[STATEMENT]
theorem uniquetree: "invar_vebt t n \<Longrightarrow> invar_vebt s n \<Longrightarrow> set_vebt' t = set_vebt' s \<Longrightarrow> s = t"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>invar_vebt t n; invar_vebt s n; set_vebt' t = set_vebt' s\<rbrakk> \<Longrightarrow> s = t
[PROOF STEP]
proof(induction t n arbitrary: s rule: invar_vebt.induct)
[PROOF STATE]
proof (state)
goal (5 subgoals):
 1. \<And>a b s. \<lbrakk>invar_vebt s (Suc 0); set_vebt' (Leaf a b) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Leaf a b
 2. \<And>treeList n summary m deg s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = n; deg = n + m; \<nexists>i. both_member_options summary i; \<forall>t\<in>set treeList. \<nexists>x. both_member_options t x; invar_vebt s deg; set_vebt' (Node None deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node None deg treeList summary
 3. \<And>treeList n summary m deg s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<nexists>i. both_member_options summary i; \<forall>t\<in>set treeList. \<nexists>x. both_member_options t x; invar_vebt s deg; set_vebt' (Node None deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node None deg treeList summary
 4. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
 5. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
[PROOF STEP]
case (1 a b)
[PROOF STATE]
proof (state)
this:
invar_vebt s (Suc 0)
set_vebt' (Leaf a b) = set_vebt' s

goal (5 subgoals):
 1. \<And>a b s. \<lbrakk>invar_vebt s (Suc 0); set_vebt' (Leaf a b) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Leaf a b
 2. \<And>treeList n summary m deg s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = n; deg = n + m; \<nexists>i. both_member_options summary i; \<forall>t\<in>set treeList. \<nexists>x. both_member_options t x; invar_vebt s deg; set_vebt' (Node None deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node None deg treeList summary
 3. \<And>treeList n summary m deg s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<nexists>i. both_member_options summary i; \<forall>t\<in>set treeList. \<nexists>x. both_member_options t x; invar_vebt s deg; set_vebt' (Node None deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node None deg treeList summary
 4. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
 5. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
invar_vebt s (Suc 0)
set_vebt' (Leaf a b) = set_vebt' s
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
invar_vebt s (Suc 0)
set_vebt' (Leaf a b) = set_vebt' s

goal (1 subgoal):
 1. s = Leaf a b
[PROOF STEP]
apply(cases "vebt_member t 0")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>invar_vebt s (Suc 0); set_vebt' (Leaf a b) = set_vebt' s; vebt_member t 0\<rbrakk> \<Longrightarrow> s = Leaf a b
 2. \<lbrakk>invar_vebt s (Suc 0); set_vebt' (Leaf a b) = set_vebt' s; \<not> vebt_member t 0\<rbrakk> \<Longrightarrow> s = Leaf a b
[PROOF STEP]
apply(cases "vebt_member t 1")
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<lbrakk>invar_vebt s (Suc 0); set_vebt' (Leaf a b) = set_vebt' s; vebt_member t 0; vebt_member t 1\<rbrakk> \<Longrightarrow> s = Leaf a b
 2. \<lbrakk>invar_vebt s (Suc 0); set_vebt' (Leaf a b) = set_vebt' s; vebt_member t 0; \<not> vebt_member t 1\<rbrakk> \<Longrightarrow> s = Leaf a b
 3. \<lbrakk>invar_vebt s (Suc 0); set_vebt' (Leaf a b) = set_vebt' s; \<not> vebt_member t 0\<rbrakk> \<Longrightarrow> s = Leaf a b
[PROOF STEP]
apply(cases "vebt_member t 1")
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<lbrakk>invar_vebt s (Suc 0); set_vebt' (Leaf a b) = set_vebt' s; vebt_member t 0; vebt_member t 1; vebt_member t 1\<rbrakk> \<Longrightarrow> s = Leaf a b
 2. \<lbrakk>invar_vebt s (Suc 0); set_vebt' (Leaf a b) = set_vebt' s; vebt_member t 0; vebt_member t 1; \<not> vebt_member t 1\<rbrakk> \<Longrightarrow> s = Leaf a b
 3. \<lbrakk>invar_vebt s (Suc 0); set_vebt' (Leaf a b) = set_vebt' s; vebt_member t 0; \<not> vebt_member t 1\<rbrakk> \<Longrightarrow> s = Leaf a b
 4. \<lbrakk>invar_vebt s (Suc 0); set_vebt' (Leaf a b) = set_vebt' s; \<not> vebt_member t 0\<rbrakk> \<Longrightarrow> s = Leaf a b
[PROOF STEP]
apply (smt (z3) "1.prems"(1) "1.prems"(2) VEBT_Member.vebt_member.simps(1) One_nat_def deg_1_Leafy deg_not_0 less_not_refl mem_Collect_eq set_vebt'_def) +
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
s = Leaf a b

goal (4 subgoals):
 1. \<And>treeList n summary m deg s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = n; deg = n + m; \<nexists>i. both_member_options summary i; \<forall>t\<in>set treeList. \<nexists>x. both_member_options t x; invar_vebt s deg; set_vebt' (Node None deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node None deg treeList summary
 2. \<And>treeList n summary m deg s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<nexists>i. both_member_options summary i; \<forall>t\<in>set treeList. \<nexists>x. both_member_options t x; invar_vebt s deg; set_vebt' (Node None deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node None deg treeList summary
 3. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
 4. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (4 subgoals):
 1. \<And>treeList n summary m deg s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = n; deg = n + m; \<nexists>i. both_member_options summary i; \<forall>t\<in>set treeList. \<nexists>x. both_member_options t x; invar_vebt s deg; set_vebt' (Node None deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node None deg treeList summary
 2. \<And>treeList n summary m deg s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<nexists>i. both_member_options summary i; \<forall>t\<in>set treeList. \<nexists>x. both_member_options t x; invar_vebt s deg; set_vebt' (Node None deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node None deg treeList summary
 3. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
 4. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
[PROOF STEP]
case (2 treeList n summary m deg)
[PROOF STATE]
proof (state)
this:
\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t)
\<lbrakk>invar_vebt ?s m; set_vebt' summary = set_vebt' ?s\<rbrakk> \<Longrightarrow> ?s = summary
invar_vebt summary m
length treeList = 2 ^ m
m = n
deg = n + m
\<nexists>i. both_member_options summary i
\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x
invar_vebt s deg
set_vebt' (Node None deg treeList summary) = set_vebt' s

goal (4 subgoals):
 1. \<And>treeList n summary m deg s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = n; deg = n + m; \<nexists>i. both_member_options summary i; \<forall>t\<in>set treeList. \<nexists>x. both_member_options t x; invar_vebt s deg; set_vebt' (Node None deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node None deg treeList summary
 2. \<And>treeList n summary m deg s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<nexists>i. both_member_options summary i; \<forall>t\<in>set treeList. \<nexists>x. both_member_options t x; invar_vebt s deg; set_vebt' (Node None deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node None deg treeList summary
 3. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
 4. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
[PROOF STEP]
from 2(9)
[PROOF STATE]
proof (chain)
picking this:
invar_vebt s deg
[PROOF STEP]
obtain treeList' summary' where sprop:"s = Node None deg treeList' summary' \<and> deg = n+m
                \<and> length treeList' =2^m \<and> invar_vebt summary' m \<and> (\<forall> t \<in> set treeList'. invar_vebt t n) \<and>
               (\<nexists>i. both_member_options summary' i)"
[PROOF STATE]
proof (prove)
using this:
invar_vebt s deg

goal (1 subgoal):
 1. (\<And>treeList' summary'. s = Node None deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<and> (\<nexists>i. both_member_options summary' i) \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
apply(cases)
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<And>a b. \<lbrakk>\<And>treeList' summary'. s = Node None deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<and> (\<nexists>i. both_member_options summary' i) \<Longrightarrow> thesis; s = Leaf a b; deg = Suc 0\<rbrakk> \<Longrightarrow> thesis
 2. \<And>treeList n summary ma. \<lbrakk>\<And>treeList' summary'. s = Node None deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<and> (\<nexists>i. both_member_options summary' i) \<Longrightarrow> thesis; s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = n; deg = n + ma; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> thesis
 3. \<And>treeList n summary ma. \<lbrakk>\<And>treeList' summary'. s = Node None deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<and> (\<nexists>i. both_member_options summary' i) \<Longrightarrow> thesis; s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = Suc n; deg = n + ma; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> thesis
 4. \<And>treeList n summary ma mi maa. \<lbrakk>\<And>treeList' summary'. s = Node None deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<and> (\<nexists>i. both_member_options summary' i) \<Longrightarrow> thesis; s = Node (Some (mi, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = n; deg = n + ma; \<forall>i<2 ^ ma. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mi = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mi \<le> maa; maa < 2 ^ deg; mi \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ ma. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> thesis
 5. \<And>treeList n summary ma mi maa. \<lbrakk>\<And>treeList' summary'. s = Node None deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<and> (\<nexists>i. both_member_options summary' i) \<Longrightarrow> thesis; s = Node (Some (mi, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = Suc n; deg = n + ma; \<forall>i<2 ^ ma. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mi = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mi \<le> maa; maa < 2 ^ deg; mi \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ ma. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> thesis
[PROOF STEP]
using "2.hyps"(3) "2.hyps"(4) one_is_add
[PROOF STATE]
proof (prove)
using this:
m = n
deg = n + m
(Suc 0 = ?m + ?n) = (?m = Suc 0 \<and> ?n = 0 \<or> ?m = 0 \<and> ?n = Suc 0)

goal (5 subgoals):
 1. \<And>a b. \<lbrakk>\<And>treeList' summary'. s = Node None deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<and> (\<nexists>i. both_member_options summary' i) \<Longrightarrow> thesis; s = Leaf a b; deg = Suc 0\<rbrakk> \<Longrightarrow> thesis
 2. \<And>treeList n summary ma. \<lbrakk>\<And>treeList' summary'. s = Node None deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<and> (\<nexists>i. both_member_options summary' i) \<Longrightarrow> thesis; s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = n; deg = n + ma; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> thesis
 3. \<And>treeList n summary ma. \<lbrakk>\<And>treeList' summary'. s = Node None deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<and> (\<nexists>i. both_member_options summary' i) \<Longrightarrow> thesis; s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = Suc n; deg = n + ma; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> thesis
 4. \<And>treeList n summary ma mi maa. \<lbrakk>\<And>treeList' summary'. s = Node None deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<and> (\<nexists>i. both_member_options summary' i) \<Longrightarrow> thesis; s = Node (Some (mi, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = n; deg = n + ma; \<forall>i<2 ^ ma. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mi = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mi \<le> maa; maa < 2 ^ deg; mi \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ ma. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> thesis
 5. \<And>treeList n summary ma mi maa. \<lbrakk>\<And>treeList' summary'. s = Node None deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<and> (\<nexists>i. both_member_options summary' i) \<Longrightarrow> thesis; s = Node (Some (mi, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = Suc n; deg = n + ma; \<forall>i<2 ^ ma. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mi = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mi \<le> maa; maa < 2 ^ deg; mi \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ ma. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> thesis
[PROOF STEP]
apply force
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>treeList n summary ma. \<lbrakk>\<And>treeList' summary'. s = Node None deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<and> (\<nexists>i. both_member_options summary' i) \<Longrightarrow> thesis; s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = n; deg = n + ma; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> thesis
 2. \<And>treeList n summary ma. \<lbrakk>\<And>treeList' summary'. s = Node None deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<and> (\<nexists>i. both_member_options summary' i) \<Longrightarrow> thesis; s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = Suc n; deg = n + ma; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> thesis
 3. \<And>treeList n summary ma mi maa. \<lbrakk>\<And>treeList' summary'. s = Node None deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<and> (\<nexists>i. both_member_options summary' i) \<Longrightarrow> thesis; s = Node (Some (mi, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = n; deg = n + ma; \<forall>i<2 ^ ma. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mi = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mi \<le> maa; maa < 2 ^ deg; mi \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ ma. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> thesis
 4. \<And>treeList n summary ma mi maa. \<lbrakk>\<And>treeList' summary'. s = Node None deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<and> (\<nexists>i. both_member_options summary' i) \<Longrightarrow> thesis; s = Node (Some (mi, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = Suc n; deg = n + ma; \<forall>i<2 ^ ma. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mi = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mi \<le> maa; maa < 2 ^ deg; mi \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ ma. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> thesis
[PROOF STEP]
apply (metis "2.hyps"(3) "2.hyps"(4) add_self_div_2)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>treeList n summary ma. \<lbrakk>\<And>treeList' summary'. s = Node None deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<and> (\<nexists>i. both_member_options summary' i) \<Longrightarrow> thesis; s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = Suc n; deg = n + ma; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> thesis
 2. \<And>treeList n summary ma mi maa. \<lbrakk>\<And>treeList' summary'. s = Node None deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<and> (\<nexists>i. both_member_options summary' i) \<Longrightarrow> thesis; s = Node (Some (mi, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = n; deg = n + ma; \<forall>i<2 ^ ma. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mi = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mi \<le> maa; maa < 2 ^ deg; mi \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ ma. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> thesis
 3. \<And>treeList n summary ma mi maa. \<lbrakk>\<And>treeList' summary'. s = Node None deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<and> (\<nexists>i. both_member_options summary' i) \<Longrightarrow> thesis; s = Node (Some (mi, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = Suc n; deg = n + ma; \<forall>i<2 ^ ma. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mi = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mi \<le> maa; maa < 2 ^ deg; mi \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ ma. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> thesis
[PROOF STEP]
apply (metis "2.hyps"(3) "2.hyps"(4) One_nat_def add_self_div_2 div_greater_zero_iff even_Suc_div_two not_numeral_le_zero odd_add order.not_eq_order_implies_strict plus_1_eq_Suc zero_le_one zero_neq_one)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>treeList n summary ma mi maa. \<lbrakk>\<And>treeList' summary'. s = Node None deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<and> (\<nexists>i. both_member_options summary' i) \<Longrightarrow> thesis; s = Node (Some (mi, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = n; deg = n + ma; \<forall>i<2 ^ ma. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mi = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mi \<le> maa; maa < 2 ^ deg; mi \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ ma. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> thesis
 2. \<And>treeList n summary ma mi maa. \<lbrakk>\<And>treeList' summary'. s = Node None deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<and> (\<nexists>i. both_member_options summary' i) \<Longrightarrow> thesis; s = Node (Some (mi, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = Suc n; deg = n + ma; \<forall>i<2 ^ ma. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mi = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mi \<le> maa; maa < 2 ^ deg; mi \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ ma. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> thesis
[PROOF STEP]
apply (metis "2.prems"(1) "2.prems"(2) VEBT_Member.vebt_member.simps(2) Suc_1 add_leD1 add_self_div_2 both_member_options_def deg_not_0 div_greater_zero_iff empty_Collect_eq membermima.simps(4) nat_le_iff_add plus_1_eq_Suc set_vebt'_def valid_member_both_member_options)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>treeList n summary ma mi maa. \<lbrakk>\<And>treeList' summary'. s = Node None deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<and> (\<nexists>i. both_member_options summary' i) \<Longrightarrow> thesis; s = Node (Some (mi, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = Suc n; deg = n + ma; \<forall>i<2 ^ ma. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mi = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mi \<le> maa; maa < 2 ^ deg; mi \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ ma. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> thesis
[PROOF STEP]
apply (metis "2.hyps"(3) "2.hyps"(4) add_self_div_2 div2_Suc_Suc even_Suc_div_two odd_add one_is_add plus_1_eq_Suc zero_neq_one)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
s = Node None deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<and> (\<nexists>i. both_member_options summary' i)

goal (4 subgoals):
 1. \<And>treeList n summary m deg s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = n; deg = n + m; \<nexists>i. both_member_options summary i; \<forall>t\<in>set treeList. \<nexists>x. both_member_options t x; invar_vebt s deg; set_vebt' (Node None deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node None deg treeList summary
 2. \<And>treeList n summary m deg s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<nexists>i. both_member_options summary i; \<forall>t\<in>set treeList. \<nexists>x. both_member_options t x; invar_vebt s deg; set_vebt' (Node None deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node None deg treeList summary
 3. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
 4. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
[PROOF STEP]
from 2(9)
[PROOF STATE]
proof (chain)
picking this:
invar_vebt s deg
[PROOF STEP]
have aa:"\<forall> t \<in> set treeList'. invar_vebt t n"
[PROOF STATE]
proof (prove)
using this:
invar_vebt s deg

goal (1 subgoal):
 1. \<forall>t\<in>set treeList'. invar_vebt t n
[PROOF STEP]
using sprop
[PROOF STATE]
proof (prove)
using this:
invar_vebt s deg
s = Node None deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<and> (\<nexists>i. both_member_options summary' i)

goal (1 subgoal):
 1. \<forall>t\<in>set treeList'. invar_vebt t n
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
\<forall>t\<in>set treeList'. invar_vebt t n

goal (4 subgoals):
 1. \<And>treeList n summary m deg s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = n; deg = n + m; \<nexists>i. both_member_options summary i; \<forall>t\<in>set treeList. \<nexists>x. both_member_options t x; invar_vebt s deg; set_vebt' (Node None deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node None deg treeList summary
 2. \<And>treeList n summary m deg s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<nexists>i. both_member_options summary i; \<forall>t\<in>set treeList. \<nexists>x. both_member_options t x; invar_vebt s deg; set_vebt' (Node None deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node None deg treeList summary
 3. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
 4. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
[PROOF STEP]
have ac:"deg \<ge> 2"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. 2 \<le> deg
[PROOF STEP]
by (metis "2.hyps"(3) add_self_div_2 deg_not_0 div_greater_zero_iff sprop)
[PROOF STATE]
proof (state)
this:
2 \<le> deg

goal (4 subgoals):
 1. \<And>treeList n summary m deg s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = n; deg = n + m; \<nexists>i. both_member_options summary i; \<forall>t\<in>set treeList. \<nexists>x. both_member_options t x; invar_vebt s deg; set_vebt' (Node None deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node None deg treeList summary
 2. \<And>treeList n summary m deg s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<nexists>i. both_member_options summary i; \<forall>t\<in>set treeList. \<nexists>x. both_member_options t x; invar_vebt s deg; set_vebt' (Node None deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node None deg treeList summary
 3. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
 4. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
[PROOF STEP]
hence ab:"\<forall> t \<in> set treeList. set_vebt' t = {}"
[PROOF STATE]
proof (prove)
using this:
2 \<le> deg

goal (1 subgoal):
 1. \<forall>t\<in>set treeList. set_vebt' t = {}
[PROOF STEP]
by (metis "2.hyps"(6) empty_Collect_eq min_Null_member not_min_Null_member set_vebt'_def)
[PROOF STATE]
proof (state)
this:
\<forall>t\<in>set treeList. set_vebt' t = {}

goal (4 subgoals):
 1. \<And>treeList n summary m deg s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = n; deg = n + m; \<nexists>i. both_member_options summary i; \<forall>t\<in>set treeList. \<nexists>x. both_member_options t x; invar_vebt s deg; set_vebt' (Node None deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node None deg treeList summary
 2. \<And>treeList n summary m deg s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<nexists>i. both_member_options summary i; \<forall>t\<in>set treeList. \<nexists>x. both_member_options t x; invar_vebt s deg; set_vebt' (Node None deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node None deg treeList summary
 3. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
 4. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
[PROOF STEP]
hence ac:"length treeList' =length treeList"
[PROOF STATE]
proof (prove)
using this:
\<forall>t\<in>set treeList. set_vebt' t = {}

goal (1 subgoal):
 1. length treeList' = length treeList
[PROOF STEP]
by (simp add: "2.hyps"(2) sprop)
[PROOF STATE]
proof (state)
this:
length treeList' = length treeList

goal (4 subgoals):
 1. \<And>treeList n summary m deg s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = n; deg = n + m; \<nexists>i. both_member_options summary i; \<forall>t\<in>set treeList. \<nexists>x. both_member_options t x; invar_vebt s deg; set_vebt' (Node None deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node None deg treeList summary
 2. \<And>treeList n summary m deg s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<nexists>i. both_member_options summary i; \<forall>t\<in>set treeList. \<nexists>x. both_member_options t x; invar_vebt s deg; set_vebt' (Node None deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node None deg treeList summary
 3. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
 4. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
[PROOF STEP]
hence membercongy:"i < 2^m \<Longrightarrow> vebt_member (treeList! i) x \<longleftrightarrow> vebt_member (treeList' ! i) x" for i x
[PROOF STATE]
proof (prove)
using this:
length treeList' = length treeList

goal (1 subgoal):
 1. i < 2 ^ m \<Longrightarrow> vebt_member (treeList ! i) x = vebt_member (treeList' ! i) x
[PROOF STEP]
proof-
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>i < 2 ^ m; length treeList' = length treeList\<rbrakk> \<Longrightarrow> vebt_member (treeList ! i) x = vebt_member (treeList' ! i) x
[PROOF STEP]
assume "i < 2^m"
[PROOF STATE]
proof (state)
this:
i < 2 ^ m

goal (1 subgoal):
 1. \<lbrakk>i < 2 ^ m; length treeList' = length treeList\<rbrakk> \<Longrightarrow> vebt_member (treeList ! i) x = vebt_member (treeList' ! i) x
[PROOF STEP]
show "vebt_member (treeList! i) x \<longleftrightarrow> vebt_member (treeList' ! i) x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. vebt_member (treeList ! i) x = vebt_member (treeList' ! i) x
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. vebt_member (treeList ! i) x \<Longrightarrow> vebt_member (treeList' ! i) x
 2. vebt_member (treeList' ! i) x \<Longrightarrow> vebt_member (treeList ! i) x
[PROOF STEP]
show "vebt_member (treeList ! i) x \<Longrightarrow> vebt_member (treeList' ! i) x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. vebt_member (treeList ! i) x \<Longrightarrow> vebt_member (treeList' ! i) x
[PROOF STEP]
by (metis "2.hyps"(6) \<open>i < 2 ^ m\<close> ac min_Null_member not_min_Null_member nth_mem sprop)
[PROOF STATE]
proof (state)
this:
vebt_member (treeList ! i) x \<Longrightarrow> vebt_member (treeList' ! i) x

goal (1 subgoal):
 1. vebt_member (treeList' ! i) x \<Longrightarrow> vebt_member (treeList ! i) x
[PROOF STEP]
show "vebt_member (treeList' ! i) x \<Longrightarrow> vebt_member (treeList ! i) x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. vebt_member (treeList' ! i) x \<Longrightarrow> vebt_member (treeList ! i) x
[PROOF STEP]
proof-
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. vebt_member (treeList' ! i) x \<Longrightarrow> vebt_member (treeList ! i) x
[PROOF STEP]
assume "vebt_member (treeList' ! i) x"
[PROOF STATE]
proof (state)
this:
vebt_member (treeList' ! i) x

goal (1 subgoal):
 1. vebt_member (treeList' ! i) x \<Longrightarrow> vebt_member (treeList ! i) x
[PROOF STEP]
hence "both_member_options (treeList' ! i) x"
[PROOF STATE]
proof (prove)
using this:
vebt_member (treeList' ! i) x

goal (1 subgoal):
 1. both_member_options (treeList' ! i) x
[PROOF STEP]
by (metis \<open>i < 2 ^ m\<close> both_member_options_equiv_member nth_mem sprop)
[PROOF STATE]
proof (state)
this:
both_member_options (treeList' ! i) x

goal (1 subgoal):
 1. vebt_member (treeList' ! i) x \<Longrightarrow> vebt_member (treeList ! i) x
[PROOF STEP]
hence "membermima (treeList' ! i) x \<or> naive_member (treeList' ! i) x"
[PROOF STATE]
proof (prove)
using this:
both_member_options (treeList' ! i) x

goal (1 subgoal):
 1. membermima (treeList' ! i) x \<or> naive_member (treeList' ! i) x
[PROOF STEP]
unfolding both_member_options_def
[PROOF STATE]
proof (prove)
using this:
naive_member (treeList' ! i) x \<or> membermima (treeList' ! i) x

goal (1 subgoal):
 1. membermima (treeList' ! i) x \<or> naive_member (treeList' ! i) x
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
membermima (treeList' ! i) x \<or> naive_member (treeList' ! i) x

goal (1 subgoal):
 1. vebt_member (treeList' ! i) x \<Longrightarrow> vebt_member (treeList ! i) x
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
membermima (treeList' ! i) x \<or> naive_member (treeList' ! i) x

goal (1 subgoal):
 1. vebt_member (treeList' ! i) x \<Longrightarrow> vebt_member (treeList ! i) x
[PROOF STEP]
have "membermima (treeList' ! i) x \<Longrightarrow> membermima s (2^m*i+x)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. membermima (treeList' ! i) x \<Longrightarrow> membermima s (2 ^ m * i + x)
[PROOF STEP]
using membermima.simps(5)[of "deg-1" treeList' summary' "(2^m*i+x)"] sprop ac
[PROOF STATE]
proof (prove)
using this:
membermima (Node None (Suc (deg - 1)) treeList' summary') (2 ^ m * i + x) = (let pos = high (2 ^ m * i + x) (Suc (deg - 1) div 2) in if pos < length treeList' then membermima (treeList' ! pos) (low (2 ^ m * i + x) (Suc (deg - 1) div 2)) else False)
s = Node None deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<and> (\<nexists>i. both_member_options summary' i)
length treeList' = length treeList

