theory rotate_structural_mod
imports Main
        "$HIPSTER_HOME/IsaHipster"
begin

datatype Nat = S "Nat" | Z

datatype 'a List2 = Cons2 "'a" "'a List2" | Nil2

fun take :: "Nat => 'a List2 => 'a List2" where
"take (S z) (Cons2 x2 x3) = Cons2 x2 (take z x3)"
| "take (S z) (Nil2) = Nil2"
| "take (Z) y = Nil2"

fun minus :: "Nat => Nat => Nat" where
"minus (S z) (S x2) = minus z x2"
| "minus (S z) (Z) = S z"
| "minus (Z) y = Z"

fun mod2 :: "Nat => Nat => Nat => Nat" where
"mod2 (S n) (S k) (S x2) = mod2 n k (S x2)"
| "mod2 (S n) (Z) (S x2) = mod2 n x2 (S x2)"
| "mod2 (Z) (S m) (S x2) = minus (S x2) (S m)"
| "mod2 (Z) (Z) (S x2) = Z"
| "mod2 x y (Z) = Z"

fun mod3 :: "Nat => Nat => Nat" where
"mod3 x y = mod2 x Z y"

fun length :: "'a List2 => Nat" where
"length (Cons2 y xs) = S (length xs)"
| "length (Nil2) = Z"

fun drop :: "Nat => 'a List2 => 'a List2" where
"drop (S z) (Cons2 x2 x3) = drop z x3"
| "drop (S z) (Nil2) = Nil2"
| "drop (Z) y = y"

fun append :: "'a List2 => 'a List2 => 'a List2" where
"append (Cons2 z xs) y = Cons2 z (append xs y)"
| "append (Nil2) y = y"

fun rotate :: "Nat => 'a List2 => 'a List2" where
"rotate (S z) (Cons2 x2 x3) =
   rotate z (append x3 (Cons2 x2 (Nil2)))"
| "rotate (S z) (Nil2) = Nil2"
| "rotate (Z) y = y"

(*hipster take minus mod2 mod3 length drop append rotate *)

theorem x0 :
  "!! (n :: Nat) (xs :: 'a List2) .
     (rotate n xs) =
       (append
          (drop (mod3 n (length xs)) xs) (take (mod3 n (length xs)) xs))"
  by (tactic \<open>Subgoal.FOCUS_PARAMS (K (Tactic_Data.hard_tac @{context})) @{context} 1\<close>)

end


theory T149
imports Main
begin
lemma "(
(\<forall> x::nat. \<forall> y::nat. meet(x, y) = meet(y, x)) &
(\<forall> x::nat. \<forall> y::nat. join(x, y) = join(y, x)) &
(\<forall> x::nat. \<forall> y::nat. \<forall> z::nat. meet(x, meet(y, z)) = meet(meet(x, y), z)) &
(\<forall> x::nat. \<forall> y::nat. \<forall> z::nat. join(x, join(y, z)) = join(join(x, y), z)) &
(\<forall> x::nat. \<forall> y::nat. meet(x, join(x, y)) = x) &
(\<forall> x::nat. \<forall> y::nat. join(x, meet(x, y)) = x) &
(\<forall> x::nat. \<forall> y::nat. \<forall> z::nat. mult(x, join(y, z)) = join(mult(x, y), mult(x, z))) &
(\<forall> x::nat. \<forall> y::nat. \<forall> z::nat. mult(join(x, y), z) = join(mult(x, z), mult(y, z))) &
(\<forall> x::nat. \<forall> y::nat. \<forall> z::nat. meet(x, over(join(mult(x, y), z), y)) = x) &
(\<forall> x::nat. \<forall> y::nat. \<forall> z::nat. meet(y, undr(x, join(mult(x, y), z))) = y) &
(\<forall> x::nat. \<forall> y::nat. \<forall> z::nat. join(mult(over(x, y), y), x) = x) &
(\<forall> x::nat. \<forall> y::nat. \<forall> z::nat. join(mult(y, undr(y, x)), x) = x) &
(\<forall> x::nat. \<forall> y::nat. \<forall> z::nat. mult(x, meet(y, z)) = meet(mult(x, y), mult(x, z))) &
(\<forall> x::nat. \<forall> y::nat. \<forall> z::nat. mult(meet(x, y), z) = meet(mult(x, z), mult(y, z))) &
(\<forall> x::nat. \<forall> y::nat. \<forall> z::nat. undr(x, join(y, z)) = join(undr(x, y), undr(x, z))) &
(\<forall> x::nat. \<forall> y::nat. \<forall> z::nat. over(join(x, y), z) = join(over(x, z), over(y, z))) &
(\<forall> x::nat. \<forall> y::nat. invo(join(x, y)) = meet(invo(x), invo(y))) &
(\<forall> x::nat. \<forall> y::nat. invo(meet(x, y)) = join(invo(x), invo(y))) &
(\<forall> x::nat. invo(invo(x)) = x)
) \<longrightarrow>
(\<forall> x::nat. \<forall> y::nat. \<forall> z::nat. over(x, meet(y, z)) = join(over(x, y), over(x, z)))
"
nitpick[card nat=4,timeout=86400]
oops
end


theory Remove_And_Copy
  imports "~~/src/HOL/IMP/Sem_Equiv" "~~/src/HOL/IMP/Vars"
begin

text {*
\exercise\label{exs:remove}
This exercise builds infrastructure for \autoref{exs:acopy}, where we
will have to manipulate partial maps from variable names to variable names.
*}
type_synonym tab = "vname \<Rightarrow> vname option"

text {*
  In addition to the function @{text merge} from theory @{text Fold},
  implement two functions @{text remove} and @{text remove_all} that
  remove one variable name from the range of a map, and a set of variable
  names from the domain and range of a map.
*}

definition
  merge :: "tab \<Rightarrow> tab \<Rightarrow> tab" where
  "merge t1 t2 = (\<lambda>m. if t1 m = t2 m then t1 m else None)"

definition remove :: "vname \<Rightarrow> tab \<Rightarrow> tab"  where
(* your definition/proof here *)

definition remove_all :: "vname set \<Rightarrow> tab \<Rightarrow> tab"  where
(* your definition/proof here *)

text {*
  Prove the following lemmas.
*}

lemma "ran (remove x t) = ran t - {x}"
(* your definition/proof here *)

lemma "ran (remove_all S t) \<subseteq> -S"
(* your definition/proof here *)

lemma "dom (remove_all S t) \<subseteq> -S"
(* your definition/proof here *)

lemma remove_all_update[simp]:
"remove_all {x} (t (x:= y)) = remove_all {x} t"
(* your definition/proof here *)

lemma remove_all_remove[simp]:
"remove_all {x} (remove x t) = remove_all {x} t"
(* your definition/proof here *)

lemma remove_all_Un[simp]:
"remove_all A (remove_all B t) = remove_all (A \<union> B) t"
(* your definition/proof here *)

lemma merge_remove_all:
  assumes "remove_all S t1 = remove_all S t"
  assumes "remove_all S t2 = remove_all S t"
  shows "remove_all S (merge t1 t2) = remove_all S t"
(* your definition/proof here *)

text {*
  \endexercise

  \exercise\label{exs:acopy}
  This is a more challenging exercise.
  Define and prove correct \emph{copy propagation}. Copy propagation is
similar to constant folding, but propagates the right-hand side of assignments
if these right-hand sides are just variables. For instance, the program
\texttt{x := y; z := x + z} will be transformed into
\texttt{x := y; z := y + z}.
The assignment \texttt{x := y} can then be eliminated in a liveness
analysis. Copy propagation is useful for cleaning up after other optimisation
phases.

  To do this, take the definitions for constant folding from theory
  @{text Fold} and adjust
  them to do copy propagation instead (without constant folding).
  Use the functions from \autoref{exs:remove} in your definition.
  The general proof idea and structure of constant folding remains
  applicable. Adjust it according to your new definitions.
*}

primrec copy :: "com \<Rightarrow> tab \<Rightarrow> com" where
(* your definition/proof here *)

value "copy (''x'' ::= V ''y'';; ''z'' ::= Plus (V ''x'') (V ''z'')) empty"

lemma approx_merge:
  "approx t1 s \<or> approx t2 s \<Longrightarrow> approx (merge t1 t2) s"
  by (fastforce simp: merge_def approx_def)

lemma approx_map_le:
  "approx t2 s \<Longrightarrow> t1 \<subseteq>\<^sub>m t2 \<Longrightarrow> approx t1 s"
  by (clarsimp simp: approx_def map_le_def dom_def)

theorem "copy c empty \<sim> c"
(* your definition/proof here *)

text {* \endexercise *}

end


(* Author: Tobias Nipkow *)

section \<open>Red-Black Tree Implementation of Maps\<close>

theory RBT_Map
imports
  RBT_Set
  Lookup2
begin

fun upd :: "'a::linorder \<Rightarrow> 'b \<Rightarrow> ('a*'b) rbt \<Rightarrow> ('a*'b) rbt" where
"upd x y Leaf = R Leaf (x,y) Leaf" |
"upd x y (B l (a,b) r) = (case cmp x a of
  LT \<Rightarrow> baliL (upd x y l) (a,b) r |
  GT \<Rightarrow> baliR l (a,b) (upd x y r) |
  EQ \<Rightarrow> B l (x,y) r)" |
"upd x y (R l (a,b) r) = (case cmp x a of
  LT \<Rightarrow> R (upd x y l) (a,b) r |
  GT \<Rightarrow> R l (a,b) (upd x y r) |
  EQ \<Rightarrow> R l (x,y) r)"

definition update :: "'a::linorder \<Rightarrow> 'b \<Rightarrow> ('a*'b) rbt \<Rightarrow> ('a*'b) rbt" where
"update x y t = paint Black (upd x y t)"

fun del :: "'a::linorder \<Rightarrow> ('a*'b)rbt \<Rightarrow> ('a*'b)rbt" where
"del x Leaf = Leaf" |
"del x (Node l (ab, _) r) = (case cmp x (fst ab) of
     LT \<Rightarrow> if l \<noteq> Leaf \<and> color l = Black
           then baldL (del x l) ab r else R (del x l) ab r |
     GT \<Rightarrow> if r \<noteq> Leaf\<and> color r = Black
           then baldR l ab (del x r) else R l ab (del x r) |
  EQ \<Rightarrow> join l r)"

definition delete :: "'a::linorder \<Rightarrow> ('a*'b) rbt \<Rightarrow> ('a*'b) rbt" where
"delete x t = paint Black (del x t)"

subsection "Functional Correctness Proofs"

lemma inorder_upd:
  "sorted1(inorder t) \<Longrightarrow> inorder(upd x y t) = upd_list x y (inorder t)"
by(induction x y t rule: upd.induct)
  (auto simp: upd_list_simps inorder_baliL inorder_baliR)

lemma inorder_update:
  "sorted1(inorder t) \<Longrightarrow> inorder(update x y t) = upd_list x y (inorder t)"
by(simp add: update_def inorder_upd inorder_paint)

(* This lemma became necessary below when \<open>del\<close> was converted from pattern-matching to \<open>fst\<close> *)
lemma del_list_id: "\<forall>ab\<in>set ps. y < fst ab \<Longrightarrow> x \<le> y \<Longrightarrow> del_list x ps = ps"
by(rule del_list_idem) auto

lemma inorder_del:
 "sorted1(inorder t) \<Longrightarrow>  inorder(del x t) = del_list x (inorder t)"
by(induction x t rule: del.induct)
  (auto simp: del_list_simps del_list_id inorder_join inorder_baldL inorder_baldR)

lemma inorder_delete:
  "sorted1(inorder t) \<Longrightarrow> inorder(delete x t) = del_list x (inorder t)"
by(simp add: delete_def inorder_del inorder_paint)

subsection \<open>Structural invariants\<close>

subsubsection \<open>Update\<close>

lemma invc_upd: assumes "invc t"
  shows "color t = Black \<Longrightarrow> invc (upd x y t)" "invc2 (upd x y t)"
using assms
by (induct x y t rule: upd.induct) (auto simp: invc_baliL invc_baliR invc2I)

lemma invh_upd: assumes "invh t"
  shows "invh (upd x y t)" "bheight (upd x y t) = bheight t"
using assms
by(induct x y t rule: upd.induct)
  (auto simp: invh_baliL invh_baliR bheight_baliL bheight_baliR)

theorem rbt_update: "rbt t \<Longrightarrow> rbt (update x y t)"
by (simp add: invc_upd(2) invh_upd(1) color_paint_Black invh_paint rbt_def update_def)

subsubsection \<open>Deletion\<close>

lemma del_invc_invh: "invh t \<Longrightarrow> invc t \<Longrightarrow> invh (del x t) \<and>
   (color t = Red \<and> bheight (del x t) = bheight t \<and> invc (del x t) \<or>
    color t = Black \<and> bheight (del x t) = bheight t - 1 \<and> invc2 (del x t))"
proof (induct x t rule: del.induct)
case (2 x _ ab c)
  have "x = fst ab \<or> x < fst ab \<or> x > fst ab" by auto
  thus ?case proof (elim disjE)
    assume "x = fst ab"
    with 2 show ?thesis
    by (cases c) (simp_all add: invh_join invc_join)
  next
    assume "x < fst ab"
    with 2 show ?thesis
      by(cases c)
        (auto simp: invh_baldL_invc invc_baldL invc2_baldL dest: neq_LeafD)
  next
    assume "fst ab < x"
    with 2 show ?thesis
      by(cases c)
        (auto simp: invh_baldR_invc invc_baldR invc2_baldR dest: neq_LeafD)
  qed
qed auto

theorem rbt_delete: "rbt t \<Longrightarrow> rbt (delete k t)"
by (metis delete_def rbt_def color_paint_Black del_invc_invh invc2I invh_paint)

interpretation M: Map_by_Ordered
where empty = empty and lookup = lookup and update = update and delete = delete
and inorder = inorder and inv = rbt
proof (standard, goal_cases)
  case 1 show ?case by (simp add: empty_def)
next
  case 2 thus ?case by(simp add: lookup_map_of)
next
  case 3 thus ?case by(simp add: inorder_update)
next
  case 4 thus ?case by(simp add: inorder_delete)
next
  case 5 thus ?case by (simp add: rbt_def empty_def)
next
  case 6 thus ?case by (simp add: rbt_update)
next
  case 7 thus ?case by (simp add: rbt_delete)
qed

