# Proofs

proof_type: f_proof
decl_type: formula
library: exact_real_arith
theory: sincosx
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp)
   (lemma "lemma_div2n" ("x" "pi" "cx" "cauchy_pi" "n" "2"))
   (rewrite "pi_lemma")
   (lemma "lemma_div2n" ("x" "1" "cx" "cauchy_int(1)" "n" "1"))
   (rewrite "int_lemma")
   (expand "div2n")
   (rewrite "expt_x1")
   (rewrite "expt_x2")
   (lemma "sqrt_lemma"
    ("nnx" "1/2" "nncx" "cauchy_div2n(cauchy_int(1), 1)"))
   (("1"
     (assert)
     (hide -2)
     (lemma "div_lemma"
      ("x"
       "x!1"
       "cx"
       "cx!1"
       "nzy"
       "pi/4"
       "nzcy"
       "cauchy_div2n(cauchy_pi, 2)"))
     (("1"
       (rewrite "div_div1")
       (assert)
       (name "PI4" "cauchy_div2n(cauchy_pi, 2)")
       (replace -1)
       (name "S" "round(cauchy_div(cx!1,PI4)(2)/4)")
       (copy -3)
       (expand "cauchy_prop" -1)
       (inst - "2")
       (rewrite "expt_x2")
       (flatten)
       (expand "round")
       (typepred "floor(1 / 2 + cauchy_div(cx!1, PI4)(2) / 4)")
       (replace -5)
       (name-replace "DIV" "cauchy_div(cx!1, PI4)(2)")
       (case "4*x!1/pi-3/4<S&S<4*x!1/pi+3/4")
       (("1"
         (flatten)
         (lemma "mul_lemma"
          ("x" "pi/4" "cx" "PI4" "y" "S" "cy" "cauchy_int(S)"))
         (rewrite "int_lemma")
         (assert)
         (lemma "sub_lemma"
          ("x"
           "x!1"
           "cx"
           "cx!1"
           "y"
           "pi/4*S"
           "cy"
           "cauchy_mul(PI4, cauchy_int(S))"))
         (assert)
         (case "-3*pi/16<x!1 - pi / 4 * S&x!1 - pi / 4 * S<3*pi/16")
         (("1"
           (flatten)
           (lemma "pi_bnds")
           (flatten)
           (name "CY" "cauchy_sub(cx!1, cauchy_mul(PI4, cauchy_int(S)))")
           (replace -1)
           (lemma "sin_dr_lemma" ("sx" "x!1 - pi / 4 * S" "csx" "CY"))
           (("1"
             (lemma "cos_dr_lemma" ("sx" "x!1 - pi / 4 * S" "csx" "CY"))
             (("1"
               (assert)
               (expand "cauchy_cos")
               (name-replace "SQRT_"
                "cauchy_sqrt(cauchy_div2n(cauchy_int(1), 1))")
               (expand "DIV")
               (expand "round")
               (replace -17)
               (replace -16)
               (replace -3)
               (name-replace "SIN_" "cauchy_sin_dr(CY)")
               (name-replace "COS_" "cauchy_cos_dr(CY)")
               (hide -3 -8 -9 -12 -13 -14 -15 -17 -18 -20 -21)
               (rewrite "remx_def")
               (typepred "rem(8)(S)")
               (skosimp)
               (replace -2 -3)
               (replace -2 -4)
               (lemma "sin_period" ("a" "x!1-rem(8)(S)*pi/4" "j" "-q!1"))
               (lemma "cos_period" ("a" "x!1-rem(8)(S)*pi/4" "j" "-q!1"))
               (replace -1 * rl)
               (replace -2 * rl)
               (hide -1 -2)
               (rewrite "sin_minus")
               (rewrite "cos_minus")
               (case-replace "rem(8)(S)=0")
               (("1" (rewrite "sin_0") (rewrite "cos_0") (assert))
                ("2"
                 (case "1/sqrt(2)=sqrt(1/2)")
                 (("1"
                   (case "(-1)/sqrt(2)=-sqrt(1/2)")
                   (("1"
                     (case-replace "rem(8)(S) = 1")
                     (("1"
                       (assert)
                       (rewrite "cos_pi4")
                       (rewrite "sin_pi4")
                       (replace -3)
                       (lemma "sub_lemma"
                        ("x"
                         "cos(x!1) * sqrt(1 / 2) + sin(x!1) * sqrt(1 / 2)"
                         "cx"
                         "COS_"
                         "y"
                         "sin(x!1) * sqrt(1 / 2) - sqrt(1 / 2) * cos(x!1)"
                         "cy"
                         "SIN_"))
                       (assert)
                       (lemma "mul_lemma"
                        ("x"
                         "sqrt(1 / 2)"
                         "cx"
                         "SQRT_"
                         "y"
                         "2*cos(x!1) * sqrt(1 / 2)"
                         "cy"
                         "cauchy_sub(COS_, SIN_)"))
                       (assert)
                       (rewrite "associative_mult" -1 :dir rl)
                       (rewrite "sq_rew")
                       (assert))
                      ("2"
                       (case-replace "rem(8)(S)=2")
                       (("1"
                         (assert)
                         (rewrite "cos_pi2")
                         (rewrite "sin_pi2")
                         (assert)
                         (lemma "neg_lemma"
                          ("x" "-cos(x!1)" "cx" "SIN_"))
                         (assert))
                        ("2"
                         (case-replace "rem(8)(S)=3")
                         (("1"
                           (assert)
                           (lemma "add_lemma"
                            ("x"
                             "cos(x!1) * -sqrt(1 / 2) + sin(x!1) * sqrt(1 / 2)"
                             "cx"
                             "COS_"
                             "y"
                             "sin(x!1) * -sqrt(1 / 2) - sqrt(1 / 2) * cos(x!1)"
                             "cy"
                             "SIN_"))
                           (assert)
                           (lemma "mul_lemma"
                            ("x"
                             "sqrt(1/2)"
                             "cx"
                             "SQRT_"
                             "y"
                             "-2*cos(x!1)*sqrt(1/2)"
                             "cy"
                             "cauchy_add(COS_, SIN_)"))
                           (assert)
                           (rewrite "commutative_mult" -1)
                           (rewrite "commutative_mult" -1)
                           (rewrite "commutative_mult" -1)
                           (assert)
                           (case-replace
                            "sqrt(1 / 2) * (-2 * (sqrt(1 / 2) * cos(x!1))) = -2*sq(sqrt(1/2))*cos(x!1)")
                           (("1"
                             (hide -1)
                             (assert)
                             (lemma "neg_lemma"
                              ("x"
                               "-cos(x!1)"
                               "cx"
                               "cauchy_mul(SQRT_, cauchy_add(COS_, SIN_))"))
                             (assert)
                             (lemma "add_lemma"
                              ("x"
                               "cos(x!1) * cos(3 * pi / 4) + sin(x!1) * sin(3 * pi / 4)"
                               "cx"
                               "COS_"
                               "y"
                               "sin(x!1) * cos(3 * pi / 4) - sin(3 * pi / 4) * cos(x!1)"
                               "cy"
                               "SIN_"))
                             (assert)
                             (rewrite "cos_3pi4")
                             (rewrite "sin_3pi4")
                             (lemma "mul_lemma"
                              ("x"
                               "sqrt(1 / 2)"
                               "cx"
                               "SQRT_"
                               "y"
                               "cos(x!1) * (-1 / sqrt(2)) + sin(x!1) * (-1 / sqrt(2)) +
                                                                             sin(x!1) * (1 / sqrt(2))
                                                                             - 1 / sqrt(2) * cos(x!1)"
                               "cy"
                               "cauchy_add(COS_, SIN_)"))
                             (assert))
                            ("2"
                             (expand "sq" 1)
                             (hide-all-but 1)
                             (assert))))
                          ("2"
                           (case-replace "rem(8)(S)=4")
                           (("1"
                             (assert)
                             (rewrite "cos_pi")
                             (rewrite "sin_pi")
                             (lemma "neg_lemma"
                              ("x" "-cos(x!1)" "cx" "COS_"))
                             (assert))
                            ("2"
                             (case-replace "rem(8)(S)=5")
                             (("1"
                               (assert)
                               (lemma "sub_lemma"
                                ("x"
                                 "cos(x!1) * cos(5 * pi / 4) + sin(x!1) * sin(5 * pi / 4)"
                                 "cx"
                                 "COS_"
                                 "y"
                                 "sin(x!1) * cos(5 * pi / 4) - sin(5 * pi / 4) * cos(x!1)"
                                 "cy"
                                 "SIN_"))
                               (assert)
                               (rewrite "cos_5pi4")
                               (rewrite "sin_5pi4")
                               (replace -3)
                               (assert)
                               (lemma "mul_lemma"
                                ("x"
                                 "sqrt(1/2)"
                                 "cx"
                                 "SQRT_"
                                 "y"
                                 "sqrt(1/2)*-2*cos(x!1)"
                                 "cy"
                                 "cauchy_sub(COS_, SIN_)"))
                               (rewrite "associative_mult" -1)
                               (assert)
                               (rewrite "associative_mult" -1 :dir rl)
                               (rewrite "sq_rew" -1)
                               (lemma "neg_lemma"
                                ("x"
                                 "-cos(x!1)"
                                 "cx"
                                 "cauchy_mul(SQRT_, cauchy_sub(COS_, SIN_))"))
                               (assert))
                              ("2"
                               (case-replace "rem(8)(S)=6")
                               (("1"
                                 (assert)
                                 (rewrite "sin_3pi2")
                                 (rewrite "cos_3pi2")
                                 (assert))
                                ("2"
                                 (case-replace "rem(8)(S)=7")
                                 (("1"
                                   (assert)
                                   (lemma
                                    "cos_minus"
                                    ("a" "2*pi" "b" "pi/4"))
                                   (lemma
                                    "sin_minus"
                                    ("a" "2*pi" "b" "pi/4"))
                                   (rewrite "sin_pi4")
                                   (rewrite "cos_pi4")
                                   (rewrite "cos_2pi")
                                   (rewrite "sin_2pi")
                                   (assert)
                                   (replace -5)
                                   (replace -1)
                                   (replace -2)
                                   (hide -1 -2 1 2 3 4 5 6 7)
                                   (lemma
                                    "add_lemma"
                                    ("x"
                                     "cos(x!1) * sqrt(1 / 2) + sin(x!1) * (-1 * sqrt(1 / 2))"
                                     "cx"
                                     "COS_"
                                     "y"
                                     "sin(x!1) * sqrt(1 / 2) + sqrt(1 / 2) * cos(x!1)"
                                     "cy"
                                     "SIN_"))
                                   (assert)
                                   (assert)
                                   (lemma
                                    "mul_lemma"
                                    ("x"
                                     "sqrt(1/2)"
                                     "cx"
                                     "SQRT_"
                                     "y"
                                     "2*cos(x!1)*sqrt(1/2)"
                                     "cy"
                                     "cauchy_add(COS_, SIN_)"))
                                   (assert)
                                   (rewrite
                                    "associative_mult"
                                    -1
                                    :dir
                                    rl)
                                   (rewrite "sq_rew")
                                   (assert))
                                  ("2" (assert))))))))))))))))
                    ("2" (assert))))
                  ("2"
                   (hide-all-but 1)
                   (lemma "sq_eq" ("nna" "1/sqrt(2)" "nnb" "sqrt(1/2)"))
                   (rewrite "sq_div")
                   (assert))))))
              ("2" (assert))))
            ("2" (assert))
            ("3"
             (assert)
             (expand "cauchy_real_3pi16?")
             (inst + "x!1 - pi / 4 * S"))))
          ("2"
           (assert)
           (hide-all-but (-3 -4 1))
           (lemma "pi_bnds")
           (flatten)
           (lemma "both_sides_times_pos_lt1"
            ("pz" "pi/4" "x" "4 * x!1 / pi - 3 / 4" "y" "S"))
           (lemma "both_sides_times_pos_lt1"
            ("pz" "pi/4" "y" "4 * x!1 / pi + 3 / 4" "x" "S"))
           (assert))))
        ("2" (assert))))
      ("2" (expand "cauchy_nzreal?") (inst + "pi/4"))))
    ("2" (expand "cauchy_nnreal?") (inst + "1/2"))))


proof_type: t_proof
decl_type: tcc
library: exact_real_arith
theory: sincosx
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (expand "cauchy_real_3pi16?")
   (inst + "0")
   (("1" (expand "cauchy_prop") (propax))
    ("2" (lemma "pi_bnds") (flatten) (assert))))


proof_type: j_proof
decl_type: tcc
library: exact_real_arith
theory: sincosx
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp)
   (typepred "x!1")
   (expand "cauchy_real?")
   (expand "cauchy_nnsreal?")
   (skosimp)
   (inst + "x!2"))


proof_type: j_proof
decl_type: tcc
library: exact_real_arith
theory: sincosx
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp)
   (typepred "x!1")
   (expand "cauchy_real_3pi16?")
   (expand "cauchy_real?")
   (skosimp)
   (inst + "x!2"))


proof_type: t_proof
decl_type: tcc
library: exact_real_arith
theory: sincosx
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (expand "cauchys_real?")
   (lemma "sin_series_lemma")
   (expand "cauchys_prop")
   (inst + "sin_term(1)"))


proof_type: t_proof
decl_type: tcc
library: exact_real_arith
theory: sincosx
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp)
   (typepred "csnx!1")
   (expand "cauchy_nnsreal?")
   (skosimp)
   (typepred "x!1")
   (expand "cauchy_real?")
   (expand "<=" -1)
   (split -1)
   (("1"
     (lemma "powerseries_lemma"
      ("x"
       "x!1"
       "cx"
       "csnx!1"
       "xs"
       "sin_term(1)"
       "cxs"
       "cauchy_sin_series"))
     (replace -4)
     (lemma "sin_series_lemma")
     (replace -1)
     (hide -1)
     (inst + "sin(sqrt(x!1))/sqrt(x!1)")
     (("1"
       (hide -4)
       (expand "cauchy_prop")
       (skosimp)
       (inst - "2+p!1")
       (inst - "2+p!1")
       (name-replace "CPS"
        "cauchy_powerseries(csnx!1, cauchy_sin_series, 2 + p!1)(2 + p!1)")
       (flatten)
       (expand "powerseries")
       (lemma "sin_approx_sin" ("a" "sqrt(x!1)" "n" "2+p!1"))
       (expand "sin_approx")
       (expand "sin_term" -1 2)
       (rewrite "abs_div")
       (rewrite "abs_mult")
       (expand "abs" -1 4)
       (assert)
       (typepred "factorial(7 + 2 * p!1)")
       (assert)
       (hide -1)
       (rewrite "abs_expt" -1 :dir rl)
       (expand "abs" -1 2)
       (rewrite "expt_1i")
       (lemma "expt_plus" ("n0x" "sqrt(x!1)" "i" "1" "j" "6+2*p!1"))
       (lemma "expt_times" ("n0x" "sqrt(x!1)" "i" "2" "j" "3+p!1"))
       (rewrite "expt_x2")
       (rewrite "sq_rew")
       (replace -1 -2)
       (rewrite "expt_x1")
       (replace -2 -3)
       (expand "abs" -3 2)
       (assert)
       (hide -1 -2)
       (case-replace
        "sigma(0, 2 + p!1,
                                     LAMBDA (i:nat):
                                       IF i = 0 THEN sin_term(1)(i)
                                       ELSE sin_term(1)(i) * x!1 ^ i
                                       ENDIF)=sigma(0, 2 + p!1, sin_term(sqrt(x!1)))/sqrt(x!1)")
       (("1"
         (hide -1)
         (lemma "div_mult_pos_le1"
          ("py"
           "sqrt(x!1)"
           "x"
           "x!1 ^ (3 + p!1) / factorial(7 + 2 * p!1)"
           "z"
           "abs(sin(sqrt(x!1)) - sigma(0, 2 + p!1, sin_term(sqrt(x!1))))"))
         (replace -1 -2 rl)
         (hide -1)
         (lemma "abs_div"
          ("x"
           "sin(sqrt(x!1)) - sigma(0, 2 + p!1, sin_term(sqrt(x!1)))"
           "n0y"
           "sqrt(x!1)"))
         (expand "abs" -1 3)
         (replace -1 -2 rl)
         (assert)
         (hide -1)
         (rewrite "minus_div2" -1 :dir rl)
         (name-replace "SIN_APPROX"
          "sigma(0, 2 + p!1, sin_term(sqrt(x!1))) / sqrt(x!1)")
         (name-replace "SIN_" "sin(sqrt(x!1)) / sqrt(x!1)")
         (case "abs(SIN_APPROX-CPS/2 ^ (2 + p!1))<2^-(2+p!1)")
         (("1"
           (case "abs(SIN_-CPS / 2 ^ (2 + p!1)) < 2 ^ -(1 + p!1)")
           (("1"
             (hide -2 -3 -4 -5)
             (expand "round")
             (typepred "floor(1 / 2 + CPS / 4)")
             (name-replace "RR" "floor(1 / 2 + CPS / 4)")
             (rewrite "expt_plus")
             (rewrite "expt_x2")
             (rewrite "expt_inverse")
             (rewrite "expt_plus")
             (rewrite "expt_x1")
             (name-replace "P2" "2^p!1")
             (lemma "div_mult_pos_lt2"
              ("py" "P2" "z" "1/2" "x" "abs(SIN_ - CPS / (4 * P2))"))
             (replace -1 -4)
             (hide -1)
             (lemma "abs_mult" ("x" "SIN_ - CPS / (4 * P2)" "y" "P2"))
             (expand "abs" -1 3)
             (assert))
            ("2"
             (hide 2)
             (case "x!1 ^ (3 + p!1) / factorial(7 + 2 * p!1) < 2^-(2+p!1)")
             (("1"
               (name-replace "DRL1"
                "x!1 ^ (3 + p!1) / factorial(7 + 2 * p!1)")
               (case-replace "2 ^ -(1 + p!1)=2*2 ^ -(2 + p!1)")
               (("1"
                 (rewrite "expt_inverse" 1)
                 (name-replace "P2" "2 ^ (2 + p!1)")
                 (hide-all-but (-2 -3 -4 1))
                 (grind))
                ("2"
                 (hide-all-but 1)
                 (rewrite "expt_inverse")
                 (rewrite "expt_inverse")
                 (rewrite "expt_plus")
                 (rewrite "expt_plus")
                 (rewrite "expt_x1")
                 (rewrite "expt_x2")
                 (assert))))
              ("2"
               (hide-all-but (-5 -6 1))
               (lemma "both_sides_expt_pos_lt"
                ("px" "x!1" "py" "1/2" "pm" "3+p!1"))
               (assert)
               (rewrite "div_mult_pos_lt1")
               (lemma "inv_expt")
               (inst -1 "3+p!1" "2")
               (replaces -1)
               (rewrite "expt_inverse" 1)
               (name-replace "DRL1" "x!1 ^ (3 + p!1)")
               (rewrite "expt_plus")
               (rewrite "expt_plus")
               (rewrite "expt_x2")
               (rewrite "expt_x3")
               (assert)
               (lemma "factorial_incr" ("k" "3" "n" "7 + 2 * p!1"))
               (rewrite "factorial_3")
               (assert)
               (lemma "both_sides_times_pos_lt1"
                ("pz"
                 "1/(4*2^p!1)"
                 "x"
                 "1/2"
                 "y"
                 "factorial(7 + 2 * p!1)"))
               (assert))))))
          ("2"
           (hide 2 -1)
           (lemma "div_mult_pos_lt1"
            ("py" "2^(2+p!1)" "x" "SIN_APPROX" "z" "CPS - 1"))
           (lemma "div_mult_pos_lt2"
            ("py" "2^(2+p!1)" "x" "SIN_APPROX" "z" "CPS+1"))
           (assert)
           (rewrite "expt_inverse" 1)
           (name-replace "P2" "2^(2+p!1)")
           (grind))))
        ("2"
         (hide-all-but (-4 -5 1))
         (case-replace
          "(LAMBDA (i_1: nat):
                                            IF i_1 = 0 THEN sin_term(1)(i_1)
                                            ELSE sin_term(1)(i_1) * x!1 ^ i_1
                                            ENDIF)
                                     =(LAMBDA (i: nat): 1 / sqrt(x!1) * sin_term(sqrt(x!1))(i))")
         (("1"
           (hide -1 2)
           (assert)
           (rewrite "sigma_scal")
           (expand "sin_term")
           (assert))
          ("2"
           (hide 2)
           (apply-extensionality :hide? t)
           (expand "sin_term")
           (typepred "factorial(1 + 2 * x!2)")
           (name-replace "FACTORIAL" "factorial(1 + 2 * x!2)")
           (rewrite "expt_1i")
           (rewrite "expt_plus")
           (name-replace "SIGN" "(-1) ^ x!2")
           (rewrite "expt_x1")
           (case-replace "sqrt(x!1) ^ (2 * x!2)=x!1^x!2")
           (("1"
             (case-replace "x!2=0")
             (("1"
               (assert)
               (rewrite "expt_x0")
               (replace -2 1 rl)
               (assert))
              ("2" (assert))))
            ("2"
             (hide-all-but (-2 -3 1))
             (lemma "expt_times" ("i" "2" "j" "x!2" "n0x" "sqrt(x!1)"))
             (rewrite "expt_x2")
             (rewrite "sq_rew"))))))))
      ("2" (expand "/=" 1) (lemma "sqrt_eq_0" ("nnx" "x!1")) (assert))))
    ("2"
     (replace -1 * rl)
     (hide -1 -2)
     (inst + "1")
     (lemma "powerseries_lemma"
      ("x"
       "0"
       "cx"
       "csnx!1"
       "xs"
       "sin_term(1)"
       "cxs"
       "cauchy_sin_series"))
     (lemma "sin_series_lemma")
     (replace -1)
     (replace -3)
     (hide -1 -3)
     (expand "cauchy_prop")
     (skosimp)
     (inst - "2+p!1")
     (inst - "2+p!1")
     (flatten)
     (name-replace "CPS"
      "cauchy_powerseries(csnx!1, cauchy_sin_series, 2 + p!1)(2 + p!1)")
     (case-replace "powerseries(0, sin_term(1), 2 + p!1)=1")
     (("1"
       (hide -1)
       (rewrite "expt_plus")
       (rewrite "expt_x2")
       (expand "round")
       (typepred "floor(1 / 2 + CPS / 4)")
       (name-replace "RR" "floor(1 / 2 + CPS / 4)")
       (lemma "div_mult_pos_lt2" ("z" "1+CPS" "x" "2^p!1" "py" "4"))
       (lemma "div_mult_pos_lt1" ("z" "CPS-1" "x" "2^p!1" "py" "4"))
       (assert))
      ("2"
       (hide-all-but 1)
       (expand "powerseries")
       (case-replace
        "(LAMBDA (i:nat): IF i = 0 THEN sin_term(1)(i) ELSE sin_term(1)(i) * 0 ^ i ENDIF)=(LAMBDA (i:nat): IF i = 0 THEN 1 ELSE 0 ENDIF)")
       (("1"
         (hide -1)
         (assert)
         (rewrite "sigma_first")
         (lemma "sigma_eq[nat]"
          ("low"
           "1"
           "high"
           "2+p!1"
           "F"
           "(LAMBDA (i: nat): IF i = 0 THEN 1 ELSE 0 ENDIF)"
           "G"
           "(LAMBDA (i:nat): 0)"))
         (split -1)
         (("1" (replace -1) (hide -1) (rewrite "sigma_zero") (assert))
          ("2" (assert))))
        ("2"
         (hide 2)
         (grind)
         (apply-extensionality :hide? t)
         (case-replace "x!2=0")
         (("1" (grind)) ("2" (assert))))))))))


proof_type: t_proof
decl_type: tcc
library: exact_real_arith
theory: sincosx
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (expand "cauchys_real?")
   (inst + "cos_term(1)")
   (expand "cauchys_prop")
   (skosimp)
   (rewrite "cos_series_lemma"))


proof_type: t_proof
decl_type: tcc
library: exact_real_arith
theory: sincosx
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp)
   (typepred "csnx!1")
   (expand "cauchy_nnsreal?")
   (skosimp)
   (expand "cauchy_real?")
   (typepred "x!1")
   (inst + "cos(sqrt(x!1))")
   (lemma "powerseries_lemma"
    ("x"
     "x!1"
     "cx"
     "csnx!1"
     "cxs"
     "cauchy_cos_series"
     "xs"
     "cos_term(1)"))
   (lemma "cos_series_lemma")
   (replace -1 -2)
   (replace -5 -2)
   (hide -1 -5)
   (expand "cauchy_prop")
   (skosimp)
   (inst - "2+p!1")
   (inst - "2+p!1")
   (flatten)
   (case-replace
    "powerseries(x!1, cos_term(1), 2 + p!1)=cos_approx(sqrt(x!1),2+p!1)")
   (("1"
     (hide -1)
     (name-replace "CPS"
      "cauchy_powerseries(csnx!1, cauchy_cos_series, 2 + p!1)(2 + p!1)")
     (lemma "cos_approx_cos" ("a" "sqrt(x!1)" "n" "2+p!1"))
     (name-replace "COS_APPROX" "cos_approx(sqrt(x!1), 2 + p!1)")
     (name-replace "COS_" "cos(sqrt(x!1))")
     (expand "cos_term")
     (rewrite "abs_div")
     (rewrite "abs_mult")
     (expand "abs" -1 4)
     (typepred "factorial(6 + 2 * p!1)")
     (assert)
     (hide -1)
     (lemma "abs_expt" ("n0x" "-1" "i" "3+p!1"))
     (expand "abs" -1 1)
     (rewrite "expt_1i" -1)
     (replace -1 -2 rl)
     (hide -1)
     (lemma "expt_times" ("n0x" "sqrt(x!1)" "i" "2" "j" "3+p!1"))
     (("1"
       (rewrite "expt_x2")
       (rewrite "sq_rew")
       (replace -1)
       (hide -1)
       (expand "abs" -1 2)
       (assert)
       (lemma "nnreal_exp" ("x" "x!1" "i" "3+p!1"))
       (assert)
       (case "abs(COS_APPROX-CPS/2^(2+p!1)) < 1/2^(2+p!1)")
       (("1"
         (case "x!1 ^ (3 + p!1)/ factorial(6 + 2 * p!1) < 2^-(2+p!1)")
         (("1"
           (rewrite "expt_inverse" -2 :dir rl)
           (case "abs(COS_*2^p!1-CPS/4) < 1/2")
           (("1"
             (hide-all-but (-1 -8 -9 1))
             (expand "round")
             (typepred "floor(1 / 2 + CPS / 4)")
             (name-replace "RR" "floor(1 / 2 + CPS / 4)")
             (name-replace "DRL1" "COS_ * 2 ^ p!1")
             (grind))
            ("2"
             (hide 2)
             (lemma "abs_mult" ("x" "COS_-CPS/2^(2+p!1)" "y" "2^p!1"))
             (expand "abs" -1 3)
             (rewrite "expt_plus" -1)
             (rewrite "expt_x2")
             (lemma "div_cancel1" ("n0z" "2^p!1" "x" "CPS/4"))
             (rewrite "div_div2" -1)
             (replace -1)
             (replace -2 1)
             (hide -1 -2)
             (lemma "div_mult_pos_lt2"
              ("z"
               "1/2"
               "py"
               "2^p!1"
               "x"
               "abs(COS_ - (CPS / (4 * 2 ^ p!1)))"))
             (replace -1 1 rl)
             (hide -1)
             (case "abs(COS_ - (CPS / (4 * 2 ^ p!1))) < 2*2^-(2+p!1)")
             (("1"
               (case-replace "2 * 2 ^ -(2 + p!1)=1/2 / 2 ^ p!1")
               (hide-all-but 1)
               (rewrite "expt_inverse")
               (rewrite "expt_plus")
               (rewrite "expt_x2")
               (assert))
              ("2"
               (hide 2)
               (name-replace "DRL1" "CPS / (4 * 2 ^ p!1)")
               (name-replace "DRL2"
                "x!1 ^ (3 + p!1) / factorial(6 + 2 * p!1)")
               (assert)
               (name-replace "DRL3" "2 ^ (-(2 + p!1))")
               (hide-all-but (-1 -2 -4 1))
               (grind))))))
          ("2"
           (hide-all-but (-6 -7 1))
           (expand "<=" -1)
           (split)
           (("1"
             (lemma "both_sides_expt_pos_lt"
              ("px" "x!1" "pm" "2+p!1" "py" "1/2"))
             (("1"
               (assert)
               (lemma "inv_expt")
               (inst -1 "(2+p!1)" "2")
               (replaces -1)
               (rewrite "expt_inverse" 1)
               (assert)
               (lemma "expt_plus" ("n0x" "2" "i" "1" "j" "2+p!1"))
               (rewrite "expt_x1")
               (rewrite "div_mult_pos_lt1" 1)
               (lemma "factorial_incr" ("k" "2" "n" "6 + 2 * p!1"))
               (assert)
               (rewrite "factorial_2")
               (assert)
               (lemma "expt_plus" ("n0x" "x!1" "i" "1" "j" "2+p!1"))
               (rewrite "expt_x1")
               (replace -1)
               (assert)
               (lemma "lt_times_lt_pos1"
                ("px"
                 "x!1"
                 "y"
                 "1/2"
                 "nnz"
                 "x!1 ^ (2 + p!1)"
                 "w"
                 "1 / 2 ^ (2 + p!1)"))
               (assert)
               (name-replace "LHS" "x!1 * x!1 ^ (2 + p!1)")
               (lemma "both_sides_times_pos_le1"
                ("pz"
                 "1 / 2 * (1 / 2 ^ (2 + p!1))"
                 "x"
                 "2"
                 "y"
                 "factorial(6 + 2 * p!1)"))
               (assert))
              ("2" (assert))))
            ("2"
             (replace -1 * rl)
             (expand "^" 1 1)
             (expand "expt")
             (assert))))))
        ("2"
         (hide-all-but (-3 -4 1))
         (rewrite "div_mult_pos_lt2" 1)
         (lemma "abs_mult"
          ("x" "COS_APPROX - CPS / 2 ^ (2 + p!1)" "y" "2 ^ (2 + p!1)"))
         (expand "abs" -1 3)
         (rewrite "div_cancel1")
         (replace -1 1 rl)
         (hide -1)
         (name-replace "P2" "2^(2+p!1)")
         (grind))))
      ("2"
       (expand "/=" 1)
       (replace -1)
       (expand "COS_")
       (replace -1)
       (rewrite "cos_0")
       (expand "COS_APPROX")
       (replace -1)
       (rewrite "cos_approx_a0")
       (hide-all-but (-3 -4 1 -1))
       (expand "round")
       (typepred "floor(1 / 2 + CPS / 4)")
       (name-replace "RR" "floor(1 / 2 + CPS / 4)")
       (lemma "both_sides_div_pos_lt1"
        ("pz" "4" "x" "CPS-1" "y" "2^(2+p!1)"))
       (lemma "both_sides_div_pos_lt1"
        ("pz" "4" "y" "CPS+1" "x" "2^(2+p!1)"))
       (flatten)
       (hide -1 -3)
       (split -1)
       (("1"
         (split -2)
         (("1" (rewrite "expt_plus") (rewrite "expt_x2") (assert))
          ("2" (assert))))
        ("2" (assert))))))
    ("2"
     (hide-all-but (-3 -4 1))
     (expand "cos_approx")
     (expand "powerseries")
     (expand "cos_term")
     (case-replace
      "(LAMBDA (i:nat):
                            IF i = 0 THEN 1
                            ELSE (-1) ^ i * 1 ^ (2 * i) / factorial(2 * i) * x!1 ^ i
                            ENDIF)=(LAMBDA (n:nat):
                             IF n = 0 THEN 1
                             ELSE (-1) ^ n * sqrt(x!1) ^ (2 * n) / factorial(2 * n)
                             ENDIF)")
     (hide 2)
     (apply-extensionality :hide? t)
     (case-replace "x!2=0")
     (assert)
     (rewrite "expt_1i")
     (rewrite "expt_times")
     (("1" (rewrite "expt_x2") (rewrite "sq_rew") (assert))
      ("2"
       (expand "/=" 1)
       (replace -1)
       (lemma "sqrt_eq_0" ("nnx" "x!1"))
       (split -1)
       (("1"
         (replace -1)
         (expand "^" 2 4)
         (expand "^" 2 2)
         (expand "expt")
         (assert))
        ("2" (propax))))))))


proof_type: t_proof
decl_type: tcc
library: exact_real_arith
theory: sincosx
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp)
   (typepred "csx!1")
   (expand "cauchy_real_3pi16?")
   (skosimp)
   (typepred "x!1")
   (lemma "mul_lemma" ("x" "x!1" "y" "x!1" "cx" "csx!1" "cy" "csx!1"))
   (replace -4)
   (rewrite "sq_rew")
   (lemma "sq_lt" ("nna" "abs(x!1)" "nnb" "3*pi/16"))
   (flatten)
   (hide -1)
   (split -1)
   (("1"
     (rewrite "sq_abs")
     (case "sq(3 * pi / 16)<1/2")
     (("1" (expand "cauchy_nnsreal?") (inst + "sq(x!1)") (assert))
      ("2"
       (hide-all-but 1)
       (lemma "pi_bnds")
       (flatten)
       (lemma "sq_lt" ("nna" "pi" "nnb" "319/100"))
       (grind))))
    ("2" (hide-all-but (-2 -3 1)) (grind))))


proof_type: t_proof
decl_type: tcc
library: exact_real_arith
theory: sincosx
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp)
   (hide -1)
   (lemma "lemma_div2n" ("n" "1" "x" "1" "cx" "cauchy_int(1)"))
   (rewrite "int_lemma")
   (expand "cauchy_nnreal?")
   (inst + "1/2")
   (expand "div2n")
   (rewrite "expt_x1"))


proof_type: t_proof
decl_type: tcc
library: exact_real_arith
theory: sincosx
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (replace -1)
   (hide-all-but 1)
   (lemma "lemma_div2n" ("n" "2" "x" "pi" "cx" "cauchy_pi"))
   (rewrite "pi_lemma")
   (expand "div2n")
   (rewrite "expt_x2")
   (expand "cauchy_nzreal?")
   (inst + "pi/4"))


proof_type: t_proof
decl_type: tcc
library: exact_real_arith
theory: sincosx
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (replace -5)
   (hide -5 -4 -2)
   (lemma "lemma_div2n" ("n" "2" "x" "pi" "cx" "cauchy_pi"))
   (rewrite "pi_lemma")
   (expand "div2n")
   (rewrite "expt_x2")
   (replace -2 * rl)
   (hide -2)
   (typepred "cx!1")
   (expand "cauchy_real?")
   (skosimp)
   (lemma "div_lemma" ("x" "x!1" "cx" "cx!1" "nzy" "pi/4" "nzcy" "p2!1"))
   (assert)
   (rewrite "div_div1")
   (lemma "mul_lemma"
    ("x" "pi/4" "y" "s!1" "cx" "p2!1" "cy" "cauchy_int(s!1)"))
   (rewrite "int_lemma")
   (assert)
   (lemma "sub_lemma"
    ("x"
     "x!1"
     "cx"
     "cx!1"
     "y"
     "pi / 4 * s!1"
     "cy"
     "cauchy_mul(p2!1, cauchy_int(s!1))"))
   (assert)
   (expand "cauchy_real_3pi16?")
   (inst + "x!1 - pi / 4 * s!1")
   (hide-all-but (1 -6 -3))
   (expand "cauchy_prop")
   (inst - "2")
   (flatten)
   (rewrite "expt_x2")
   (name-replace "CP2" "cauchy_div(cx!1, p2!1)(2)")
   (expand "round")
   (lemma "floor_def" ("x" "1 / 2 + CP2 / 4"))
   (flatten)
   (replace -5 * rl)
   (lemma "both_sides_times_pos_le1"
    ("x" "s!1" "y" "1 / 2 + CP2 / 4" "pz" "pi/4"))
   (lemma "both_sides_times_pos_lt1"
    ("y" "s!1" "x" "CP2 / 4 -1/2" "pz" "pi/4"))
   (assert)
   (name-replace "SP4" "s!1 * (pi / 4)")
   (lemma "both_sides_times_pos_lt1"
    ("x" "CP2*pi/16 -pi/16" "y" "x!1" "pz" "16/pi"))
   (assert)
   (lemma "both_sides_times_pos_lt1"
    ("y" "CP2*pi/16 +pi/16" "x" "x!1" "pz" "16/pi"))
   (assert))


proof_type: f_proof
decl_type: formula
library: exact_real_arith
theory: trigx
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp)
   (expand "sec")
   (expand "cauchy_sec")
   (lemma "cos_lemma" ("x" "ncx!1" "cx" "cncx!1"))
   (assert)
   (lemma "inv_lemma" ("nzx" "cos(ncx!1)" "nzcx" "cauchy_cos(cncx!1)"))
   (assert))


proof_type: f_proof
decl_type: formula
library: exact_real_arith
theory: trigx
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp)
   (expand "cosec")
   (expand "cauchy_cosec")
   (lemma "sin_lemma" ("x" "nsx!1" "cx" "cnsx!1"))
   (assert)
   (lemma "inv_lemma" ("nzx" "sin(nsx!1)" "nzcx" "cauchy_sin(cnsx!1)"))
   (assert))


proof_type: f_proof
decl_type: formula
library: exact_real_arith
theory: trigx
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp)
   (expand "tan")
   (expand "cauchy_tan")
   (lemma "sin_lemma" ("x" "ncx!1" "cx" "cncx!1"))
   (lemma "cos_lemma" ("x" "ncx!1" "cx" "cncx!1"))
   (assert)
   (lemma "div_lemma"
    ("x"
     "sin(ncx!1)"
     "cx"
     "cauchy_sin(cncx!1)"
     "nzy"
     "cos(ncx!1)"
     "nzcy"
     "cauchy_cos(cncx!1)"))
   (assert))


proof_type: f_proof
decl_type: formula
library: exact_real_arith
theory: trigx
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp)
   (lemma "sin_lemma" ("x" "nsx!1" "cx" "cnsx!1"))
   (lemma "cos_lemma" ("x" "nsx!1" "cx" "cnsx!1"))
   (assert)
   (lemma "div_lemma"
    ("nzy"
     "sin(nsx!1)"
     "nzcy"
     "cauchy_sin(cnsx!1)"
     "x"
     "cos(nsx!1)"
     "cx"
     "cauchy_cos(cnsx!1)"))
   (("1" (expand "cot") (expand "cauchy_cot") (assert))
    ("2" (expand "cauchy_nzreal?") (inst + "sin(nsx!1)"))))


proof_type: t_proof
decl_type: tcc
library: exact_real_arith
theory: trigx
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (expand "cauchy_sin_nz?")
   (lemma "lemma_div2n" ("x" "pi" "cx" "cauchy_pi" "n" "1"))
   (rewrite "pi_lemma")
   (expand "div2n")
   (rewrite "expt_x1")
   (inst + "pi / 2")
   (rewrite "sin_pi2")
   (assert))


proof_type: t_proof
decl_type: tcc
library: exact_real_arith
theory: trigx
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (expand "cauchy_cos_nz?")
   (inst + "0")
   (("1"
     (expand "cauchy_prop")
     (skosimp)
     (assert)
     (expand "cauchy_zero")
     (propax))
    ("2" (rewrite "cos_0") (assert))))


proof_type: j_proof
decl_type: tcc
library: exact_real_arith
theory: trigx
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp)
   (typepred "x!1")
   (expand "cauchy_sin_nz?")
   (skosimp)
   (expand "cauchy_real?")
   (inst + "nsx!1"))


proof_type: j_proof
decl_type: tcc
library: exact_real_arith
theory: trigx
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp)
   (typepred "x!1")
   (expand "cauchy_cos_nz?")
   (skosimp)
   (expand "cauchy_real?")
   (inst + "ncx!1"))


proof_type: t_proof
decl_type: tcc
library: exact_real_arith
theory: trigx
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp)
   (typepred "cncx!1")
   (expand "cauchy_cos_nz?")
   (skosimp)
   (typepred "ncx!1")
   (expand "cauchy_nzreal?")
   (inst + "cos(ncx!1)")
   (lemma "cos_lemma" ("x" "ncx!1" "cx" "cncx!1"))
   (assert))


proof_type: t_proof
decl_type: tcc
library: exact_real_arith
theory: trigx
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp)
   (typepred "cnsx!1")
   (expand "cauchy_sin_nz?")
   (skosimp)
   (typepred "nsx!1")
   (expand "cauchy_nzreal?")
   (lemma "sin_lemma" ("x" "nsx!1" "cx" "cnsx!1"))
   (inst + "sin(nsx!1)")
   (assert))


proof_type: f_proof
decl_type: formula
library: exact_real_arith
theory: test
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (lemma "pi_lemma")
   (expand "cauchy_prop")
   (inst - "210")
   (eval-expr "2^210")
   (eval-expr "cauchy_pi(210)")
   (flatten)
   (assert))


proof_type: f_proof
decl_type: formula
library: exact_real_arith
theory: test
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (lemma "cauchy_ln2_lemma")
   (expand "cauchy_prop")
   (inst - "210")
   (eval-expr "2^210")
   (eval-expr "cauchy_ln2(210)")
   (flatten)
   (assert))


proof_type: f_proof
decl_type: formula
library: exact_real_arith
theory: test
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (lemma "exp_lemma" ("x" "1" "cx" "cauchy_int(1)"))
   (rewrite "int_lemma")
   (expand "e")
   (expand "cauchy_prop")
   (inst -1 "210")
   (eval-expr "2^210")
   (eval-expr "cauchy_exp(cauchy_int(1))(210)")
   (flatten)
   (assert))


proof_type: f_proof
decl_type: formula
library: exact_real_arith
theory: test
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (assert)
   (lemma "sqrt_lemma" ("nnx" "2" "nncx" "cauchy_int(2)"))
   (("1"
     (rewrite "int_lemma")
     (expand "cauchy_prop")
     (inst - "210")
     (eval-expr "2^210")
     (eval-expr "cauchy_sqrt(cauchy_int(2))(210)")
     (flatten)
     (assert))
    ("2"
     (hide 2)
     (expand "cauchy_nnreal?")
     (inst + "2")
     (rewrite "int_lemma"))))


proof_type: f_proof
decl_type: formula
library: exact_real_arith
theory: asinx
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp)
   (expand "cauchy_asin")
   (copy -1)
   (expand "cauchy_prop" -1)
   (inst - "0")
   (rewrite "expt_x0")
   (flatten -1)
   (name-replace "TT" "cx!1(0)")
   (lemma "mul_lemma" ("x" "x!1" "y" "x!1" "cx" "cx!1" "cy" "cx!1"))
   (rewrite "sq_rew")
   (assert)
   (lemma "sub_lemma"
    ("x"
     "1"
     "y"
     "sq(x!1)"
     "cx"
     "cauchy_int(1)"
     "cy"
     "cauchy_mul(cx!1, cx!1)"))
   (rewrite "int_lemma")
   (assert)
   (hide -2)
   (case "1-sq(x!1)>=0")
   (("1"
     (lemma "sqrt_lemma"
      ("nnx"
       "1-sq(x!1)"
       "nncx"
       "cauchy_sub(cauchy_int(1), cauchy_mul(cx!1, cx!1))"))
     (("1"
       (assert)
       (name-replace "CY"
        "cauchy_sqrt(cauchy_sub(cauchy_int(1),
                                                 cauchy_mul(cx!1, cx!1)))")
       (hide -3)
       (lemma "pi_lemma")
       (lemma "lemma_div2n" ("x" "pi" "cx" "cauchy_pi" "n" "1"))
       (assert)
       (name-replace "PI2" "cauchy_div2n(cauchy_pi, 1)")
       (expand "div2n")
       (rewrite "expt_x1")
       (hide -2)
       (case-replace "TT=0")
       (("1"
         (case "sq(x!1)<1")
         (("1"
           (lemma "sqrt_pos" ("px" "1-sq(x!1)"))
           (("1"
             (expand "asin")
             (assert)
             (rewrite "sq_rew")
             (lemma "div_lemma"
              ("x"
               "x!1"
               "cx"
               "cx!1"
               "nzy"
               "sqrt(1 - sq(x!1))"
               "nzcy"
               "CY"))
             (assert)
             (lemma "atan_lemma"
              ("x"
               "x!1 / sqrt(1 - sq(x!1))"
               "cx"
               "cauchy_div(cx!1, CY)"))
             (assert))
            ("2" (assert))))
          ("2"
           (hide-all-but (-5 -6 1))
           (lemma "sq_lt" ("nna" "abs(x!1)" "nnb" "1"))
           (rewrite "sq_abs")
           (rewrite "sq_1")
           (assert)
           (hide 2)
           (grind))))
        ("2"
         (assert)
         (case "x!1/=0")
         (("1"
           (case-replace "TT > 0")
           (("1"
             (case "x!1>0")
             (("1"
               (hide 1)
               (lemma "div_lemma"
                ("nzy"
                 "x!1"
                 "nzcy"
                 "cx!1"
                 "x"
                 "sqrt(1 - sq(x!1))"
                 "cx"
                 "CY"))
               (assert)
               (lemma "atan_lemma"
                ("x"
                 "sqrt(1 - sq(x!1)) / x!1"
                 "cx"
                 "cauchy_div(CY, cx!1)"))
               (assert)
               (lemma "sub_lemma"
                ("x"
                 "pi/2"
                 "cx"
                 "PI2"
                 "y"
                 "atan(sqrt(1 - sq(x!1)) / x!1)"
                 "cy"
                 "cauchy_atan(cauchy_div(CY, cx!1))"))
               (assert)
               (rewrite "asin_pos_restrict")
               (rewrite "sq_rew"))
              ("2" (assert))))
            ("2"
             (replace 1)
             (case "TT<0")
             (("1"
               (hide 1 2)
               (case "x!1<0")
               (("1"
                 (lemma "div_lemma"
                  ("nzy"
                   "x!1"
                   "nzcy"
                   "cx!1"
                   "x"
                   "sqrt(1 - sq(x!1))"
                   "cx"
                   "CY"))
                 (assert)
                 (lemma "atan_lemma"
                  ("x"
                   "sqrt(1 - sq(x!1)) / x!1"
                   "cx"
                   "cauchy_div(CY, cx!1)"))
                 (assert)
                 (lemma "sub_lemma"
                  ("x"
                   "-pi/2"
                   "cx"
                   "cauchy_neg(PI2)"
                   "y"
                   "atan(sqrt(1 - sq(x!1)) / x!1)"
                   "cy"
                   "cauchy_atan(cauchy_div(CY, cx!1))"))
                 (rewrite "neg_lemma" -7)
                 (assert)
                 (rewrite "asin_neg_restrict")
                 (rewrite "sq_rew"))
                ("2" (assert))))
              ("2" (assert))))))
          ("2" (assert))))))
      ("2" (propax))
      ("3" (hide 2) (expand "cauchy_nnreal?") (inst + "1-sq(x!1)"))))
    ("2"
     (hide-all-but 1)
     (lemma "sq_lt" ("nna" "abs(x!1)" "nnb" "1"))
     (rewrite "sq_abs")
     (rewrite "sq_1")
     (grind))))