goal (1 subgoal):
 1. membermima (treeList' ! i) x \<Longrightarrow> membermima s (2 ^ m * i + x)
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>membermima (treeList' ! i) x; length treeList' = 2 ^ m; s = Node None (n + m) treeList' summary'; deg = n + m; length treeList = 2 ^ m; invar_vebt summary' m; \<forall>t\<in>set treeList'. invar_vebt t n; \<forall>x. \<not> both_member_options summary' x; let pos = high (2 ^ m * i + x) (Suc (n + m - Suc 0) div 2) in if pos < 2 ^ m then membermima (treeList' ! pos) (low (2 ^ m * i + x) (Suc (n + m - Suc 0) div 2)) else False; let pos = high (2 ^ m * i + x) (Suc (n + m - Suc 0) div 2) in if pos < 2 ^ m then membermima (treeList' ! pos) (low (2 ^ m * i + x) (Suc (n + m - 1) div 2)) else False\<rbrakk> \<Longrightarrow> membermima (Node None (n + m) treeList' summary') (2 ^ m * i + x)
 2. \<lbrakk>membermima (treeList' ! i) x; length treeList' = 2 ^ m; s = Node None (n + m) treeList' summary'; deg = n + m; length treeList = 2 ^ m; invar_vebt summary' m; \<forall>t\<in>set treeList'. invar_vebt t n; \<forall>x. \<not> both_member_options summary' x; \<not> (let pos = high (2 ^ m * i + x) (Suc (n + m - Suc 0) div 2) in if pos < 2 ^ m then membermima (treeList' ! pos) (low (2 ^ m * i + x) (Suc (n + m - Suc 0) div 2)) else False); \<not> (let pos = high (2 ^ m * i + x) (Suc (n + m - Suc 0) div 2) in if pos < 2 ^ m then membermima (treeList' ! pos) (low (2 ^ m * i + x) (Suc (n + m - 1) div 2)) else False)\<rbrakk> \<Longrightarrow> membermima (Node None (n + m) treeList' summary') (2 ^ m * i + x)
[PROOF STEP]
apply (metis One_nat_def Suc_diff_1 \<open>membermima (Node None (Suc (deg - 1)) treeList' summary') (2 ^ m * i + x) = (let pos = high (2 ^ m * i + x) (Suc (deg - 1) div 2) in if pos < length treeList' then membermima (treeList' ! pos) (low (2 ^ m * i + x) (Suc (deg - 1) div 2)) else False)\<close> add.commute deg_not_0 neq0_conv not_add_less1)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>membermima (treeList' ! i) x; length treeList' = 2 ^ m; s = Node None (n + m) treeList' summary'; deg = n + m; length treeList = 2 ^ m; invar_vebt summary' m; \<forall>t\<in>set treeList'. invar_vebt t n; \<forall>x. \<not> both_member_options summary' x; \<not> (let pos = high (2 ^ m * i + x) (Suc (n + m - Suc 0) div 2) in if pos < 2 ^ m then membermima (treeList' ! pos) (low (2 ^ m * i + x) (Suc (n + m - Suc 0) div 2)) else False); \<not> (let pos = high (2 ^ m * i + x) (Suc (n + m - Suc 0) div 2) in if pos < 2 ^ m then membermima (treeList' ! pos) (low (2 ^ m * i + x) (Suc (n + m - 1) div 2)) else False)\<rbrakk> \<Longrightarrow> membermima (Node None (n + m) treeList' summary') (2 ^ m * i + x)
[PROOF STEP]
by (smt (z3) "2.hyps"(3) Nat.add_0_right Suc_pred \<open>i < 2 ^ m\<close> \<open>vebt_member (treeList' ! i) x\<close> add_gr_0 add_self_div_2 deg_not_0 div_less div_mult_self4 high_def low_inv member_bound mult.commute nth_mem power_not_zero zero_neq_numeral)
[PROOF STATE]
proof (state)
this:
membermima (treeList' ! i) x \<Longrightarrow> membermima s (2 ^ m * i + x)

goal (1 subgoal):
 1. vebt_member (treeList' ! i) x \<Longrightarrow> vebt_member (treeList ! i) x
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
membermima (treeList' ! i) x \<Longrightarrow> membermima s (2 ^ m * i + x)

goal (1 subgoal):
 1. vebt_member (treeList' ! i) x \<Longrightarrow> vebt_member (treeList ! i) x
[PROOF STEP]
have "naive_member (treeList' ! i) x \<Longrightarrow> naive_member s (2^m*i+x)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. naive_member (treeList' ! i) x \<Longrightarrow> naive_member s (2 ^ m * i + x)
[PROOF STEP]
using naive_member.simps(3)[of None "deg-1" treeList' summary' "(2^m*i+x)" ] sprop ac
[PROOF STATE]
proof (prove)
using this:
naive_member (Node None (Suc (deg - 1)) treeList' summary') (2 ^ m * i + x) = (let pos = high (2 ^ m * i + x) (Suc (deg - 1) div 2) in if pos < length treeList' then naive_member (treeList' ! pos) (low (2 ^ m * i + x) (Suc (deg - 1) div 2)) else False)
s = Node None deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<and> (\<nexists>i. both_member_options summary' i)
length treeList' = length treeList

goal (1 subgoal):
 1. naive_member (treeList' ! i) x \<Longrightarrow> naive_member s (2 ^ m * i + x)
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>naive_member (treeList' ! i) x; length treeList' = 2 ^ m; s = Node None (n + m) treeList' summary'; deg = n + m; length treeList = 2 ^ m; invar_vebt summary' m; \<forall>t\<in>set treeList'. invar_vebt t n; \<forall>x. \<not> both_member_options summary' x; let pos = high (2 ^ m * i + x) (Suc (n + m - Suc 0) div 2) in if pos < 2 ^ m then naive_member (treeList' ! pos) (low (2 ^ m * i + x) (Suc (n + m - Suc 0) div 2)) else False; let pos = high (2 ^ m * i + x) (Suc (n + m - Suc 0) div 2) in if pos < 2 ^ m then naive_member (treeList' ! pos) (low (2 ^ m * i + x) (Suc (n + m - 1) div 2)) else False\<rbrakk> \<Longrightarrow> naive_member (Node None (n + m) treeList' summary') (2 ^ m * i + x)
 2. \<lbrakk>naive_member (treeList' ! i) x; length treeList' = 2 ^ m; s = Node None (n + m) treeList' summary'; deg = n + m; length treeList = 2 ^ m; invar_vebt summary' m; \<forall>t\<in>set treeList'. invar_vebt t n; \<forall>x. \<not> both_member_options summary' x; \<not> (let pos = high (2 ^ m * i + x) (Suc (n + m - Suc 0) div 2) in if pos < 2 ^ m then naive_member (treeList' ! pos) (low (2 ^ m * i + x) (Suc (n + m - Suc 0) div 2)) else False); \<not> (let pos = high (2 ^ m * i + x) (Suc (n + m - Suc 0) div 2) in if pos < 2 ^ m then naive_member (treeList' ! pos) (low (2 ^ m * i + x) (Suc (n + m - 1) div 2)) else False)\<rbrakk> \<Longrightarrow> naive_member (Node None (n + m) treeList' summary') (2 ^ m * i + x)
[PROOF STEP]
apply (metis One_nat_def Suc_pred' \<open>naive_member (Node None (Suc (deg - 1)) treeList' summary') (2 ^ m * i + x) = (let pos = high (2 ^ m * i + x) (Suc (deg - 1) div 2) in if pos < length treeList' then naive_member (treeList' ! pos) (low (2 ^ m * i + x) (Suc (deg - 1) div 2)) else False)\<close> add_gr_0 deg_not_0)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>naive_member (treeList' ! i) x; length treeList' = 2 ^ m; s = Node None (n + m) treeList' summary'; deg = n + m; length treeList = 2 ^ m; invar_vebt summary' m; \<forall>t\<in>set treeList'. invar_vebt t n; \<forall>x. \<not> both_member_options summary' x; \<not> (let pos = high (2 ^ m * i + x) (Suc (n + m - Suc 0) div 2) in if pos < 2 ^ m then naive_member (treeList' ! pos) (low (2 ^ m * i + x) (Suc (n + m - Suc 0) div 2)) else False); \<not> (let pos = high (2 ^ m * i + x) (Suc (n + m - Suc 0) div 2) in if pos < 2 ^ m then naive_member (treeList' ! pos) (low (2 ^ m * i + x) (Suc (n + m - 1) div 2)) else False)\<rbrakk> \<Longrightarrow> naive_member (Node None (n + m) treeList' summary') (2 ^ m * i + x)
[PROOF STEP]
by (smt (z3) "2.hyps"(3) Nat.add_0_right Suc_pred \<open>i < 2 ^ m\<close> \<open>vebt_member (treeList' ! i) x\<close> add_gr_0 add_self_div_2 deg_not_0 div_less div_mult_self4 high_def low_inv member_bound mult.commute nth_mem power_not_zero zero_neq_numeral)
[PROOF STATE]
proof (state)
this:
naive_member (treeList' ! i) x \<Longrightarrow> naive_member s (2 ^ m * i + x)

goal (1 subgoal):
 1. vebt_member (treeList' ! i) x \<Longrightarrow> vebt_member (treeList ! i) x
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
membermima (treeList' ! i) x \<or> naive_member (treeList' ! i) x
membermima (treeList' ! i) x \<Longrightarrow> membermima s (2 ^ m * i + x)
naive_member (treeList' ! i) x \<Longrightarrow> naive_member s (2 ^ m * i + x)
[PROOF STEP]
have "both_member_options s (2^m*i +x)"
[PROOF STATE]
proof (prove)
using this:
membermima (treeList' ! i) x \<or> naive_member (treeList' ! i) x
membermima (treeList' ! i) x \<Longrightarrow> membermima s (2 ^ m * i + x)
naive_member (treeList' ! i) x \<Longrightarrow> naive_member s (2 ^ m * i + x)

goal (1 subgoal):
 1. both_member_options s (2 ^ m * i + x)
[PROOF STEP]
unfolding both_member_options_def
[PROOF STATE]
proof (prove)
using this:
membermima (treeList' ! i) x \<or> naive_member (treeList' ! i) x
membermima (treeList' ! i) x \<Longrightarrow> membermima s (2 ^ m * i + x)
naive_member (treeList' ! i) x \<Longrightarrow> naive_member s (2 ^ m * i + x)

goal (1 subgoal):
 1. naive_member s (2 ^ m * i + x) \<or> membermima s (2 ^ m * i + x)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
both_member_options s (2 ^ m * i + x)

goal (1 subgoal):
 1. vebt_member (treeList' ! i) x \<Longrightarrow> vebt_member (treeList ! i) x
[PROOF STEP]
hence False
[PROOF STATE]
proof (prove)
using this:
both_member_options s (2 ^ m * i + x)

goal (1 subgoal):
 1. False
[PROOF STEP]
using "2.prems"(1) VEBT_Member.vebt_member.simps(2) sprop valid_member_both_member_options
[PROOF STATE]
proof (prove)
using this:
both_member_options s (2 ^ m * i + x)
invar_vebt s deg
vebt_member (Node None ?uu ?uv ?uw) ?x = False
s = Node None deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<and> (\<nexists>i. both_member_options summary' i)
\<lbrakk>invar_vebt ?t ?n; both_member_options ?t ?x\<rbrakk> \<Longrightarrow> vebt_member ?t ?x

goal (1 subgoal):
 1. False
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
False

goal (1 subgoal):
 1. vebt_member (treeList' ! i) x \<Longrightarrow> vebt_member (treeList ! i) x
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
False
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
False

goal (1 subgoal):
 1. vebt_member (treeList ! i) x
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
vebt_member (treeList ! i) x

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
vebt_member (treeList' ! i) x \<Longrightarrow> vebt_member (treeList ! i) x

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
vebt_member (treeList ! i) x = vebt_member (treeList' ! i) x

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
?i < 2 ^ m \<Longrightarrow> vebt_member (treeList ! ?i) ?x = vebt_member (treeList' ! ?i) ?x

goal (4 subgoals):
 1. \<And>treeList n summary m deg s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = n; deg = n + m; \<nexists>i. both_member_options summary i; \<forall>t\<in>set treeList. \<nexists>x. both_member_options t x; invar_vebt s deg; set_vebt' (Node None deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node None deg treeList summary
 2. \<And>treeList n summary m deg s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<nexists>i. both_member_options summary i; \<forall>t\<in>set treeList. \<nexists>x. both_member_options t x; invar_vebt s deg; set_vebt' (Node None deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node None deg treeList summary
 3. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
 4. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
[PROOF STEP]
hence ad:"i<2^m \<Longrightarrow> set_vebt' (treeList' ! i ) = {}" for i
[PROOF STATE]
proof (prove)
using this:
?i < 2 ^ m \<Longrightarrow> vebt_member (treeList ! ?i) ?x = vebt_member (treeList' ! ?i) ?x

goal (1 subgoal):
 1. i < 2 ^ m \<Longrightarrow> set_vebt' (treeList' ! i) = {}
[PROOF STEP]
proof-
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>i < 2 ^ m; \<And>i x. i < 2 ^ m \<Longrightarrow> vebt_member (treeList ! i) x = vebt_member (treeList' ! i) x\<rbrakk> \<Longrightarrow> set_vebt' (treeList' ! i) = {}
[PROOF STEP]
assume assm:"i < 2^m"
[PROOF STATE]
proof (state)
this:
i < 2 ^ m

goal (1 subgoal):
 1. \<lbrakk>i < 2 ^ m; \<And>i x. i < 2 ^ m \<Longrightarrow> vebt_member (treeList ! i) x = vebt_member (treeList' ! i) x\<rbrakk> \<Longrightarrow> set_vebt' (treeList' ! i) = {}
[PROOF STEP]
show "set_vebt' (treeList' ! i ) = {}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. set_vebt' (treeList' ! i) = {}
[PROOF STEP]
proof(rule ccontr)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. set_vebt' (treeList' ! i) \<noteq> {} \<Longrightarrow> False
[PROOF STEP]
assume "set_vebt' (treeList' ! i ) \<noteq> {}"
[PROOF STATE]
proof (state)
this:
set_vebt' (treeList' ! i) \<noteq> {}

goal (1 subgoal):
 1. set_vebt' (treeList' ! i) \<noteq> {} \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
set_vebt' (treeList' ! i) \<noteq> {}
[PROOF STEP]
obtain y where "vebt_member (treeList' ! i) y"
[PROOF STATE]
proof (prove)
using this:
set_vebt' (treeList' ! i) \<noteq> {}

goal (1 subgoal):
 1. (\<And>y. vebt_member (treeList' ! i) y \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using set_vebt'_def
[PROOF STATE]
proof (prove)
using this:
set_vebt' (treeList' ! i) \<noteq> {}
set_vebt' ?t = {x. vebt_member ?t x}

goal (1 subgoal):
 1. (\<And>y. vebt_member (treeList' ! i) y \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
vebt_member (treeList' ! i) y

goal (1 subgoal):
 1. set_vebt' (treeList' ! i) \<noteq> {} \<Longrightarrow> False
[PROOF STEP]
thus False
[PROOF STATE]
proof (prove)
using this:
vebt_member (treeList' ! i) y

goal (1 subgoal):
 1. False
[PROOF STEP]
using ab ac assm membercongy sprop set_vebt'_def
[PROOF STATE]
proof (prove)
using this:
vebt_member (treeList' ! i) y
\<forall>t\<in>set treeList. set_vebt' t = {}
length treeList' = length treeList
i < 2 ^ m
?i < 2 ^ m \<Longrightarrow> vebt_member (treeList ! ?i) ?x = vebt_member (treeList' ! ?i) ?x
s = Node None deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<and> (\<nexists>i. both_member_options summary' i)
set_vebt' ?t = {x. vebt_member ?t x}

goal (1 subgoal):
 1. False
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
False

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
set_vebt' (treeList' ! i) = {}

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
?i < 2 ^ m \<Longrightarrow> set_vebt' (treeList' ! ?i) = {}

goal (4 subgoals):
 1. \<And>treeList n summary m deg s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = n; deg = n + m; \<nexists>i. both_member_options summary i; \<forall>t\<in>set treeList. \<nexists>x. both_member_options t x; invar_vebt s deg; set_vebt' (Node None deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node None deg treeList summary
 2. \<And>treeList n summary m deg s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<nexists>i. both_member_options summary i; \<forall>t\<in>set treeList. \<nexists>x. both_member_options t x; invar_vebt s deg; set_vebt' (Node None deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node None deg treeList summary
 3. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
 4. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
[PROOF STEP]
hence ae:"i< 2^m \<Longrightarrow> treeList' ! i = treeList ! i"  for i
[PROOF STATE]
proof (prove)
using this:
?i < 2 ^ m \<Longrightarrow> set_vebt' (treeList' ! ?i) = {}

goal (1 subgoal):
 1. i < 2 ^ m \<Longrightarrow> treeList' ! i = treeList ! i
[PROOF STEP]
by (simp add: "2.IH"(1) "2.hyps"(2) ab sprop)
[PROOF STATE]
proof (state)
this:
?i < 2 ^ m \<Longrightarrow> treeList' ! ?i = treeList ! ?i

goal (4 subgoals):
 1. \<And>treeList n summary m deg s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = n; deg = n + m; \<nexists>i. both_member_options summary i; \<forall>t\<in>set treeList. \<nexists>x. both_member_options t x; invar_vebt s deg; set_vebt' (Node None deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node None deg treeList summary
 2. \<And>treeList n summary m deg s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<nexists>i. both_member_options summary i; \<forall>t\<in>set treeList. \<nexists>x. both_member_options t x; invar_vebt s deg; set_vebt' (Node None deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node None deg treeList summary
 3. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
 4. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
?i < 2 ^ m \<Longrightarrow> treeList' ! ?i = treeList ! ?i
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
?i < 2 ^ m \<Longrightarrow> treeList' ! ?i = treeList ! ?i

goal (1 subgoal):
 1. s = Node None deg treeList summary
[PROOF STEP]
by (metis "2.IH"(2) "2.hyps"(1) "2.hyps"(5) ac both_member_options_equiv_member empty_Collect_eq list_eq_iff_nth_eq sprop set_vebt'_def)
[PROOF STATE]
proof (state)
this:
s = Node None deg treeList summary

goal (3 subgoals):
 1. \<And>treeList n summary m deg s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<nexists>i. both_member_options summary i; \<forall>t\<in>set treeList. \<nexists>x. both_member_options t x; invar_vebt s deg; set_vebt' (Node None deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node None deg treeList summary
 2. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
 3. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<And>treeList n summary m deg s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<nexists>i. both_member_options summary i; \<forall>t\<in>set treeList. \<nexists>x. both_member_options t x; invar_vebt s deg; set_vebt' (Node None deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node None deg treeList summary
 2. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
 3. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
[PROOF STEP]
case (3 treeList n summary m deg)
[PROOF STATE]
proof (state)
this:
\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t)
\<lbrakk>invar_vebt ?s m; set_vebt' summary = set_vebt' ?s\<rbrakk> \<Longrightarrow> ?s = summary
invar_vebt summary m
length treeList = 2 ^ m
m = Suc n
deg = n + m
\<nexists>i. both_member_options summary i
\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x
invar_vebt s deg
set_vebt' (Node None deg treeList summary) = set_vebt' s

goal (3 subgoals):
 1. \<And>treeList n summary m deg s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<nexists>i. both_member_options summary i; \<forall>t\<in>set treeList. \<nexists>x. both_member_options t x; invar_vebt s deg; set_vebt' (Node None deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node None deg treeList summary
 2. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
 3. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
[PROOF STEP]
from 3(9)
[PROOF STATE]
proof (chain)
picking this:
invar_vebt s deg
[PROOF STEP]
obtain treeList' summary' where sprop:"s = Node None deg treeList' summary' \<and> deg = n+m
                        \<and> length treeList' =2^m \<and> invar_vebt summary' m \<and> (\<forall> t \<in> set treeList'. invar_vebt t n) \<and>
                       (\<nexists>i. both_member_options summary' i)"
[PROOF STATE]
proof (prove)
using this:
invar_vebt s deg

goal (1 subgoal):
 1. (\<And>treeList' summary'. s = Node None deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<and> (\<nexists>i. both_member_options summary' i) \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
apply(cases)
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<And>a b. \<lbrakk>\<And>treeList' summary'. s = Node None deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<and> (\<nexists>i. both_member_options summary' i) \<Longrightarrow> thesis; s = Leaf a b; deg = Suc 0\<rbrakk> \<Longrightarrow> thesis
 2. \<And>treeList n summary ma. \<lbrakk>\<And>treeList' summary'. s = Node None deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<and> (\<nexists>i. both_member_options summary' i) \<Longrightarrow> thesis; s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = n; deg = n + ma; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> thesis
 3. \<And>treeList n summary ma. \<lbrakk>\<And>treeList' summary'. s = Node None deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<and> (\<nexists>i. both_member_options summary' i) \<Longrightarrow> thesis; s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = Suc n; deg = n + ma; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> thesis
 4. \<And>treeList n summary ma mi maa. \<lbrakk>\<And>treeList' summary'. s = Node None deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<and> (\<nexists>i. both_member_options summary' i) \<Longrightarrow> thesis; s = Node (Some (mi, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = n; deg = n + ma; \<forall>i<2 ^ ma. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mi = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mi \<le> maa; maa < 2 ^ deg; mi \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ ma. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> thesis
 5. \<And>treeList n summary ma mi maa. \<lbrakk>\<And>treeList' summary'. s = Node None deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<and> (\<nexists>i. both_member_options summary' i) \<Longrightarrow> thesis; s = Node (Some (mi, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = Suc n; deg = n + ma; \<forall>i<2 ^ ma. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mi = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mi \<le> maa; maa < 2 ^ deg; mi \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ ma. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> thesis
[PROOF STEP]
apply (metis "3.IH"(1) "3.hyps"(2) "3.hyps"(3) "3.hyps"(4) One_nat_def Suc_1 not_one_le_zero one_is_add set_n_deg_not_0 zero_neq_numeral)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>treeList n summary ma. \<lbrakk>\<And>treeList' summary'. s = Node None deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<and> (\<nexists>i. both_member_options summary' i) \<Longrightarrow> thesis; s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = n; deg = n + ma; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> thesis
 2. \<And>treeList n summary ma. \<lbrakk>\<And>treeList' summary'. s = Node None deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<and> (\<nexists>i. both_member_options summary' i) \<Longrightarrow> thesis; s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = Suc n; deg = n + ma; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> thesis
 3. \<And>treeList n summary ma mi maa. \<lbrakk>\<And>treeList' summary'. s = Node None deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<and> (\<nexists>i. both_member_options summary' i) \<Longrightarrow> thesis; s = Node (Some (mi, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = n; deg = n + ma; \<forall>i<2 ^ ma. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mi = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mi \<le> maa; maa < 2 ^ deg; mi \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ ma. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> thesis
 4. \<And>treeList n summary ma mi maa. \<lbrakk>\<And>treeList' summary'. s = Node None deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<and> (\<nexists>i. both_member_options summary' i) \<Longrightarrow> thesis; s = Node (Some (mi, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = Suc n; deg = n + ma; \<forall>i<2 ^ ma. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mi = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mi \<le> maa; maa < 2 ^ deg; mi \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ ma. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> thesis
[PROOF STEP]
apply (metis "3.hyps"(3) "3.hyps"(4) add_self_div_2 div2_Suc_Suc even_Suc_div_two odd_add plus_1_eq_Suc)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>treeList n summary ma. \<lbrakk>\<And>treeList' summary'. s = Node None deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<and> (\<nexists>i. both_member_options summary' i) \<Longrightarrow> thesis; s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = Suc n; deg = n + ma; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> thesis
 2. \<And>treeList n summary ma mi maa. \<lbrakk>\<And>treeList' summary'. s = Node None deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<and> (\<nexists>i. both_member_options summary' i) \<Longrightarrow> thesis; s = Node (Some (mi, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = n; deg = n + ma; \<forall>i<2 ^ ma. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mi = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mi \<le> maa; maa < 2 ^ deg; mi \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ ma. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> thesis
 3. \<And>treeList n summary ma mi maa. \<lbrakk>\<And>treeList' summary'. s = Node None deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<and> (\<nexists>i. both_member_options summary' i) \<Longrightarrow> thesis; s = Node (Some (mi, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = Suc n; deg = n + ma; \<forall>i<2 ^ ma. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mi = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mi \<le> maa; maa < 2 ^ deg; mi \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ ma. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> thesis
[PROOF STEP]
apply (metis "3.hyps"(3) "3.hyps"(4) Suc_inject add_Suc_right add_self_div_2)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>treeList n summary ma mi maa. \<lbrakk>\<And>treeList' summary'. s = Node None deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<and> (\<nexists>i. both_member_options summary' i) \<Longrightarrow> thesis; s = Node (Some (mi, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = n; deg = n + ma; \<forall>i<2 ^ ma. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mi = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mi \<le> maa; maa < 2 ^ deg; mi \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ ma. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> thesis
 2. \<And>treeList n summary ma mi maa. \<lbrakk>\<And>treeList' summary'. s = Node None deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<and> (\<nexists>i. both_member_options summary' i) \<Longrightarrow> thesis; s = Node (Some (mi, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = Suc n; deg = n + ma; \<forall>i<2 ^ ma. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mi = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mi \<le> maa; maa < 2 ^ deg; mi \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ ma. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> thesis
[PROOF STEP]
apply (metis "3.hyps"(3) "3.hyps"(4) add_Suc_right add_self_div_2 even_Suc_div_two le_add2 le_less_Suc_eq odd_add order.strict_iff_order plus_1_eq_Suc)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>treeList n summary ma mi maa. \<lbrakk>\<And>treeList' summary'. s = Node None deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<and> (\<nexists>i. both_member_options summary' i) \<Longrightarrow> thesis; s = Node (Some (mi, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = Suc n; deg = n + ma; \<forall>i<2 ^ ma. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mi = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mi \<le> maa; maa < 2 ^ deg; mi \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ ma. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> thesis
[PROOF STEP]
apply (metis "3.prems"(1) "3.prems"(2) VEBT_Member.vebt_member.simps(2) Suc_pred' both_member_options_def deg_not_0 mem_Collect_eq membermima.simps(4) set_vebt'_def valid_member_both_member_options)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
s = Node None deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<and> (\<nexists>i. both_member_options summary' i)