end


theory T64
imports Main
begin
lemma "(
(\<forall> x::nat. \<forall> y::nat. meet(x, y) = meet(y, x)) &
(\<forall> x::nat. \<forall> y::nat. join(x, y) = join(y, x)) &
(\<forall> x::nat. \<forall> y::nat. \<forall> z::nat. meet(x, meet(y, z)) = meet(meet(x, y), z)) &
(\<forall> x::nat. \<forall> y::nat. \<forall> z::nat. join(x, join(y, z)) = join(join(x, y), z)) &
(\<forall> x::nat. \<forall> y::nat. meet(x, join(x, y)) = x) &
(\<forall> x::nat. \<forall> y::nat. join(x, meet(x, y)) = x) &
(\<forall> x::nat. \<forall> y::nat. \<forall> z::nat. mult(x, join(y, z)) = join(mult(x, y), mult(x, z))) &
(\<forall> x::nat. \<forall> y::nat. \<forall> z::nat. mult(join(x, y), z) = join(mult(x, z), mult(y, z))) &
(\<forall> x::nat. \<forall> y::nat. \<forall> z::nat. meet(x, over(join(mult(x, y), z), y)) = x) &
(\<forall> x::nat. \<forall> y::nat. \<forall> z::nat. meet(y, undr(x, join(mult(x, y), z))) = y) &
(\<forall> x::nat. \<forall> y::nat. \<forall> z::nat. join(mult(over(x, y), y), x) = x) &
(\<forall> x::nat. \<forall> y::nat. \<forall> z::nat. join(mult(y, undr(y, x)), x) = x) &
(\<forall> x::nat. \<forall> y::nat. \<forall> z::nat. over(join(x, y), z) = join(over(x, z), over(y, z))) &
(\<forall> x::nat. \<forall> y::nat. invo(join(x, y)) = meet(invo(x), invo(y))) &
(\<forall> x::nat. \<forall> y::nat. invo(meet(x, y)) = join(invo(x), invo(y))) &
(\<forall> x::nat. invo(invo(x)) = x)
) \<longrightarrow>
(\<forall> x::nat. \<forall> y::nat. \<forall> z::nat. undr(x, join(y, z)) = join(undr(x, y), undr(x, z)))
"
nitpick[card nat=4,timeout=86400]
oops
end


theory T175
imports Main
begin
lemma "(
(\<forall> x::nat. \<forall> y::nat. meet(x, y) = meet(y, x)) &
(\<forall> x::nat. \<forall> y::nat. join(x, y) = join(y, x)) &
(\<forall> x::nat. \<forall> y::nat. \<forall> z::nat. meet(x, meet(y, z)) = meet(meet(x, y), z)) &
(\<forall> x::nat. \<forall> y::nat. \<forall> z::nat. join(x, join(y, z)) = join(join(x, y), z)) &
(\<forall> x::nat. \<forall> y::nat. meet(x, join(x, y)) = x) &
(\<forall> x::nat. \<forall> y::nat. join(x, meet(x, y)) = x) &
(\<forall> x::nat. \<forall> y::nat. \<forall> z::nat. mult(x, join(y, z)) = join(mult(x, y), mult(x, z))) &
(\<forall> x::nat. \<forall> y::nat. \<forall> z::nat. mult(join(x, y), z) = join(mult(x, z), mult(y, z))) &
(\<forall> x::nat. \<forall> y::nat. \<forall> z::nat. meet(x, over(join(mult(x, y), z), y)) = x) &
(\<forall> x::nat. \<forall> y::nat. \<forall> z::nat. meet(y, undr(x, join(mult(x, y), z))) = y) &
(\<forall> x::nat. \<forall> y::nat. \<forall> z::nat. join(mult(over(x, y), y), x) = x) &
(\<forall> x::nat. \<forall> y::nat. \<forall> z::nat. join(mult(y, undr(y, x)), x) = x) &
(\<forall> x::nat. \<forall> y::nat. \<forall> z::nat. mult(x, meet(y, z)) = meet(mult(x, y), mult(x, z))) &
(\<forall> x::nat. \<forall> y::nat. \<forall> z::nat. over(join(x, y), z) = join(over(x, z), over(y, z))) &
(\<forall> x::nat. \<forall> y::nat. \<forall> z::nat. over(x, meet(y, z)) = join(over(x, y), over(x, z))) &
(\<forall> x::nat. \<forall> y::nat. invo(join(x, y)) = meet(invo(x), invo(y))) &
(\<forall> x::nat. \<forall> y::nat. invo(meet(x, y)) = join(invo(x), invo(y))) &
(\<forall> x::nat. invo(invo(x)) = x)
) \<longrightarrow>
(\<forall> x::nat. \<forall> y::nat. \<forall> z::nat. undr(meet(x, y), z) = join(undr(x, z), undr(y, z)))
"
nitpick[card nat=4,timeout=86400]
oops
end


chapter \<open>Arctan Upper and Lower Bounds\<close>

theory Atan_CF_Bounds
imports Bounds_Lemmas
        "HOL-Library.Sum_of_Squares"

begin

text\<open>Covers all bounds used in arctan-upper.ax, arctan-lower.ax and arctan-extended.ax,
excepting only arctan-extended2.ax, which is used in two atan-error-analysis problems.\<close>

section \<open>Upper Bound 1\<close>

definition arctan_upper_11 :: "real \<Rightarrow> real"
  where "arctan_upper_11 \<equiv> \<lambda>x. -(pi/2) - 1/x"

definition diff_delta_arctan_upper_11 :: "real \<Rightarrow> real"
  where "diff_delta_arctan_upper_11 \<equiv> \<lambda>x. 1 / (x^2 * (1 + x^2))"

lemma d_delta_arctan_upper_11_pos: "x \<noteq> 0 \<Longrightarrow> diff_delta_arctan_upper_11 x > 0"
unfolding diff_delta_arctan_upper_11_def
by (simp add: divide_simps zero_less_mult_iff add_pos_pos)

text\<open>Different proof needed here: they coincide not at zero, but at (-) infinity!\<close>

lemma arctan_upper_11:
  assumes "x < 0"
    shows "arctan(x) < arctan_upper_11 x"
proof -
  have "((\<lambda>x. arctan_upper_11 x - arctan x) \<longlongrightarrow> - (pi / 2) - 0 - (- (pi / 2))) at_bot"
    unfolding arctan_upper_11_def
    apply (intro tendsto_intros tendsto_arctan_at_bot, auto simp: ext [OF divide_inverse])
    apply (metis tendsto_inverse_0 at_bot_le_at_infinity tendsto_mono)
    done
  then have *: "((\<lambda>x. arctan_upper_11 x - arctan x) \<longlongrightarrow> 0) at_bot"
    by simp
  have "0 < arctan_upper_11 x - arctan x"
    apply (rule DERIV_pos_imp_increasing_at_bot [OF _ *])
    apply (metis assms d_delta_arctan_upper_11 d_delta_arctan_upper_11_pos not_le)
    done
  then show ?thesis
    by auto
qed

definition arctan_upper_12 :: "real \<Rightarrow> real"
  where "arctan_upper_12 \<equiv> \<lambda>x. 3*x / (x^2 + 3)"

definition diff_delta_arctan_upper_12 :: "real \<Rightarrow> real"
  where "diff_delta_arctan_upper_12 \<equiv> \<lambda>x. -4*x^4 / ((x^2+3)^2 * (1+x^2))"

lemma d_delta_arctan_upper_12:
     "((\<lambda>x. arctan_upper_12 x - arctan x) has_field_derivative diff_delta_arctan_upper_12 x) (at x)"
  unfolding arctan_upper_12_def diff_delta_arctan_upper_12_def
  apply (intro derivative_eq_intros,  simp_all)
  apply (auto simp: divide_simps add_nonneg_eq_0_iff, algebra)
  done

text\<open>Strict inequalities also possible\<close>
lemma arctan_upper_12:
  assumes "x \<le> 0" shows "arctan(x) \<le> arctan_upper_12 x"
apply (rule gen_upper_bound_decreasing [OF assms d_delta_arctan_upper_12])
apply (auto simp: diff_delta_arctan_upper_12_def arctan_upper_12_def)
done

definition arctan_upper_13 :: "real \<Rightarrow> real"
  where "arctan_upper_13 \<equiv> \<lambda>x. x"

definition diff_delta_arctan_upper_13 :: "real \<Rightarrow> real"
  where "diff_delta_arctan_upper_13 \<equiv> \<lambda>x. x^2 / (1 + x^2)"

lemma d_delta_arctan_upper_13:
    "((\<lambda>x. arctan_upper_13 x - arctan x) has_field_derivative diff_delta_arctan_upper_13 x) (at x)"
unfolding arctan_upper_13_def diff_delta_arctan_upper_13_def
apply (intro derivative_eq_intros, simp_all)
apply (simp add: divide_simps add_nonneg_eq_0_iff)
done

lemma arctan_upper_13:
  assumes "x \<ge> 0" shows "arctan(x) \<le> arctan_upper_13 x"
apply (rule gen_upper_bound_increasing [OF assms d_delta_arctan_upper_13])
apply (auto simp: diff_delta_arctan_upper_13_def arctan_upper_13_def)
done

definition arctan_upper_14 :: "real \<Rightarrow> real"
  where "arctan_upper_14 \<equiv> \<lambda>x. pi/2 - 3*x / (1 + 3*x^2)"

definition diff_delta_arctan_upper_14 :: "real \<Rightarrow> real"
  where "diff_delta_arctan_upper_14 \<equiv> \<lambda>x. -4 / ((1 + 3*x^2)^2 * (1+x^2))"

lemma d_delta_arctan_upper_14:
  "((\<lambda>x. arctan_upper_14 x - arctan x) has_field_derivative diff_delta_arctan_upper_14 x) (at x)"
unfolding arctan_upper_14_def diff_delta_arctan_upper_14_def
apply (intro derivative_eq_intros | simp add: add_nonneg_eq_0_iff)+
apply (simp add: divide_simps add_nonneg_eq_0_iff, algebra)
done

lemma d_delta_arctan_upper_14_neg: "diff_delta_arctan_upper_14 x < 0"
unfolding diff_delta_arctan_upper_14_def
apply (auto simp: divide_simps add_nonneg_eq_0_iff zero_less_mult_iff)
using power2_less_0 [of x]
apply arith
done

lemma lim14: "((\<lambda>x::real. 3 * x / (1 + 3 * x\<^sup>2)) \<longlongrightarrow> 0) at_infinity"
  apply (rule tendsto_0_le [where f = inverse and K=1])
  apply (metis tendsto_inverse_0)
  apply (simp add: eventually_at_infinity)
  apply (rule_tac x=1 in exI)
  apply (simp add: power_eq_if abs_if divide_simps add_sign_intros)
  done

text\<open>Different proof needed here: they coincide not at zero, but at (+) infinity!\<close>

lemma arctan_upper_14:
  assumes "x > 0"
    shows "arctan(x) < arctan_upper_14 x"
proof -
  have "((\<lambda>x. arctan_upper_14 x - arctan x) \<longlongrightarrow> pi / 2 - 0 - pi / 2) at_top"
    unfolding arctan_upper_14_def
    apply (intro tendsto_intros tendsto_arctan_at_top)
    apply (auto simp: tendsto_mono [OF at_top_le_at_infinity lim14])
    done
  then have *: "((\<lambda>x. arctan_upper_14 x - arctan x) \<longlongrightarrow> 0) at_top"
    by simp
  have "0 < arctan_upper_14 x - arctan x"
    apply (rule DERIV_neg_imp_decreasing_at_top [OF _ *])
    apply (metis d_delta_arctan_upper_14 d_delta_arctan_upper_14_neg)
    done
  then show ?thesis
    by auto
qed

section \<open>Lower Bound 1\<close>

definition arctan_lower_11 :: "real \<Rightarrow> real"
  where "arctan_lower_11 \<equiv> \<lambda>x. -(pi/2) - 3*x / (1 + 3*x^2)"

lemma arctan_lower_11:
  assumes "x < 0"
    shows "arctan(x) > arctan_lower_11 x"
    using arctan_upper_14 [of "-x"] assms
    by (auto simp: arctan_upper_14_def arctan_lower_11_def arctan_minus)

abbreviation "arctan_lower_12 \<equiv> arctan_upper_13"

lemma arctan_lower_12:
  assumes "x \<le> 0"
    shows "arctan(x) \<ge> arctan_lower_12 x"
    using arctan_upper_13 [of "-x"] assms
    by (auto simp: arctan_upper_13_def arctan_minus)

abbreviation "arctan_lower_13 \<equiv> arctan_upper_12"

lemma arctan_lower_13:
  assumes "x \<ge> 0"
    shows "arctan(x) \<ge> arctan_lower_13 x"
    using arctan_upper_12 [of "-x"] assms
    by (auto simp: arctan_upper_12_def arctan_minus)

definition arctan_lower_14 :: "real \<Rightarrow> real"
  where "arctan_lower_14 \<equiv> \<lambda>x. pi/2 - 1/x"

lemma arctan_lower_14:
  assumes "x > 0"
    shows "arctan(x) > arctan_lower_14 x"
    using arctan_upper_11 [of "-x"] assms
    by (auto simp: arctan_upper_11_def arctan_lower_14_def arctan_minus)

section \<open>Upper Bound 3\<close>

definition arctan_upper_31 :: "real \<Rightarrow> real"
  where "arctan_upper_31 \<equiv> \<lambda>x. -(pi/2) - (64 + 735*x^2 + 945*x^4) / (15*x*(15 + 70*x^2 + 63*x^4))"

definition diff_delta_arctan_upper_31 :: "real \<Rightarrow> real"
  where "diff_delta_arctan_upper_31 \<equiv> \<lambda>x. 64 / (x^2 * (15 + 70*x^2 + 63*x^4)^2 * (1 + x^2))"

lemma d_delta_arctan_upper_31:
  assumes "x \<noteq> 0"
    shows "((\<lambda>x. arctan_upper_31 x - arctan x) has_field_derivative diff_delta_arctan_upper_31 x) (at x)"
  unfolding arctan_upper_31_def diff_delta_arctan_upper_31_def
  using assms
  apply (intro derivative_eq_intros)
  apply (rule refl | simp add: add_nonneg_eq_0_iff)+
  apply (simp add: divide_simps add_nonneg_eq_0_iff, algebra)
  done

lemma d_delta_arctan_upper_31_pos: "x \<noteq> 0 \<Longrightarrow> diff_delta_arctan_upper_31 x > 0"
unfolding diff_delta_arctan_upper_31_def
by (auto simp: divide_simps zero_less_mult_iff add_pos_pos add_nonneg_eq_0_iff)