proof_type: t_proof
decl_type: tcc
library: exact_real_arith
theory: asinx
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (expand "cauchy_real_abs_le1?")
   (inst + "0")
   (("1" (expand "cauchy_prop") (propax)) ("2" (grind))))


proof_type: j_proof
decl_type: tcc
library: exact_real_arith
theory: asinx
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (typepred "x!1")
   (expand "cauchy_real_abs_le1?")
   (expand "cauchy_real?")
   (skosimp*)
   (inst + "x!2"))


proof_type: t_proof
decl_type: tcc
library: exact_real_arith
theory: asinx
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp)
   (typepred "cx!1")
   (expand "cauchy_real_abs_le1?")
   (skosimp)
   (typepred "x!1")
   (hide -4)
   (lemma "mul_lemma" ("x" "x!1" "cx" "cx!1" "y" "x!1" "cy" "cx!1"))
   (assert)
   (rewrite "sq_rew")
   (lemma "sub_lemma"
    ("x"
     "1"
     "y"
     "sq(x!1)"
     "cx"
     "cauchy_int(1)"
     "cy"
     "cauchy_mul(cx!1, cx!1)"))
   (rewrite "int_lemma")
   (assert)
   (lemma "sq_le" ("nna" "abs(x!1)" "nnb" "1"))
   (rewrite "sq_abs")
   (assert)
   (case "1-sq(x!1)>=0")
   (("1" (expand "cauchy_nnreal?") (inst + "1-sq(x!1)"))
    ("2" (assert) (hide-all-but (-3 -4 2)) (grind))))


proof_type: t_proof
decl_type: tcc
library: exact_real_arith
theory: asinx
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (replace -3)
   (hide -3 -4)
   (typepred "cx!1")
   (expand "cauchy_real_abs_le1?")
   (skosimp)
   (case "abs(x!1)<1")
   (("1"
     (hide -3)
     (lemma "mul_lemma" ("x" "x!1" "y" "x!1" "cx" "cx!1" "cy" "cx!1"))
     (assert)
     (rewrite "sq_rew")
     (lemma "sq_lt" ("nna" "abs(x!1)" "nnb" "1"))
     (rewrite "sq_abs")
     (assert)
     (lemma "sub_lemma"
      ("x"
       "1"
       "y"
       "sq(x!1)"
       "cx"
       "cauchy_int(1)"
       "cy"
       "cauchy_mul(cx!1, cx!1)"))
     (rewrite "int_lemma")
     (assert)
     (lemma "sqrt_lemma"
      ("nnx"
       "1-sq(x!1)"
       "nncx"
       "cauchy_sub(cauchy_int(1), cauchy_mul(cx!1, cx!1))"))
     (assert)
     (expand "cauchy_nzreal?")
     (inst + "sqrt(1 - sq(x!1))")
     (("1" (assert)) ("2" (assert))))
    ("2"
     (hide 2 -3)
     (expand "cauchy_prop")
     (inst - "0")
     (rewrite "expt_x0")
     (flatten)
     (assert)
     (grind))))


proof_type: t_proof
decl_type: tcc
library: exact_real_arith
theory: asinx
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (typepred "cx!1")
   (expand "cauchy_real_abs_le1?")
   (skosimp)
   (typepred "x!1")
   (replace -4 *)
   (hide -4 -5 -6)
   (lemma "trichotomy" ("x" "cx!1(0)"))
   (split)
   (("1"
     (hide 1)
     (copy -4)
     (expand "cauchy_prop" -1)
     (inst - "0")
     (rewrite "expt_x0")
     (flatten)
     (assert)
     (expand "cauchy_nzreal?")
     (inst + "x!1"))
    ("2" (propax))
    ("3"
     (hide 1)
     (expand "cauchy_nzreal?")
     (inst + "x!1")
     (expand "cauchy_prop")
     (inst - "0")
     (rewrite "expt_x0")
     (flatten)
     (assert))))


proof_type: f_proof
decl_type: formula
library: exact_real_arith
theory: acosx
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (expand "acos")
   (expand "cauchy_acos")
   (lemma "pi_lemma")
   (lemma "lemma_div2n" ("x" "pi" "cx" "cauchy_pi" "n" "1"))
   (lemma "asin_lemma" ("x" "x!1" "cx" "cx!1"))
   (assert)
   (expand "div2n")
   (rewrite "expt_x1")
   (lemma "sub_lemma"
    ("x"
     "pi/2"
     "y"
     "asin(x!1)"
     "cx"
     "cauchy_div2n(cauchy_pi, 1)"
     "cy"
     "cauchy_asin(cx!1)"))
   (assert))


proof_type: f_proof
decl_type: formula
library: exact_real_arith
theory: series
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (induct "n")
   (("1" (grind))
    ("2"
     (skosimp*)
     (inst - "x!1" "xs!1" "ys!1")
     (replace -2 -1)
     (expand "sum" 1)
     (inst -2 "1+j!1")
     (assert))))


proof_type: f_proof
decl_type: formula
library: exact_real_arith
theory: series
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (induct "n")
   (("1" (grind))
    ("2"
     (skosimp*)
     (inst - "x!1")
     (assert)
     (expand "sum" 1)
     (replace -1 1)
     (expand "geometric_series" 1)
     (case "x!1=0")
     (("1" (replace -1) (simplify 1) (grind))
      ("2"
       (lemma "expt_plus" ("n0x" "x!1" "i" "1" "j" "1+j!1"))
       (("1"
         (rewrite "expt_x1")
         (lemma "minus_div2"
          ("n0x" "1-x!1" "x" "1-x!1*x!1^(1+j!1)" "y" "1-x!1^(1+j!1)"))
         (assert))
        ("2" (assert))))))
    ("3" (hide 2) (grind))))


proof_type: f_proof
decl_type: formula
library: exact_real_arith
theory: series
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (expand "odd?")
   (skosimp*)
   (replace -1 1)
   (lemma "div_cancel2" ("x" "j!1" "n0z" "2"))
   (replace -1)
   (lemma "geometric_series_aux1" ("x" "x!1" "n" "1+2*j!1"))
   (("1"
     (lemma "geometric_series_aux1" ("x" "x!1*x!1" "n" "j!1"))
     (("1"
       (lemma "div_cancel2"
        ("x" "(1-(x!1*x!1)^(j!1+1))/(1-x!1)" "n0z" "1+x!1"))
       (("1"
         (rewrite "div_div2")
         (lemma "trichotomy" ("x" "x!1"))
         (split -1)
         (("1"
           (lemma "expt_times" ("n0x" "x!1" "i" "2" "j" "j!1"))
           (("1"
             (lemma "expt_plus" ("n0x" "x!1" "i" "1" "j" "1"))
             (rewrite "expt_x1")
             (lemma "lt_times_lt_pos1"
              ("px" "x!1" "y" "1" "nnz" "x!1" "w" "1"))
             (("1"
               (assert)
               (lemma "posreal_times_posreal_is_posreal"
                ("px" "x!1" "py" "x!1"))
               (assert)
               (replace -7 1)
               (replace -8 1)
               (replace -6 1)
               (replace -3)
               (lemma "expt_times" ("n0x" "x!1" "i" "2" "j" "j!1+1"))
               (assert))
              ("2" (assert)) ("3" (assert))))
            ("2" (assert))))
          ("2" (replace -1) (assert) (grind))
          ("3"
           (lemma "negreal_times_negreal_is_posreal"
            ("nx" "x!1" "ny" "x!1"))
           (("1"
             (lemma "lt_times_lt_neg1"
              ("x" "-1" "ny" "x!1" "z" "-1" "npw" "x!1"))
             (("1"
               (assert)
               (replace -5)
               (replace -4)
               (replace -6)
               (lemma "expt_times" ("n0x" "x!1" "i" "2" "j" "j!1+1"))
               (lemma "expt_plus" ("n0x" "x!1" "i" "1" "j" "1"))
               (rewrite "expt_x1")
               (assert))
              ("2" (assert))))
            ("2" (assert))))))
        ("2" (assert)) ("3" (assert)) ("4" (assert))))
      ("2" (assert))))
    ("2" (assert))))


proof_type: f_proof
decl_type: formula
library: exact_real_arith
theory: series
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (expand "even?")
   (skosimp*)
   (expand "sum")
   (assert)
   (lemma "geometric_series_aux_odd" ("n" "n!1-1" "x" "x!1"))
   (assert)
   (lemma "even_plus_odd_is_odd" ("e1" "n!1" "o2" "-1"))
   (replace -1 -2)
   (lemma "trich_lt" ("x" "n!1" "y" "2"))
   (split -1)
   (("1" (grind)) ("2" (grind)) ("3" (grind))))


proof_type: f_proof
decl_type: formula
library: exact_real_arith
theory: series
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (expand "member")
   (expand "geometric_series_approx_set")
   (skosimp*)
   (inst + "0")
   (grind))


proof_type: f_proof
decl_type: formula
library: exact_real_arith
theory: series
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (expand "nonempty?")
   (expand "empty?")
   (inst - "1")
   (expand "member")
   (expand "geometric_series_approx_set")
   (inst + "0")
   (grind))


proof_type: f_proof
decl_type: formula
library: exact_real_arith
theory: series
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (expand "upper_bound?")
   (skosimp*)
   (typepred "s!1")
   (expand "geometric_series_approx_set")
   (skosimp*)
   (lemma "geometric_series_aux1" ("x" "x!1" "n" "n!1"))
   (assert)
   (expand "<=" -3)
   (split -3)
   (("1"
     (lemma "expt_pos" ("px" "x!1" "i" "1+n!1"))
     (("1"
       (lemma "posreal_div_posreal_is_posreal"
        ("px" "x!1^(1+n!1)" "py" "1-x!1"))
       (("1"
         (replace -5 -4 rl)
         (replace -4 1)
         (lemma "minus_div2" ("x" "1" "y" "x!1^(1+n!1)" "n0x" "1-x!1"))
         (assert))
        ("2" (assert))))
      ("2" (assert))))
    ("2"
     (expand "^")
     (rewrite "expt")
     (replace -1 (-2 -3 1) rl)
     (assert))))


proof_type: f_proof
decl_type: formula
library: exact_real_arith
theory: series
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (expand "least_upper_bound?")
   (lemma "geometric_series_approx_set_pos_upper_bound" ("x" "x!1"))
   (assert)
   (skosimp*)
   (expand "upper_bound?" -4)
   (lemma "geometric_series_approx_set_contains1" ("x" "x!1"))
   (inst-cp - "1")
   (("1"
     (lemma "posreal_times_posreal_is_posreal" ("px" "y!1" "py" "1-x!1"))
     (("1"
       (lemma "trich_lt" ("x" "y!1" "y" "1/(1-x!1)"))
       (split -1)
       (("1"
         (lemma "div_mult_pos_lt2" ("x" "y!1" "z" "1" "py" "1-x!1"))
         (expand "<=" -6)
         (split -6)
         (("1"
           (lemma "exp_of_exists2" ("lt1x" "x!1" "lt1y" "1-y!1*(1-x!1)"))
           (("1"
             (skosimp*)
             (lemma "both_sides_minus_lt2"
              ("z" "1" "y" "y!1*(1-x!1)" "x" "1-x!1^n!1"))
             (lemma "div_mult_pos_lt2"
              ("x" "y!1" "py" "1-x!1" "z" "1-x!1^n!1"))
             (lemma "trichotomy" ("x" "n!1"))
             (split -1)
             (("1"
               (lemma "geometric_series_aux1" ("x" "x!1" "n" "n!1-1"))
               (("1"
                 (inst -14 "sum(geometric_series(x!1), n!1 - 1)")
                 (("1"
                   (assert)
                   (name-replace "A"
                    "sum(geometric_series(x!1), n!1 - 1)")
                   (replace -1 -3 rl)
                   (assert))
                  ("2"
                   (assert)
                   (hide-all-but (-1 1 -2))
                   (expand "geometric_series_approx_set")
                   (inst + "n!1-1"))
                  ("3" (assert))))
                ("2" (assert))))
              ("2" (replace -1) (rewrite "expt_x0") (assert))
              ("3" (assert))))
            ("2"
             (lemma "both_sides_minus_lt2"
              ("z" "1" "x" "1" "y" "y!1*(1-x!1)"))
             (lemma "both_sides_minus_lt2"
              ("z" "1" "y" "0" "x" "y!1*(1-x!1)"))
             (grind))
            ("3" (assert))))
          ("2" (assert))))
        ("2" (assert) (grind)) ("3" (grind))))
      ("2" (assert))))
    ("2" (expand "member") (propax))))


proof_type: f_proof
decl_type: formula
library: exact_real_arith
theory: series
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (lemma "geometric_series_approx_set_pos_least_upper_bound"
    ("x" "x!1"))
   (lemma "lub_lem"
    ("SA" "geometric_series_approx_set(x!1)" "x" "1/(1-x!1)"))
   (("1" (assert)) ("2" (assert))
    ("3"
     (lemma "geometric_series_approx_set_nonempty" ("x" "x!1"))
     (lemma "geometric_series_approx_set_pos_upper_bound" ("x" "x!1"))
     (expand "bounded_above?")
     (assert)
     (inst + "1/(1-x!1)"))))


proof_type: t_proof
decl_type: tcc
library: exact_real_arith
theory: series
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (expand "even?")
   (skosimp*)
   (lemma "div_cancel2" ("x" "j!1" "n0z" "2"))
   (replace -5)
   (replace -1)
   (assert))


proof_type: t_proof
decl_type: tcc
library: exact_real_arith
theory: series
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (expand "bounded_above?")
   (skosimp*)
   (lemma "geometric_series_approx_set_nonempty" ("x" "x!1"))
   (replace -1 1)
   (lemma "geometric_series_approx_set_pos_upper_bound" ("x" "x!1"))
   (assert)
   (inst + "1/(1-x!1)"))


proof_type: f_proof
decl_type: formula
library: exact_real_arith
theory: max
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (expand "cauchy_max")
   (expand "cauchy_prop")
   (skosimp*)
   (inst - "p!1")
   (inst - "p!1")
   (lemma "expt_pos" ("px" "2" "i" "p!1"))
   (case "cx!1(p!1) < cy!1(p!1)")
   (("1"
     (lemma "both_sides_times_pos_lt1"
      ("x" "y!1" "y" "x!1" "pz" "2^p!1"))
     (grind))
    ("2"
     (lemma "both_sides_times_pos_lt1"
      ("x" "x!1" "y" "y!1" "pz" "2^p!1"))
     (grind))))


proof_type: t_proof
decl_type: tcc
library: exact_real_arith
theory: max
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (expand "cauchy_real?")
   (skosimp*)
   (typepred "cx!1")
   (typepred "cy!1")
   (expand "cauchy_real?")
   (skosimp*)
   (inst + "max(x!2,x!1)")
   (expand "cauchy_prop")
   (skosimp*)
   (lemma "expt_pos" ("px" "2" "i" "p!1"))
   (inst - "p!1")
   (inst - "p!1")
   (case "cx!1(p!1) < cy!1(p!1)")
   (("1"
     (lemma "both_sides_times_pos_lt1"
      ("x" "x!1" "y" "x!2" "pz" "2^p!1"))
     (grind))
    ("2"
     (lemma "both_sides_times_pos_lt1"
      ("x" "x!2" "y" "x!1" "pz" "2^p!1"))
     (grind))))


proof_type: f_proof
decl_type: formula
library: exact_real_arith
theory: min
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (expand "cauchy_min")
   (expand "cauchy_prop")
   (skosimp*)
   (case "cx!1(p!1)<cy!1(p!1)")
   (("1"
     (replace -1)
     (inst - "p!1")
     (inst - "p!1")
     (lemma "expt_pos" ("px" "2" "i" "p!1"))
     (lemma "both_sides_times_pos_lt1"
      ("x" "y!1" "y" "x!1" "pz" "2^p!1"))
     (grind))
    ("2"
     (replace 1)
     (lemma "expt_pos" ("px" "2" "i" "p!1"))
     (inst - "p!1")
     (inst - "p!1")
     (lemma "both_sides_times_pos_lt1"
      ("x" "x!1" "y" "y!1" "pz" "2^p!1"))
     (grind))))


proof_type: t_proof
decl_type: tcc
library: exact_real_arith
theory: min
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (typepred "cx!1")
   (typepred "cy!1")
   (expand "cauchy_real?")
   (skosimp*)
   (inst + "min(x!1,x!2)")
   (expand "cauchy_prop")
   (skosimp*)
   (inst - "p!1")
   (inst - "p!1")
   (lemma "expt_pos" ("px" "2" "i" "p!1"))
   (case "cx!1(p!1) < cy!1(p!1)")
   (("1"
     (lemma "both_sides_times_pos_lt1"
      ("x" "x!1" "y" "x!2" "pz" "2^p!1"))
     (grind))
    ("2"
     (lemma "both_sides_times_pos_lt1"
      ("x" "x!2" "y" "x!1" "pz" "2^p!1"))
     (grind))))


proof_type: f_proof
decl_type: formula
library: exact_real_arith
theory: rat
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp)
   (expand "cauchy_rat")
   (lemma "int_lemma" ("n" "numerator(x!1)"))
   (lemma "int_lemma" ("n" "denominator(x!1)"))
   (typepred "denominator(x!1)")
   (lemma "div_lemma"
    ("x"
     "numerator(x!1)"
     "nzy"
     "denominator(x!1)"
     "cx"
     "cauchy_int(numerator(x!1))"
     "nzcy"
     "cauchy_int(denominator(x!1))"))
   (assert)
   (case-replace "numerator(x!1) / denominator(x!1)=x!1")
   (hide-all-but (1 -2))
   (rewrite "div_cancel3")
   (expand "numerator")
   (propax))


proof_type: t_proof
decl_type: tcc
library: exact_real_arith
theory: rat
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (typepred "x!1")
   (lemma "rational_pred_ax2" ("r" "x!1"))
   (expand "nonempty?")
   (expand "empty?")
   (skosimp*)
   (inst - "p!1")
   (expand "member")
   (inst + "i!1"))


proof_type: t_proof
decl_type: tcc
library: exact_real_arith
theory: rat
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp)
   (typepred "denominator(x!1)")
   (expand "denominator")
   (lemma "denominators_TCC1" ("x" "x!1"))
   (expand "denominators")
   (typepred "min[posnat]({pn | EXISTS i: x!1 = i / pn})")
   (("1" (skosimp) (rewrite "div_cancel4" -2) (assert)) ("2" (propax))))


proof_type: f_proof
decl_type: formula
library: exact_real_arith
theory: prelude_sqrt
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (split)
   (("1"
     (flatten)
     (case "1<nnx!1")
     (("1"
       (lemma "lt_times_lt_pos1"
        ("px" "1" "y" "nnx!1" "nnz" "1" "w" "nnx!1"))
       (grind))
      ("2" (assert))))
    ("2"
     (flatten)
     (case "0<nnx!1")
     (("1"
       (case "nnx!1<1")
       (("1"
         (lemma "lt_times_lt_pos1"
          ("px" "nnx!1" "y" "1" "nnz" "nnx!1" "w" "1"))
         (("1" (grind)) ("2" (assert))))
        ("2" (assert))))
      ("2" (case "nnx!1=0") (("1" (assert)) ("2" (assert))))))))


proof_type: f_proof
decl_type: formula
library: exact_real_arith
theory: prelude_sqrt
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (typepred "nnx!1")
   (typepred "nny!1")
   (case "nnx!1<nny!1")
   (("1"
     (split)
     (("1" (assert))
      ("2"
       (lemma "lt_times_lt_nn1"
        ("nnx" "nnx!1" "y" "nny!1" "nnz" "nnx!1" "w" "nny!1"))
       (assert))))
    ("2"
     (case "nny!1<=nnx!1")
     (("1"
       (split)
       (("1"
         (lemma "le_times_le_pos"
          ("nnx" "nny!1" "y" "nnx!1" "nnz" "nny!1" "w" "nnx!1"))
         (grind))
        ("2" (flatten))))
      ("2" (assert))))))


proof_type: f_proof
decl_type: formula
library: exact_real_arith
theory: prelude_sqrt
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (case "nnx!1<nny!1")
   (("1" (lemma "square_le3" ("nnx" "nnx!1" "nny" "nny!1")) (assert))
    ("2"
     (case "nny!1<nnx!1")
     (("1" (lemma "square_le3" ("nny" "nnx!1" "nnx" "nny!1")) (assert))
      ("2"
       (case "nnx!1=nny!1")
       (("1" (replace -1) (assert)) ("2" (assert))))))))


proof_type: f_proof
decl_type: formula
library: exact_real_arith
theory: prelude_sqrt
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (lemma "square_eq1" ("nnx" "nnx!1" "nny" "nny!1"))
   (lemma "square_le3" ("nnx" "nnx!1" "nny" "nny!1"))
   (grind))


proof_type: f_proof
decl_type: formula
library: exact_real_arith
theory: prelude_sqrt
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (lemma "square_le2" ("nnx" "1/px!1"))
   (flatten)
   (split 1)
   (("1"
     (simplify -1)
     (lemma "div_mult_pos_le1" ("z" "1" "py" "px!1" "x" "1"))
     (replace -1 -2)
     (rewrite "div_times" -2)
     (lemma "div_mult_pos_le1" ("z" "1" "py" "px!1*px!1" "x" "1"))
     (replace -1 -3)
     (assert)
     (hide (-1 -2 -4))
     (case "1=px!1 * px!1")
     (("1" (replace -1 (-2 1) rl) (assert))
      ("2"
       (case "1 < px!1 *px!1")
       (("1"
         (expand "<=" -2 1)
         (replace -1 -2)
         (simplify -2)
         (expand "<=")
         (split -2)
         (("1" (assert)) ("2" (grind))))
        ("2" (assert))))))
    ("2"
     (hide -1)
     (lemma "div_mult_pos_le1" ("z" "1" "py" "px!1" "x" "1"))
     (replace -1 -2)
     (rewrite "div_times" -2)
     (lemma "div_mult_pos_le1" ("z" "1" "py" "px!1* px!1" "x" "1"))
     (replace -1 -3)
     (hide (-1 -2))
     (expand "<=")
     (case "1=px!1")
     (("1" (replace -1 (-2 1) rl) (grind))
      ("2"
       (case "1<px!1")
       (("1"
         (simplify)
         (replace -1)
         (simplify)
         (split -2)
         (("1" (assert))
          ("2" (lemma "square_le2" ("nnx" "px!1")) (grind))))
        ("2" (assert))))))))


proof_type: f_proof
decl_type: formula
library: exact_real_arith
theory: prelude_sqrt
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (rewrite "lt_equiv_not_le" 1)
   (rewrite "le_equiv_not_lt" -1)
   (expand "<=")
   (split -2)
   (("1"
     (lemma "strict_lt")
     (expand "strict_total_order?")
     (expand "strict_order?")
     (expand "transitive?")
     (flatten)
     (inst - "1" "py!1" "nnx!1")
     (lemma "lt_times_lt_pos1"
      ("px" "py!1" "y" "nnx!1" "nnz" "1" "w" "nnx!1"))
     (grind))
    ("2"
     (replace -1)
     (lemma "both_sides_times_pos_lt1"
      ("x" "1" "y" "nnx!1" "pz" "nnx!1"))
     (("1" (grind)) ("2" (assert))))))


proof_type: f_proof
decl_type: formula
library: exact_real_arith
theory: prelude_sqrt
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (lemma "archimedean" ("px" "px!1"))
   (skolem!)
   (rewrite "div_mult_pos_lt1")
   (inst + "n!1")
   (rewrite "div_mult_pos_lt1")
   (typepred "n!1")
   (expand ">")
   (lemma "lt_equiv_le_plus_one" ("x" "0" "y" "n!1"))
   (grind)
   (lemma "lt_times_lt_pos1"
    ("px" "1" "y" "n!1" "nnz" "1" "w" "px!1 * n!1"))
   (grind))


proof_type: f_proof
decl_type: formula
library: exact_real_arith
theory: prelude_sqrt
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (lemma "archimedean" ("px" "px!1"))
   (skolem!)
   (inst + "4*n!1")
   (rewrite "add_div")
   (rewrite "div_mult_pos_lt1")
   (rewrite "div_mult_pos_lt1")
   (typepred "n!1")
   (expand ">")
   (lemma "lt_equiv_le_plus_one" ("x" "0" "y" "n!1"))
   (replace -1 -2)
   (replace -2 -1)
   (flatten)
   (simplify)
   (lemma "both_sides_times_pos_lt1" ("x" "0" "y" "n!1" "pz" "7"))
   (rewrite "zero_times1")
   (replace -2 -1)
   (flatten)
   (lemma "lt_plus_lt1" ("x" "1" "y" "n!1" "z" "0" "w" "n!1*7"))
   (grind)
   (lemma "both_sides_times_pos_lt1"
    ("x" "1" "y" "8 * n!1" "pz" "4*n!1"))
   (grind)
   (lemma "both_sides_plus_lt1"
    ("x" "4 * n!1" "y" "32 * (n!1 * n!1)" "z" "32 * (n!1 * n!1)"))
   (lemma "lt_times_lt_pos1"
    ("px"
     "1"
     "y"
     "px!1 *n!1"
     "nnz"
     "32 * (n!1 * n!1) + 4 * n!1"
     "w"
     "64 * (n!1 * n!1)"))
   (grind))


proof_type: f_proof
decl_type: formula
library: exact_real_arith
theory: prelude_sqrt
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (lemma "square_archimedean2" ("px" "px!1-py!1 * py!1"))
   (("1"
     (skolem!)
     (inst + "py!1*(1+1/n!1)")
     (split)
     (("1"
       (lemma "both_sides_times_pos_lt1"
        ("x" "1" "y" "1+1/n!1" "pz" "py!1"))
       (grind))
      ("2"
       (grind)
       (lemma "both_sides_plus_lt1"
        ("x"
         "1 / (n!1 * n!1) + 2 / n!1"
         "y"
         "px!1 - py!1 * py!1"
         "z"
         "py!1 * py!1"))
       (grind)
       (typepred "n!1")
       (lemma "both_sides_times_pos_lt1"
        ("x"
         "1 / (n!1 * n!1) + 2 / n!1 + py!1 * py!1"
         "y"
         "px!1"
         "pz"
         "n!1 * n!1"))
       (lemma "both_sides_times_pos_lt1"
        ("x"
         "1 / n!1 * py!1 * py!1 + 1 / n!1 * (1 / n!1) * py!1 * py!1 +
                (1 / n!1 * py!1 * py!1 + py!1 * py!1)"
         "y"
         "px!1"
         "pz"
         "n!1 * n!1"))
       (grind)
       (hide (2 -6 -4))
       (rewrite "div_cancel2" -1)
       (rewrite "div_cancel2" 1)
       (simplify)
       (lemma "square_le2" ("nnx" "py!1"))
       (grind)
       (lemma "both_sides_times_pos_le1"
        ("x" "py!1*py!1" "y" "1" "pz" "2*n!1"))
       (grind))))
    ("2" (assert))))


proof_type: f_proof
decl_type: formula
library: exact_real_arith
theory: prelude_sqrt
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (lemma "square_archimedean1" ("px" "px!1"))
   (skolem!)
   (inst + "1/n!1")
   (grind))


proof_type: f_proof
decl_type: formula
library: exact_real_arith
theory: prelude_sqrt
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (typepred "nny!1")
   (expand ">=")
   (expand "<=")
   (split)
   (("1"
     (lemma "div_mult_pos_lt2" ("x" "1" "z" "px!1" "py" "nny!1 * nny!1"))
     (("1"
       (replace -3 -1)
       (flatten)
       (lemma "square_exist_lt1"
        ("py" "1" "px" "px!1 / (nny!1 * nny!1)"))
       (("1"
         (replace -2 -1)
         (simplify -1)
         (skolem!)
         (flatten)
         (inst + "nny!1 *pz!1")
         (("1"
           (split)
           (("1"
             (lemma "both_sides_times_pos_lt1"
              ("x" "1" "y" "pz!1" "pz" "nny!1"))
             (("1" (grind)) ("2" (assert))))
            ("2"
             (lemma "div_mult_pos_lt2"
              ("x" "pz!1 * pz!1" "z" "px!1" "py" "nny!1 * nny!1"))
             (grind))))
          ("2"
           (lemma "lt_times_lt_nn1"
            ("nnx" "1" "y" "pz!1" "nnz" "0" "w" "nny!1"))
           (grind))))
        ("2" (hide 2) (grind))
        ("3"
         (hide 2)
         (lemma "square_le3" ("nnx" "0" "nny" "nny!1"))
         (grind))))
      ("2" (lemma "square_le3" ("nnx" "0" "nny" "nny!1")) (grind))))
    ("2"
     (replace -1 (-2 1) rl)
     (lemma "square_exist_lt2" ("px" "px!1"))
     (grind))))


proof_type: f_proof
decl_type: formula
library: exact_real_arith
theory: prelude_sqrt
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (typepred "nnx!1")
   (expand ">=")
   (expand "<=")
   (split)
   (("1"
     (lemma "both_sides_div_pos_lt2"
      ("py" "nnx!1" "px" "py!1 * py!1" "pz" "1"))
     (("1"
       (replace -3 -1)
       (flatten)
       (lemma "square_exist_lt3" ("nny" "1/py!1" "px" "1/nnx!1"))
       (("1"
         (replace -2 -1)
         (simplify -1)
         (skolem!)
         (inst + "1/pz!1")
         (flatten)
         (split)
         (("1"
           (lemma "div_mult_pos_lt1" ("z" "1" "py" "py!1" "x" "pz!1"))
           (lemma "div_mult_pos_lt1" ("z" "1" "py" "pz!1" "x" "py!1"))
           (grind))
          ("2"
           (lemma "div_mult_pos_lt2"
            ("z" "1" "py" "nnx!1" "x" "pz!1 * pz!1"))
           (rewrite "div_times" 1)
           (lemma "div_mult_pos_lt2"
            ("z" "1" "x" "nnx!1" "py" "pz!1 * pz!1"))
           (grind))))
        ("2"
         (hide (2 -1 -3))
         (lemma "div_mult_pos_gt2" ("py" "nnx!1" "z" "1" "x" "0"))
         (("1" (grind)) ("2" (assert))))
        ("3" (assert))))
      ("2" (assert))))
    ("2"
     (replace -1 (-2 1) rl)
     (lemma "square_le3" ("nnx" "0" "nny" "py!1"))
     (lemma "archimedean" ("px" "py!1"))
     (skolem!)
     (inst + "1 / n!1")
     (grind))))


proof_type: f_proof
decl_type: formula
library: exact_real_arith
theory: prelude_sqrt
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (expand "sqrt_set")
   (expand "nonempty?")
   (expand "empty?")
   (inst - "0")
   (grind))


proof_type: f_proof
decl_type: formula
library: exact_real_arith
theory: prelude_sqrt
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (lemma "sqrt_set_nonempty" ("nnx" "nnx!1"))
   (expand "sqrt_set_UB")
   (expand "upper_bound?")
   (skosimp*)
   (typepred "s!1")
   (expand "sqrt_set" -1)
   (grind)
   (("1" (lemma "square_le2" ("nnx" "s!1")) (grind))
    ("2"
     (lemma "le_equiv_not_lt" ("x" "nnx!1" "y" "1"))
     (lemma "square_le6" ("py" "nnx!1" "nnx" "s!1"))
     (grind))))


proof_type: f_proof
decl_type: formula
library: exact_real_arith
theory: prelude_sqrt
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (split)
   (("1"
     (flatten)
     (expand "least_upper_bound?")
     (split)
     (("1"
       (expand "upper_bound?")
       (skosimp*)
       (typepred "s!1")
       (expand "sqrt_set")
       (grind)
       (lemma "square_le4" ("nnx" "s!1" "nny" "nny!1"))
       (grind))
      ("2"
       (skosimp*)
       (expand "upper_bound?")
       (inst - "nny!1")
       (expand "extend")
       (expand "sqrt_set")
       (grind))))
    ("2"
     (flatten)
     (lemma "trich_lt" ("x" "nny!1 * nny!1" "y" "nnx!1"))
     (split -1)
     (("1"
       (hide 1)
       (expand "least_upper_bound?")
       (flatten)
       (hide -3)
       (expand "upper_bound?")
       (rewrite "not_forall" -2)
       (typepred "nny!1")
       (expand ">=")
       (lemma "le_times_le_pos"
        ("nnx" "0" "y" "nny!1" "nnz" "0" "w" "nny!1"))
       (lemma "square_exist_lt3" ("nny" "nny!1" "px" "nnx!1"))
       (("1"
         (replace -4 -1)
         (simplify -1)
         (skolem!)
         (flatten)
         (inst + "pz!1")
         (("1" (assert))
          ("2"
           (expand "extend")
           (expand "sqrt_set")
           (expand "restrict")
           (assert))))
        ("2" (hide 2) (grind))))
      ("2" (propax))
      ("3"
       (hide 1)
       (expand "least_upper_bound?")
       (flatten)
       (hide -2)
       (rewrite "not_forall" -2)
       (("1"
         (lemma "square_exist_gt3" ("nnx" "nnx!1" "py" "nny!1"))
         (("1"
           (replace -2 -1)
           (simplify -1)
           (skolem!)
           (flatten)
           (inst + "nnz!1")
           (expand "upper_bound?")
           (prop)
           (("1" (assert))
            ("2"
             (skolem!)
             (typepred "s!1")
             (expand "extend")
             (expand "sqrt_set")
             (expand "restrict")
             (lemma "square_le3" ("nnx" "s!1" "nny" "nnz!1"))
             (("1" (grind)) ("2" (assert))))))
          ("2" (assert))))
        ("2"
         (expand "nonempty?")
         (expand "empty?")
         (inst -1 "0")
         (grind))))))))


proof_type: f_proof
decl_type: formula
library: exact_real_arith
theory: prelude_sqrt
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (expand "injective?")
   (expand "square")
   (skosimp*)
   (lemma "square_eq1" ("nnx" "x1!1" "nny" "x2!1"))
   (assert))


proof_type: f_proof
decl_type: formula
library: exact_real_arith
theory: prelude_sqrt
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (expand "surjective?")
   (expand "square")
   (skosimp*)
   (typepred "y!1")
   (lemma "sqrt_set_nonempty" ("nnx" "y!1"))
   (lemma "sqrt_set_LUB" ("nnx" "y!1"))
   (lemma "lub_exists"
    ("SA" "extend[real, nnreal, bool, FALSE](sqrt_set(y!1))"))
   (("1"
     (skolem!)
     (inst - "x!1")
     (("1"
       (inst + "x!1")
       (("1" (replace -2 1) (propax))
        ("2"
         (replace -2 -1 rl)
         (replace -2 -1)
         (hide -2)
         (expand "least_upper_bound?")
         (flatten)
         (hide -2)
         (expand "upper_bound?")
         (inst - "0")
         (("1" (assert))
          ("2" (expand "extend") (expand "sqrt_set") (grind))))))
      ("2"
       (expand "least_upper_bound?")
       (flatten)
       (expand "upper_bound?")
       (inst -1 "0")
       (("1" (assert))
        ("2"
         (expand "extend")
         (expand "sqrt_set")
         (hide-all-but (-3 1))
         (grind))))))
    ("2"
     (split 1)
     (("1"
       (hide (-1 -3 2))
       (expand "nonempty?")
       (expand "empty?")
       (skosimp*)
       (inst - "x!1")
       (grind))
      ("2"
       (lemma "sqrt_set_has_UB" ("nnx" "y!1"))
       (expand "bounded_above?")
       (inst 1 "sqrt_set_UB(y!1)"))))))


proof_type: f_proof
decl_type: formula
library: exact_real_arith
theory: prelude_sqrt
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (lemma "square_bijective")
   (skosimp*)
   (lemma "comp_inverse_right" ("f" "square" "y" "nnx!1"))
   (("1" (expand "sqrt") (propax)) ("2" (propax))))


proof_type: f_proof
decl_type: formula
library: exact_real_arith
theory: prelude_sqrt
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp)
   (lemma "square_bijective")
   (expand "sqrt")
   (lemma "comp_inverse_left" ("f" "square" "x" "nnx!1"))
   (("1" (propax)) ("2" (propax))))


proof_type: f_proof
decl_type: formula
library: exact_real_arith
theory: prelude_sqrt
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (lemma "square_surjective")
   (expand "surjective?")
   (inst-cp -1 "nnx!1")
   (inst -1 "nny!1")
   (skolem!)
   (skolem!)
   (replace -1 1 rl)
   (replace -2 1 rl)
   (lemma "square_times" ("nnx" "x!2" "nny" "x!1"))
   (replace -1 1 rl)
   (rewrite "sqrt_square2")
   (rewrite "sqrt_square2")
   (rewrite "sqrt_square2"))


proof_type: f_proof
decl_type: formula
library: exact_real_arith
theory: prelude_sqrt
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (lemma "square_eq1" ("nnx" "sqrt(0)" "nny" "0"))
   (lemma "square_is" ("nnx" "sqrt(0)"))
   (replace -1 -2 rl)
   (lemma "sqrt_square1" ("nnx" "0"))
   (assert))


proof_type: f_proof
decl_type: formula
library: exact_real_arith
theory: prelude_sqrt
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (lemma "square_eq1" ("nnx" "sqrt(1)" "nny" "1"))
   (lemma "square_is" ("nnx" "sqrt(1)"))
   (replace -1 -2 rl)
   (lemma "sqrt_square1" ("nnx" "1"))
   (assert))


proof_type: f_proof
decl_type: formula
library: exact_real_arith
theory: prelude_sqrt
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (lemma "square_eq1" ("nnx" "sqrt(nnx!1)" "nny" "nny!1"))
   (lemma "sqrt_square1" ("nnx" "nnx!1"))
   (expand "square")
   (grind))


proof_type: f_proof
decl_type: formula
library: exact_real_arith
theory: prelude_sqrt
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (lemma "both_sides_sqrt1" ("nnx" "nnx!1" "nny" "sqrt(nny!1)"))
   (lemma "sqrt_square1" ("nnx" "nny!1"))
   (expand "square")
   (grind))


proof_type: f_proof
decl_type: formula
library: exact_real_arith
theory: prelude_sqrt
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (lemma "square_le3" ("nnx" "sqrt(nnx!1)" "nny" "nny!1"))
   (lemma "sqrt_square1" ("nnx" "nnx!1"))
   (expand "square")
   (grind))


proof_type: f_proof
decl_type: formula
library: exact_real_arith
theory: prelude_sqrt
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (lemma "both_sides_sqrt_lt1" ("nnx" "nnx!1" "nny" "sqrt(nny!1)"))
   (lemma "sqrt_square1" ("nnx" "nny!1"))
   (grind))


proof_type: f_proof
decl_type: formula
library: exact_real_arith
theory: prelude_sqrt
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (lemma "square_le3" ("nnx" "nnx!1" "nny" "sqrt(nny!1)"))
   (lemma "sqrt_square1" ("nnx" "nny!1"))
   (expand "square")
   (assert)
   (grind))


proof_type: f_proof
decl_type: formula
library: exact_real_arith
theory: prelude_sqrt
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (lemma "both_sides_sqrt1" ("nnx" "nnx!1" "nny" "nny!1"))
   (lemma "both_sides_sqrt_lt1" ("nnx" "nnx!1" "nny" "nny!1"))
   (grind))


proof_type: f_proof
decl_type: formula
library: exact_real_arith
theory: prelude_sqrt
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (lemma "both_sides_sqrt2" ("nnx" "nnx!1" "nny" "nny!1"))
   (lemma "both_sides_sqrt_lt2" ("nnx" "nnx!1" "nny" "nny!1"))
   (grind))


proof_type: f_proof
decl_type: formula
library: exact_real_arith
theory: prelude_sqrt
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (lemma "both_sides_sqrt_lt3" ("nnx" "nnx!1" "nny" "nny!1"))
   (lemma "both_sides_sqrt1" ("nnx" "nny!1" "nny" "nnx!1"))
   (grind))


proof_type: t_proof
decl_type: tcc
library: exact_real_arith
theory: prelude_sqrt
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (lemma "sqrt_set_nonempty" ("nnx" "nnx!1"))
   (expand "nonempty?")
   (expand "empty?")
   (skosimp*)
   (inst - "x!1")
   (expand "extend")
   (typepred "x!1")
   (expand "member")
   (propax))


proof_type: f_proof
decl_type: formula
library: extended_nnreal
theory: code_product
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp)
   (expand "double_index_triangle")
   (expand "singleton_elt")
   (expand "member")
   (typepred
    "the! (x: nat):
                 (x + x * x) / 2 <= n!1 AND n!1 < (2 + 3 * x + x * x) / 2")
   (("1" (assert))
    ("2"
     (hide 2)
     (lemma "double_index_triangle_TCC1" ("n" "n!1"))
     (expand "singleton?")
     (skosimp)
     (inst + "x!1")
     (skosimp)
     (inst - "y!1"))))


proof_type: f_proof
decl_type: formula
library: extended_nnreal
theory: code_product
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skolem + ("i" "j"))
   (flatten)
   (case "double_index_triangle(j)+1<=double_index_triangle(i)")
   (("1"
     (hide 1)
     (name "Tj" "double_index_triangle(j)")
     (name "Ti" "double_index_triangle(i)")
     (replace -1)
     (replace -2)
     (expand "double_index_triangle")
     (expand "singleton_elt")
     (expand "member")
     (typepred
      "the! (x: nat): (x + x * x) / 2 <= i AND i < (2 + 3 * x + x * x) / 2")
     (("1"
       (replace -3)
       (hide -3)
       (typepred
        "the! (x_1: nat):
                (x_1 + x_1 * x_1) / 2 <= j AND j < (2 + 3 * x_1 + x_1 * x_1) / 2")
       (("1"
         (replace -5)
         (hide -5)
         (case "2 + 3 * Tj + Tj * Tj<=Ti + Ti * Ti")
         (("1" (assert))
          ("2"
           (hide -1 -2 -3 -4 -6)
           (lemma "sq_le" ("nna" "Tj+1" "nnb" "Ti"))
           (expand "sq")
           (assert))))
        ("2"
         (hide-all-but 1)
         (lemma "double_index_triangle_TCC1" ("n" "j"))
         (expand "singleton?")
         (skosimp)
         (inst + "x!1")
         (skosimp)
         (inst - "y!1"))))
      ("2"
       (hide-all-but 1)
       (lemma "double_index_triangle_TCC1" ("n" "i"))
       (expand "singleton?")
       (skosimp)
       (inst + "x!1")
       (skosimp)
       (inst - "y!1"))))
    ("2" (assert))))


proof_type: f_proof
decl_type: formula
library: extended_nnreal
theory: code_product
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp)
   (lemma "double_index_triangle_def" ("n" "n!1"))
   (flatten)
   (name-replace "II" "double_index_triangle(n!1)")
   (hide -2)
   (rewrite "div_mult_pos_le1")
   (case "II<=II*II")
   (("1" (assert))
    ("2"
     (hide -1 2)
     (case-replace "II=0")
     (("1" (assert))
      ("2"
       (lemma "both_sides_times_pos_le1" ("pz" "II" "x" "1" "y" "II"))
       (("1" (assert)) ("2" (assert))))))))


proof_type: f_proof
decl_type: formula
library: extended_nnreal
theory: code_product
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp)
   (expand "double_index_j")
   (lemma "double_index_triangle_def" ("n" "n!1"))
   (flatten)
   (name-replace "II" "double_index_triangle(n!1)")
   (case "n!1<= (II + II * II+2*II) / 2")
   (("1" (assert))
    ("2"
     (hide 2)
     (assert)
     (case "n!1+1 <= (2 + II + (2 * II + II * II)) / 2")
     (("1" (hide -3) (hide -2) (assert))
      ("2"
       (hide 2 -1)
       (name "DRL" "2 + II + (2 * II + II * II)")
       (replace -1)
       (assert)
       (case "forall (i,j:nat): i<j => i+1<=j")
       (("1"
         (inst - "n!1" "DRL/2")
         (("1" (assert))
          ("2"
           (hide -2 2)
           (expand "DRL")
           (hide -1)
           (case "even?(II)")
           (("1"
             (expand "even?")
             (skosimp)
             (replace -1)
             (assert)
             (case-replace
              "(2 + 4 * (j!1 * j!1) + 6 * j!1) / 2= 1+2*j!1*j!1+3*j!1")
             (("1" (assert)) ("2" (assert))))
            ("2"
             (rewrite "even_or_odd")
             (expand "odd?")
             (skosimp)
             (replace -1)
             (assert)
             (case-replace
              "(6 + 4 * (j!1 * j!1) + 10 * j!1) / 2=3+2*j!1*j!1+5*j!1")
             (("1" (assert)) ("2" (assert))))))))
        ("2" (hide-all-but 1) (skosimp) (assert))))))))


proof_type: f_proof
decl_type: formula
library: extended_nnreal
theory: code_product
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp)
   (expand "double_index_n")
   (lemma "both_sides_div_pos_lt1"
    ("pz"
     "2"
     "x"
     "j!1 * j!1 + j!1 * n!1 + j!1 + (j!1 * n!1 + n!1 * n!1 + n!1)"
     "y"
     "j!1 * j!1 + j!1 * m!1 + j!1 + (j!1 * m!1 + m!1 * m!1 + m!1)"))
   (flatten)
   (hide -1)
   (split -1)
   (("1" (assert))
    ("2"
     (hide 2)
     (assert)
     (lemma "both_sides_times_pos_lt1"
      ("pz" "2*j!1+1" "x" "n!1" "y" "m!1"))
     (assert)
     (case "n!1*n!1<m!1*m!1")
     (("1" (assert))
      ("2"
       (hide -1 2)
       (case-replace "n!1=0")
       (("1"
         (lemma "posreal_times_posreal_is_posreal"
          ("px" "m!1" "py" "m!1"))
         (assert))
        ("2"
         (lemma "lt_times_lt_pos1"
          ("px" "n!1" "y" "m!1" "nnz" "n!1" "w" "m!1"))
         (assert))))))))