goal (3 subgoals):
 1. \<And>treeList n summary m deg s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<nexists>i. both_member_options summary i; \<forall>t\<in>set treeList. \<nexists>x. both_member_options t x; invar_vebt s deg; set_vebt' (Node None deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node None deg treeList summary
 2. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
 3. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
[PROOF STEP]
have ac:"deg \<ge> 2"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. 2 \<le> deg
[PROOF STEP]
by (metis "3.hyps"(3) One_nat_def add_le_mono le_add1 numeral_2_eq_2 plus_1_eq_Suc set_n_deg_not_0 sprop)
[PROOF STATE]
proof (state)
this:
2 \<le> deg

goal (3 subgoals):
 1. \<And>treeList n summary m deg s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<nexists>i. both_member_options summary i; \<forall>t\<in>set treeList. \<nexists>x. both_member_options t x; invar_vebt s deg; set_vebt' (Node None deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node None deg treeList summary
 2. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
 3. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
[PROOF STEP]
hence ab:"\<forall> t \<in> set treeList. set_vebt' t = {}"
[PROOF STATE]
proof (prove)
using this:
2 \<le> deg

goal (1 subgoal):
 1. \<forall>t\<in>set treeList. set_vebt' t = {}
[PROOF STEP]
by (metis "3.hyps"(6) empty_Collect_eq min_Null_member not_min_Null_member set_vebt'_def)
[PROOF STATE]
proof (state)
this:
\<forall>t\<in>set treeList. set_vebt' t = {}

goal (3 subgoals):
 1. \<And>treeList n summary m deg s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<nexists>i. both_member_options summary i; \<forall>t\<in>set treeList. \<nexists>x. both_member_options t x; invar_vebt s deg; set_vebt' (Node None deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node None deg treeList summary
 2. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
 3. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
[PROOF STEP]
hence ac:"length treeList' =length treeList"
[PROOF STATE]
proof (prove)
using this:
\<forall>t\<in>set treeList. set_vebt' t = {}

goal (1 subgoal):
 1. length treeList' = length treeList
[PROOF STEP]
by (simp add: "3.hyps"(2) sprop)
[PROOF STATE]
proof (state)
this:
length treeList' = length treeList

goal (3 subgoals):
 1. \<And>treeList n summary m deg s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<nexists>i. both_member_options summary i; \<forall>t\<in>set treeList. \<nexists>x. both_member_options t x; invar_vebt s deg; set_vebt' (Node None deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node None deg treeList summary
 2. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
 3. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
[PROOF STEP]
hence membercongy:"i < 2^m \<Longrightarrow> vebt_member (treeList! i) x \<longleftrightarrow> vebt_member (treeList' ! i) x" for i x
[PROOF STATE]
proof (prove)
using this:
length treeList' = length treeList

goal (1 subgoal):
 1. i < 2 ^ m \<Longrightarrow> vebt_member (treeList ! i) x = vebt_member (treeList' ! i) x
[PROOF STEP]
proof-
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>i < 2 ^ m; length treeList' = length treeList\<rbrakk> \<Longrightarrow> vebt_member (treeList ! i) x = vebt_member (treeList' ! i) x
[PROOF STEP]
assume "i < 2^m"
[PROOF STATE]
proof (state)
this:
i < 2 ^ m

goal (1 subgoal):
 1. \<lbrakk>i < 2 ^ m; length treeList' = length treeList\<rbrakk> \<Longrightarrow> vebt_member (treeList ! i) x = vebt_member (treeList' ! i) x
[PROOF STEP]
show "vebt_member (treeList! i) x \<longleftrightarrow> vebt_member (treeList' ! i) x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. vebt_member (treeList ! i) x = vebt_member (treeList' ! i) x
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. vebt_member (treeList ! i) x \<Longrightarrow> vebt_member (treeList' ! i) x
 2. vebt_member (treeList' ! i) x \<Longrightarrow> vebt_member (treeList ! i) x
[PROOF STEP]
show "vebt_member (treeList ! i) x \<Longrightarrow> vebt_member (treeList' ! i) x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. vebt_member (treeList ! i) x \<Longrightarrow> vebt_member (treeList' ! i) x
[PROOF STEP]
by (metis "3.hyps"(6) \<open>i < 2 ^ m\<close> ac min_Null_member not_min_Null_member nth_mem sprop)
[PROOF STATE]
proof (state)
this:
vebt_member (treeList ! i) x \<Longrightarrow> vebt_member (treeList' ! i) x

goal (1 subgoal):
 1. vebt_member (treeList' ! i) x \<Longrightarrow> vebt_member (treeList ! i) x
[PROOF STEP]
show "vebt_member (treeList' ! i) x \<Longrightarrow> vebt_member (treeList ! i) x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. vebt_member (treeList' ! i) x \<Longrightarrow> vebt_member (treeList ! i) x
[PROOF STEP]
proof-
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. vebt_member (treeList' ! i) x \<Longrightarrow> vebt_member (treeList ! i) x
[PROOF STEP]
assume "vebt_member (treeList' ! i) x"
[PROOF STATE]
proof (state)
this:
vebt_member (treeList' ! i) x

goal (1 subgoal):
 1. vebt_member (treeList' ! i) x \<Longrightarrow> vebt_member (treeList ! i) x
[PROOF STEP]
hence "both_member_options (treeList' ! i) x"
[PROOF STATE]
proof (prove)
using this:
vebt_member (treeList' ! i) x

goal (1 subgoal):
 1. both_member_options (treeList' ! i) x
[PROOF STEP]
by (metis \<open>i < 2 ^ m\<close> both_member_options_equiv_member nth_mem sprop)
[PROOF STATE]
proof (state)
this:
both_member_options (treeList' ! i) x

goal (1 subgoal):
 1. vebt_member (treeList' ! i) x \<Longrightarrow> vebt_member (treeList ! i) x
[PROOF STEP]
hence "membermima (treeList' ! i) x \<or> naive_member (treeList' ! i) x"
[PROOF STATE]
proof (prove)
using this:
both_member_options (treeList' ! i) x

goal (1 subgoal):
 1. membermima (treeList' ! i) x \<or> naive_member (treeList' ! i) x
[PROOF STEP]
unfolding both_member_options_def
[PROOF STATE]
proof (prove)
using this:
naive_member (treeList' ! i) x \<or> membermima (treeList' ! i) x

goal (1 subgoal):
 1. membermima (treeList' ! i) x \<or> naive_member (treeList' ! i) x
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
membermima (treeList' ! i) x \<or> naive_member (treeList' ! i) x

goal (1 subgoal):
 1. vebt_member (treeList' ! i) x \<Longrightarrow> vebt_member (treeList ! i) x
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
membermima (treeList' ! i) x \<or> naive_member (treeList' ! i) x

goal (1 subgoal):
 1. vebt_member (treeList' ! i) x \<Longrightarrow> vebt_member (treeList ! i) x
[PROOF STEP]
have "membermima (treeList' ! i) x \<Longrightarrow> membermima s (2^n*i+x)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. membermima (treeList' ! i) x \<Longrightarrow> membermima s (2 ^ n * i + x)
[PROOF STEP]
using membermima.simps(5)[of "deg-1" treeList' summary' "(2^n*i+x)"] sprop ac
[PROOF STATE]
proof (prove)
using this:
membermima (Node None (Suc (deg - 1)) treeList' summary') (2 ^ n * i + x) = (let pos = high (2 ^ n * i + x) (Suc (deg - 1) div 2) in if pos < length treeList' then membermima (treeList' ! pos) (low (2 ^ n * i + x) (Suc (deg - 1) div 2)) else False)
s = Node None deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<and> (\<nexists>i. both_member_options summary' i)
length treeList' = length treeList

goal (1 subgoal):
 1. membermima (treeList' ! i) x \<Longrightarrow> membermima s (2 ^ n * i + x)
[PROOF STEP]
by (smt (z3) "3.hyps"(3) "3.prems"(1) Nat.add_diff_assoc Suc_pred \<open>i < 2 ^ m\<close> \<open>vebt_member (treeList' ! i) x\<close> add_diff_cancel_left' add_self_div_2 deg_not_0 even_Suc high_inv le_add1 low_inv member_bound mult.commute mult_2 nth_mem odd_two_times_div_two_nat plus_1_eq_Suc)
[PROOF STATE]
proof (state)
this:
membermima (treeList' ! i) x \<Longrightarrow> membermima s (2 ^ n * i + x)

goal (1 subgoal):
 1. vebt_member (treeList' ! i) x \<Longrightarrow> vebt_member (treeList ! i) x
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
membermima (treeList' ! i) x \<Longrightarrow> membermima s (2 ^ n * i + x)

goal (1 subgoal):
 1. vebt_member (treeList' ! i) x \<Longrightarrow> vebt_member (treeList ! i) x
[PROOF STEP]
have "naive_member (treeList' ! i) x \<Longrightarrow> naive_member s (2^n*i+x)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. naive_member (treeList' ! i) x \<Longrightarrow> naive_member s (2 ^ n * i + x)
[PROOF STEP]
using naive_member.simps(3)[of None "deg-1" treeList' summary' "(2^n*i+x)" ] sprop ac
[PROOF STATE]
proof (prove)
using this:
naive_member (Node None (Suc (deg - 1)) treeList' summary') (2 ^ n * i + x) = (let pos = high (2 ^ n * i + x) (Suc (deg - 1) div 2) in if pos < length treeList' then naive_member (treeList' ! pos) (low (2 ^ n * i + x) (Suc (deg - 1) div 2)) else False)
s = Node None deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<and> (\<nexists>i. both_member_options summary' i)
length treeList' = length treeList

goal (1 subgoal):
 1. naive_member (treeList' ! i) x \<Longrightarrow> naive_member s (2 ^ n * i + x)
[PROOF STEP]
by (smt (z3) "3.hyps"(3) "3.prems"(1) Nat.add_0_right Nat.add_diff_assoc Suc_pred \<open>i < 2 ^ m\<close> \<open>vebt_member (treeList' ! i) x\<close> add_self_div_2 deg_not_0 div_less div_mult_self4 even_Suc_div_two high_def le_add1 low_inv member_bound mult.commute nth_mem odd_add plus_1_eq_Suc power_not_zero zero_neq_numeral)
[PROOF STATE]
proof (state)
this:
naive_member (treeList' ! i) x \<Longrightarrow> naive_member s (2 ^ n * i + x)

goal (1 subgoal):
 1. vebt_member (treeList' ! i) x \<Longrightarrow> vebt_member (treeList ! i) x
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
membermima (treeList' ! i) x \<or> naive_member (treeList' ! i) x
membermima (treeList' ! i) x \<Longrightarrow> membermima s (2 ^ n * i + x)
naive_member (treeList' ! i) x \<Longrightarrow> naive_member s (2 ^ n * i + x)
[PROOF STEP]
have "both_member_options s (2^n*i +x)"
[PROOF STATE]
proof (prove)
using this:
membermima (treeList' ! i) x \<or> naive_member (treeList' ! i) x
membermima (treeList' ! i) x \<Longrightarrow> membermima s (2 ^ n * i + x)
naive_member (treeList' ! i) x \<Longrightarrow> naive_member s (2 ^ n * i + x)

goal (1 subgoal):
 1. both_member_options s (2 ^ n * i + x)
[PROOF STEP]
unfolding both_member_options_def
[PROOF STATE]
proof (prove)
using this:
membermima (treeList' ! i) x \<or> naive_member (treeList' ! i) x
membermima (treeList' ! i) x \<Longrightarrow> membermima s (2 ^ n * i + x)
naive_member (treeList' ! i) x \<Longrightarrow> naive_member s (2 ^ n * i + x)

goal (1 subgoal):
 1. naive_member s (2 ^ n * i + x) \<or> membermima s (2 ^ n * i + x)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
both_member_options s (2 ^ n * i + x)

goal (1 subgoal):
 1. vebt_member (treeList' ! i) x \<Longrightarrow> vebt_member (treeList ! i) x
[PROOF STEP]
hence False
[PROOF STATE]
proof (prove)
using this:
both_member_options s (2 ^ n * i + x)

goal (1 subgoal):
 1. False
[PROOF STEP]
using "3.prems"(1) VEBT_Member.vebt_member.simps(2) sprop valid_member_both_member_options
[PROOF STATE]
proof (prove)
using this:
both_member_options s (2 ^ n * i + x)
invar_vebt s deg
vebt_member (Node None ?uu ?uv ?uw) ?x = False
s = Node None deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<and> (\<nexists>i. both_member_options summary' i)
\<lbrakk>invar_vebt ?t ?n; both_member_options ?t ?x\<rbrakk> \<Longrightarrow> vebt_member ?t ?x

goal (1 subgoal):
 1. False
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
False

goal (1 subgoal):
 1. vebt_member (treeList' ! i) x \<Longrightarrow> vebt_member (treeList ! i) x
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
False
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
False

goal (1 subgoal):
 1. vebt_member (treeList ! i) x
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
vebt_member (treeList ! i) x

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
vebt_member (treeList' ! i) x \<Longrightarrow> vebt_member (treeList ! i) x

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
vebt_member (treeList ! i) x = vebt_member (treeList' ! i) x

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
?i < 2 ^ m \<Longrightarrow> vebt_member (treeList ! ?i) ?x = vebt_member (treeList' ! ?i) ?x

goal (3 subgoals):
 1. \<And>treeList n summary m deg s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<nexists>i. both_member_options summary i; \<forall>t\<in>set treeList. \<nexists>x. both_member_options t x; invar_vebt s deg; set_vebt' (Node None deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node None deg treeList summary
 2. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
 3. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
[PROOF STEP]
hence ad:"i<2^m \<Longrightarrow> set_vebt' (treeList' ! i ) = {}" for i
[PROOF STATE]
proof (prove)
using this:
?i < 2 ^ m \<Longrightarrow> vebt_member (treeList ! ?i) ?x = vebt_member (treeList' ! ?i) ?x

goal (1 subgoal):
 1. i < 2 ^ m \<Longrightarrow> set_vebt' (treeList' ! i) = {}
[PROOF STEP]
proof-
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>i < 2 ^ m; \<And>i x. i < 2 ^ m \<Longrightarrow> vebt_member (treeList ! i) x = vebt_member (treeList' ! i) x\<rbrakk> \<Longrightarrow> set_vebt' (treeList' ! i) = {}
[PROOF STEP]
assume assm:"i < 2^m"
[PROOF STATE]
proof (state)
this:
i < 2 ^ m

goal (1 subgoal):
 1. \<lbrakk>i < 2 ^ m; \<And>i x. i < 2 ^ m \<Longrightarrow> vebt_member (treeList ! i) x = vebt_member (treeList' ! i) x\<rbrakk> \<Longrightarrow> set_vebt' (treeList' ! i) = {}
[PROOF STEP]
show "set_vebt' (treeList' ! i ) = {}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. set_vebt' (treeList' ! i) = {}
[PROOF STEP]
proof(rule ccontr)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. set_vebt' (treeList' ! i) \<noteq> {} \<Longrightarrow> False
[PROOF STEP]
assume "set_vebt' (treeList' ! i ) \<noteq> {}"
[PROOF STATE]
proof (state)
this:
set_vebt' (treeList' ! i) \<noteq> {}

goal (1 subgoal):
 1. set_vebt' (treeList' ! i) \<noteq> {} \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
set_vebt' (treeList' ! i) \<noteq> {}
[PROOF STEP]
obtain y where "vebt_member (treeList' ! i) y"
[PROOF STATE]
proof (prove)
using this:
set_vebt' (treeList' ! i) \<noteq> {}

goal (1 subgoal):
 1. (\<And>y. vebt_member (treeList' ! i) y \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
using set_vebt'_def
[PROOF STATE]
proof (prove)
using this:
set_vebt' (treeList' ! i) \<noteq> {}
set_vebt' ?t = {x. vebt_member ?t x}

goal (1 subgoal):
 1. (\<And>y. vebt_member (treeList' ! i) y \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
vebt_member (treeList' ! i) y

goal (1 subgoal):
 1. set_vebt' (treeList' ! i) \<noteq> {} \<Longrightarrow> False
[PROOF STEP]
thus False
[PROOF STATE]
proof (prove)
using this:
vebt_member (treeList' ! i) y

goal (1 subgoal):
 1. False
[PROOF STEP]
using ab ac assm membercongy sprop set_vebt'_def
[PROOF STATE]
proof (prove)
using this:
vebt_member (treeList' ! i) y
\<forall>t\<in>set treeList. set_vebt' t = {}
length treeList' = length treeList
i < 2 ^ m
?i < 2 ^ m \<Longrightarrow> vebt_member (treeList ! ?i) ?x = vebt_member (treeList' ! ?i) ?x
s = Node None deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<and> (\<nexists>i. both_member_options summary' i)
set_vebt' ?t = {x. vebt_member ?t x}

goal (1 subgoal):
 1. False
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
False

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
set_vebt' (treeList' ! i) = {}

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
?i < 2 ^ m \<Longrightarrow> set_vebt' (treeList' ! ?i) = {}

goal (3 subgoals):
 1. \<And>treeList n summary m deg s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<nexists>i. both_member_options summary i; \<forall>t\<in>set treeList. \<nexists>x. both_member_options t x; invar_vebt s deg; set_vebt' (Node None deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node None deg treeList summary
 2. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
 3. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
[PROOF STEP]
hence ae:"i< 2^m \<Longrightarrow> treeList' ! i = treeList ! i"  for i
[PROOF STATE]
proof (prove)
using this:
?i < 2 ^ m \<Longrightarrow> set_vebt' (treeList' ! ?i) = {}

goal (1 subgoal):
 1. i < 2 ^ m \<Longrightarrow> treeList' ! i = treeList ! i
[PROOF STEP]
by (simp add: "3.IH"(1) "3.hyps"(2) ab sprop)
[PROOF STATE]
proof (state)
this:
?i < 2 ^ m \<Longrightarrow> treeList' ! ?i = treeList ! ?i

goal (3 subgoals):
 1. \<And>treeList n summary m deg s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<nexists>i. both_member_options summary i; \<forall>t\<in>set treeList. \<nexists>x. both_member_options t x; invar_vebt s deg; set_vebt' (Node None deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node None deg treeList summary
 2. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
 3. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
?i < 2 ^ m \<Longrightarrow> treeList' ! ?i = treeList ! ?i
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
?i < 2 ^ m \<Longrightarrow> treeList' ! ?i = treeList ! ?i

goal (1 subgoal):
 1. s = Node None deg treeList summary
[PROOF STEP]
by (metis "3.IH"(2) "3.hyps"(1) "3.hyps"(5) Collect_empty_eq ac both_member_options_equiv_member list_eq_iff_nth_eq sprop set_vebt'_def)
[PROOF STATE]
proof (state)
this:
s = Node None deg treeList summary

goal (2 subgoals):
 1. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
 2. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
 2. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
[PROOF STEP]
case (4 treeList n summary m deg mi ma)
[PROOF STATE]
proof (state)
this:
\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t)
\<lbrakk>invar_vebt ?s m; set_vebt' summary = set_vebt' ?s\<rbrakk> \<Longrightarrow> ?s = summary
invar_vebt summary m
length treeList = 2 ^ m
m = n
deg = n + m
\<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i
mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x)
mi \<le> ma
ma < 2 ^ deg
mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))
invar_vebt s deg
set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s

goal (2 subgoals):
 1. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
 2. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
[PROOF STEP]
note case4= this
[PROOF STATE]
proof (state)
this:
\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t)
\<lbrakk>invar_vebt ?s m; set_vebt' summary = set_vebt' ?s\<rbrakk> \<Longrightarrow> ?s = summary
invar_vebt summary m
length treeList = 2 ^ m
m = n
deg = n + m
\<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i
mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x)
mi \<le> ma
ma < 2 ^ deg
mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))
invar_vebt s deg
set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s

goal (2 subgoals):
 1. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
 2. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
[PROOF STEP]
hence "set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s"
[PROOF STATE]
proof (prove)
using this:
\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t)
\<lbrakk>invar_vebt ?s m; set_vebt' summary = set_vebt' ?s\<rbrakk> \<Longrightarrow> ?s = summary
invar_vebt summary m
length treeList = 2 ^ m
m = n
deg = n + m
\<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i
mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x)
mi \<le> ma
ma < 2 ^ deg
mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))
invar_vebt s deg
set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s

goal (1 subgoal):
 1. set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s

goal (2 subgoals):
 1. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
 2. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
[PROOF STEP]
hence a0:"deg \<ge> 2"
[PROOF STATE]
proof (prove)
using this:
set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s

goal (1 subgoal):
 1. 2 \<le> deg
[PROOF STEP]
using 4
[PROOF STATE]
proof (prove)
using this:
set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s
\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t)
\<lbrakk>invar_vebt ?s m; set_vebt' summary = set_vebt' ?s\<rbrakk> \<Longrightarrow> ?s = summary
invar_vebt summary m
length treeList = 2 ^ m
m = n
deg = n + m
\<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i
mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x)
mi \<le> ma
ma < 2 ^ deg
mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))
invar_vebt s deg
set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s

goal (1 subgoal):
 1. 2 \<le> deg
[PROOF STEP]
by (metis add_self_div_2 deg_not_0 div_greater_zero_iff)
[PROOF STATE]
proof (state)
this:
2 \<le> deg

goal (2 subgoals):
 1. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
 2. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
[PROOF STEP]
hence aa:"{mi, ma} \<subseteq> set_vebt' (Node (Some (mi, ma)) deg treeList summary)"
[PROOF STATE]
proof (prove)
using this:
2 \<le> deg

goal (1 subgoal):
 1. {mi, ma} \<subseteq> set_vebt' (Node (Some (mi, ma)) deg treeList summary)
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. 2 \<le> deg \<Longrightarrow> mi \<in> set_vebt' (Node (Some (mi, ma)) deg treeList summary)
 2. 2 \<le> deg \<Longrightarrow> ma \<in> set_vebt' (Node (Some (mi, ma)) deg treeList summary)
[PROOF STEP]
using vebt_member.simps(5)[of mi ma "deg -2" treeList summary mi]
[PROOF STATE]
proof (prove)
using this:
vebt_member (Node (Some (mi, ma)) (Suc (Suc (deg - 2))) treeList summary) mi = (if mi = mi then True else if mi = ma then True else if mi < mi then False else if ma < mi then False else let h = high mi (Suc (Suc (deg - 2)) div 2); l = low mi (Suc (Suc (deg - 2)) div 2) in if h < length treeList then vebt_member (treeList ! h) l else False)

goal (2 subgoals):
 1. 2 \<le> deg \<Longrightarrow> mi \<in> set_vebt' (Node (Some (mi, ma)) deg treeList summary)
 2. 2 \<le> deg \<Longrightarrow> ma \<in> set_vebt' (Node (Some (mi, ma)) deg treeList summary)
[PROOF STEP]
apply (metis add_2_eq_Suc' le_add_diff_inverse2 mem_Collect_eq set_vebt'_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. 2 \<le> deg \<Longrightarrow> ma \<in> set_vebt' (Node (Some (mi, ma)) deg treeList summary)
[PROOF STEP]
using vebt_member.simps(5)[of mi ma "deg -2" treeList summary ma]
[PROOF STATE]
proof (prove)
using this:
vebt_member (Node (Some (mi, ma)) (Suc (Suc (deg - 2))) treeList summary) ma = (if ma = mi then True else if ma = ma then True else if ma < mi then False else if ma < ma then False else let h = high ma (Suc (Suc (deg - 2)) div 2); l = low ma (Suc (Suc (deg - 2)) div 2) in if h < length treeList then vebt_member (treeList ! h) l else False)

goal (1 subgoal):
 1. 2 \<le> deg \<Longrightarrow> ma \<in> set_vebt' (Node (Some (mi, ma)) deg treeList summary)
[PROOF STEP]
apply (metis add_2_eq_Suc' le_add_diff_inverse2 mem_Collect_eq set_vebt'_def)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
{mi, ma} \<subseteq> set_vebt' (Node (Some (mi, ma)) deg treeList summary)

goal (2 subgoals):
 1. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
 2. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
[PROOF STEP]
from 4(12)
[PROOF STATE]
proof (chain)
picking this:
invar_vebt s deg
[PROOF STEP]
obtain treeList' summary' info where sprop1:"s = Node info deg treeList' summary' \<and> deg = n+m
                       \<and> length treeList' =2^m \<and> invar_vebt summary' m \<and> (\<forall> t \<in> set treeList'. invar_vebt t n) "
[PROOF STATE]
proof (prove)
using this:
invar_vebt s deg