lemma arctan_upper_31:
  assumes "x < 0"
    shows "arctan(x) < arctan_upper_31 x"
proof -
  have *: "\<And>x::real.  (15 + 70 * x\<^sup>2 + 63 * x ^ 4) > 0"
    by (sos "((R<1 + ((R<1 * ((R<7/8 * [19/7*x^2 + 1]^2) + ((R<4 * [x]^2) + (R<10/7 * [x^2]^2)))) + ((A<=0 * R<1) * (R<1/8 * [1]^2)))))")
  then have **: "\<And>x::real. \<not> (15 + 70 * x\<^sup>2 + 63 * x ^ 4) < 0"
    by (simp add: not_less)
  have "((\<lambda>x::real. (64 + 735 * x\<^sup>2 + 945 * x ^ 4) / (15 * x * (15 + 70 * x\<^sup>2 + 63 * x ^ 4))) \<longlongrightarrow> 0) at_bot"
    apply (rule tendsto_0_le [where f = inverse and K=2])
    apply (metis at_bot_le_at_infinity tendsto_inverse_0 tendsto_mono)
    apply (simp add: eventually_at_bot_linorder)
    apply (rule_tac x="-1" in exI)
    apply (auto simp: divide_simps abs_if zero_less_mult_iff **)
    done
  then have "((\<lambda>x. arctan_upper_31 x - arctan x) \<longlongrightarrow> - (pi / 2) - 0 - (- (pi / 2))) at_bot"
    unfolding arctan_upper_31_def
    apply (intro tendsto_intros tendsto_arctan_at_bot, auto)
    done
  then have *: "((\<lambda>x. arctan_upper_31 x - arctan x) \<longlongrightarrow> 0) at_bot"
    by simp
  have "0 < arctan_upper_31 x - arctan x"
    apply (rule DERIV_pos_imp_increasing_at_bot [OF _ *])
    apply (metis assms d_delta_arctan_upper_31 d_delta_arctan_upper_31_pos not_le)
    done
  then show ?thesis
    by auto
qed

definition arctan_upper_32 :: "real \<Rightarrow> real"
  where "arctan_upper_32 \<equiv> \<lambda>x. 7*(33*x^4 + 170*x^2 + 165)*x / (5*(5*x^6 + 105*x^4 + 315*x^2 + 231))"

definition diff_delta_arctan_upper_32 :: "real \<Rightarrow> real"
  where "diff_delta_arctan_upper_32 \<equiv> \<lambda>x. -256*x^12 / ((5*x^6+105*x^4+315*x^2+231)^2*(1+x^2))"

lemma d_delta_arctan_upper_32:
    "((\<lambda>x. arctan_upper_32 x - arctan x) has_field_derivative diff_delta_arctan_upper_32 x) (at x)"
    unfolding arctan_upper_32_def diff_delta_arctan_upper_32_def
    apply (intro derivative_eq_intros | simp)+
    apply simp_all
    apply (auto simp: add_nonneg_eq_0_iff divide_simps, algebra)
    done

lemma arctan_upper_32:
  assumes "x \<le> 0" shows "arctan(x) \<le> arctan_upper_32 x"
apply (rule gen_upper_bound_decreasing [OF assms d_delta_arctan_upper_32])
apply (auto simp: diff_delta_arctan_upper_32_def arctan_upper_32_def)
done

definition arctan_upper_33 :: "real \<Rightarrow> real"
  where "arctan_upper_33 \<equiv> \<lambda>x. (64*x^4+735*x^2+945)*x / (15*(15*x^4+70*x^2+63))"

definition diff_delta_arctan_upper_33 :: "real \<Rightarrow> real"
  where "diff_delta_arctan_upper_33 \<equiv> \<lambda>x. 64*x^10 / ((15*x^4+70*x^2+63)^2*(1+x^2))"

lemma d_delta_arctan_upper_33:
    "((\<lambda>x. arctan_upper_33 x - arctan x) has_field_derivative diff_delta_arctan_upper_33 x) (at x)"
unfolding arctan_upper_33_def diff_delta_arctan_upper_33_def
apply (intro derivative_eq_intros, simp_all)
apply (auto simp: add_nonneg_eq_0_iff divide_simps, algebra)
done

lemma arctan_upper_33:
  assumes "x \<ge> 0" shows "arctan(x) \<le> arctan_upper_33 x"
apply (rule gen_upper_bound_increasing [OF assms d_delta_arctan_upper_33])
apply (auto simp: diff_delta_arctan_upper_33_def arctan_upper_33_def)
done

definition arctan_upper_34 :: "real \<Rightarrow> real"
  where "arctan_upper_34 \<equiv>
         \<lambda>x. pi/2 - (33 + 170*x^2 + 165*x^4)*7*x / (5*(5 + 105*x^2 + 315*x^4 + 231*x^6))"

definition diff_delta_arctan_upper_34 :: "real \<Rightarrow> real"
  where "diff_delta_arctan_upper_34 \<equiv> \<lambda>x. -256 / ((5+105*x^2+315*x^4+231*x^6)^2*(1+x^2))"

lemma d_delta_arctan_upper_34:
  "((\<lambda>x. arctan_upper_34 x - arctan x) has_field_derivative diff_delta_arctan_upper_34 x) (at x)"
unfolding arctan_upper_34_def diff_delta_arctan_upper_34_def
apply (intro derivative_eq_intros | simp add: add_nonneg_eq_0_iff)+
apply (simp add: divide_simps add_nonneg_eq_0_iff, algebra)
done

lemma d_delta_arctan_upper_34_pos: "diff_delta_arctan_upper_34 x < 0"
unfolding diff_delta_arctan_upper_34_def
apply (simp add: divide_simps add_nonneg_eq_0_iff zero_less_mult_iff)
using power2_less_0 [of x]
apply arith
done

lemma arctan_upper_34:
  assumes "x > 0"
    shows "arctan(x) < arctan_upper_34 x"
proof -
  have "((\<lambda>x. arctan_upper_34 x - arctan x) \<longlongrightarrow> pi / 2 - 0 - pi / 2) at_top"
    unfolding arctan_upper_34_def
    apply (intro tendsto_intros tendsto_arctan_at_top, auto)
    apply (rule tendsto_0_le [where f = inverse and K=1])
    apply (metis tendsto_inverse_0 at_top_le_at_infinity tendsto_mono)
    apply (simp add: eventually_at_top_linorder)
    apply (rule_tac x=1 in exI)
    apply (auto simp: divide_simps power_eq_if add_pos_pos algebra_simps)
    done
  then have *: "((\<lambda>x. arctan_upper_34 x - arctan x) \<longlongrightarrow> 0) at_top"
    by simp
  have "0 < arctan_upper_34 x - arctan x"
    apply (rule DERIV_neg_imp_decreasing_at_top [OF _ *])
    apply (metis d_delta_arctan_upper_34 d_delta_arctan_upper_34_pos)
    done
  then show ?thesis
    by auto
qed

section \<open>Lower Bound 3\<close>

definition arctan_lower_31 :: "real \<Rightarrow> real"
  where "arctan_lower_31 \<equiv> \<lambda>x. -(pi/2) - (33 + 170*x^2 + 165*x^4)*7*x / (5*(5 + 105*x^2 + 315*x^4 + 231*x^6))"

lemma arctan_lower_31:
  assumes "x < 0"
    shows "arctan(x) > arctan_lower_31 x"
    using arctan_upper_34 [of "-x"] assms
    by (auto simp: arctan_upper_34_def arctan_lower_31_def arctan_minus)

abbreviation "arctan_lower_32 \<equiv> arctan_upper_33"

lemma arctan_lower_32:
  assumes "x \<le> 0"
    shows "arctan(x) \<ge> arctan_lower_32 x"
    using arctan_upper_33 [of "-x"] assms
    by (auto simp: arctan_upper_33_def arctan_minus)

abbreviation "arctan_lower_33 \<equiv> arctan_upper_32"

lemma arctan_lower_33:
  assumes "x \<ge> 0"
    shows "arctan(x) \<ge> arctan_lower_33 x"
    using arctan_upper_32 [of "-x"] assms
    by (auto simp: arctan_upper_32_def arctan_minus)

definition arctan_lower_34 :: "real \<Rightarrow> real"
  where "arctan_lower_34 \<equiv> \<lambda>x. pi/2 - (64 + 735*x^2 + 945*x^4) / (15*x*(15 + 70*x^2 + 63*x^4))"

lemma arctan_lower_34:
  assumes "x > 0"
    shows "arctan(x) > arctan_lower_34 x"
    using arctan_upper_31 [of "-x"] assms
    by (auto simp: arctan_upper_31_def arctan_lower_34_def arctan_minus)

section \<open>Upper Bound 4\<close>

definition arctan_upper_41 :: "real \<Rightarrow> real"
  where "arctan_upper_41 \<equiv>
        \<lambda>x. -(pi/2) - (256 + 5943*x^2 + 19250*x^4 + 15015*x^6) /
               (35*x*(35 + 315*x^2 + 693*x^4 + 429*x^6))"

definition diff_delta_arctan_upper_41 :: "real \<Rightarrow> real"
  where "diff_delta_arctan_upper_41 \<equiv> \<lambda>x. 256 / (x^2*(35+315*x^2+693*x^4+429*x^6)^2*(1+x^2))"

lemma d_delta_arctan_upper_41:
  assumes "x \<noteq> 0"
    shows "((\<lambda>x. arctan_upper_41 x - arctan x) has_field_derivative diff_delta_arctan_upper_41 x) (at x)"
  unfolding arctan_upper_41_def diff_delta_arctan_upper_41_def
  using assms
  apply (intro derivative_eq_intros)
  apply (rule refl | simp add: add_nonneg_eq_0_iff)+
  apply (simp add: divide_simps add_nonneg_eq_0_iff, algebra)
  done

lemma d_delta_arctan_upper_41_pos: "x \<noteq> 0 \<Longrightarrow> diff_delta_arctan_upper_41 x > 0"
unfolding diff_delta_arctan_upper_41_def
by (auto simp: zero_less_mult_iff add_pos_pos add_nonneg_eq_0_iff)

lemma arctan_upper_41:
  assumes "x < 0"
    shows "arctan(x) < arctan_upper_41 x"
proof -
  have *: "\<And>x::real. (35 + 315 * x\<^sup>2 + 693 * x ^ 4 + 429 * x ^ 6) > 0"
    by (sos "((R<1 + ((R<1 * ((R<13/8589934592 * [95/26*x^2 + 1]^2) + ((R<38654705675/4294967296 * [170080704731/154618822700*x^3 + x]^2) + ((R<14271/446676598784 * [x^2]^2) + (R<3631584276674589067439/2656331147370089676800 * [x^3]^2))))) + ((A<=0 * R<1) * (R<245426703/8589934592 * [1]^2)))))")
  then have **: "\<And>x::real. x < 0 \<Longrightarrow> \<not> (35 + 315 * x\<^sup>2 + 693 * x ^ 4 + 429 * x ^ 6) < 0"
    by (simp add: not_less)
  have "((\<lambda>x::real. (256 + 5943 * x\<^sup>2 + 19250 * x ^ 4 + 15015 * x ^ 6) /
           (35 * x * (35 + 315 * x\<^sup>2 + 693 * x ^ 4 + 429 * x ^ 6))) \<longlongrightarrow> 0) at_bot"
    apply (rule tendsto_0_le [where f = inverse and K=2])
    apply (metis at_bot_le_at_infinity tendsto_inverse_0 tendsto_mono)
    apply (simp add: eventually_at_bot_linorder)
    apply (rule_tac x="-1" in exI)
    apply (auto simp: ** abs_if divide_simps zero_less_mult_iff)
    done
  then have "((\<lambda>x. arctan_upper_41 x - arctan x) \<longlongrightarrow> - (pi / 2) - 0 - (- (pi / 2))) at_bot"
    unfolding arctan_upper_41_def
    apply (intro tendsto_intros tendsto_arctan_at_bot, auto)
    done
  then have *: "((\<lambda>x. arctan_upper_41 x - arctan x) \<longlongrightarrow> 0) at_bot"
    by simp
  have "0 < arctan_upper_41 x - arctan x"
    apply (rule DERIV_pos_imp_increasing_at_bot [OF _ *])
    apply (metis assms d_delta_arctan_upper_41 d_delta_arctan_upper_41_pos not_le)
    done
  then show ?thesis
    by auto
qed

definition arctan_upper_42 :: "real \<Rightarrow> real"
  where "arctan_upper_42 \<equiv>
          \<lambda>x. (15159*x^6+147455*x^4+345345*x^2+225225)*x / (35*(35*x^8+1260*x^6+6930*x^4+12012*x^2+6435))"

definition diff_delta_arctan_upper_42 :: "real \<Rightarrow> real"
  where "diff_delta_arctan_upper_42 \<equiv>
            \<lambda>x. -16384*x^16 / ((35*x^8+1260*x^6+6930*x^4+12012*x^2+6435)^2*(1+x^2))"

lemma d_delta_arctan_upper_42:
    "((\<lambda>x. arctan_upper_42 x - arctan x) has_field_derivative diff_delta_arctan_upper_42 x) (at x)"
    unfolding arctan_upper_42_def diff_delta_arctan_upper_42_def
    apply (intro derivative_eq_intros, simp_all)
    apply (auto simp: divide_simps add_nonneg_eq_0_iff, algebra)
    done

lemma arctan_upper_42:
  assumes "x \<le> 0" shows "arctan(x) \<le> arctan_upper_42 x"
apply (rule gen_upper_bound_decreasing [OF assms d_delta_arctan_upper_42])
apply (auto simp: diff_delta_arctan_upper_42_def arctan_upper_42_def)
done

definition arctan_upper_43 :: "real \<Rightarrow> real"
  where "arctan_upper_43 \<equiv>
          \<lambda>x. (256*x^6+5943*x^4+19250*x^2+15015)*x /
              (35 * (35*x^6+315*x^4+693*x^2+429))"

definition diff_delta_arctan_upper_43 :: "real \<Rightarrow> real"
  where "diff_delta_arctan_upper_43 \<equiv> \<lambda>x. 256*x^14 / ((35*x^6+315*x^4+693*x^2+429)^2*(1+x^2))"

lemma d_delta_arctan_upper_43:
    "((\<lambda>x. arctan_upper_43 x - arctan x) has_field_derivative diff_delta_arctan_upper_43 x) (at x)"
unfolding arctan_upper_43_def diff_delta_arctan_upper_43_def
apply (intro derivative_eq_intros, simp_all)
apply (auto simp: add_nonneg_eq_0_iff divide_simps, algebra)
done

lemma arctan_upper_43:
  assumes "x \<ge> 0" shows "arctan(x) \<le> arctan_upper_43 x"
apply (rule gen_upper_bound_increasing [OF assms d_delta_arctan_upper_43])
apply (auto simp: diff_delta_arctan_upper_43_def arctan_upper_43_def)
done

definition arctan_upper_44 :: "real \<Rightarrow> real"
  where "arctan_upper_44 \<equiv>
         \<lambda>x. pi/2 - (15159+147455*x^2+345345*x^4+225225*x^6)*x /
                 (35*(35+1260*x^2+6930*x^4+12012*x^6+6435*x^8))"

definition diff_delta_arctan_upper_44 :: "real \<Rightarrow> real"
  where "diff_delta_arctan_upper_44 \<equiv>
    \<lambda>x. -16384 / ((35+1260*x^2+6930*x^4+12012*x^6+6435*x^8)^2*(1+x^2))"

lemma d_delta_arctan_upper_44:
  "((\<lambda>x. arctan_upper_44 x - arctan x) has_field_derivative diff_delta_arctan_upper_44 x) (at x)"
unfolding arctan_upper_44_def diff_delta_arctan_upper_44_def
apply (intro derivative_eq_intros | simp add: add_nonneg_eq_0_iff)+
apply (simp add: divide_simps add_nonneg_eq_0_iff, algebra)
done