proof_type: f_proof
decl_type: formula
library: extended_nnreal
theory: code_product
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp)
   (expand "double_index_i")
   (expand "double_index_j")
   (name-replace "II" "double_index_triangle(n!1)")
   (expand "double_index_n")
   (propax))


proof_type: f_proof
decl_type: formula
library: extended_nnreal
theory: code_product
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp)
   (expand "double_index_i")
   (case-replace "double_index_j(double_index_n(i!1, j!1)) = j!1")
   (("1"
     (hide -1)
     (lemma "double_index_triangle_def" ("n" "double_index_n(i!1, j!1)"))
     (flatten)
     (name-replace "N" "double_index_triangle(double_index_n(i!1, j!1))")
     (lemma "trich_lt" ("x" "N" "y" "i!1+j!1"))
     (name "M" "i!1+j!1")
     (case-replace "double_index_n(i!1, j!1)=(M*(M+1))/2+j!1")
     (("1"
       (hide -1)
       (replace -1)
       (split -2)
       (("1"
         (assert)
         (lemma "sq_le" ("nna" "N+1" "nnb" "M"))
         (expand "sq")
         (propax))
        ("2" (assert))
        ("3"
         (assert)
         (lemma "sq_le" ("nna" "M+1" "nnb" "N"))
         (expand "sq")
         (propax))))
      ("2" (expand "double_index_n") (expand "M") (assert))))
    ("2"
     (hide 2)
     (expand "double_index_j")
     (name "M" "i!1+j!1")
     (case-replace "double_index_n(i!1, j!1)=(M*(M+1))/2+j!1")
     (("1"
       (hide -1)
       (assert)
       (lemma "double_index_triangle_def"
        ("n" "((M + M * M) / 2 + j!1)"))
       (("1"
         (flatten)
         (name-replace "II"
          "double_index_triangle((M + M * M) / 2 + j!1)")
         (("1"
           (lemma "trich_lt" ("x" "M" "y" "II"))
           (split -1)
           (("1"
             (lemma "sq_le" ("nna" "M+1" "nnb" "II"))
             (expand "sq")
             (assert))
            ("2" (assert))
            ("3"
             (lemma "sq_le" ("nna" "II+1" "nnb" "M"))
             (expand "sq")
             (assert))))
          ("2"
           (hide-all-but 1)
           (case "even?(M)")
           (("1"
             (expand "even?")
             (skosimp)
             (replace -1)
             (case-replace
              "(2 * j!2 + 2 * j!2 * (2 * j!2))/2 = j!2+2*j!2*j!2")
             (("1" (assert)) ("2" (assert))))
            ("2"
             (rewrite "even_or_odd")
             (expand "odd?")
             (skosimp)
             (replace -1)
             (assert)
             (case-replace
              "(2 + 4 * (j!2 * j!2) + 6 * j!2)/2= 1+2*j!2*j!2+3*j!2")
             (("1" (assert)) ("2" (assert))))))))
        ("2"
         (hide-all-but 1)
         (case "even?(M)")
         (("1"
           (expand "even?")
           (skosimp)
           (replace -1)
           (case-replace
            "(2 * j!2 + 2 * j!2 * (2 * j!2)) / 2 = j!2+2*j!2*j!2")
           (("1" (assert)) ("2" (assert))))
          ("2"
           (rewrite "even_or_odd")
           (expand "odd?")
           (skosimp)
           (replace -1)
           (assert)
           (case-replace
            "(2 + 4 * (j!2 * j!2) + 6 * j!2)/2= 1+2*j!2*j!2+3*j!2")
           (("1" (assert)) ("2" (assert))))))))
      ("2" (expand "double_index_n") (expand "M") (assert))))))


proof_type: f_proof
decl_type: formula
library: extended_nnreal
theory: code_product
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (expand "bijective?")
   (split)
   (("1"
     (expand "injective?")
     (case "forall (i,j0,j1:nat): double_index_n(i,j0)=double_index_n(i,j1)=> j0=j1")
     (("1"
       (skosimp)
       (case "x1!1`1 = x2!1`1")
       (("1"
         (inst - "x1!1`1" "x1!1`2" "x2!1`2")
         (assert)
         (decompose-equality))
        ("2"
         (hide -1)
         (case "forall (i0,i1,j0,j1:nat): i0<i1 => double_index_n(i0, j0) /= double_index_n(i1, j1)")
         (("1"
           (lemma "trich_lt" ("x" "x1!1`1" "y" "x2!1`1"))
           (split -1)
           (("1" (inst - "x1!1`1" "x2!1`1" "x1!1`2" "x2!1`2") (assert))
            ("2" (propax))
            ("3" (inst - "x2!1`1" "x1!1`1" "x2!1`2" "x1!1`2") (assert))))
          ("2"
           (hide 2 3 -1)
           (skosimp)
           (expand "double_index_n")
           (case "(i0!1 * i0!1 + i0!1 * j0!1 + i0!1 +
                         (i0!1 * j0!1 + j0!1 * j0!1 + j0!1))
                        + 2*j0!1
                        =
                        (i1!1 * i1!1 + i1!1 * j1!1 + i1!1 +
                          (i1!1 * j1!1 + j1!1 * j1!1 + j1!1))
                         + 2*j1!1")
           (("1"
             (assert)
             (hide -3)
             (case "j0!1<=j1!1")
             (("1"
               (lemma "sq_lt" ("nna" "i0!1" "nnb" "i1!1"))
               (lemma "sq_le" ("nna" "j0!1" "nnb" "j1!1"))
               (rewrite "sq_rew")
               (rewrite "sq_rew")
               (rewrite "sq_rew")
               (rewrite "sq_rew")
               (assert)
               (lemma "le_times_le_pos"
                ("nnx" "2*i0!1" "y" "2*i1!1" "nnz" "j0!1" "w" "j1!1"))
               (assert))
              ("2"
               (case "j0!1>j1!1")
               (("1"
                 (hide 1)
                 (name "DJ" "j0!1-j1!1")
                 (case "DJ>=1")
                 (("1"
                   (name "DI" "i1!1-i0!1")
                   (case "DI>=1")
                   (("1"
                     (case-replace "j0!1=DJ+j1!1")
                     (("1"
                       (case-replace "i1!1=DI+i0!1")
                       (("1"
                         (assert)
                         (hide -1 -2 -4 -6 -7 -9)
                         (assert)
                         (lemma "trich_lt" ("x" "DJ" "y" "DI"))
                         (split -1)
                         (("1"
                           (name "DD" "DI-DJ")
                           (case "DD>=1")
                           (("1"
                             (case-replace "DI=DJ+DD")
                             (("1"
                               (assert)
                               (hide -1 -3 -4)
                               (assert)
                               (case "3*DJ=DD+DJ+DD*DD+2*DD*(DJ+i0!1+j1!1)")
                               (("1"
                                 (hide -5)
                                 (case
                                  "0=DD+DD*DD+2*DD*(DJ + i0!1 + j1!1)-2*DJ")
                                 (("1"
                                   (hide -2)
                                   (case "2*DD*DJ>=2*DJ")
                                   (("1"
                                     (case
                                      "DD + DD * DD + 2 * DD * (i0!1 + j1!1)>0")
                                     (("1" (assert))
                                      ("2"
                                       (hide -1 -2)
                                       (lemma
                                        "sq_le"
                                        ("nna" "1" "nnb" "DD"))
                                       (lemma
                                        "both_sides_times_pos_le1"
                                        ("pz"
                                         "2*DD"
                                         "x"
                                         "0"
                                         "y"
                                         "i0!1+j1!1"))
                                       (expand "sq")
                                       (assert))))
                                    ("2"
                                     (hide -1)
                                     (lemma
                                      "both_sides_times_pos_le1"
                                      ("pz" "2*DJ" "x" "1" "y" "DD"))
                                     (assert))))
                                  ("2" (assert))))
                                ("2" (assert))))
                              ("2" (assert))))
                            ("2" (assert))))
                          ("2" (replace -1) (assert))
                          ("3"
                           (lemma "sq_lt" ("nna" "DI" "nnb" "DJ"))
                           (lemma "both_sides_times_pos_lt1"
                            ("pz" "1+2*(i0!1+j1!1)" "x" "DI" "y" "DJ"))
                           (expand "sq")
                           (assert))))
                        ("2" (assert))))
                      ("2" (assert))))
                    ("2" (assert))))
                  ("2" (assert))))
                ("2" (assert))))))
            ("2" (assert))))))))
      ("2"
       (hide 2)
       (skosimp)
       (expand "double_index_n")
       (case "(i!1 * i!1 + i!1 * j0!1 + i!1 + (i!1 * j0!1 + j0!1 * j0!1 + j0!1))
                    + 2*j0!1
                    =
                    (i!1 * i!1 + i!1 * j1!1 + i!1 + (i!1 * j1!1 + j1!1 * j1!1 + j1!1))
                     + 2*j1!1")
       (("1"
         (hide -2)
         (assert)
         (lemma "trich_lt" ("x" "j0!1" "y" "j1!1"))
         (split -1)
         (("1"
           (lemma "sq_lt" ("nna" "j0!1" "nnb" "j1!1"))
           (expand "sq")
           (case-replace "i!1=0")
           (("1" (assert))
            ("2"
             (lemma "both_sides_times_pos_lt1"
              ("pz" "i!1" "x" "j0!1" "y" "j1!1"))
             (("1" (assert)) ("2" (assert))))))
          ("2" (propax))
          ("3"
           (lemma "sq_lt" ("nna" "j1!1" "nnb" "j0!1"))
           (expand "sq")
           (assert)
           (case-replace "i!1=0")
           (("1" (assert))
            ("2"
             (lemma "both_sides_times_pos_lt1"
              ("pz" "i!1" "x" "j1!1" "y" "j0!1"))
             (assert))))))
        ("2" (assert))))))
    ("2"
     (expand "surjective?")
     (skolem + ("n"))
     (case "exists i,j: double_index_n(i,j)=n")
     (("1" (propax))
      ("2"
       (hide 2)
       (inst + "double_index_i(n)" "double_index_j(n)")
       (rewrite "double_index_n_ij"))))))


proof_type: t_proof
decl_type: tcc
library: extended_nnreal
theory: code_product
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp)
   (name-replace "N" "i!1 + j!1")
   (case-replace "1 + i!1 + j!1=1+N")
   (("1"
     (hide -1)
     (case "even?(N)")
     (("1"
       (expand "even?")
       (skosimp)
       (replace -1)
       (assert)
       (lemma "div_cancel1" ("x" "2*(j!2*j!2)+j!2" "n0z" "2"))
       (replace -1)
       (assert))
      ("2"
       (rewrite "even_or_odd")
       (expand "odd?")
       (skosimp)
       (replace -1)
       (assert)
       (lemma "div_cancel1" ("x" "1+3*j!2+2*j!2*j!2" "n0z" "2"))
       (replace -1)
       (assert))))
    ("2" (assert) (expand "N") (propax))))


proof_type: t_proof
decl_type: tcc
library: extended_nnreal
theory: code_product
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (expand "singleton?")
   (skosimp)
   (name "II" "floor(sqrt(2*n!1))")
   (typepred "floor(sqrt(2 * n!1))")
   (replace -4)
   (lemma "sq_le" ("nna" "II" "nnb" "sqrt(2 * n!1)"))
   (assert)
   (lemma "sq_lt" ("nna" "sqrt(2 * n!1)" "nnb" "1 + II"))
   (assert)
   (hide -3 -4)
   (case "II+II*II<= 2*n!1")
   (("1"
     (inst + "II")
     (("1"
       (skosimp)
       (lemma "trich_lt" ("x" "II" "y" "y!1"))
       (split -1)
       (("1"
         (lemma "sq_le" ("nna" "II+1" "nnb" "y!1"))
         (assert)
         (typepred "y!1")
         (expand "sq")
         (assert))
        ("2" (propax))
        ("3"
         (lemma "sq_le" ("nnb" "II" "nna" "y!1+1"))
         (typepred "y!1")
         (expand "sq")
         (assert))))
      ("2" (assert) (expand "sq") (assert))))
    ("2"
     (case "2*n!1<II + II * II")
     (("1"
       (hide 1)
       (inst + "II-1")
       (("1"
         (skosimp)
         (typepred "y!1")
         (expand "sq")
         (lemma "trich_lt" ("x" "II-1" "y" "y!1"))
         (split -1)
         (("1"
           (lemma "sq_le" ("nna" "II" "nnb" "y!1"))
           (expand "sq")
           (assert))
          ("2" (propax))
          ("3"
           (lemma "sq_le" ("nnb" "II-1" "nna" "y!1+1"))
           (("1" (expand "sq") (assert)) ("2" (assert))))))
        ("2" (assert) (expand "sq") (assert))))
      ("2" (assert))))))


proof_type: t_proof
decl_type: tcc
library: extended_nnreal
theory: code_product
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp)
   (lemma "double_index_triangle_def" ("n" "n!1"))
   (flatten)
   (assert)
   (hide -1 -2)
   (name-replace "II" "double_index_triangle(n!1)")
   (case "even?(II)")
   (("1"
     (expand "even?")
     (skosimp)
     (replace -1)
     (case-replace "(2 * j!1 + 2 * j!1 * (2 * j!1)) / 2 = j!1+2*j!1*j!1")
     (("1" (assert)) ("2" (assert))))
    ("2"
     (rewrite "even_or_odd")
     (expand "odd?")
     (skosimp)
     (replace -1)
     (assert)
     (case-replace
      "(2 + 4 * (j!1 * j!1) + 6 * j!1) / 2= 1+2*j!1*j!1+3*j!1")
     (("1" (assert)) ("2" (assert))))))


proof_type: f_proof
decl_type: formula
library: extended_nnreal
theory: double_index
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp)
   (expand "double_index")
   (expand "single_index")
   (expand "o ")
   (apply-extensionality :hide? t)
   (rewrite "double_index_n_ij"))


proof_type: f_proof
decl_type: formula
library: extended_nnreal
theory: double_index
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp)
   (expand "single_index")
   (expand "double_index")
   (apply-extensionality :hide? t)
   (expand "o")
   (lemma "double_index_ij_n" ("i" "x!1" "j" "x!2"))
   (flatten)
   (replace -1)
   (replace -2)
   (propax))


proof_type: f_proof
decl_type: formula
library: extended_nnreal
theory: double_nn_sequence
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (expand "increasing?")
   (expand "series")
   (skosimp*)
   (lemma "sigma_split" ("low" "0" "high" "y!1" "z" "x!1" "F" "v!1"))
   (assert)
   (lemma "sigma_ge_0" ("low" "x!1+1" "high" "y!1" "F" "v!1"))
   (assert))


proof_type: f_proof
decl_type: formula
library: extended_nnreal
theory: double_nn_sequence
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (induct "n")
   (("1"
     (skosimp)
     (case-replace "double_index_n(0, 0)=0")
     (("1"
       (expand "series")
       (expand "sigma")
       (expand "sigma")
       (expand "single_index")
       (lemma "double_index_ij_n" ("i" "0" "j" "0"))
       (replace -2)
       (flatten)
       (assert))
      ("2" (hide 2) (expand "double_index_n") (assert))))
    ("2"
     (skosimp*)
     (expand "series")
     (inst - "u!1")
     (expand "sigma" 1 2)
     (expand "sigma" 1 2)
     (expand "sigma" 1 2)
     (expand "sigma" 1 3)
     (assert)
     (case "double_index_n(0, j!1)<double_index_n(0, 1 + j!1)")
     (("1"
       (lemma "sigma_split"
        ("low"
         "0"
         "high"
         "double_index_n(0, 1 + j!1)"
         "z"
         "double_index_n(0, j!1)"
         "F"
         "single_index(u!1)"))
       (assert)
       (replace -1)
       (hide -1)
       (lemma "sigma_sum"
        ("low"
         "0"
         "high"
         "j!1"
         "F"
         "LAMBDA i:IF 0 > 1 - i + j!1 THEN 0
                         ELSE u!1(i, 1 - i + j!1)ENDIF"
         "G"
         "LAMBDA i: IF 0 > 1 - i + j!1 THEN 0
                         ELSE sigma(0, j!1 - i, LAMBDA j: u!1(i, j))ENDIF"))
       (("1"
         (assert)
         (case-replace
          "(LAMBDA (i_1: nat):
                         IF 0 > 1 - i_1 + j!1 THEN 0
                         ELSE u!1(i_1, 1 - i_1 + j!1)
                         ENDIF
                          +
                          IF 0 > 1 - i_1 + j!1 THEN 0
                          ELSE sigma(0, j!1 - i_1, LAMBDA j: u!1(i_1, j))
                          ENDIF)=LAMBDA i:
                          IF 0 > 1 - i + j!1 THEN 0
                          ELSE u!1(i, 1 - i + j!1) +
                                sigma(0, j!1 - i, LAMBDA j: u!1(i, j))
                          ENDIF")
         (("1"
           (name-replace "FF"
            "LAMBDA i:
                            IF 0 > 1 - i + j!1 THEN 0
                            ELSE u!1(i, 1 - i + j!1) +
                                  sigma(0, j!1 - i, LAMBDA j: u!1(i, j))
                            ENDIF")
           (replace -2 1 rl)
           (hide -1 -2)
           (case-replace
            "sigma(0, j!1,
                           LAMBDA i:
                             IF 0 > 1 - i + j!1 THEN 0
                             ELSE sigma(0, j!1 - i, LAMBDA j: u!1(i, j))
                             ENDIF)=sigma(0, double_index_n(0, j!1), single_index(u!1))")
           (("1"
             (assert)
             (hide -1 -3)
             (case "forall n: sigma(1 + double_index_n(0, n), double_index_n(0, 1 + n),
                               single_index(u!1))
                          =
                          u!1(1 + n, 0) +
                           sigma(0, n,
                                 LAMBDA i:
                                   IF 0 > 1 - i + n THEN 0 ELSE u!1(i, 1 - i + n) ENDIF)")
             (("1" (inst - "j!1"))
              ("2"
               (hide -1 2)
               (case " FORALL n: u!1(1 + n, 0) +
                               sigma(0, n,
                                     LAMBDA i:
                                       IF 0 > 1 - i + n THEN 0 ELSE u!1(i, 1 - i + n) ENDIF) = sigma(0,n+1, LAMBDA i:
                                       IF 0 > 1 - i + n THEN 0 ELSE u!1(i,1-i+n)endif)")
               (("1"
                 (case "FORALL n:
                               sigma(1 + double_index_n(0, n), double_index_n(0, 1 + n),
                                     single_index(u!1))
                                =sigma(0, n + 1,
                                      LAMBDA i:
                                        IF 0 > 1 - i + n THEN 0 ELSE u!1(i, 1 - i + n) ENDIF)")
                 (("1" (skosimp) (inst - "n!1") (inst - "n!1") (assert))
                  ("2"
                   (hide -1 2)
                   (case "FORALL n:
                                 sigma(1 + double_index_n(0, n), double_index_n(0, 1 + n),
                                       single_index(u!1))
                                  =sigma(0, n + 1,
                                        LAMBDA i:
                                          IF 0 > 1 - i + n THEN 0 ELSE u!1(n+1-i,i) endif)")
                   (("1"
                     (case "FORALL n:sigma(0, n + 1,
                                          LAMBDA i:
                                            IF 0 > 1 - i + n THEN 0 ELSE u!1(n + 1 - i, i) ENDIF) =
                                    sigma(0, n + 1,
                                          LAMBDA i:
                                            IF 0 > 1 - i + n THEN 0 ELSE u!1(i, 1 - i + n) ENDIF)")
                     (("1"
                       (skosimp)
                       (inst - "n!1")
                       (inst - "n!1")
                       (assert))
                      ("2"
                       (hide -1 2)
                       (skosimp)
                       (case "forall j: j <= n!1+1 => sigma(0, j,
                                         LAMBDA i:
                                           IF 0 > 1 - i + n!1 THEN 0 ELSE u!1(n!1 + 1 - i, i) ENDIF)
                                    =
                                    sigma(n!1+1-j, n!1 + 1,
                                          LAMBDA i:
                                            IF 0 > 1 - i + n!1 THEN 0 ELSE u!1(i, 1 - i + n!1) ENDIF)")
                       (("1" (inst - "n!1+1") (assert))
                        ("2"
                         (hide 2)
                         (induct "j")
                         (("1"
                           (expand "sigma")
                           (expand "sigma")
                           (propax))
                          ("2"
                           (skosimp*)
                           (expand "sigma" 1 1)
                           (assert)
                           (replace -1 1)
                           (hide -1)
                           (lemma "sigma_first"
                            ("low"
                             "n!1 - j!2"
                             "high"
                             "1 + n!1"
                             "F"
                             "LAMBDA i:
                                            IF 0 > 1 - i + n!1 THEN 0 ELSE u!1(i, 1 - i + n!1) ENDIF"))
                           (("1" (assert)) ("2" (skosimp) (assert))))
                          ("3" (skosimp) (skosimp) (assert))
                          ("4" (skosimp) (assert))
                          ("5" (skosimp) (skosimp) (assert))))
                        ("3" (skosimp) (skosimp) (assert))
                        ("4" (skosimp) (assert))
                        ("5" (skosimp) (skosimp) (assert))))
                      ("3" (skosimp) (assert)) ("4" (skosimp) (assert))))
                    ("2"
                     (hide 2)
                     (skosimp)
                     (case "forall j: j <=n!1+1=>sigma(1 + double_index_n(0, n!1), 1+double_index_n(0, n!1)+j,
                                       single_index(u!1))
                                  =
                                  sigma(0, j,
                                        LAMBDA i:
                                          IF 0 > 1 - i + n!1 THEN 0 ELSE u!1(n!1 + 1 - i, i) ENDIF)")
                     (("1"
                       (inst - "n!1+1")
                       (assert)
                       (case-replace
                        "double_index_n(0, 1 + n!1)=2 + double_index_n(0, n!1) + n!1")
                       (assert)
                       (hide -1 2)
                       (expand "double_index_n")
                       (assert))
                      ("2"
                       (hide 2)
                       (induct "j")
                       (("1"
                         (assert)
                         (expand "sigma")
                         (assert)
                         (expand "sigma")
                         (case-replace
                          "1 + double_index_n(0, n!1)=double_index_n(n!1+1,0)")
                         (("1"
                           (expand "single_index")
                           (lemma "double_index_ij_n"
                            ("i" "1+n!1" "j" "0"))
                           (flatten)
                           (assert))
                          ("2"
                           (hide 2)
                           (expand "double_index_n")
                           (assert))))
                        ("2"
                         (skosimp*)
                         (expand "sigma" 1)
                         (assert)
                         (replace -1)
                         (hide -1)
                         (assert)
                         (case-replace
                          "2 + double_index_n(0, n!1) + j!2=double_index_n(n!1-j!2,1+j!2)")
                         (("1"
                           (expand "single_index")
                           (lemma "double_index_ij_n"
                            ("i" "n!1-j!2" "j" "1+j!2"))
                           (flatten)
                           (assert))
                          ("2"
                           (hide 2)
                           (expand "double_index_n")
                           (assert))))
                        ("3" (skosimp) (skosimp) (assert))
                        ("4" (skosimp) (assert))
                        ("5" (skosimp) (assert))))
                      ("3" (skosimp) (skosimp) (assert))
                      ("4" (skosimp) (assert))))
                    ("3" (skosimp) (assert))))
                  ("3" (skosimp) (assert))))
                ("2"
                 (hide 2)
                 (skosimp)
                 (lemma "sigma_last"
                  ("low"
                   "0"
                   "high"
                   "n!1+1"
                   "F"
                   "LAMBDA i:
                                  IF 0 > 1 - i + n!1 THEN 0 ELSE u!1(i, 1 - i + n!1) ENDIF"))
                 (("1" (assert)) ("2" (skosimp) (assert))))
                ("3" (skosimp) (assert))))
              ("3" (skosimp) (assert)) ("4" (skosimp) (assert))
              ("5" (skosimp) (assert))))
            ("2"
             (hide 2)
             (replace -2)
             (hide -2)
             (lemma "sigma_restrict_eq"
              ("low"
               "0"
               "high"
               "j!1"
               "F"
               "LAMBDA i:
                             IF 0 > 1 - i + j!1 THEN 0
                             ELSE sigma(0, j!1 - i, LAMBDA j: u!1(i, j))
                             ENDIF"
               "G"
               "LAMBDA i: sigma(0, j!1 - i, LAMBDA j: u!1(i, j))"))
             (("1"
               (split -1)
               (("1" (propax))
                ("2" (hide 2) (expand "restrict") (propax))))
              ("2" (skosimp) (inst + "j!1") (assert))))))
          ("2"
           (hide -1 2)
           (apply-extensionality :hide? t)
           (("1"
             (case-replace "0 > 1 - x!1 + j!1")
             (("1" (assert)) ("2" (assert))))
            ("2" (skosimp) (inst + "j!1") (assert))
            ("3" (skosimp) (assert))))))
        ("2" (skosimp) (inst + "j!1") (assert))
        ("3" (skosimp) (assert))))
      ("2"
       (hide-all-but 1)
       (expand "double_index_n")
       (rewrite "sq_rew")
       (assert))))
    ("3" (skosimp) (inst + "n!2") (assert))))


proof_type: f_proof
decl_type: formula
library: extended_nnreal
theory: double_nn_sequence
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp)
   (rewrite "nn_index_scaf1")
   (lemma "sigma_split"
    ("low"
     "0"
     "high"
     "2*n!1"
     "z"
     "n!1"
     "F"
     "LAMBDA i: sigma(0, 2 * n!1 - i, LAMBDA j: u!1(i, j))"))
   (("1"
     (assert)
     (replace -1)
     (hide -1)
     (lemma "sigma_le"
      ("low"
       "0"
       "high"
       "n!1"
       "F"
       "LAMBDA i: sigma(0, n!1, LAMBDA j: u!1(i, j))"
       "G"
       "LAMBDA i: sigma(0, 2 * n!1 - i, LAMBDA j: u!1(i, j))"))
     (split -1)
     (("1"
       (lemma "sigma_ge_0"
        ("low"
         "1+n!1"
         "high"
         "2*n!1"
         "F"
         "LAMBDA i: sigma(0, 2 * n!1 - i, LAMBDA j: u!1(i, j))"))
       (assert))
      ("2"
       (hide 2)
       (skosimp)
       (typepred "n!2")
       (lemma "sigma_split"
        ("low"
         "0"
         "high"
         "2*n!1-n!2"
         "z"
         "n!1"
         "F"
         "LAMBDA j: u!1(n!2, j)"))
       (assert)
       (replace -1)
       (hide -1)
       (assert))))
    ("2" (skosimp) (assert))))


proof_type: f_proof
decl_type: formula
library: extended_nnreal
theory: double_nn_sequence
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skolem + ("i!1" "j!1" "u!1"))
   (lemma "nn_index_scaf2" ("u" "u!1" "n" "i!1+j!1"))
   (inst + "double_index_n(0, 2 * (i!1 + j!1))")
   (name-replace "RHS"
    "series(single_index(u!1))(double_index_n(0, 2 * (i!1 + j!1)))")
   (lemma "sigma_split"
    ("low"
     "0"
     "high"
     "i!1+j!1"
     "z"
     "i!1"
     "F"
     "LAMBDA i: sigma(0, i!1 + j!1, LAMBDA j: u!1(i, j))"))
   (assert)
   (replace -1)
   (hide -1)
   (lemma "sigma_ge_0"
    ("low"
     "1+i!1"
     "high"
     "i!1+j!1"
     "F"
     "LAMBDA i: sigma(0, i!1 + j!1, LAMBDA j: u!1(i, j))"))
   (split -1)
   (("1"
     (name-replace "DRL1"
      "sigma(1 + i!1, i!1 + j!1,
                  LAMBDA i: sigma(0, i!1 + j!1, LAMBDA j: u!1(i, j)))")
     (lemma "sigma_sum"
      ("low"
       "0"
       "high"
       "i!1"
       "F"
       "LAMBDA i: sigma(0, j!1, LAMBDA j: u!1(i, j))"
       "G"
       "LAMBDA i: sigma(j!1+1, i!1+j!1,LAMBDA j: u!1(i, j))"))
     (assert)
     (case-replace
      "(LAMBDA (i_1: nat):
                     sigma(0, j!1, LAMBDA j: u!1(i_1, j)) +
                      sigma(1 + j!1, i!1 + j!1, LAMBDA j: u!1(i_1, j)))=LAMBDA i: sigma(0, i!1 + j!1, LAMBDA j: u!1(i, j))")
     (("1" (replace -2 -4 rl) (assert))
      ("2"
       (apply-extensionality 1 :hide? t)
       (hide-all-but 1)
       (lemma "sigma_split"
        ("low"
         "0"
         "high"
         "i!1+j!1"
         "z"
         "j!1"
         "F"
         "LAMBDA j: u!1(x!1, j)"))
       (assert))))
    ("2" (skosimp) (hide-all-but 1) (rewrite "sigma_ge_0"))))


proof_type: f_proof
decl_type: formula
library: extended_nnreal
theory: double_nn_sequence
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp)
   (inst + "n!1" "n!1")
   (lemma "nn_index_scaf1" ("u" "u!1" "n" "n!1"))
   (case "n!1<=double_index_n(0, n!1)")
   (("1"
     (lemma "nn_series_increasing" ("v" "single_index(u!1)"))
     (expand "increasing?")
     (inst - "n!1" "double_index_n(0, n!1)")
     (assert)
     (name-replace "LHS" "series(single_index(u!1))(n!1)")
     (name-replace "DRL1"
      "series(single_index(u!1))(double_index_n(0, n!1))")
     (lemma "sigma_le"
      ("low"
       "0"
       "high"
       "n!1"
       "F"
       "LAMBDA i: sigma(0, n!1 - i, LAMBDA j: u!1(i, j))"
       "G"
       "LAMBDA i: sigma(0, n!1, LAMBDA j: u!1(i, j))"))
     (("1"
       (assert)
       (skosimp)
       (hide-all-but 1)
       (typepred "n!2")
       (lemma "sigma_split"
        ("low"
         "0"
         "high"
         "n!1"
         "z"
         "n!1-n!2"
         "F"
         "LAMBDA j: u!1(n!2, j)"))
       (assert)
       (replace -1)
       (assert))
      ("2" (skosimp) (assert))))
    ("2" (hide-all-but 1) (expand "double_index_n") (assert))))


proof_type: f_proof
decl_type: formula
library: extended_nnreal
theory: double_nn_sequence
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp)
   (split)
   (("1"
     (flatten)
     (expand "bounded_above?")
     (expand "convergent?")
     (skosimp)
     (inst + "l!1")
     (expand "upper_bound?")
     (skosimp)
     (typepred "s!1")
     (expand "Im")
     (skolem - ("n!1"))
     (expand "convergence")
     (case "l!1<series(v!1)(n!1)")
     (("1"
       (hide -2 1)
       (inst - "series(v!1)(n!1)-l!1")
       (("1"
         (skosimp)
         (inst - "n!1+n!2")
         (assert)
         (lemma "nn_series_increasing" ("v" "v!1"))
         (expand "increasing?")
         (inst - "n!1" "n!1+n!2")
         (assert))
        ("2" (assert))))
      ("2" (assert))))
    ("2"
     (flatten)
     (typepred "lub(Im(series(v!1)))")
     (("1"
       (expand "least_upper_bound?")
       (flatten)
       (expand "convergent?")
       (inst + "lub(Im(series(v!1)))")
       (expand "convergence")
       (skosimp)
       (name-replace "LUB" "lub(Im(series(v!1)))")
       (case "EXISTS n:
                     FORALL i: i >= n IMPLIES LUB-series(v!1)(i) < epsilon!1")
       (("1"
         (skosimp)
         (inst + "n!1")
         (skosimp)
         (inst - "i!1")
         (assert)
         (expand "upper_bound?")
         (inst - "series(v!1)(i!1)")
         (("1"
           (expand "abs")
           (expand "<=" -2)
           (split -2)
           (("1" (assert)) ("2" (assert))))
          ("2" (expand "Im") (inst + "i!1"))))
        ("2"
         (hide 2)
         (inst - "LUB-epsilon!1")
         (assert)
         (expand "upper_bound?")
         (skosimp)
         (typepred "s!1")
         (case "LUB<s!1+epsilon!1")
         (("1"
           (hide 2)
           (copy -2)
           (expand "Im" -1)
           (skolem - "n!1")
           (replace -1)
           (hide -1)
           (inst + "n!1")
           (skosimp)
           (lemma "nn_series_increasing" ("v" "v!1"))
           (expand "increasing?")
           (inst - "n!1" "i!1")
           (assert))
          ("2" (assert))))))
      ("2" (propax))))))


proof_type: f_proof
decl_type: formula
library: extended_nnreal
theory: double_nn_sequence
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp)
   (lemma "nn_series_increasing" ("v" "v!1"))
   (lemma "nn_convegent_bounded" ("v" "v!1"))
   (assert)
   (lemma "increasing_bounded_convergence" ("v1" "series(v!1)"))
   (("1" (assert) (expand "sup") (rewrite "limit_def" 1))
    ("2"
     (hide-all-but (-1 1))
     (expand "Im")
     (expand "bounded_above?")
     (skosimp)
     (expand "upper_bound?")
     (inst + "x!1")
     (skosimp)
     (inst - "series(v!1)(x!2)")
     (inst + "x!2"))))


proof_type: f_proof
decl_type: formula
library: extended_nnreal
theory: double_nn_sequence
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp)
   (split)
   (("1"
     (flatten)
     (lemma "increasing_bounded_convergence" ("v1" "v!1"))
     (("1"
       (assert)
       (expand "sup")
       (expand "Im")
       (lemma "unique_limit"
        ("u"
         "v!1"
         "l1"
         "lub({z:real | EXISTS (x: nat): z = v!1(x)})"
         "l2"
         "l!1"))
       (("1" (assert))
        ("2"
         (hide -1 2)
         (split)
         (("1"
           (expand "nonempty?")
           (expand "empty?")
           (expand "member")
           (inst - "v!1(0)")
           (inst + "0"))
          ("2"
           (expand "bounded_above?")
           (inst + "l!1")
           (expand "upper_bound?")
           (skosimp)
           (typepred "s!1")
           (skosimp)
           (expand "convergence")
           (replace -1)
           (case "l!1<v!1(x!1)")
           (("1"
             (hide -2 1)
             (inst - "v!1(x!1)-l!1")
             (("1"
               (skosimp)
               (inst - "x!1+n!1")
               (assert)
               (expand "increasing?")
               (inst - "x!1" "n!1+x!1")
               (assert))
              ("2" (assert))))
            ("2" (assert))))))))
      ("2"
       (hide 2)
       (expand "bounded_above?")
       (inst + "l!1")
       (skosimp)
       (case "l!1<v!1(x!1)")
       (("1"
         (hide 1)
         (expand "convergence")
         (inst - "v!1(x!1)-l!1")
         (("1"
           (skosimp)
           (inst - "x!1+n!1")
           (assert)
           (expand "increasing?")
           (inst - "x!1" "n!1+x!1")
           (assert))
          ("2" (assert))))
        ("2" (assert))))))
    ("2"
     (flatten)
     (expand "convergence")
     (skosimp)
     (expand "least_upper_bound?")
     (flatten)
     (inst - "l!1-epsilon!1")
     (assert)
     (expand "upper_bound?")
     (skosimp)
     (typepred "s!1")
     (expand "Im")
     (skosimp)
     (inst + "x!1")
     (skosimp)
     (expand "increasing?")
     (inst -4 "x!1" "i!1")
     (assert)
     (inst - "v!1(i!1)")
     (("1"
       (expand "abs")
       (assert)
       (case-replace "v!1(i!1) - l!1 < 0")
       (("1" (assert)) ("2" (assert))))
      ("2" (expand "Im") (inst + "i!1"))))))


proof_type: f_proof
decl_type: formula
library: extended_nnreal
theory: double_nn_sequence
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skolem + ("_" "j!1" "u!1"))
   (induct "i1")
   (("1"
     (expand "series")
     (expand "sigma" 1 4)
     (expand "sigma" 1 4)
     (expand "sigma" 1 1)
     (expand "sigma" 1 1)
     (propax))
    ("2"
     (skosimp*)
     (expand "series")
     (expand "sigma" 1 4)
     (expand "sigma" 1 1)
     (replace -1)
     (hide -1)
     (lemma "sigma_sum"
      ("low"
       "0"
       "high"
       "j!1"
       "F"
       "LAMBDA j: u!1(1 + j!2, j)"
       "G"
       "LAMBDA j: sigma(0, j!2, LAMBDA i: u!1(i, j))"))
     (assert))))


proof_type: f_proof
decl_type: formula
library: extended_nnreal
theory: double_nn_sequence
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp)
   (lemma "nonneg_series_inj_conv" ("nna" "single_index(u!1)"))
   (assert)
   (hide -2)
   (expand "o ")
   (expand "single_index")
   (lemma "double_index_n_bijective")
   (expand "bijective?")
   (flatten)
   (inst - "lambda j: double_index_n(i!1,j)")
   (("1"
     (case-replace
      "(LAMBDA (x: nat):
                                u!1(double_index_i(double_index_n(i!1, x)),
                                    double_index_j(double_index_n(i!1, x))))=(LAMBDA j: u!1(i!1, j))")
     (hide -2 2)
     (apply-extensionality :hide? t)
     (lemma "double_index_ij_n" ("i" "i!1" "j" "x!1"))
     (flatten)
     (replace -1)
     (replace -2)
     (propax))
    ("2"
     (hide 2 -2)
     (expand "injective?")
     (skosimp)
     (inst - "(i!1, x1!1)" "(i!1, x2!1)")
     (assert))))


proof_type: f_proof
decl_type: formula
library: extended_nnreal
theory: double_nn_sequence
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp)
   (lemma "double_subseq_convergent" ("u" "u!1" "i" "i!1"))
   (lemma "nn_convegent_bounded" ("v" "single_index(u!1)"))
   (assert)
   (lemma "nn_convegent_bounded" ("v" "LAMBDA j: u!1(i!1, j)"))
   (assert))


proof_type: f_proof
decl_type: formula
library: extended_nnreal
theory: double_nn_sequence
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skolem + ("_" "u!1"))
   (case-replace "FORALL i: convergent?(LAMBDA j: u!1(i, j))")
   (("1"
     (case "forall i: convergent?(LAMBDA j: series(LAMBDA i: u!1(i, j))(i))")
     (("1"
       (induct "i1")
       (("1"
         (expand "series")
         (expand "sigma")
         (expand "sigma")
         (propax))
        ("2"
         (skosimp*)
         (expand "series")
         (expand "sigma" 1)
         (replace -1)
         (rewrite "limit_sum" 1 :dir rl)
         (("1" (expand "+" 1) (propax)) ("2" (inst - "j!1"))
          ("3" (inst -3 "1+j!1"))))))
      ("2"
       (hide 2)
       (induct "i")
       (("1"
         (expand "series")
         (expand "sigma")
         (expand "sigma")
         (inst - "0"))
        ("2"
         (skosimp*)
         (expand "series")
         (expand "sigma" 1)
         (lemma "convergent_sum"
          ("s1"
           "LAMBDA j:
                              u!1(1 + j!1, j)"
           "s2"
           "LAMBDA j: sigma(0, j!1, LAMBDA i: u!1(i, j))"))
         (inst - "1+j!1")
         (replace -2)
         (replace -3)
         (expand "+")
         (propax))))))
    ("2" (skosimp) (skosimp) (inst - "i!1"))))


proof_type: f_proof
decl_type: formula
library: extended_nnreal
theory: double_nn_sequence
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (lemma "series_limit_def")
   (inst - "i1!1" "lambda (i,j): series(LAMBDA j: u!1(i, j))(j)")
   (("1"
     (split)
     (("1"
       (expand "series")
       (replace -1 1)
       (hide -1)
       (lemma "extensionality_postulate"
        ("f"
         "(LAMBDA (j_1: nat):
                       sigma(0, i1!1,
                             LAMBDA (i_1: nat):
                               sigma(0, j_1, LAMBDA j: u!1(i_1, j))))"
         "g"
         "(LAMBDA (n: nat):
                        sigma(0, n, LAMBDA j: sigma(0, i1!1, LAMBDA i: u!1(i, j))))"))
       (flatten)
       (hide -2 -3)
       (split -1)
       (("1" (replace -1) (propax))
        ("2"
         (hide 2)
         (induct "x")
         (("1"
           (expand "sigma" 1 3)
           (expand "sigma" 1 3)
           (expand "sigma" 1 2)
           (expand "sigma" 1 2)
           (propax))
          ("2"
           (skosimp*)
           (expand "sigma" 1 3)
           (expand "sigma" 1 2)
           (lemma "sigma_sum"
            ("low"
             "0"
             "high"
             "i1!1"
             "F"
             "LAMBDA (i_1: nat):
                           u!1(i_1, 1 + j!1)"
             "G"
             "LAMBDA (i_1: nat):sigma(0, j!1, LAMBDA j: u!1(i_1, j))"))
           (replace -1 1 rl)
           (hide -1)
           (replace -1)
           (propax))))))
      ("2"
       (hide 2)
       (induct "i_1")
       (("1" (inst - "0") (expand "series") (propax))
        ("2" (skosimp*) (expand "series") (inst - "1+j!1"))))))
    ("2"
     (hide-all-but 1)
     (skosimp*)
     (expand "series")
     (lemma "sigma_ge_0"
      ("low" "0" "high" "j!1" "F" "LAMBDA (j_1: nat): u!1(i!1, j_1)"))
     (assert))))


proof_type: f_proof
decl_type: formula
library: extended_nnreal
theory: double_nn_sequence
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp)
   (split)
   (("1"
     (flatten)
     (lemma "nn_convegent_bounded" ("v" "single_index(u!1)"))
     (flatten -1)
     (hide -2)
     (split)
     (("1"
       (lemma "nn_convergence_least_upper_bound"
        ("v" "series(single_index(u!1))" "l" "l!1"))
       (("1"
         (rewrite "nn_series_increasing")
         (assert)
         (hide -2 -3)
         (expand "least_upper_bound?")
         (flatten)
         (split 1)
         (("1"
           (hide -2)
           (expand "upper_bound?")
           (skosimp)
           (typepred "s!1")
           (skosimp)
           (replace -1 1 rl)
           (hide -1)
           (expand "series")
           (lemma "nn_index_scaf3" ("u" "u!1"))
           (inst - "i!1" "j!1")
           (skosimp)
           (inst - "series(single_index(u!1))(n!1)")
           (("1"
             (lemma "double_series" ("u" "u!1"))
             (expand "series" -1)
             (inst - "i!1" "j!1")
             (assert))
            ("2" (expand "Im") (inst + "n!1"))))
          ("2"
           (skosimp)
           (expand "upper_bound?" -1)
           (inst -3 "y!1")
           (assert)
           (case "y!1<l!1")
           (("1"
             (hide 1)
             (expand "upper_bound?")
             (skosimp)
             (typepred "s!1")
             (expand "Im" -1)
             (skolem - ("n!1"))
             (replace -1)
             (lemma "nn_index_scaf4" ("n" "n!1" "u" "u!1"))
             (skosimp)
             (inst -
              "series(LAMBDA j: series(LAMBDA i: u!1(i, j))(i!1))(j!1)")
             (("1"
               (rewrite "double_series" -4 :dir rl)
               (expand "series" -4)
               (assert))
              ("2" (inst + "i!1" "j!1"))))
            ("2" (assert))))))
        ("2"
         (hide-all-but 1)
         (skosimp)
         (expand "series")
         (rewrite "sigma_ge_0"))))
      ("2" (expand "convergent?") (inst + "l!1"))))
    ("2"
     (flatten)
     (case "bounded_above?(Im(series(single_index(u!1))))")
     (("1"
       (lemma "nn_convegent_bounded" ("v" "single_index(u!1)"))
       (assert)
       (lemma "nn_convergence_least_upper_bound"
        ("v" "series(single_index(u!1))" "l" "l!1"))
       (("1"
         (rewrite "nn_series_increasing")
         (replace -1)
         (hide -1 -2)
         (hide -1)
         (expand "least_upper_bound?")
         (flatten)
         (split)
         (("1"
           (expand "upper_bound?")
           (skosimp)
           (typepred "s!1")
           (expand "Im" -1)
           (skolem - ("n!1"))
           (lemma "nn_index_scaf4" ("u" "u!1" "n" "n!1"))
           (skosimp)
           (inst -
            "series(LAMBDA j: series(LAMBDA i: u!1(i, j))(i!1))(j!1)")
           (("1"
             (rewrite "double_series" -3 :dir rl)
             (expand "series" -3)
             (assert))
            ("2" (inst + "i!1" "j!1"))))
          ("2"
           (skosimp)
           (inst -3 "y!1")
           (assert)
           (case "y!1<l!1")
           (("1"
             (hide 1)
             (expand "upper_bound?" 1)
             (skosimp)
             (typepred "s!1")
             (skosimp)
             (rewrite "double_series" -1 :dir rl)
             (expand "series" -1)
             (lemma "nn_index_scaf3" ("u" "u!1"))
             (inst - "i!1" "j!1")
             (skosimp)
             (replace -2)
             (expand "upper_bound?" -4)
             (inst - "series(single_index(u!1))(n!1)")
             (("1" (assert)) ("2" (expand "Im") (inst + "n!1"))))
            ("2" (assert))))))
        ("2"
         (hide-all-but 1)
         (skosimp)
         (expand "series")
         (rewrite "sigma_ge_0"))))
      ("2"
       (expand "least_upper_bound?")
       (flatten)
       (hide -2 2)
       (expand "bounded_above?")
       (inst + "l!1")
       (expand "upper_bound?")
       (skosimp)
       (typepred "s!1")
       (expand "Im")
       (skolem - "n!1")
       (replace -1)
       (hide -1)
       (lemma "nn_index_scaf4" ("u" "u!1" "n" "n!1"))
       (skosimp)
       (inst - "series(LAMBDA j: series(LAMBDA i: u!1(i, j))(i!1))(j!1)")
       (("1"
         (rewrite "double_series" -2 :dir rl)
         (expand "series")
         (assert))
        ("2" (inst + "i!1" "j!1"))))))))