goal (1 subgoal):
 1. (\<And>info treeList' summary'. s = Node info deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
apply cases
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<And>a b. \<lbrakk>\<And>info treeList' summary'. s = Node info deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<Longrightarrow> thesis; s = Leaf a b; deg = Suc 0\<rbrakk> \<Longrightarrow> thesis
 2. \<And>treeList n summary ma. \<lbrakk>\<And>info treeList' summary'. s = Node info deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<Longrightarrow> thesis; s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = n; deg = n + ma; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> thesis
 3. \<And>treeList n summary ma. \<lbrakk>\<And>info treeList' summary'. s = Node info deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<Longrightarrow> thesis; s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = Suc n; deg = n + ma; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> thesis
 4. \<And>treeList n summary ma mi maa. \<lbrakk>\<And>info treeList' summary'. s = Node info deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<Longrightarrow> thesis; s = Node (Some (mi, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = n; deg = n + ma; \<forall>i<2 ^ ma. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mi = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mi \<le> maa; maa < 2 ^ deg; mi \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ ma. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> thesis
 5. \<And>treeList n summary ma mi maa. \<lbrakk>\<And>info treeList' summary'. s = Node info deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<Longrightarrow> thesis; s = Node (Some (mi, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = Suc n; deg = n + ma; \<forall>i<2 ^ ma. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mi = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mi \<le> maa; maa < 2 ^ deg; mi \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ ma. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> thesis
[PROOF STEP]
using "4.hyps"(3) "4.hyps"(4) one_is_add
[PROOF STATE]
proof (prove)
using this:
m = n
deg = n + m
(Suc 0 = ?m + ?n) = (?m = Suc 0 \<and> ?n = 0 \<or> ?m = 0 \<and> ?n = Suc 0)

goal (5 subgoals):
 1. \<And>a b. \<lbrakk>\<And>info treeList' summary'. s = Node info deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<Longrightarrow> thesis; s = Leaf a b; deg = Suc 0\<rbrakk> \<Longrightarrow> thesis
 2. \<And>treeList n summary ma. \<lbrakk>\<And>info treeList' summary'. s = Node info deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<Longrightarrow> thesis; s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = n; deg = n + ma; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> thesis
 3. \<And>treeList n summary ma. \<lbrakk>\<And>info treeList' summary'. s = Node info deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<Longrightarrow> thesis; s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = Suc n; deg = n + ma; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> thesis
 4. \<And>treeList n summary ma mi maa. \<lbrakk>\<And>info treeList' summary'. s = Node info deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<Longrightarrow> thesis; s = Node (Some (mi, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = n; deg = n + ma; \<forall>i<2 ^ ma. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mi = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mi \<le> maa; maa < 2 ^ deg; mi \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ ma. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> thesis
 5. \<And>treeList n summary ma mi maa. \<lbrakk>\<And>info treeList' summary'. s = Node info deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<Longrightarrow> thesis; s = Node (Some (mi, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = Suc n; deg = n + ma; \<forall>i<2 ^ ma. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mi = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mi \<le> maa; maa < 2 ^ deg; mi \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ ma. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> thesis
[PROOF STEP]
apply force
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>treeList n summary ma. \<lbrakk>\<And>info treeList' summary'. s = Node info deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<Longrightarrow> thesis; s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = n; deg = n + ma; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> thesis
 2. \<And>treeList n summary ma. \<lbrakk>\<And>info treeList' summary'. s = Node info deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<Longrightarrow> thesis; s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = Suc n; deg = n + ma; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> thesis
 3. \<And>treeList n summary ma mi maa. \<lbrakk>\<And>info treeList' summary'. s = Node info deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<Longrightarrow> thesis; s = Node (Some (mi, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = n; deg = n + ma; \<forall>i<2 ^ ma. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mi = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mi \<le> maa; maa < 2 ^ deg; mi \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ ma. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> thesis
 4. \<And>treeList n summary ma mi maa. \<lbrakk>\<And>info treeList' summary'. s = Node info deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<Longrightarrow> thesis; s = Node (Some (mi, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = Suc n; deg = n + ma; \<forall>i<2 ^ ma. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mi = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mi \<le> maa; maa < 2 ^ deg; mi \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ ma. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> thesis
[PROOF STEP]
apply (metis "4.hyps"(3) "4.hyps"(4) add_self_div_2)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>treeList n summary ma. \<lbrakk>\<And>info treeList' summary'. s = Node info deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<Longrightarrow> thesis; s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = Suc n; deg = n + ma; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> thesis
 2. \<And>treeList n summary ma mi maa. \<lbrakk>\<And>info treeList' summary'. s = Node info deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<Longrightarrow> thesis; s = Node (Some (mi, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = n; deg = n + ma; \<forall>i<2 ^ ma. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mi = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mi \<le> maa; maa < 2 ^ deg; mi \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ ma. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> thesis
 3. \<And>treeList n summary ma mi maa. \<lbrakk>\<And>info treeList' summary'. s = Node info deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<Longrightarrow> thesis; s = Node (Some (mi, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = Suc n; deg = n + ma; \<forall>i<2 ^ ma. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mi = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mi \<le> maa; maa < 2 ^ deg; mi \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ ma. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> thesis
[PROOF STEP]
apply (metis "4.hyps"(3) "4.hyps"(4) even_Suc odd_add)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>treeList n summary ma mi maa. \<lbrakk>\<And>info treeList' summary'. s = Node info deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<Longrightarrow> thesis; s = Node (Some (mi, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = n; deg = n + ma; \<forall>i<2 ^ ma. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mi = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mi \<le> maa; maa < 2 ^ deg; mi \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ ma. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> thesis
 2. \<And>treeList n summary ma mi maa. \<lbrakk>\<And>info treeList' summary'. s = Node info deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<Longrightarrow> thesis; s = Node (Some (mi, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = Suc n; deg = n + ma; \<forall>i<2 ^ ma. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mi = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mi \<le> maa; maa < 2 ^ deg; mi \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ ma. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> thesis
[PROOF STEP]
apply (metis "4.hyps"(3) "4.hyps"(4) add_self_div_2)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>treeList n summary ma mi maa. \<lbrakk>\<And>info treeList' summary'. s = Node info deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<Longrightarrow> thesis; s = Node (Some (mi, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = Suc n; deg = n + ma; \<forall>i<2 ^ ma. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mi = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mi \<le> maa; maa < 2 ^ deg; mi \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ ma. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> thesis
[PROOF STEP]
apply (metis "4.hyps"(3) "4.hyps"(4) even_Suc odd_add)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
s = Node info deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n)

goal (2 subgoals):
 1. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
 2. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
[PROOF STEP]
have  ac:"invar_vebt t h \<Longrightarrow> invar_vebt k h \<Longrightarrow> set_vebt' t = set_vebt' k \<Longrightarrow> vebt_mint t = vebt_mint k" for t k h
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>invar_vebt t h; invar_vebt k h; set_vebt' t = set_vebt' k\<rbrakk> \<Longrightarrow> vebt_mint t = vebt_mint k
[PROOF STEP]
proof-
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>invar_vebt t h; invar_vebt k h; set_vebt' t = set_vebt' k\<rbrakk> \<Longrightarrow> vebt_mint t = vebt_mint k
[PROOF STEP]
assume assms: "invar_vebt t h" "invar_vebt k h" "set_vebt' t = set_vebt' k"
[PROOF STATE]
proof (state)
this:
invar_vebt t h
invar_vebt k h
set_vebt' t = set_vebt' k

goal (1 subgoal):
 1. \<lbrakk>invar_vebt t h; invar_vebt k h; set_vebt' t = set_vebt' k\<rbrakk> \<Longrightarrow> vebt_mint t = vebt_mint k
[PROOF STEP]
have "\<not> vebt_mint t = vebt_mint k \<Longrightarrow> False"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. vebt_mint t \<noteq> vebt_mint k \<Longrightarrow> False
[PROOF STEP]
proof-
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. vebt_mint t \<noteq> vebt_mint k \<Longrightarrow> False
[PROOF STEP]
assume "vebt_mint t \<noteq> vebt_mint k"
[PROOF STATE]
proof (state)
this:
vebt_mint t \<noteq> vebt_mint k

goal (1 subgoal):
 1. vebt_mint t \<noteq> vebt_mint k \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
vebt_mint t \<noteq> vebt_mint k
[PROOF STEP]
obtain a b where abdef:"vebt_mint t = None \<and> vebt_mint k = Some b \<or>
                            vebt_mint t = Some a \<and> vebt_mint k = None \<or>
                            a < b \<and> Some a = vebt_mint t \<and> Some b = vebt_mint k \<or>
                            b < a \<and> Some a = vebt_mint t \<and> Some b = vebt_mint k"
[PROOF STATE]
proof (prove)
using this:
vebt_mint t \<noteq> vebt_mint k

goal (1 subgoal):
 1. (\<And>b a. vebt_mint t = None \<and> vebt_mint k = Some b \<or> vebt_mint t = Some a \<and> vebt_mint k = None \<or> a < b \<and> Some a = vebt_mint t \<and> Some b = vebt_mint k \<or> b < a \<and> Some a = vebt_mint t \<and> Some b = vebt_mint k \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (metis linorder_neqE_nat option.exhaust)
[PROOF STATE]
proof (state)
this:
vebt_mint t = None \<and> vebt_mint k = Some b \<or> vebt_mint t = Some a \<and> vebt_mint k = None \<or> a < b \<and> Some a = vebt_mint t \<and> Some b = vebt_mint k \<or> b < a \<and> Some a = vebt_mint t \<and> Some b = vebt_mint k

goal (1 subgoal):
 1. vebt_mint t \<noteq> vebt_mint k \<Longrightarrow> False
[PROOF STEP]
show False
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. False
[PROOF STEP]
apply(cases "vebt_mint t = None \<and> vebt_mint k = Some b")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. vebt_mint t = None \<and> vebt_mint k = Some b \<Longrightarrow> False
 2. \<not> (vebt_mint t = None \<and> vebt_mint k = Some b) \<Longrightarrow> False
[PROOF STEP]
apply (metis \<open>vebt_mint t \<noteq> vebt_mint k\<close> assms(1) assms(2) assms(3) mint_corr mint_sound)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<not> (vebt_mint t = None \<and> vebt_mint k = Some b) \<Longrightarrow> False
[PROOF STEP]
apply(cases "   vebt_mint t = Some a \<and> vebt_mint k = None")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>\<not> (vebt_mint t = None \<and> vebt_mint k = Some b); vebt_mint t = Some a \<and> vebt_mint k = None\<rbrakk> \<Longrightarrow> False
 2. \<lbrakk>\<not> (vebt_mint t = None \<and> vebt_mint k = Some b); \<not> (vebt_mint t = Some a \<and> vebt_mint k = None)\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
apply (metis \<open>vebt_mint t \<noteq> vebt_mint k\<close> assms(1) assms(2) assms(3) mint_corr mint_sound)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<not> (vebt_mint t = None \<and> vebt_mint k = Some b); \<not> (vebt_mint t = Some a \<and> vebt_mint k = None)\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
apply (cases "a < b \<and> Some a = vebt_mint t \<and> Some b = vebt_mint k")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>\<not> (vebt_mint t = None \<and> vebt_mint k = Some b); \<not> (vebt_mint t = Some a \<and> vebt_mint k = None); a < b \<and> Some a = vebt_mint t \<and> Some b = vebt_mint k\<rbrakk> \<Longrightarrow> False
 2. \<lbrakk>\<not> (vebt_mint t = None \<and> vebt_mint k = Some b); \<not> (vebt_mint t = Some a \<and> vebt_mint k = None); \<not> (a < b \<and> Some a = vebt_mint t \<and> Some b = vebt_mint k)\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
apply (metis \<open>vebt_mint t \<noteq> vebt_mint k\<close> assms(1) assms(2) assms(3) mint_corr mint_sound)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<not> (vebt_mint t = None \<and> vebt_mint k = Some b); \<not> (vebt_mint t = Some a \<and> vebt_mint k = None); \<not> (a < b \<and> Some a = vebt_mint t \<and> Some b = vebt_mint k)\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
apply (metis \<open>vebt_mint t \<noteq> vebt_mint k\<close> abdef assms(1) assms(2) assms(3) mint_corr mint_sound)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
False

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
vebt_mint t \<noteq> vebt_mint k \<Longrightarrow> False

goal (1 subgoal):
 1. \<lbrakk>invar_vebt t h; invar_vebt k h; set_vebt' t = set_vebt' k\<rbrakk> \<Longrightarrow> vebt_mint t = vebt_mint k
[PROOF STEP]
thus "vebt_mint t = vebt_mint k"
[PROOF STATE]
proof (prove)
using this:
vebt_mint t \<noteq> vebt_mint k \<Longrightarrow> False

goal (1 subgoal):
 1. vebt_mint t = vebt_mint k
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
vebt_mint t = vebt_mint k

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>invar_vebt ?t ?h; invar_vebt ?k ?h; set_vebt' ?t = set_vebt' ?k\<rbrakk> \<Longrightarrow> vebt_mint ?t = vebt_mint ?k

goal (2 subgoals):
 1. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
 2. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
[PROOF STEP]
have  ad:"invar_vebt t h \<Longrightarrow> invar_vebt k h \<Longrightarrow> set_vebt' t = set_vebt' k \<Longrightarrow> vebt_maxt t = vebt_maxt k" for t k h
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>invar_vebt t h; invar_vebt k h; set_vebt' t = set_vebt' k\<rbrakk> \<Longrightarrow> vebt_maxt t = vebt_maxt k
[PROOF STEP]
proof-
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>invar_vebt t h; invar_vebt k h; set_vebt' t = set_vebt' k\<rbrakk> \<Longrightarrow> vebt_maxt t = vebt_maxt k
[PROOF STEP]
assume assms: "invar_vebt t h" "invar_vebt k h" "set_vebt' t = set_vebt' k"
[PROOF STATE]
proof (state)
this:
invar_vebt t h
invar_vebt k h
set_vebt' t = set_vebt' k

goal (1 subgoal):
 1. \<lbrakk>invar_vebt t h; invar_vebt k h; set_vebt' t = set_vebt' k\<rbrakk> \<Longrightarrow> vebt_maxt t = vebt_maxt k
[PROOF STEP]
have "\<not> vebt_maxt t = vebt_maxt k \<Longrightarrow> False"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. vebt_maxt t \<noteq> vebt_maxt k \<Longrightarrow> False
[PROOF STEP]
proof-
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. vebt_maxt t \<noteq> vebt_maxt k \<Longrightarrow> False
[PROOF STEP]
assume "vebt_maxt t \<noteq> vebt_maxt k"
[PROOF STATE]
proof (state)
this:
vebt_maxt t \<noteq> vebt_maxt k

goal (1 subgoal):
 1. vebt_maxt t \<noteq> vebt_maxt k \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
vebt_maxt t \<noteq> vebt_maxt k
[PROOF STEP]
obtain a b where abdef:"vebt_maxt t = None \<and> vebt_maxt k = Some b \<or>
                            vebt_maxt t = Some a \<and> vebt_maxt k = None \<or>
                            a < b \<and> Some a = vebt_maxt t \<and> Some b = vebt_maxt k \<or>
                            b < a \<and> Some a = vebt_maxt t \<and> Some b = vebt_maxt k"
[PROOF STATE]
proof (prove)
using this:
vebt_maxt t \<noteq> vebt_maxt k

goal (1 subgoal):
 1. (\<And>b a. vebt_maxt t = None \<and> vebt_maxt k = Some b \<or> vebt_maxt t = Some a \<and> vebt_maxt k = None \<or> a < b \<and> Some a = vebt_maxt t \<and> Some b = vebt_maxt k \<or> b < a \<and> Some a = vebt_maxt t \<and> Some b = vebt_maxt k \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (metis linorder_neqE_nat option.exhaust)
[PROOF STATE]
proof (state)
this:
vebt_maxt t = None \<and> vebt_maxt k = Some b \<or> vebt_maxt t = Some a \<and> vebt_maxt k = None \<or> a < b \<and> Some a = vebt_maxt t \<and> Some b = vebt_maxt k \<or> b < a \<and> Some a = vebt_maxt t \<and> Some b = vebt_maxt k

goal (1 subgoal):
 1. vebt_maxt t \<noteq> vebt_maxt k \<Longrightarrow> False
[PROOF STEP]
show False
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. False
[PROOF STEP]
apply(cases "vebt_maxt t = None \<and> vebt_maxt k = Some b")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. vebt_maxt t = None \<and> vebt_maxt k = Some b \<Longrightarrow> False
 2. \<not> (vebt_maxt t = None \<and> vebt_maxt k = Some b) \<Longrightarrow> False
[PROOF STEP]
apply (metis \<open>vebt_maxt t \<noteq> vebt_maxt k\<close> assms(1) assms(2) assms(3) maxt_corr maxt_sound)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<not> (vebt_maxt t = None \<and> vebt_maxt k = Some b) \<Longrightarrow> False
[PROOF STEP]
apply(cases "   vebt_maxt t = Some a \<and> vebt_maxt k = None")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>\<not> (vebt_maxt t = None \<and> vebt_maxt k = Some b); vebt_maxt t = Some a \<and> vebt_maxt k = None\<rbrakk> \<Longrightarrow> False
 2. \<lbrakk>\<not> (vebt_maxt t = None \<and> vebt_maxt k = Some b); \<not> (vebt_maxt t = Some a \<and> vebt_maxt k = None)\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
apply (metis \<open>vebt_maxt t \<noteq> vebt_maxt k\<close> assms(1) assms(2) assms(3) maxt_corr maxt_sound)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<not> (vebt_maxt t = None \<and> vebt_maxt k = Some b); \<not> (vebt_maxt t = Some a \<and> vebt_maxt k = None)\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
apply (cases "a < b \<and> Some a = vebt_maxt t \<and> Some b = vebt_maxt k")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>\<not> (vebt_maxt t = None \<and> vebt_maxt k = Some b); \<not> (vebt_maxt t = Some a \<and> vebt_maxt k = None); a < b \<and> Some a = vebt_maxt t \<and> Some b = vebt_maxt k\<rbrakk> \<Longrightarrow> False
 2. \<lbrakk>\<not> (vebt_maxt t = None \<and> vebt_maxt k = Some b); \<not> (vebt_maxt t = Some a \<and> vebt_maxt k = None); \<not> (a < b \<and> Some a = vebt_maxt t \<and> Some b = vebt_maxt k)\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
apply (metis \<open>vebt_maxt t \<noteq> vebt_maxt k\<close> assms(1) assms(2) assms(3) maxt_corr maxt_sound)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<not> (vebt_maxt t = None \<and> vebt_maxt k = Some b); \<not> (vebt_maxt t = Some a \<and> vebt_maxt k = None); \<not> (a < b \<and> Some a = vebt_maxt t \<and> Some b = vebt_maxt k)\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
by (metis \<open>vebt_maxt t \<noteq> vebt_maxt k\<close> abdef assms(1) assms(2) assms(3) maxt_corr maxt_sound)
[PROOF STATE]
proof (state)
this:
False

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
vebt_maxt t \<noteq> vebt_maxt k \<Longrightarrow> False

goal (1 subgoal):
 1. \<lbrakk>invar_vebt t h; invar_vebt k h; set_vebt' t = set_vebt' k\<rbrakk> \<Longrightarrow> vebt_maxt t = vebt_maxt k
[PROOF STEP]
thus "vebt_maxt t = vebt_maxt k"
[PROOF STATE]
proof (prove)
using this:
vebt_maxt t \<noteq> vebt_maxt k \<Longrightarrow> False

goal (1 subgoal):
 1. vebt_maxt t = vebt_maxt k
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
vebt_maxt t = vebt_maxt k

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>invar_vebt ?t ?h; invar_vebt ?k ?h; set_vebt' ?t = set_vebt' ?k\<rbrakk> \<Longrightarrow> vebt_maxt ?t = vebt_maxt ?k

goal (2 subgoals):
 1. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
 2. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
[PROOF STEP]
have infsplit: "info = Some (mi ,ma)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. info = Some (mi, ma)
[PROOF STEP]
using 4(12)
[PROOF STATE]
proof (prove)
using this:
invar_vebt s deg

goal (1 subgoal):
 1. info = Some (mi, ma)
[PROOF STEP]
proof cases
[PROOF STATE]
proof (state)
goal (5 subgoals):
 1. \<And>a b. \<lbrakk>s = Leaf a b; deg = Suc 0\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
 2. \<And>treeList n summary m. \<lbrakk>s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = n; deg = n + m; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
 3. \<And>treeList n summary m. \<lbrakk>s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
 4. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
 5. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
[PROOF STEP]
case (1 a b)
[PROOF STATE]
proof (state)
this:
s = Leaf a b
deg = Suc 0

goal (5 subgoals):
 1. \<And>a b. \<lbrakk>s = Leaf a b; deg = Suc 0\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
 2. \<And>treeList n summary m. \<lbrakk>s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = n; deg = n + m; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
 3. \<And>treeList n summary m. \<lbrakk>s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
 4. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
 5. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
s = Leaf a b
deg = Suc 0
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
s = Leaf a b
deg = Suc 0

goal (1 subgoal):
 1. info = Some (mi, ma)
[PROOF STEP]
using sprop1
[PROOF STATE]
proof (prove)
using this:
s = Leaf a b
deg = Suc 0
s = Node info deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n)

goal (1 subgoal):
 1. info = Some (mi, ma)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
info = Some (mi, ma)

goal (4 subgoals):
 1. \<And>treeList n summary m. \<lbrakk>s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = n; deg = n + m; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
 2. \<And>treeList n summary m. \<lbrakk>s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
 3. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
 4. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (4 subgoals):
 1. \<And>treeList n summary m. \<lbrakk>s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = n; deg = n + m; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
 2. \<And>treeList n summary m. \<lbrakk>s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
 3. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
 4. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
[PROOF STEP]
case (2 treeList n summary m)
[PROOF STATE]
proof (state)
this:
s = Node None deg treeList summary
\<forall>t\<in>set treeList. invar_vebt t n
invar_vebt summary m
length treeList = 2 ^ m
m = n
deg = n + m
\<not> Ex (both_member_options summary)
\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)

goal (4 subgoals):
 1. \<And>treeList n summary m. \<lbrakk>s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = n; deg = n + m; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
 2. \<And>treeList n summary m. \<lbrakk>s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
 3. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
 4. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
s = Node None deg treeList summary
\<forall>t\<in>set treeList. invar_vebt t n
invar_vebt summary m
length treeList = 2 ^ m
m = n
deg = n + m
\<not> Ex (both_member_options summary)
\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
s = Node None deg treeList summary
\<forall>t\<in>set treeList. invar_vebt t n
invar_vebt summary m
length treeList = 2 ^ m
m = n
deg = n + m
\<not> Ex (both_member_options summary)
\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)

goal (1 subgoal):
 1. info = Some (mi, ma)
[PROOF STEP]
by (metis "4.prems"(2) Collect_empty_eq VEBT_Member.vebt_member.simps(2) aa empty_iff insert_subset set_vebt'_def)
[PROOF STATE]
proof (state)
this:
info = Some (mi, ma)

goal (3 subgoals):
 1. \<And>treeList n summary m. \<lbrakk>s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
 2. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
 3. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<And>treeList n summary m. \<lbrakk>s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
 2. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
 3. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
[PROOF STEP]
case (3 treeList n summary m)
[PROOF STATE]
proof (state)
this:
s = Node None deg treeList summary
\<forall>t\<in>set treeList. invar_vebt t n
invar_vebt summary m
length treeList = 2 ^ m
m = Suc n
deg = n + m
\<not> Ex (both_member_options summary)
\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)

goal (3 subgoals):
 1. \<And>treeList n summary m. \<lbrakk>s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
 2. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
 3. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
s = Node None deg treeList summary
\<forall>t\<in>set treeList. invar_vebt t n
invar_vebt summary m
length treeList = 2 ^ m
m = Suc n
deg = n + m
\<not> Ex (both_member_options summary)
\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
s = Node None deg treeList summary
\<forall>t\<in>set treeList. invar_vebt t n
invar_vebt summary m
length treeList = 2 ^ m
m = Suc n
deg = n + m
\<not> Ex (both_member_options summary)
\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)

goal (1 subgoal):
 1. info = Some (mi, ma)
[PROOF STEP]
by (metis "4.prems"(2) Collect_empty_eq VEBT_Member.vebt_member.simps(2) aa empty_iff insert_subset set_vebt'_def)
[PROOF STATE]
proof (state)
this:
info = Some (mi, ma)

goal (2 subgoals):
 1. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
 2. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
 2. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
[PROOF STEP]
case (4 treeList' n' summary' m' mi' ma')
[PROOF STATE]
proof (state)
this:
s = Node (Some (mi', ma')) deg treeList' summary'
\<forall>t\<in>set treeList'. invar_vebt t n'
invar_vebt summary' m'
length treeList' = 2 ^ m'
m' = n'
deg = n' + m'
\<forall>i<2 ^ m'. Ex (both_member_options (treeList' ! i)) = both_member_options summary' i
mi' = ma' \<longrightarrow> (\<forall>t\<in>set treeList'. \<not> Ex (both_member_options t))
mi' \<le> ma'
ma' < 2 ^ deg
mi' \<noteq> ma' \<longrightarrow> (\<forall>i<2 ^ m'. (high ma' n' = i \<longrightarrow> both_member_options (treeList' ! i) (low ma' n')) \<and> (\<forall>x. high x n' = i \<and> both_member_options (treeList' ! i) (low x n') \<longrightarrow> mi' < x \<and> x \<le> ma'))