lemma d_delta_arctan_upper_44_pos: "diff_delta_arctan_upper_44 x < 0"
unfolding diff_delta_arctan_upper_44_def
apply (auto simp: divide_simps add_nonneg_eq_0_iff zero_less_mult_iff)
using power2_less_0 [of x]
apply arith
done

lemma arctan_upper_44:
  assumes "x > 0"
    shows "arctan(x) < arctan_upper_44 x"
proof -
  have "((\<lambda>x. arctan_upper_44 x - arctan x) \<longlongrightarrow> pi / 2 - 0 - pi / 2) at_top"
    unfolding arctan_upper_44_def
    apply (intro tendsto_intros tendsto_arctan_at_top, auto)
    apply (rule tendsto_0_le [where f = inverse and K=1])
    apply (metis tendsto_inverse_0 at_top_le_at_infinity tendsto_mono)
    apply (simp add: eventually_at_top_linorder)
    apply (rule_tac x=1 in exI)
    apply (auto simp: zero_le_mult_iff divide_simps not_le[symmetric] power_eq_if algebra_simps)
    done
  then have *: "((\<lambda>x. arctan_upper_44 x - arctan x) \<longlongrightarrow> 0) at_top"
    by simp
  have "0 < arctan_upper_44 x - arctan x"
    apply (rule DERIV_neg_imp_decreasing_at_top [OF _ *])
    apply (metis d_delta_arctan_upper_44 d_delta_arctan_upper_44_pos)
    done
  then show ?thesis
    by auto
qed

section \<open>Lower Bound 4\<close>

definition arctan_lower_41 :: "real \<Rightarrow> real"
  where "arctan_lower_41 \<equiv>
     \<lambda>x. -(pi/2) - (15159+147455*x^2+345345*x^4+225225*x^6)*x /
                   (35*(35+1260*x^2+6930*x^4+12012*x^6+6435*x^8))"

lemma arctan_lower_41:
  assumes "x < 0"
    shows "arctan(x) > arctan_lower_41 x"
    using arctan_upper_44 [of "-x"] assms
    by (auto simp: arctan_upper_44_def arctan_lower_41_def arctan_minus)

abbreviation "arctan_lower_42 \<equiv> arctan_upper_43"

lemma arctan_lower_42:
  assumes "x \<le> 0"
    shows "arctan(x) \<ge> arctan_lower_42 x"
    using arctan_upper_43 [of "-x"] assms
    by (auto simp: arctan_upper_43_def arctan_minus)

abbreviation "arctan_lower_43 \<equiv> arctan_upper_42"

lemma arctan_lower_43:
  assumes "x \<ge> 0"
    shows "arctan(x) \<ge> arctan_lower_43 x"
    using arctan_upper_42 [of "-x"] assms
    by (auto simp: arctan_upper_42_def arctan_minus)

definition arctan_lower_44 :: "real \<Rightarrow> real"
  where "arctan_lower_44 \<equiv>
    \<lambda>x. pi/2 - (256+5943*x^2+19250*x^4+15015*x^6) /
               (35*x*(35+315*x^2+693*x^4+429*x^6))"

lemma arctan_lower_44:
  assumes "x > 0"
    shows "arctan(x) > arctan_lower_44 x"
    using arctan_upper_41 [of "-x"] assms
    by (auto simp: arctan_upper_41_def arctan_lower_44_def arctan_minus)

end


theory Positions
  imports Lexer LexicalVals
begin

section \<open>An alternative definition for POSIX values by Okui \& Suzuki\<close>

section \<open>Positions in Values\<close>

fun
  at :: "'a val \<Rightarrow> nat list \<Rightarrow> 'a val"
where
  "at v [] = v"
| "at (Left v) (0#ps)= at v ps"
| "at (Right v) (Suc 0#ps)= at v ps"
| "at (Seq v1 v2) (0#ps)= at v1 ps"
| "at (Seq v1 v2) (Suc 0#ps)= at v2 ps"
| "at (Stars vs) (n#ps)= at (nth vs n) ps"

fun Pos :: "'a val \<Rightarrow> (nat list) set"
where
  "Pos (Void) = {[]}"
| "Pos (Atm c) = {[]}"
| "Pos (Left v) = {[]} \<union> {0#ps | ps. ps \<in> Pos v}"
| "Pos (Right v) = {[]} \<union> {1#ps | ps. ps \<in> Pos v}"
| "Pos (Seq v1 v2) = {[]} \<union> {0#ps | ps. ps \<in> Pos v1} \<union> {1#ps | ps. ps \<in> Pos v2}"
| "Pos (Stars []) = {[]}"
| "Pos (Stars (v#vs)) = {[]} \<union> {0#ps | ps. ps \<in> Pos v} \<union> {Suc n#ps | n ps. n#ps \<in> Pos (Stars vs)}"

lemma Pos_stars:
  "Pos (Stars vs) = {[]} \<union> (\<Union>n < length vs. {n#ps | ps. ps \<in> Pos (vs ! n)})"
apply(induct vs)
apply(auto simp add: insert_ident less_Suc_eq_0_disj)
done

lemma Pos_empty:
  shows "[] \<in> Pos v"
by (induct v rule: Pos.induct)(auto)

abbreviation
  "intlen vs \<equiv> int (length vs)"

definition pflat_len :: "'a val \<Rightarrow> nat list => int"
where
  "pflat_len v p \<equiv> (if p \<in> Pos v then intlen (flat (at v p)) else -1)"

lemma pflat_len_simps:
  shows "pflat_len (Seq v1 v2) (0#p) = pflat_len v1 p"
  and   "pflat_len (Seq v1 v2) (Suc 0#p) = pflat_len v2 p"
  and   "pflat_len (Left v) (0#p) = pflat_len v p"
  and   "pflat_len (Left v) (Suc 0#p) = -1"
  and   "pflat_len (Right v) (Suc 0#p) = pflat_len v p"
  and   "pflat_len (Right v) (0#p) = -1"
  and   "pflat_len (Stars (v#vs)) (Suc n#p) = pflat_len (Stars vs) (n#p)"
  and   "pflat_len (Stars (v#vs)) (0#p) = pflat_len v p"
  and   "pflat_len v [] = intlen (flat v)"
by (auto simp add: pflat_len_def Pos_empty)

lemma pflat_len_Stars_simps:
  assumes "n < length vs"
  shows "pflat_len (Stars vs) (n#p) = pflat_len (vs!n) p"
using assms
apply(induct vs arbitrary: n p)
apply(auto simp add: less_Suc_eq_0_disj pflat_len_simps)
done

lemma pflat_len_outside:
  assumes "p \<notin> Pos v1"
  shows "pflat_len v1 p = -1 "
using assms by (simp add: pflat_len_def)

section \<open>Orderings\<close>

definition prefix_list:: "'a list \<Rightarrow> 'a list \<Rightarrow> bool" ("_ \<sqsubseteq>pre _" [60,59] 60)
where
  "ps1 \<sqsubseteq>pre ps2 \<equiv> \<exists>ps'. ps1 @ps' = ps2"

definition sprefix_list:: "'a list \<Rightarrow> 'a list \<Rightarrow> bool" ("_ \<sqsubset>spre _" [60,59] 60)
where
  "ps1 \<sqsubset>spre ps2 \<equiv> ps1 \<sqsubseteq>pre ps2 \<and> ps1 \<noteq> ps2"

inductive lex_list :: "nat list \<Rightarrow> nat list \<Rightarrow> bool" ("_ \<sqsubset>lex _" [60,59] 60)
where
  "[] \<sqsubset>lex (p#ps)"
| "ps1 \<sqsubset>lex ps2 \<Longrightarrow> (p#ps1) \<sqsubset>lex (p#ps2)"
| "p1 < p2 \<Longrightarrow> (p1#ps1) \<sqsubset>lex (p2#ps2)"

lemma lex_irrfl:
  fixes ps1 ps2 :: "nat list"
  assumes "ps1 \<sqsubset>lex ps2"
  shows "ps1 \<noteq> ps2"
using assms
by(induct rule: lex_list.induct)(auto)

lemma lex_simps [simp]:
  fixes xs ys :: "nat list"
  shows "[] \<sqsubset>lex ys \<longleftrightarrow> ys \<noteq> []"
  and   "xs \<sqsubset>lex [] \<longleftrightarrow> False"
  and   "(x # xs) \<sqsubset>lex (y # ys) \<longleftrightarrow> (x < y \<or> (x = y \<and> xs \<sqsubset>lex ys))"
by (auto simp add: neq_Nil_conv elim: lex_list.cases intro: lex_list.intros)

lemma lex_trans:
  fixes ps1 ps2 ps3 :: "nat list"
  assumes "ps1 \<sqsubset>lex ps2" "ps2 \<sqsubset>lex ps3"
  shows "ps1 \<sqsubset>lex ps3"
using assms
by (induct arbitrary: ps3 rule: lex_list.induct)
   (auto elim: lex_list.cases)

lemma lex_trichotomous:
  fixes p q :: "nat list"
  shows "p = q \<or> p \<sqsubset>lex q \<or> q \<sqsubset>lex p"
apply(induct p arbitrary: q)
apply(auto elim: lex_list.cases)
apply(case_tac q)
apply(auto)
done

section \<open>POSIX Ordering of Values According to Okui \& Suzuki\<close>

definition PosOrd:: "'a val \<Rightarrow> nat list \<Rightarrow> 'a val \<Rightarrow> bool" ("_ \<sqsubset>val _ _" [60, 60, 59] 60)
where
  "v1 \<sqsubset>val p v2 \<equiv> pflat_len v1 p > pflat_len v2 p \<and>
                   (\<forall>q \<in> Pos v1 \<union> Pos v2. q \<sqsubset>lex p \<longrightarrow> pflat_len v1 q = pflat_len v2 q)"

lemma PosOrd_def2:
  shows "v1 \<sqsubset>val p v2 \<longleftrightarrow>
         pflat_len v1 p > pflat_len v2 p \<and>
         (\<forall>q \<in> Pos v1. q \<sqsubset>lex p \<longrightarrow> pflat_len v1 q = pflat_len v2 q) \<and>
         (\<forall>q \<in> Pos v2. q \<sqsubset>lex p \<longrightarrow> pflat_len v1 q = pflat_len v2 q)"
unfolding PosOrd_def
apply(auto)
done

definition PosOrd_ex:: "'a val \<Rightarrow> 'a val \<Rightarrow> bool" ("_ :\<sqsubset>val _" [60, 59] 60)
where
  "v1 :\<sqsubset>val v2 \<equiv> \<exists>p. v1 \<sqsubset>val p v2"

definition PosOrd_ex_eq:: "'a val \<Rightarrow> 'a val \<Rightarrow> bool" ("_ :\<sqsubseteq>val _" [60, 59] 60)
where
  "v1 :\<sqsubseteq>val v2 \<equiv> v1 :\<sqsubset>val v2 \<or> v1 = v2"

lemma PosOrd_trans:
  assumes "v1 :\<sqsubset>val v2" "v2 :\<sqsubset>val v3"
  shows "v1 :\<sqsubset>val v3"
proof -
  from assms obtain p p'
    where as: "v1 \<sqsubset>val p v2" "v2 \<sqsubset>val p' v3" unfolding PosOrd_ex_def by blast
  then have pos: "p \<in> Pos v1" "p' \<in> Pos v2" unfolding PosOrd_def pflat_len_def
    by (smt not_int_zless_negative)+
  have "p = p' \<or> p \<sqsubset>lex p' \<or> p' \<sqsubset>lex p"
    by (rule lex_trichotomous)
  moreover
    { assume "p = p'"
      with as have "v1 \<sqsubset>val p v3" unfolding PosOrd_def pflat_len_def
      by (smt Un_iff)
      then have " v1 :\<sqsubset>val v3" unfolding PosOrd_ex_def by blast
    }
  moreover
    { assume "p \<sqsubset>lex p'"
      with as have "v1 \<sqsubset>val p v3" unfolding PosOrd_def pflat_len_def
      by (smt Un_iff lex_trans)
      then have " v1 :\<sqsubset>val v3" unfolding PosOrd_ex_def by blast
    }
  moreover
    { assume "p' \<sqsubset>lex p"
      with as have "v1 \<sqsubset>val p' v3" unfolding PosOrd_def
      by (smt Un_iff lex_trans pflat_len_def)
      then have "v1 :\<sqsubset>val v3" unfolding PosOrd_ex_def by blast
    }
  ultimately show "v1 :\<sqsubset>val v3" by blast
qed

lemma PosOrd_irrefl:
  assumes "v :\<sqsubset>val v"
  shows "False"
using assms unfolding PosOrd_ex_def PosOrd_def
by auto

lemma PosOrd_assym:
  assumes "v1 :\<sqsubset>val v2"
  shows "\<not>(v2 :\<sqsubset>val v1)"
using assms
using PosOrd_irrefl PosOrd_trans by blast