proof_type: f_proof
decl_type: formula
library: extended_nnreal
theory: double_nn_sequence
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp)
   (lemma "nn_convergence_least_upper_bound"
    ("v"
     "series(LAMBDA i: limit(series(LAMBDA j: u!1(i, j))))"
     "l"
     "l!1"))
   (("1"
     (rewrite "nn_series_increasing")
     (("1"
       (replace -1)
       (hide -1)
       (split)
       (("1"
         (flatten)
         (expand "least_upper_bound?")
         (flatten)
         (case-replace
          "upper_bound?(l!1,
                             {z |
                                EXISTS i, j:
                                  series(LAMBDA j: series(LAMBDA i: u!1(i, j))(i))(j)
                                   = z})")
         (("1"
           (skosimp)
           (inst -3 "y!1")
           (assert)
           (case "y!1<l!1")
           (("1"
             (hide 2)
             (expand "upper_bound?")
             (skosimp)
             (typepred "s!1")
             (expand "Im" -1)
             (skolem - ("n!1"))
             (lemma "double_approx" ("u" "u!1"))
             (inst -1 "n!1")
             (replace -7)
             (replace -2 * rl)
             (lemma "nn_limit_lub"
              ("v" "(LAMBDA j: series(LAMBDA i: u!1(i, j))(n!1))"))
             (("1"
               (replace -2 * rl)
               (lemma "nn_convegent_bounded"
                ("v" "LAMBDA j: series(LAMBDA i: u!1(i, j))(n!1)"))
               (flatten -1)
               (hide -1)
               (split -1)
               (("1"
                 (replace -1)
                 (hide -1)
                 (hide -2 -3)
                 (typepred
                  "lub(Im(series((LAMBDA j: series(LAMBDA i: u!1(i, j))(n!1)))))")
                 (expand "least_upper_bound?")
                 (flatten)
                 (replace -3 * rl)
                 (inst -2 "y!1")
                 (assert)
                 (expand "upper_bound?" 1)
                 (skosimp)
                 (typepred "s!2")
                 (expand "Im" -1)
                 (skosimp)
                 (inst -7 "s!2")
                 (inst + "n!1" "x!1")
                 (assert))
                ("2"
                 (hide-all-but (-5 1))
                 (expand "bounded_above?")
                 (inst + "l!1")
                 (expand "upper_bound?")
                 (skosimp)
                 (typepred "s!2")
                 (expand "Im")
                 (skosimp)
                 (inst - "s!2")
                 (inst + "n!1" "x!1")
                 (assert))))
              ("2"
               (hide-all-but 1)
               (skosimp)
               (expand "series")
               (rewrite "sigma_ge_0"))))
            ("2" (assert))))
          ("2"
           (hide 2)
           (hide -2)
           (expand "upper_bound?")
           (skosimp)
           (typepred "s!1")
           (skosimp)
           (rewrite "double_series" -1 :dir rl)
           (inst -
            "series(LAMBDA i:
                                         limit(series(LAMBDA j: u!1(i, j))))(i!1)")
           (("1"
             (case "series(LAMBDA i: series(LAMBDA j: u!1(i, j))(j!1))(i!1)<=series(LAMBDA i: limit(series(LAMBDA j: u!1(i, j))))(i!1)")
             (("1" (assert))
              ("2"
               (hide-all-but (-3 1))
               (expand "series" 1 3)
               (expand "series" 1 1)
               (rewrite "sigma_le")
               (hide 2)
               (skosimp)
               (inst - "n!1")
               (lemma "nn_limit_lub" ("v" "LAMBDA j: u!1(n!1, j)"))
               (assert)
               (replace -1)
               (hide -1 -2)
               (typepred "lub(Im(series(LAMBDA j: u!1(n!1, j))))")
               (expand "least_upper_bound?")
               (flatten)
               (hide -2)
               (expand "upper_bound?")
               (inst - "series(LAMBDA j: u!1(n!1, j))(j!1)")
               (expand "Im")
               (inst + "j!1"))))
            ("2" (expand "Im") (inst + "i!1"))))
          ("3"
           (hide 2)
           (expand "nonempty?")
           (expand "empty?")
           (expand "member")
           (inst - "series(LAMBDA j: series(LAMBDA i: u!1(i, j))(0))(0)")
           (inst + "0" "0"))))
        ("2"
         (flatten)
         (expand "least_upper_bound?")
         (flatten)
         (case-replace
          "upper_bound?(l!1,
                             Im(series(LAMBDA i:
                                         limit(series(LAMBDA j: u!1(i, j))))))")
         (("1"
           (skosimp)
           (inst -3 "y!1")
           (assert)
           (case "y!1<l!1")
           (("1"
             (hide 2)
             (expand "upper_bound?")
             (skosimp)
             (typepred "s!1")
             (skosimp)
             (inst -5
              "series(LAMBDA i:
                                           limit(series(LAMBDA j: u!1(i, j))))(i!1)")
             (("1"
               (rewrite "double_series" -1 :dir rl)
               (case "series(LAMBDA i: series(LAMBDA j: u!1(i, j))(j!1))(i!1)<=series(LAMBDA i: limit(series(LAMBDA j: u!1(i, j))))(i!1)")
               (("1" (assert))
                ("2"
                 (hide-all-but (-6 1))
                 (expand "series" 1 3)
                 (expand "series" 1 1)
                 (rewrite "sigma_le")
                 (hide 2)
                 (skosimp)
                 (inst - "n!1")
                 (lemma "nn_limit_lub" ("v" "LAMBDA j: u!1(n!1, j)"))
                 (replace -2)
                 (replace -1)
                 (hide -1 -2)
                 (typepred "lub(Im(series(LAMBDA j: u!1(n!1, j))))")
                 (expand "least_upper_bound?")
                 (flatten)
                 (hide -2)
                 (expand "upper_bound?")
                 (inst - "series(LAMBDA j: u!1(n!1, j))(j!1)")
                 (expand "Im")
                 (inst + "j!1"))))
              ("2" (expand "Im") (inst + "i!1"))))
            ("2" (assert))))
          ("2"
           (hide 2)
           (expand "upper_bound?")
           (skosimp)
           (typepred "s!1")
           (expand "Im" -1)
           (skolem - ("n!1"))
           (lemma "double_approx" ("u" "u!1"))
           (inst - "n!1")
           (replace -5)
           (replace -2 * rl)
           (lemma "nn_limit_lub"
            ("v" "LAMBDA j: series(LAMBDA i: u!1(i, j))(n!1)"))
           (("1"
             (replace -2 * rl)
             (lemma "nn_convegent_bounded"
              ("v" "LAMBDA j: series(LAMBDA i: u!1(i, j))(n!1)"))
             (replace -1 -2)
             (hide -1)
             (split -1)
             (("1"
               (hide -2 -3)
               (typepred
                "lub(Im(series(LAMBDA j: series(LAMBDA i: u!1(i, j))(n!1))))")
               (expand "least_upper_bound?")
               (flatten)
               (replace -3 * rl)
               (inst -2 "l!1")
               (assert)
               (expand "upper_bound?" 1)
               (skosimp)
               (typepred "s!2")
               (expand "Im" -1)
               (skosimp)
               (inst -4 "s!2")
               (inst + "n!1" "x!1")
               (assert))
              ("2"
               (hide-all-but (-3 1))
               (expand "bounded_above?")
               (inst + "l!1")
               (expand "upper_bound?")
               (skosimp)
               (typepred "s!2")
               (expand "Im")
               (skosimp)
               (inst - "s!2")
               (inst + "n!1" "x!1")
               (assert))))
            ("2"
             (hide-all-but 1)
             (skosimp)
             (expand "series")
             (rewrite "sigma_ge_0"))))))))
      ("2"
       (hide 2 -1)
       (skosimp)
       (inst - "i!1")
       (lemma "limit_nonneg" ("nna" "series(LAMBDA j: u!1(i!1, j))"))
       (("1" (assert))
        ("2"
         (hide-all-but 1)
         (skosimp)
         (expand "series")
         (rewrite "sigma_ge_0"))))))
    ("2"
     (hide 2)
     (skosimp)
     (expand "series")
     (rewrite "sigma_ge_0")
     (hide 2)
     (skosimp)
     (inst - "n!1")
     (lemma "limit_nonneg"
      ("nna" "LAMBDA (n: nat): sigma(0, n, LAMBDA j: u!1(n!1, j))"))
     (assert))
    ("3" (propax))))


proof_type: f_proof
decl_type: formula
library: extended_nnreal
theory: double_nn_sequence
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp)
   (case-replace "(FORALL i: convergent?(series(LAMBDA j: u!1(i, j))))")
   (("1"
     (lemma "double_approx2" ("u" "u!1" "l" "l!1"))
     (lemma "double_approx1" ("u" "u!1" "l" "l!1"))
     (replace -3)
     (name-replace "LUB"
      "least_upper_bound?(l!1,
                                {z |
                                   EXISTS i, j:
                                     series(LAMBDA
                                            j:
                                            series(LAMBDA i: u!1(i, j))(i))
                                           (j)
                                      = z})")
     (("1" (replace -1) (replace -2) (hide-all-but 1) (grind))
      ("2"
       (hide-all-but 1)
       (expand "nonempty?")
       (expand "empty?")
       (expand "member")
       (inst - "series(LAMBDA j: series(LAMBDA i: u!1(i, j))(0))(0)")
       (inst + "0" "0"))))
    ("2"
     (split)
     (("1"
       (flatten)
       (hide 1)
       (skosimp)
       (lemma "double_subseq_convergent" ("u" "u!1" "i" "i!1"))
       (assert)
       (expand "convergent?")
       (hide 2)
       (inst + "l!1"))
      ("2" (flatten))))))


proof_type: f_proof
decl_type: formula
library: extended_nnreal
theory: double_nn_sequence
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp)
   (split)
   (("1"
     (flatten)
     (split)
     (("1"
       (skosimp)
       (lemma "double_subseq_convergent" ("u" "u!1" "i" "i!1"))
       (assert))
      ("2"
       (expand "convergent?")
       (skosimp)
       (inst + "l!1")
       (lemma "double_left_convergence" ("u" "u!1" "l" "l!1"))
       (("1" (assert))
        ("2"
         (lemma "limit_nonneg" ("nna" "series(single_index(u!1))"))
         (("1"
           (assert)
           (split -1)
           (("1" (rewrite "limit_def" -2 :dir rl) (assert))
            ("2" (expand "convergent?") (inst + "l!1"))))
          ("2"
           (skolem + ("n!1"))
           (lemma "nn_series_increasing"
            ("v" "single_index[nnreal](u!1)"))
           (expand "increasing?")
           (inst - "0" "n!1")
           (assert)
           (expand "series" -1 1)
           (expand "sigma")
           (expand "single_index")
           (assert))))))))
    ("2"
     (flatten)
     (expand "convergent?" (-2 1))
     (skosimp)
     (inst + "l!1")
     (lemma "double_left_convergence" ("u" "u!1" "l" "l!1"))
     (("1" (replace -1 1) (replace -2) (propax))
      ("2"
       (hide 2)
       (lemma "limit_nonneg"
        ("nna" "series(LAMBDA i: limit(series(LAMBDA j: u!1(i, j))))"))
       (("1"
         (split -1)
         (("1" (rewrite "limit_def" -3 :dir rl) (assert))
          ("2" (expand "convergent?") (inst + "l!1"))))
        ("2"
         (skolem + ("n!1"))
         (hide -2 2)
         (lemma "nn_series_increasing"
          ("v" "LAMBDA i: limit(series(LAMBDA j: u!1(i, j)))"))
         (("1"
           (expand "increasing?")
           (inst - "0" "n!1")
           (assert)
           (expand "series" -1 1)
           (expand "sigma")
           (expand "sigma")
           (inst - "0")
           (lemma "limit_nonneg" ("nna" "series(LAMBDA j: u!1(0, j))"))
           (("1" (split -1) (("1" (assert)) ("2" (propax))))
            ("2"
             (skolem + ("m!1"))
             (hide 2)
             (expand "series")
             (lemma "sigma_ge_0"
              ("low" "0" "high" "m!1" "F" "LAMBDA j: u!1(0, j)"))
             (assert))))
          ("2"
           (skosimp)
           (inst - "i!1")
           (hide 2)
           (lemma "limit_nonneg" ("nna" "series(LAMBDA j: u!1(i!1, j))"))
           (("1" (assert))
            ("2"
             (skolem + ("m!1"))
             (hide -1 2)
             (expand "series")
             (lemma "sigma_ge_0"
              ("low" "0" "high" "m!1" "F" "LAMBDA j: u!1(i!1, j)"))
             (assert))))
          ("3" (propax))))
        ("3" (propax))))))))


proof_type: f_proof
decl_type: formula
library: extended_nnreal
theory: double_nn_sequence
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp)
   (lemma "double_left_convergence"
    ("u" "u!1" "l" "limit(series(single_index(u!1)))"))
   (("1"
     (rewrite "limit_lemma")
     (rewrite "limit_def" -1 :dir rl)
     (("1" (assert))
      ("2"
       (skosimp)
       (lemma "double_subseq_convergent" ("u" "u!1" "i" "i!1"))
       (assert))))
    ("2"
     (hide 2)
     (lemma "limit_nonneg" ("nna" "series(single_index(u!1))"))
     (("1" (assert))
      ("2"
       (hide-all-but 1)
       (skosimp)
       (lemma "nn_series_increasing" ("v" "single_index[nnreal](u!1)"))
       (expand "increasing?")
       (inst - "0" "x1!1")
       (assert)
       (expand "series" -1 1)
       (expand "sigma")
       (expand "sigma")
       (expand "single_index" -1 1)
       (assert))))))


proof_type: f_proof
decl_type: formula
library: extended_nnreal
theory: double_nn_sequence
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp)
   (name "PHI"
         "lambda n: double_index_n(double_index_j(n), double_index_i(n))")
   (case "bijective?[nat,nat](PHI)")
   (("1"
     (split 1)
     (("1"
       (flatten)
       (lemma "nonneg_series_bij"
        ("nna" "single_index(u!1)" "nnx" "l!1" "phi" "PHI"))
       (("1"
         (assert)
         (expand "o")
         (case-replace
          "(LAMBDA (x: nat): single_index(u!1)(PHI(x)))=single_index(LAMBDA j, i: u!1(i, j))")
         (hide-all-but 1)
         (apply-extensionality :hide? t)
         (expand "single_index")
         (expand "PHI")
         (lemma "double_index_ij_n"
          ("i" "double_index_j(x!1)" "j" "double_index_i(x!1)"))
         (flatten)
         (replace -1)
         (replace -2)
         (propax))
        ("2" (propax))))
      ("2"
       (flatten)
       (lemma "nonneg_series_bij"
        ("nna"
         "single_index(LAMBDA j, i: u!1(i, j))"
         "nnx"
         "l!1"
         "phi"
         "PHI"))
       (("1"
         (assert)
         (expand "o")
         (case-replace
          "(LAMBDA (x: nat):
                                     single_index(LAMBDA j, i: u!1(i, j))(PHI(x)))=single_index(u!1)")
         (apply-extensionality :hide? t)
         (hide-all-but 1)
         (expand "PHI")
         (expand "single_index")
         (lemma "double_index_ij_n"
          ("i" "double_index_j(x!1)" "j" "double_index_i(x!1)"))
         (flatten)
         (assert))
        ("2" (propax))))))
    ("2"
     (hide-all-but 1)
     (expand "PHI")
     (lemma "double_index_n_bijective")
     (expand "bijective?")
     (flatten)
     (split)
     (("1"
       (expand "injective?")
       (skosimp)
       (inst -2 "(double_index_j(x1!1), double_index_i(x1!1))"
        "(double_index_j(x2!1), double_index_i(x2!1))")
       (assert)
       (flatten)
       (expand "double_index_i")
       (assert)
       (replace -2)
       (assert)
       (expand "double_index_j")
       (hide -1)
       (replace -2)
       (name-replace "TRI" "double_index_triangle(x2!1)")
       (assert))
      ("2"
       (hide -1)
       (expand "surjective?")
       (skosimp)
       (inst - "y!1")
       (hide -1)
       (inst +
        "double_index_n(double_index_j(y!1), double_index_i(y!1))")
       (lemma "double_index_ij_n"
        ("i" "double_index_j(y!1)" "j" "double_index_i(y!1)"))
       (flatten)
       (replace -1)
       (replace -2)
       (rewrite "double_index_n_ij"))))))


proof_type: f_proof
decl_type: formula
library: extended_nnreal
theory: double_nn_sequence
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp)
   (expand "convergent?")
   (split)
   (("1"
     (skosimp)
     (skosimp)
     (inst + "l!1")
     (rewrite "double_right_convergence")
     (lemma "limit_nonneg" ("nna" "series(single_index(u!1))"))
     (("1"
       (split -1)
       (("1" (rewrite "limit_def" -2 :dir rl) (assert))
        ("2" (expand "convergent?") (inst + "l!1"))))
      ("2"
       (skolem + "i!1")
       (hide-all-but 1)
       (expand "series")
       (lemma "sigma_ge_0[nat]"
        ("low" "0" "high" "i!1" "F" "single_index[nnreal](u!1)"))
       (split -1)
       (("1" (propax))
        ("2" (hide 2) (skosimp) (expand "single_index") (assert))))))
    ("2"
     (skosimp*)
     (inst + "l!1")
     (rewrite "double_right_convergence" 1)
     (hide 2)
     (lemma "limit_nonneg"
      ("nna" "series(single_index(LAMBDA j, i: u!1(i, j)))"))
     (("1"
       (split)
       (("1" (rewrite "limit_def" -2 :dir rl) (assert))
        ("2" (expand "convergent?") (inst + "l!1"))))
      ("2"
       (hide -1 2)
       (skolem + "n!1")
       (expand "series")
       (expand "single_index")
       (lemma "sigma_ge_0[nat]"
        ("low"
         "0"
         "high"
         "n!1"
         "F"
         "LAMBDA n: u!1(double_index_j(n), double_index_i(n))"))
       (split -1)
       (("1" (propax)) ("2" (hide 2) (skosimp) (assert))))))))


proof_type: f_proof
decl_type: formula
library: extended_nnreal
theory: double_nn_sequence
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp)
   (expand "convergent?")
   (skosimp)
   (lemma "double_right_convergence" ("u" "u!1" "l" "l!1"))
   (("1"
     (assert)
     (rewrite "limit_def" -1 :dir rl)
     (rewrite "limit_def" -2 :dir rl)
     (assert))
    ("2"
     (hide 2)
     (lemma "limit_nonneg" ("nna" "series(single_index(u!1))"))
     (("1"
       (split)
       (("1" (rewrite "limit_def" -2 :dir rl) (assert))
        ("2" (expand "convergent?") (inst + "l!1"))))
      ("2"
       (skolem + ("n!1"))
       (hide-all-but 1)
       (expand "series")
       (expand "single_index")
       (rewrite "sigma_ge_0[nat]" +))))))


proof_type: t_proof
decl_type: tcc
library: extended_nnreal
theory: double_nn_sequence
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skolem + ("_" "u!1"))
   (case-replace "FORALL i: convergent?(LAMBDA j: u!1(i, j))")
   (("1"
     (induct "i1")
     (("1"
       (expand "series")
       (expand "sigma")
       (expand "sigma")
       (inst - "0"))
      ("2"
       (skosimp*)
       (expand "series")
       (expand "sigma" 1)
       (inst - "1+j!1")
       (lemma "convergent_sum"
        ("s1"
         "LAMBDA j: u!1(1 + j!1, j)"
         "s2"
         "LAMBDA j: sigma(0, j!1, LAMBDA i: u!1(i, j))"))
       (expand "+")
       (assert))))
    ("2" (skosimp*) (inst - "i!1"))))


proof_type: t_proof
decl_type: tcc
library: extended_nnreal
theory: double_nn_sequence
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skolem + ("_" "u!1"))
   (induct "i1")
   (("1"
     (flatten)
     (expand "series")
     (expand "sigma" 1 2)
     (expand "sigma" 1 2)
     (inst - "0"))
    ("2"
     (skosimp*)
     (replace -2)
     (expand "series")
     (expand "sigma" 1 2)
     (inst - "1+j!1")
     (lemma "convergent_sum"
      ("s1"
       "LAMBDA (n: nat): sigma(0, n, LAMBDA j: u!1(1 + j!1, j))"
       "s2"
       "LAMBDA (n: nat):
                          sigma(0, n,
                                LAMBDA j: sigma(0, j!1, LAMBDA i: u!1(i, j)))"))
     (assert)
     (expand "+" -1)
     (hide -2 -3)
     (lemma "extensionality_postulate"
      ("f"
       "(LAMBDA (x: nat):
                          sigma(0, x, LAMBDA j: u!1(1 + j!1, j)) +
                           sigma(0, x,
                                 LAMBDA j: sigma(0, j!1, LAMBDA i: u!1(i, j))))"
       "g"
       "(LAMBDA (n: nat):
                          sigma(0, n,
                                LAMBDA j:
                                  u!1(1 + j!1, j) +
                                   sigma(0, j!1, LAMBDA i: u!1(i, j))))"))
     (flatten)
     (hide -2)
     (split -1)
     (("1" (replace -1) (propax))
      ("2"
       (hide -1 2)
       (skosimp*)
       (lemma "sigma_sum"
        ("low"
         "0"
         "high"
         "x!1"
         "F"
         "LAMBDA j: u!1(1 + j!1, j)"
         "G"
         "LAMBDA j: sigma(0, j!1, LAMBDA i: u!1(i, j))"))
       (assert))))))


proof_type: t_proof
decl_type: tcc
library: extended_nnreal
theory: double_nn_sequence
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp)
   (expand "nonempty?")
   (expand "empty?")
   (expand "member")
   (inst - "series(LAMBDA j: series(LAMBDA i: u!1(i, j))(0))(0)")
   (inst + "0" "0"))


proof_type: f_proof
decl_type: formula
library: extended_nnreal
theory: extended_nnreal
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (expand "associative?")
   (grind)
   (("1" (rewrite "zero_times3")) ("2" (rewrite "zero_times3"))))


proof_type: f_proof
decl_type: formula
library: extended_nnreal
theory: extended_nnreal
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (expand "x_sigma")
   (expand "x_le")
   (case-replace "FORALL i: low!1 <= i AND i <= high!1 => T!1(i)`1")
   (("1"
     (case-replace
      "FORALL (i_1: nat): low!1 <= i_1 AND i_1 <= high!1 => S!1(i_1)`1")
     (("1"
       (lemma "sigma_le"
        ("low"
         "low!1"
         "high"
         "high!1"
         "F"
         "LAMBDA (i_2: nat): S!1(i_2)`2"
         "G"
         "LAMBDA (i_2: nat): T!1(i_2)`2"))
       (split -1)
       (("1" (propax))
        ("2"
         (hide 2)
         (skosimp)
         (typepred "n!1")
         (inst - "n!1")
         (inst - "n!1")
         (inst - "n!1")
         (assert))))
      ("2" (hide 2) (skosimp) (inst - "i!1") (inst - "i!1") (assert))))
    ("2" (replace 1 2) (propax))))


proof_type: f_proof
decl_type: formula
library: extended_nnreal
theory: extended_nnreal
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp)
   (expand "x_sigma")
   (expand "x_lt")
   (case-replace "FORALL i: low!1 <= i AND i <= high!1 => T!1(i)`1")
   (("1"
     (case-replace
      "FORALL (i_1: nat): low!1 <= i_1 AND i_1 <= high!1 => S!1(i_1)`1")
     (("1"
       (lemma "sigma_lt"
        ("low"
         "low!1"
         "high"
         "high!1"
         "F"
         "LAMBDA (i_1: nat): S!1(i_1)`2"
         "G"
         "LAMBDA (i_1: nat): T!1(i_1)`2"))
       (split -1)
       (("1" (propax)) ("2" (propax))
        ("3"
         (hide 2)
         (skosimp)
         (typepred "n!1")
         (inst - "n!1")
         (inst - "n!1")
         (inst - "n!1")
         (assert))))
      ("2" (hide 2) (skosimp) (inst - "i!1") (inst - "i!1") (assert))))
    ("2" (replace 1 2) (propax))))


proof_type: f_proof
decl_type: formula
library: extended_nnreal
theory: extended_nnreal
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp)
   (expand "x_le")
   (expand "x_sum")
   (case-replace
    "(FORALL i: T!1(i)`1) AND
                    convergent?(series(LAMBDA i: T!1(i)`2))")
   (("1"
     (case-replace
      "(FORALL (i_1: nat): S!1(i_1)`1) AND
                 convergent?(series(LAMBDA (i_1: nat): S!1(i_1)`2))")
     (("1"
       (flatten)
       (name "F" "LAMBDA (i_2: nat): T!1(i_2)`2-S!1(i_2)`2")
       (case "forall i: 0<=F(i)")
       (("1"
         (case "series(F)= series(LAMBDA i: T!1(i)`2)-series(LAMBDA (i_1: nat): S!1(i_1)`2)")
         (("1"
           (lemma "convergent_diff"
            ("s1"
             "series(LAMBDA i: T!1(i)`2)"
             "s2"
             "series(LAMBDA (i_1: nat): S!1(i_1)`2)"))
           (replace -2 -1 rl)
           (assert)
           (lemma "limit_diff"
            ("v1"
             "series(LAMBDA i: T!1(i)`2)"
             "v2"
             "series(LAMBDA (i_1: nat): S!1(i_1)`2)"))
           (replace -3 -1 rl)
           (name-replace "L1"
            "convergence_sequences.limit(series(LAMBDA (i_2: nat): S!1(i_2)`2))")
           (name-replace "L2"
            "convergence_sequences.limit(series(LAMBDA (i_1: nat): T!1(i_1)`2))")
           (lemma "limit_nonneg" ("nna" "series(F)"))
           (("1" (assert))
            ("2"
             (skolem + ("n!1"))
             (hide-all-but (-4 1))
             (expand "series")
             (lemma "sigma_ge_0" ("low" "0" "high" "n!1" "F" "F"))
             (assert)
             (skosimp)
             (inst - "n!2")
             (assert))))
          ("2"
           (hide 2)
           (expand "F")
           (rewrite "series_diff")
           (expand "-")
           (propax))))
        ("2"
         (hide 2)
         (skosimp)
         (expand "F" 1)
         (inst - "i!1")
         (inst - "i!1")
         (inst - "i!1")
         (assert))))
      ("2"
       (hide 2)
       (split)
       (("1" (skosimp) (inst - "i!1") (inst - "i!1") (assert))
        ("2"
         (flatten)
         (lemma "comparison_test"
          ("b" "LAMBDA i: T!1(i)`2" "a" "LAMBDA (i_1: nat): S!1(i_1)`2"))
         (replace -3)
         (split)
         (("1" (propax))
          ("2"
           (hide -2 2)
           (skosimp)
           (expand "abs")
           (assert)
           (typepred "S!1(n!1)`2")
           (assert)
           (inst - "n!1")
           (inst - "n!1")
           (assert))))))))
    ("2" (replace 1 2) (propax))))


proof_type: f_proof
decl_type: formula
library: extended_nnreal
theory: extended_nnreal
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp)
   (lemma "x_sum_le" ("S" "S!1" "T" "T!1"))
   (lemma "x_sum_le" ("S" "T!1" "T" "S!1"))
   (split)
   (("1"
     (split)
     (("1"
       (lemma "x_le_antisymmetric" ("x" "x_sum(S!1)" "y" "x_sum(T!1)"))
       (assert))
      ("2"
       (hide-all-but (-2 1))
       (skosimp)
       (inst - "i!1")
       (expand "x_le")
       (expand "x_eq")
       (flatten)
       (assert))))
    ("2"
     (hide-all-but (-2 1))
     (skosimp)
     (inst - "i!1")
     (expand "x_eq")
     (expand "x_le")
     (flatten)
     (assert))))


proof_type: f_proof
decl_type: formula
library: extended_nnreal
theory: extended_nnreal
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp)
   (expand "x_sum")
   (expand "x_lt")
   (case-replace
    "(FORALL i: T!1(i)`1) AND
                    convergent?(series(LAMBDA i: T!1(i)`2))")
   (("1"
     (flatten)
     (case-replace
      "(FORALL (i_1: nat): S!1(i_1)`1) AND
                 convergent?(series(LAMBDA (i_1: nat): S!1(i_1)`2))")
     (("1"
       (flatten)
       (name "F" "series(LAMBDA (i_2: nat): T!1(i_2)`2-S!1(i_2)`2)")
       (case "forall i: F(i)>0")
       (("1"
         (case "series(LAMBDA (i_2: nat): T!1(i_2)`2)-series(LAMBDA (i_2: nat): S!1(i_2)`2)=F")
         (("1"
           (lemma "convergent_diff"
            ("s1"
             "series(LAMBDA (i_2: nat): T!1(i_2)`2)"
             "s2"
             "series(LAMBDA (i_2: nat): S!1(i_2)`2)"))
           (replace -2)
           (assert)
           (lemma "limit_diff"
            ("v1"
             "series(LAMBDA (i_2: nat): T!1(i_2)`2)"
             "v2"
             "series(LAMBDA (i_2: nat): S!1(i_2)`2)"))
           (replace -3 -1)
           (name-replace "L1"
            "convergence_sequences.limit(series(LAMBDA (i_1: nat): S!1(i_1)`2))")
           (name-replace "L2"
            "convergence_sequences.limit(series(LAMBDA (i_2: nat): T!1(i_2)`2))")
           (hide -3 -5 -7 -9)
           (expand "F")
           (lemma "limit_series_shift"
            ("a" "LAMBDA (i_2: nat): T!1(i_2)`2 - S!1(i_2)`2" "pn" "1"))
           (assert)
           (replace -2)
           (lemma "conv_series_shift"
            ("a" "LAMBDA (i_2: nat): T!1(i_2)`2 - S!1(i_2)`2" "N" "1"))
           (assert)
           (lemma "limit_pos"
            ("a" "series(LAMBDA i: T!1(1 + i)`2 - S!1(1 + i)`2)"))
           (replace -2)
           (name-replace "L3"
            "convergence_sequences.limit(series(LAMBDA i: T!1(1 + i)`2 - S!1(1 + i)`2))")
           (split -1)
           (("1"
             (expand "sigma")
             (inst -6 "0")
             (expand "series" -6)
             (expand "sigma")
             (assert))
            ("2"
             (hide 2)
             (skosimp)
             (expand "series" (1 -5))
             (lemma "sigma_gt_0"
              ("low"
               "0"
               "high"
               "n!1"
               "F"
               "LAMBDA (i_1: nat): T!1(1 + i_1)`2 - S!1(1 + i_1)`2"))
             (assert)
             (hide -5 2)
             (skosimp)
             (typepred "n!2")
             (inst - "1+n!2")
             (inst - "1+n!2")
             (inst - "1+n!2")
             (assert))))
          ("2"
           (rewrite "series_diff")
           (expand "F")
           (expand "-")
           (propax))))
        ("2"
         (skosimp)
         (hide -1 -3 -5 2)
         (expand "F")
         (expand "series")
         (lemma "sigma_gt_0"
          ("low"
           "0"
           "high"
           "i!1"
           "F"
           "LAMBDA (i_2: nat): T!1(i_2)`2 - S!1(i_2)`2"))
         (assert)
         (hide 2)
         (skosimp)
         (typepred "n!1")
         (inst - "n!1")
         (inst - "n!1")
         (inst - "n!1")
         (assert))))
      ("2"
       (hide 2)
       (split)
       (("1" (skosimp) (inst - "i!1") (inst - "i!1") (assert))
        ("2"
         (lemma "comparison_test"
          ("a" "LAMBDA (i_1: nat): S!1(i_1)`2" "b" "LAMBDA i: T!1(i)`2"))
         (assert)
         (hide -2 2)
         (skosimp)
         (typepred "S!1(n!1)`2")
         (expand "abs")
         (assert)
         (inst - "n!1")
         (inst - "n!1")
         (assert))))))
    ("2" (replace 1 2) (propax))))


proof_type: f_proof
decl_type: formula
library: extended_nnreal
theory: extended_nnreal
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp)
   (expand "x_inf")
   (expand "x_le" 1)
   (flatten)
   (assert)
   (expand "fullset")
   (expand "image")
   (expand "x_inf")
   (prop)
   (("1"
     (skosimp)
     (typepred "x!1")
     (skosimp)
     (inst -4 "x!2")
     (expand "x_le")
     (assert)
     (flatten)
     (inst - "S!1(x!2)")
     (inst + "x!2"))
    ("2"
     (replace 1 2)
     (skolem! 1)
     (lift-if)
     (assert)
     (case-replace
      "FORALL (x:
                         ({y: extended_nnreal |
                             EXISTS (x_1: ({x: nat | TRUE})): y = S!1(x_1)})):
                 NOT x`1")
     (("1"
       (inst - "x!1")
       (typepred
        "glb({z:real |
                      EXISTS x:
                        (EXISTS (x_1: ({x: nat | TRUE})): x = T!1(x_1)) AND
                         x`1 AND x`2 = z})")
       (("1"
         (name-replace "RHS"
          "glb({z:real |
                        EXISTS x:
                          (EXISTS (x_1: ({x: nat | TRUE})): x = T!1(x_1)) AND
                           x`1 AND x`2 = z})")
         (expand "greatest_lower_bound?" -1)
         (flatten)
         (inst -2 "0")
         (assert)
         (expand "lower_bound?")
         (skosimp)
         (typepred "s!1")
         (skosimp)
         (skosimp)
         (assert))
        ("2"
         (hide 3)
         (assert)
         (split)
         (("1"
           (expand "nonempty?")
           (expand "empty?")
           (expand "member")
           (typepred "x!1")
           (skosimp)
           (inst -2 "x!1`2")
           (inst + "x!1")
           (assert)
           (inst 1 "x!2"))
          ("2"
           (hide 2)
           (expand "bounded_below?")
           (inst + "0")
           (expand "lower_bound?")
           (skosimp)
           (typepred "s!1")
           (skosimp)
           (skosimp)
           (assert))))))
      ("2"
       (replace 1 2)
       (skosimp)
       (typepred
        "glb({z:real |
                     EXISTS x:
                       (EXISTS (x_1: ({x: nat | TRUE})): x = S!1(x_1)) AND
                        x`1 AND x`2 = z})")
       (("1"
         (name-replace "LHS"
          "glb({z:real |
                       EXISTS x:
                         (EXISTS (x_1: ({x: nat | TRUE})): x = S!1(x_1)) AND
                          x`1 AND x`2 = z})")
         (typepred
          "glb({z:real |
                       EXISTS x:
                         (EXISTS (x_1: ({x: nat | TRUE})): x = T!1(x_1)) AND
                          x`1 AND x`2 = z})")
         (("1"
           (name-replace "RHS"
            "glb({z:real |
                         EXISTS x:
                           (EXISTS (x_1: ({x: nat | TRUE})): x = T!1(x_1)) AND
                            x`1 AND x`2 = z})")
           (expand "greatest_lower_bound?")
           (flatten)
           (inst -2 "LHS")
           (assert)
           (expand "lower_bound?" 1)
           (skosimp)
           (typepred "s!1")
           (skosimp)
           (skosimp)
           (inst -9 "x!4")
           (expand "x_le" -9)
           (assert)
           (flatten)
           (hide -4 -6)
           (expand "lower_bound?")
           (inst - "S!1(x!4)`2")
           (("1" (assert))
            ("2" (inst + "S!1(x!4)") (assert) (inst + "x!4"))))
          ("2"
           (hide 2 -1)
           (split)
           (("1"
             (expand "nonempty?")
             (expand "empty?")
             (expand "member")
             (inst - "x!1`2")
             (inst + "x!1")
             (assert))
            ("2"
             (expand "bounded_below?")
             (inst + "0")
             (expand "lower_bound?")
             (skosimp)
             (typepred "s!1")
             (skosimp)
             (assert))))))
        ("2"
         (hide 2)
         (split)
         (("1"
           (expand "nonempty?")
           (expand "empty?")
           (expand "member")
           (inst - "x!2`2")
           (inst + "x!2")
           (assert))
          ("2"
           (expand "bounded_below?")
           (inst + "0")
           (expand "lower_bound?")
           (skosimp)
           (typepred "s!1")
           (skosimp)
           (assert))))))))))


proof_type: f_proof
decl_type: formula
library: extended_nnreal
theory: extended_nnreal
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp)
   (expand "x_eq")
   (expand "x_add")
   (expand "x_sum")
   (lift-if)
   (assert)
   (case-replace "FORALL i: S!1(i)`1")
   (("1"
     (case-replace "FORALL i: T!1(i)`1")
     (("1"
       (case-replace "FORALL (i: nat): S!1(i)`1 AND T!1(i)`1")
       (("1"
         (case-replace "convergent?(series(LAMBDA i: S!1(i)`2))")
         (("1"
           (case-replace "convergent?(series(LAMBDA i: T!1(i)`2))")
           (("1"
             (lemma "convergent_sum"
              ("s1"
               "series(LAMBDA i: S!1(i)`2)"
               "s2"
               "series(LAMBDA i: T!1(i)`2)"))
             (assert)
             (lemma "limit_sum"
              ("v1"
               "series(LAMBDA i: S!1(i)`2)"
               "v2"
               "series(LAMBDA i: T!1(i)`2)"))
             (rewrite "series_sum")
             (expand "+")
             (case-replace
              "(LAMBDA (i_1: nat):
                                        IF S!1(i_1)`1 AND T!1(i_1)`1
                                          THEN S!1(i_1)`2 + T!1(i_1)`2
                                        ELSE 0
                                        ENDIF)=(LAMBDA (i: nat): S!1(i)`2 + T!1(i)`2)")
             (("1" (replace -3) (replace -2) (propax))
              ("2"
               (apply-extensionality 1 :hide? t)
               (inst - "x!1")
               (flatten)
               (assert))))
            ("2"
             (replace 1)
             (assert)
             (lemma "comparison_test"
              ("b"
               "(LAMBDA (i_1: nat):
                                         IF S!1(i_1)`1 AND T!1(i_1)`1
                                           THEN S!1(i_1)`2 + T!1(i_1)`2
                                         ELSE 0
                                         ENDIF)"
               "a"
               "LAMBDA i: T!1(i)`2"))
             (assert)
             (skosimp)
             (inst - "n!1")
             (flatten)
             (assert)
             (expand "abs")
             (assert))))
          ("2"
           (replace 1)
           (lemma "comparison_test"
            ("b"
             "(LAMBDA (i_1: nat):
                                       IF S!1(i_1)`1 AND T!1(i_1)`1
                                         THEN S!1(i_1)`2 + T!1(i_1)`2
                                       ELSE 0
                                       ENDIF)"
             "a"
             "LAMBDA i: S!1(i)`2"))
           (assert)
           (hide -4 2)
           (skosimp)
           (inst - "n!1")
           (flatten)
           (assert)
           (expand "abs")
           (assert))))
        ("2" (skosimp) (inst - "i!1") (inst - "i!1") (assert))))
      ("2"
       (replace 1)
       (assert)
       (flatten)
       (skosimp)
       (inst -2 "i!1")
       (flatten))))
    ("2" (replace 1) (flatten) (skosimp) (inst - "i!1") (flatten))))


proof_type: f_proof
decl_type: formula
library: extended_nnreal
theory: extended_nnreal
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp)
   (expand "x_limit")
   (expand "x_sum")
   (expand "x_eq")
   (case-replace "FORALL i: S!1(i)`1")
   (("1"
     (case-replace "FORALL i: T!1(i)`1")
     (("1"
       (case-replace "series(LAMBDA i: T!1(i)`2)=LAMBDA i: S!1(i)`2")
       (hide 2)
       (apply-extensionality :hide? t)
       (expand "series")
       (inst -3 "x!1")
       (flatten)
       (inst -2 "x!1")
       (assert)
       (expand "x_sigma")
       (prop)
       (replace -1)
       (assert))
      ("2"
       (hide 2)
       (skosimp)
       (inst -2 "i!1")
       (inst-cp - "i!1")
       (replace -2)
       (flatten)
       (expand "x_sigma")
       (prop)
       (inst - "i!1")
       (assert))))
    ("2"
     (replace 1 2)
     (assert)
     (prop)
     (skosimp)
     (inst -3 "i!1")
     (flatten)
     (assert)
     (hide -2 -3 1)
     (expand "x_sigma")
     (prop)
     (skosimp)
     (inst - "i!2"))))


proof_type: f_proof
decl_type: formula
library: extended_nnreal
theory: extended_nnreal
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (case "FORALL (S, T: [nat -> extended_nnreal], x:nnreal):
                 (FORALL i: x_eq(x_times(x, S(i)), T(i))) =>
                  x_eq(x_times(x, x_sum(S)), x_sum(T))")
   (("1"
     (skosimp)
     (expand "x_eq")
     (expand "x_times")
     (expand "x_times")
     (case-replace "x!1`1")
     (("1"
       (inst - "S!1" "T!1" "x!1`2")
       (case-replace "x!1`2 = 0")
       (("1"
         (expand "x_eq" -4 1)
         (assert)
         (expand "x_eq" -4 1)
         (assert)
         (expand "x_eq" -4 1)
         (replace -4 -3)
         (flatten)
         (expand "x_eq" 1 1)
         (expand "x_eq" 1 1)
         (expand "x_eq" 1 1)
         (assert))
        ("2"
         (replace 1)
         (expand "x_eq" -3 1)
         (assert)
         (expand "x_eq" 2 1)
         (expand "x_eq" 2 2)
         (expand "x_eq" 2 3)
         (expand "x_eq" -3 4)
         (expand "x_eq" -3 2)
         (split)
         (("1"
           (flatten)
           (case-replace "x_sum(S!1)`1")
           (("1" (assert)) ("2" (assert) (expand "x_eq") (propax))))
          ("2"
           (skosimp)
           (inst - "i!1")
           (case-replace "S!1(i!1)`1")
           (("1" (flatten) (assert))
            ("2" (assert) (expand "x_eq") (propax))))))))
      ("2"
       (expand "x_eq" 2 1)
       (expand "x_eq" 2 2)
       (expand "x_eq" 2 3)
       (assert)
       (expand "x_eq" -2 1)
       (expand "x_eq" -2 2)
       (expand "x_eq" -2 3)
       (expand "x_eq" -2)
       (hide -1)
       (case "forall i: S!1(i)`1")
       (("1"
         (case "FORALL i: S!1(i)`2 = 0")
         (("1"
           (case-replace "x_eq(x_sum(S!1), 0)")
           (("1"
             (lemma "x_sum_eq" ("S" "S!1" "T" "T!1"))
             (split)
             (("1" (expand "x_eq") (flatten) (assert))
              ("2"
               (skosimp)
               (inst - "i!1")
               (inst - "i!1")
               (inst - "i!1")
               (expand "x_eq")
               (assert)
               (flatten)
               (assert))))
            ("2"
             (hide 3)
             (expand "x_eq")
             (expand "x_sum")
             (replace -2)
             (case-replace "(LAMBDA i: S!1(i)`2)=(lambda i: 0)")
             (("1"
               (rewrite "zero_series_conv")
               (rewrite "zero_series_limit"))
              ("2" (apply-extensionality :hide? t))))))
          ("2"
           (skosimp)
           (case-replace "x_eq(x_sum(S!1), 0)")
           (("1"
             (expand "x_eq" -1)
             (flatten)
             (expand "x_sum")
             (replace -3)
             (hide 3)
             (prop)
             (replace -1)
             (lemma "convergence_nonneg"
              ("nna" "LAMBDA i: S!1(i)`2" "nnx" "0"))
             (split)
             (("1"
               (inst - "i!1")
               (expand "series")
               (lemma "sigma_nonneg_eq_0"
                ("low"
                 "0"
                 "high"
                 "i!1"
                 "Fnnr"
                 "LAMBDA i: S!1(i)`2"
                 "i"
                 "i!1"))
               (assert))
              ("2" (rewrite "limit_def"))))
            ("2"
             (replace 1)
             (assert)
             (expand "x_eq" 1)
             (expand "x_sum" -3)
             (hide 1)
             (prop)
             (inst -4 "i!1")
             (assert)
             (inst - "i!1"))))))
        ("2"
         (case-replace "x_eq(x_sum(S!1), 0)")
         (("1"
           (hide-all-but (-1 1))
           (expand "x_eq")
           (expand "x_sum")
           (flatten)
           (replace 1)
           (propax))
          ("2"
           (replace 1)
           (assert)
           (expand "x_sum")
           (hide 1)
           (prop)
           (skosimp)
           (inst - "i!1")
           (inst - "i!1")
           (assert))))))))
    ("2"
     (hide 2)
     (skosimp)
     (expand "x_times")
     (expand "x_times")
     (expand "x_eq")
     (case-replace "x!1=0")
     (("1"
       (lemma "x_sum_eq" ("S" "lambda i: (TRUE,0)" "T" "T!1"))
       (split)
       (("1"
         (expand "x_eq")
         (flatten)
         (expand "x_sum" -1 1)
         (expand "x_sum" -2 1)
         (expand "x_sum" -2 1)
         (rewrite "zero_series_conv")
         (assert)
         (rewrite "zero_series_limit"))
        ("2"
         (hide 2)
         (skosimp)
         (inst - "i!1")
         (flatten)
         (expand "x_eq")
         (assert))))
      ("2"
       (assert)
       (case "forall i: S!1(i)`1")
       (("1"
         (expand "x_sum")
         (replace -1)
         (case-replace "FORALL i: T!1(i)`1")
         (("1"
           (case "forall i: S!1(i)`2 * x!1=T!1(i)`2")
           (("1"
             (hide -4)
             (case-replace "convergent?(series(LAMBDA i: S!1(i)`2))")
             (("1"
               (case-replace "convergent?(series(LAMBDA i: T!1(i)`2))")
               (("1"
                 (lemma "limit_scal"
                  ("a" "x!1" "v1" "series(LAMBDA i: S!1(i)`2)"))
                 (rewrite "series_scal")
                 (case-replace
                  "(LAMBDA i: x!1 * S!1(i)`2)=(LAMBDA i: T!1(i)`2)")
                 (("1" (assert))
                  ("2"
                   (apply-extensionality :hide? t)
                   (inst -4 "x!2")
                   (assert))))
                ("2"
                 (hide 3)
                 (lemma "convergent_scal"
                  ("s1" "series(LAMBDA i: S!1(i)`2)" "a" "x!1"))
                 (assert)
                 (rewrite "series_scal")
                 (case-replace
                  "(LAMBDA i: x!1 * S!1(i)`2)=(LAMBDA i: T!1(i)`2)")
                 (apply-extensionality :hide? t)
                 (inst -3 "x!2")
                 (assert))))
              ("2"
               (replace 1)
               (assert)
               (prop)
               (lemma "convergent_scal"
                ("s1" "series(LAMBDA i: T!1(i)`2)" "a" "1/x!1"))
               (assert)
               (rewrite "series_scal" -1)
               (case-replace
                "(LAMBDA i: 1 / x!1 * T!1(i)`2)=(LAMBDA i: S!1(i)`2)")
               (apply-extensionality :hide? t)
               (inst -3 "x!2")
               (assert))))
            ("2"
             (hide 3)
             (skosimp)
             (inst - "i!1")
             (inst - "i!1")
             (inst - "i!1")
             (assert))))
          ("2"
           (hide 3)
           (skosimp)
           (inst - "i!1")
           (inst - "i!1")
           (assert))))
        ("2"
         (expand "x_sum")
         (replace 1)
         (assert)
         (prop)
         (skosimp)
         (inst - "i!1")
         (inst - "i!1")
         (assert))))))))