goal (2 subgoals):
 1. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
 2. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
[PROOF STEP]
have "vebt_mint s = Some mi'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. vebt_mint s = Some mi'
[PROOF STEP]
by (simp add: "4"(1))
[PROOF STATE]
proof (state)
this:
vebt_mint s = Some mi'

goal (2 subgoals):
 1. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
 2. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
[PROOF STEP]
hence "mi' = mi"
[PROOF STATE]
proof (prove)
using this:
vebt_mint s = Some mi'

goal (1 subgoal):
 1. mi' = mi
[PROOF STEP]
by (smt (verit, ccfv_threshold) "4.hyps"(7) "4.prems"(1) "4.prems"(2) VEBT_Member.vebt_member.simps(5) One_nat_def a0 aa add.assoc eq_iff insert_subset leI le_add_diff_inverse less_imp_le_nat mem_Collect_eq min_in_set_def mint_sound numeral_2_eq_2 option.sel order.not_eq_order_implies_strict plus_1_eq_Suc set_vebt'_def)
[PROOF STATE]
proof (state)
this:
mi' = mi

goal (2 subgoals):
 1. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
 2. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
[PROOF STEP]
have "vebt_maxt s = Some ma'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. vebt_maxt s = Some ma'
[PROOF STEP]
by (simp add: "4"(1))
[PROOF STATE]
proof (state)
this:
vebt_maxt s = Some ma'

goal (2 subgoals):
 1. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
 2. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
[PROOF STEP]
hence "ma' < ma \<Longrightarrow> ma\<notin> set_vebt' s"
[PROOF STATE]
proof (prove)
using this:
vebt_maxt s = Some ma'

goal (1 subgoal):
 1. ma' < ma \<Longrightarrow> ma \<notin> set_vebt' s
[PROOF STEP]
by (meson "4.prems"(1) leD max_in_set_def maxt_corr)
[PROOF STATE]
proof (state)
this:
ma' < ma \<Longrightarrow> ma \<notin> set_vebt' s

goal (2 subgoals):
 1. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
 2. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
ma' < ma \<Longrightarrow> ma \<notin> set_vebt' s

goal (2 subgoals):
 1. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
 2. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
[PROOF STEP]
have "ma < ma' \<Longrightarrow> ma' \<notin> set_vebt' (Node (Some (mi, ma)) deg treeList summary)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ma < ma' \<Longrightarrow> ma' \<notin> set_vebt' (Node (Some (mi, ma)) deg treeList summary)
[PROOF STEP]
using case4
[PROOF STATE]
proof (prove)
using this:
\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t)
\<lbrakk>invar_vebt ?s m; set_vebt' summary = set_vebt' ?s\<rbrakk> \<Longrightarrow> ?s = summary
invar_vebt summary m
length treeList = 2 ^ m
m = n
deg = n + m
\<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i
mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x)
mi \<le> ma
ma < 2 ^ deg
mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))
invar_vebt s deg
set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s

goal (1 subgoal):
 1. ma < ma' \<Longrightarrow> ma' \<notin> set_vebt' (Node (Some (mi, ma)) deg treeList summary)
[PROOF STEP]
by (metis dual_order.strict_trans2 mem_Collect_eq member_inv not_less_iff_gr_or_eq set_vebt'_def)
[PROOF STATE]
proof (state)
this:
ma < ma' \<Longrightarrow> ma' \<notin> set_vebt' (Node (Some (mi, ma)) deg treeList summary)

goal (2 subgoals):
 1. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
 2. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
ma' < ma \<Longrightarrow> ma \<notin> set_vebt' s
ma < ma' \<Longrightarrow> ma' \<notin> set_vebt' (Node (Some (mi, ma)) deg treeList summary)
[PROOF STEP]
have "ma'=ma"
[PROOF STATE]
proof (prove)
using this:
ma' < ma \<Longrightarrow> ma \<notin> set_vebt' s
ma < ma' \<Longrightarrow> ma' \<notin> set_vebt' (Node (Some (mi, ma)) deg treeList summary)

goal (1 subgoal):
 1. ma' = ma
[PROOF STEP]
by (metis \<open>vebt_maxt s = Some ma'\<close> aa case4(12) case4(13) insert_subset max_in_set_def maxt_corr not_less_iff_gr_or_eq)
[PROOF STATE]
proof (state)
this:
ma' = ma

goal (2 subgoals):
 1. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
 2. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
ma' = ma
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
ma' = ma

goal (1 subgoal):
 1. info = Some (mi, ma)
[PROOF STEP]
using "4"(1) \<open>mi' = mi\<close> sprop1
[PROOF STATE]
proof (prove)
using this:
ma' = ma
s = Node (Some (mi', ma')) deg treeList' summary'
mi' = mi
s = Node info deg treeList'__ summary'__ \<and> deg = n + m \<and> length treeList'__ = 2 ^ m \<and> invar_vebt summary'__ m \<and> (\<forall>t\<in>set treeList'__. invar_vebt t n)

goal (1 subgoal):
 1. info = Some (mi, ma)
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
info = Some (mi, ma)

goal (1 subgoal):
 1. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
[PROOF STEP]
case (5 treeList n summary m mi' ma')
[PROOF STATE]
proof (state)
this:
s = Node (Some (mi', ma')) deg treeList summary
\<forall>t\<in>set treeList. invar_vebt t n
invar_vebt summary m
length treeList = 2 ^ m
m = Suc n
deg = n + m
\<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i
mi' = ma' \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t))
mi' \<le> ma'
ma' < 2 ^ deg
mi' \<noteq> ma' \<longrightarrow> (\<forall>i<2 ^ m. (high ma' n = i \<longrightarrow> both_member_options (treeList ! i) (low ma' n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi' < x \<and> x \<le> ma'))

goal (1 subgoal):
 1. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
[PROOF STEP]
have "vebt_mint s = Some mi'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. vebt_mint s = Some mi'
[PROOF STEP]
by (simp add: "5"(1))
[PROOF STATE]
proof (state)
this:
vebt_mint s = Some mi'

goal (1 subgoal):
 1. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
[PROOF STEP]
hence "mi' = mi"
[PROOF STATE]
proof (prove)
using this:
vebt_mint s = Some mi'

goal (1 subgoal):
 1. mi' = mi
[PROOF STEP]
by (smt (verit, ccfv_threshold) "4.hyps"(7) "4.prems"(1) "4.prems"(2) VEBT_Member.vebt_member.simps(5) One_nat_def a0 aa add.assoc eq_iff insert_subset leI le_add_diff_inverse less_imp_le_nat mem_Collect_eq min_in_set_def mint_sound numeral_2_eq_2 option.sel order.not_eq_order_implies_strict plus_1_eq_Suc set_vebt'_def)
[PROOF STATE]
proof (state)
this:
mi' = mi

goal (1 subgoal):
 1. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
[PROOF STEP]
have "vebt_maxt s = Some ma'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. vebt_maxt s = Some ma'
[PROOF STEP]
by (simp add: "5"(1))
[PROOF STATE]
proof (state)
this:
vebt_maxt s = Some ma'

goal (1 subgoal):
 1. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
[PROOF STEP]
hence "ma' < ma \<Longrightarrow> ma\<notin> set_vebt' s"
[PROOF STATE]
proof (prove)
using this:
vebt_maxt s = Some ma'

goal (1 subgoal):
 1. ma' < ma \<Longrightarrow> ma \<notin> set_vebt' s
[PROOF STEP]
by (meson "4.prems"(1) leD max_in_set_def maxt_corr)
[PROOF STATE]
proof (state)
this:
ma' < ma \<Longrightarrow> ma \<notin> set_vebt' s

goal (1 subgoal):
 1. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
ma' < ma \<Longrightarrow> ma \<notin> set_vebt' s

goal (1 subgoal):
 1. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
[PROOF STEP]
have "ma < ma' \<Longrightarrow> ma' \<notin> set_vebt' (Node (Some (mi, ma)) deg treeList summary)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ma < ma' \<Longrightarrow> ma' \<notin> set_vebt' (Node (Some (mi, ma)) deg treeList summary)
[PROOF STEP]
using case4
[PROOF STATE]
proof (prove)
using this:
\<forall>t\<in>set treeList__. invar_vebt t na__ \<and> (\<forall>x. invar_vebt x na__ \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t)
\<lbrakk>invar_vebt ?s m__; set_vebt' summary__ = set_vebt' ?s\<rbrakk> \<Longrightarrow> ?s = summary__
invar_vebt summary__ m__
length treeList__ = 2 ^ m__
m__ = na__
deg = na__ + m__
\<forall>i<2 ^ m__. (\<exists>x. both_member_options (treeList__ ! i) x) = both_member_options summary__ i
mi = ma \<longrightarrow> (\<forall>t\<in>set treeList__. \<nexists>x. both_member_options t x)
mi \<le> ma
ma < 2 ^ deg
mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m__. (high ma na__ = i \<longrightarrow> both_member_options (treeList__ ! i) (low ma na__)) \<and> (\<forall>x. high x na__ = i \<and> both_member_options (treeList__ ! i) (low x na__) \<longrightarrow> mi < x \<and> x \<le> ma))
invar_vebt s deg
set_vebt' (Node (Some (mi, ma)) deg treeList__ summary__) = set_vebt' s

goal (1 subgoal):
 1. ma < ma' \<Longrightarrow> ma' \<notin> set_vebt' (Node (Some (mi, ma)) deg treeList summary)
[PROOF STEP]
by (metis dual_order.strict_trans2 mem_Collect_eq member_inv not_less_iff_gr_or_eq set_vebt'_def)
[PROOF STATE]
proof (state)
this:
ma < ma' \<Longrightarrow> ma' \<notin> set_vebt' (Node (Some (mi, ma)) deg treeList summary)

goal (1 subgoal):
 1. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
ma' < ma \<Longrightarrow> ma \<notin> set_vebt' s
ma < ma' \<Longrightarrow> ma' \<notin> set_vebt' (Node (Some (mi, ma)) deg treeList summary)
[PROOF STEP]
have "ma'=ma"
[PROOF STATE]
proof (prove)
using this:
ma' < ma \<Longrightarrow> ma \<notin> set_vebt' s
ma < ma' \<Longrightarrow> ma' \<notin> set_vebt' (Node (Some (mi, ma)) deg treeList summary)

goal (1 subgoal):
 1. ma' = ma
[PROOF STEP]
by (metis "5"(5) "5"(6) case4(5) case4(6) even_Suc odd_add)
[PROOF STATE]
proof (state)
this:
ma' = ma

goal (1 subgoal):
 1. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
ma' = ma
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
ma' = ma

goal (1 subgoal):
 1. info = Some (mi, ma)
[PROOF STEP]
using "5"(1) \<open>mi' = mi\<close> sprop1
[PROOF STATE]
proof (prove)
using this:
ma' = ma
s = Node (Some (mi', ma')) deg treeList summary
mi' = mi
s = Node info deg treeList' summary' \<and> deg = na__ + m__ \<and> length treeList' = 2 ^ m__ \<and> invar_vebt summary' m__ \<and> (\<forall>t\<in>set treeList'. invar_vebt t na__)

goal (1 subgoal):
 1. info = Some (mi, ma)
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
info = Some (mi, ma)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
info = Some (mi, ma)

goal (2 subgoals):
 1. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
 2. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
[PROOF STEP]
from 4(12)
[PROOF STATE]
proof (chain)
picking this:
invar_vebt s deg
[PROOF STEP]
have acd:"mi \<noteq> ma \<longrightarrow>
    (\<forall>i<2 ^ m.
        (high ma n = i \<longrightarrow> both_member_options (treeList' ! i) (low ma n)) \<and>
        (\<forall>x. high x n = i \<and> both_member_options (treeList' ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))"
[PROOF STATE]
proof (prove)
using this:
invar_vebt s deg

goal (1 subgoal):
 1. mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList' ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList' ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))
[PROOF STEP]
apply cases
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<And>a b. \<lbrakk>s = Leaf a b; deg = Suc 0\<rbrakk> \<Longrightarrow> mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList' ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList' ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))
 2. \<And>treeList n summary mb. \<lbrakk>s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary mb; length treeList = 2 ^ mb; mb = n; deg = n + mb; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList' ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList' ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))
 3. \<And>treeList n summary mb. \<lbrakk>s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary mb; length treeList = 2 ^ mb; mb = Suc n; deg = n + mb; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList' ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList' ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))
 4. \<And>treeList n summary mb mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary mb; length treeList = 2 ^ mb; mb = n; deg = n + mb; \<forall>i<2 ^ mb. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ mb. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList' ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList' ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))
 5. \<And>treeList n summary mb mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary mb; length treeList = 2 ^ mb; mb = Suc n; deg = n + mb; \<forall>i<2 ^ mb. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ mb. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList' ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList' ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))
[PROOF STEP]
using sprop1
[PROOF STATE]
proof (prove)
using this:
s = Node info deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n)

goal (5 subgoals):
 1. \<And>a b. \<lbrakk>s = Leaf a b; deg = Suc 0\<rbrakk> \<Longrightarrow> mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList' ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList' ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))
 2. \<And>treeList n summary mb. \<lbrakk>s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary mb; length treeList = 2 ^ mb; mb = n; deg = n + mb; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList' ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList' ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))
 3. \<And>treeList n summary mb. \<lbrakk>s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary mb; length treeList = 2 ^ mb; mb = Suc n; deg = n + mb; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList' ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList' ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))
 4. \<And>treeList n summary mb mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary mb; length treeList = 2 ^ mb; mb = n; deg = n + mb; \<forall>i<2 ^ mb. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ mb. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList' ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList' ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))
 5. \<And>treeList n summary mb mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary mb; length treeList = 2 ^ mb; mb = Suc n; deg = n + mb; \<forall>i<2 ^ mb. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ mb. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList' ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList' ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>treeList n summary mb. \<lbrakk>s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary mb; length treeList = 2 ^ mb; mb = n; deg = n + mb; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList' ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList' ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))
 2. \<And>treeList n summary mb. \<lbrakk>s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary mb; length treeList = 2 ^ mb; mb = Suc n; deg = n + mb; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList' ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList' ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))
 3. \<And>treeList n summary mb mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary mb; length treeList = 2 ^ mb; mb = n; deg = n + mb; \<forall>i<2 ^ mb. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ mb. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList' ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList' ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))
 4. \<And>treeList n summary mb mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary mb; length treeList = 2 ^ mb; mb = Suc n; deg = n + mb; \<forall>i<2 ^ mb. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ mb. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList' ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList' ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))
[PROOF STEP]
using sprop1 infsplit
[PROOF STATE]
proof (prove)
using this:
s = Node info deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n)
info = Some (mi, ma)

goal (4 subgoals):
 1. \<And>treeList n summary mb. \<lbrakk>s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary mb; length treeList = 2 ^ mb; mb = n; deg = n + mb; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList' ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList' ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))
 2. \<And>treeList n summary mb. \<lbrakk>s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary mb; length treeList = 2 ^ mb; mb = Suc n; deg = n + mb; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList' ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList' ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))
 3. \<And>treeList n summary mb mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary mb; length treeList = 2 ^ mb; mb = n; deg = n + mb; \<forall>i<2 ^ mb. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ mb. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList' ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList' ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))
 4. \<And>treeList n summary mb mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary mb; length treeList = 2 ^ mb; mb = Suc n; deg = n + mb; \<forall>i<2 ^ mb. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ mb. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList' ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList' ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>treeList n summary mb. \<lbrakk>s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary mb; length treeList = 2 ^ mb; mb = Suc n; deg = n + mb; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList' ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList' ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))
 2. \<And>treeList n summary mb mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary mb; length treeList = 2 ^ mb; mb = n; deg = n + mb; \<forall>i<2 ^ mb. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ mb. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList' ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList' ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))
 3. \<And>treeList n summary mb mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary mb; length treeList = 2 ^ mb; mb = Suc n; deg = n + mb; \<forall>i<2 ^ mb. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ mb. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList' ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList' ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))
[PROOF STEP]
using sprop1 infsplit
[PROOF STATE]
proof (prove)
using this:
s = Node info deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n)
info = Some (mi, ma)

goal (3 subgoals):
 1. \<And>treeList n summary mb. \<lbrakk>s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary mb; length treeList = 2 ^ mb; mb = Suc n; deg = n + mb; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList' ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList' ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))
 2. \<And>treeList n summary mb mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary mb; length treeList = 2 ^ mb; mb = n; deg = n + mb; \<forall>i<2 ^ mb. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ mb. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList' ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList' ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))
 3. \<And>treeList n summary mb mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary mb; length treeList = 2 ^ mb; mb = Suc n; deg = n + mb; \<forall>i<2 ^ mb. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ mb. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList' ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList' ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>treeList n summary mb mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary mb; length treeList = 2 ^ mb; mb = n; deg = n + mb; \<forall>i<2 ^ mb. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ mb. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList' ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList' ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))
 2. \<And>treeList n summary mb mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary mb; length treeList = 2 ^ mb; mb = Suc n; deg = n + mb; \<forall>i<2 ^ mb. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ mb. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList' ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList' ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))
[PROOF STEP]
apply (metis VEBT.inject(1) add_self_div_2 case4(5) infsplit option.inject prod.inject sprop1)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>treeList n summary mb mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary mb; length treeList = 2 ^ mb; mb = Suc n; deg = n + mb; \<forall>i<2 ^ mb. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ mb. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList' ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList' ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))
[PROOF STEP]
by (metis case4(5) case4(6) even_Suc odd_add)
[PROOF STATE]
proof (state)
this:
mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList' ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList' ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))

goal (2 subgoals):
 1. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
 2. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
[PROOF STEP]
hence "length treeList' = 2^m"
[PROOF STATE]
proof (prove)
using this:
mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList' ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList' ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))

goal (1 subgoal):
 1. length treeList' = 2 ^ m
[PROOF STEP]
using sprop1
[PROOF STATE]
proof (prove)
using this:
mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList' ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList' ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))
s = Node info deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n)

goal (1 subgoal):
 1. length treeList' = 2 ^ m
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
length treeList' = 2 ^ m

goal (2 subgoals):
 1. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
 2. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
[PROOF STEP]
hence aca:"length treeList' =length treeList"
[PROOF STATE]
proof (prove)
using this:
length treeList' = 2 ^ m

goal (1 subgoal):
 1. length treeList' = length treeList
[PROOF STEP]
using "4.hyps"(2)
[PROOF STATE]
proof (prove)
using this:
length treeList' = 2 ^ m
length treeList = 2 ^ m

goal (1 subgoal):
 1. length treeList' = length treeList
[PROOF STEP]
by (simp add: "4.hyps"(2) sprop1)
[PROOF STATE]
proof (state)
this:
length treeList' = length treeList

goal (2 subgoals):
 1. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
 2. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
[PROOF STEP]
from 4(12)
[PROOF STATE]
proof (chain)
picking this:
invar_vebt s deg
[PROOF STEP]
have sumtreelistcong: " \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList' ! i) x) = both_member_options summary' i"
[PROOF STATE]
proof (prove)
using this:
invar_vebt s deg

goal (1 subgoal):
 1. \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList' ! i) x) = both_member_options summary' i
[PROOF STEP]
apply cases
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<And>a b. \<lbrakk>s = Leaf a b; deg = Suc 0\<rbrakk> \<Longrightarrow> \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList' ! i) x) = both_member_options summary' i
 2. \<And>treeList n summary ma. \<lbrakk>s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = n; deg = n + ma; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList' ! i) x) = both_member_options summary' i
 3. \<And>treeList n summary ma. \<lbrakk>s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = Suc n; deg = n + ma; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList' ! i) x) = both_member_options summary' i
 4. \<And>treeList n summary ma mi maa. \<lbrakk>s = Node (Some (mi, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = n; deg = n + ma; \<forall>i<2 ^ ma. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mi = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mi \<le> maa; maa < 2 ^ deg; mi \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ ma. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList' ! i) x) = both_member_options summary' i
 5. \<And>treeList n summary ma mi maa. \<lbrakk>s = Node (Some (mi, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = Suc n; deg = n + ma; \<forall>i<2 ^ ma. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mi = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mi \<le> maa; maa < 2 ^ deg; mi \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ ma. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList' ! i) x) = both_member_options summary' i
[PROOF STEP]
using a0
[PROOF STATE]
proof (prove)
using this:
2 \<le> deg

goal (5 subgoals):
 1. \<And>a b. \<lbrakk>s = Leaf a b; deg = Suc 0\<rbrakk> \<Longrightarrow> \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList' ! i) x) = both_member_options summary' i
 2. \<And>treeList n summary ma. \<lbrakk>s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = n; deg = n + ma; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList' ! i) x) = both_member_options summary' i
 3. \<And>treeList n summary ma. \<lbrakk>s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = Suc n; deg = n + ma; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList' ! i) x) = both_member_options summary' i
 4. \<And>treeList n summary ma mi maa. \<lbrakk>s = Node (Some (mi, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = n; deg = n + ma; \<forall>i<2 ^ ma. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mi = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mi \<le> maa; maa < 2 ^ deg; mi \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ ma. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList' ! i) x) = both_member_options summary' i
 5. \<And>treeList n summary ma mi maa. \<lbrakk>s = Node (Some (mi, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = Suc n; deg = n + ma; \<forall>i<2 ^ ma. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mi = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mi \<le> maa; maa < 2 ^ deg; mi \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ ma. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList' ! i) x) = both_member_options summary' i
[PROOF STEP]
apply linarith
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>treeList n summary ma. \<lbrakk>s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = n; deg = n + ma; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList' ! i) x) = both_member_options summary' i
 2. \<And>treeList n summary ma. \<lbrakk>s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = Suc n; deg = n + ma; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList' ! i) x) = both_member_options summary' i
 3. \<And>treeList n summary ma mi maa. \<lbrakk>s = Node (Some (mi, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = n; deg = n + ma; \<forall>i<2 ^ ma. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mi = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mi \<le> maa; maa < 2 ^ deg; mi \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ ma. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList' ! i) x) = both_member_options summary' i
 4. \<And>treeList n summary ma mi maa. \<lbrakk>s = Node (Some (mi, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = Suc n; deg = n + ma; \<forall>i<2 ^ ma. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mi = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mi \<le> maa; maa < 2 ^ deg; mi \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ ma. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList' ! i) x) = both_member_options summary' i
[PROOF STEP]
apply (metis VEBT.inject(1) nth_mem sprop1)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>treeList n summary ma. \<lbrakk>s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = Suc n; deg = n + ma; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList' ! i) x) = both_member_options summary' i
 2. \<And>treeList n summary ma mi maa. \<lbrakk>s = Node (Some (mi, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = n; deg = n + ma; \<forall>i<2 ^ ma. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mi = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mi \<le> maa; maa < 2 ^ deg; mi \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ ma. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList' ! i) x) = both_member_options summary' i
 3. \<And>treeList n summary ma mi maa. \<lbrakk>s = Node (Some (mi, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = Suc n; deg = n + ma; \<forall>i<2 ^ ma. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mi = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mi \<le> maa; maa < 2 ^ deg; mi \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ ma. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList' ! i) x) = both_member_options summary' i
[PROOF STEP]
using infsplit sprop1
[PROOF STATE]
proof (prove)
using this:
info = Some (mi, ma)
s = Node info deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n)

goal (3 subgoals):
 1. \<And>treeList n summary ma. \<lbrakk>s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = Suc n; deg = n + ma; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList' ! i) x) = both_member_options summary' i
 2. \<And>treeList n summary ma mi maa. \<lbrakk>s = Node (Some (mi, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = n; deg = n + ma; \<forall>i<2 ^ ma. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mi = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mi \<le> maa; maa < 2 ^ deg; mi \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ ma. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList' ! i) x) = both_member_options summary' i
 3. \<And>treeList n summary ma mi maa. \<lbrakk>s = Node (Some (mi, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = Suc n; deg = n + ma; \<forall>i<2 ^ ma. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mi = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mi \<le> maa; maa < 2 ^ deg; mi \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ ma. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList' ! i) x) = both_member_options summary' i
[PROOF STEP]
apply force
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>treeList n summary ma mi maa. \<lbrakk>s = Node (Some (mi, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = n; deg = n + ma; \<forall>i<2 ^ ma. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mi = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mi \<le> maa; maa < 2 ^ deg; mi \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ ma. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList' ! i) x) = both_member_options summary' i
 2. \<And>treeList n summary ma mi maa. \<lbrakk>s = Node (Some (mi, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = Suc n; deg = n + ma; \<forall>i<2 ^ ma. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mi = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mi \<le> maa; maa < 2 ^ deg; mi \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ ma. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList' ! i) x) = both_member_options summary' i
[PROOF STEP]
apply (metis VEBT.inject(1) sprop1)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>treeList n summary ma mi maa. \<lbrakk>s = Node (Some (mi, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = Suc n; deg = n + ma; \<forall>i<2 ^ ma. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mi = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mi \<le> maa; maa < 2 ^ deg; mi \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ ma. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList' ! i) x) = both_member_options summary' i
[PROOF STEP]
using sprop1
[PROOF STATE]
proof (prove)
using this:
s = Node info deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n)