(*
  :\<sqsubseteq>val and :\<sqsubset>val are partial orders.
*)

lemma PosOrd_ordering:
  shows "ordering (\<lambda>v1 v2. v1 :\<sqsubseteq>val v2) (\<lambda> v1 v2. v1 :\<sqsubset>val v2)"
unfolding ordering_def PosOrd_ex_eq_def
apply(auto)
using PosOrd_trans partial_preordering_def apply blast
using PosOrd_assym ordering_axioms_def by blast

lemma PosOrd_order:
  shows "class.order (\<lambda>v1 v2. v1 :\<sqsubseteq>val v2) (\<lambda> v1 v2. v1 :\<sqsubset>val v2)"
  using PosOrd_ordering
  apply(simp add: class.order_def class.preorder_def class.order_axioms_def)
  by (smt (verit) PosOrd_ex_eq_def PosOrd_irrefl PosOrd_trans)

lemma PosOrd_ex_eq2:
  shows "v1 :\<sqsubset>val v2 \<longleftrightarrow> (v1 :\<sqsubseteq>val v2 \<and> v1 \<noteq> v2)"
  using PosOrd_ordering
  using PosOrd_ex_eq_def PosOrd_irrefl by blast

lemma PosOrdeq_trans:
  assumes "v1 :\<sqsubseteq>val v2" "v2 :\<sqsubseteq>val v3"
  shows "v1 :\<sqsubseteq>val v3"
using assms PosOrd_ordering
  unfolding ordering_def
  by (metis partial_preordering.trans)

lemma PosOrdeq_antisym:
  assumes "v1 :\<sqsubseteq>val v2" "v2 :\<sqsubseteq>val v1"
  shows "v1 = v2"
using assms PosOrd_ordering
  by (metis ordering.eq_iff)

lemma PosOrdeq_refl:
  shows "v :\<sqsubseteq>val v"
unfolding PosOrd_ex_eq_def
by auto

lemma PosOrd_shorterE:
  assumes "v1 :\<sqsubset>val v2"
  shows "length (flat v2) \<le> length (flat v1)"
using assms unfolding PosOrd_ex_def PosOrd_def
apply(auto)
apply(case_tac p)
apply(simp add: pflat_len_simps)
apply(drule_tac x="[]" in bspec)
apply(simp add: Pos_empty)
apply(simp add: pflat_len_simps)
done

lemma PosOrd_shorterI:
  assumes "length (flat v2) < length (flat v1)"
  shows "v1 :\<sqsubset>val v2"
unfolding PosOrd_ex_def PosOrd_def pflat_len_def
using assms Pos_empty by force

lemma PosOrd_spreI:
  assumes "flat v' \<sqsubset>spre flat v"
  shows "v :\<sqsubset>val v'"
using assms
apply(rule_tac PosOrd_shorterI)
unfolding prefix_list_def sprefix_list_def
by (metis append_Nil2 append_eq_conv_conj drop_all le_less_linear)

lemma pflat_len_inside:
  assumes "pflat_len v2 p < pflat_len v1 p"
  shows "p \<in> Pos v1"
using assms
unfolding pflat_len_def
by (auto split: if_splits)

lemma PosOrd_Left_Right:
  assumes "flat v1 = flat v2"
  shows "Left v1 :\<sqsubset>val Right v2"
unfolding PosOrd_ex_def
apply(rule_tac x="[0]" in exI)
apply(auto simp add: PosOrd_def pflat_len_simps assms)
done

lemma PosOrd_LeftE:
  assumes "Left v1 :\<sqsubset>val Left v2" "flat v1 = flat v2"
  shows "v1 :\<sqsubset>val v2"
using assms
unfolding PosOrd_ex_def PosOrd_def2
apply(auto simp add: pflat_len_simps)
apply(frule pflat_len_inside)
apply(auto simp add: pflat_len_simps)
by (metis lex_simps(3) pflat_len_simps(3))

lemma PosOrd_LeftI:
  assumes "v1 :\<sqsubset>val v2" "flat v1 = flat v2"
  shows  "Left v1 :\<sqsubset>val Left v2"
using assms
unfolding PosOrd_ex_def PosOrd_def2
apply(auto simp add: pflat_len_simps)
by (metis less_numeral_extra(3) lex_simps(3) pflat_len_simps(3))

lemma PosOrd_Left_eq:
  assumes "flat v1 = flat v2"
  shows "Left v1 :\<sqsubset>val Left v2 \<longleftrightarrow> v1 :\<sqsubset>val v2"
using assms PosOrd_LeftE PosOrd_LeftI
by blast

lemma PosOrd_RightE:
  assumes "Right v1 :\<sqsubset>val Right v2" "flat v1 = flat v2"
  shows "v1 :\<sqsubset>val v2"
using assms
unfolding PosOrd_ex_def PosOrd_def2
apply(auto simp add: pflat_len_simps)
apply(frule pflat_len_inside)
apply(auto simp add: pflat_len_simps)
by (metis lex_simps(3) pflat_len_simps(5))

lemma PosOrd_RightI:
  assumes "v1 :\<sqsubset>val v2" "flat v1 = flat v2"
  shows  "Right v1 :\<sqsubset>val Right v2"
using assms
unfolding PosOrd_ex_def PosOrd_def2
apply(auto simp add: pflat_len_simps)
by (metis lex_simps(3) nat_neq_iff pflat_len_simps(5))

lemma PosOrd_Right_eq:
  assumes "flat v1 = flat v2"
  shows "Right v1 :\<sqsubset>val Right v2 \<longleftrightarrow> v1 :\<sqsubset>val v2"
using assms PosOrd_RightE PosOrd_RightI
by blast

lemma PosOrd_SeqI1:
  assumes "v1 :\<sqsubset>val w1" "flat (Seq v1 v2) = flat (Seq w1 w2)"
  shows "Seq v1 v2 :\<sqsubset>val Seq w1 w2"
using assms(1)
apply(subst (asm) PosOrd_ex_def)
apply(subst (asm) PosOrd_def)
apply(clarify)
apply(subst PosOrd_ex_def)
apply(rule_tac x="0#p" in exI)
apply(subst PosOrd_def)
apply(rule conjI)
apply(simp add: pflat_len_simps)
apply(rule ballI)
apply(rule impI)
apply(simp only: Pos.simps)
apply(auto)[1]
apply(simp add: pflat_len_simps)
apply(auto simp add: pflat_len_simps)
using assms(2)
apply(simp)
apply(metis length_append of_nat_add)
done

lemma PosOrd_SeqI2:
  assumes "v2 :\<sqsubset>val w2" "flat v2 = flat w2"
  shows "Seq v v2 :\<sqsubset>val Seq v w2"
using assms(1)
apply(subst (asm) PosOrd_ex_def)
apply(subst (asm) PosOrd_def)
apply(clarify)
apply(subst PosOrd_ex_def)
apply(rule_tac x="Suc 0#p" in exI)
apply(subst PosOrd_def)
apply(rule conjI)
apply(simp add: pflat_len_simps)
apply(rule ballI)
apply(rule impI)
apply(simp only: Pos.simps)
apply(auto)[1]
apply(simp add: pflat_len_simps)
using assms(2)
apply(simp)
apply(auto simp add: pflat_len_simps)
done

lemma PosOrd_Seq_eq:
  assumes "flat v2 = flat w2"
  shows "(Seq v v2) :\<sqsubset>val (Seq v w2) \<longleftrightarrow> v2 :\<sqsubset>val w2"
using assms
apply(auto)
prefer 2
apply(simp add: PosOrd_SeqI2)
apply(simp add: PosOrd_ex_def)
apply(auto)
apply(case_tac p)
apply(simp add: PosOrd_def pflat_len_simps)
apply(case_tac a)
apply(simp add: PosOrd_def pflat_len_simps)
apply(clarify)
apply(case_tac nat)
prefer 2
apply(simp add: PosOrd_def pflat_len_simps pflat_len_outside)
apply(rule_tac x="list" in exI)
apply(auto simp add: PosOrd_def2 pflat_len_simps)
apply(smt Collect_disj_eq lex_list.intros(2) mem_Collect_eq pflat_len_simps(2))
apply(smt Collect_disj_eq lex_list.intros(2) mem_Collect_eq pflat_len_simps(2))
done

lemma PosOrd_StarsI:
  assumes "v1 :\<sqsubset>val v2" "flats (v1#vs1) = flats (v2#vs2)"
  shows "Stars (v1#vs1) :\<sqsubset>val Stars (v2#vs2)"
using assms(1)
apply(subst (asm) PosOrd_ex_def)
apply(subst (asm) PosOrd_def)
apply(clarify)
apply(subst PosOrd_ex_def)
apply(subst PosOrd_def)
apply(rule_tac x="0#p" in exI)
apply(simp add: pflat_len_Stars_simps pflat_len_simps)
using assms(2)
apply(simp add: pflat_len_simps)
apply(auto simp add: pflat_len_Stars_simps pflat_len_simps)
by (metis length_append of_nat_add)

lemma PosOrd_StarsI2:
  assumes "Stars vs1 :\<sqsubset>val Stars vs2" "flats vs1 = flats vs2"
  shows "Stars (v#vs1) :\<sqsubset>val Stars (v#vs2)"
using assms(1)
apply(subst (asm) PosOrd_ex_def)
apply(subst (asm) PosOrd_def)
apply(clarify)
apply(subst PosOrd_ex_def)
apply(subst PosOrd_def)
apply(case_tac p)
apply(simp add: pflat_len_simps)
apply(rule_tac x="Suc a#list" in exI)
apply(auto simp add: pflat_len_Stars_simps pflat_len_simps assms(2))
done

lemma PosOrd_Stars_appendI:
  assumes "Stars vs1 :\<sqsubset>val Stars vs2" "flat (Stars vs1) = flat (Stars vs2)"
  shows "Stars (vs @ vs1) :\<sqsubset>val Stars (vs @ vs2)"
using assms
apply(induct vs)
apply(simp)
apply(simp add: PosOrd_StarsI2)
done

lemma PosOrd_StarsE2:
  assumes "Stars (v # vs1) :\<sqsubset>val Stars (v # vs2)"
  shows "Stars vs1 :\<sqsubset>val Stars vs2"
using assms
apply(subst (asm) PosOrd_ex_def)
apply(erule exE)
apply(case_tac p)
apply(simp)
apply(simp add: PosOrd_def pflat_len_simps)
apply(subst PosOrd_ex_def)
apply(rule_tac x="[]" in exI)
apply(simp add: PosOrd_def pflat_len_simps Pos_empty)
apply(simp)
apply(case_tac a)
apply(clarify)
apply(auto simp add: pflat_len_simps PosOrd_def pflat_len_def split: if_splits)[1]
apply(clarify)
apply(simp add: PosOrd_ex_def)
apply(rule_tac x="nat#list" in exI)
apply(auto simp add: PosOrd_def pflat_len_simps)[1]
apply(case_tac q)
apply(simp add: PosOrd_def pflat_len_simps)
apply(clarify)
apply(drule_tac x="Suc a # lista" in bspec)
apply(simp)
apply(auto simp add: PosOrd_def pflat_len_simps)[1]
apply(case_tac q)
apply(simp add: PosOrd_def pflat_len_simps)
apply(clarify)
apply(drule_tac x="Suc a # lista" in bspec)
apply(simp)
apply(auto simp add: PosOrd_def pflat_len_simps)[1]
done

lemma PosOrd_Stars_appendE:
  assumes "Stars (vs @ vs1) :\<sqsubset>val Stars (vs @ vs2)"
  shows "Stars vs1 :\<sqsubset>val Stars vs2"
using assms
apply(induct vs)
apply(simp)
apply(simp add: PosOrd_StarsE2)
done

lemma PosOrd_Stars_append_eq:
  assumes "flats vs1 = flats vs2"
  shows "Stars (vs @ vs1) :\<sqsubset>val Stars (vs @ vs2) \<longleftrightarrow> Stars vs1 :\<sqsubset>val Stars vs2"
using assms
apply(rule_tac iffI)
apply(erule PosOrd_Stars_appendE)
apply(rule PosOrd_Stars_appendI)
apply(auto)
done

lemma PosOrd_almost_trichotomous:
  shows "v1 :\<sqsubset>val v2 \<or> v2 :\<sqsubset>val v1 \<or> (length (flat v1) = length (flat v2))"
apply(auto simp add: PosOrd_ex_def)
apply(auto simp add: PosOrd_def)
apply(rule_tac x="[]" in exI)
apply(auto simp add: Pos_empty pflat_len_simps)
apply(drule_tac x="[]" in spec)
apply(auto simp add: Pos_empty pflat_len_simps)
done