proof_type: f_proof
decl_type: formula
library: extended_nnreal
theory: extended_nnreal
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp)
   (split)
   (("1" (grind))
    ("2"
     (flatten)
     (expand "x_add")
     (expand "x_le")
     (flatten)
     (replace -2)
     (inst-cp - "1")
     (flatten)
     (assert)
     (hide -3)
     (lemma "varying_epsilon" ("x" "x!1`2" "y" "y!1`2"))
     (replace -1)
     (skosimp)
     (inst -3 "epsilon!1")
     (assert))))


proof_type: f_proof
decl_type: formula
library: extended_nnreal
theory: extended_nnreal
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp)
   (expand "x_eq")
   (expand "x_sum")
   (case-replace "FORALL i: single_index(U!1)(i)`1")
   (("1"
     (case-replace
      "convergent?(series(LAMBDA i: single_index(U!1)(i)`2))")
     (("1"
       (case-replace
        "(FORALL (i_1: nat):
                    IF (FORALL (i_2: nat): U!1(i_1, i_2)`1) AND
                        convergent?(series(LAMBDA (i_2: nat): U!1(i_1, i_2)`2))
                      THEN TRUE
                    ELSE FALSE
                    ENDIF)
                  AND
                  convergent?(series(LAMBDA (i_1: nat):
                                      IF (FORALL (i_2: nat): U!1(i_1, i_2)`1) AND
                                          convergent?(series
                                                     (LAMBDA
                                                      (i_2: nat):
                                                      U!1(i_1, i_2)`2))
                                        THEN convergence_sequences.limit
                                             (series
                                              (LAMBDA (i_2: nat): U!1(i_1, i_2)`2))
                                      ELSE 0
                                      ENDIF))")
       (("1"
         (flatten)
         (lemma "double_left_limit" ("u" "lambda (i,j): U!1(i,j)`2"))
         (expand "single_index")
         (replace -4)
         (replace -1)
         (hide -1)
         (case-replace
          "(LAMBDA (i_1: nat):
                               IF (FORALL (i_2: nat): U!1(i_1, i_2)`1) AND
                                   convergent?(series
                                              (LAMBDA (i_2: nat): U!1(i_1, i_2)`2))
                                 THEN convergence_sequences.limit
                                          (series(LAMBDA
                                                  (i_2: nat):
                                                  U!1(i_1, i_2)`2))
                               ELSE 0
                               ENDIF)=(LAMBDA (i_1: nat):
                               limit(series(LAMBDA (j_1: nat): U!1(i_1, j_1)`2)))")
         (("1"
           (hide 2)
           (apply-extensionality :hide? t)
           (("1"
             (inst - "x!1")
             (prop)
             (replace -1)
             (replace -2)
             (propax))
            ("2" (skosimp) (inst - "i!1") (prop))))
          ("2" (hide -2 2) (skosimp) (inst - "i!1") (prop))))
        ("2"
         (hide 2)
         (case-replace
          "(FORALL (i_1: nat):
                   IF (FORALL (i_2: nat): U!1(i_1, i_2)`1) AND
                       convergent?(series(LAMBDA (i_2: nat): U!1(i_1, i_2)`2))
                     THEN TRUE
                   ELSE FALSE
                   ENDIF)")
         (("1"
           (lemma "double_left_convergent"
            ("u" "lambda (i,j): U!1(i,j)`2"))
           (flatten)
           (hide -2)
           (split -1)
           (("1"
             (flatten)
             (case-replace
              "(LAMBDA (i_1: nat):
                                        IF (FORALL (i_2: nat): U!1(i_1, i_2)`1) AND
                                            convergent?(series
                                                       (LAMBDA
                                                        (i_2: nat):
                                                        U!1(i_1, i_2)`2))
                                          THEN convergence_sequences.limit
                                                   (series
                                                    (LAMBDA (i_2: nat): U!1(i_1, i_2)`2))
                                        ELSE 0
                                        ENDIF)=(LAMBDA (i_1: nat):
                                        limit(series(LAMBDA
                                                     (j_1: nat):
                                                     (LAMBDA (i, j): U!1(i, j)`2)
                                                     (i_1, j_1))))")
             (("1" (assert))
              ("2"
               (apply-extensionality 1 :hide? t)
               (hide 2)
               (inst -3 "x!1")
               (prop)
               (replace -1)
               (replace -2)
               (propax))
              ("3" (hide 2) (skosimp) (inst -3 "i!1") (prop))))
            ("2" (hide 2 -1) (expand "single_index") (propax))))
          ("2"
           (hide 2)
           (skosimp)
           (prop)
           (("1"
             (skosimp)
             (hide -1)
             (expand "single_index")
             (lemma "double_index_ij_n" ("i" "i!1" "j" "i!2"))
             (flatten)
             (inst - "double_index_n(i!1, i!2)")
             (assert))
            ("2"
             (lemma "double_subseq_convergent"
              ("u" "lambda (i,j): U!1(i,j)`2" "i" "i!1"))
             (split -1)
             (("1" (assert))
              ("2" (hide 2) (expand "single_index") (propax))))))))))
      ("2"
       (replace 1 2)
       (assert)
       (prop)
       (lemma "double_left_convergent")
       (inst - "lambda (i,j): U!1(i,j)`2")
       (expand "single_index" 1)
       (expand "single_index" -1 1)
       (replace -1 1)
       (hide -1)
       (split 1)
       (("1" (skosimp) (inst - "i!1") (prop))
        ("2"
         (case-replace
          "(LAMBDA (i_1: nat):
                                    IF (FORALL (i_2: nat): U!1(i_1, i_2)`1) AND
                                        convergent?(series
                                                   (LAMBDA
                                                    (i_2: nat):
                                                    U!1(i_1, i_2)`2))
                                      THEN convergence_sequences.limit
                                               (series
                                                (LAMBDA (i_2: nat): U!1(i_1, i_2)`2))
                                    ELSE 0
                                    ENDIF)=(LAMBDA (i_1: nat):
                                    convergence_sequences.limit(series(LAMBDA
                                                 (j_1: nat):
                                                 U!1(i_1, j_1)`2)))")
         (("1"
           (apply-extensionality 1 :hide? t)
           (("1"
             (hide 2)
             (inst - "x!1")
             (prop)
             (replace -1)
             (replace -2)
             (propax))
            ("2" (skosimp) (inst - "i!1") (prop))))
          ("2" (skosimp) (inst - "i!1") (prop))))))))
    ("2"
     (replace 1 2)
     (assert)
     (prop)
     (skosimp)
     (expand "single_index")
     (inst - "double_index_i(i!1)")
     (prop)
     (inst - "double_index_j(i!1)"))))


proof_type: f_proof
decl_type: formula
library: extended_nnreal
theory: extended_nnreal
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp)
   (lemma "double_x_sum" ("U" "U!1"))
   (name-replace "LHS" "x_sum(LAMBDA i: x_sum(LAMBDA j: U!1(i, j)))")
   (lemma "double_x_sum" ("U" "lambda i,j: U!1(j,i)"))
   (assert)
   (name-replace "RHS" "x_sum(LAMBDA j: x_sum(LAMBDA i: U!1(i, j)))")
   (case "x_eq(x_sum(single_index(U!1)),x_sum(single_index(LAMBDA i, j: U!1(j, i))))")
   (("1" (expand "x_eq") (flatten) (assert) (flatten) (assert))
    ("2"
     (hide-all-but 1)
     (case "forall i,j: U!1(i, j)`1")
     (("1"
       (expand "x_sum")
       (case-replace "FORALL i: single_index(U!1)(i)`1")
       (("1"
         (case-replace
          "FORALL (i_1: nat):
                           single_index(LAMBDA i, j: U!1(j, i))(i_1)`1")
         (("1"
           (lemma "double_right_convergent"
            ("u" "lambda i,j: U!1(i,j)`2"))
           (expand "single_index" (-1 1))
           (replace -1 1 rl)
           (case-replace
            "convergent?(series(LAMBDA i:
                                              U!1(double_index_i(i),
                                                  double_index_j(i))`2))")
           (("1"
             (assert)
             (expand "x_eq" 1)
             (lemma "double_right_limit" ("u" "lambda i,j: U!1(i,j)`2"))
             (expand "single_index")
             (propax))
            ("2" (assert) (hide-all-but 3) (expand "x_eq") (propax))))
          ("2"
           (hide -1 2)
           (skosimp)
           (expand "single_index")
           (inst - "double_index_j(i!1)" "double_index_i(i!1)"))))
        ("2"
         (hide 2)
         (skosimp)
         (expand "single_index")
         (inst - "double_index_i(i!1)" "double_index_j(i!1)"))))
      ("2"
       (skosimp)
       (expand "x_sum")
       (expand "x_eq")
       (case-replace "FORALL i: single_index(U!1)(i)`1")
       (("1"
         (assert)
         (hide 2)
         (lemma "double_single" ("u" "U!1"))
         (replace -1 1 rl)
         (hide -1)
         (expand "double_index")
         (expand "o ")
         (inst - "double_index_n(i!1, j!1)"))
        ("2"
         (replace 1 3)
         (assert)
         (prop)
         (hide -2 2)
         (skosimp)
         (expand "single_index")
         (inst -
          "double_index_n(double_index_j(i!2),double_index_i(i!2))")
         (lemma "double_index_ij_n"
          ("i" "double_index_j(i!2)" "j" "double_index_i(i!2)"))
         (flatten)
         (replace -1)
         (replace -2)
         (propax))))))))


proof_type: t_proof
decl_type: tcc
library: extended_nnreal
theory: extended_nnreal
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (split)
   (("1"
     (expand "nonempty?")
     (expand "empty?")
     (expand "member")
     (inst - "x!1`2")
     (inst + "x!1")
     (assert))
    ("2"
     (expand "bounded_below?")
     (inst + "0")
     (expand "lower_bound?")
     (skosimp)
     (typepred "s!1")
     (skosimp)
     (assert))))


proof_type: t_proof
decl_type: tcc
library: extended_nnreal
theory: extended_nnreal
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (lemma "x_inf_TCC1" ("X" "X!1"))
   (split -1)
   (("1"
     (flatten)
     (typepred "glb({z | EXISTS x: X!1(x) AND x`1 AND x`2 = z})")
     (("1"
       (name-replace "GLB"
        "glb({zz:real | EXISTS y: X!1(y) AND y`1 AND y`2 = zz})")
       (expand "greatest_lower_bound?")
       (flatten)
       (inst - "0")
       (assert)
       (hide 2)
       (expand "lower_bound?")
       (skosimp)
       (typepred "s!1")
       (skosimp)
       (assert))
      ("2" (assert))))
    ("2" (inst - "x!1"))))


proof_type: t_proof
decl_type: tcc
library: extended_nnreal
theory: extended_nnreal
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (expand "empty?")
   (skosimp)
   (expand "member")
   (expand "nonempty?")
   (expand "empty?")
   (expand "member")
   (inst - "x!1`2")
   (inst + "x!1")
   (inst + "x!1")
   (assert))


proof_type: t_proof
decl_type: tcc
library: extended_nnreal
theory: extended_nnreal
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (replace -1)
   (lemma "x_sup_TCC1" ("X" "X!1"))
   (replace 3)
   (replace 2)
   (propax))


proof_type: t_proof
decl_type: tcc
library: extended_nnreal
theory: extended_nnreal
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (lemma "x_sup_TCC2" ("X" "X!1"))
   (replace -2)
   (replace 1)
   (replace 2)
   (typepred "lub({z | EXISTS x: X!1(x) AND x`1 AND x`2 = z})")
   (("1"
     (expand "least_upper_bound?")
     (name-replace "LUB"
      "lub({z | EXISTS x: X!1(x) AND x`1 AND x`2 = z})")
     (flatten)
     (expand "empty?")
     (hide 1 2 -4)
     (expand "nonempty?")
     (expand "empty?")
     (expand "member")
     (skosimp)
     (skosimp)
     (expand "upper_bound?")
     (hide -2)
     (inst - "x!1")
     (("1" (assert)) ("2" (inst + "x!2") (assert))))
    ("2" (assert))))


proof_type: t_proof
decl_type: tcc
library: extended_nnreal
theory: extended_nnreal
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (lemma "limit_nonneg" ("nna" "series(LAMBDA i: S!1(i)`2)"))
   (("1"
     (assert)
     (expand "series")
     (expand "limit")
     (expand "limit")
     (propax))
    ("2"
     (expand "series")
     (hide-all-but 1)
     (skosimp)
     (lemma "sigma_ge_0"
      ("low" "0" "high" "x1!1" "F" "LAMBDA i: S!1(i)`2"))
     (split -1)
     (("1" (propax)) ("2" (hide 2) (skosimp) (assert))))))


proof_type: t_proof
decl_type: tcc
library: extended_nnreal
theory: extended_nnreal
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp)
   (lemma "limit_nonneg" ("nna" "series(U!1)"))
   (("1" (assert) (expand "limit" 1) (propax))
    ("2"
     (hide-all-but 1)
     (skolem + "n!1")
     (expand "series")
     (lemma "sigma_ge_0" ("low" "0" "high" "n!1" "F" "U!1"))
     (assert))))


proof_type: t_proof
decl_type: tcc
library: extended_nnreal
theory: extended_nnreal
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp)
   (lemma "limit_nonneg" ("nna" "LAMBDA i: S!1(i)`2"))
   (assert)
   (expand "limit" 1)
   (propax))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: event_sequences
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (induct "j")
   (("1"
     (assert)
     (skosimp*)
     (typepred "es!1")
     (expand "increasing?")
     (inst?))
    ("2"
     (skosimp*)
     (inst?)
     (typepred "es!1")
     (expand "increasing?")
     (inst - "i!1 + 1 + j!1")
     (assert))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: event_sequences
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (lemma "increasing_ind")
   (inst - _ "i!1" "j!1 - i!1 - 1")
   (("1" (inst?) (assert)) ("2" (assert))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: event_sequences
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (expand "index_of")
   (invoke (name-replace "m" "%1") (! 1 l 1))
   (case-replace "m = 0")
   (typepred "m")
   (inst - "m - 1")
   (("1" (expand "future_events") (assert)) ("2" (assert))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: event_sequences
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (expand "index_of")
   (invoke (name-replace "m" "%1") (! 1 l 1))
   (typepred "m")
   (inst - "m - 1")
   (("1" (expand "future_events") (assert)) ("2" (assert))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: event_sequences
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (expand "index_of")
   (rewrite "min_def")
   (expand "minimum?")
   (prop)
   (("1"
     (expand "future_events")
     (typepred "es!1")
     (expand "increasing?")
     (inst?))
    ("2"
     (skosimp*)
     (expand "future_events")
     (lemma "nondecreasing")
     (inst - "es!1" "x!1 + 1" "i!1")
     (assert))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: event_sequences
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (use "index_le_alt")
   (assert)
   (lemma "nondecreasing")
   (inst - "es!1" "1 + k!1" "index_of(es!1)(t!1)")
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: event_sequences
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (use "lt_index")
   (lemma "nondecreasing")
   (inst - "es!1" "index_of(es!1)(t!1) + 1" "k!1")
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: event_sequences
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
script:
  (""
   (skosimp*)
   (rewrite "index_conversion_right")
   (inst?)
   (lemma "index_le_alt")
   (inst - "es2!1" _)
   (inst?)
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: event_sequences
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (expand "nonoverlap?")
   (inst?)
   (lemma "nondecreasing")
   (inst - "es2!1" "j!1 + 1" "k!1")
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: event_sequences
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (rewrite "index_conversion_left")
   (use "lt_index")
   (expand "nonoverlap?")
   (inst?)
   (assert))


proof_type: j_proof
decl_type: tcc
library: fault_tolerance
theory: event_sequences
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (auto-rewrite-defs)
   (typepred "es!1")
   (assert)
   (inst -2 "t!1")
   (skosimp*)
   (inst -3 "k!1")
   (inst?)
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: bounded_ints
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp* t)
   (expand "in_set")
   (typepred "sup(SS!1)")
   (expand "least_upper_bound")
   (flatten)
   (case "upper_bound(<=)(sup(SS!1) - 1, SS!1)")
   (("1" (inst - "sup(SS!1) - 1") (assert))
    ("2"
     (hide -2)
     (expand "upper_bound")
     (skosimp* t)
     (inst?)
     (case-replace "z!1 = sup(SS!1)")
     (assert)
     (case "EXISTS (i:int): i = sup(SS!1)")
     (("1" (skosimp*) (replace -1 :dir rl :hide? t) (assert))
      ("2" (inst + "sup(SS!1)"))))))


proof_type: j_proof
decl_type: tcc
library: fault_tolerance
theory: bounded_ints
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp* t)
   (typepred "sup(SS!1)")
   (expand "least_upper_bound")
   (flatten)
   (case "upper_bound(<=)(floor(sup(SS!1)), SS!1)")
   (("1"
     (inst - "floor(sup(SS!1))")
     (assert)
     (split +)
     (("1" (assert)) ("2" (assert))))
    ("2"
     (hide 2 -2)
     (expand "upper_bound")
     (skosimp* t)
     (inst?)
     (assert))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: minmax_ineq
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (expand "max")
   (case "a!1 < b!1")
   (("1" (assert) (prop) (assert)) ("2" (assert) (prop) (assert))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: minmax_ineq
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (expand "max")
   (case "b!1 < c!1")
   (("1" (assert) (prop) (assert)) ("2" (assert) (prop) (assert))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: minmax_ineq
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (expand "max")
   (assert)
   (lift-if)
   (lift-if)
   (lift-if)
   (assert)
   (prop)
   (lift-if)
   (assert)
   (prop)
   (lift-if)
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: abs_props
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (expand "abs")
   (assert)
   (lift-if)
   (lift-if)
   (assert)
   (lift-if)
   (assert)
   (use pos_times_ge)
   (flatten)
   (assert)
   (ground))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: physical_clocks
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (name "n" "T2!1 - T1!1")
   (isolate -1 l 1)
   (replace*)
   (assert)
   (hide -1 -2)
   (generalize "n" "n" "nat")
   (induct "n")
   (("1" (assert))
    ("2" (skosimp*) (typepred "c!1") (inst - "T1!1 + j!1") (assert))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: physical_clocks
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (lemma "drift_left")
   (case "T1!1 <= T2!1")
   (("1"
     (inst - "T1!1" "T2!1" "c!1")
     (assert)
     (expand "abs")
     (lift-if)
     (assert)
     (lift-if)
     (assert))
    ("2" (inst?) (assert) (expand "abs") (assert) (lift-if) (assert))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: physical_clocks
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (lemma "drift_left")
   (inst - "T1!1" "T2!1" "c!1")
   (assert)
   (invoke (then (case "0 <= %1") (assert)) (! -1 l))
   (cross-mult 1))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: physical_clocks
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (lemma "drift_left")
   (inst - "T1!1" "T2!1" "c!1")
   (assert)
   (invoke (then (case "0 < %1") (assert)) (! -1 l))
   (cross-mult 1))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: physical_clocks
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (lemma "clock_nondecreasing_alt")
   (inst-cp - "T1!1" "T2!1" "c!1")
   (inst - "T2!1" "T1!1" "c!1")
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: physical_clocks
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (lemma "drift_left_nat")
   (inst - "T2!1" "X!1" "c2!1")
   (lemma "drift_right_nat")
   (inst - "T1!1" "X!1" "c1!1")
   (expand "drift")
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: physical_clocks
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (lemma "drift_left")
   (inst-cp - "T1!1" "T!1" "c1!1")
   (inst - "T!1" "T2!1" "c2!1")
   (prop)
   (div-by (-4 -5 -6) "rate")
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: physical_clocks
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (lemma "drift_left")
   (inst-cp - "T1!1" "T!1" "c1!1")
   (inst - "T!1" "T2!1" "c2!1")
   (prop)
   (div-by (1 -5 -6) "rate")
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: physical_clocks
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (lemma "nonoverlap_basis")
   (inst - _ "T1!1" "T2!1" "skew!1 + drift * X!1" "c1!1" "c2!1")
   (assert)
   (lemma "relative_drift")
   (inst - "T!1" "T!1" "T1!1 - T!1" "c1!1" "c2!1")
   (("1" (inst - "T1!1") (mult-by -4 "drift") (assert))
    ("2"
     (lemma "relative_drift")
     (inst - "T2!1" "T2!1" "T!1 - T2!1" "c2!1" "c1!1")
     (("1" (inst - "T2!1") (mult-by -5 "drift") (assert))
      ("2" (inst - "T!1") (assert))))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: physical_clocks
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (lemma "skew_basis_0")
   (inst - _ "T1!1" "T2!1" "skew!1 + drift * X!1" "c1!1" "c2!1")
   (assert)
   (lemma "relative_drift")
   (inst - "T!1" "T!1" "T1!1 - T!1" "c1!1" "c2!1")
   (("1" (inst - "T1!1") (mult-by -4 "drift") (assert))
    ("2"
     (lemma "relative_drift")
     (inst - "T2!1" "T2!1" "T!1 - T2!1" "c2!1" "c1!1")
     (("1" (inst - "T2!1") (mult-by -5 "drift") (assert))
      ("2" (inst - "T!1") (assert))))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: physical_clocks
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
script:
  (""
   (skosimp*)
   (rewrite "le_ceiling")
   (isolate 1 l 1)
   (expand "abs" 1)
   (lift-if)
   (prop)
   (("1"
     (lemma "skew_bound_2")
     (inst - "T!1" "T1!1 + 1" "T2!1" "X!1" "c1!1" "c2!1" "skew!1")
     (assert))
    ("2"
     (lemma "skew_bound_1")
     (inst - "T!1" "T2!1" "T1!1" "X!1" "c2!1" "c1!1" "skew!1")
     (assert))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: physical_clocks
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (div-by 1 "rate")
   (expand "drift")
   (lemma "drift_right")
   (inst - "T1!1 - X!1" "T1!1" _)
   (inst?)
   (assert)
   (lemma "drift_left")
   (inst - "T1!1 - X!1" "T2!1" _)
   (inst?)
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: physical_clocks
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (cross-mult)
   (expand "drift")
   (lemma "drift_right")
   (inst - "T1!1 - X!1" "T2!1" _)
   (inst?)
   (assert)
   (lemma "drift_left")
   (inst - "T1!1 - X!1" "T1!1" _)
   (inst?)
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: inverse_clocks
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (lemma "axiom_of_archimedes")
   (inst - "id(c!1(0)-t!1)*rate")
   (skosimp*)
   (case "i!1 >= 0")
   (("1"
     (inst + "-i!1")
     (lemma "drift_left")
     (inst - "-i!1" "0" "c!1")
     (assert)
     (div-by -3 "rate")
     (expand "id")
     (assert))
    ("2"
     (inst + "0")
     (use "pos_times_lt")
     (assert)
     (expand "id")
     (assert))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: inverse_clocks
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (lemma "axiom_of_archimedes")
   (inst - "id(t!1-c!1(0))*rate")
   (skosimp*)
   (case "i!1 > 0")
   (("1"
     (inst + "i!1")
     (lemma "drift_left")
     (inst - "0" "i!1" "c!1")
     (assert)
     (div-by -3 "rate")
     (expand "id")
     (assert))
    ("2"
     (inst + "0")
     (use "neg_times_lt")
     (assert)
     (expand "id")
     (assert))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: inverse_clocks
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (expand* "C" "max")
   (rewrite "sup_def")
   (expand "least_upper_bound")
   (split +)
   (("1"
     (expand "upper_bound")
     (skosimp* t)
     (expand "past_ticks")
     (forward-chain "clock_nondecreasing_alt"))
    ("2"
     (skosimp*)
     (expand "upper_bound")
     (inst?)
     (expand "past_ticks")
     (assert))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: inverse_clocks
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (expand* "C" "max")
   (invoke (typepred "%1") (! 1 r 1 2))
   (expand "least_upper_bound")
   (flatten)
   (hide -2)
   (expand "upper_bound")
   (inst - "1 + sup(past_ticks(c!1)(t!1))")
   (("1" (assert)) ("2" (expand "past_ticks") (assert))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: inverse_clocks
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (lemma "clock_nondecreasing")
   (inst - "1+ C(c!1)(t2!1)" "C(c!1)(t1!1)" "c!1")
   (assert)
   (use "Clock_lower")
   (use "Clock_upper")
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: inverse_clocks
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (expand "clock_edge?")
   (prop)
   (("1" (skosimp*) (replace*) (rewrite "Clock_rewrite"))
    ("2" (inst?) (assert))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: inverse_clocks
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (lemma "clock_increasing")
   (inst - "T!1" "C(c!1)(t!1)" "c!1")
   (use "Clock_lower")
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: inverse_clocks
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (prop)
   (("1"
     (lemma "clock_nondecreasing")
     (inst - "C(c!1)(t!1) + 1" "T!1 + 1" "c!1")
     (use "Clock_upper")
     (assert))
    ("2"
     (lemma "clock_nondecreasing")
     (inst - "T!1 + 1" "C(c!1)(t!1)" "c!1")
     (use "Clock_lower")
     (assert))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: inverse_clocks
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (prop)
   (("1"
     (lemma "clock_nondecreasing")
     (inst - "T!1" "C(c!1)(t!1)" "c!1")
     (use "Clock_lower")
     (assert))
    ("2"
     (lemma "clock_nondecreasing")
     (inst - "C(c!1)(t!1) + 1" "T!1" "c!1")
     (use "Clock_upper")
     (assert))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: inverse_clocks
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (expand "obs?")
   (skosimp*)
   (rewrite "conversion_right" :dir rl)
   (rewrite "conversion_left_alt" :dir rl)
   (rewrite "abs_max")
   (rewrite "max_le")
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: inverse_clocks
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (use "skew_bound")
   (assert)
   (rewrite "obs_bound")
   (use "Clock_lower")
   (use "Clock_upper")
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: inverse_clocks
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (use "precision_conversion_sym")
   (prop)
   (rewrite "abs_diff_commutes" +)
   (rewrite "abs_diff_commutes")
   (use "precision_conversion_sym")
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: inverse_clocks
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (rewrite "conversion_right" :dir rl)
   (lemma "upper_offset")
   (inst - "T!1" "1 + C(c!1)(t!1)" "X!1" "c!1")
   (assert)
   (use "Clock_upper")
   (cross-mult)
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: inverse_clocks
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (rewrite "conversion_right" :dir rl)
   (lemma "lower_offset")
   (inst - "T!1" "C(c!1)(t!1)" "X!1" "c!1")
   (assert)
   (use "Clock_lower")
   (mult-by -1 "rate")
   (assert))


proof_type: j_proof
decl_type: tcc
library: fault_tolerance
theory: inverse_clocks
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (split +)
   (("1"
     (rewrite "nonempty_exists")
     (lemma "lower_Clocktime_exists")
     (inst - "c!1" "t!1")
     (skosimp*)
     (inst?)
     (expand "past_ticks")
     (propax))
    ("2"
     (expand* "above_bounded" "upper_bound")
     (use "upper_Clocktime_exists")
     (skosimp*)
     (inst + "T!1")
     (skosimp* t)
     (expand "past_ticks")
     (lemma "clock_nondecreasing_alt")
     (inst - "z!1" "T!1" "c!1")
     (assert))
    ("3" (use "sup_int_is_in_set") (rewrite "sup_int_in_set"))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: interval_clocks
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (expand "adjustment_lower_bound?")
   (expand "t")
   (inst?)
   (lemma "drift_right")
   (inst - "T(j!1)" "T(j!1+1)" "ic1!1(j!1)")
   (rewrite "T_def")
   (rewrite "drift")
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: interval_clocks
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (expand "adjustment_upper_bound?")
   (expand "t")
   (inst?)
   (lemma "drift_left")
   (inst - "T(j!1)" "T(j!1+1)" "ic1!1(j!1)")
   (rewrite "T_def")
   (rewrite "drift")
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: interval_clocks
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (expand "abs")
   (lift-if)
   (rewrite "handover_precision_lower")
   (use "handover_precision_upper")
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: interval_clocks
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
script:
  (""
   (skosimp*)
   (expand "peer_precision?")
   (expand "t")
   (inst?)
   (lemma "skew_bound_1")
   (inst - "T(j!1)" "T1!1" "T1!1 + X!1" "P" "ic1!1(j!1)" "ic2!1(j!1)"
    "pi!1")
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: interval_clocks
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (use "handover_precision_lower")
   (assert)
   (lemma "nonoverlap_basis")
   (inst - _ "T1!1" "T1!1 + X!1" _ "ic1!1(j!1)" "ic2!1(1 + j!1)")
   (inst?)
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: interval_clocks
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (use "handover_precision_upper")
   (assert)
   (lemma "nonoverlap_basis")
   (inst - _ "T1!1" "T1!1 + X!1" _ "ic2!1(1 + j!1)" "ic1!1(j!1)")
   (inst?)
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: interval_clocks
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
script:
  (""
   (skosimp*)
   (use "handover_precision_lower")
   (assert)
   (use "nonoverlap_basis")
   (rewrite "T_def")
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: interval_clocks
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (induct "j")
   (("1"
     (assert)
     (skosimp*)
     (expand "lower_accuracy_bound?")
     (skosimp*)
     (inst -2 0)
     (assert))
    ("2"
     (skosimp*)
     (expand "lower_accuracy_bound?" -2)
     (skosimp*)
     (inst - "alpha!1" "ic1!1" "p!1" 0)
     (prop)
     (("1"
       (replace -5 :dir rl)
       (expand "adjustment_lower_bound?")
       (inst - "j!1")
       (inst - "1 + j!1")
       (assert))
      ("2" (expand "lower_accuracy_bound?") (inst?) (assert))))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: interval_clocks
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (induct "j")
   (("1"
     (assert)
     (expand "upper_accuracy_bound?")
     (skosimp*)
     (inst?)
     (assert))
    ("2"
     (skosimp*)
     (expand "upper_accuracy_bound?" -2)
     (skosimp*)
     (inst - "alpha!1" "ic1!1" "p!1" 0)
     (prop)
     (("1"
       (replace -5 :dir rl)
       (expand "adjustment_upper_bound?")
       (inst - "j!1")
       (inst - "1 + j!1")
       (assert))
      ("2" (expand "upper_accuracy_bound?") (inst?) (assert))))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: virtual_clocks
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (expand "self_adjustment?")
   (skosimp*)
   (expand "obs?")
   (prop)
   (("1"
     (forward-chain "index_le")
     (expand "earliest_adjustment?")
     (inst?)
     (invoke (then (case "%1 <= %2") (assert)) (! 1 l) (! -2 l))
     (rewrite "clock_nondecreasing"))
    ("2"
     (use "lt_index")
     (expand "latest_adjustment?")
     (inst?)
     (rewrite "T_def")
     (assert))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: virtual_clocks
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (expand* "self_adjustment?" "cross_adjustment?" "obs?")
   (prop)
   (("1"
     (lemma "index_le")
     (inst - "es2!1" _)
     (inst?)
     (expand "earliest_cross_adjustment?")
     (inst?)
     (assert))
    ("2"
     (lemma "lt_index")
     (inst - "es1!1" _)
     (inst?)
     (expand "latest_adjustment?")
     (inst?)
     (assert))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: virtual_clocks
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (expand* "self_adjustment?" "cross_adjustment?" "obs?")
   (prop)
   (("1"
     (lemma "index_le")
     (inst - "es2!1" _)
     (inst?)
     (expand "earliest_adjustment?")
     (inst?)
     (assert))
    ("2"
     (lemma "lt_index")
     (inst - "es1!1" _)
     (inst?)
     (expand "latest_cross_adjustment?")
     (inst?)
     (assert))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: virtual_clocks
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (expand "nonoverlap?")
   (skosimp*)
   (expand "latest_cross_adjustment?")
   (inst?)
   (expand "earliest_cross_adjustment?")
   (inst?)
   (rewrite "T_def")
   (invoke (then (case "%1 <= %2") (assert)) (! -1 r) (! -2 l))
   (rewrite "clock_nondecreasing"))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: virtual_clocks
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (expand "VC")
   (replace*)
   (expand "Pi")
   (lemma "precision_conversion")
   (assert)
   (inst - "T(index_of(es1!1)(t1!1))" "P + A!1" _ _ _ _)
   (inst?)
   (assert)
   (inst?)
   (assert)
   (hide 2)
   (prop)
   (("1"
     (expand* "peer_precision?" "t")
     (inst?)
     (inst?)
     (expand "abs")
     (lift-if)
     (assert))
    ("2" (use "observable_peers") (assert))
    ("3" (swap-rel -6) (replace*) (use "observable_peers") (assert))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: virtual_clocks
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (expand "VC")
   (replace*)
   (lemma "observable_master")
   (inst?)
   (inst?)
   (assert)
   (hide -3 -5)
   (lemma "observable_slave")
   (inst?)
   (inst?)
   (assert)
   (hide -4 -5)
   (expand "compatible?")
   (flatten)
   (lemma "handover_precision")
   (inst?)
   (inst?)
   (prop)
   (use "precision_conversion")
   (expand "Pi")
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: virtual_clocks
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (rewrite "VC_precision_1")
   (expand "compatible?")
   (rewrite "VC_precision_0")
   (use "nonoverlap_index_bound")
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: virtual_clocks
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (rewrite "VC_precision_sym")
   (rewrite "abs_diff_commutes")
   (rewrite "max_commutative")
   (rewrite "VC_precision_sym"))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: virtual_clocks
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (cross-mult)
   (use "lower_interval_accuracy")
   (prop)
   (expand "earliest_adjustment?")
   (forward-chain "index_le")
   (inst?)
   (invoke (name-replace "K" "%1") (! 1 l 1))
   (lemma "drift_right")
   (inst - "T(K) - A!1" "T(K)" "ic!1(K)")
   (expand "t")
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: virtual_clocks
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (expand "VC")
   (forward-chain "index_upper_bound")
   (mult-by -1 "au!1")
   (lemma "upper_interval_accuracy")
   (inst?)
   (inst - "index_of(es!1)(t1!1)" "P * rate + au!1")
   (prop)
   (forward-chain "index_le")
   (expand* "earliest_adjustment?" "id")
   (inst?)
   (lemma "lower_accuracy_conversion")
   (inst - _ _ _ "t1!1")
   (inst?)
   (assert)
   (cross-mult (-1 1))
   (expand* "t" "T")
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: virtual_clocks
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (expand "VC")
   (forward-chain "index_upper_bound")
   (mult-by -1 "al!1")
   (expand* "earliest_adjustment?" "id")
   (inst?)
   (lemma "lower_interval_accuracy")
   (inst?)
   (inst - "index_of(es!1)(t1!1)" "P / rate - al!1")
   (prop)
   (forward-chain "index_le")
   (lemma "upper_accuracy_conversion")
   (inst - _ _ _ "t1!1")
   (inst?)
   (assert)
   (div-by (-1 1) "rate")
   (expand* "t" "T")
   (assert))


proof_type: j_proof
decl_type: tcc
library: fault_tolerance
theory: function_image_nonempty
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (typepred "S!1")
   (rewrite "nonempty_exists")
   (rewrite "nonempty_exists")
   (skosimp*)
   (inst + "f!1(x!1)")
   (expand "image")
   (inst + "x!1"))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: clock_minmax
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (expand "clock_min")
   (typepred "min(image(t_at(T!1), participant!1))")
   (hide -2)
   (rewrite "image" -)
   (expand "t_at")
   (skosimp*)
   (inst?)
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: clock_minmax
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (expand "clock_max")
   (typepred "max(image(t_at(T!1), participant!1))")
   (hide -2)
   (rewrite "image" -)
   (expand "t_at")
   (skosimp*)
   (inst?)
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: clock_minmax
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (expand "clock_min")
   (typepred "min(image(t_at(T!1), participant!1))")
   (hide -1)
   (inst?)
   (assert)
   (rewrite "image")
   (expand "t_at")
   (inst?))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: clock_minmax
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (expand "clock_max")
   (invoke (typepred "%1") (! 1 r))
   (hide -1)
   (inst?)
   (assert)
   (hide 2)
   (expand* "image" "t_at")
   (inst?))


proof_type: j_proof
decl_type: tcc
library: fault_tolerance
theory: clock_minmax
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (prop)
   (("1"
     (use "clock_min_witness")
     (skosimp*)
     (replace -2 :hide? t)
     (use "clock_min_is_min")
     (typepred "c!1")
     (inst - "T!1")
     (flatten)
     (assert))
    ("2"
     (lemma "clock_min_witness")
     (inst - "T!1" _)
     (inst?)
     (skosimp*)
     (replace -2 :hide? t)
     (use "clock_min_is_min")
     (typepred "c!1")
     (inst - "T!1")
     (flatten)
     (assert))))


proof_type: j_proof
decl_type: tcc
library: fault_tolerance
theory: clock_minmax
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (prop)
   (("1"
     (lemma "clock_max_witness")
     (inst - "T!1" _)
     (inst?)
     (skosimp*)
     (replace -2 :hide? t)
     (lemma "clock_max_is_max")
     (inst - "1 + T!1" _ _)
     (inst?)
     (typepred "c!1")
     (inst - "T!1")
     (flatten)
     (assert))
    ("2"
     (use "clock_max_witness")
     (skosimp*)
     (replace -2 :hide? t)
     (lemma "clock_max_is_max")
     (inst - "T!1" _ _)
     (inst?)
     (typepred "c!1")
     (inst - "T!1")
     (flatten)
     (assert))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: synch_constant_definitions
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (lemma "P_bound")
   (mult-by 1 "P")
   (invoke (then (case "%1 <= %2") (assert)) (! 1 l) (! -1 l))
   (hide-all-but 1)
   (expand* "drift" "rate" "id")
   (field 1))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: synch_constant_definitions
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (expand "p_min")
   (lemma "P_bound")
   (isolate 1 r 1)
   (cross-mult)
   (invoke (then (case "%1 <= %2") (assert)) (! 1 l) (! -1 l))
   (hide-all-but 1)
   (assert)
   (expand "max")
   (lift-if)
   (assert)
   (expand "id")
   (prop)
   (assert)
   (isolate 1 l 2)
   (assert)
   (cancel))


proof_type: t_proof
decl_type: tcc
library: fault_tolerance
theory: synch_constant_definitions
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (invoke (then (case "%1") (assert)) (! 1 2))
   (hide 2)
   (move-terms 1 l 2)
   (cross-mult)
   (lemma "p_min_bound")
   (assert)
   (expand "max")
   (lift-if)
   (prop)
   (("1" (div-by (-2 1) "rate") (assert)) ("2" (assert))))