goal (1 subgoal):
 1. \<And>treeList n summary ma mi maa. \<lbrakk>s = Node (Some (mi, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = Suc n; deg = n + ma; \<forall>i<2 ^ ma. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mi = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mi \<le> maa; maa < 2 ^ deg; mi \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ ma. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList' ! i) x) = both_member_options summary' i
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList' ! i) x) = both_member_options summary' i

goal (2 subgoals):
 1. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
 2. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
[PROOF STEP]
hence membercongy:"i < 2^m \<Longrightarrow> vebt_member (treeList! i) x \<longleftrightarrow> vebt_member (treeList' ! i) x" for i x
[PROOF STATE]
proof (prove)
using this:
\<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList' ! i) x) = both_member_options summary' i

goal (1 subgoal):
 1. i < 2 ^ m \<Longrightarrow> vebt_member (treeList ! i) x = vebt_member (treeList' ! i) x
[PROOF STEP]
proof-
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>i < 2 ^ m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList' ! i) x) = both_member_options summary' i\<rbrakk> \<Longrightarrow> vebt_member (treeList ! i) x = vebt_member (treeList' ! i) x
[PROOF STEP]
assume "i < 2^m"
[PROOF STATE]
proof (state)
this:
i < 2 ^ m

goal (1 subgoal):
 1. \<lbrakk>i < 2 ^ m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList' ! i) x) = both_member_options summary' i\<rbrakk> \<Longrightarrow> vebt_member (treeList ! i) x = vebt_member (treeList' ! i) x
[PROOF STEP]
show "vebt_member (treeList! i) x \<longleftrightarrow> vebt_member (treeList' ! i) x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. vebt_member (treeList ! i) x = vebt_member (treeList' ! i) x
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. vebt_member (treeList ! i) x \<Longrightarrow> vebt_member (treeList' ! i) x
 2. vebt_member (treeList' ! i) x \<Longrightarrow> vebt_member (treeList ! i) x
[PROOF STEP]
show "vebt_member (treeList ! i) x \<Longrightarrow> vebt_member (treeList' ! i) x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. vebt_member (treeList ! i) x \<Longrightarrow> vebt_member (treeList' ! i) x
[PROOF STEP]
proof-
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. vebt_member (treeList ! i) x \<Longrightarrow> vebt_member (treeList' ! i) x
[PROOF STEP]
assume "vebt_member (treeList ! i) x"
[PROOF STATE]
proof (state)
this:
vebt_member (treeList ! i) x

goal (1 subgoal):
 1. vebt_member (treeList ! i) x \<Longrightarrow> vebt_member (treeList' ! i) x
[PROOF STEP]
hence aaa:"both_member_options (treeList ! i) x"
[PROOF STATE]
proof (prove)
using this:
vebt_member (treeList ! i) x

goal (1 subgoal):
 1. both_member_options (treeList ! i) x
[PROOF STEP]
by (metis \<open>i < 2 ^ m\<close> both_member_options_equiv_member case4(1) case4(4) nth_mem)
[PROOF STATE]
proof (state)
this:
both_member_options (treeList ! i) x

goal (1 subgoal):
 1. vebt_member (treeList ! i) x \<Longrightarrow> vebt_member (treeList' ! i) x
[PROOF STEP]
have "x < 2^n"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x < 2 ^ n
[PROOF STEP]
by (metis \<open>i < 2 ^ m\<close> \<open>vebt_member (treeList ! i) x\<close> case4(1) case4(4) member_bound nth_mem)
[PROOF STATE]
proof (state)
this:
x < 2 ^ n

goal (1 subgoal):
 1. vebt_member (treeList ! i) x \<Longrightarrow> vebt_member (treeList' ! i) x
[PROOF STEP]
hence "vebt_member (Node (Some (mi, ma)) deg treeList summary) (2^n*i+x)"
[PROOF STATE]
proof (prove)
using this:
x < 2 ^ n

goal (1 subgoal):
 1. vebt_member (Node (Some (mi, ma)) deg treeList summary) (2 ^ n * i + x)
[PROOF STEP]
using both_member_options_from_chilf_to_complete_tree
            [of " (2^n*i+x)" deg treeList mi ma summary] aaa high_inv[of x n i]
[PROOF STATE]
proof (prove)
using this:
x < 2 ^ n
\<lbrakk>high (2 ^ n * i + x) (deg div 2) < length treeList; 1 \<le> deg; both_member_options (treeList ! high (2 ^ n * i + x) (deg div 2)) (low (2 ^ n * i + x) (deg div 2))\<rbrakk> \<Longrightarrow> both_member_options (Node (Some (mi, ma)) deg treeList summary) (2 ^ n * i + x)
both_member_options (treeList ! i) x
x < 2 ^ n \<Longrightarrow> high (i * 2 ^ n + x) n = i

goal (1 subgoal):
 1. vebt_member (Node (Some (mi, ma)) deg treeList summary) (2 ^ n * i + x)
[PROOF STEP]
by (smt (z3) VEBT_Member.vebt_member.simps(5) Suc_diff_Suc Suc_leD \<open>i < 2 ^ m\<close> \<open>vebt_member (treeList ! i) x\<close> a0 add_self_div_2 case4(11) case4(4) case4(5) case4(8) le_add_diff_inverse le_less_Suc_eq le_neq_implies_less low_inv mult.commute nat_1_add_1 not_less_iff_gr_or_eq nth_mem plus_1_eq_Suc sprop1)
[PROOF STATE]
proof (state)
this:
vebt_member (Node (Some (mi, ma)) deg treeList summary) (2 ^ n * i + x)

goal (1 subgoal):
 1. vebt_member (treeList ! i) x \<Longrightarrow> vebt_member (treeList' ! i) x
[PROOF STEP]
have "mi <  (2^n*i+x) \<and>  (2^n*i+x) \<le> ma"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. mi < 2 ^ n * i + x \<and> 2 ^ n * i + x \<le> ma
[PROOF STEP]
using vebt_mint.simps(3)[of mi ma deg treeList summary]
[PROOF STATE]
proof (prove)
using this:
vebt_mint (Node (Some (mi, ma)) deg treeList summary) = Some mi

goal (1 subgoal):
 1. mi < 2 ^ n * i + x \<and> 2 ^ n * i + x \<le> ma
[PROOF STEP]
by (metis \<open>i < 2 ^ m\<close> \<open>x < 2 ^ n\<close> aaa case4(11) case4(4) case4(8) high_inv low_inv mult.commute nth_mem)
[PROOF STATE]
proof (state)
this:
mi < 2 ^ n * i + x \<and> 2 ^ n * i + x \<le> ma

goal (1 subgoal):
 1. vebt_member (treeList ! i) x \<Longrightarrow> vebt_member (treeList' ! i) x
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
mi < 2 ^ n * i + x \<and> 2 ^ n * i + x \<le> ma

goal (1 subgoal):
 1. vebt_member (treeList ! i) x \<Longrightarrow> vebt_member (treeList' ! i) x
[PROOF STEP]
have "both_member_options s (2^m*i +x)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. both_member_options s (2 ^ m * i + x)
[PROOF STEP]
using \<open>vebt_member (Node (Some (mi, ma)) deg treeList summary) (2 ^ n * i + x)\<close> both_member_options_equiv_member case4(12) case4(13) case4(5) set_vebt'_def
[PROOF STATE]
proof (prove)
using this:
vebt_member (Node (Some (mi, ma)) deg treeList summary) (2 ^ n * i + x)
invar_vebt ?t ?n \<Longrightarrow> both_member_options ?t ?x = vebt_member ?t ?x
invar_vebt s deg
set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s
m = n
set_vebt' ?t = {x. vebt_member ?t x}

goal (1 subgoal):
 1. both_member_options s (2 ^ m * i + x)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
both_member_options s (2 ^ m * i + x)

goal (1 subgoal):
 1. vebt_member (treeList ! i) x \<Longrightarrow> vebt_member (treeList' ! i) x
[PROOF STEP]
hence "both_member_options (treeList' ! i) x"
[PROOF STATE]
proof (prove)
using this:
both_member_options s (2 ^ m * i + x)

goal (1 subgoal):
 1. both_member_options (treeList' ! i) x
[PROOF STEP]
by (smt (z3) \<open>i < 2 ^ m\<close>  acd \<open>x < 2 ^ n\<close> a0 add_leD1 add_self_div_2 both_member_options_from_complete_tree_to_child calculation case4(5) high_inv infsplit low_inv mult.commute nat_neq_iff numeral_2_eq_2 plus_1_eq_Suc sprop1)
[PROOF STATE]
proof (state)
this:
both_member_options (treeList' ! i) x

goal (1 subgoal):
 1. vebt_member (treeList ! i) x \<Longrightarrow> vebt_member (treeList' ! i) x
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
both_member_options (treeList' ! i) x
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
both_member_options (treeList' ! i) x

goal (1 subgoal):
 1. vebt_member (treeList' ! i) x
[PROOF STEP]
by (metis \<open>i < 2 ^ m\<close> nth_mem sprop1 valid_member_both_member_options)
[PROOF STATE]
proof (state)
this:
vebt_member (treeList' ! i) x

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
vebt_member (treeList ! i) x \<Longrightarrow> vebt_member (treeList' ! i) x

goal (1 subgoal):
 1. vebt_member (treeList' ! i) x \<Longrightarrow> vebt_member (treeList ! i) x
[PROOF STEP]
show "vebt_member (treeList' ! i) x \<Longrightarrow> vebt_member (treeList ! i) x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. vebt_member (treeList' ! i) x \<Longrightarrow> vebt_member (treeList ! i) x
[PROOF STEP]
proof-
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. vebt_member (treeList' ! i) x \<Longrightarrow> vebt_member (treeList ! i) x
[PROOF STEP]
assume "vebt_member (treeList' ! i) x"
[PROOF STATE]
proof (state)
this:
vebt_member (treeList' ! i) x

goal (1 subgoal):
 1. vebt_member (treeList' ! i) x \<Longrightarrow> vebt_member (treeList ! i) x
[PROOF STEP]
hence "vebt_member s (2^n*i +x)"
[PROOF STATE]
proof (prove)
using this:
vebt_member (treeList' ! i) x

goal (1 subgoal):
 1. vebt_member s (2 ^ n * i + x)
[PROOF STEP]
using sprop1 both_member_options_from_chilf_to_complete_tree
            [of "(2^n*i +x)" deg treeList' mi ma summary']
[PROOF STATE]
proof (prove)
using this:
vebt_member (treeList' ! i) x
s = Node info deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n)
\<lbrakk>high (2 ^ n * i + x) (deg div 2) < length treeList'; 1 \<le> deg; both_member_options (treeList' ! high (2 ^ n * i + x) (deg div 2)) (low (2 ^ n * i + x) (deg div 2))\<rbrakk> \<Longrightarrow> both_member_options (Node (Some (mi, ma)) deg treeList' summary') (2 ^ n * i + x)

goal (1 subgoal):
 1. vebt_member s (2 ^ n * i + x)
[PROOF STEP]
by (smt (z3) Nat.add_0_right \<open>i < 2 ^ m\<close> a0 add_leD1 add_self_div_2 both_member_options_equiv_member case4(12) case4(5) div_less div_mult_self4 high_def infsplit low_inv member_bound mult.commute nat_1_add_1 nth_mem power_not_zero zero_neq_numeral)
[PROOF STATE]
proof (state)
this:
vebt_member s (2 ^ n * i + x)

goal (1 subgoal):
 1. vebt_member (treeList' ! i) x \<Longrightarrow> vebt_member (treeList ! i) x
[PROOF STEP]
hence "mi < (2^n*i +x) \<and> (2^n*i +x) \<le> ma "
[PROOF STATE]
proof (prove)
using this:
vebt_member s (2 ^ n * i + x)

goal (1 subgoal):
 1. mi < 2 ^ n * i + x \<and> 2 ^ n * i + x \<le> ma
[PROOF STEP]
using vebt_mint.simps(3)[of mi ma deg treeList' summary'] vebt_maxt.simps(3)[of mi ma deg treeList' summary']
[PROOF STATE]
proof (prove)
using this:
vebt_member s (2 ^ n * i + x)
vebt_mint (Node (Some (mi, ma)) deg treeList' summary') = Some mi
vebt_maxt (Node (Some (mi, ma)) deg treeList' summary') = Some ma

goal (1 subgoal):
 1. mi < 2 ^ n * i + x \<and> 2 ^ n * i + x \<le> ma
[PROOF STEP]
by (metis \<open>i < 2 ^ m\<close> \<open>vebt_member (treeList' ! i) x\<close> acd both_member_options_equiv_member case4(12) high_inv infsplit low_inv member_bound mi_eq_ma_no_ch mult.commute nth_mem sprop1)
[PROOF STATE]
proof (state)
this:
mi < 2 ^ n * i + x \<and> 2 ^ n * i + x \<le> ma

goal (1 subgoal):
 1. vebt_member (treeList' ! i) x \<Longrightarrow> vebt_member (treeList ! i) x
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
mi < 2 ^ n * i + x \<and> 2 ^ n * i + x \<le> ma

goal (1 subgoal):
 1. vebt_member (treeList' ! i) x \<Longrightarrow> vebt_member (treeList ! i) x
[PROOF STEP]
have "both_member_options (Node (Some (mi, ma)) deg treeList summary) (2^m*i +x)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. both_member_options (Node (Some (mi, ma)) deg treeList summary) (2 ^ m * i + x)
[PROOF STEP]
by (metis \<open>vebt_member s (2 ^ n * i + x)\<close> add_leD1 both_member_options_equiv_member both_member_options_from_chilf_to_complete_tree calculation case4(1) case4(13) case4(5) maxbmo vebt_maxt.simps(3) mem_Collect_eq member_inv nat_neq_iff nth_mem one_add_one set_vebt'_def)
[PROOF STATE]
proof (state)
this:
both_member_options (Node (Some (mi, ma)) deg treeList summary) (2 ^ m * i + x)

goal (1 subgoal):
 1. vebt_member (treeList' ! i) x \<Longrightarrow> vebt_member (treeList ! i) x
[PROOF STEP]
hence "both_member_options (treeList ! i) x"
[PROOF STATE]
proof (prove)
using this:
both_member_options (Node (Some (mi, ma)) deg treeList summary) (2 ^ m * i + x)

goal (1 subgoal):
 1. both_member_options (treeList ! i) x
[PROOF STEP]
using both_member_options_from_complete_tree_to_child[of deg mi ma treeList summary "(2^n*i +x)"]
[PROOF STATE]
proof (prove)
using this:
both_member_options (Node (Some (mi, ma)) deg treeList summary) (2 ^ m * i + x)
\<lbrakk>1 \<le> deg; both_member_options (Node (Some (mi, ma)) deg treeList summary) (2 ^ n * i + x)\<rbrakk> \<Longrightarrow> both_member_options (treeList ! high (2 ^ n * i + x) (deg div 2)) (low (2 ^ n * i + x) (deg div 2)) \<or> 2 ^ n * i + x = mi \<or> 2 ^ n * i + x = ma

goal (1 subgoal):
 1. both_member_options (treeList ! i) x
[PROOF STEP]
by (smt (z3) Nat.add_0_right Suc_leD \<open>i < 2 ^ m\<close> \<open>vebt_member (treeList' ! i) x\<close> a0 add_self_div_2 calculation case4(11) case4(5) div_less div_mult_self4 high_def low_inv member_bound mult.commute nat_1_add_1 nat_neq_iff nth_mem plus_1_eq_Suc power_not_zero sprop1 zero_neq_numeral)
[PROOF STATE]
proof (state)
this:
both_member_options (treeList ! i) x

goal (1 subgoal):
 1. vebt_member (treeList' ! i) x \<Longrightarrow> vebt_member (treeList ! i) x
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
both_member_options (treeList ! i) x
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
both_member_options (treeList ! i) x

goal (1 subgoal):
 1. vebt_member (treeList ! i) x
[PROOF STEP]
by (metis \<open>i < 2 ^ m\<close> aca case4(1) nth_mem sprop1 valid_member_both_member_options)
[PROOF STATE]
proof (state)
this:
vebt_member (treeList ! i) x

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
vebt_member (treeList' ! i) x \<Longrightarrow> vebt_member (treeList ! i) x

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
vebt_member (treeList ! i) x = vebt_member (treeList' ! i) x

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
?i < 2 ^ m \<Longrightarrow> vebt_member (treeList ! ?i) ?x = vebt_member (treeList' ! ?i) ?x

goal (2 subgoals):
 1. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
 2. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
[PROOF STEP]
hence setcongy: "i < 2^m \<Longrightarrow> set_vebt' (treeList ! i) = set_vebt' (treeList' ! i)" for i
[PROOF STATE]
proof (prove)
using this:
?i < 2 ^ m \<Longrightarrow> vebt_member (treeList ! ?i) ?x = vebt_member (treeList' ! ?i) ?x

goal (1 subgoal):
 1. i < 2 ^ m \<Longrightarrow> set_vebt' (treeList ! i) = set_vebt' (treeList' ! i)
[PROOF STEP]
unfolding set_vebt'_def
[PROOF STATE]
proof (prove)
using this:
?i < 2 ^ m \<Longrightarrow> vebt_member (treeList ! ?i) ?x = vebt_member (treeList' ! ?i) ?x

goal (1 subgoal):
 1. i < 2 ^ m \<Longrightarrow> Collect (vebt_member (treeList ! i)) = Collect (vebt_member (treeList' ! i))
[PROOF STEP]
by presburger
[PROOF STATE]
proof (state)
this:
?i < 2 ^ m \<Longrightarrow> set_vebt' (treeList ! ?i) = set_vebt' (treeList' ! ?i)

goal (2 subgoals):
 1. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
 2. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
[PROOF STEP]
hence treecongy: "i < 2^m \<Longrightarrow> treeList ! i = treeList' ! i" for i
[PROOF STATE]
proof (prove)
using this:
?i < 2 ^ m \<Longrightarrow> set_vebt' (treeList ! ?i) = set_vebt' (treeList' ! ?i)

goal (1 subgoal):
 1. i < 2 ^ m \<Longrightarrow> treeList ! i = treeList' ! i
[PROOF STEP]
by (metis case4(1) case4(4) nth_mem sprop1)
[PROOF STATE]
proof (state)
this:
?i < 2 ^ m \<Longrightarrow> treeList ! ?i = treeList' ! ?i

goal (2 subgoals):
 1. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
 2. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
[PROOF STEP]
hence "treeList = treeList'"
[PROOF STATE]
proof (prove)
using this:
?i < 2 ^ m \<Longrightarrow> treeList ! ?i = treeList' ! ?i

goal (1 subgoal):
 1. treeList = treeList'
[PROOF STEP]
by (metis aca case4(4) nth_equalityI)
[PROOF STATE]
proof (state)
this:
treeList = treeList'

goal (2 subgoals):
 1. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
 2. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
[PROOF STEP]
have "vebt_member summary x \<longleftrightarrow> vebt_member summary' x" for x
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. vebt_member summary x = vebt_member summary' x
[PROOF STEP]
by (metis \<open>treeList = treeList'\<close> both_member_options_equiv_member case4(3) case4(7) member_bound sprop1 sumtreelistcong)
[PROOF STATE]
proof (state)
this:
vebt_member summary ?x = vebt_member summary' ?x

goal (2 subgoals):
 1. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
 2. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
[PROOF STEP]
hence "set_vebt' summary = set_vebt' summary'"
[PROOF STATE]
proof (prove)
using this:
vebt_member summary ?x = vebt_member summary' ?x

goal (1 subgoal):
 1. set_vebt' summary = set_vebt' summary'
[PROOF STEP]
unfolding set_vebt'_def
[PROOF STATE]
proof (prove)
using this:
vebt_member summary ?x = vebt_member summary' ?x

goal (1 subgoal):
 1. Collect (vebt_member summary) = Collect (vebt_member summary')
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
set_vebt' summary = set_vebt' summary'

goal (2 subgoals):
 1. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
 2. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
[PROOF STEP]
hence "summary = summary'"
[PROOF STATE]
proof (prove)
using this:
set_vebt' summary = set_vebt' summary'

goal (1 subgoal):
 1. summary = summary'
[PROOF STEP]
using case4(2) sprop1
[PROOF STATE]
proof (prove)
using this:
set_vebt' summary = set_vebt' summary'
\<lbrakk>invar_vebt ?s m; set_vebt' summary = set_vebt' ?s\<rbrakk> \<Longrightarrow> ?s = summary
s = Node info deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n)

goal (1 subgoal):
 1. summary = summary'
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
summary = summary'

goal (2 subgoals):
 1. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
 2. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
summary = summary'
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
summary = summary'

goal (1 subgoal):
 1. s = Node (Some (mi, ma)) deg treeList summary
[PROOF STEP]
using \<open>treeList = treeList'\<close> infsplit sprop1
[PROOF STATE]
proof (prove)
using this:
summary = summary'
treeList = treeList'
info = Some (mi, ma)
s = Node info deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n)

goal (1 subgoal):
 1. s = Node (Some (mi, ma)) deg treeList summary
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
s = Node (Some (mi, ma)) deg treeList summary

goal (1 subgoal):
 1. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
[PROOF STEP]
case (5 treeList n summary m deg mi ma)
[PROOF STATE]
proof (state)
this:
\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t)
\<lbrakk>invar_vebt ?s m; set_vebt' summary = set_vebt' ?s\<rbrakk> \<Longrightarrow> ?s = summary
invar_vebt summary m
length treeList = 2 ^ m
m = Suc n
deg = n + m
\<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i
mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x)
mi \<le> ma
ma < 2 ^ deg
mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))
invar_vebt s deg
set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s

goal (1 subgoal):
 1. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
[PROOF STEP]
note case4= this
[PROOF STATE]
proof (state)
this:
\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t)
\<lbrakk>invar_vebt ?s m; set_vebt' summary = set_vebt' ?s\<rbrakk> \<Longrightarrow> ?s = summary
invar_vebt summary m
length treeList = 2 ^ m
m = Suc n
deg = n + m
\<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i
mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x)
mi \<le> ma
ma < 2 ^ deg
mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))
invar_vebt s deg
set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s

goal (1 subgoal):
 1. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
[PROOF STEP]
hence "set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s"
[PROOF STATE]
proof (prove)
using this:
\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t)
\<lbrakk>invar_vebt ?s m; set_vebt' summary = set_vebt' ?s\<rbrakk> \<Longrightarrow> ?s = summary
invar_vebt summary m
length treeList = 2 ^ m
m = Suc n
deg = n + m
\<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i
mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x)
mi \<le> ma
ma < 2 ^ deg
mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))
invar_vebt s deg
set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s

goal (1 subgoal):
 1. set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s

goal (1 subgoal):
 1. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
[PROOF STEP]
hence a0:"deg \<ge> 2"
[PROOF STATE]
proof (prove)
using this:
set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s

goal (1 subgoal):
 1. 2 \<le> deg
[PROOF STEP]
using 5
[PROOF STATE]
proof (prove)
using this:
set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s
\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t)
\<lbrakk>invar_vebt ?s m; set_vebt' summary = set_vebt' ?s\<rbrakk> \<Longrightarrow> ?s = summary
invar_vebt summary m
length treeList = 2 ^ m
m = Suc n
deg = n + m
\<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i
mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x)
mi \<le> ma
ma < 2 ^ deg
mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))
invar_vebt s deg
set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s

goal (1 subgoal):
 1. 2 \<le> deg
[PROOF STEP]
by (metis Suc_leI add_le_mono diff_Suc_1 less_add_same_cancel1 not_add_less1 not_less_iff_gr_or_eq numeral_2_eq_2 plus_1_eq_Suc set_n_deg_not_0)
[PROOF STATE]
proof (state)
this:
2 \<le> deg

goal (1 subgoal):
 1. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
[PROOF STEP]
hence aa:"{mi, ma} \<subseteq> set_vebt' (Node (Some (mi, ma)) deg treeList summary)"
[PROOF STATE]
proof (prove)
using this:
2 \<le> deg

goal (1 subgoal):
 1. {mi, ma} \<subseteq> set_vebt' (Node (Some (mi, ma)) deg treeList summary)
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. 2 \<le> deg \<Longrightarrow> mi \<in> set_vebt' (Node (Some (mi, ma)) deg treeList summary)
 2. 2 \<le> deg \<Longrightarrow> ma \<in> set_vebt' (Node (Some (mi, ma)) deg treeList summary)
[PROOF STEP]
using vebt_member.simps(5)[of mi ma "deg -2" treeList summary mi]
[PROOF STATE]
proof (prove)
using this:
vebt_member (Node (Some (mi, ma)) (Suc (Suc (deg - 2))) treeList summary) mi = (if mi = mi then True else if mi = ma then True else if mi < mi then False else if ma < mi then False else let h = high mi (Suc (Suc (deg - 2)) div 2); l = low mi (Suc (Suc (deg - 2)) div 2) in if h < length treeList then vebt_member (treeList ! h) l else False)