section \<open>The Posix Value is smaller than any other lexical value\<close>

lemma Posix_PosOrd:
  assumes "s \<in> r \<rightarrow> v1" "v2 \<in> LV r s"
  shows "v1 :\<sqsubseteq>val v2"
using assms
proof (induct arbitrary: v2 rule: Posix.induct)
  case (Posix_One v)
  have "v \<in> LV One []" by fact
  then have "v = Void"
    by (simp add: LV_simps)
  then show "Void :\<sqsubseteq>val v"
    by (simp add: PosOrd_ex_eq_def)
next
  case (Posix_Atom c v)
  have "v \<in> LV (Atom c) [c]" by fact
  then have "v = Atm c"
    by (simp add: LV_simps)
  then show "Atm c :\<sqsubseteq>val v"
    by (simp add: PosOrd_ex_eq_def)
next
  case (Posix_Plus1 s r1 v r2 v2)
  have as1: "s \<in> r1 \<rightarrow> v" by fact
  have IH: "\<And>v2. v2 \<in> LV r1 s \<Longrightarrow> v :\<sqsubseteq>val v2" by fact
  have "v2 \<in> LV (Plus r1 r2) s" by fact
  then have "\<turnstile> v2 : Plus r1 r2" "flat v2 = s"
    by(auto simp add: LV_def prefix_list_def)
  then consider
    (Left) v3 where "v2 = Left v3" "\<turnstile> v3 : r1" "flat v3 = s"
  | (Right) v3 where "v2 = Right v3" "\<turnstile> v3 : r2" "flat v3 = s"
  by (auto elim: Prf.cases)
  then show "Left v :\<sqsubseteq>val v2"
  proof(cases)
     case (Left v3)
     have "v3 \<in> LV r1 s" using Left(2,3)
       by (auto simp add: LV_def prefix_list_def)
     with IH have "v :\<sqsubseteq>val v3" by simp
     moreover
     have "flat v3 = flat v" using as1 Left(3)
       by (simp add: Posix1(2))
     ultimately have "Left v :\<sqsubseteq>val Left v3"
       by (simp add: PosOrd_ex_eq_def PosOrd_Left_eq)
     then show "Left v :\<sqsubseteq>val v2" unfolding Left .
  next
     case (Right v3)
     have "flat v3 = flat v" using as1 Right(3)
       by (simp add: Posix1(2))
     then have "Left v :\<sqsubseteq>val Right v3"
       unfolding PosOrd_ex_eq_def
       by (simp add: PosOrd_Left_Right)
     then show "Left v :\<sqsubseteq>val v2" unfolding Right .
  qed
next
  case (Posix_Plus2 s r2 v r1 v2)
  have as1: "s \<in> r2 \<rightarrow> v" by fact
  have as2: "s \<notin> lang r1" by fact
  have IH: "\<And>v2. v2 \<in> LV r2 s \<Longrightarrow> v :\<sqsubseteq>val v2" by fact
  have "v2 \<in> LV (Plus r1 r2) s" by fact
  then have "\<turnstile> v2 : Plus r1 r2" "flat v2 = s"
    by(auto simp add: LV_def prefix_list_def)
  then consider
    (Left) v3 where "v2 = Left v3" "\<turnstile> v3 : r1" "flat v3 = s"
  | (Right) v3 where "v2 = Right v3" "\<turnstile> v3 : r2" "flat v3 = s"
  by (auto elim: Prf.cases)
  then show "Right v :\<sqsubseteq>val v2"
  proof (cases)
    case (Right v3)
     have "v3 \<in> LV r2 s" using Right(2,3)
       by (auto simp add: LV_def prefix_list_def)
     with IH have "v :\<sqsubseteq>val v3" by simp
     moreover
     have "flat v3 = flat v" using as1 Right(3)
       by (simp add: Posix1(2))
     ultimately have "Right v :\<sqsubseteq>val Right v3"
        by (auto simp add: PosOrd_ex_eq_def PosOrd_RightI)
     then show "Right v :\<sqsubseteq>val v2" unfolding Right .
  next
     case (Left v3)
     have "v3 \<in> LV r1 s" using Left(2,3) as2
       by (auto simp add: LV_def prefix_list_def)
     then have "flat v3 = flat v \<and> \<turnstile> v3 : r1" using as1 Left(3)
       by (simp add: Posix1(2) LV_def)
     then have "False" using as1 as2 Left
       by (auto simp add: Posix1(2) L_flat_Prf1)
     then show "Right v :\<sqsubseteq>val v2" by simp
  qed
next
  case (Posix_Times s1 r1 v1 s2 r2 v2 v3)
  have "s1 \<in> r1 \<rightarrow> v1" "s2 \<in> r2 \<rightarrow> v2" by fact+
  then have as1: "s1 = flat v1" "s2 = flat v2" by (simp_all add: Posix1(2))
  have IH1: "\<And>v3. v3 \<in> LV r1 s1 \<Longrightarrow> v1 :\<sqsubseteq>val v3" by fact
  have IH2: "\<And>v3. v3 \<in> LV r2 s2 \<Longrightarrow> v2 :\<sqsubseteq>val v3" by fact
  have cond: "\<not> (\<exists>s\<^sub>3 s\<^sub>4. s\<^sub>3 \<noteq> [] \<and> s\<^sub>3 @ s\<^sub>4 = s2 \<and> s1 @ s\<^sub>3 \<in> lang r1 \<and> s\<^sub>4 \<in> lang r2)" by fact
  have "v3 \<in> LV (Times r1 r2) (s1 @ s2)" by fact
  then obtain v3a v3b where eqs:
    "v3 = Seq v3a v3b" "\<turnstile> v3a : r1" "\<turnstile> v3b : r2"
    "flat v3a @ flat v3b = s1 @ s2"
    by (force simp add: prefix_list_def LV_def elim: Prf.cases)
  with cond have "flat v3a \<sqsubseteq>pre s1" unfolding prefix_list_def
    by (smt L_flat_Prf1 append_eq_append_conv2 append_self_conv)
  then have "flat v3a \<sqsubset>spre s1 \<or> (flat v3a = s1 \<and> flat v3b = s2)" using eqs
    by (simp add: sprefix_list_def append_eq_conv_conj)
  then have q2: "v1 :\<sqsubset>val v3a \<or> (flat v3a = s1 \<and> flat v3b = s2)"
    using PosOrd_spreI as1(1) eqs by blast
  then have "v1 :\<sqsubset>val v3a \<or> (v3a \<in> LV r1 s1 \<and> v3b \<in> LV r2 s2)" using eqs(2,3)
    by (auto simp add: LV_def)
  then have "v1 :\<sqsubset>val v3a \<or> (v1 :\<sqsubseteq>val v3a \<and> v2 :\<sqsubseteq>val v3b)" using IH1 IH2 by blast
  then have "Seq v1 v2 :\<sqsubseteq>val Seq v3a v3b" using eqs q2 as1
    unfolding  PosOrd_ex_eq_def by (auto simp add: PosOrd_SeqI1 PosOrd_Seq_eq)
  then show "Seq v1 v2 :\<sqsubseteq>val v3" unfolding eqs by blast
next
  case (Posix_Star1 s1 r v s2 vs v3)
  have "s1 \<in> r \<rightarrow> v" "s2 \<in> Star r \<rightarrow> Stars vs" by fact+
  then have as1: "s1 = flat v" "s2 = flat (Stars vs)" by (auto dest: Posix1(2))
  have IH1: "\<And>v3. v3 \<in> LV r s1 \<Longrightarrow> v :\<sqsubseteq>val v3" by fact
  have IH2: "\<And>v3. v3 \<in> LV (Star r) s2 \<Longrightarrow> Stars vs :\<sqsubseteq>val v3" by fact
  have cond: "\<not> (\<exists>s\<^sub>3 s\<^sub>4. s\<^sub>3 \<noteq> [] \<and> s\<^sub>3 @ s\<^sub>4 = s2 \<and> s1 @ s\<^sub>3 \<in> lang r \<and> s\<^sub>4 \<in> lang (Star r))" by fact
  have cond2: "flat v \<noteq> []" by fact
  have "v3 \<in> LV (Star r) (s1 @ s2)" by fact
  then consider
    (NonEmpty) v3a vs3 where "v3 = Stars (v3a # vs3)"
    "\<turnstile> v3a : r" "\<turnstile> Stars vs3 : Star r"
    "flat (Stars (v3a # vs3)) = s1 @ s2"
  | (Empty) "v3 = Stars []"
  unfolding LV_def
  apply(auto)
  apply(erule Prf_elims)
  by (metis NonEmpty Prf.intros(6) list.set_intros(1) list.set_intros(2) neq_Nil_conv)
  then show "Stars (v # vs) :\<sqsubseteq>val v3"
    proof (cases)
      case (NonEmpty v3a vs3)
      have "flat (Stars (v3a # vs3)) = s1 @ s2" using NonEmpty(4) .
      with cond have "flat v3a \<sqsubseteq>pre s1" using NonEmpty(2,3)
        unfolding prefix_list_def
        by (smt L_flat_Prf1 append_Nil2 append_eq_append_conv2 flat.simps(7))
      then have "flat v3a \<sqsubset>spre s1 \<or> (flat v3a = s1 \<and> flat (Stars vs3) = s2)" using NonEmpty(4)
        by (simp add: sprefix_list_def append_eq_conv_conj)
      then have q2: "v :\<sqsubset>val v3a \<or> (flat v3a = s1 \<and> flat (Stars vs3) = s2)"
        using PosOrd_spreI as1(1) NonEmpty(4) by blast
      then have "v :\<sqsubset>val v3a \<or> (v3a \<in> LV r s1 \<and> Stars vs3 \<in> LV (Star r) s2)"
        using NonEmpty(2,3) by (auto simp add: LV_def)
      then have "v :\<sqsubset>val v3a \<or> (v :\<sqsubseteq>val v3a \<and> Stars vs :\<sqsubseteq>val Stars vs3)" using IH1 IH2 by blast
      then have "v :\<sqsubset>val v3a \<or> (v = v3a \<and> Stars vs :\<sqsubseteq>val Stars vs3)"
         unfolding PosOrd_ex_eq_def by auto
      then have "Stars (v # vs) :\<sqsubseteq>val Stars (v3a # vs3)" using NonEmpty(4) q2 as1
        unfolding  PosOrd_ex_eq_def
        using PosOrd_StarsI PosOrd_StarsI2
        by (metis flat.simps(7) flat_Stars val.inject(5))
      then show "Stars (v # vs) :\<sqsubseteq>val v3" unfolding NonEmpty by blast
    next
      case Empty
      have "v3 = Stars []" by fact
      then show "Stars (v # vs) :\<sqsubseteq>val v3"
      unfolding PosOrd_ex_eq_def using cond2
      by (simp add: PosOrd_shorterI)
    qed
next
  case (Posix_Star2 r v2)
  have "v2 \<in> LV (Star r) []" by fact
  then have "v2 = Stars []"
    unfolding LV_def by (auto elim: Prf.cases)
  then show "Stars [] :\<sqsubseteq>val v2"
  by (simp add: PosOrd_ex_eq_def)
qed

lemma Posix_PosOrd_reverse:
  assumes "s \<in> r \<rightarrow> v1"
  shows "\<not>(\<exists>v2 \<in> LV r s. v2 :\<sqsubset>val v1)"
using assms
by (metis Posix_PosOrd less_irrefl PosOrd_def
    PosOrd_ex_eq_def PosOrd_ex_def PosOrd_trans)

lemma PosOrd_Posix:
  assumes "v1 \<in> LV r s" "\<forall>v\<^sub>2 \<in> LV r s. \<not> v\<^sub>2 :\<sqsubset>val v1"
  shows "s \<in> r \<rightarrow> v1"
proof -
  have "s \<in> lang r" using assms(1) unfolding LV_def
    using L_flat_Prf1 by blast
  then obtain vposix where vp: "s \<in> r \<rightarrow> vposix"
    using lexer_correct_Some by blast
  with assms(1) have "vposix :\<sqsubseteq>val v1" by (simp add: Posix_PosOrd)
  then have "vposix = v1 \<or> vposix :\<sqsubset>val v1" unfolding PosOrd_ex_eq2 by auto
  moreover
    { assume "vposix :\<sqsubset>val v1"
      moreover
      have "vposix \<in> LV r s" using vp
         using Posix_LV by blast
      ultimately have "False" using assms(2) by blast
    }
  ultimately show "s \<in> r \<rightarrow> v1" using vp by blast
qed

lemma Least_existence:
  assumes "LV r s \<noteq> {}"
  shows " \<exists>vmin \<in> LV r s. \<forall>v \<in> LV r s. vmin :\<sqsubseteq>val v"
proof -
  from assms
  obtain vposix where "s \<in> r \<rightarrow> vposix"
  unfolding LV_def
  using L_flat_Prf1 lexer_correct_Some by blast
  then have "\<forall>v \<in> LV r s. vposix :\<sqsubseteq>val v"
    by (simp add: Posix_PosOrd)
  then show "\<exists>vmin \<in> LV r s. \<forall>v \<in> LV r s. vmin :\<sqsubseteq>val v"
    using Posix_LV \<open>s \<in> r \<rightarrow> vposix\<close> by blast
qed

lemma Least_existence1:
  assumes "LV r s \<noteq> {}"
  shows " \<exists>! v\<^sub>m\<^sub>i\<^sub>n \<in> LV r s. \<forall>v \<in> LV r s. v\<^sub>m\<^sub>i\<^sub>n :\<sqsubseteq>val v"
using Least_existence[OF assms] assms
using PosOrdeq_antisym by blast

lemma Least_existence2:
  assumes "LV r s \<noteq> {}"
  shows " \<exists>!vmin \<in> LV r s. lexer r s = Some vmin \<and> (\<forall>v \<in> LV r s. vmin :\<sqsubseteq>val v)"
using Least_existence[OF assms] assms
using PosOrdeq_antisym
using PosOrd_Posix PosOrd_ex_eq2 lexer_correctness(1)
  by (metis (mono_tags, lifting))

lemma Least_existence1_pre:
  assumes "LV r s \<noteq> {}"
  shows " \<exists>!vmin \<in> LV r s. \<forall>v \<in> (LV r s \<union> {v'. flat v' \<sqsubset>spre s}). vmin :\<sqsubseteq>val v"
using Least_existence[OF assms] assms
apply -
apply(erule bexE)
apply(rule_tac a="vmin" in ex1I)
apply(auto)[1]
apply (metis PosOrd_Posix PosOrd_ex_eq2 PosOrd_spreI PosOrdeq_antisym Posix1(2))
apply(auto)[1]
apply(simp add: PosOrdeq_antisym)
done

lemma PosOrd_partial:
  shows "partial_order_on UNIV {(v1, v2). v1 :\<sqsubseteq>val v2}"
apply(simp add: partial_order_on_def)
apply(simp add: preorder_on_def refl_on_def)
apply(simp add: PosOrdeq_refl)
apply(auto)
apply(rule transI)
apply(auto intro: PosOrdeq_trans)[1]
apply(rule antisymI)
apply(simp add: PosOrdeq_antisym)
done

lemma PosOrd_wf:
  shows "wf {(v1, v2). v1 :\<sqsubset>val v2 \<and> v1 \<in> LV r s \<and> v2 \<in> LV r s}"
proof -
  have "finite {(v1, v2). v1 \<in> LV r s \<and> v2 \<in> LV r s}"
    by (simp add: LV_finite)
  moreover
  have "{(v1, v2). v1 :\<sqsubset>val v2 \<and> v1 \<in> LV r s \<and> v2 \<in> LV r s} \<subseteq> {(v1, v2). v1 \<in> LV r s \<and> v2 \<in> LV r s}"
    by auto
  ultimately have "finite {(v1, v2). v1 :\<sqsubset>val v2 \<and> v1 \<in> LV r s \<and> v2 \<in> LV r s}"
    using finite_subset by blast
  moreover
  have "acyclicP (\<lambda>v1 v2. v1 :\<sqsubset>val v2 \<and> v1 \<in> LV r s \<and> v2 \<in> LV r s)"
    unfolding acyclic_def
    by (smt (verit, ccfv_threshold) PosOrd_irrefl PosOrd_trans tranclp_trans_induct tranclp_unfold)
  ultimately show "wf {(v1, v2). v1 :\<sqsubset>val v2 \<and> v1 \<in> LV r s \<and> v2 \<in> LV r s}"
    using finite_acyclic_wf by blast
qed

unused_thms

end


(*  Title:      Sequents/S4.thy
    Author:     Martin Coen
    Copyright   1991  University of Cambridge
*)

theory S4
imports Modal0
begin

axiomatization where
(* Definition of the star operation using a set of Horn clauses *)
(* For system S4:  gamma * == {[]P | []P : gamma}               *)
(*                 delta * == {<>P | <>P : delta}               *)

  lstar0:         "|L>" and
  lstar1:         "$G |L> $H \<Longrightarrow> []P, $G |L> []P, $H" and
  lstar2:         "$G |L> $H \<Longrightarrow>   P, $G |L>      $H" and
  rstar0:         "|R>" and
  rstar1:         "$G |R> $H \<Longrightarrow> <>P, $G |R> <>P, $H" and
  rstar2:         "$G |R> $H \<Longrightarrow>   P, $G |R>      $H" and

(* Rules for [] and <> *)

  boxR:
   "\<lbrakk>$E |L> $E';  $F |R> $F';  $G |R> $G';
           $E'         \<turnstile> $F', P, $G'\<rbrakk> \<Longrightarrow> $E          \<turnstile> $F, []P, $G" and
  boxL:     "$E,P,$F,[]P \<turnstile>         $G    \<Longrightarrow> $E, []P, $F \<turnstile>          $G" and

  diaR:     "$E          \<turnstile> $F,P,$G,<>P   \<Longrightarrow> $E          \<turnstile> $F, <>P, $G" and
  diaL:
   "\<lbrakk>$E |L> $E';  $F |L> $F';  $G |R> $G';
           $E', P, $F' \<turnstile>         $G'\<rbrakk> \<Longrightarrow> $E, <>P, $F \<turnstile> $G"

ML \<open>
structure S4_Prover = Modal_ProverFun
(
  val rewrite_rls = @{thms rewrite_rls}
  val safe_rls = @{thms safe_rls}
  val unsafe_rls = @{thms unsafe_rls} @ [@{thm boxR}, @{thm diaL}]
  val bound_rls = @{thms bound_rls} @ [@{thm boxL}, @{thm diaR}]
  val aside_rls = [@{thm lstar0}, @{thm lstar1}, @{thm lstar2}, @{thm rstar0},
    @{thm rstar1}, @{thm rstar2}]
)
\<close>

method_setup S4_solve =
  \<open>Scan.succeed (fn ctxt => SIMPLE_METHOD (S4_Prover.solve_tac ctxt 2))\<close>