proof_type: t_proof
decl_type: tcc
library: fault_tolerance
theory: synch_constant_definitions
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (invoke (then (case "%1") (assert)) (! 1 2))
   (hide 2)
   (isolate 1 l 1)
   (cross-mult)
   (lemma "p_min_bound")
   (expand "id")
   (assert)
   (expand "max")
   (lift-if)
   (assert)
   (prop)
   (div-by (-2 1) "rate")
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: synch_protocol_invariants
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (expand "all_periodic_precision?")
   (skosimp*)
   (generalize-skolem-constants)
   (induct "j_1")
   (("1" (skosimp*) (expand "initial_precision?") (propax))
    ("2"
     (skosimp*)
     (inst?)
     (assert)
     (expand "periodic_precision_enhancement?")
     (inst?)
     (assert))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: synch_protocol_invariants
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (expand "adjustment_lower_bound?")
   (skosimp*)
   (expand* "all_periodic_precision?" "periodic_precision?")
   (inst?)
   (expand* "lower_accuracy_preservation?" "adjustment_lower_bound?")
   (inst?)
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: synch_protocol_invariants
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (expand "adjustment_upper_bound?")
   (skosimp*)
   (expand* "upper_accuracy_preservation?" "adjustment_upper_bound?")
   (inst?)
   (expand* "all_periodic_precision?" "periodic_precision?")
   (inst - "j!1")
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: synch_protocol_invariants
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (lemma "min_le_trace")
   (inst - _ "ic2!1" _)
   (inst?)
   (lemma "trace_le_max")
   (inst - _ "ic1!1" _)
   (inst?)
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: synch_protocol_invariants
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (expand "peer_precision?")
   (skosimp*)
   (use "trace_diff")
   (forward-chain "all_periodic_precision")
   (expand "all_periodic_precision?")
   (inst - "j!1")
   (expand "periodic_precision?")
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: synch_protocol_invariants
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (expand "adjustment_lower_bound?")
   (skosimp*)
   (lemma "trace_diff")
   (inst - _ _ "ic1!1" "ic2!1" "j!1" "1 + j!1")
   (inst?)
   (inst?)
   (forward-chain "all_periodic_precision")
   (forward-chain "minmax_adjustment_lower_bound")
   (expand "adjustment_lower_bound?")
   (inst?)
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: synch_protocol_invariants
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (expand "adjustment_upper_bound?")
   (skosimp*)
   (use "trace_diff")
   (forward-chain "all_periodic_precision")
   (forward-chain "minmax_adjustment_upper_bound")
   (expand "adjustment_upper_bound?")
   (inst?)
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: synch_protocol_invariants
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (expand "synch_protocol_invariants?")
   (expand "compatible?")
   (skosimp*)
   (prop)
   (("1"
     (lemma "traces_peer_precision")
     (inst - _ _ _ "pi!1")
     (inst?)
     (inst - "ic2!1")
     (assert)
     (expand "peer_precision?")
     (skosimp*)
     (inst?)
     (assert))
    ("2"
     (lemma "traces_lower")
     (inst - _ _ _ "pi!1" _)
     (inst?)
     (inst?)
     (assert)
     (expand "lower_accuracy_preservation?")
     (expand "adjustment_lower_bound?")
     (hide 2)
     (skosimp*)
     (inst?)
     (assert))
    ("3"
     (lemma "traces_upper")
     (inst - _ _ _ "pi!1" _)
     (inst?)
     (inst?)
     (assert)
     (expand "upper_accuracy_preservation?")
     (expand "adjustment_upper_bound?")
     (skosimp*)
     (inst?)
     (assert))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: synch_protocol_invariants
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (expand* "synch_protocol_invariants?" "lower_accuracy_preservation?"
    "lower_accuracy_bound?")
   (skosimp*)
   (inst?)
   (prop)
   (("1" (skosimp*) (rewrite "min_le_trace"))
    ("2"
     (expand* "initial_precision?" "periodic_precision?")
     (use "trace_le_max")
     (assert))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: synch_protocol_invariants
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (expand* "synch_protocol_invariants?" "upper_accuracy_bound?"
    "upper_accuracy_preservation?")
   (skosimp*)
   (inst?)
   (prop)
   (("1" (skosimp*) (rewrite "trace_le_max"))
    ("2"
     (expand* "initial_precision?" "periodic_precision?")
     (lemma "min_le_trace")
     (inst?)
     (inst - "ic!1")
     (assert))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: synch_protocol_invariants
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (expand "synch_protocol_invariants?")
   (expand "weakly_accurate?")
   (skosimp*)
   (rewrite "p_min_lower")
   (rewrite "p_max_upper")
   (use "traces_lower")
   (prop)
   (use "traces_upper")
   (prop))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: virtual_clock_2
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (expand "increasing?")
   (skosimp*)
   (typepred "ac!1")
   (expand "weakly_accurate?")
   (expand "adjustment_lower_bound?")
   (flatten)
   (inst?)
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: virtual_clock_2
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (expand "unbounded?")
   (skosimp*)
   (lemma "axiom_of_archimedes")
   (inst - "(t!1 - t(ac!1)(0))/ p_min")
   (skosimp*)
   (cross-mult)
   (isolate -1 l 1)
   (case "i!1 >= 0")
   (("1"
     (inst + "i!1")
     (typepred "ac!1")
     (expand "weakly_accurate?")
     (flatten)
     (lemma "lower_interval_accuracy")
     (inst - "pi_0 + alpha_l" "ac!1" "i!1" "p_min" 0)
     (expand "lower_accuracy_bound?")
     (expand "p_min")
     (assert)
     (inst?)
     (assert))
    ("2" (inst + 0) (mult-by 1 "p_min") (assert))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: virtual_clock_2
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (expand* "compatible?" "nonoverlap?")
   (skosimp*)
   (expand "adjustment_lower_bound?")
   (inst?)
   (use "p_min_bound")
   (div-by -1 "rate")
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: virtual_clock_2
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (expand "self_adjustment?")
   (expand "t")
   (skosimp*)
   (prop)
   (("1"
     (expand "earliest_adjustment?")
     (skosimp*)
     (rewrite "clock_nondecreasing"))
    ("2"
     (expand "latest_adjustment?")
     (skosimp*)
     (typepred "ac!1")
     (expand "weakly_accurate?")
     (lemma "nonoverlap_upper")
     (expand "p_max")
     (inst - _ "1 + ADJ" _ _ _ _)
     (inst?)
     (inst?)
     (use "ADJ_ineq_h")
     (expand "id")
     (assert))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: virtual_clock_2
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (expand "cross_adjustment?")
   (expand "t")
   (skosimp*)
   (prop)
   (("1"
     (expand "earliest_cross_adjustment?")
     (skosimp*)
     (expand "compatible?")
     (lemma "nonoverlap_lower")
     (inst - _ "1 + ADJ" _ _ _ "max(alpha_l, alpha_u) + pi_0")
     (inst?)
     (expand* "id" "ADJ")
     (assert))
    ("2"
     (expand "latest_cross_adjustment?")
     (skosimp*)
     (lemma "nonoverlap_peers")
     (expand "compatible?")
     (inst - "T(k!1)" "1 + ADJ" _ _ _ "max(alpha_l, alpha_u) + pi_0")
     (inst?)
     (expand* "id" "ADJ")
     (assert))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: virtual_clock_2
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (expand "VC2")
   (expand "VC")
   (rewrite "index_rewrite")
   (expand "t")
   (rewrite "Clock_rewrite"))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: virtual_clock_2
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (lemma "trace_weakly_accurate")
   (inst-cp - _ "ic2!1")
   (inst - _ "ic1!1")
   (inst?)
   (inst?)
   (assert)
   (expand "VC2")
   (lemma "VC_precision")
   (inst - "ADJ + 1" "max(alpha_l, alpha_u) + pi_0" "t(ic1!1)" "t(ic2!1)"
    "ic1!1" "ic2!1" "t1!1")
   (expand "Pi")
   (expand "P_max")
   (assert)
   (hide 2)
   (lemma "traces_compatible")
   (inst - "alpha_l" "alpha_u" "hst!1" _ _ "pi_0")
   (inst-cp - "ic1!1" "ic2!1")
   (inst - "ic2!1" "ic1!1")
   (assert)
   (expand "p_lower")
   (expand "p_upper")
   (assert)
   (rewrite "t_self")
   (rewrite "t_self")
   (rewrite "t_cross")
   (rewrite "t_cross")
   (rewrite "t_nonoverlap")
   (rewrite "t_nonoverlap"))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: virtual_clock_2
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (typepred "p_lower")
   (use "trace_weakly_accurate")
   (assert)
   (assert)
   (expand "p_lower")
   (expand "p_upper")
   (use "trace_lower_accuracy")
   (use "trace_upper_accuracy")
   (prop)
   (expand "VC2")
   (use "t_early")
   (lemma "VC_lower_accuracy")
   (inst?)
   (inst - "0" "alpha_l" "alpha_u" "p_lower" "pi_0")
   (rewrite "p_lower" :dir rl)
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: virtual_clock_2
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (use "p_lower")
   (use "trace_weakly_accurate")
   (assert)
   (expand "VC2")
   (expand "p_lower" -5)
   (use "trace_lower_accuracy")
   (assert)
   (use "t_early")
   (lemma "VC_upper_accuracy")
   (inst?)
   (inst - "0" "alpha_l" "p_lower" "pi_0")
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: virtual_clock_1
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (expand "increasing?")
   (skosimp*)
   (expand "turns")
   (rewrite "T_def")
   (lift-if)
   (prop)
   (("1" (replace*) (rewrite "clock_increasing"))
    ("2"
     (typepred "ac!1")
     (expand* "weakly_accurate?" "p_min")
     (flatten)
     (lemma "P_bound")
     (lemma "nonoverlap_round")
     (inst - "P" "ac!1" "ac!1" "i!1 - 1" "pi_0 + max(alpha_l, alpha_u)")
     (("1"
       (rewrite "T_def")
       (assert)
       (expand "adjustment_lower_bound?")
       (skosimp*)
       (inst?)
       (assert))
      ("2" (assert))))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: virtual_clock_1
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (expand "unbounded?")
   (skosimp*)
   (lemma "axiom_of_archimedes")
   (inst - "(t!1 - t(ac!1)(0))/ p_min")
   (skosimp*)
   (cross-mult)
   (isolate -1 l 1)
   (case "i!1 >= 0")
   (("1"
     (inst + "1 + i!1")
     (("1"
       (typepred "ac!1")
       (expand "weakly_accurate?")
       (flatten)
       (lemma "lower_interval_accuracy")
       (inst - "pi_0 + alpha_l" "ac!1" "i!1" "p_min" 0)
       (use "p_min")
       (assert)
       (prop)
       (("1"
         (expand "turns")
         (expand "t")
         (lemma "clock_nondecreasing")
         (inst - "T(i!1)" "T(i!1 + 1)" "ac!1(i!1)")
         (rewrite "T_def")
         (assert))
        ("2" (expand "lower_accuracy_bound?") (inst?) (assert))))
      ("2" (assert))))
    ("2"
     (assert)
     (inst + 0)
     (mult-by 1 "p_min")
     (assert)
     (expand "turns")
     (expand "t")
     (assert))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: virtual_clock_1
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (expand "nonoverlap?")
   (skosimp*)
   (use "ADJ_bound")
   (expand "turns")
   (rewrite "T_def")
   (lift-if)
   (expand "compatible?")
   (prop)
   (("1"
     (hide-all-but (1 -6 -1 -2))
     (replace*)
     (use "nonoverlap_peers")
     (expand "ADJ")
     (assert))
    ("2"
     (hide-all-but (2 1 -3 -1))
     (lemma "nonoverlap_lower")
     (inst - _ _ _ _ _ "pi_0 + max(alpha_l, alpha_u)")
     (inst?)
     (("1" (inst?) (expand "ADJ") (assert)) ("2" (assert))))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: virtual_clock_1
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (expand "earliest_adjustment?")
   (expand "turns")
   (skosimp*)
   (lift-if)
   (prop)
   (("1" (replace*) (rewrite "clock_nondecreasing"))
    ("2"
     (lemma "nonoverlap_upper")
     (inst - "T(k!1) - ADJ - 1" "ADJ + 1" "ac!1" "ac!1" "k!1 - 1"
      "pi_0 + max(alpha_l, alpha_u)")
     (("1"
       (assert)
       (prop)
       (("1"
         (typepred "ac!1")
         (expand "weakly_accurate?")
         (flatten)
         (expand "p_max")
         (expand "adjustment_upper_bound?")
         (skosimp*)
         (inst?)
         (assert))
        ("2" (isolate 1 l 2) (expand "ADJ") (assert))))
      ("2" (assert))))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: virtual_clock_1
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (expand "self_adjustment?")
   (rewrite "turns_early")
   (expand "latest_adjustment?")
   (skosimp*)
   (expand "turns")
   (rewrite "clock_nondecreasing"))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: virtual_clock_1
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (expand "compatible?")
   (expand "cross_adjustment?")
   (prop)
   (("1"
     (hide-all-but (1 -4))
     (expand "earliest_cross_adjustment?")
     (skosimp*)
     (expand "turns")
     (lemma "nonoverlap_peers")
     (inst?)
     (inst - "ADJ + 1" "ac2!1" _)
     (inst?)
     (rewrite "T_def")
     (expand "ADJ")
     (assert))
    ("2"
     (expand "latest_cross_adjustment?")
     (skosimp*)
     (expand "turns")
     (lift-if)
     (prop)
     (("1"
       (hide-all-but (1 -2 -1))
       (replace*)
       (lemma "nonoverlap_peers")
       (inst - "T(0)" "ADJ + 1" _ _ _ _)
       (inst?)
       (inst?)
       (expand "ADJ")
       (assert))
      ("2"
       (hide-all-but (2 1 -5))
       (lemma "nonoverlap_lower")
       (inst?)
       (("1"
         (inst - "pi_0 + max(alpha_l, alpha_u)")
         (expand "ADJ")
         (assert))
        ("2" (assert))))))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: virtual_clock_1
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (expand "VC1")
   (expand "VC")
   (rewrite "index_rewrite")
   (expand "turns")
   (propax))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: virtual_clock_1
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (lemma "trace_weakly_accurate")
   (inst-cp - _ "ic2!1")
   (inst - _ "ic1!1")
   (inst?)
   (inst?)
   (assert)
   (expand "VC1")
   (lemma "VC_precision")
   (inst?)
   (inst - "ADJ + 1" "max(alpha_l, alpha_u) + pi_0")
   (expand "Pi")
   (expand "P_max")
   (assert)
   (hide 2)
   (lemma "traces_compatible")
   (inst - "alpha_l" "alpha_u" "hst!1" _ _ "pi_0")
   (inst-cp - "ic1!1" "ic2!1")
   (inst - "ic2!1" "ic1!1")
   (assert)
   (expand "p_lower")
   (expand "p_upper")
   (assert)
   (rewrite "turns_self")
   (rewrite "turns_self")
   (rewrite "turns_nonoverlap")
   (rewrite "turns_nonoverlap")
   (rewrite "turns_cross")
   (rewrite "turns_cross")
   (expand "turns")
   (expand "t")
   (propax))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: virtual_clock_1
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (use "trace_weakly_accurate")
   (assert)
   (expand "p_lower" -4)
   (use "trace_lower_accuracy")
   (assert)
   (rewrite "p_lower" :dir rl)
   (expand "p_upper")
   (use "trace_upper_accuracy")
   (assert)
   (expand "VC1")
   (use "turns_early")
   (lemma "p_lower")
   (lemma "VC_lower_accuracy")
   (inst?)
   (inst - "ADJ + 1" "alpha_l" "alpha_u" "p_lower" "pi_0")
   (assert)
   (expand "t")
   (expand "turns")
   (propax))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: virtual_clock_1
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (use "p_lower")
   (use "trace_weakly_accurate")
   (assert)
   (expand "VC1")
   (expand "p_lower" -5)
   (use "trace_lower_accuracy")
   (assert)
   (use "turns_early")
   (lemma "VC_upper_accuracy")
   (inst?)
   (inst - "ADJ + 1" "alpha_l" "p_lower" "pi_0")
   (assert)
   (expand "turns")
   (expand "t")
   (propax))


proof_type: j_proof
decl_type: tcc
library: fault_tolerance
theory: relations_extra
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp* t)
   (expand "strict_order?")
   (flatten)
   (expand "asymmetric?")
   (skosimp*)
   (expand "transitive?")
   (inst - "x!2" "y!1" "x!2")
   (assert)
   (expand "irreflexive?")
   (inst?))


proof_type: j_proof
decl_type: tcc
library: fault_tolerance
theory: relations_extra
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp* t)
   (expand "asymmetric?")
   (expand "antisymmetric?")
   (skosimp*)
   (inst?)
   (assert))


proof_type: j_proof
decl_type: tcc
library: fault_tolerance
theory: relations_extra
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp* t)
   (expand* "preorder?" "transitive?" "reflexive_closure" "union"
    "member")
   (skosimp*)
   (inst - "x!1" "y!1" "z!1")
   (assert)
   (ground))


proof_type: j_proof
decl_type: tcc
library: fault_tolerance
theory: relations_extra
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp* t)
   (expand* "partial_order?" "preorder?")
   (expand* "antisymmetric?" "reflexive_closure" "union" "member")
   (skosimp*)
   (assert)
   (use "asymmetric")
   (prop))


proof_type: j_proof
decl_type: tcc
library: fault_tolerance
theory: relations_extra
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (expand* "dichotomous?" "reflexive_closure" "union" "member")
   (skosimp*)
   (use "trichotomous")
   (prop))


proof_type: j_proof
decl_type: tcc
library: fault_tolerance
theory: relations_extra
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp* t)
   (expand* "strict_order?" "transitive?" "irreflexive_kernel"
    "difference" "member")
   (skosimp*)
   (lemma "transitive")
   (assert)
   (inst - "R!1" "x!1" "y!1" "z!1")
   (assert)
   (replace -5 :hide? t)
   (lemma "antisymmetric")
   (inst - "R!1" "z!1" "y!1")
   (prop))


proof_type: j_proof
decl_type: tcc
library: fault_tolerance
theory: relations_extra
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (expand* "trichotomous?" "irreflexive_kernel" "difference" "member")
   (skosimp*)
   (assert)
   (use "dichotomous")
   (prop))


proof_type: j_proof
decl_type: tcc
library: fault_tolerance
theory: relations_extra
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp* t)
   (expand "equivalence?")
   (prop)
   (("1"
     (expand* "reflexive?" "symmetric_kernel" "intersection" "converse"
      "member")
     (skosimp*)
     (use "reflexive")
     (prop))
    ("2"
     (expand* "transitive?" "symmetric_kernel" "intersection" "converse"
      "member")
     (skosimp*)
     (lemma "transitive")
     (inst-cp - "R!1" "x!1" "y!1" "z!1")
     (inst - "R!1" "z!1" "y!1" "x!1")
     (prop))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: node
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (decompose-equality)
   (expand* "uniform_nodes" "enabled_symmetric?")
   (inst?)
   (iff)
   (ground))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: node
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (expand "vec2seq")
   (decompose-equality)
   (("1" (lift-if) (prop) (expand "enabled_symmetric?") (inst?) (assert))
    ("2"
     (skosimp*)
     (expand "nonempty?")
     (expand "empty?")
     (expand "member")
     (propax))))


proof_type: t_proof
decl_type: tcc
library: fault_tolerance
theory: node
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (lemma "bij_exists[below(N)]")
   (inst +
    "lambda enabled: choose({g: [below(card(enabled)) -> (enabled)] | bijective?(g)})")
   (skosimp*)
   (inst?)
   (skosimp*)
   (expand "nonempty?")
   (expand "empty?")
   (expand "member")
   (typepred "enabled!1")
   (expand "empty?")
   (skosimp*)
   (expand "member")
   (inst - "inverse(f!1)")
   (("1" (rewrite "bij_inv_is_bij") (inst?)) ("2" (inst?))))


proof_type: j_proof
decl_type: tcc
library: fault_tolerance
theory: node
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (expand "vec2seq")
   (use "nonempty_card[below(N)]")
   (assert)
   (expand "nonempty?")
   (typepred "enabled!1")
   (propax))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: select_minmax
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (expand "v_min")
   (typepred "min(image(v!1, node_set!1))")
   (("1" (hide -2) (rewrite "image" -1) (skosimp*) (inst?) (assert))
    ("2" (use "v_min_TCC1"))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: select_minmax
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (expand "v_max")
   (typepred "max(image(v!1, node_set!1))")
   (("1" (hide -2) (rewrite "image" -1) (skosimp*) (inst?) (assert))
    ("2" (use "v_min_TCC1"))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: select_minmax
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (expand "v_min")
   (typepred "min(image(v!1, node_set!1))")
   (inst?)
   (assert)
   (rewrite "image" +)
   (inst?))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: select_minmax
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (expand "v_max")
   (typepred "max(image(v!1, node_set!1))")
   (inst?)
   (assert)
   (rewrite "image" +)
   (inst?))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: select_minmax
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (typepred "<=")
   (expand* "total_order?" "partial_order?" "preorder?")
   (prop)
   (("1" (expand "reflexive?") (inst?) (assert))
    ("2" (use "min_le_max") (expand "antisymmetric?") (inst?) (assert))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: select_minmax
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (prop)
   (("1"
     (lemma "v_min_witness")
     (inst?)
     (lemma "v_max_witness")
     (inst?)
     (expand "uniform?")
     (skosimp*)
     (inst-cp - "n!2")
     (inst - "n!1")
     (assert))
    ("2"
     (lemma "v_min_witness")
     (inst?)
     (skosimp*)
     (expand "uniform?")
     (inst?)
     (assert))
    ("3"
     (expand "uniform?")
     (skosimp*)
     (lemma "v_min_is_min")
     (inst?)
     (inst?)
     (assert)
     (lemma "v_max_is_max")
     (inst?)
     (inst?)
     (assert)
     (replace*)
     (hide -3 -4 -5)
     (typepred "<=")
     (expand "total_order?")
     (expand "partial_order?")
     (expand "antisymmetric?")
     (flatten)
     (inst?)
     (assert))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: select_minmax
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (expand "uniform?")
   (prop)
   (("1"
     (use "v_max_witness")
     (skosimp*)
     (inst?)
     (assert)
     (replace*)
     (use "reflexive"))
    ("2"
     (use "v_min_witness")
     (skosimp*)
     (inst?)
     (assert)
     (replace*)
     (use "reflexive"))
    ("3"
     (skosimp*)
     (lemma "antisymmetric")
     (invoke (inst - "<=" "%1" "%2") (! 1 l) (! 1 r))
     (assert)
     (lemma "transitive")
     (prop)
     (("1"
       (use "v_max_is_max")
       (assert)
       (inst - "<=" "v!1(n!1)" "v_max(v!1, node_set!1)" "t!1")
       (assert))
      ("2"
       (use "v_min_is_min")
       (inst - "<=" "t!1" "v_min(v!1, node_set!1)" "v!1(n!1)")
       (assert))))))


proof_type: t_proof
decl_type: tcc
library: fault_tolerance
theory: select_minmax
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (typepred "node_set!1")
   (expand "empty?")
   (expand "image")
   (expand "member")
   (skosimp*)
   (inst - "v!1(x!1)")
   (inst?))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: pigeonhole
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (case "card(intersection(A!1, B!1)) >= 1")
   (("1"
     (hide -2)
     (forward-chain "card_1_has_1")
     (hide -2)
     (skosimp*)
     (expand* "intersection" "member")
     (inst?))
    ("2" (use "card_plus[T]") (assert))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: pigeonhole
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (rewrite "difference_intersection")
   (lemma "card_disj_union[T]")
   (inst?)
   (invoke (inst - "%1") (! 1 r 1 1))
   (split -)
   (("1"
     (rewrite "distribute_intersection_union" :dir rl)
     (invoke (case-replace "%1 = %2") (! -1 l 1) (! -1 l 1 1))
     (("1" (ground))
      ("2"
       (hide-all-but 1)
       (apply-extensionality :hide? t)
       (iff)
       (grind))))
    ("2" (hide-all-but 1) (grind))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: pigeonhole
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (lemma "pigeonhole")
   (inst - "A!1" "intersection(S!1, B!1)")
   (prop)
   (("1"
     (skosimp*)
     (expand "intersection")
     (expand "member")
     (flatten)
     (inst?)
     (assert))
    ("2"
     (case "subset?(union(A!1, intersection(S!1, B!1)), S!1)")
     (("1"
       (forward-chain "card_subset")
       (rewrite "card_difference_alt")
       (assert))
      ("2"
       (rewrite "union_upper_bound")
       (rewrite "intersection_subset1"))))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: pigeonhole
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (prop)
   (("1"
     (expand "majority_subset?")
     (expand "simple_majority?")
     (assert)
     (hide -1)
     (grind))
    ("2"
     (expand "simple_majority?")
     (expand "majority_subset?")
     (flatten))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: pigeonhole
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (expand "majority_subset?")
   (flatten)
   (use "nonempty_card[T]")
   (assert)
   (expand* "nonempty?" "empty?" "subset?" "member")
   (skosimp*)
   (inst?)
   (inst?)
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: pigeonhole
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (lemma "majority_subset_nonempty")
   (inst?)
   (assert)
   (expand "majority_subset?")
   (flatten)
   (lemma "card_empty?[T]")
   (inst-cp - "S!1")
   (inst - "A!1")
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: pigeonhole
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (case "card(union(A!1,B!1)) <= card(S!1)")
   (("1" (use "pigeonhole") (assert))
    ("2"
     (hide -1 -3 2)
     (rewrite "card_subset")
     (rewrite "union_upper_bound"))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: pigeonhole
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (expand "simple_majority?")
   (case "card(union(intersection(A!1,S!1),intersection(B!1,S!1))) <= card(S!1)")
   (("1"
     (lemma "pigeonhole")
     (inst - "intersection(A!1, S!1)" "intersection(B!1, S!1)")
     (assert)
     (skosimp*)
     (inst?)
     (expand "intersection")
     (expand "member")
     (flatten)
     (assert))
    ("2"
     (rewrite "card_subset")
     (hide -1 -2 2 3)
     (auto-rewrite-defs)
     (assert)
     (skosimp*)
     (ground))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: pigeonhole
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (case "subset?(S1!1, S2!1)")
   (("1"
     (lemma "majority_pigeonhole")
     (inst - "B!1" "A!1" "S2!1")
     (assert)
     (expand "majority_subset?")
     (flatten)
     (assert)
     (forward-chain "card_subset")
     (assert)
     (prop)
     (("1" (skosimp*) (inst?) (assert))
      ("2"
       (rewrite "union_subset2")
       (rewrite "intersection_subset2")
       (assert))
      ("3"
       (hide -1 -3 -5 -6 -7 2)
       (lemma "subset_transitive[T]")
       (inst?)
       (inst - "S1!1")
       (assert))))
    ("2"
     (case "subset?(S2!1, S1!1)")
     (("1"
       (rewrite "union_commutative")
       (rewrite "intersection_commutative")
       (rewrite "union_subset2")
       (rewrite "intersection_subset2")
       (expand "majority_subset?")
       (flatten)
       (lemma "majority_pigeonhole")
       (inst - "A!1" "B!1" "S1!1")
       (assert)
       (prop)
       (hide -2 -3 -4 -6 2 3)
       (lemma "subset_transitive[T]")
       (inst?)
       (inst - "S2!1")
       (assert))
      ("2"
       (hide -1 -2 3)
       (case "card(difference(union(S1!1, S2!1), intersection(S1!1, S2!1))) >= 2")
       (("1"
         (use "card_diff_subset[T]")
         (assert)
         (hide-all-but 1)
         (expand "subset?")
         (expand "intersection")
         (expand "union")
         (expand "member")
         (skosimp*))
        ("2"
         (hide -1)
         (expand "subset?")
         (skosimp*)
         (case "subset?((: x!1, x!2 :), difference(union(S1!1, S2!1), intersection(S1!1, S2!1)))")
         (("1"
           (forward-chain "card_subset")
           (("1"
             (hide -2)
             (expand "list2set")
             (expand "list2set")
             (expand "list2set")
             (rewrite "card_add")
             (rewrite "card_add")
             (rewrite "card_emptyset")
             (assert)
             (expand "emptyset")
             (expand "add")
             (expand "member")
             (assert))
            ("2"
             (expand "list2set")
             (expand "list2set")
             (expand "list2set")
             (propax))))
          ("2"
           (hide 2)
           (expand "list2set")
           (expand "list2set")
           (expand "list2set")
           (expand "add")
           (expand "subset?")
           (expand "intersection")
           (expand "union")
           (expand "difference")
           (expand "emptyset")
           (expand "member")
           (skosimp*)
           (assert)
           (ground))))))))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: pigeonhole
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (expand "intersection_majority?")
   (use "nonempty_card[T]")
   (assert)
   (expand "nonempty?")
   (expand "empty?")
   (expand "member")
   (expand "intersection")
   (expand "member")
   (skosimp*)
   (inst?))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: pigeonhole
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (expand "intersection_majority?")
   (skosimp*)
   (rewrite "pigeonhole")
   (hide 2)
   (expand "two_thirds_majority_subset?")
   (flatten)
   (invoke (case "%1 <= %2") (! 1 r) (! -5 r))
   (("1"
     (invoke (then (case "%1 > %2") (assert)) (! 1 l) (! -1 r))
     (hide -1 -3 -5 2)
     (rewrite "card_union")
     (assert))
    ("2"
     (rewrite "card_subset")
     (hide-all-but (-2 -4 1))
     (expand "subset?")
     (expand "union")
     (expand "member")
     (skosimp*)
     (inst?)
     (inst?)
     (prop))))


proof_type: t_proof
decl_type: tcc
library: fault_tolerance
theory: pigeonhole
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (use "nonempty_card[T]")
   (assert)
   (typepred "e!1")
   (expand "nonempty?")
   (propax))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: finite_seqs
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (expand "choose")
   (lift-if)
   (assert)
   (ground)
   (("1" (expand "in?") (inst?)) ("2" (expand "in?") (inst?))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: finite_seqs
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp* t)
   (typepred "mf!1(fs!1)")
   (typepred "maj(fs!1)")
   (prop)
   (use "is_majority_unique")
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: finite_seqs
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (rewrite "maj_exists_same")
   (("1" (use "maj_lem") (prop)) ("2" (expand "maj_exists") (inst?))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: finite_seqs
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (prop)
   (("1"
     (expand "is_majority")
     (expand "is_majority?")
     (expand "uniform")
     (propax))
    ("2"
     (expand "is_majority?")
     (expand "is_majority")
     (assert)
     (expand "uniform")
     (propax))))


proof_type: j_proof
decl_type: tcc
library: fault_tolerance
theory: finite_seqs
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (expand "majority_choose")
   (lift-if)
   (assert)
   (prop)
   (("1"
     (typepred "maj(x1!1)")
     (prop)
     (use "maj_in_seq")
     (assert)
     (expand "in_seq")
     (expand "in?")
     (skosimp*)
     (inst?)
     (assert))
    ("2" (assert) (expand "choose") (assert) (expand "in?") (inst?))))


proof_type: j_proof
decl_type: tcc
library: fault_tolerance
theory: finite_seqs
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (expand "majority_choose2")
   (expand "majority_choose")
   (lift-if)
   (assert)
   (prop)
   (("1"
     (expand "maj_exists")
     (expand "is_majority")
     (skosimp*)
     (use "empty_card[below(length(x1!1))]")
     (("1" (assert) (expand "empty?") (expand "member") (skosimp*))
      ("2" (rewrite "finite_below"))))
    ("2" (typepred "maj(x1!1)") (assert))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: ordered_finite_sequences
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (typepred "min(sort(s!1) ^ (i!1, j!1))")
   (skosimp*)
   (replace -2 :dir RL :hide? T)
   (typepred "jj!1")
   (expand "^")
   (lift-if)
   (assert)
   (case-replace "jj!1 = 0")
   (("1" (assert))
    ("2"
     (inst - "0")
     (typepred "sort(s!1)")
     (expand "increasing?")
     (inst - "i!1" "i!1+jj!1")
     (assert)
     (typepred "<=")
     (expand "total_order?")
     (expand "partial_order?")
     (expand "antisymmetric?")
     (flatten)
     (inst?)
     (assert))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: ordered_finite_sequences
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (typepred "max(sort(s!1) ^ (i!1, j!1))")
   (skosimp*)
   (replace -2 :dir RL :hide? T)
   (typepred "jj!1")
   (expand "^")
   (lift-if)
   (assert)
   (expand "min")
   (case-replace "jj!1 = j!1-i!1")
   (("1" (assert))
    ("2"
     (inst - "j!1-i!1")
     (("1"
       (assert)
       (typepred "sort(s!1)")
       (expand "increasing?")
       (inst - "i!1+jj!1" "j!1")
       (assert)
       (typepred "<=")
       (expand "total_order?")
       (expand "partial_order?")
       (expand "antisymmetric?")
       (flatten)
       (inst?)
       (assert))
      ("2" (expand "^") (assert) (expand "min") (assert))))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: ordered_finite_sequences
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (use "min_seq_in?")
   (expand "in?")
   (skosimp*)
   (replace -1 :hide? t)
   (use "max_seq_lem"))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: ordered_finite_sequences
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (use "min_seq_it_is")
   (assert)
   (hide 2)
   (prop)
   (("1"
     (skosimp* t)
     (expand "minmax")
     (expand "list2finseq")
     (expand "length")
     (expand "length")
     (expand "length")
     (expand "nth")
     (expand "nth")
     (assert)
     (lift-if)
     (prop)
     (("1" (use "reflexive")) ("2" (use "min_le_max"))))
    ("2"
     (expand "in?")
     (inst + 0)
     (expand "minmax")
     (expand "list2finseq")
     (expand "nth")
     (propax))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: ordered_finite_sequences
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (use "max_seq_it_is")
   (assert)
   (hide 2)
   (prop)
   (("1"
     (skosimp* t)
     (expand "minmax")
     (expand "list2finseq")
     (expand "length")
     (expand "length")
     (expand "length")
     (expand "nth")
     (expand "nth")
     (assert)
     (lift-if)
     (prop)
     (("1" (use "min_le_max")) ("2" (use "reflexive"))))
    ("2"
     (expand "in?")
     (inst + 1)
     (("1"
       (expand "minmax")
       (expand "list2finseq")
       (expand "nth")
       (expand "nth")
       (propax))
      ("2"
       (expand "minmax")
       (expand "list2finseq")
       (expand "length")
       (expand "length")
       (assert))))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: ordered_finite_sequences
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (expand "subset?")
   (expand "member")
   (expand "lower")
   (expand "map_set")
   (assert)
   (skosimp*)
   (typepred "sort_map(s!1)")
   (inst?)
   (case "sort_map(s!1)(x!1) = i!1")
   (("1"
     (typepred "<=")
     (expand "total_order?")
     (expand "partial_order?")
     (expand "preorder?")
     (expand "reflexive?")
     (flatten)
     (inst - "s!1`seq(x!1)")
     (assert))
    ("2"
     (typepred "sort(s!1)")
     (expand "increasing?")
     (inst - "sort_map(s!1)(x!1)" "i!1")
     (assert))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: ordered_finite_sequences
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (expand "subset?")
   (expand "member")
   (expand "upper")
   (expand "map_set")
   (assert)
   (skosimp*)
   (typepred "sort_map(s!1)")
   (inst?)
   (case "sort_map(s!1)(x!1) = i!1")
   (("1"
     (typepred "<=")
     (expand "total_order?")
     (expand "partial_order?")
     (expand "preorder?")
     (expand "reflexive?")
     (flatten)
     (inst - "s!1`seq(x!1)")
     (assert))
    ("2"
     (typepred "sort(s!1)")
     (expand "increasing?")
     (inst - "i!1" "sort_map(s!1)(x!1)")
     (assert))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: ordered_finite_sequences
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (use "card_eq_bij[below(k!1), below(k!1)]")
   (assert)
   (hide 2)
   (inst + "mapper(s!1,k!1,a!1)")
   (typepred "sort_map(s!1)")
   (hide-all-but (-1 1))
   (expand "bijective?")
   (expand "mapper")
   (ground)
   (("1"
     (expand "injective?")
     (skosimp*)
     (inst - "x1!1" "x2!1")
     (assert))
    ("2"
     (expand "surjective?")
     (skosimp*)
     (inst-cp - "y!1")
     (skosimp*)
     (inst-cp + "x!1")
     (expand "map_set")
     (typepred "y!1")
     (assert))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: ordered_finite_sequences
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (induct "i")
   (("1"
     (skosimp*)
     (assert)
     (use "empty_card[below(k!1)]")
     (("1"
       (assert)
       (expand "empty?")
       (inst - "0")
       (expand "member")
       (assert))
      ("2" (rewrite "finite_below"))))
    ("2"
     (skosimp*)
     (assert)
     (inst - "k!1")
     (assert)
     (case "add(1+j!1,{m: below(k!1) | m <= j!1}) = {m: below(k!1) | m <= 1 + j!1}")
     (("1"
       (replace -1 :dir RL)
       (rewrite "card_add[below(k!1)]")
       (("1" (assert)) ("2" (rewrite "finite_below"))))
      ("2"
       (hide-all-but 1)
       (expand "add")
       (expand "member")
       (decompose-equality)
       (iff)
       (ground))))
    ("3" (skosimp*) (rewrite "finite_below"))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: ordered_finite_sequences
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (induct "i")
   (("1"
     (skosimp*)
     (use "card_below_fullset[k!1]")
     (expand "fullset")
     (assert))
    ("2"
     (skosimp*)
     (inst - "k!1")
     (assert)
     (case "add(j!1,{m: below(k!1) | j!1+1<=m}) = {m: below(k!1) | j!1<=m}")
     (("1"
       (replace -1 :dir RL)
       (rewrite "card_add[below(k!1)]")
       (("1" (assert)) ("2" (hide-all-but 1) (rewrite "finite_below"))))
      ("2"
       (hide-all-but 1)
       (expand "add")
       (expand "member")
       (decompose-equality)
       (iff)
       (ground))))
    ("3" (skosimp*) (rewrite "finite_below"))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: ordered_finite_sequences
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (use "map_subset_lower")
   (assert)
   (use "card_subset[below(k!1)]")
   (("1"
     (assert)
     (rewrite "map_card_eq")
     (("1" (use "card_below_set") (assert))
      ("2" (rewrite "finite_below"))))
    ("2" (rewrite "finite_below"))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: ordered_finite_sequences
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (use "map_subset_upper")
   (assert)
   (use "card_subset[below(k!1)]")
   (("1"
     (assert)
     (rewrite "map_card_eq")
     (("1" (use "card_above_set") (assert))
      ("2" (rewrite "finite_below"))))
    ("2" (rewrite "finite_below"))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: ordered_finite_sequences
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (lemma "pigeonhole[below(k!1)]")
   (inst - "lower(s2!1, k!1, i!1)" "upper(s1!1, k!1, i!1)")
   (assert)
   (prop)
   (("1" (expand "lower") (expand "upper") (propax))
    ("2"
     (hide 2)
     (use "card_lower")
     (use "card_upper")
     (assert)
     (invoke (then (case "%1 <= %2") (assert)) (! 1 r) (! -1 l 1))
     (hide-all-but 1)
     (use "card_below[k!1]"))))


proof_type: t_proof
decl_type: tcc
library: fault_tolerance
theory: ordered_finite_sequences
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (expand "^")
   (expand "min")
   (skosimp*)
   (lift-if)
   (assert)
   (assert)
   (ground)
   (postpone))


proof_type: j_proof
decl_type: tcc
library: fault_tolerance
theory: ordered_finite_sequences
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp* t)
   (typepred "x!1(x1!1)")
   (expand "in?")
   (skosimp*)
   (replace*)
   (use "min_seq_lem")
   (use "max_seq_lem")
   (assert))


proof_type: t_proof
decl_type: tcc
library: fault_tolerance
theory: ordered_finite_sequences
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (use "finite_below[k!1]")
   (("1" (assert) (skosimp*) (assert)) ("2" (skosimp*) (assert))))


proof_type: t_proof
decl_type: tcc
library: fault_tolerance
theory: ordered_finite_sequences
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (use "finite_below[k!1]")
   (("1" (skosimp*) (assert)) ("2" (skosimp*) (assert))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: real_finite_sequences
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (expand "similar?")
   (flatten)
   (assert)
   (skosimp*)
   (lemma "sort_overlap")
   (inst?)
   (assert)
   (inst - "s2!1")
   (inst?)
   (("1" (skosimp*) (inst?) (assert))
    ("2" (assert) (typepred "i!1") (assert))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: real_finite_sequences
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp* t)
   (use "max_seq_in?")
   (expand "in?")
   (skosimp*)
   (replace -1 :hide? t)
   (expand "sum")
   (lemma "sigma_middle[below(s!1`length)]")
   (("1"
     (inst?)
     (assert)
     (inst?)
     (replace -1 :hide? t)
     (move-terms 1 r 1)
     (assert)
     (lemma "sigma_le[below(s!1`length)]")
     (inst-cp - "(lambda (i: below(s!1`length)): min(s!1))" "s!1"
      "ii!1 - 1" 0)
     (use "sigma_const[below(s!1`length)]")
     (replace -1 :hide? t)
     (inst - "(lambda (i: below(s!1`length)): min(s!1))" "s!1"
      "s!1`length - 1" "ii!1 + 1")
     (("1"
       (expand "finseq_appl")
       (use "sigma_const[below(s!1`length)]")
       (replace -1 :hide? t)
       (assert)
       (split -1)
       (("1"
         (split -2)
         (("1" (lift-if) (ground)) ("2" (skosimp*) (use "min_seq_lem"))))
        ("2" (skosimp*) (use "min_seq_lem"))))
      ("2" (flatten) (inst + "ii!1") (assert))))
    ("2" (skosimp*) (assert))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: real_finite_sequences
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp* t)
   (use "min_seq_in?")
   (expand "in?")
   (skosimp*)
   (replace -1 :hide? t)
   (expand "sum")
   (lemma "sigma_middle[below(s!1`length)]")
   (("1"
     (inst?)
     (assert)
     (inst?)
     (replace -1 :hide? t)
     (move-terms 1 r 1)
     (assert)
     (lemma "sigma_le[below(s!1`length)]")
     (inst-cp - "s!1`seq" "(lambda (i: below(s!1`length)): max(s!1))"
      "ii!1 - 1" 0)
     (use "sigma_const[below(s!1`length)]")
     (replace -1 :hide? t)
     (inst - "s!1`seq" "(lambda (i: below(s!1`length)): max(s!1))"
      "s!1`length - 1" "ii!1 + 1")
     (("1"
       (assert)
       (use "sigma_const[below(s!1`length)]")
       (replace -1 :hide? t)
       (assert)
       (split -1)
       (("1"
         (split -2)
         (("1" (lift-if) (ground)) ("2" (skosimp*) (use "max_seq_lem"))))
        ("2" (skosimp*) (use "max_seq_lem"))))
      ("2" (flatten) (inst + "ii!1") (assert))))
    ("2" (skosimp*) (assert))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: real_finite_sequences
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp* t)
   (expand "mean")
   (use "sum_lower")
   (cross-mult)
   (mult-by -1 "k!1")
   (mult-by -4 "max(s!1) - min(s!1)" *)
   (assert)
   (prop)
   (use "min_le_max")
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: real_finite_sequences
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp* t)
   (expand "mean")
   (use "sum_upper")
   (cross-mult)
   (mult-by -1 "k!1")
   (mult-by -4 "max(s!1) - min(s!1)" *)
   (use "min_le_max")
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: real_finite_sequences
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (expand "inexact_consensus?")
   (skosimp*)
   (forward-chain "similar_sort")
   (hide -2)
   (expand "similar?")
   (flatten)
   (inst - 0)
   (rewrite "sort_seq_min")
   (rewrite "sort_seq_min"))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: real_finite_sequences
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (expand "inexact_consensus?")
   (skosimp*)
   (forward-chain "similar_sort")
   (expand "similar?")
   (flatten)
   (inst - "s1!1`length -1")
   (rewrite "sort_seq_max")
   (replace*)
   (rewrite "sort_seq_max"))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: real_finite_sequences
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (expand "inexact_consensus?")
   (expand "similar?")
   (expand "choose")
   (skosimp*)
   (replace*)
   (lift-if)
   (assert)
   (prop)
   (("1" (inst?)) ("2" (inst?))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: real_finite_sequences
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (expand "inexact_consensus?")
   (skosimp*)
   (expand "similar?")
   (flatten)
   (expand "mean")
   (replace*)
   (expand "sum")
   (replace*)
   (same-name "sigma[below(s1!1`length)]" "sigma[below(s2!1`length)]")
   (("1"
     (replaces -1)
     (field 1)
     (rewrite "sigma_minus[below(s2!1`length)]")
     (lemma "sigma_bound[below(s2!1`length)]")
     (inst -1 "eps!1"
      "LAMBDA(i: below(s2!1`length)): s1!1`seq(i) - s2!1`seq(i)"
      "s2!1`length-1" "0")
     (("1" (assert) (skosimp*) (inst? -)) ("2" (skosimp*) (assert))))
    ("2" (replace*) (assert)) ("3" (skosimp*) (assert))
    ("4" (skosimp*) (assert))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: real_finite_sequences
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (expand "inexact_consensus?")
   (skosimp*)
   (rewrite "midpoint_def")
   (rewrite "midpoint_def")
   (use "inexact_min")
   (use "inexact_max")
   (expand "inexact_consensus?")
   (inst?)
   (inst?)
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: real_finite_sequences
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (lemma "mean_upper")
   (inst - "k!1" "s1!1")
   (lemma "mean_lower")
   (inst - "k!1" "s2!1")
   (assert)
   (mult-by -5 "(k!1 - 1)")
   (isolate 1 r 1)
   (cross-mult)
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: real_finite_sequences
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (expand "midpoint")
   (rewrite "max_minmax" :dir rl)
   (rewrite "min_minmax" :dir rl)
   (lemma "mean_convergence")
   (inst?)
   (inst - 2)
   (assert)
   (rewrite "min_minmax")
   (rewrite "max_minmax")
   (assert)
   (hide-all-but 1)
   (expand "minmax")
   (expand "list2finseq")
   (expand "length")
   (expand "length")
   (expand "length")
   (propax))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: real_finite_sequences
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (expand "convergent?")
   (skosimp*)
   (lemma "mean_convergence")
   (inst?)
   (inst - "k!1")
   (assert)
   (assert)
   (isolate 1 r 1)
   (isolate -1 r 1)
   (cross-mult)
   (assert)
   (use "mean_le_max")
   (lemma "min_le_mean")
   (inst - "s2!1")
   (mult-by (-1 -2 -6) "i!1")
   (assert))


proof_type: t_proof
decl_type: tcc
library: fault_tolerance
theory: node_functions_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (expand "vec2seq")
   (use "card_empty?[below(S)]")
   (typepred "x1!1`2")
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: fault_assumptions_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (expand "enabled_within?")
   (expand "enabled?")
   (expand "subset?")
   (expand "member")
   (skosimp*)
   (inst?))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: fault_assumptions_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (expand "majority?")
   (expand "simple_majority?")
   (expand "quorum?")
   (expand "quorum?")
   (skosimp*)
   (inst?)
   (flatten)
   (rewrite "card_difference_alt")
   (rewrite "intersection_commutative")
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: fault_assumptions_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (apply-extensionality :hide? t)
   (iff)
   (prop)
   (("1"
     (expand "quorum?")
     (skosimp*)
     (expand "majority?")
     (inst?)
     (expand "quorum?")
     (forward-chain "simple_majority_nonempty[below(S)]")
     (assert)
     (rewrite "card_difference_alt")
     (expand "simple_majority?")
     (rewrite "intersection_commutative")
     (assert)
     (expand "mid")
     (assert))
    ("2" (use "quorum_implies_majority") (assert))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: fault_assumptions_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (expand "quorum?")
   (expand "enabled_within?")
   (skosimp*)
   (inst?)
   (expand "quorum?")
   (expand "enabled_nonempty?")
   (inst?)
   (assert)
   (use "card_difference_alt[below(S)]")
   (assert)
   (rewrite "intersection_subset2")
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: fault_assumptions_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (apply-extensionality :hide? t)
   (iff)
   (prop)
   (("1" (rewrite "enabled_within_quorum"))
    ("2"
     (expand "enabled_within?")
     (expand "subset?")
     (expand "member")
     (skosimp*)
     (expand "quorum?")
     (expand "quorum?")
     (expand "nada")
     (inst?)
     (flatten)
     (rewrite "difference_intersection")
     (use "nonempty_card[below(S)]")
     (assert)
     (expand "nonempty?")
     (hide -2 -4 1)
     (expand "empty?")
     (expand "intersection")
     (expand "complement")
     (expand "member")
     (inst?)
     (assert))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: fault_assumptions_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (expand "quorum?")
   (expand "quorum?")
   (expand "enabled_nonempty?")
   (skosimp*)
   (inst?)
   (flatten))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: fault_assumptions_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (expand "enabled_nonempty?")
   (expand "intersection_majority?")
   (skosimp*)
   (inst?)
   (inst?)
   (expand "intersection_majority?")
   (rewrite "intersection_idempotent")
   (rewrite "union_idempotent")
   (use "majority_nonempty[below(S)]")
   (expand "majority_subset?")
   (rewrite "subset_reflexive")
   (prop))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: fault_assumptions_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (expand "byzantine_intersection_majority?")
   (expand "byzantine_intersection_majority?")
   (expand "enabled_nonempty?")
   (skosimp*)
   (inst?)
   (inst?)
   (rewrite "intersection_associative" :dir rl)
   (rewrite "intersection_idempotent")
   (rewrite "union_idempotent")
   (use "nonempty_card[below(S)]")
   (assert)
   (hide -2)
   (expand "nonempty?")
   (rewrite "intersection_commutative")
   (rewrite "emptyset_is_empty?" -)
   (replace*)
   (rewrite "intersection_empty")
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: fault_assumptions_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (expand "intersection_majority?")
   (expand "intersection_majority?")
   (skosimp*)
   (inst?)
   (invoke (then (case "%1 <= %2") (assert)) (! 1 r) (! -2 r))
   (rewrite "card_subset")
   (hide -2 2 3)
   (expand "enabled_within?")
   (inst-cp - "d2!1")
   (inst - "d1!1")
   (expand "subset?")
   (expand "union")
   (expand "member")
   (skosimp*)
   (inst?)
   (inst?)
   (prop))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: fault_assumptions_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (expand "uniformly_enabled?")
   (decompose-equality 1)
   (iff)
   (expand "enabled_within?")
   (expand "subset?")
   (expand "member")
   (prop)
   (("1" (inst?) (inst - "x!1" "d1!1" "d2!1") (assert))
    ("2" (inst?) (inst - "x!1" "d2!1" "d1!1") (assert))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: inexact_comm_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (split)
   (("1"
     (expand "quorum_lower?")
     (expand "quorum_accuracy?")
     (skosimp*)
     (inst?)
     (assert))
    ("2"
     (expand "quorum_accuracy?")
     (expand "quorum_upper?")
     (skosimp*)
     (inst?)
     (assert))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: inexact_comm_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (split)
   (("1"
     (expand "majority_lower?")
     (expand "majority_accuracy?")
     (skosimp*)
     (inst?)
     (assert))
    ("2"
     (expand "majority_accuracy?")
     (expand "majority_upper?")
     (skosimp*)
     (inst?)
     (assert))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: inexact_comm_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (expand "quorum_accuracy?")
   (expand "majority_accuracy?")
   (rewrite "majority"))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: inexact_comm_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (expand "majority_imprecision?")
   (expand "quorum_imprecision?")
   (skosimp*)
   (rewrite "majority"))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: inexact_comm_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (expand "correct_imprecision?")
   (expand "correct_upper_inaccuracy?")
   (expand "correct_lower_inaccuracy?")
   (skosimp*)
   (inst-cp - "d2!1" "s2!1")
   (inst - "d1!1" "s1!1")
   (inst-cp - "d2!1" "s2!1")
   (inst - "d1!1" "s1!1")
   (prop)
   (expand "abs")
   (lift-if)
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: inexact_comm_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (expand "rcvd_diameter?")
   (expand "correct_imprecision?")
   (expand "diameter?")
   (expand "enabled_within?")
   (expand "subset?")
   (expand "member")
   (skosimp*)
   (inst?)
   (inst - "d2!1" "s2!1")
   (inst - "s1!1" "s2!1")
   (inst-cp - "d1!1" "s1!1")
   (inst - "d2!1" "s2!1")
   (prop)
   (expand "abs")
   (lift-if)
   (ground))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: reduce_properties
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (rewrite "injection_and_cardinal")
   (hide 2)
   (inst + "m(enabled!1)")
   (("1"
     (assert)
     (use "injective_restrict[below(card[below(N)](enabled!1)),
                                                                        (lower[T, <=]
                                                                        (vec2seq(v!1,enabled!1),
                                                                        card[below(N)](enabled!1), i!1)),
                                                                        (enabled!1)]")
     (prop)
     (("1" (expand "injective?") (propax))
      ("2"
       (assert)
       (typepred "m(enabled!1)")
       (expand "bijective?")
       (propax))))
    ("2"
     (skosimp* t)
     (expand "lowset")
     (expand "lower")
     (flatten)
     (expand "vec2seq")
     (propax))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: reduce_properties
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (use "card_lower_leq_lowset")
   (use "card_lower")
   (assert)
   (expand "vec2seq")
   (propax))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: reduce_properties
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (rewrite "injection_and_cardinal")
   (hide 2)
   (inst + "m(enabled!1)")
   (("1"
     (assert)
     (use "injective_restrict[below(card[below(N)](enabled!1)),
                                                                                (upper[T, <=]
                                                                                     (vec2seq(v!1,enabled!1),
                                                                                      card[below(N)](enabled!1), i!1)),
                                                                                (enabled!1)]")
     (prop)
     (("1" (expand "injective?") (propax))
      ("2" (typepred "m(enabled!1)") (expand "bijective?") (flatten))))
    ("2"
     (skosimp* t)
     (expand "upper")
     (expand "highset")
     (flatten)
     (expand "vec2seq")
     (propax))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: reduce_properties
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (use "card_upper_leq_highset")
   (use "card_upper")
   (assert)
   (expand "vec2seq")
   (propax))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: reduce_properties
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (expand "reduce")
   (expand "M")
   (expand "^")
   (skosimp*)
   (lift-if)
   (assert)
   (expand "vec2seq")
   (assert)
   (expand "min")
   (propax))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: reduce_properties
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (rewrite "reduce_rewrite")
   (rewrite "reduce_rewrite")
   (expand "M")
   (lemma "sort_overlap")
   (inst - "card(enabled!1)" "vec2seq(v2!1, enabled!1)"
    "vec2seq(v1!1, enabled!1)")
   (expand "vec2seq")
   (inst?)
   (("1" (skosimp*) (inst?) (assert)) ("2" (assert))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: reduce_properties
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (expand "quorum?")
   (rewrite "min_reduce")
   (lemma "pigeonhole_difference[below(N)]")
   (inst?)
   (assert)
   (inst - "lowset(v!1, enabled!1, tau!1(card(enabled!1)))")
   (assert)
   (prop)
   (("1" (expand "lowset") (skosimp*) (inst?) (prop))
    ("2" (expand* "subset?" "lowset" "member") (skosimp*))
    ("3" (use "card_lowset") (assert))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: reduce_properties
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (expand "quorum?")
   (rewrite "max_reduce")
   (lemma "pigeonhole_difference[below(N)]")
   (inst?)
   (assert)
   (inst -
    "highset(v!1, enabled!1, card(enabled!1) - 1 - tau!1(card(enabled!1)))")
   (assert)
   (prop)
   (("1" (expand "highset") (skosimp*) (inst?) (prop))
    ("2" (expand* "subset?" "member" "highset") (skosimp*))
    ("3" (use "card_highset") (assert))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: reduce_properties
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (use "min_validity")
   (("1"
     (assert)
     (skosimp*)
     (inst?)
     (assert)
     (expand "reduce_choice")
     (expand "quorum?")
     (flatten)
     (assert)
     (lemma "transitive")
     (invoke (inst - "<=" "%1" "%2" "%3") (! 2 l) (! -4 r) (! 2 r))
     (assert))
    ("2" (expand "quorum?") (flatten))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: reduce_properties
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (use "max_validity")
   (("1"
     (assert)
     (skosimp*)
     (inst?)
     (assert)
     (expand "reduce_choice")
     (expand "quorum?")
     (prop)
     (assert)
     (lemma "transitive")
     (invoke (inst - "<=" "%1" "%2" "%3") (! 2 l) (! -4 l) (! 2 r))
     (assert)
     (rewrite "cf_upper"))
    ("2" (assert) (expand "quorum?") (propax))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: reduce_properties
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (expand "reduce_choice")
   (lift-if)
   (assert)
   (prop)
   (rewrite "congruence")
   (rewrite "reduce_agreement"))