goal (2 subgoals):
 1. 2 \<le> deg \<Longrightarrow> mi \<in> set_vebt' (Node (Some (mi, ma)) deg treeList summary)
 2. 2 \<le> deg \<Longrightarrow> ma \<in> set_vebt' (Node (Some (mi, ma)) deg treeList summary)
[PROOF STEP]
apply (metis add_2_eq_Suc' le_add_diff_inverse2 mem_Collect_eq set_vebt'_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. 2 \<le> deg \<Longrightarrow> ma \<in> set_vebt' (Node (Some (mi, ma)) deg treeList summary)
[PROOF STEP]
using vebt_member.simps(5)[of mi ma "deg -2" treeList summary ma]
[PROOF STATE]
proof (prove)
using this:
vebt_member (Node (Some (mi, ma)) (Suc (Suc (deg - 2))) treeList summary) ma = (if ma = mi then True else if ma = ma then True else if ma < mi then False else if ma < ma then False else let h = high ma (Suc (Suc (deg - 2)) div 2); l = low ma (Suc (Suc (deg - 2)) div 2) in if h < length treeList then vebt_member (treeList ! h) l else False)

goal (1 subgoal):
 1. 2 \<le> deg \<Longrightarrow> ma \<in> set_vebt' (Node (Some (mi, ma)) deg treeList summary)
[PROOF STEP]
apply (metis add_2_eq_Suc' le_add_diff_inverse2 mem_Collect_eq set_vebt'_def)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
{mi, ma} \<subseteq> set_vebt' (Node (Some (mi, ma)) deg treeList summary)

goal (1 subgoal):
 1. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
[PROOF STEP]
from 5(12)
[PROOF STATE]
proof (chain)
picking this:
invar_vebt s deg
[PROOF STEP]
obtain treeList' summary' info where sprop1:"s = Node info deg treeList' summary' \<and> deg = n+m
                  \<and> length treeList' =2^m \<and> invar_vebt summary' m \<and> (\<forall> t \<in> set treeList'. invar_vebt t n) "
[PROOF STATE]
proof (prove)
using this:
invar_vebt s deg

goal (1 subgoal):
 1. (\<And>info treeList' summary'. s = Node info deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
apply cases
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<And>a b. \<lbrakk>\<And>info treeList' summary'. s = Node info deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<Longrightarrow> thesis; s = Leaf a b; deg = Suc 0\<rbrakk> \<Longrightarrow> thesis
 2. \<And>treeList n summary ma. \<lbrakk>\<And>info treeList' summary'. s = Node info deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<Longrightarrow> thesis; s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = n; deg = n + ma; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> thesis
 3. \<And>treeList n summary ma. \<lbrakk>\<And>info treeList' summary'. s = Node info deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<Longrightarrow> thesis; s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = Suc n; deg = n + ma; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> thesis
 4. \<And>treeList n summary ma mi maa. \<lbrakk>\<And>info treeList' summary'. s = Node info deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<Longrightarrow> thesis; s = Node (Some (mi, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = n; deg = n + ma; \<forall>i<2 ^ ma. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mi = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mi \<le> maa; maa < 2 ^ deg; mi \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ ma. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> thesis
 5. \<And>treeList n summary ma mi maa. \<lbrakk>\<And>info treeList' summary'. s = Node info deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<Longrightarrow> thesis; s = Node (Some (mi, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = Suc n; deg = n + ma; \<forall>i<2 ^ ma. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mi = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mi \<le> maa; maa < 2 ^ deg; mi \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ ma. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> thesis
[PROOF STEP]
using a0
[PROOF STATE]
proof (prove)
using this:
2 \<le> deg

goal (5 subgoals):
 1. \<And>a b. \<lbrakk>\<And>info treeList' summary'. s = Node info deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<Longrightarrow> thesis; s = Leaf a b; deg = Suc 0\<rbrakk> \<Longrightarrow> thesis
 2. \<And>treeList n summary ma. \<lbrakk>\<And>info treeList' summary'. s = Node info deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<Longrightarrow> thesis; s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = n; deg = n + ma; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> thesis
 3. \<And>treeList n summary ma. \<lbrakk>\<And>info treeList' summary'. s = Node info deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<Longrightarrow> thesis; s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = Suc n; deg = n + ma; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> thesis
 4. \<And>treeList n summary ma mi maa. \<lbrakk>\<And>info treeList' summary'. s = Node info deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<Longrightarrow> thesis; s = Node (Some (mi, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = n; deg = n + ma; \<forall>i<2 ^ ma. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mi = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mi \<le> maa; maa < 2 ^ deg; mi \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ ma. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> thesis
 5. \<And>treeList n summary ma mi maa. \<lbrakk>\<And>info treeList' summary'. s = Node info deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<Longrightarrow> thesis; s = Node (Some (mi, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = Suc n; deg = n + ma; \<forall>i<2 ^ ma. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mi = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mi \<le> maa; maa < 2 ^ deg; mi \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ ma. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> thesis
[PROOF STEP]
apply linarith
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>treeList n summary ma. \<lbrakk>\<And>info treeList' summary'. s = Node info deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<Longrightarrow> thesis; s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = n; deg = n + ma; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> thesis
 2. \<And>treeList n summary ma. \<lbrakk>\<And>info treeList' summary'. s = Node info deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<Longrightarrow> thesis; s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = Suc n; deg = n + ma; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> thesis
 3. \<And>treeList n summary ma mi maa. \<lbrakk>\<And>info treeList' summary'. s = Node info deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<Longrightarrow> thesis; s = Node (Some (mi, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = n; deg = n + ma; \<forall>i<2 ^ ma. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mi = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mi \<le> maa; maa < 2 ^ deg; mi \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ ma. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> thesis
 4. \<And>treeList n summary ma mi maa. \<lbrakk>\<And>info treeList' summary'. s = Node info deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<Longrightarrow> thesis; s = Node (Some (mi, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = Suc n; deg = n + ma; \<forall>i<2 ^ ma. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mi = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mi \<le> maa; maa < 2 ^ deg; mi \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ ma. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> thesis
[PROOF STEP]
apply (metis case4(5) case4(6) even_Suc odd_add add_self_div_2)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>treeList n summary ma. \<lbrakk>\<And>info treeList' summary'. s = Node info deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<Longrightarrow> thesis; s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = Suc n; deg = n + ma; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> thesis
 2. \<And>treeList n summary ma mi maa. \<lbrakk>\<And>info treeList' summary'. s = Node info deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<Longrightarrow> thesis; s = Node (Some (mi, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = n; deg = n + ma; \<forall>i<2 ^ ma. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mi = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mi \<le> maa; maa < 2 ^ deg; mi \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ ma. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> thesis
 3. \<And>treeList n summary ma mi maa. \<lbrakk>\<And>info treeList' summary'. s = Node info deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<Longrightarrow> thesis; s = Node (Some (mi, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = Suc n; deg = n + ma; \<forall>i<2 ^ ma. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mi = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mi \<le> maa; maa < 2 ^ deg; mi \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ ma. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> thesis
[PROOF STEP]
apply (metis Suc_inject add_Suc_right add_self_div_2 case4(5) case4(6))
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>treeList n summary ma mi maa. \<lbrakk>\<And>info treeList' summary'. s = Node info deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<Longrightarrow> thesis; s = Node (Some (mi, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = n; deg = n + ma; \<forall>i<2 ^ ma. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mi = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mi \<le> maa; maa < 2 ^ deg; mi \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ ma. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> thesis
 2. \<And>treeList n summary ma mi maa. \<lbrakk>\<And>info treeList' summary'. s = Node info deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<Longrightarrow> thesis; s = Node (Some (mi, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = Suc n; deg = n + ma; \<forall>i<2 ^ ma. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mi = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mi \<le> maa; maa < 2 ^ deg; mi \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ ma. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> thesis
[PROOF STEP]
apply (metis case4(5) case4(6) even_Suc odd_add)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>treeList n summary ma mi maa. \<lbrakk>\<And>info treeList' summary'. s = Node info deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n) \<Longrightarrow> thesis; s = Node (Some (mi, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = Suc n; deg = n + ma; \<forall>i<2 ^ ma. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mi = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mi \<le> maa; maa < 2 ^ deg; mi \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ ma. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> thesis
[PROOF STEP]
apply (metis Suc_inject add_Suc_right add_self_div_2 case4(5) case4(6))
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
s = Node info deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n)

goal (1 subgoal):
 1. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
[PROOF STEP]
have  ac:"invar_vebt t h \<Longrightarrow> invar_vebt k h \<Longrightarrow> set_vebt' t = set_vebt' k \<Longrightarrow> vebt_mint t = vebt_mint k" for t k h
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>invar_vebt t h; invar_vebt k h; set_vebt' t = set_vebt' k\<rbrakk> \<Longrightarrow> vebt_mint t = vebt_mint k
[PROOF STEP]
proof-
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>invar_vebt t h; invar_vebt k h; set_vebt' t = set_vebt' k\<rbrakk> \<Longrightarrow> vebt_mint t = vebt_mint k
[PROOF STEP]
assume assms: "invar_vebt t h" "invar_vebt k h" "set_vebt' t = set_vebt' k"
[PROOF STATE]
proof (state)
this:
invar_vebt t h
invar_vebt k h
set_vebt' t = set_vebt' k

goal (1 subgoal):
 1. \<lbrakk>invar_vebt t h; invar_vebt k h; set_vebt' t = set_vebt' k\<rbrakk> \<Longrightarrow> vebt_mint t = vebt_mint k
[PROOF STEP]
have "\<not> vebt_mint t = vebt_mint k \<Longrightarrow> False"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. vebt_mint t \<noteq> vebt_mint k \<Longrightarrow> False
[PROOF STEP]
proof-
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. vebt_mint t \<noteq> vebt_mint k \<Longrightarrow> False
[PROOF STEP]
assume "vebt_mint t \<noteq> vebt_mint k"
[PROOF STATE]
proof (state)
this:
vebt_mint t \<noteq> vebt_mint k

goal (1 subgoal):
 1. vebt_mint t \<noteq> vebt_mint k \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
vebt_mint t \<noteq> vebt_mint k
[PROOF STEP]
obtain a b where abdef:"vebt_mint t = None \<and> vebt_mint k = Some b \<or>
                            vebt_mint t = Some a \<and> vebt_mint k = None \<or>
                            a < b \<and> Some a = vebt_mint t \<and> Some b = vebt_mint k \<or>
                            b < a \<and> Some a = vebt_mint t \<and> Some b = vebt_mint k"
[PROOF STATE]
proof (prove)
using this:
vebt_mint t \<noteq> vebt_mint k

goal (1 subgoal):
 1. (\<And>b a. vebt_mint t = None \<and> vebt_mint k = Some b \<or> vebt_mint t = Some a \<and> vebt_mint k = None \<or> a < b \<and> Some a = vebt_mint t \<and> Some b = vebt_mint k \<or> b < a \<and> Some a = vebt_mint t \<and> Some b = vebt_mint k \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (metis linorder_neqE_nat option.exhaust)
[PROOF STATE]
proof (state)
this:
vebt_mint t = None \<and> vebt_mint k = Some b \<or> vebt_mint t = Some a \<and> vebt_mint k = None \<or> a < b \<and> Some a = vebt_mint t \<and> Some b = vebt_mint k \<or> b < a \<and> Some a = vebt_mint t \<and> Some b = vebt_mint k

goal (1 subgoal):
 1. vebt_mint t \<noteq> vebt_mint k \<Longrightarrow> False
[PROOF STEP]
show False
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. False
[PROOF STEP]
apply(cases "vebt_mint t = None \<and> vebt_mint k = Some b")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. vebt_mint t = None \<and> vebt_mint k = Some b \<Longrightarrow> False
 2. \<not> (vebt_mint t = None \<and> vebt_mint k = Some b) \<Longrightarrow> False
[PROOF STEP]
apply (metis \<open>vebt_mint t \<noteq> vebt_mint k\<close> assms(1) assms(2) assms(3) mint_corr mint_sound)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<not> (vebt_mint t = None \<and> vebt_mint k = Some b) \<Longrightarrow> False
[PROOF STEP]
apply(cases "   vebt_mint t = Some a \<and> vebt_mint k = None")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>\<not> (vebt_mint t = None \<and> vebt_mint k = Some b); vebt_mint t = Some a \<and> vebt_mint k = None\<rbrakk> \<Longrightarrow> False
 2. \<lbrakk>\<not> (vebt_mint t = None \<and> vebt_mint k = Some b); \<not> (vebt_mint t = Some a \<and> vebt_mint k = None)\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
apply (metis \<open>vebt_mint t \<noteq> vebt_mint k\<close> assms(1) assms(2) assms(3) mint_corr mint_sound)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<not> (vebt_mint t = None \<and> vebt_mint k = Some b); \<not> (vebt_mint t = Some a \<and> vebt_mint k = None)\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
apply (cases "a < b \<and> Some a = vebt_mint t \<and> Some b = vebt_mint k")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>\<not> (vebt_mint t = None \<and> vebt_mint k = Some b); \<not> (vebt_mint t = Some a \<and> vebt_mint k = None); a < b \<and> Some a = vebt_mint t \<and> Some b = vebt_mint k\<rbrakk> \<Longrightarrow> False
 2. \<lbrakk>\<not> (vebt_mint t = None \<and> vebt_mint k = Some b); \<not> (vebt_mint t = Some a \<and> vebt_mint k = None); \<not> (a < b \<and> Some a = vebt_mint t \<and> Some b = vebt_mint k)\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
apply (metis \<open>vebt_mint t \<noteq> vebt_mint k\<close> assms(1) assms(2) assms(3) mint_corr mint_sound)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<not> (vebt_mint t = None \<and> vebt_mint k = Some b); \<not> (vebt_mint t = Some a \<and> vebt_mint k = None); \<not> (a < b \<and> Some a = vebt_mint t \<and> Some b = vebt_mint k)\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
by (metis \<open>vebt_mint t \<noteq> vebt_mint k\<close> abdef assms(1) assms(2) assms(3) mint_corr mint_sound)
[PROOF STATE]
proof (state)
this:
False

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
vebt_mint t \<noteq> vebt_mint k \<Longrightarrow> False

goal (1 subgoal):
 1. \<lbrakk>invar_vebt t h; invar_vebt k h; set_vebt' t = set_vebt' k\<rbrakk> \<Longrightarrow> vebt_mint t = vebt_mint k
[PROOF STEP]
thus "vebt_mint t = vebt_mint k"
[PROOF STATE]
proof (prove)
using this:
vebt_mint t \<noteq> vebt_mint k \<Longrightarrow> False

goal (1 subgoal):
 1. vebt_mint t = vebt_mint k
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
vebt_mint t = vebt_mint k

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>invar_vebt ?t ?h; invar_vebt ?k ?h; set_vebt' ?t = set_vebt' ?k\<rbrakk> \<Longrightarrow> vebt_mint ?t = vebt_mint ?k

goal (1 subgoal):
 1. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
[PROOF STEP]
have  ad:"invar_vebt t h \<Longrightarrow> invar_vebt k h \<Longrightarrow> set_vebt' t = set_vebt' k \<Longrightarrow> vebt_maxt t = vebt_maxt k" for t k h
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>invar_vebt t h; invar_vebt k h; set_vebt' t = set_vebt' k\<rbrakk> \<Longrightarrow> vebt_maxt t = vebt_maxt k
[PROOF STEP]
proof-
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>invar_vebt t h; invar_vebt k h; set_vebt' t = set_vebt' k\<rbrakk> \<Longrightarrow> vebt_maxt t = vebt_maxt k
[PROOF STEP]
assume assms: "invar_vebt t h" "invar_vebt k h" "set_vebt' t = set_vebt' k"
[PROOF STATE]
proof (state)
this:
invar_vebt t h
invar_vebt k h
set_vebt' t = set_vebt' k

goal (1 subgoal):
 1. \<lbrakk>invar_vebt t h; invar_vebt k h; set_vebt' t = set_vebt' k\<rbrakk> \<Longrightarrow> vebt_maxt t = vebt_maxt k
[PROOF STEP]
have "\<not> vebt_maxt t = vebt_maxt k \<Longrightarrow> False"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. vebt_maxt t \<noteq> vebt_maxt k \<Longrightarrow> False
[PROOF STEP]
proof-
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. vebt_maxt t \<noteq> vebt_maxt k \<Longrightarrow> False
[PROOF STEP]
assume "vebt_maxt t \<noteq> vebt_maxt k"
[PROOF STATE]
proof (state)
this:
vebt_maxt t \<noteq> vebt_maxt k

goal (1 subgoal):
 1. vebt_maxt t \<noteq> vebt_maxt k \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
vebt_maxt t \<noteq> vebt_maxt k
[PROOF STEP]
obtain a b where abdef:"vebt_maxt t = None \<and> vebt_maxt k = Some b \<or>
                            vebt_maxt t = Some a \<and> vebt_maxt k = None \<or>
                            a < b \<and> Some a = vebt_maxt t \<and> Some b = vebt_maxt k \<or>
                            b < a \<and> Some a = vebt_maxt t \<and> Some b = vebt_maxt k"
[PROOF STATE]
proof (prove)
using this:
vebt_maxt t \<noteq> vebt_maxt k

goal (1 subgoal):
 1. (\<And>b a. vebt_maxt t = None \<and> vebt_maxt k = Some b \<or> vebt_maxt t = Some a \<and> vebt_maxt k = None \<or> a < b \<and> Some a = vebt_maxt t \<and> Some b = vebt_maxt k \<or> b < a \<and> Some a = vebt_maxt t \<and> Some b = vebt_maxt k \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (metis linorder_neqE_nat option.exhaust)
[PROOF STATE]
proof (state)
this:
vebt_maxt t = None \<and> vebt_maxt k = Some b \<or> vebt_maxt t = Some a \<and> vebt_maxt k = None \<or> a < b \<and> Some a = vebt_maxt t \<and> Some b = vebt_maxt k \<or> b < a \<and> Some a = vebt_maxt t \<and> Some b = vebt_maxt k

goal (1 subgoal):
 1. vebt_maxt t \<noteq> vebt_maxt k \<Longrightarrow> False
[PROOF STEP]
show False
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. False
[PROOF STEP]
apply(cases "vebt_maxt t = None \<and> vebt_maxt k = Some b")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. vebt_maxt t = None \<and> vebt_maxt k = Some b \<Longrightarrow> False
 2. \<not> (vebt_maxt t = None \<and> vebt_maxt k = Some b) \<Longrightarrow> False
[PROOF STEP]
apply (metis \<open>vebt_maxt t \<noteq> vebt_maxt k\<close> assms(1) assms(2) assms(3) maxt_corr maxt_sound)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<not> (vebt_maxt t = None \<and> vebt_maxt k = Some b) \<Longrightarrow> False
[PROOF STEP]
apply(cases "   vebt_maxt t = Some a \<and> vebt_maxt k = None")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>\<not> (vebt_maxt t = None \<and> vebt_maxt k = Some b); vebt_maxt t = Some a \<and> vebt_maxt k = None\<rbrakk> \<Longrightarrow> False
 2. \<lbrakk>\<not> (vebt_maxt t = None \<and> vebt_maxt k = Some b); \<not> (vebt_maxt t = Some a \<and> vebt_maxt k = None)\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
apply (metis \<open>vebt_maxt t \<noteq> vebt_maxt k\<close> assms(1) assms(2) assms(3) maxt_corr maxt_sound)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<not> (vebt_maxt t = None \<and> vebt_maxt k = Some b); \<not> (vebt_maxt t = Some a \<and> vebt_maxt k = None)\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
apply (cases "a < b \<and> Some a = vebt_maxt t \<and> Some b = vebt_maxt k")
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>\<not> (vebt_maxt t = None \<and> vebt_maxt k = Some b); \<not> (vebt_maxt t = Some a \<and> vebt_maxt k = None); a < b \<and> Some a = vebt_maxt t \<and> Some b = vebt_maxt k\<rbrakk> \<Longrightarrow> False
 2. \<lbrakk>\<not> (vebt_maxt t = None \<and> vebt_maxt k = Some b); \<not> (vebt_maxt t = Some a \<and> vebt_maxt k = None); \<not> (a < b \<and> Some a = vebt_maxt t \<and> Some b = vebt_maxt k)\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
apply (metis \<open>vebt_maxt t \<noteq> vebt_maxt k\<close> assms(1) assms(2) assms(3) maxt_corr maxt_sound)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<not> (vebt_maxt t = None \<and> vebt_maxt k = Some b); \<not> (vebt_maxt t = Some a \<and> vebt_maxt k = None); \<not> (a < b \<and> Some a = vebt_maxt t \<and> Some b = vebt_maxt k)\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
apply (metis \<open>vebt_maxt t \<noteq> vebt_maxt k\<close> abdef assms(1) assms(2) assms(3) maxt_corr maxt_sound)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
False

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
vebt_maxt t \<noteq> vebt_maxt k \<Longrightarrow> False

goal (1 subgoal):
 1. \<lbrakk>invar_vebt t h; invar_vebt k h; set_vebt' t = set_vebt' k\<rbrakk> \<Longrightarrow> vebt_maxt t = vebt_maxt k
[PROOF STEP]
thus "vebt_maxt t = vebt_maxt k"
[PROOF STATE]
proof (prove)
using this:
vebt_maxt t \<noteq> vebt_maxt k \<Longrightarrow> False

goal (1 subgoal):
 1. vebt_maxt t = vebt_maxt k
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
vebt_maxt t = vebt_maxt k

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<lbrakk>invar_vebt ?t ?h; invar_vebt ?k ?h; set_vebt' ?t = set_vebt' ?k\<rbrakk> \<Longrightarrow> vebt_maxt ?t = vebt_maxt ?k

goal (1 subgoal):
 1. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
[PROOF STEP]
have infsplit: "info = Some (mi ,ma)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. info = Some (mi, ma)
[PROOF STEP]
using 5(12)
[PROOF STATE]
proof (prove)
using this:
invar_vebt s deg

goal (1 subgoal):
 1. info = Some (mi, ma)
[PROOF STEP]
proof cases
[PROOF STATE]
proof (state)
goal (5 subgoals):
 1. \<And>a b. \<lbrakk>s = Leaf a b; deg = Suc 0\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
 2. \<And>treeList n summary m. \<lbrakk>s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = n; deg = n + m; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
 3. \<And>treeList n summary m. \<lbrakk>s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
 4. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
 5. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
[PROOF STEP]
case (1 a b)
[PROOF STATE]
proof (state)
this:
s = Leaf a b
deg = Suc 0

goal (5 subgoals):
 1. \<And>a b. \<lbrakk>s = Leaf a b; deg = Suc 0\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
 2. \<And>treeList n summary m. \<lbrakk>s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = n; deg = n + m; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
 3. \<And>treeList n summary m. \<lbrakk>s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
 4. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
 5. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
s = Leaf a b
deg = Suc 0
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
s = Leaf a b
deg = Suc 0

goal (1 subgoal):
 1. info = Some (mi, ma)
[PROOF STEP]
using sprop1
[PROOF STATE]
proof (prove)
using this:
s = Leaf a b
deg = Suc 0
s = Node info deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n)

goal (1 subgoal):
 1. info = Some (mi, ma)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
info = Some (mi, ma)

goal (4 subgoals):
 1. \<And>treeList n summary m. \<lbrakk>s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = n; deg = n + m; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
 2. \<And>treeList n summary m. \<lbrakk>s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
 3. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
 4. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (4 subgoals):
 1. \<And>treeList n summary m. \<lbrakk>s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = n; deg = n + m; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
 2. \<And>treeList n summary m. \<lbrakk>s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
 3. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
 4. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
[PROOF STEP]
case (2 treeList n summary m)
[PROOF STATE]
proof (state)
this:
s = Node None deg treeList summary
\<forall>t\<in>set treeList. invar_vebt t n
invar_vebt summary m
length treeList = 2 ^ m
m = n
deg = n + m
\<not> Ex (both_member_options summary)
\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)

goal (4 subgoals):
 1. \<And>treeList n summary m. \<lbrakk>s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = n; deg = n + m; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
 2. \<And>treeList n summary m. \<lbrakk>s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
 3. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
 4. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
s = Node None deg treeList summary
\<forall>t\<in>set treeList. invar_vebt t n
invar_vebt summary m
length treeList = 2 ^ m
m = n
deg = n + m
\<not> Ex (both_member_options summary)
\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
s = Node None deg treeList summary
\<forall>t\<in>set treeList. invar_vebt t n
invar_vebt summary m
length treeList = 2 ^ m
m = n
deg = n + m
\<not> Ex (both_member_options summary)
\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)

goal (1 subgoal):
 1. info = Some (mi, ma)
[PROOF STEP]
by (metis "5.prems"(2) Collect_empty_eq VEBT_Member.vebt_member.simps(2) aa empty_iff insert_subset set_vebt'_def)
[PROOF STATE]
proof (state)
this:
info = Some (mi, ma)

goal (3 subgoals):
 1. \<And>treeList n summary m. \<lbrakk>s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
 2. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
 3. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<And>treeList n summary m. \<lbrakk>s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
 2. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
 3. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
[PROOF STEP]
case (3 treeList n summary m)
[PROOF STATE]
proof (state)
this:
s = Node None deg treeList summary
\<forall>t\<in>set treeList. invar_vebt t n
invar_vebt summary m
length treeList = 2 ^ m
m = Suc n
deg = n + m
\<not> Ex (both_member_options summary)
\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)