(* Theorems of system T from Hughes and Cresswell and Hailpern, LNCS 129 *)

lemma "\<turnstile> []P \<longrightarrow> P" by S4_solve
lemma "\<turnstile> [](P \<longrightarrow> Q) \<longrightarrow> ([]P \<longrightarrow> []Q)" by S4_solve   (* normality*)
lemma "\<turnstile> (P --< Q) \<longrightarrow> []P \<longrightarrow> []Q" by S4_solve
lemma "\<turnstile> P \<longrightarrow> <>P" by S4_solve

lemma "\<turnstile>  [](P \<and> Q) \<longleftrightarrow> []P \<and> []Q" by S4_solve
lemma "\<turnstile>  <>(P \<or> Q) \<longleftrightarrow> <>P \<or> <>Q" by S4_solve
lemma "\<turnstile>  [](P \<longleftrightarrow> Q) \<longleftrightarrow> (P >-< Q)" by S4_solve
lemma "\<turnstile>  <>(P \<longrightarrow> Q) \<longleftrightarrow> ([]P \<longrightarrow> <>Q)" by S4_solve
lemma "\<turnstile>        []P \<longleftrightarrow> \<not> <>(\<not> P)" by S4_solve
lemma "\<turnstile>     [](\<not> P) \<longleftrightarrow> \<not> <>P" by S4_solve
lemma "\<turnstile>       \<not> []P \<longleftrightarrow> <>(\<not> P)" by S4_solve
lemma "\<turnstile>      [][]P \<longleftrightarrow> \<not> <><>(\<not> P)" by S4_solve
lemma "\<turnstile> \<not> <>(P \<or> Q) \<longleftrightarrow> \<not> <>P \<and> \<not> <>Q" by S4_solve

lemma "\<turnstile> []P \<or> []Q \<longrightarrow> [](P \<or> Q)" by S4_solve
lemma "\<turnstile> <>(P \<and> Q) \<longrightarrow> <>P \<and> <>Q" by S4_solve
lemma "\<turnstile> [](P \<or> Q) \<longrightarrow> []P \<or> <>Q" by S4_solve
lemma "\<turnstile> <>P \<and> []Q \<longrightarrow> <>(P \<and> Q)" by S4_solve
lemma "\<turnstile> [](P \<or> Q) \<longrightarrow> <>P \<or> []Q" by S4_solve
lemma "\<turnstile> <>(P \<longrightarrow> (Q \<and> R)) \<longrightarrow> ([]P \<longrightarrow> <>Q) \<and> ([]P \<longrightarrow> <>R)" by S4_solve
lemma "\<turnstile> (P --< Q) \<and> (Q --< R) \<longrightarrow> (P --< R)" by S4_solve
lemma "\<turnstile> []P \<longrightarrow> <>Q \<longrightarrow> <>(P \<and> Q)" by S4_solve

(* Theorems of system S4 from Hughes and Cresswell, p.46 *)

lemma "\<turnstile> []A \<longrightarrow> A" by S4_solve             (* refexivity *)
lemma "\<turnstile> []A \<longrightarrow> [][]A" by S4_solve         (* transitivity *)
lemma "\<turnstile> []A \<longrightarrow> <>A" by S4_solve           (* seriality *)
lemma "\<turnstile> <>[](<>A \<longrightarrow> []<>A)" by S4_solve
lemma "\<turnstile> <>[](<>[]A \<longrightarrow> []A)" by S4_solve
lemma "\<turnstile> []P \<longleftrightarrow> [][]P" by S4_solve
lemma "\<turnstile> <>P \<longleftrightarrow> <><>P" by S4_solve
lemma "\<turnstile> <>[]<>P \<longrightarrow> <>P" by S4_solve
lemma "\<turnstile> []<>P \<longleftrightarrow> []<>[]<>P" by S4_solve
lemma "\<turnstile> <>[]P \<longleftrightarrow> <>[]<>[]P" by S4_solve

(* Theorems for system S4 from Hughes and Cresswell, p.60 *)

lemma "\<turnstile> []P \<or> []Q \<longleftrightarrow> []([]P \<or> []Q)" by S4_solve
lemma "\<turnstile> ((P >-< Q) --< R) \<longrightarrow> ((P >-< Q) --< []R)" by S4_solve

(* These are from Hailpern, LNCS 129 *)

lemma "\<turnstile> [](P \<and> Q) \<longleftrightarrow> []P \<and> []Q" by S4_solve
lemma "\<turnstile> <>(P \<or> Q) \<longleftrightarrow> <>P \<or> <>Q" by S4_solve
lemma "\<turnstile> <>(P \<longrightarrow> Q) \<longleftrightarrow> ([]P \<longrightarrow> <>Q)" by S4_solve

lemma "\<turnstile> [](P \<longrightarrow> Q) \<longrightarrow> (<>P \<longrightarrow> <>Q)" by S4_solve
lemma "\<turnstile> []P \<longrightarrow> []<>P" by S4_solve
lemma "\<turnstile> <>[]P \<longrightarrow> <>P" by S4_solve

lemma "\<turnstile> []P \<or> []Q \<longrightarrow> [](P \<or> Q)" by S4_solve
lemma "\<turnstile> <>(P \<and> Q) \<longrightarrow> <>P \<and> <>Q" by S4_solve
lemma "\<turnstile> [](P \<or> Q) \<longrightarrow> []P \<or> <>Q" by S4_solve
lemma "\<turnstile> <>P \<and> []Q \<longrightarrow> <>(P \<and> Q)" by S4_solve
lemma "\<turnstile> [](P \<or> Q) \<longrightarrow> <>P \<or> []Q" by S4_solve

end


(*  Title:      HOL/Cardinals/Order_Relation_More.thy
    Author:     Andrei Popescu, TU Muenchen
    Copyright   2012

Basics on order-like relations.
*)

section {* Basics on Order-Like Relations *}

theory Order_Relation_More
imports Main
begin

subsection {* The upper and lower bounds operators *}

lemma aboveS_subset_above: "aboveS r a \<le> above r a"
by(auto simp add: aboveS_def above_def)

lemma AboveS_subset_Above: "AboveS r A \<le> Above r A"
by(auto simp add: AboveS_def Above_def)

lemma UnderS_disjoint: "A Int (UnderS r A) = {}"
by(auto simp add: UnderS_def)

lemma aboveS_notIn: "a \<notin> aboveS r a"
by(auto simp add: aboveS_def)

lemma Refl_above_in: "\<lbrakk>Refl r; a \<in> Field r\<rbrakk> \<Longrightarrow> a \<in> above r a"
by(auto simp add: refl_on_def above_def)

lemma in_Above_under: "a \<in> Field r \<Longrightarrow> a \<in> Above r (under r a)"
by(auto simp add: Above_def under_def)

lemma in_Under_above: "a \<in> Field r \<Longrightarrow> a \<in> Under r (above r a)"
by(auto simp add: Under_def above_def)

lemma in_UnderS_aboveS: "a \<in> Field r \<Longrightarrow> a \<in> UnderS r (aboveS r a)"
by(auto simp add: UnderS_def aboveS_def)

lemma UnderS_subset_Under: "UnderS r A \<le> Under r A"
by(auto simp add: UnderS_def Under_def)

lemma subset_Above_Under: "B \<le> Field r \<Longrightarrow> B \<le> Above r (Under r B)"
by(auto simp add: Above_def Under_def)

lemma subset_Under_Above: "B \<le> Field r \<Longrightarrow> B \<le> Under r (Above r B)"
by(auto simp add: Under_def Above_def)

lemma subset_AboveS_UnderS: "B \<le> Field r \<Longrightarrow> B \<le> AboveS r (UnderS r B)"
by(auto simp add: AboveS_def UnderS_def)

lemma subset_UnderS_AboveS: "B \<le> Field r \<Longrightarrow> B \<le> UnderS r (AboveS r B)"
by(auto simp add: UnderS_def AboveS_def)

lemma Under_Above_Galois:
"\<lbrakk>B \<le> Field r; C \<le> Field r\<rbrakk> \<Longrightarrow> (B \<le> Above r C) = (C \<le> Under r B)"
by(unfold Above_def Under_def, blast)

lemma UnderS_AboveS_Galois:
"\<lbrakk>B \<le> Field r; C \<le> Field r\<rbrakk> \<Longrightarrow> (B \<le> AboveS r C) = (C \<le> UnderS r B)"
by(unfold AboveS_def UnderS_def, blast)

lemma Refl_above_aboveS:
  assumes REFL: "Refl r" and IN: "a \<in> Field r"
  shows "above r a = aboveS r a \<union> {a}"
proof(unfold above_def aboveS_def, auto)
  show "(a,a) \<in> r" using REFL IN refl_on_def[of _ r] by blast
qed

lemma Linear_order_under_aboveS_Field:
  assumes LIN: "Linear_order r" and IN: "a \<in> Field r"
  shows "Field r = under r a \<union> aboveS r a"
proof(unfold under_def aboveS_def, auto)
  assume "a \<in> Field r" "(a, a) \<notin> r"
  with LIN IN order_on_defs[of _ r] refl_on_def[of _ r]
  show False by auto
next
  fix b assume "b \<in> Field r" "(b, a) \<notin> r"
  with LIN IN order_on_defs[of "Field r" r] total_on_def[of "Field r" r]
  have "(a,b) \<in> r \<or> a = b" by blast
  thus "(a,b) \<in> r"
  using LIN IN order_on_defs[of _ r] refl_on_def[of _ r] by auto
next
  fix b assume "(b, a) \<in> r"
  thus "b \<in> Field r"
  using LIN order_on_defs[of _ r] refl_on_def[of _ r] by blast
next
  fix b assume "b \<noteq> a" "(a, b) \<in> r"
  thus "b \<in> Field r"
  using LIN order_on_defs[of "Field r" r] refl_on_def[of "Field r" r] by blast
qed

lemma Linear_order_underS_above_Field:
assumes LIN: "Linear_order r" and IN: "a \<in> Field r"
shows "Field r = underS r a \<union> above r a"
proof(unfold underS_def above_def, auto)
  assume "a \<in> Field r" "(a, a) \<notin> r"
  with LIN IN order_on_defs[of _ r] refl_on_def[of _ r]
  show False by metis
next
  fix b assume "b \<in> Field r" "(a, b) \<notin> r"
  with LIN IN order_on_defs[of "Field r" r] total_on_def[of "Field r" r]
  have "(b,a) \<in> r \<or> b = a" by blast
  thus "(b,a) \<in> r"
  using LIN IN order_on_defs[of _ r] refl_on_def[of _ r] by auto
next
  fix b assume "b \<noteq> a" "(b, a) \<in> r"
  thus "b \<in> Field r"
  using LIN order_on_defs[of _ r] refl_on_def[of _ r] by blast
next
  fix b assume "(a, b) \<in> r"
  thus "b \<in> Field r"
  using LIN order_on_defs[of "Field r" r] refl_on_def[of "Field r" r] by blast
qed

lemma under_empty: "a \<notin> Field r \<Longrightarrow> under r a = {}"
unfolding Field_def under_def by auto

lemma Under_Field: "Under r A \<le> Field r"
by(unfold Under_def Field_def, auto)

lemma UnderS_Field: "UnderS r A \<le> Field r"
by(unfold UnderS_def Field_def, auto)

lemma above_Field: "above r a \<le> Field r"
by(unfold above_def Field_def, auto)

lemma aboveS_Field: "aboveS r a \<le> Field r"
by(unfold aboveS_def Field_def, auto)

lemma Above_Field: "Above r A \<le> Field r"
by(unfold Above_def Field_def, auto)

lemma Refl_under_Under:
assumes REFL: "Refl r" and NE: "A \<noteq> {}"
shows "Under r A = (\<Inter> a \<in> A. under r a)"
proof
  show "Under r A \<subseteq> (\<Inter> a \<in> A. under r a)"
  by(unfold Under_def under_def, auto)
next
  show "(\<Inter> a \<in> A. under r a) \<subseteq> Under r A"
  proof(auto)
    fix x
    assume *: "\<forall>xa \<in> A. x \<in> under r xa"
    hence "\<forall>xa \<in> A. (x,xa) \<in> r"
    by (simp add: under_def)
    moreover
    {from NE obtain a where "a \<in> A" by blast
     with * have "x \<in> under r a" by simp
     hence "x \<in> Field r"
     using under_Field[of r a] by auto
    }
    ultimately show "x \<in> Under r A"
    unfolding Under_def by auto
  qed
qed

lemma Refl_underS_UnderS:
assumes REFL: "Refl r" and NE: "A \<noteq> {}"
shows "UnderS r A = (\<Inter> a \<in> A. underS r a)"
proof
  show "UnderS r A \<subseteq> (\<Inter> a \<in> A. underS r a)"
  by(unfold UnderS_def underS_def, auto)
next
  show "(\<Inter> a \<in> A. underS r a) \<subseteq> UnderS r A"
  proof(auto)
    fix x
    assume *: "\<forall>xa \<in> A. x \<in> underS r xa"
    hence "\<forall>xa \<in> A. x \<noteq> xa \<and> (x,xa) \<in> r"
    by (auto simp add: underS_def)
    moreover
    {from NE obtain a where "a \<in> A" by blast
     with * have "x \<in> underS r a" by simp
     hence "x \<in> Field r"
     using underS_Field[of _ r a] by auto
    }
    ultimately show "x \<in> UnderS r A"
    unfolding UnderS_def by auto
  qed
qed

lemma Refl_above_Above:
assumes REFL: "Refl r" and NE: "A \<noteq> {}"
shows "Above r A = (\<Inter> a \<in> A. above r a)"
proof
  show "Above r A \<subseteq> (\<Inter> a \<in> A. above r a)"
  by(unfold Above_def above_def, auto)
next
  show "(\<Inter> a \<in> A. above r a) \<subseteq> Above r A"
  proof(auto)
    fix x
    assume *: "\<forall>xa \<in> A. x \<in> above r xa"
    hence "\<forall>xa \<in> A. (xa,x) \<in> r"
    by (simp add: above_def)
    moreover
    {from NE obtain a where "a \<in> A" by blast
     with * have "x \<in> above r a" by simp
     hence "x \<in> Field r"
     using above_Field[of r a] by auto
    }
    ultimately show "x \<in> Above r A"
    unfolding Above_def by auto
  qed
qed

lemma Refl_aboveS_AboveS:
assumes REFL: "Refl r" and NE: "A \<noteq> {}"
shows "AboveS r A = (\<Inter> a \<in> A. aboveS r a)"
proof
  show "AboveS r A \<subseteq> (\<Inter> a \<in> A. aboveS r a)"
  by(unfold AboveS_def aboveS_def, auto)
next
  show "(\<Inter> a \<in> A. aboveS r a) \<subseteq> AboveS r A"
  proof(auto)
    fix x
    assume *: "\<forall>xa \<in> A. x \<in> aboveS r xa"
    hence "\<forall>xa \<in> A. xa \<noteq> x \<and> (xa,x) \<in> r"
    by (auto simp add: aboveS_def)
    moreover
    {from NE obtain a where "a \<in> A" by blast
     with * have "x \<in> aboveS r a" by simp
     hence "x \<in> Field r"
     using aboveS_Field[of r a] by auto
    }
    ultimately show "x \<in> AboveS r A"
    unfolding AboveS_def by auto
  qed
qed

lemma under_Under_singl: "under r a = Under r {a}"
by(unfold Under_def under_def, auto simp add: Field_def)

lemma underS_UnderS_singl: "underS r a = UnderS r {a}"
by(unfold UnderS_def underS_def, auto simp add: Field_def)

lemma above_Above_singl: "above r a = Above r {a}"
by(unfold Above_def above_def, auto simp add: Field_def)