proof_type: t_proof
decl_type: tcc
library: fault_tolerance
theory: reduce_properties
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (typepred "enabled!1")
   (use "nonempty_card[below(N)]")
   (expand "nonempty?")
   (propax))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: reduce_choice
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (expand "reduce_choice")
   (expand "reduce_choice")
   (assert)
   (typepred
    "icf!1(reduce(tau!1)(rcvd!1(d!1), enabled(rcvd!1, check!1)(d!1)))")
   (expand "in?")
   (skosimp* t)
   (replace -2 :hide? T)
   (use "reduce_overlap")
   (rewrite "reduce_length[S,T,<=]")
   (assert)
   (skosimp*)
   (inst + "n!1")
   (assert)
   (typepred "<=")
   (expand "total_order?")
   (expand "partial_order?")
   (expand "antisymmetric?")
   (flatten)
   (inst?)
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: reduce_choice
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (expand "reduce_choice")
   (expand "reduce_choice")
   (lift-if)
   (ground)
   (use "reflexive"))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: reduce_choice
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (expand "max_length")
   (typepred "max(image(M(rcvd!1, check!1, tau!1), fullset[below(D)]))")
   (inst?)
   (assert)
   (expand "image")
   (inst?)
   (expand "fullset")
   (propax))


proof_type: t_proof
decl_type: tcc
library: fault_tolerance
theory: reduce_choice
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (use "finite_image[below(D), nat]")
   (("1"
     (assert)
     (expand "empty?")
     (expand "member")
     (inst - "M(rcvd!1, check!1, tau!1)(0)")
     (("1" (assert) (expand "image") (inst?) (expand "fullset") (assert))
      ("2" (assert))))
    ("2" (assert) (rewrite "finite_below[D]"))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: inexact_reduce_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (expand "quorum_lower?")
   (skosimp*)
   (use "quorum_nonempty")
   (assert)
   (expand "quorum?")
   (inst - "d!1")
   (expand "enabled_nonempty?")
   (inst?)
   (expand "correct_lower_inaccuracy?")
   (inst?)
   (expand "reduce_choice")
   (use "choice_lower_validity")
   (assert)
   (skosimp*)
   (inst?)
   (assert)
   (inst?)
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: inexact_reduce_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (expand "quorum_upper?")
   (skosimp*)
   (use "quorum_nonempty")
   (assert)
   (expand "quorum?")
   (inst?)
   (expand "enabled_nonempty?")
   (inst?)
   (expand "reduce_choice")
   (assert)
   (expand "correct_upper_inaccuracy?")
   (inst?)
   (assert)
   (use "choice_upper_validity")
   (assert)
   (skosimp*)
   (inst?)
   (inst?)
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: inexact_reduce_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (forward-chain "quorum_accuracy")
   (use "reduce_lower_validity")
   (use "reduce_upper_validity")
   (assert)
   (skosimp*)
   (expand "diameter?")
   (inst-cp - "s!1" "s!2")
   (inst - "s!3" "s!1")
   (assert)
   (expand "enabled_within?")
   (inst?)
   (expand "subset?")
   (expand "member")
   (inst-cp - "s!2")
   (inst - "s!3")
   (prop)
   (assert)
   (expand "abs")
   (lift-if)
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: inexact_reduce_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (expand "quorum_imprecision?")
   (skosimp*)
   (use "quorum_nonempty")
   (assert)
   (expand "quorum?")
   (inst-cp - "d1!1")
   (inst - "d2!1")
   (expand "enabled_nonempty?")
   (inst-cp - "d1!1")
   (inst - "d2!1")
   (expand "reduce_choice")
   (expand "reduce_choice")
   (assert)
   (use "rcvd_diameter")
   (assert)
   (lemma "min_validity")
   (inst - _ _ _ "rcvd!1(d2!1)")
   (inst?)
   (assert)
   (hide -4)
   (lemma "max_validity")
   (inst - _ _ _ "rcvd!1(d1!1)")
   (inst?)
   (assert)
   (hide -5)
   (skosimp*)
   (expand "rcvd_diameter?")
   (inst - "d1!1" "d2!1" "n!1" "n!2")
   (assert)
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: inexact_reduce_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (expand "overlap?")
   (expand "overlap_imprecision?")
   (skosimp*)
   (expand "reduce_overlap?")
   (expand "reduce_choice")
   (expand "reduce_choice")
   (inst?)
   (inst - "d2!1")
   (skosimp*)
   (lift-if)
   (expand "empty?")
   (expand "member")
   (prop)
   (("1" (inst?))
    ("2"
     (lift-if)
     (prop)
     (("1" (inst?))
      ("2"
       (hide 1 3)
       (expand "single_imprecision?")
       (inst?)
       (inst - "d2!1")
       (assert)
       (assert))))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: inexact_reduce_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (lemma "reduce_agreement_propagation")
   (inst - "max" "min" _ "d1!1" "d2!1" _ _ _ _ _ _)
   (("1"
     (inst?)
     (inst?)
     (assert)
     (expand "quorum_imprecision?")
     (skosimp*)
     (forward-chain "quorum_nonempty")
     (forward-chain "convergence_overlap")
     (expand "overlap?")
     (inst - "d1!1" "d2!1")
     (expand "enabled_nonempty?")
     (inst-cp - "d1!1")
     (inst - "d2!1")
     (expand "reduce_choice")
     (expand "reduce_choice")
     (assert)
     (hide -3 -4 -5 -6 -7 1 2)
     (expand "convergent?")
     (inst?)
     (assert)
     (hide-all-but 1)
     (rewrite "reduce_length[S,real,<=]")
     (lemma "max_length_bound")
     (inst?)
     (inst-cp - "d1!1")
     (inst - "d2!1")
     (expand "M" -)
     (assert)
     (rewrite "reduce_length[S,real,<=]"))
    ("2" (skosimp*) (rewrite "min_le_max"))
    ("3" (assert) (skosimp*) (assert) (rewrite "min_le_max"))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: inexact_reduce_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (expand "all_symmetric?")
   (skosimp*)
   (lemma "enabled_agree")
   (inst?)
   (inst - "d1!1" "d2!1")
   (prop)
   (expand "reduce_choice")
   (expand "reduce_choice")
   (assert)
   (replace*)
   (assert)
   (lift-if)
   (assert)
   (prop)
   (expand "inexact_consensus?")
   (inst?)
   (assert)
   (hide 2)
   (expand "similar?")
   (prop)
   (("1"
     (rewrite "reduce_length[S,real,<=]")
     (rewrite "reduce_length[S,real,<=]"))
    ("2"
     (skosimp*)
     (lemma "reduce_overlap")
     (inst - "enabled(rcvd!1, check!1)(d2!1)" "i!1" "tau!1"
      "rcvd!1(d2!1)" "rcvd!1(d1!1)")
     (assert)
     (prop)
     (("1"
       (skosimp*)
       (expand "single_imprecision?")
       (inst - "d1!1" "d2!1" "n!1")
       (assert)
       (expand "enabled_within?")
       (expand "subset?")
       (expand "member")
       (inst?)
       (assert)
       (assert)
       (expand "abs")
       (assert))
      ("2"
       (typepred "i!1")
       (assert)
       (rewrite "reduce_length[S,real,<=]"))))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: inexact_reduce_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (use "v_min_witness[D, real, <=]")
   (skosimp*)
   (replace -2 :hide? t)
   (use "reduce_lower_validity")
   (assert)
   (skosimp*)
   (use "v_min_is_min[S, real, <=]")
   (expand* "enabled_within?" "subset?" "member")
   (inst?)
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: inexact_reduce_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (use "v_max_witness[D, real, <=]")
   (skosimp*)
   (replace -2 :hide? t)
   (use "reduce_upper_validity")
   (assert)
   (skosimp*)
   (lemma "v_max_is_max[S, real, <=]")
   (inst - "s!1" "src_set!1" "sent!1")
   (assert)
   (expand* "enabled_within?" "subset?" "member")
   (inst?)
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: inexact_reduce_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (expand "diameter?")
   (skosimp*)
   (lemma "v_min_is_min[S, real, <=]")
   (inst?)
   (inst-cp - "s2!1")
   (inst - "s1!1")
   (lemma "v_max_is_max[S, real, <=]")
   (inst - _ "src_set!1" "sent!1")
   (inst-cp - "s1!1")
   (inst - "s2!1")
   (assert)
   (expand "abs")
   (lift-if)
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: inexact_reduce_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (use "v_min_witness[D, real, <=]")
   (use "v_max_witness[D, real, <=]")
   (skosimp*)
   (replace*)
   (hide -4 -2)
   (use "reduce_agreement_propagation")
   (assert)
   (rewrite "minmax_diameter"))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: inexact_reduce_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (use "v_max_witness[D, real, <=]")
   (use "v_min_witness[D, real, <=]")
   (skosimp*)
   (replace*)
   (hide -4 -2)
   (use "reduce_agreement_generation")
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: inexact_reduce_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (use "v_min_witness[D, real, <=]")
   (use "v_max_witness[D, real, <=]")
   (skosimp*)
   (replace*)
   (hide -4 -2)
   (use "reduce_convergence")
   (ground)
   (rewrite "minmax_diameter"))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: weber_overlap
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (expand "intersection_majority?")
   (use "card_intersection_le[below(N)]")
   (flatten)
   (rewrite "min_reduce")
   (rewrite "max_reduce")
   (lemma "pigeonhole[below(N)]")
   (inst - "highset(v1!1, e1!1, tau(src_set!1)(card(e1!1)))"
    "lowset(v2!1, e2!1, card(e2!1) - 1 - tau(src_set!1)(card(e2!1)))")
   (prop)
   (("1"
     (expand* "highset" "lowset" "subset?" "member")
     (skosimp*)
     (inst? +)
     (inst?)
     (prop))
    ("2"
     (hide 2)
     (use "card_highset")
     (use "card_lowset")
     (expand* "tau" "weber")
     (lemma "card_subset[below(N)]")
     (inst-cp - "e2!1" "src_set!1")
     (inst - "e1!1" "src_set!1")
     (assert)
     (assert)
     (invoke (then (case "%1 <= %2") (assert)) (! 1 r) (! -1 r))
     (rewrite "card_subset")
     (hide-all-but (-7 -8 1))
     (expand* "subset?" "union" "member" "highset" "lowset")
     (skosimp*)
     (inst?)
     (inst?)
     (prop))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: weber_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (forward-chain "intersection_majority")
   (forward-chain "intersection_majority_nonempty")
   (expand "overlap_imprecision?")
   (inst?)
   (assert)
   (expand "reduce_overlap?")
   (skosimp*)
   (hide -2)
   (expand "intersection_majority?")
   (inst?)
   (inst - "d2!1")
   (expand "enabled_nonempty?")
   (inst-cp - "d2!1")
   (inst - "d1!1")
   (expand "enabled_within?")
   (inst-cp - "d2!1")
   (inst - "d1!1")
   (lemma "weber_overlap")
   (inst?)
   (assert)
   (inst?)
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: weber_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (forward-chain "overlap_imprecision")
   (lemma "convergence")
   (inst?)
   (inst?)
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: weber_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (use "weber_convergence")
   (prop)
   (replace -1 :dir rl :hide? t)
   (use "convergent_mean")
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: weber_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (lemma "weber_convergence")
   (inst?)
   (inst?)
   (inst - "2" "delta!1")
   (rewrite "convergent_midpoint")
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: pigeonhole_int
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (expand "disjoint?")
   (expand "empty?")
   (expand "intersection")
   (expand "member")
   (skosimp* t)
   (inst?)
   (inst?)
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: pigeonhole_int
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (expand "mirror")
   (expand "image")
   (expand "image")
   (expand "complement")
   (skosimp*)
   (decompose-equality)
   (iff)
   (prop)
   (("1" (skosimp* t) (expand "complement") (assert))
    ("2"
     (inst + "complement(x!1)")
     (("1" (expand "complement") (propax)) ("2" (inst?))))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: pigeonhole_int
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (use "mirror_mirror")
   (expand "mirror")
   (expand "image")
   (lemma "card_image[int, int]")
   (inst-cp - "complement" "image(complement, X!1)")
   (inst - "complement" "X!1")
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: pigeonhole_int
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (expand "subset?")
   (expand "split")
   (expand "intersection")
   (expand "union")
   (expand "mirror")
   (expand "difference")
   (expand "member")
   (skosimp*)
   (split -)
   (("1" (inst?) (flatten) (assert))
    ("2"
     (expand "image")
     (expand "image")
     (skosimp* t)
     (inst? +)
     (inst?)
     (assert))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: pigeonhole_int
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (expand "split")
   (rewrite "card_disj_union")
   (("1"
     (rewrite "card_mirror")
     (lemma "card_disj_union[int]")
     (invoke (inst - "%1" "%2") (! 1 l 2 1) (! 1 l 1 1))
     (assert)
     (prop)
     (("1"
       (replace -1 :dir rl)
       (hide -1)
       (rewrite "congruence")
       (hide 2)
       (decompose-equality)
       (iff)
       (grind))
      ("2"
       (hide 2)
       (expand "disjoint?")
       (expand "empty?")
       (expand "intersection")
       (expand "difference")
       (expand "member")
       (skosimp*))))
    ("2"
     (hide 2)
     (rewrite "disjoint1")
     (("1"
       (hide 2)
       (expand "mirror")
       (expand "difference")
       (expand "member")
       (expand "image")
       (expand "image")
       (skosimp* t)
       (typepred "A!1")
       (inst?)
       (expand "complement")
       (assert))
      ("2"
       (hide 2)
       (expand "intersection")
       (expand "member")
       (skosimp*)
       (assert)
       (typepred " A!1")
       (inst?)
       (assert))))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: pigeonhole_int
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (expand "two_thirds_majority_subset?")
   (skosimp*)
   (use "subset_split")
   (assert)
   (hide -1 -3)
   (rewrite "card_split")
   (rewrite "card_split"))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: pigeonhole_int
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (forward-chain "two_thirds_overlap_pigeonhole")
   (hide -2 -3 -4)
   (skosimp*)
   (expand "split")
   (expand "union")
   (expand "intersection")
   (expand "member")
   (prop)
   (("1" (inst?) (assert))
    ("2"
     (hide 1)
     (expand "mirror")
     (expand "image")
     (expand "image")
     (skosimp* t)
     (expand "difference")
     (expand "member")
     (flatten)
     (typepred "A!1")
     (inst?)
     (typepred "B!1")
     (inst - "x!2")
     (assert)
     (expand "complement")
     (assert))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: pigeonhole_int
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (lemma "two_thirds_overlap_lem")
   (inst?)
   (inst - "S1!1" "S2!1")
   (assert)
   (rewrite "two_thirds_split")
   (prop)
   (hide -1 -2 2)
   (expand "byzantine_intersection_majority?")
   (expand "intersection_majority?")
   (expand "split")
   (rewrite "distribute_intersection_union")
   (rewrite "card_disj_union")
   (("1"
     (lemma "disjoint1")
     (expand "disjoint?")
     (inst?)
     (("1"
       (use "empty_card[int]")
       (assert)
       (replace -1)
       (assert)
       (hide -1 -2)
       (invoke (then (case "%1 <= %2") (assert) (hide -1 2)) (! 1 r)
        (! -1 r))
       (rewrite "union_associative" :dir rl)
       (rewrite "card_disj_union")
       (("1"
         (rewrite "card_mirror")
         (isolate 1 l 2)
         (assert)
         (rewrite "card_subset")
         (hide 2)
         (expand "subset?")
         (expand "intersection")
         (expand "union")
         (expand "member")
         (skosimp*)
         (prop))
        ("2"
         (hide 2)
         (rewrite "disjoint1")
         (("1"
           (hide 2)
           (expand "difference")
           (expand "member")
           (expand "mirror")
           (expand "image")
           (expand "image")
           (expand "complement")
           (skosimp* t)
           (typepred "S2!1")
           (inst?)
           (assert))
          ("2"
           (hide 2)
           (expand "intersection")
           (expand "union")
           (expand "member")
           (skosimp*)
           (typepred "S1!1")
           (inst?)
           (typepred "S2!1")
           (inst?)
           (prop))))))
      ("2"
       (hide -1 2)
       (expand "difference")
       (expand "member")
       (expand "mirror")
       (expand "image")
       (expand "image")
       (expand "complement")
       (skosimp* t)
       (assert)
       (typepred "S2!1")
       (inst?)
       (assert))))
    ("2"
     (hide -1 2)
     (expand "disjoint?")
     (expand "intersection")
     (expand "empty?")
     (expand "difference")
     (expand "mirror")
     (expand "member")
     (expand "image")
     (expand "image")
     (expand "complement")
     (skosimp* t)
     (assert)
     (typepred "S2!1")
     (inst-cp - "x!2")
     (inst - "x!1")
     (assert))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: middle_third_pigeonhole
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (auto-rewrite-theory "extend_set_props[int, below(N)]")
   (skosimp*)
   (lemma "fta_overlap_pigeonhole")
   (inst - "A!1" "B!1" "C!1" "S1!1" "S2!1")
   (("1"
     (expand "two_thirds_majority_subset?")
     (expand "byzantine_intersection_majority?")
     (ground)
     (skosimp*)
     (expand "extend")
     (inst?)
     (("1" (ground)) ("2" (ground))))
    ("2" (skosimp*) (expand "extend") (assert))
    ("3" (skosimp*) (expand "extend") (assert))
    ("4" (skosimp*) (expand "extend") (assert))
    ("5" (skosimp*) (expand "extend") (assert))
    ("6" (skosimp*) (expand "extend") (assert))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: middle_third_overlap
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (rewrite "min_reduce")
   (rewrite "max_reduce")
   (lemma "middle_third_pigeonhole[N]")
   (inst - "highset(v1!1, e1!1, byz(card(e1!1)))"
    "lowset(v2!1, e2!1, card(e2!1) - 1 - byz(card(e2!1)))" "src_set!1"
    "e1!1" "e2!1")
   (prop)
   (("1" (expand* "highset" "lowset") (skosimp*) (inst?) (prop))
    ("2"
     (use "card_highset")
     (expand* "two_thirds_majority_subset?" "byz")
     (assert)
     (expand* "subset?" "highset" "member")
     (skosimp*))
    ("3"
     (use "card_lowset")
     (expand* "two_thirds_majority_subset?" "byz")
     (assert)
     (expand* "subset?" "lowset" "member")
     (skosimp*))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: middle_third_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (expand "byz_overlap_imprecision?")
   (skosimp*)
   (forward-chain "byzantine_intersection_nonempty")
   (expand "overlap_imprecision?")
   (inst?)
   (assert)
   (expand "reduce_overlap?")
   (skosimp*)
   (expand "enabled_nonempty?")
   (inst-cp - "d2!1")
   (inst - "d1!1")
   (expand "byzantine_intersection_majority?")
   (use "middle_third_overlap")
   (assert)
   (inst?)
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: middle_third_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (use "middle_third_convergence")
   (assert)
   (replace*)
   (rewrite "convergent_mean"))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: middle_third_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (lemma "middle_third_convergence")
   (inst?)
   (inst?)
   (inst - 2 "epsilon!1")
   (rewrite "convergent_midpoint")
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: median_overlap
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
script:
  (""
   (skosimp*)
   (rewrite "min_reduce")
   (rewrite "max_reduce")
   (lemma "median_pigeonhole[below(N)]")
   (inst - "highset(v1!1, e1!1, mid(card(e1!1)))"
    "lowset(v2!1, e2!1, card(e2!1) - 1 - mid(card(e2!1)))" "e1!1" "e2!1")
   (assert)
   (prop)
   (("1" (expand "highset") (expand "lowset") (skosimp*) (inst?) (prop))
    ("2"
     (expand "majority_subset?")
     (use "card_highset")
     (assert)
     (expand* "subset?" "highset" "member")
     (skosimp*))
    ("3"
     (expand "majority_subset?")
     (use "card_lowset")
     (assert)
     (expand* "subset?" "lowset" "member")
     (skosimp*))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: median_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (expand "overlap_imprecision?")
   (expand "all_single_imprecision?")
   (inst?)
   (assert)
   (expand "reduce_overlap?")
   (skosimp*)
   (use "median_overlap")
   (("1"
     (prop)
     (("1" (skosimp*) (inst?) (prop) (expand "enabled?") (inst?))
      ("2" (expand "one_asymmetric_ommission?") (inst?))))
    ("2" (expand "enabled_nonempty?") (inst?))
    ("3" (expand "enabled_nonempty?") (inst?))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: median_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (forward-chain "quorum_imprecision_nonempty")
   (forward-chain "one_asymmetric_overlap")
   (expand "median")
   (lemma "convergence")
   (inst?)
   (inst?)
   (inst - "epsilon!1" 2)
   (rewrite "convergent_midpoint")
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: protocol
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (";;; Proof protocol_rw-1 for formula k_protocol.protocol_rw"
   ";;; developed with shostak decision procedures"
   (skosimp*)
   (expand "protocol")
   (propax))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: inexact_reduce
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (induct "k")
   (("1" (skosimp*) (expand "sigma") (assert))
    ("2"
     (skosimp*)
     (inst?)
     (inst?)
     (inst?)
     (inst - "eps_l!1" _)
     (inst?)
     (assert)
     (prop)
     (("1"
       (rewrite "sigma_last" +)
       (invoke (then (case "%1 - eps_l!1(j!1+j!2) <= %2") (assert))
        (! -1 r) (! 1 r))
       (hide 2 -1)
       (expand "enabled_within?")
       (expand "protocol")
       (expand "quorum_lower?")
       (inst - "j!1 + j!2")
       (inst - "j!1 + j!2")
       (inst - "j!1 + j!2")
       (assert)
       (expand "v_min")
       (expand "reduce_choice")
       (replace -1 :hide? t)
       (lemma
        "reduce_min_validity[N(j!2 + j!1), N(1 + j!1 + j!2), error(j!1 + j!2)]")
       (inst?)
       (assert))
      ("2"
       (hide-all-but (1 -1))
       (expand "protocol")
       (skosimp*)
       (inst?)
       (assert))
      ("3"
       (hide-all-but (1 -2))
       (expand "quorum_lower?")
       (skosimp*)
       (inst?)
       (assert))
      ("4"
       (hide-all-but (1 -3))
       (expand "enabled_within?")
       (skosimp*)
       (inst?)
       (assert))))
    ("3" (hide 2) (skosimp*) (assert))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: inexact_reduce
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (induct "k")
   (("1" (skosimp*) (expand "sigma") (assert))
    ("2"
     (skosimp*)
     (inst?)
     (inst?)
     (inst?)
     (inst - "eps_u!1" "rcvd!1")
     (assert)
     (prop)
     (("1"
       (rewrite "sigma_first" 1)
       (invoke (then (case "%1 <= %2 + eps_u!1(j!2)") (assert))
        (! -1 r 1) (! 1 r 1))
       (hide 2 -1)
       (expand "enabled_within?")
       (expand "quorum_upper?")
       (expand "protocol")
       (inst - "j!2")
       (inst - "j!2")
       (inst - "j!2")
       (assert)
       (expand "v_max")
       (expand "reduce_choice")
       (replace -1 :hide? t)
       (lemma "reduce_max_validity[N(j!2), N(1 + j!2), error(j!2)]")
       (inst?)
       (inst?)
       (inst?)
       (assert))
      ("2"
       (hide-all-but (1 -1))
       (expand "protocol")
       (skosimp*)
       (inst?)
       (assert))
      ("3"
       (hide-all-but (1 -2))
       (expand "quorum_upper?")
       (skosimp*)
       (inst?)
       (assert))
      ("4"
       (hide-all-but (1 -3))
       (expand "enabled_within?")
       (skosimp*)
       (inst?)
       (assert))))
    ("3" (hide 2) (skosimp*) (assert))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: inexact_reduce
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (induct "k")
   (("1" (skosimp*) (expand "sigma") (propax))
    ("2"
     (skosimp*)
     (inst?)
     (inst?)
     (inst?)
     (inst - "epsilon!1" "rcvd!1")
     (assert)
     (prop)
     (("1"
       (hide -5)
       (expand "protocol")
       (expand "enabled_within?")
       (expand "quorum_imprecision?")
       (inst - "j!1 + j!2")
       (inst - "j!1 + j!2")
       (inst - "j!1 + j!2")
       (assert)
       (expand "v_min")
       (expand "v_max")
       (expand "reduce_choice")
       (replace -2 :hide? t)
       (lemma
        "agreement_propagation[N(j!1 + j!2), N(1 + j!1 + j!2), error(j!1 + j!2)]")
       (inst - _ _ _ "delta!1+sigma(j!2,j!1+j!2-1,epsilon!1)" _
        "epsilon!1(j!1+j!2)" _ _ _ _)
       (("1" (inst?) (assert) (inst?) (assert) (rewrite "sigma_last" 1))
        ("2"
         (hide-all-but 1)
         (assert)
         (use "sigma_nonneg[nat]")
         (("1" (skosimp*) (assert)) ("2" (ground)) ("3" (ground))))))
      ("2"
       (hide-all-but (1 -1))
       (expand "protocol")
       (skosimp*)
       (inst?)
       (assert))
      ("3"
       (hide-all-but (1 -2))
       (expand "quorum_imprecision?")
       (skosimp*)
       (inst?)
       (assert))
      ("4"
       (hide-all-but (1 -3))
       (expand "enabled_within?")
       (skosimp*)
       (inst?)
       (assert))))
    ("3" (hide-all-but 1) (skosimp*) (assert))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: inexact_reduce
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
script:
  (""
   (expand "convergent_stage?")
   (skosimp*)
   (lemma "agreement_propagation")
   (inst - _ _ _ _ "j!1" "i!1 - j!1" _ _ _ _)
   (("1"
     (assert)
     (inst?)
     (inst?)
     (inst?)
     (inst?)
     (inst?)
     (ground)
     (("1"
       (hide -9)
       (expand "v_max" -)
       (expand "v_min" -)
       (lemma "convergence[N(i!1), N(i!1 + 1), error(i!1)]")
       (inst?)
       (invoke (inst - "%1" _ _ _ _) (! -2 r))
       (inst?)
       (inst?)
       (inst - "node_set!1(i!1 + 1)")
       (ground)
       (("1"
         (hide -2 -8 -9)
         (lemma "agreement_propagation")
         (inst - _ _ _ _ "i!1 + 1" "j!1 + k!1 - (i!1 + 1)" _ _ _ _)
         (assert)
         (inst?)
         (inst?)
         (inst?)
         (invoke (inst - "%1" "epsilon!1" "rcvd!1") (! -2 r))
         (("1"
           (ground)
           (("1"
             (hide -2)
             (lemma "sigma_middle")
             (inst - "epsilon!1" "j!1 - 1 + k!1" "i!1" "j!1")
             (assert)
             (replace -1 :hide? t)
             (invoke (then (case "%1 <= %2") (assert)) (! -1 r 3)
              (! 1 r 3))
             (hide-all-but 1)
             (case "(X!1 - 1)/X!1 <= 1")
             (("1" (invoke (mult-by -1 "%1") (! 1 r)) (assert))
              ("2" (cross-mult 1))))
            ("2"
             (hide-all-but (-2 1))
             (expand "protocol")
             (skosimp*)
             (inst?)
             (assert))
            ("3"
             (hide-all-but (-3 1))
             (expand "quorum_imprecision?")
             (skosimp*)
             (inst?)
             (assert))
            ("4"
             (hide-all-but (-4 1))
             (expand "enabled_within?")
             (skosimp*)
             (inst?)
             (assert))
            ("5"
             (hide 2)
             (expand "v_max" +)
             (expand "v_min" +)
             (assert)
             (expand "protocol")
             (inst?)
             (expand "reduce_choice" -2)
             (propax))))
          ("2"
           (hide-all-but 1)
           (case "(X!1 - 1) / X!1 >= 0")
           (("1"
             (case "sigma[nat](j!1, i!1 - 1, epsilon!1) >= 0")
             (("1"
               (mult-by -1 "(X!1-1)/X!1")
               (assert)
               (mult-by -2 "delta!1")
               (assert))
              ("2" (hide 2) (assert))))
            ("2" (assert) (hide 2) (cross-mult 1))))))
        ("2"
         (hide-all-but (-3 1))
         (expand "quorum_imprecision?" -)
         (inst?)
         (assert))
        ("3"
         (hide-all-but (-4 1))
         (expand "enabled_within?" -)
         (inst?)
         (assert))))
      ("2"
       (hide-all-but (-1 1))
       (expand "protocol")
       (skosimp*)
       (inst?)
       (assert))
      ("3"
       (hide-all-but (-2 1))
       (expand "quorum_imprecision?")
       (skosimp*)
       (inst?)
       (assert))
      ("4"
       (hide-all-but (-3 1))
       (expand "enabled_within?")
       (skosimp*)
       (inst?)
       (assert))))
    ("2" (assert))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: inexact_reduce
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (expand "exists_all_symmetric?")
   (skosimp*)
   (lemma "agreement_propagation")
   (inst - _ _ "sigma(j!1,i!1,epsilon!1)" "epsilon!1" "1 + i!1"
    "j!1 + k!1 - i!1 - 1" _ _ _ _)
   (("1"
     (inst?)
     (inst?)
     (inst?)
     (assert)
     (prop)
     (("1"
       (hide-all-but (1 -1))
       (lemma "sigma_split")
       (inst - _ "j!1+k!1-1" "j!1" "i!1")
       (inst?)
       (assert))
      ("2"
       (hide-all-but (1 -1))
       (expand "protocol")
       (skosimp*)
       (inst?)
       (assert))
      ("3"
       (hide-all-but (1 -7))
       (expand "enabled_within?")
       (skosimp*)
       (inst?)
       (assert))
      ("4"
       (expand "protocol")
       (inst - "i!1")
       (assert)
       (expand "v_max")
       (expand "v_min")
       (expand "reduce_choice")
       (replace -1 :hide? t)
       (rewrite "sigma_last")
       (lemma "agreement_generation[N(i!1), N(1 + i!1), error(i!1)]")
       (inst - _ _ _ "epsilon!1(i!1)" _ _)
       (inst?)
       (assert)
       (use "sigma_nonneg")
       (assert)
       (skosimp*)
       (assert))))
    ("2" (assert))
    ("3" (use "sigma_nonneg") (assert) (skosimp*) (assert))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: integration_fault_model
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (expand "subset?")
   (expand "member")
   (expand "symmetric_denotation")
   (expand "single_denotation")
   (skosimp*)
   (expand "symmetric_denotation?")
   (expand "single_denotation?")
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: timing_imprecision
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (auto-rewrite-defs)
   (assert)
   (expand "W")
   (lift-if)
   (assert)
   (prop)
   (("1" (use "ceiling_def") (assert))
    ("2" (invoke (then (case "%1 >= %2") (assert)) (! 1 l) (! 1 r)))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: timing_imprecision
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (expand "epsilon_l")
   (expand "epsilon_u")
   (expand "max_latency")
   (expand "drift")
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: timing_imprecision
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (prop)
   (("1" (expand "Timestamp") (use "Clock_upper") (assert))
    ("2"
     (expand "Timestamp")
     (use "Clock_lower")
     (lemma "drift_right")
     (invoke (inst - "%1" "%2" _) (! -2 l 1) (! 1 l 1))
     (inst?)
     (expand "rate")
     (assert))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: timing_imprecision
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (expand* "good_range" "Timestamp")
   (use "Clock_upper")
   (flatten)
   (invoke (then (case "%1 <= %2") (assert)) (! 1 l) (! -2 l))
   (hide-all-but 1)
   (isolate 1 l 1)
   (move-terms 1 r 1)
   (expand "epsilon_l")
   (lemma "drift_right")
   (inst?)
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: timing_imprecision
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (expand* "good_range" "Timestamp")
   (use "Clock_lower")
   (flatten)
   (lemma "drift_right")
   (invoke (inst - "%1" "%2" _) (! -2 l 1) (! 1 l 1))
   (inst?)
   (assert)
   (invoke (then (case "%1 + %2 <= %3") (assert)) (! -4 r) (! -1 r)
    (! 1 r))
   (hide-all-but 1)
   (isolate 1 r 1)
   (move-terms 1 l 1)
   (expand* "epsilon_u" "max_latency" "epsilon" "rate")
   (lemma "drift_left")
   (inst?)
   (expand* "epsilon_u" "max_latency" "epsilon" "rate"))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: timing_imprecision
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (use "link_lower_range")
   (use "link_upper_range")
   (expand "max_error")
   (expand "abs")
   (lift-if)
   (ground))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: timing_imprecision
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (lemma "event_observation_error")
   (inst-cp - "c2!1" "ev2r!1")
   (inst - "c1!1" "ev1r!1")
   (expand "good_range")
   (flatten)
   (rewrite "abs_max")
   (rewrite "max_le")
   (expand "epsilon")
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: timing_imprecision
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (expand "good_range")
   (flatten)
   (rewrite "abs_max")
   (rewrite "max_le")
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: timing_imprecision
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (rewrite "abs_max")
   (rewrite "max_le")
   (rewrite "abs_max")
   (rewrite "max_le")
   (lemma "event_observation_error")
   (inst-cp - "c1!1" "ev1!1")
   (inst - "c2!1" "ev2!1")
   (expand "epsilon")
   (flatten)
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: timing_window
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (rewrite "abs_max")
   (rewrite "max_le")
   (expand "timing_conforms?")
   (prop)
   (("1"
     (lemma "clock_increasing")
     (inst - "Timestamp(c!1, ev!1)" "T!1 - Delta_max(skew!1)" "c!1")
     (assert))
    ("2"
     (lemma "clock_increasing")
     (inst - "Delta_max(skew!1) + T!1" "Timestamp(c!1, ev!1)" "c!1")
     (assert))
    ("3" (rewrite "clock_nondecreasing"))
    ("4" (rewrite "clock_nondecreasing"))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: timing_window
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (rewrite "timing_conforms_def")
   (expand "Delta_max")
   (rewrite "le_floor_r")
   (factor 1 r)
   (div-by 1 "rate")
   (use "link_abs_bound")
   (assert)
   (use "abs_drift_lb")
   (lemma "triangle")
   (invoke (inst - "%1" "%2") (! -3 l 1) (! -5 l 1))
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: timing_integration_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (inst + "lambda d: t_min(c_dst!1, T!1 - Delta_max(pi!1) - 2)")
   (expand "uniformly_outer_window?")
   (skosimp*)
   (expand "outer_window?")
   (expand "timing_conforms?")
   (flatten)
   (expand "t_min")
   (hide -2)
   (forward-chain "clock_nondecreasing_alt")
   (hide -2)
   (expand "Timestamp")
   (typepred
    "min(image(t_of(c_dst!1, T!1 - 2 - Delta_max(pi!1)),
                              fullset[below(D)]))")
   (hide -1)
   (inst - "t_of(c_dst!1, T!1 - 2 - Delta_max(pi!1))(d!1)")
   (prop)
   (("1"
     (rewrite "t_of")
     (lemma "Clock_nondecreasing")
     (inst?)
     (invoke (inst - "%1") (! -2 r))
     (assert)
     (rewrite "Clock_rewrite")
     (assert))
    ("2" (expand "image") (inst?) (expand "fullset") (propax))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: timing_integration_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (expand "symmetric_timing_conforms?")
   (expand "uniformly_inner_window?")
   (expand "uniformly_outer_window?")
   (prop)
   (("1"
     (expand "inner_window?")
     (expand "outer_window?")
     (skosimp*)
     (inst?)
     (assert)
     (inst?))
    ("2" (expand "inner_window?") (skosimp*) (assert) (hide -2) (inst?))
    ("3"
     (expand "outer_window?")
     (expand "inner_window?")
     (skosimp*)
     (inst?))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: timing_integration_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (expand "uniformly_outer_window?")
   (expand "single_denotation_timing?")
   (skosimp*)
   (inst?)
   (expand "inner_window?")
   (expand "outer_window?")
   (propax))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: timing_integration_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (expand "single_denotation_timing?")
   (skosimp*)
   (typepred "tsym_send(c_dst!1, T!1, pi!1, s!1)")
   (expand "union")
   (expand "member")
   (expand "intersection")
   (expand "member")
   (expand "single_denotation_timing?")
   (prop)
   (("1" (inst?) (prop))
    ("2"
     (expand "uniformly_outer_window?")
     (inst?)
     (expand "outer_window?")
     (expand "inner_window?")
     (propax))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: timing_integration_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (expand "enabled_within?")
   (expand "subset?")
   (expand "enabled")
   (expand "member")
   (expand "check")
   (skosimp*))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: timing_integration_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (expand "correct_denotation?")
   (prop)
   (("1" (assert) (expand "send") (propax))
    ("2"
     (assert)
     (expand "send")
     (invoke (typepred "%1") (! 1 1 0))
     (expand* "union" "member" "uniformly_good_range?"
      "uniformly_outer_window?")
     (prop)
     (("1" (inst?)) ("2" (inst?))))
    ("3"
     (assert)
     (expand "send")
     (invoke (typepred "%1") (! 1 1))
     (expand* "union" "member")
     (prop))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: timing_integration_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (expand "clock_relation?")
   (inst - "s!1" "d!1")
   (use "correct_denotation_send")
   (expand "correct_denotation")
   (assert)
   (hide 1)
   (expand* "enabled" "check" "received" "outer_window?")
   (prop))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: timing_integration_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (expand "single_denotation_timing?")
   (expand "transpose")
   (skosimp*)
   (expand "single_denotation?")
   (expand "send")
   (lift-if)
   (assert)
   (prop)
   (("1"
     (typepred "good_send(c_src!1, T!1, s!1)(d1!1)")
     (typepred "good_send(c_src!1, T!1, s!1)(d2!1)")
     (expand "good_range")
     (flatten)
     (assert)
     (expand "abs")
     (lift-if)
     (assert))
    ("2"
     (typepred "osym_send(c_src!1, c_dst!1, T!1, pi!1, s!1)")
     (expand "union")
     (expand "member")
     (prop)
     (("1"
       (expand "uniformly_good_range?")
       (inst-cp - "d2!1")
       (inst - "d1!1")
       (expand "good_range")
       (flatten)
       (assert)
       (expand "abs")
       (assert)
       (lift-if)
       (assert))
      ("2"
       (expand "uniformly_outer_window?")
       (expand "inner_window?")
       (expand "outer_window?")
       (inst?))))
    ("3"
     (typepred "oasym_send(c_src!1, c_dst!1, T!1, pi!1, s!1, d1!1)")
     (typepred "oasym_send(c_src!1, c_dst!1, T!1, pi!1, s!1, d2!1)")
     (expand "union")
     (expand "member")
     (split -1)
     (("1"
       (split -)
       (("1"
         (expand "good_range")
         (flatten)
         (expand "abs")
         (lift-if)
         (assert))
        ("2"
         (expand "outer_window?")
         (expand "inner_window?")
         (propax))))
      ("2" (expand "outer_window?") (expand "inner_window?") (propax))))
    ("4"
     (typepred "tsym_send(c_dst!1, T!1, pi!1, s!1)")
     (expand "union")
     (expand "intersection")
     (expand "member")
     (prop)
     (("1" (expand "single_denotation_timing?") (inst?) (prop))
      ("2"
       (expand "uniformly_outer_window?")
       (expand "inner_window?")
       (expand "outer_window?")
       (inst?))))
    ("5"
     (typepred "sv_send(c_dst!1, T!1, pi!1, s!1)")
     (expand "single_denotation_timing?")
     (inst?)
     (assert))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: timing_integration_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (rewrite "single_denotation_send")
   (expand "single_denotation?")
   (expand "symmetric_denotation?")
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: timing_integration_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (rewrite "symmetric_timing_uniform")
   (expand "transpose")
   (assert)
   (flatten)
   (expand "uniformly_outer_window?")
   (expand "uniformly_inner_window?")
   (skosimp*)
   (expand "symmetric_denotation?")
   (prop)
   (("1"
     (expand "send")
     (assert)
     (typepred "good_send(c_src!1, T!1, s!1)(d!1)")
     (use "good_range_inner_window")
     (assert)
     (expand "clock_relation?")
     (inst?))
    ("2"
     (expand "send")
     (assert)
     (typepred "osym_send(c_src!1, c_dst!1, T!1, pi!1, s!1)")
     (expand "union")
     (expand "member")
     (expand "uniformly_outer_window?")
     (prop)
     (("1"
       (expand "uniformly_good_range?")
       (inst?)
       (use "good_range_inner_window")
       (assert)
       (expand "clock_relation?")
       (inst?))
      ("2" (inst?))))
    ("3"
     (expand "send")
     (assert)
     (typepred "tsym_send(c_dst!1, T!1, pi!1, s!1)")
     (expand "intersection")
     (expand "union")
     (expand "member")
     (prop)
     (("1" (expand "uniformly_inner_window?") (inst?))
      ("2" (expand "uniformly_outer_window?") (inst?))))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: timing_integration_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (expand "correct_lower_inaccuracy?")
   (skosimp*)
   (forward-chain "conforming_correct_denotation_send")
   (hide -4)
   (expand* "nominal" "received")
   (rewrite "link_lower_range"))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: timing_integration_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (expand "quorum_lower?")
   (assert)
   (inst?)
   (assert)
   (use "correct_lower_timing")
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: timing_integration_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (expand "majority_lower?")
   (assert)
   (inst?)
   (assert)
   (use "correct_lower_timing")
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: timing_integration_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (expand "correct_upper_inaccuracy?")
   (skosimp*)
   (forward-chain "conforming_correct_denotation_send")
   (hide -4)
   (expand* "nominal" "received")
   (rewrite "link_upper_range"))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: timing_integration_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (expand "majority_upper?")
   (inst?)
   (assert)
   (use "correct_lower_timing")
   (assert)
   (use "correct_upper_timing")
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: timing_integration_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (expand "quorum_upper?")
   (inst?)
   (assert)
   (use "correct_upper_timing")
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: timing_integration_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (expand "majority_accuracy?")
   (inst?)
   (assert)
   (use "correct_lower_timing")
   (assert)
   (use "correct_upper_timing")
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: timing_integration_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (expand "correct_imprecision?")
   (skosimp*)
   (expand* "received" "sent")
   (lemma "link_relative_range")
   (inst - "c_dst!1(d1!1)" "c_dst!1(d2!1)" "c_src!1(s1!1)(T!1 - W)" _
    "c_src!1(s2!1)(T!1 - W)" _)
   (inst?)
   (assert)
   (hide 2)
   (split)
   (("1"
     (hide -2 -3)
     (use "conforming_correct_denotation_send")
     (assert)
     (expand "received")
     (assert))
    ("2"
     (hide -4 -5)
     (use "conforming_correct_denotation_send")
     (assert)
     (expand "received")
     (assert))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: timing_integration_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (expand "quorum_imprecision?")
   (skosimp*)
   (inst?)
   (assert)
   (use "correct_imprecision_timing")
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: timing_integration_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (expand "majority_imprecision?")
   (skosimp*)
   (inst?)
   (assert)
   (use "correct_imprecision_timing")
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: timing_integration_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (expand "single_imprecision?")
   (expand "enabled")
   (expand "check")
   (skosimp*)
   (expand "received")
   (rewrite "link_symmetry")
   (hide 2)
   (expand "single_denotation")
   (forward-chain "single_denotation_send")
   (expand "single_denotation_timing?")
   (expand "transpose")
   (expand "inner_window?")
   (inst?)
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: timing_integration_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (expand "uniformly_enabled?")
   (expand "enabled")
   (expand "check")
   (skosimp*)
   (expand "symmetric_denotation")
   (forward-chain "symmetric_timing_conforms")
   (expand "symmetric_timing_conforms?")
   (expand "inner_window?")
   (expand "received")
   (inst - "d1!1" "d2!1")
   (expand "transpose")
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: timing_integration_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (use "single_imprecision_timing")
   (assert)
   (use "symmetric_single_denotation")
   (expand "single_imprecision?")
   (skosimp*)
   (inst?)
   (assert)
   (expand "subset?")
   (expand "member")
   (inst?)
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: timing_integration_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (expand "all_symmetric?")
   (inst?)
   (assert)
   (use "uniformly_enabled")
   (assert)
   (use "symmetric_imprecision_timing")
   (assert))


proof_type: t_proof
decl_type: tcc
library: fault_tolerance
theory: timing_integration_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (rewrite "finite_image")
   (("1"
     (expand "empty?")
     (expand "member")
     (expand "image")
     (rewrite "forall_not")
     (inst + "t_of(c_dst!1, T!1)(0)")
     (("1" (inst?) (expand "fullset") (assert)) ("2" (assert))))
    ("2" (rewrite "finite_below"))))


proof_type: t_proof
decl_type: tcc
library: fault_tolerance
theory: timing_integration_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (inst + "LAMBDA (c_src, T, s): LAMBDA d: c_src(s)(T-W) + min_latency")
   (skosimp*)
   (expand "good_range")
   (assert))


proof_type: t_proof
decl_type: tcc
library: fault_tolerance
theory: timing_integration_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (inst +
    "LAMBDA (c_src, c_dst, T, pi, s): lambda d: c_src(s)(T-W) + min_latency")
   (skosimp*)
   (expand* "union" "member" "uniformly_good_range?")
   (skosimp*)
   (assert)
   (expand "good_range")
   (assert))


proof_type: t_proof
decl_type: tcc
library: fault_tolerance
theory: timing_integration_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (inst +
    "LAMBDA (c_src, c_dst, T, pi, s, d): c_src(s)(T-W) + min_latency")
   (skosimp*)
   (expand* "union" "member" "good_range")
   (assert)
   (flatten)
   (assert))


proof_type: t_proof
decl_type: tcc
library: fault_tolerance
theory: timing_integration_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (inst +
    "lambda c_dst, T, pi, s: choose({f | uniformly_outer_window?(c_dst, T, pi)(f)})")
   (("1"
     (skosimp*)
     (expand "union")
     (expand "intersection")
     (expand "member")
     (propax))
    ("2"
     (skosimp*)
     (expand "nonempty?")
     (expand "empty?")
     (expand "member")
     (rewrite "forall_not")
     (use "uniformly_outer_exists"))))


proof_type: t_proof
decl_type: tcc
library: fault_tolerance
theory: timing_integration_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (inst +
    "lambda c_dst, T, pi, s: choose({f | uniformly_outer_window?(c_dst, T, pi)(f)})")
   (("1"
     (skosimp*)
     (use "uniformly_outer_single_denotation")
     (("1" (assert))
      ("2"
       (expand "nonempty?")
       (expand "empty?")
       (expand "member")
       (rewrite "forall_not")
       (use "uniformly_outer_exists"))))
    ("2"
     (skosimp*)
     (expand "nonempty?")
     (expand "empty?")
     (expand "member")
     (rewrite "forall_not")
     (use "uniformly_outer_exists"))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: clock_shift
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (expand "offset")
   (expand "clock_edge?")
   (skosimp*)
   (replace -1 :hide? t)
   (rewrite "Clock_rewrite")
   (use "drift_left")
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: clock_shift
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (expand "offset")
   (use "Clock_upper")
   (lemma "drift_right_nat")
   (inst?)
   (lemma "drift_left_nat")
   (inst - _ "X!1" "c!1(n!1)")
   (inst?)
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: clock_shift
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (expand "offset")
   (expand "clock_edge?")
   (skosimp*)
   (replace -1 :hide? t)
   (rewrite "Clock_rewrite")
   (use "drift_right")
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: clock_shift
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (expand "offset")
   (use "Clock_lower")
   (lemma "drift_right")
   (invoke (inst - "%1" "%2" "c!1(n!1)") (! -2 l 1) (! 1 l 1 1))
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: clock_shift
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (apply-extensionality :hide? t)
   (expand "all_clock_edge?")
   (inst?)
   (expand "clock_edge?")
   (skosimp*)
   (expand "offset")
   (replace -1 :hide? t)
   (rewrite "Clock_rewrite"))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: clock_shift
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (expand "offset")
   (use "relative_drift")
   (assert)
   (move-terms 1 r 3)
   (move-terms -1 r 3)
   (invoke (then (case "%1 < %2") (assert) (hide -1 2)) (! -1 r) (! 1 r))
   (use "Clock_lower")
   (lemma "Clock_upper")
   (inst - "c!1(n1!1)" "local_event!1(n1!1)")
   (use "drift_right_nat")
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: clock_shift
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (expand "offset")
   (rewrite "clock_nondecreasing")
   (isolate 1 r 1)
   (assert)
   (rewrite "Clock_nondecreasing"))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: clock_shift
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (expand "offset")
   (expand "clock_edge?")
   (skosimp*)
   (replace*)
   (hide -1 -2)
   (rewrite "Clock_rewrite")
   (rewrite "Clock_rewrite")
   (use "relative_drift")
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: clock_shift
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (apply-extensionality :hide? t)
   (expand "offset")
   (assert)
   (rewrite "Clock_rewrite")
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: clock_shift
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (prop)
   (("1"
     (lemma "congruence[below(N), real]")
     (inst?)
     (apply-extensionality :hide? t)
     (inst - "x!1" "x!1")
     (hide -2)
     (expand "offset")
     (expand "same_edges?")
     (inst?)
     (expand "offset_clocks?")
     (skosimp*)
     (invoke (inst-cp - "%1") (! -1 l 1))
     (invoke (inst - "%1") (! 1 l 1))
     (replace*)
     (hide -1 -2)
     (assert)
     (forward-chain "clock_eq_arg")
     (assert))
    ("2"
     (lemma "double_offset")
     (inst-cp - "T1!1" "T2!1" "c1!1" "le1!1")
     (inst - "T1!1" "T2!1" "c2!1" "le2!1")
     (assert)
     (replace -1 :dir rl :hide? t)
     (replace -1 :dir rl :hide? t)
     (replace -1 :dir rl :hide? t)
     (expand "offset")
     (apply-extensionality :hide? t)
     (rewrite "Clock_rewrite")
     (expand "same_edges?")
     (inst?)
     (expand "offset_clocks?")
     (skosimp*)
     (invoke (inst-cp - "%1") (! 1 r 1 1 1 1))
     (replace*)
     (rewrite "Clock_rewrite")
     (hide -2)
     (inst?)
     (assert))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: clock_shift
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (lemma "offset_same")
   (inst - "T1!1" 0 "c1!1" "c2!1" "le1!1" "le2!1")
   (assert)
   (replace -1 :hide? t)
   (rewrite "offset_zero")
   (rewrite "offset_zero")
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: reduce_synch_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (apply-extensionality :hide? t)
   (expand "synch_stage")
   (expand "offset")
   (rewrite "Clock_rewrite ")
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: reduce_synch_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (expand "quorum_synch?")
   (use "correct_quorum_lower")
   (use "enabled_within_stage")
   (assert)
   (use "v_min_witness[D, real, <=]")
   (skosimp*)
   (replace -2 :hide? t)
   (move-terms 1 l 2)
   (lemma "reduce_min_validity")
   (inst?)
   (inst - "min" _ _)
   (("1"
     (inst?)
     (inst?)
     (assert)
     (invoke (then (case "%1 <= %2") (assert) (hide -1 2)) (! -1 r)
      (! 1 r))
     (hide -2 -3)
     (use "v_min_is_min[D, real, <=]")
     (assert)
     (invoke (then (case "%1 <= %2") (assert) (hide -1 2)) (! -1 r)
      (! 1 r))
     (lemma "offset_left_edge")
     (inst?)
     (expand "synch_stage")
     (inst?)
     (assert)
     (prop)
     (("1"
       (invoke (then (case "%1 <= %2") (assert) (hide -1 2)) (! -1 r 1)
        (! 1 r 1))
       (expand "offset")
       (rewrite "clock_nondecreasing")
       (hide 2)
       (isolate 1 r 1)
       (assert)
       (rewrite "Clock_nondecreasing")
       (hide 2)
       (rewrite "min_reduce_choice"))
      ("2"
       (hide 2)
       (expand "clock_edge?")
       (expand "quorum?")
       (inst - "n!1")
       (expand "quorum?")
       (flatten)
       (use "in_rcvd")
       (assert)
       (skosimp*)
       (replace*)
       (expand "received")
       (inst?))))
    ("2" (skosimp*) (use "min_le_max[real, <=]"))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: reduce_synch_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (expand "quorum_synch?")
   (use "correct_quorum_upper")
   (use "enabled_within_stage")
   (assert)
   (use "v_max_witness[D, real, <=]")
   (skosimp*)
   (replace -2 :hide? t)
   (move-terms 1 r 2)
   (expand "synch_stage")
   (use "reduce_max_validity")
   (assert)
   (invoke (then (case "%1 <= %2") (assert) (hide -1 2)) (! 1 l)
    (! -1 l))
   (hide -2 -3)
   (lemma "v_max_is_max[D, real, <=]")
   (invoke (inst - _ _ "%1") (! 1 r 1))
   (inst?)
   (assert)
   (invoke (then (case "%1 <= %2") (assert) (hide -1 2)) (! 1 l)
    (! -1 l))
   (use "offset_right")
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: reduce_synch_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (rewrite "abs_max")
   (rewrite "max_le")
   (prop)
   (("1"
     (use "v_min_is_min[S, real, <=]")
     (use "upper_synch_validity")
     (use "v_max_is_max[D, real, <=]")
     (assert))
    ("2"
     (use "v_max_is_max[S, real, <=]")
     (use "lower_synch_validity")
     (use "v_min_is_min[D, real, <=]")
     (assert))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: reduce_synch_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (expand "quorum_synch?")
   (use "quorum_imprecision")
   (use "enabled_within_stage")
   (assert)
   (use "v_max_witness[D, real, <=]")
   (use "v_min_witness[D, real, <=]")
   (skosimp*)
   (replace*)
   (expand "synch_stage")
   (lemma "inexact_reduce_stage.agreement_propagation")
   (inst - "max" "min" _ _ _ _ _ _ _ _)
   (("1"
     (inst?)
     (inst?)
     (inst?)
     (assert)
     (hide -3 -5 -6 -7 -9 -10)
     (use "v_min_is_min[D, real, <=]")
     (assert)
     (lemma "v_max_is_max[D, real, <=]")
     (inst - "n!2" _ _)
     (inst?)
     (assert)
     (lemma "offset_drift_edge")
     (invoke (inst - _ _ "%1" "%2" _ _) (! -3 l 1) (! -2 r 1))
     (inst?)
     (inst?)
     (inst?)
     (prop)
     (("1"
       (invoke (then (case "%1 <= %2") (assert) (hide -1 2)) (! 1 l)
        (! -1 l))
       (hide-all-but 1)
       (lemma "offset_nondecreasing")
       (inst - "N!1" "c_dst!1" _ _ _)
       (use "max_reduce_choice")
       (lemma "min_reduce_choice")
       (inst - _ _ "n!1" _ _)
       (inst?)
       (inst-cp - _ _ "n!1")
       (inst - _ _ "n!2")
       (inst?)
       (inst?)
       (assert))
      ("2"
       (hide-all-but (-6 1))
       (expand "clock_edge?")
       (use "in_rcvd")
       (assert)
       (expand "quorum?")
       (inst? -)
       (expand "quorum?")
       (prop)
       (hide -2 2)
       (skosimp*)
       (replace -1 :hide? t)
       (expand "received")
       (inst?))
      ("3"
       (hide-all-but (-6 1))
       (expand "clock_edge?")
       (use "in_rcvd")
       (assert)
       (expand "quorum?")
       (inst? -)
       (expand "quorum?")
       (prop)
       (hide -2 2)
       (skosimp*)
       (replace -1 :hide? t)
       (expand "received")
       (inst?))))
    ("2" (skosimp*) (use "min_le_max[real, <=]"))
    ("3" (skosimp*) (use "min_le_max[real, <=]"))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: reduce_synch_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (use "single_imprecision_timing")
   (expand "overlap_synch?")
   (expand "overlap_imprecision?")
   (inst?)
   (("1" (assert))
    ("2"
     (expand "reduce_overlap?")
     (inst - 0 0)
     (("1" (skosimp*) (expand "empty?") (expand "member") (inst?))
      ("2" (assert))))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: reduce_synch_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (expand "quorum_synch?")
   (use "quorum_imprecision")
   (use "overlap_imprecision")
   (use "enabled_within_stage")
   (expand "max_length")
   (assert)
   (use "v_max_witness[D, real, <=]")
   (use "v_min_witness[D, real, <=]")
   (assert)
   (skosimp*)
   (replace*)
   (expand "synch_stage")
   (hide -2 -4)
   (use "inexact_reduce_stage.convergence")
   (assert)
   (use "v_min_is_min[D, real, <=]")
   (lemma "v_max_is_max[D, real, <=]")
   (inst - "n!2" _ _)
   (inst?)
   (assert)
   (use "offset_drift")
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: reduce_synch_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (expand "all_symmetric_synch?")
   (flatten)
   (use "all_symmetric_timing")
   (assert)
   (use "v_max_witness[D, real, <=]")
   (use "v_min_witness[D, real, <=]")
   (assert)
   (skosimp*)
   (replace*)
   (expand "synch_stage")
   (hide -2 -4)
   (use "inexact_reduce_stage.agreement_generation")
   (assert)
   (use "v_min_is_min[D, real, <=]")
   (assert)
   (lemma "v_max_is_max[D, real, <=]")
   (inst - "n!2" _ _)
   (inst?)
   (assert)
   (use "offset_drift")
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: reduce_synch_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (expand "all_symmetric_synch?")
   (flatten)
   (use "all_symmetric_timing")
   (assert)
   (use "v_max_witness[D, real, <=]")
   (use "v_min_witness[D, real, <=]")
   (assert)
   (skosimp*)
   (replace*)
   (expand "synch_stage")
   (hide -2 -4)
   (use "inexact_reduce_stage.agreement_generation")
   (assert)
   (use "v_min_is_min[D, real, <=]")
   (assert)
   (lemma "v_max_is_max[D, real, <=]")
   (inst - "n!2" _ _)
   (inst?)
   (assert)
   (use "offset_drift_edge")
   (ground)
   (("1"
     (hide-all-but (-8 1))
     (expand "enabled_nonempty?")
     (expand "clock_edge?")
     (use "in_rcvd")
     (assert)
     (prop)
     (("1" (skosimp*) (replace*) (expand "received") (inst?))
      ("2" (inst? -))))
    ("2"
     (hide-all-but (-8 1))
     (expand "clock_edge?")
     (use "in_rcvd")
     (prop)
     (("1" (skosimp*) (replace*) (expand "received") (inst?))
      ("2" (expand "enabled_nonempty?") (inst? -))))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: timing_integration
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (expand "enabled_within?")
   (skosimp*)
   (expand "received")
   (expand "check")
   (use "enabled_within_stage[rho, min_latency(i!1), var_latency(i!1), stage(i!1), stage(1 + i!1)]"))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: reduce_synch
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (apply-extensionality :hide? t)
   (expand "nominal")
   (expand "W")
   (expand "nominal")
   (expand "offset")
   (expand "sent")
   (expand "sent")
   (rewrite "Clock_rewrite")
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: reduce_synch
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (expand "synch_protocol")
   (inst - "i!1")
   (assert)
   (expand "same_clock?")
   (inst - "i!1")
   (assert)
   (rewrite "offset_sent_nominal")
   (rewrite "Delay_Lag")
   (lemma
    "synch_stage_offset[rho, min_latency(i!1), var_latency(i!1), stage(i!1), stage(1 + i!1)]")
   (inst - "W(i!1+1)" _ _ _ _ _ _ _ _ _)
   (assert)
   (inst?)
   (replace -1 :hide? t)
   (lemma "offset_same2[rho, stage(i!1+1)]")
   (inst?)
   (assert)
   (hide-all-but 1)
   (split)
   (("1"
     (expand "all_clock_edge?")
     (skosimp*)
     (expand "clock_edge?")
     (expand "sent")
     (expand "sent")
     (inst?))
    ("2"
     (expand "all_clock_edge?")
     (skosimp*)
     (expand "clock_edge?")
     (expand "synch_stage")
     (expand "offset")
     (inst?))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: reduce_synch
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (expand "protocol_synch")
   (expand "protocol")
   (expand "synch_protocol")
   (expand "reduce_choice")
   (expand "synch_stage")
   (expand "offset")
   (expand "offset")
   (expand "check" 1 1)
   (expand "received" 1 1)
   (prop)
   (("1"
     (skosimp*)
     (inst?)
     (assert)
     (replace -1 :hide? t)
     (apply-extensionality :hide? t)
     (rewrite "Del_Delay"))
    ("2"
     (skosimp*)
     (inst?)
     (assert)
     (replace -1 :hide? t)
     (apply-extensionality :hide? t)
     (rewrite "Del_Delay"))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: reduce_synch
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (induct "k")
   (("1" (skosimp*) (expand "sigma") (assert))
    ("2"
     (skosimp*)
     (rewrite "sigma_last")
     (inst?)
     (inst - "c_dst!1" "cf!1" "pi!1" _ "tau!1")
     (inst?)
     (prop)
     (("1"
       (rewrite "-")
       (move-terms 1 l (2 3))
       (("1"
         (invoke (then (case "%1 <= %2") (assert) (hide -1 2)) (! -1 r)
          (! 1 r))
         (expand* "*" "synch_protocol" "v_min")
         (inst?)
         (assert)
         (replace -2 :hide? t)
         (isolate 1 r 2)
         (expand* "clock_relation?" "nominal" "epsilon_lower")
         (inst?)
         (expand* "quorum_synch?" "check" "received")
         (inst?)
         (assert)
         (use "lower_synch_validity[rho, min_latency(j!1 + j!2), var_latency(j!1 + j!2), stage(j!1 + j!2), stage(1 + j!1 + j!2)]")
         (assert))
        ("2" (assert) (skosimp*) (assert))))
      ("2"
       (hide-all-but (-2 1))
       (expand "synch_protocol")
       (skosimp*)
       (inst?)
       (assert))
      ("3"
       (hide-all-but (-3 1))
       (expand "quorum_synch?")
       (skosimp*)
       (inst?)
       (assert))
      ("4"
       (hide-all-but (-4 1))
       (expand "clock_relation?")
       (skosimp*)
       (inst?)
       (assert))))
    ("3" (hide 2) (skosimp*) (assert)) ("4" (skosimp*) (assert))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: reduce_synch
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (induct "k")
   (("1" (skosimp*) (expand "sigma") (assert))
    ("2"
     (skosimp*)
     (rewrite "sigma_last")
     (inst - _ "c_dst!1" _ "cf!1" "j!2" "pi!1" _ _ "tau!1")
     (inst?)
     (inst?)
     (prop)
     (("1"
       (rewrite "+")
       (rewrite "*")
       (move-terms 1 r (2 3))
       (invoke (then (case "%1 <= %2") (assert) (hide -1 2)) (! 1 l)
        (! -1 l))
       (expand* "synch_protocol" "v_max")
       (inst?)
       (assert)
       (replace -2 :hide? t)
       (isolate 1 l 1)
       (expand* "clock_relation?" "nominal" "epsilon_upper")
       (inst?)
       (expand* "quorum_synch?" "check" "received")
       (inst?)
       (assert)
       (use "upper_synch_validity[rho, min_latency(j!1 + j!2), var_latency(j!1 + j!2), stage(j!1 + j!2), stage(1 + j!1 + j!2)]")
       (assert))
      ("2"
       (hide-all-but (-2 1))
       (expand "synch_protocol")
       (skosimp*)
       (inst?)
       (assert))
      ("3"
       (hide-all-but (-3 1))
       (expand "quorum_synch?")
       (skosimp*)
       (inst?)
       (assert))
      ("4"
       (hide-all-but (-4 1))
       (expand "clock_relation?")
       (skosimp*)
       (inst?)
       (assert))))
    ("3" (hide 2) (skosimp*) (assert))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: reduce_synch
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (induct "k")
   (("1" (skosimp*) (expand "sigma") (propax))
    ("2"
     (skosimp*)
     (rewrite "sigma_last")
     (inst?)
     (inst - "c_dst!1" "cf!1" "pi!1" _ _)
     (inst?)
     (inst?)
     (prop)
     (("1"
       (hide -6)
       (forward-chain "synch_protocol_sent")
       (expand* "v_max" "v_min" "quorum_synch?")
       (inst - "j!1+j!2")
       (assert)
       (replace -1 :hide? t)
       (expand* "clock_relation?" "sent" "check" "received")
       (inst?)
       (inst?)
       (assert)
       (rewrite "+")
       (rewrite "*")
       (rewrite "epsilon_total")
       (use "synch_agreement_propagation[rho, min_latency(j!1 + j!2), var_latency(j!1 + j!2), stage(j!1 + j!2),
                                                                                                             stage(1 + j!1 + j!2)]")
       (("1" (assert))
        ("2"
         (expand "quorum_synch?")
         (hide-all-but 1)
         (use "sigma_nonneg[nat]")
         (assert)
         (skosimp*)
         (hide 2)
         (rewrite "+")
         (rewrite "*")
         (assert))))
      ("2"
       (hide-all-but (-2 1))
       (expand "synch_protocol")
       (skosimp*)
       (inst?)
       (assert))
      ("3"
       (hide-all-but (-3 1))
       (expand "quorum_synch?")
       (skosimp*)
       (inst?)
       (assert))
      ("4"
       (hide-all-but (-4 1))
       (expand "clock_relation?")
       (skosimp*)
       (inst?)
       (assert))
      ("5"
       (hide-all-but (-6 1))
       (expand "same_clock?")
       (skosimp*)
       (inst?)
       (assert))))
    ("3" (hide 2) (skosimp*) (assert))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: reduce_synch
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (expand "convergent_stage?")
   (skosimp*)
   (lemma "agreement_propagation")
   (inst - _ _ _ _ _ "j!1" "i!1 - j!1" _ _ _ _)
   (("1"
     (assert)
     (inst?)
     (inst - "c_dst!1" "cf!1" "pi!1" "status!1" "tau!1")
     (ground)
     (("1"
       (hide -10)
       (lemma
        "synch_convergence[rho, min_latency(i!1), var_latency(i!1), stage(i!1), stage(1 + i!1)]")
       (expand "v_max" -2)
       (expand "v_min" -2)
       (assert)
       (inst?)
       (assert)
       (invoke (inst - "Lag(Schedule!1)(i!1)" "%1" "src_set!1(i!1 + 1)")
        (! -2 r))
       (("1"
         (assert)
         (ground)
         (("1"
           (hide -2 -9 -10)
           (lemma "sigma_middle")
           (invoke (inst - "%1" "j!1 + k!1 - 1" "i!1" "j!1") (! 1 r 1 3))
           (assert)
           (replace -1 :hide? t)
           (assert)
           (rewrite "+")
           (rewrite "*")
           (rewrite "epsilon_total")
           (assert)
           (lemma "agreement_propagation")
           (inst - _ _ _ _ _ "i!1 + 1" "j!1 + k!1 - (i!1 + 1)" _ _ _ _)
           (assert)
           (inst?)
           (("1"
             (assert)
             (inst - "c_dst!1" "cf!1" "pi!1" "status!1" "tau!1")
             (ground)
             (("1"
               (hide-all-but (-3 1))
               (expand "synch_protocol")
               (skosimp*)
               (inst?)
               (assert))
              ("2"
               (hide-all-but (-4 1))
               (expand "quorum_synch?")
               (skosimp*)
               (inst?)
               (assert))
              ("3"
               (hide-all-but (-5 1))
               (expand "clock_relation?")
               (skosimp*)
               (inst?)
               (assert))
              ("4"
               (hide 2)
               (rewrite "v_min" +)
               (rewrite "v_max" +)
               (use "synch_protocol_sent")
               (assert)
               (inst?)
               (assert)
               (replace -1 :hide? t)
               (case "(X!1 - 1) / X!1 <= 1")
               (("1"
                 (invoke (mult-by -1 "%1") (! 1 r 1))
                 (("1" (assert))
                  ("2"
                   (hide-all-but 1)
                   (use "sigma_nonneg")
                   (assert)
                   (skosimp*)
                   (rewrite "+")
                   (rewrite "*")
                   (assert))))
                ("2" (cross-mult) (assert))))
              ("5"
               (hide-all-but (-8 1))
               (expand "same_clock?")
               (skosimp*)
               (inst?)
               (assert))))
            ("2"
             (assert)
             (hide-all-but 1)
             (use "sigma_nonneg")
             (ground)
             (("1"
               (case " 0 <= (X!1 - 1) / X!1")
               (("1" (assert) (mult-by -1 "delta!1") (assert))
                ("2" (cross-mult) (assert))))
              ("2" (skosimp*) (rewrite "+") (rewrite "*") (assert))))))
          ("2" (expand "quorum_synch?" -) (inst?) (assert))
          ("3" (expand "clock_relation?" -) (inst?) (assert))
          ("4" (expand "sent" -) (propax))))
        ("2"
         (hide-all-but 1)
         (assert)
         (use "sigma_nonneg")
         (assert)
         (skosimp*)
         (expand "+")
         (expand "*")
         (assert))))
      ("2"
       (hide-all-but (-2 1))
       (expand "synch_protocol")
       (skosimp*)
       (inst?)
       (assert))
      ("3"
       (hide-all-but (-3 1))
       (expand "quorum_synch?")
       (skosimp*)
       (inst?)
       (assert))
      ("4"
       (hide-all-but (-4 1))
       (expand "clock_relation?")
       (skosimp*)
       (inst?)
       (assert))
      ("5"
       (hide-all-but (-10 1))
       (expand "same_clock?")
       (skosimp*)
       (inst?)
       (assert))))
    ("2" (assert))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: reduce_synch
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (expand "exists_symmetric_synch_stage?")
   (skosimp*)
   (lemma "sigma_split")
   (invoke (inst - "%1" "%2" "%3" "%4") (! 1 r 1 3) (! 1 r 1 2)
    (! 1 r 1 1) (! -4 r))
   (assert)
   (replace -1 :hide? t)
   (lemma "agreement_propagation")
   (invoke (inst - _ _ _ _ "%1 + %5" "%2" "%3 - %4" _ _ _ _) (! 1 r 2)
    (! 1 r 1 1) (! 1 r 1 2) (! -4 r) (! 1 r 3))
   (("1"
     (assert)
     (inst?)
     (inst - "cf!1")
     (prop)
     (("1"
       (hide-all-but (-2 1))
       (expand "synch_protocol")
       (skosimp*)
       (inst?)
       (assert))
      ("2"
       (hide-all-but (-8 1))
       (expand "clock_relation?")
       (skosimp*)
       (inst?)
       (assert))
      ("3"
       (hide 2)
       (rewrite "sigma_last")
       (rewrite "+")
       (rewrite "epsilon_total")
       (expand "v_min")
       (expand "v_max")
       (forward-chain "synch_protocol_sent")
       (inst?)
       (assert)
       (replace -1 :hide? t)
       (expand "clock_relation?")
       (inst?)
       (assert)
       (lemma
        "synch_agreement_generation[rho, min_latency(i!1), var_latency(i!1), stage(i!1), stage(1 + i!1)]")
       (inst?)
       (assert)
       (rewrite "*")
       (assert)
       (invoke (then (case "0 <= %1") (assert)) (! 1 r 1))
       (hide-all-but 1)
       (use "sigma_nonneg[nat]")
       (assert)
       (skosimp*)
       (expand "+ ")
       (expand "*")
       (assert))
      ("4"
       (hide-all-but (-9 1))
       (expand "same_clock?")
       (skosimp*)
       (inst?)
       (assert))))
    ("2"
     (hide-all-but 1)
     (use "sigma_nonneg[nat]")
     (assert)
     (skosimp*)
     (rewrite "+")
     (rewrite "*")
     (assert))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: reduce_synch
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (expand "exists_symmetric_synch_stage?")
   (skosimp*)
   (lemma "sigma_split")
   (invoke (inst - "%1" "%2" "%3" "%4") (! 1 r 3) (! 1 r 2) (! 1 r 1)
    (! -4 r))
   (assert)
   (replace -1 :hide? t)
   (lemma "agreement_propagation")
   (invoke (inst - _ _ _ _ "%1" "%2" "%3 - %4" _ _ _ _) (! 1 r 2)
    (! 1 r 1 1) (! 1 r 1 2) (! -4 r))
   (("1"
     (assert)
     (inst?)
     (inst - "icf!1")
     (prop)
     (("1"
       (hide-all-but (-2 1))
       (expand "synch_protocol")
       (skosimp*)
       (inst?)
       (assert))
      ("2"
       (hide-all-but (-8 1))
       (expand "clock_relation?")
       (skosimp*)
       (inst?)
       (assert))
      ("3"
       (hide 2)
       (rewrite "sigma_last")
       (rewrite "+")
       (rewrite "epsilon_total")
       (expand "v_min")
       (expand "v_max")
       (forward-chain "synch_protocol_sent")
       (inst?)
       (assert)
       (replace -1 :hide? t)
       (expand "clock_relation?")
       (inst?)
       (assert)
       (lemma
        "synch_agreement_generation_edge[rho, min_latency(i!1), var_latency(i!1), stage(i!1), stage(1 + i!1)]")
       (inst?)
       (assert)
       (rewrite "*")
       (assert)
       (invoke (then (case "0 <= %1") (assert)) (! 1 r 1))
       (hide-all-but 1)
       (use "sigma_nonneg[nat]")
       (assert)
       (skosimp*)
       (expand "+ ")
       (expand "*")
       (assert))
      ("4"
       (hide-all-but (-9 1))
       (expand "same_clock?")
       (skosimp*)
       (inst?)
       (assert))))
    ("2"
     (hide-all-but 1)
     (use "sigma_nonneg[nat]")
     (assert)
     (skosimp*)
     (rewrite "+")
     (rewrite "*")
     (assert))))


proof_type: t_proof
decl_type: tcc
library: fault_tolerance
theory: reduce_synch
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (expand "pred")
   (skosimp*)
   (lift-if)
   (assert)
   (typepred "Sched!1")
   (expand "feasible?")
   (expand "W")
   (inst - "i!1-1")
   (("1" (assert)) ("2" (assert))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: exact_comm_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (auto-rewrite-defs)
   (assert)
   (skosimp*)
   (inst?)
   (inst?)
   (inst?)
   (assert)
   (inst?))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: exact_comm_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (iff)
   (expand "majority_correct?")
   (expand "quorum_correct?")
   (prop)
   (("1" (skosimp*) (inst?) (assert) (rewrite "majority"))
    ("2" (skosimp*) (inst?) (assert) (rewrite "majority"))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: exact_reduce_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (expand "quorum_correct?")
   (skosimp*)
   (use "quorum_nonempty")
   (assert)
   (expand "quorum?")
   (inst - "d!1")
   (expand "reduce_choice")
   (expand "enabled_nonempty?")
   (inst?)
   (assert)
   (expand "exact_correct_denotation?")
   (inst?)
   (use "choice_lower_validity")
   (assert)
   (skosimp*)
   (inst?)
   (inst?)
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: exact_reduce_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (expand "quorum_correct?")
   (skosimp*)
   (use "quorum_nonempty")
   (assert)
   (expand "quorum?")
   (inst - "d!1")
   (expand "reduce_choice")
   (expand "enabled_nonempty?")
   (inst?)
   (assert)
   (expand "exact_correct_denotation?")
   (inst?)
   (use "choice_upper_validity")
   (assert)
   (skosimp*)
   (inst?)
   (inst?)
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: exact_reduce_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (expand "all_symmetric?")
   (skosimp*)
   (lemma "enabled_agree")
   (inst?)
   (assert)
   (inst - "d1!1" "d2!1")
   (assert)
   (expand "reduce_choice")
   (lemma "choice_agreement_generation")
   (inst?)
   (inst - "rcvd!1(d2!1)")
   (assert)
   (expand "enabled_symmetric?")
   (expand "exact_single_denotation?")
   (skosimp*)
   (inst?)
   (assert)
   (expand "enabled_within?")
   (expand "subset?")
   (expand "member")
   (inst?)
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: exact_reduce_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (use "v_min_witness[D, T, <=]")
   (skosimp*)
   (replace -2 :hide? t)
   (lemma "transitive")
   (inst?)
   (use "reduce_lower_validity")
   (assert)
   (skosimp*)
   (use "v_min_is_min[S, T, <=]")
   (prop)
   (("1" (inst?) (assert))
    ("2"
     (hide-all-but (1 -6 -1))
     (expand* "enabled_within?" "subset?" "member")
     (inst?)
     (prop))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: exact_reduce_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (use "v_max_witness[D, T, <=]")
   (skosimp*)
   (replace -2 :hide? t)
   (lemma "transitive")
   (inst?)
   (use "reduce_upper_validity")
   (assert)
   (skosimp*)
   (lemma "v_max_is_max[S, T, <=]")
   (inst - "s!1" "src_set!1" "sent!1")
   (assert)
   (prop)
   (("1" (inst?) (assert))
    ("2"
     (hide-all-but (1 -6 -1))
     (expand* "enabled_within?" "subset?" "member")
     (inst?)
     (prop))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: exact_reduce_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (use "reduce_min_validity")
   (use "reduce_max_validity")
   (assert)
   (rewrite "v_minmax_choose_alt[D, T, <=]")
   (rewrite "v_minmax_choose_alt[S, T, <=]")
   (hide -4 -3)
   (flatten)
   (typepred "<=")
   (expand* "total_order?" "partial_order?" "preorder?" "transitive?")
   (prop)
   (("1" (invoke (inst - "%1" "%2" "v!1") (! -5 l) (! -5 r)) (assert))
    ("2" (invoke (inst - "v!1" "%1" "%2") (! -6 l) (! -6 r)) (assert))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: exact_reduce_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (use "v_max_witness[D, T, <=]")
   (use "v_min_witness[D, T, <=]")
   (skosimp*)
   (replace*)
   (hide -4 -2)
   (use "reduce_agreement_generation")
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: exact_comm
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (expand "majority_correct?")
   (expand "quorum_correct?")
   (prop)
   (("1"
     (skosimp*)
     (inst?)
     (assert)
     (rewrite "majority_correct_rw")
     (expand "mid" +)
     (propax))
    ("2"
     (skosimp*)
     (inst?)
     (assert)
     (rewrite "majority_correct_rw")
     (expand "mid" -)
     (propax))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: exact_reduce
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (induct "k")
   (("1" (skosimp*) (assert) (use "reflexive[T]"))
    ("2"
     (skosimp*)
     (assert)
     (inst?)
     (inst?)
     (inst?)
     (inst?)
     (assert)
     (prop)
     (("1"
       (lemma "transitive[T]")
       (invoke (inst - _ "%1" "%2" "%3") (! -2 l) (! -2 r) (! 1 r))
       (inst?)
       (assert)
       (hide 2 -1)
       (expand "v_min")
       (expand "quorum_correct?")
       (expand "enabled_within?")
       (inst - "j!1 + j!2")
       (inst - "j!1 + j!2")
       (assert)
       (expand "protocol")
       (inst?)
       (expand "reduce_choice")
       (replace -1 :hide? t)
       (use "reduce_min_validity[N(j!2 + j!1), N(1 + j!1 + j!2), T, <=, error(j!1 + j!2)]")
       (assert))
      ("2"
       (hide-all-but (1 -1))
       (expand "protocol")
       (skosimp*)
       (inst?)
       (assert))
      ("3"
       (hide-all-but (1 -2))
       (expand "quorum_correct?")
       (skosimp*)
       (inst?)
       (assert))
      ("4"
       (hide-all-but (1 -3))
       (expand "enabled_within?")
       (skosimp*)
       (inst?)
       (assert))))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: exact_reduce
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (induct "k")
   (("1" (skosimp*) (assert) (use "reflexive[T]"))
    ("2"
     (skosimp*)
     (assert)
     (inst - _ _ "j!2" _ _ _ _)
     (inst?)
     (inst?)
     (inst?)
     (inst?)
     (assert)
     (prop)
     (("1"
       (lemma "transitive[T]")
       (invoke (inst - _ "%1" "%2" "%3") (! 1 l) (! -2 l) (! -2 r))
       (inst?)
       (assert)
       (hide 2 -1)
       (expand "v_max")
       (expand "quorum_correct?")
       (expand "enabled_within?")
       (inst - "j!1 + j!2")
       (inst - "j!1 + j!2")
       (assert)
       (expand "protocol")
       (inst?)
       (expand "reduce_choice")
       (replace -1 :hide? t)
       (use "reduce_max_validity[N(j!2 + j!1), N(1 + j!1 + j!2), T, <=, error(j!1 + j!2)]")
       (assert))
      ("2"
       (hide-all-but (1 -1))
       (expand "protocol")
       (skosimp*)
       (inst?)
       (assert))
      ("3"
       (hide-all-but (1 -2))
       (expand "quorum_correct?")
       (skosimp*)
       (inst?)
       (assert))
      ("4"
       (hide-all-but (1 -3))
       (expand "enabled_within?")
       (skosimp*)
       (inst?)
       (assert))))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: exact_reduce
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (forward-chain "lower_validity")
   (forward-chain "upper_validity")
   (hide -5 -4 -3)
   (rewrite "v_minmax_choose_alt[N(j!1 + k!1), T, <=]")
   (rewrite "v_minmax_choose_alt[N(j!1), T, <=]")
   (lemma "transitive[T]")
   (prop)
   (("1"
     (invoke (inst - "<=" "%1" "%2" "v!1") (! -2 l) (! -2 r))
     (assert)
     (expand "v_max" -1)
     (propax))
    ("2"
     (invoke (inst - "<=" "v!1" "%1" "%2") (! -3 l) (! -3 r))
     (assert)
     (expand "v_min" -1)
     (propax))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: exact_reduce
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (forward-chain "lower_validity")
   (forward-chain "upper_validity")
   (replace*)
   (hide-all-but (-1 -2 1))
   (lemma "transitive[T]")
   (invoke (inst - "<=" "%1" "%2" "%3") (! -2 l) (! -2 r) (! -3 r))
   (assert)
   (hide-all-but (1 -1))
   (expand* "v_max" "v_min")
   (rewrite "min_le_max_alt[N(j!1 + k!1), T, <=]"))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: exact_reduce
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (expand "exists_all_symmetric?")
   (skosimp*)
   (lemma "exact_agreement_propagation")
   (inst - _ _ "i!1+1" "j!1+k!1-(i!1+1)" _ _ _ _)
   (("1"
     (inst?)
     (inst?)
     (inst?)
     (assert)
     (prop)
     (("1"
       (hide-all-but (-1 1))
       (expand "protocol")
       (skosimp*)
       (inst?)
       (assert))
      ("2"
       (hide-all-but (-6 1))
       (expand "enabled_within?")
       (skosimp*)
       (inst?)
       (assert))
      ("3"
       (hide -5 -6 2)
       (expand* "v_max" "v_min")
       (expand "protocol")
       (inst?)
       (expand "reduce_choice")
       (assert)
       (use "reduce_min_eq_max[N(i!1), N(1 + i!1), T, <=, error(i!1)]")
       (assert))))
    ("2" (assert))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: comm_integration_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (expand "correct_denotation?")
   (expand "rcvd")
   (ground)
   (("1" (typepred "osym_rcvd(sent!1, s!1)") (assert))
    ("2" (typepred "oasym_rcvd(sent!1, s!1, d!1)") (assert))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: comm_integration_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (expand "enabled_within?")
   (expand "subset?")
   (expand "member")
   (expand "enabled")
   (expand "conforms")
   (skosimp*))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: comm_integration_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (expand "exact_correct_denotation?")
   (skosimp*)
   (expand "correct_denotation")
   (expand "enabled")
   (use "correct_denotation_send")
   (prop))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: comm_integration_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (expand "majority_correct?")
   (expand "quorum_correct?")
   (rewrite "majority")
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: comm_integration_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (expand "exact_single_denotation?")
   (skosimp*)
   (expand "single_denotation")
   (expand "single_denotation?")
   (expand "enabled")
   (expand "rcvd")
   (lift-if)
   (assert)
   (prop)
   (("1"
     (assert)
     (typepred "oasym_rcvd(sent!1, s!1, d2!1)")
     (prop)
     (("1" (typepred "oasym_rcvd(sent!1, s!1, d1!1)") (ground))
      ("2" (assert))))
    ("2"
     (typepred "sv_rcvd(sent!1, s!1, d2!1)")
     (ground)
     (typepred "sv_rcvd(sent!1, s!1, d1!1)")
     (ground))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: comm_integration_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (expand "uniformly_enabled?")
   (expand "enabled")
   (skosimp*)
   (assert)
   (expand "uniform?")
   (inst?)
   (inst - "d2!1")
   (assert)
   (expand "symmetric_denotation")
   (expand "symmetric_denotation?")
   (expand "rcvd")
   (lift-if)
   (assert)
   (ground))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: comm_integration_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (expand "exact_single_denotation?")
   (skosimp*)
   (expand "symmetric_denotation")
   (expand "symmetric_denotation?")
   (expand "enabled")
   (expand "rcvd")
   (lift-if)
   (ground))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: comm_integration_stage
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (expand "all_symmetric?")
   (skosimp*)
   (inst?)
   (assert)
   (use "uniformly_enabled")
   (assert)
   (use "exact_symmetric_single"))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: comm_integration
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (expand "quorum_correct?")
   (skosimp*)
   (inst?)
   (assert)
   (expand "rcvd")
   (use "quorum_correct_integration[N(i!1), N(1 + i!1), T]")
   (assert))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: comm_integration
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (expand "majority_correct?")
   (expand "quorum_correct?")
   (prop)
   (("1"
     (skosimp*)
     (inst?)
     (assert)
     (rewrite "majority_correct_rw")
     (expand "mid" 1)
     (propax))
    ("2"
     (skosimp*)
     (inst?)
     (assert)
     (rewrite "majority_correct_rw")
     (expand "mid" -1)
     (propax))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: comm_integration
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (expand "exists_all_symmetric?")
   (skosimp*)
   (inst?)
   (assert)
   (use "quorum_correct_integration")
   (assert)
   (use "all_symmetric_integration[N(i!1), N(1 + i!1), T]")
   (assert)
   (expand "rcvd" +)
   (propax))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: ordered_message
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (skosimp*)
   (split)
   (("1" (flatten) (replace -1) (rewrite "valid_iff_ord1") (assert))
    ("2"
     (flatten)
     (prop)
     (("1" (use "message_valid_extensionality") (assert))
      ("2" (expand "ord") (lift-if) (ground))))))


proof_type: j_proof
decl_type: tcc
library: fault_tolerance
theory: ordered_message
signature: nil
run_date: Unknown date
run_time: ----
status: proved-complete
description: nil
script:
  (""
   (typepred "leq")
   (expand "total_order?")
   (expand "partial_order?")
   (expand "preorder?")
   (expand "<=")
   (prop)
   (("1"
     (expand "reflexive?")
     (skosimp*)
     (inst?)
     (("1" (assert)) ("2" (assert))))
    ("2"
     (expand "transitive?")
     (skosimp*)
     (case "valid?(x!1) & valid?(y!1) & valid?(z!1)")
     (("1"
       (flatten)
       (assert)
       (inst - "value(x!1)" "value(y!1)" "value(z!1)")
       (assert))
      ("2"
       (rewrite "valid_iff_ord1")
       (rewrite "valid_iff_ord1")
       (rewrite "valid_iff_ord1")
       (ground))))
    ("3"
     (expand "antisymmetric?")
     (skosimp*)
     (case " valid?(x!1)")
     (("1"
       (case " valid?(y!1)")
       (("1" (assert) (inst?) (apply-extensionality))
        ("2"
         (rewrite "eq_iff")
         (flatten)
         (assert)
         (expand "ord")
         (assert))))
      ("2" (rewrite "eq_iff") (assert) (expand "ord") (assert))))
    ("4"
     (expand "dichotomous?")
     (skosimp*)
     (inst?)
     (("1" (ground)) ("2" (assert)) ("3" (assert))))))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: exact_reduce_integration
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (replace -1 :hide? t)
   (expand "protocol")
   (use "quorum_correct_integration")
   (assert)
   (use "lower_validity")
   (assert)
   (hide-all-but 1)
   (expand "enabled_within?")
   (skosimp*)
   (expand "conforms")
   (use "scheduled_conform[N(i!1), N(1 + i!1), T]"))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: exact_reduce_integration
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (replace -1 :hide? t)
   (expand "protocol")
   (use "quorum_correct_integration")
   (assert)
   (use "upper_validity")
   (assert)
   (hide-all-but 1)
   (expand "enabled_within?")
   (skosimp*)
   (expand "conforms")
   (use "scheduled_conform[N(i!1), N(1 + i!1), T]"))


proof_type: f_proof
decl_type: formula
library: fault_tolerance
theory: exact_reduce_integration
signature: nil
run_date: Unknown date
run_time: ----
status: proved-incomplete
description: nil
script:
  (""
   (skosimp*)
   (replace -1 :hide? t)
   (expand "protocol")
   (use "all_symmetric_integration")
   (assert)
   (use "agreement_generation")
   (assert)
   (hide-all-but 1)
   (expand "enabled_within?")
   (skosimp*)
   (expand "conforms")
   (use "scheduled_conform[N(i!1), N(1 + i!1), T]"))