lemma aboveS_AboveS_singl: "aboveS r a = AboveS r {a}"
by(unfold AboveS_def aboveS_def, auto simp add: Field_def)

lemma Under_decr: "A \<le> B \<Longrightarrow> Under r B \<le> Under r A"
by(unfold Under_def, auto)

lemma UnderS_decr: "A \<le> B \<Longrightarrow> UnderS r B \<le> UnderS r A"
by(unfold UnderS_def, auto)

lemma Above_decr: "A \<le> B \<Longrightarrow> Above r B \<le> Above r A"
by(unfold Above_def, auto)

lemma AboveS_decr: "A \<le> B \<Longrightarrow> AboveS r B \<le> AboveS r A"
by(unfold AboveS_def, auto)

lemma under_incl_iff:
assumes TRANS: "trans r" and REFL: "Refl r" and IN: "a \<in> Field r"
shows "(under r a \<le> under r b) = ((a,b) \<in> r)"
proof
  assume "(a,b) \<in> r"
  thus "under r a \<le> under r b" using TRANS
  by (auto simp add: under_incr)
next
  assume "under r a \<le> under r b"
  moreover
  have "a \<in> under r a" using REFL IN
  by (auto simp add: Refl_under_in)
  ultimately show "(a,b) \<in> r"
  by (auto simp add: under_def)
qed

lemma above_decr:
assumes TRANS: "trans r" and REL: "(a,b) \<in> r"
shows "above r b \<le> above r a"
proof(unfold above_def, auto)
  fix x assume "(b,x) \<in> r"
  with REL TRANS trans_def[of r]
  show "(a,x) \<in> r" by blast
qed

lemma aboveS_decr:
assumes TRANS: "trans r" and ANTISYM: "antisym r" and
        REL: "(a,b) \<in> r"
shows "aboveS r b \<le> aboveS r a"
proof(unfold aboveS_def, auto)
  assume *: "a \<noteq> b" and **: "(b,a) \<in> r"
  with ANTISYM antisym_def[of r] REL
  show False by auto
next
  fix x assume "x \<noteq> b" "(b,x) \<in> r"
  with REL TRANS trans_def[of r]
  show "(a,x) \<in> r" by blast
qed

lemma under_trans:
assumes TRANS: "trans r" and
        IN1: "a \<in> under r b" and IN2: "b \<in> under r c"
shows "a \<in> under r c"
proof-
  have "(a,b) \<in> r \<and> (b,c) \<in> r"
  using IN1 IN2 under_def by fastforce
  hence "(a,c) \<in> r"
  using TRANS trans_def[of r] by blast
  thus ?thesis unfolding under_def by simp
qed

lemma under_underS_trans:
assumes TRANS: "trans r" and ANTISYM: "antisym r" and
        IN1: "a \<in> under r b" and IN2: "b \<in> underS r c"
shows "a \<in> underS r c"
proof-
  have 0: "(a,b) \<in> r \<and> (b,c) \<in> r"
  using IN1 IN2 under_def underS_def by fastforce
  hence 1: "(a,c) \<in> r"
  using TRANS trans_def[of r] by blast
  have 2: "b \<noteq> c" using IN2 underS_def by force
  have 3: "a \<noteq> c"
  proof
    assume "a = c" with 0 2 ANTISYM antisym_def[of r]
    show False by auto
  qed
  from 1 3 show ?thesis unfolding underS_def by simp
qed

lemma underS_under_trans:
assumes TRANS: "trans r" and ANTISYM: "antisym r" and
        IN1: "a \<in> underS r b" and IN2: "b \<in> under r c"
shows "a \<in> underS r c"
proof-
  have 0: "(a,b) \<in> r \<and> (b,c) \<in> r"
  using IN1 IN2 under_def underS_def by fast
  hence 1: "(a,c) \<in> r"
  using TRANS trans_def[of r] by fast
  have 2: "a \<noteq> b" using IN1 underS_def by force
  have 3: "a \<noteq> c"
  proof
    assume "a = c" with 0 2 ANTISYM antisym_def[of r]
    show False by auto
  qed
  from 1 3 show ?thesis unfolding underS_def by simp
qed

lemma underS_underS_trans:
assumes TRANS: "trans r" and ANTISYM: "antisym r" and
        IN1: "a \<in> underS r b" and IN2: "b \<in> underS r c"
shows "a \<in> underS r c"
proof-
  have "a \<in> under r b"
  using IN1 underS_subset_under by fast
  with assms under_underS_trans show ?thesis by fast
qed

lemma above_trans:
assumes TRANS: "trans r" and
        IN1: "b \<in> above r a" and IN2: "c \<in> above r b"
shows "c \<in> above r a"
proof-
  have "(a,b) \<in> r \<and> (b,c) \<in> r"
  using IN1 IN2 above_def by fast
  hence "(a,c) \<in> r"
  using TRANS trans_def[of r] by blast
  thus ?thesis unfolding above_def by simp
qed

lemma above_aboveS_trans:
assumes TRANS: "trans r" and ANTISYM: "antisym r" and
        IN1: "b \<in> above r a" and IN2: "c \<in> aboveS r b"
shows "c \<in> aboveS r a"
proof-
  have 0: "(a,b) \<in> r \<and> (b,c) \<in> r"
  using IN1 IN2 above_def aboveS_def by fast
  hence 1: "(a,c) \<in> r"
  using TRANS trans_def[of r] by blast
  have 2: "b \<noteq> c" using IN2 aboveS_def by force
  have 3: "a \<noteq> c"
  proof
    assume "a = c" with 0 2 ANTISYM antisym_def[of r]
    show False by auto
  qed
  from 1 3 show ?thesis unfolding aboveS_def by simp
qed

lemma aboveS_above_trans:
assumes TRANS: "trans r" and ANTISYM: "antisym r" and
        IN1: "b \<in> aboveS r a" and IN2: "c \<in> above r b"
shows "c \<in> aboveS r a"
proof-
  have 0: "(a,b) \<in> r \<and> (b,c) \<in> r"
  using IN1 IN2 above_def aboveS_def by fast
  hence 1: "(a,c) \<in> r"
  using TRANS trans_def[of r] by blast
  have 2: "a \<noteq> b" using IN1 aboveS_def by force
  have 3: "a \<noteq> c"
  proof
    assume "a = c" with 0 2 ANTISYM antisym_def[of r]
    show False by auto
  qed
  from 1 3 show ?thesis unfolding aboveS_def by simp
qed

lemma aboveS_aboveS_trans:
assumes TRANS: "trans r" and ANTISYM: "antisym r" and
        IN1: "b \<in> aboveS r a" and IN2: "c \<in> aboveS r b"
shows "c \<in> aboveS r a"
proof-
  have "b \<in> above r a"
  using IN1 aboveS_subset_above by fast
  with assms above_aboveS_trans show ?thesis by fast
qed

lemma under_Under_trans:
assumes TRANS: "trans r" and
        IN1: "a \<in> under r b" and IN2: "b \<in> Under r C"
shows "a \<in> Under r C"
proof-
  have "b \<in> {u \<in> Field r. \<forall>x. x \<in> C \<longrightarrow> (u, x) \<in> r}"
    using IN2 Under_def by force
  hence "(a,b) \<in> r \<and> (\<forall>c \<in> C. (b,c) \<in> r)"
    using IN1 under_def by fast
  hence "\<forall>c \<in> C. (a,c) \<in> r"
  using TRANS trans_def[of r] by blast
  moreover
  have "a \<in> Field r" using IN1 unfolding Field_def under_def by blast
  ultimately
  show ?thesis unfolding Under_def by blast
qed

lemma underS_Under_trans:
assumes TRANS: "trans r" and ANTISYM: "antisym r" and
        IN1: "a \<in> underS r b" and IN2: "b \<in> Under r C"
shows "a \<in> UnderS r C"
proof-
  from IN1 have "a \<in> under r b"
  using underS_subset_under[of r b] by fast
  with assms under_Under_trans
  have "a \<in> Under r C" by fast
  (*  *)
  moreover
  have "a \<notin> C"
  proof
    assume *: "a \<in> C"
    have 1: "b \<noteq> a \<and> (a,b) \<in> r"
    using IN1 underS_def[of r b] by auto
    have "\<forall>c \<in> C. (b,c) \<in> r"
    using IN2 Under_def[of r C] by auto
    with * have "(b,a) \<in> r" by simp
    with 1 ANTISYM antisym_def[of r]
    show False by blast
  qed
  (*  *)
  ultimately
  show ?thesis unfolding UnderS_def
  using Under_def by force
qed

lemma underS_UnderS_trans:
assumes TRANS: "trans r" and ANTISYM: "antisym r" and
        IN1: "a \<in> underS r b" and IN2: "b \<in> UnderS r C"
shows "a \<in> UnderS r C"
proof-
  from IN2 have "b \<in> Under r C"
  using UnderS_subset_Under[of r C] by blast
  with underS_Under_trans assms
  show ?thesis by force
qed

lemma above_Above_trans:
assumes TRANS: "trans r" and
        IN1: "a \<in> above r b" and IN2: "b \<in> Above r C"
shows "a \<in> Above r C"
proof-
  have "(b,a) \<in> r \<and> (\<forall>c \<in> C. (c,b) \<in> r)"
    using IN1[unfolded above_def] IN2[unfolded Above_def] by simp
  hence "\<forall>c \<in> C. (c,a) \<in> r"
  using TRANS trans_def[of r] by blast
  moreover
  have "a \<in> Field r" using IN1[unfolded above_def] Field_def by fast
  ultimately
  show ?thesis unfolding Above_def by auto
qed

lemma aboveS_Above_trans:
assumes TRANS: "trans r" and ANTISYM: "antisym r" and
        IN1: "a \<in> aboveS r b" and IN2: "b \<in> Above r C"
shows "a \<in> AboveS r C"
proof-
  from IN1 have "a \<in> above r b"
  using aboveS_subset_above[of r b] by blast
  with assms above_Above_trans
  have "a \<in> Above r C" by fast
  (*  *)
  moreover
  have "a \<notin> C"
  proof
    assume *: "a \<in> C"
    have 1: "b \<noteq> a \<and> (b,a) \<in> r"
    using IN1 aboveS_def[of r b] by auto
    have "\<forall>c \<in> C. (c,b) \<in> r"
    using IN2 Above_def[of r C] by auto
    with * have "(a,b) \<in> r" by simp
    with 1 ANTISYM antisym_def[of r]
    show False by blast
  qed
  (*  *)
  ultimately
  show ?thesis unfolding AboveS_def
  using Above_def by force
qed

lemma above_AboveS_trans:
assumes TRANS: "trans r" and ANTISYM: "antisym r" and
        IN1: "a \<in> above r b" and IN2: "b \<in> AboveS r C"
shows "a \<in> AboveS r C"
proof-
  from IN2 have "b \<in> Above r C"
  using AboveS_subset_Above[of r C] by blast
  with assms above_Above_trans
  have "a \<in> Above r C" by force
  (*  *)
  moreover
  have "a \<notin> C"
  proof
    assume *: "a \<in> C"
    have 1: "(b,a) \<in> r"
    using IN1 above_def[of r b] by auto
    have "\<forall>c \<in> C. b \<noteq> c \<and> (c,b) \<in> r"
    using IN2 AboveS_def[of r C] by auto
    with * have "b \<noteq> a \<and> (a,b) \<in> r" by simp
    with 1 ANTISYM antisym_def[of r]
    show False by blast
  qed
  (*  *)
  ultimately
  show ?thesis unfolding AboveS_def
  using Above_def by force
qed

lemma aboveS_AboveS_trans:
assumes TRANS: "trans r" and ANTISYM: "antisym r" and
        IN1: "a \<in> aboveS r b" and IN2: "b \<in> AboveS r C"
shows "a \<in> AboveS r C"
proof-
  from IN2 have "b \<in> Above r C"
  using AboveS_subset_Above[of r C] by blast
  with aboveS_Above_trans assms
  show ?thesis by force
qed

lemma under_UnderS_trans:
assumes TRANS: "trans r" and ANTISYM: "antisym r" and
        IN1: "a \<in> under r b" and IN2: "b \<in> UnderS r C"
shows "a \<in> UnderS r C"
proof-
  from IN2 have "b \<in> Under r C"
  using UnderS_subset_Under[of r C] by blast
  with assms under_Under_trans
  have "a \<in> Under r C" by force
  (*  *)
  moreover
  have "a \<notin> C"
  proof
    assume *: "a \<in> C"
    have 1: "(a,b) \<in> r"
    using IN1 under_def[of r b] by auto
    have "\<forall>c \<in> C. b \<noteq> c \<and> (b,c) \<in> r"
    using IN2 UnderS_def[of r C] by blast
    with * have "b \<noteq> a \<and> (b,a) \<in> r" by blast
    with 1 ANTISYM antisym_def[of r]
    show False by blast
  qed
  (*  *)
  ultimately
  show ?thesis unfolding UnderS_def Under_def by fast
qed

subsection {* Properties depending on more than one relation *}

lemma under_incr2:
"r \<le> r' \<Longrightarrow> under r a \<le> under r' a"
unfolding under_def by blast

lemma underS_incr2:
"r \<le> r' \<Longrightarrow> underS r a \<le> underS r' a"
unfolding underS_def by blast

(* FIXME: r \<leadsto> r'
lemma Under_incr:
"r \<le> r' \<Longrightarrow> Under r A \<le> Under r A"
unfolding Under_def by blast

lemma UnderS_incr:
"r \<le> r' \<Longrightarrow> UnderS r A \<le> UnderS r A"
unfolding UnderS_def by blast

lemma Under_incr_decr:
"\<lbrakk>r \<le> r'; A' \<le> A\<rbrakk>  \<Longrightarrow> Under r A \<le> Under r A'"
unfolding Under_def by blast

lemma UnderS_incr_decr:
"\<lbrakk>r \<le> r'; A' \<le> A\<rbrakk>  \<Longrightarrow> UnderS r A \<le> UnderS r A'"
unfolding UnderS_def by blast
*)

lemma above_incr2:
"r \<le> r' \<Longrightarrow> above r a \<le> above r' a"
unfolding above_def by blast

lemma aboveS_incr2:
"r \<le> r' \<Longrightarrow> aboveS r a \<le> aboveS r' a"
unfolding aboveS_def by blast

(* FIXME
lemma Above_incr:
"r \<le> r' \<Longrightarrow> Above r A \<le> Above r A"
unfolding Above_def by blast

lemma AboveS_incr:
"r \<le> r' \<Longrightarrow> AboveS r A \<le> AboveS r A"
unfolding AboveS_def by blast

lemma Above_incr_decr:
"\<lbrakk>r \<le> r'; A' \<le> A\<rbrakk> \<Longrightarrow> Above r A \<le> Above r A'"
unfolding Above_def by blast

lemma AboveS_incr_decr:
"\<lbrakk>r \<le> r'; A' \<le> A\<rbrakk> \<Longrightarrow> AboveS r A \<le> AboveS r A'"
unfolding AboveS_def by blast
*)

end