goal (3 subgoals):
 1. \<And>treeList n summary m. \<lbrakk>s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
 2. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
 3. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
s = Node None deg treeList summary
\<forall>t\<in>set treeList. invar_vebt t n
invar_vebt summary m
length treeList = 2 ^ m
m = Suc n
deg = n + m
\<not> Ex (both_member_options summary)
\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
s = Node None deg treeList summary
\<forall>t\<in>set treeList. invar_vebt t n
invar_vebt summary m
length treeList = 2 ^ m
m = Suc n
deg = n + m
\<not> Ex (both_member_options summary)
\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)

goal (1 subgoal):
 1. info = Some (mi, ma)
[PROOF STEP]
by (metis "5.prems"(2) Collect_empty_eq VEBT_Member.vebt_member.simps(2) aa empty_iff insert_subset set_vebt'_def)
[PROOF STATE]
proof (state)
this:
info = Some (mi, ma)

goal (2 subgoals):
 1. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
 2. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
 2. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
[PROOF STEP]
case (4 treeList' n' summary' m' mi' ma')
[PROOF STATE]
proof (state)
this:
s = Node (Some (mi', ma')) deg treeList' summary'
\<forall>t\<in>set treeList'. invar_vebt t n'
invar_vebt summary' m'
length treeList' = 2 ^ m'
m' = n'
deg = n' + m'
\<forall>i<2 ^ m'. Ex (both_member_options (treeList' ! i)) = both_member_options summary' i
mi' = ma' \<longrightarrow> (\<forall>t\<in>set treeList'. \<not> Ex (both_member_options t))
mi' \<le> ma'
ma' < 2 ^ deg
mi' \<noteq> ma' \<longrightarrow> (\<forall>i<2 ^ m'. (high ma' n' = i \<longrightarrow> both_member_options (treeList' ! i) (low ma' n')) \<and> (\<forall>x. high x n' = i \<and> both_member_options (treeList' ! i) (low x n') \<longrightarrow> mi' < x \<and> x \<le> ma'))

goal (2 subgoals):
 1. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
 2. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
[PROOF STEP]
have "vebt_mint s = Some mi'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. vebt_mint s = Some mi'
[PROOF STEP]
by (simp add: "4"(1))
[PROOF STATE]
proof (state)
this:
vebt_mint s = Some mi'

goal (2 subgoals):
 1. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
 2. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
[PROOF STEP]
hence "mi' = mi"
[PROOF STATE]
proof (prove)
using this:
vebt_mint s = Some mi'

goal (1 subgoal):
 1. mi' = mi
[PROOF STEP]
by (smt (verit, ccfv_threshold) "5.hyps"(7) "5.prems"(1) "5.prems"(2) VEBT_Member.vebt_member.simps(5) One_nat_def a0 aa add.assoc eq_iff insert_subset leI le_add_diff_inverse less_imp_le_nat mem_Collect_eq min_in_set_def mint_sound numeral_2_eq_2 option.sel order.not_eq_order_implies_strict plus_1_eq_Suc set_vebt'_def)
[PROOF STATE]
proof (state)
this:
mi' = mi

goal (2 subgoals):
 1. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
 2. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
[PROOF STEP]
have "vebt_maxt s = Some ma'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. vebt_maxt s = Some ma'
[PROOF STEP]
by (simp add: "4"(1))
[PROOF STATE]
proof (state)
this:
vebt_maxt s = Some ma'

goal (2 subgoals):
 1. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
 2. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
[PROOF STEP]
hence "ma' < ma \<Longrightarrow> ma\<notin> set_vebt' s"
[PROOF STATE]
proof (prove)
using this:
vebt_maxt s = Some ma'

goal (1 subgoal):
 1. ma' < ma \<Longrightarrow> ma \<notin> set_vebt' s
[PROOF STEP]
by (meson "5.prems"(1) leD max_in_set_def maxt_corr)
[PROOF STATE]
proof (state)
this:
ma' < ma \<Longrightarrow> ma \<notin> set_vebt' s

goal (2 subgoals):
 1. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
 2. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
ma' < ma \<Longrightarrow> ma \<notin> set_vebt' s

goal (2 subgoals):
 1. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
 2. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
[PROOF STEP]
have "ma < ma' \<Longrightarrow> ma' \<notin> set_vebt' (Node (Some (mi, ma)) deg treeList summary)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ma < ma' \<Longrightarrow> ma' \<notin> set_vebt' (Node (Some (mi, ma)) deg treeList summary)
[PROOF STEP]
using case4
[PROOF STATE]
proof (prove)
using this:
\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t)
\<lbrakk>invar_vebt ?s m; set_vebt' summary = set_vebt' ?s\<rbrakk> \<Longrightarrow> ?s = summary
invar_vebt summary m
length treeList = 2 ^ m
m = Suc n
deg = n + m
\<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i
mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x)
mi \<le> ma
ma < 2 ^ deg
mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))
invar_vebt s deg
set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s

goal (1 subgoal):
 1. ma < ma' \<Longrightarrow> ma' \<notin> set_vebt' (Node (Some (mi, ma)) deg treeList summary)
[PROOF STEP]
by (metis dual_order.strict_trans2 mem_Collect_eq member_inv not_less_iff_gr_or_eq set_vebt'_def)
[PROOF STATE]
proof (state)
this:
ma < ma' \<Longrightarrow> ma' \<notin> set_vebt' (Node (Some (mi, ma)) deg treeList summary)

goal (2 subgoals):
 1. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
 2. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
ma' < ma \<Longrightarrow> ma \<notin> set_vebt' s
ma < ma' \<Longrightarrow> ma' \<notin> set_vebt' (Node (Some (mi, ma)) deg treeList summary)
[PROOF STEP]
have "ma'=ma"
[PROOF STATE]
proof (prove)
using this:
ma' < ma \<Longrightarrow> ma \<notin> set_vebt' s
ma < ma' \<Longrightarrow> ma' \<notin> set_vebt' (Node (Some (mi, ma)) deg treeList summary)

goal (1 subgoal):
 1. ma' = ma
[PROOF STEP]
by (metis \<open>vebt_maxt s = Some ma'\<close> aa case4(12) case4(13) insert_subset max_in_set_def maxt_corr not_less_iff_gr_or_eq)
[PROOF STATE]
proof (state)
this:
ma' = ma

goal (2 subgoals):
 1. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
 2. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
ma' = ma
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
ma' = ma

goal (1 subgoal):
 1. info = Some (mi, ma)
[PROOF STEP]
using "4"(1) \<open>mi' = mi\<close> sprop1
[PROOF STATE]
proof (prove)
using this:
ma' = ma
s = Node (Some (mi', ma')) deg treeList' summary'
mi' = mi
s = Node info deg treeList'__ summary'__ \<and> deg = n + m \<and> length treeList'__ = 2 ^ m \<and> invar_vebt summary'__ m \<and> (\<forall>t\<in>set treeList'__. invar_vebt t n)

goal (1 subgoal):
 1. info = Some (mi, ma)
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
info = Some (mi, ma)

goal (1 subgoal):
 1. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
[PROOF STEP]
case (5 treeList' n' summary' m' mi' ma')
[PROOF STATE]
proof (state)
this:
s = Node (Some (mi', ma')) deg treeList' summary'
\<forall>t\<in>set treeList'. invar_vebt t n'
invar_vebt summary' m'
length treeList' = 2 ^ m'
m' = Suc n'
deg = n' + m'
\<forall>i<2 ^ m'. Ex (both_member_options (treeList' ! i)) = both_member_options summary' i
mi' = ma' \<longrightarrow> (\<forall>t\<in>set treeList'. \<not> Ex (both_member_options t))
mi' \<le> ma'
ma' < 2 ^ deg
mi' \<noteq> ma' \<longrightarrow> (\<forall>i<2 ^ m'. (high ma' n' = i \<longrightarrow> both_member_options (treeList' ! i) (low ma' n')) \<and> (\<forall>x. high x n' = i \<and> both_member_options (treeList' ! i) (low x n') \<longrightarrow> mi' < x \<and> x \<le> ma'))

goal (1 subgoal):
 1. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
[PROOF STEP]
have "vebt_mint s = Some mi'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. vebt_mint s = Some mi'
[PROOF STEP]
by (simp add: "5"(1))
[PROOF STATE]
proof (state)
this:
vebt_mint s = Some mi'

goal (1 subgoal):
 1. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
[PROOF STEP]
hence "mi' = mi"
[PROOF STATE]
proof (prove)
using this:
vebt_mint s = Some mi'

goal (1 subgoal):
 1. mi' = mi
[PROOF STEP]
by (smt (verit, ccfv_threshold) "5.hyps"(7) "5.prems"(1) "5.prems"(2) VEBT_Member.vebt_member.simps(5) One_nat_def a0 aa add.assoc eq_iff insert_subset leI le_add_diff_inverse less_imp_le_nat mem_Collect_eq min_in_set_def mint_sound numeral_2_eq_2 option.sel order.not_eq_order_implies_strict plus_1_eq_Suc set_vebt'_def)
[PROOF STATE]
proof (state)
this:
mi' = mi

goal (1 subgoal):
 1. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
[PROOF STEP]
have "vebt_maxt s = Some ma'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. vebt_maxt s = Some ma'
[PROOF STEP]
by (simp add: "5"(1))
[PROOF STATE]
proof (state)
this:
vebt_maxt s = Some ma'

goal (1 subgoal):
 1. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
[PROOF STEP]
hence "ma' < ma \<Longrightarrow> ma\<notin> set_vebt' s"
[PROOF STATE]
proof (prove)
using this:
vebt_maxt s = Some ma'

goal (1 subgoal):
 1. ma' < ma \<Longrightarrow> ma \<notin> set_vebt' s
[PROOF STEP]
by (meson "5.prems"(1) leD max_in_set_def maxt_corr)
[PROOF STATE]
proof (state)
this:
ma' < ma \<Longrightarrow> ma \<notin> set_vebt' s

goal (1 subgoal):
 1. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
ma' < ma \<Longrightarrow> ma \<notin> set_vebt' s

goal (1 subgoal):
 1. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
[PROOF STEP]
have "ma < ma' \<Longrightarrow> ma' \<notin> set_vebt' (Node (Some (mi, ma)) deg treeList summary)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ma < ma' \<Longrightarrow> ma' \<notin> set_vebt' (Node (Some (mi, ma)) deg treeList summary)
[PROOF STEP]
using case4
[PROOF STATE]
proof (prove)
using this:
\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t)
\<lbrakk>invar_vebt ?s m; set_vebt' summary = set_vebt' ?s\<rbrakk> \<Longrightarrow> ?s = summary
invar_vebt summary m
length treeList = 2 ^ m
m = Suc n
deg = n + m
\<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i
mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x)
mi \<le> ma
ma < 2 ^ deg
mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))
invar_vebt s deg
set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s

goal (1 subgoal):
 1. ma < ma' \<Longrightarrow> ma' \<notin> set_vebt' (Node (Some (mi, ma)) deg treeList summary)
[PROOF STEP]
by (metis dual_order.strict_trans2 mem_Collect_eq member_inv not_less_iff_gr_or_eq set_vebt'_def)
[PROOF STATE]
proof (state)
this:
ma < ma' \<Longrightarrow> ma' \<notin> set_vebt' (Node (Some (mi, ma)) deg treeList summary)

goal (1 subgoal):
 1. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
ma' < ma \<Longrightarrow> ma \<notin> set_vebt' s
ma < ma' \<Longrightarrow> ma' \<notin> set_vebt' (Node (Some (mi, ma)) deg treeList summary)
[PROOF STEP]
have "ma'=ma"
[PROOF STATE]
proof (prove)
using this:
ma' < ma \<Longrightarrow> ma \<notin> set_vebt' s
ma < ma' \<Longrightarrow> ma' \<notin> set_vebt' (Node (Some (mi, ma)) deg treeList summary)

goal (1 subgoal):
 1. ma' = ma
[PROOF STEP]
using case4(13) 5
[PROOF STATE]
proof (prove)
using this:
ma' < ma \<Longrightarrow> ma \<notin> set_vebt' s
ma < ma' \<Longrightarrow> ma' \<notin> set_vebt' (Node (Some (mi, ma)) deg treeList summary)
set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s
s = Node (Some (mi', ma')) deg treeList' summary'
\<forall>t\<in>set treeList'. invar_vebt t n'
invar_vebt summary' m'
length treeList' = 2 ^ m'
m' = Suc n'
deg = n' + m'
\<forall>i<2 ^ m'. Ex (both_member_options (treeList' ! i)) = both_member_options summary' i
mi' = ma' \<longrightarrow> (\<forall>t\<in>set treeList'. \<not> Ex (both_member_options t))
mi' \<le> ma'
ma' < 2 ^ deg
mi' \<noteq> ma' \<longrightarrow> (\<forall>i<2 ^ m'. (high ma' n' = i \<longrightarrow> both_member_options (treeList' ! i) (low ma' n')) \<and> (\<forall>x. high x n' = i \<and> both_member_options (treeList' ! i) (low x n') \<longrightarrow> mi' < x \<and> x \<le> ma'))

goal (1 subgoal):
 1. ma' = ma
[PROOF STEP]
by (metis \<open>vebt_maxt s = Some ma'\<close> aa both_member_options_equiv_member case4(12) insert_subset maxbmo mem_Collect_eq not_less_iff_gr_or_eq set_vebt'_def)
[PROOF STATE]
proof (state)
this:
ma' = ma

goal (1 subgoal):
 1. \<And>treeList n summary m mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ m. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> info = Some (mi, ma)
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
ma' = ma
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
ma' = ma

goal (1 subgoal):
 1. info = Some (mi, ma)
[PROOF STEP]
using "5"(1) \<open>mi' = mi\<close> sprop1
[PROOF STATE]
proof (prove)
using this:
ma' = ma
s = Node (Some (mi', ma')) deg treeList' summary'
mi' = mi
s = Node info deg treeList'__ summary'__ \<and> deg = n + m \<and> length treeList'__ = 2 ^ m \<and> invar_vebt summary'__ m \<and> (\<forall>t\<in>set treeList'__. invar_vebt t n)

goal (1 subgoal):
 1. info = Some (mi, ma)
[PROOF STEP]
by force
[PROOF STATE]
proof (state)
this:
info = Some (mi, ma)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
info = Some (mi, ma)

goal (1 subgoal):
 1. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
[PROOF STEP]
from 5(12)
[PROOF STATE]
proof (chain)
picking this:
invar_vebt s deg
[PROOF STEP]
have acd:"mi \<noteq> ma \<longrightarrow>
    (\<forall>i<2 ^ m.
        (high ma n = i \<longrightarrow> both_member_options (treeList' ! i) (low ma n)) \<and>
        (\<forall>x. high x n = i \<and> both_member_options (treeList' ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))"
[PROOF STATE]
proof (prove)
using this:
invar_vebt s deg

goal (1 subgoal):
 1. mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList' ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList' ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))
[PROOF STEP]
apply cases
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<And>a b. \<lbrakk>s = Leaf a b; deg = Suc 0\<rbrakk> \<Longrightarrow> mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList' ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList' ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))
 2. \<And>treeList n summary mb. \<lbrakk>s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary mb; length treeList = 2 ^ mb; mb = n; deg = n + mb; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList' ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList' ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))
 3. \<And>treeList n summary mb. \<lbrakk>s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary mb; length treeList = 2 ^ mb; mb = Suc n; deg = n + mb; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList' ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList' ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))
 4. \<And>treeList n summary mb mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary mb; length treeList = 2 ^ mb; mb = n; deg = n + mb; \<forall>i<2 ^ mb. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ mb. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList' ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList' ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))
 5. \<And>treeList n summary mb mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary mb; length treeList = 2 ^ mb; mb = Suc n; deg = n + mb; \<forall>i<2 ^ mb. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ mb. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList' ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList' ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))
[PROOF STEP]
using sprop1
[PROOF STATE]
proof (prove)
using this:
s = Node info deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n)

goal (5 subgoals):
 1. \<And>a b. \<lbrakk>s = Leaf a b; deg = Suc 0\<rbrakk> \<Longrightarrow> mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList' ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList' ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))
 2. \<And>treeList n summary mb. \<lbrakk>s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary mb; length treeList = 2 ^ mb; mb = n; deg = n + mb; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList' ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList' ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))
 3. \<And>treeList n summary mb. \<lbrakk>s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary mb; length treeList = 2 ^ mb; mb = Suc n; deg = n + mb; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList' ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList' ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))
 4. \<And>treeList n summary mb mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary mb; length treeList = 2 ^ mb; mb = n; deg = n + mb; \<forall>i<2 ^ mb. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ mb. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList' ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList' ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))
 5. \<And>treeList n summary mb mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary mb; length treeList = 2 ^ mb; mb = Suc n; deg = n + mb; \<forall>i<2 ^ mb. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ mb. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList' ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList' ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>treeList n summary mb. \<lbrakk>s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary mb; length treeList = 2 ^ mb; mb = n; deg = n + mb; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList' ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList' ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))
 2. \<And>treeList n summary mb. \<lbrakk>s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary mb; length treeList = 2 ^ mb; mb = Suc n; deg = n + mb; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList' ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList' ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))
 3. \<And>treeList n summary mb mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary mb; length treeList = 2 ^ mb; mb = n; deg = n + mb; \<forall>i<2 ^ mb. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ mb. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList' ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList' ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))
 4. \<And>treeList n summary mb mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary mb; length treeList = 2 ^ mb; mb = Suc n; deg = n + mb; \<forall>i<2 ^ mb. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ mb. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList' ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList' ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))
[PROOF STEP]
using sprop1 infsplit
[PROOF STATE]
proof (prove)
using this:
s = Node info deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n)
info = Some (mi, ma)

goal (4 subgoals):
 1. \<And>treeList n summary mb. \<lbrakk>s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary mb; length treeList = 2 ^ mb; mb = n; deg = n + mb; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList' ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList' ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))
 2. \<And>treeList n summary mb. \<lbrakk>s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary mb; length treeList = 2 ^ mb; mb = Suc n; deg = n + mb; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList' ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList' ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))
 3. \<And>treeList n summary mb mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary mb; length treeList = 2 ^ mb; mb = n; deg = n + mb; \<forall>i<2 ^ mb. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ mb. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList' ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList' ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))
 4. \<And>treeList n summary mb mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary mb; length treeList = 2 ^ mb; mb = Suc n; deg = n + mb; \<forall>i<2 ^ mb. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ mb. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList' ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList' ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>treeList n summary mb. \<lbrakk>s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary mb; length treeList = 2 ^ mb; mb = Suc n; deg = n + mb; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList' ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList' ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))
 2. \<And>treeList n summary mb mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary mb; length treeList = 2 ^ mb; mb = n; deg = n + mb; \<forall>i<2 ^ mb. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ mb. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList' ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList' ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))
 3. \<And>treeList n summary mb mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary mb; length treeList = 2 ^ mb; mb = Suc n; deg = n + mb; \<forall>i<2 ^ mb. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ mb. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList' ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList' ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))
[PROOF STEP]
using sprop1 infsplit
[PROOF STATE]
proof (prove)
using this:
s = Node info deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n)
info = Some (mi, ma)

goal (3 subgoals):
 1. \<And>treeList n summary mb. \<lbrakk>s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary mb; length treeList = 2 ^ mb; mb = Suc n; deg = n + mb; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList' ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList' ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))
 2. \<And>treeList n summary mb mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary mb; length treeList = 2 ^ mb; mb = n; deg = n + mb; \<forall>i<2 ^ mb. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ mb. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList' ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList' ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))
 3. \<And>treeList n summary mb mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary mb; length treeList = 2 ^ mb; mb = Suc n; deg = n + mb; \<forall>i<2 ^ mb. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ mb. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList' ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList' ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))
[PROOF STEP]
apply simp
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>treeList n summary mb mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary mb; length treeList = 2 ^ mb; mb = n; deg = n + mb; \<forall>i<2 ^ mb. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ mb. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList' ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList' ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))
 2. \<And>treeList n summary mb mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary mb; length treeList = 2 ^ mb; mb = Suc n; deg = n + mb; \<forall>i<2 ^ mb. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ mb. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList' ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList' ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))
[PROOF STEP]
apply (metis case4(5) even_Suc odd_add sprop1)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>treeList n summary mb mia maa. \<lbrakk>s = Node (Some (mia, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary mb; length treeList = 2 ^ mb; mb = Suc n; deg = n + mb; \<forall>i<2 ^ mb. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mia = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mia \<le> maa; maa < 2 ^ deg; mia \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ mb. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mia < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList' ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList' ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))
[PROOF STEP]
apply (smt (z3) Suc_inject VEBT.inject(1) add_Suc_right add_self_div_2 case4(5) infsplit option.inject prod.inject sprop1)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList' ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList' ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))

goal (1 subgoal):
 1. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
[PROOF STEP]
hence "length treeList' = 2^m"
[PROOF STATE]
proof (prove)
using this:
mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList' ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList' ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))

goal (1 subgoal):
 1. length treeList' = 2 ^ m
[PROOF STEP]
using sprop1
[PROOF STATE]
proof (prove)
using this:
mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList' ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList' ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))
s = Node info deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n)

goal (1 subgoal):
 1. length treeList' = 2 ^ m
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
length treeList' = 2 ^ m

goal (1 subgoal):
 1. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
[PROOF STEP]
hence aca:"length treeList' =length treeList"
[PROOF STATE]
proof (prove)
using this:
length treeList' = 2 ^ m

goal (1 subgoal):
 1. length treeList' = length treeList
[PROOF STEP]
using "5.hyps"(2)
[PROOF STATE]
proof (prove)
using this:
length treeList' = 2 ^ m
length treeList = 2 ^ m

goal (1 subgoal):
 1. length treeList' = length treeList
[PROOF STEP]
by (simp add: "5.hyps"(2) sprop1)
[PROOF STATE]
proof (state)
this:
length treeList' = length treeList

goal (1 subgoal):
 1. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
[PROOF STEP]
from 5(12)
[PROOF STATE]
proof (chain)
picking this:
invar_vebt s deg
[PROOF STEP]
have sumtreelistcong: " \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList' ! i) x) = both_member_options summary' i"
[PROOF STATE]
proof (prove)
using this:
invar_vebt s deg

goal (1 subgoal):
 1. \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList' ! i) x) = both_member_options summary' i
[PROOF STEP]
apply cases
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<And>a b. \<lbrakk>s = Leaf a b; deg = Suc 0\<rbrakk> \<Longrightarrow> \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList' ! i) x) = both_member_options summary' i
 2. \<And>treeList n summary ma. \<lbrakk>s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = n; deg = n + ma; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList' ! i) x) = both_member_options summary' i
 3. \<And>treeList n summary ma. \<lbrakk>s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = Suc n; deg = n + ma; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList' ! i) x) = both_member_options summary' i
 4. \<And>treeList n summary ma mi maa. \<lbrakk>s = Node (Some (mi, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = n; deg = n + ma; \<forall>i<2 ^ ma. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mi = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mi \<le> maa; maa < 2 ^ deg; mi \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ ma. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList' ! i) x) = both_member_options summary' i
 5. \<And>treeList n summary ma mi maa. \<lbrakk>s = Node (Some (mi, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = Suc n; deg = n + ma; \<forall>i<2 ^ ma. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mi = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mi \<le> maa; maa < 2 ^ deg; mi \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ ma. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList' ! i) x) = both_member_options summary' i
[PROOF STEP]
using a0
[PROOF STATE]
proof (prove)
using this:
2 \<le> deg

goal (5 subgoals):
 1. \<And>a b. \<lbrakk>s = Leaf a b; deg = Suc 0\<rbrakk> \<Longrightarrow> \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList' ! i) x) = both_member_options summary' i
 2. \<And>treeList n summary ma. \<lbrakk>s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = n; deg = n + ma; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList' ! i) x) = both_member_options summary' i
 3. \<And>treeList n summary ma. \<lbrakk>s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = Suc n; deg = n + ma; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList' ! i) x) = both_member_options summary' i
 4. \<And>treeList n summary ma mi maa. \<lbrakk>s = Node (Some (mi, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = n; deg = n + ma; \<forall>i<2 ^ ma. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mi = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mi \<le> maa; maa < 2 ^ deg; mi \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ ma. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList' ! i) x) = both_member_options summary' i
 5. \<And>treeList n summary ma mi maa. \<lbrakk>s = Node (Some (mi, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = Suc n; deg = n + ma; \<forall>i<2 ^ ma. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mi = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mi \<le> maa; maa < 2 ^ deg; mi \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ ma. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList' ! i) x) = both_member_options summary' i
[PROOF STEP]
apply linarith
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<And>treeList n summary ma. \<lbrakk>s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = n; deg = n + ma; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList' ! i) x) = both_member_options summary' i
 2. \<And>treeList n summary ma. \<lbrakk>s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = Suc n; deg = n + ma; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList' ! i) x) = both_member_options summary' i
 3. \<And>treeList n summary ma mi maa. \<lbrakk>s = Node (Some (mi, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = n; deg = n + ma; \<forall>i<2 ^ ma. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mi = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mi \<le> maa; maa < 2 ^ deg; mi \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ ma. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList' ! i) x) = both_member_options summary' i
 4. \<And>treeList n summary ma mi maa. \<lbrakk>s = Node (Some (mi, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = Suc n; deg = n + ma; \<forall>i<2 ^ ma. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mi = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mi \<le> maa; maa < 2 ^ deg; mi \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ ma. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList' ! i) x) = both_member_options summary' i
[PROOF STEP]
apply (metis VEBT.inject(1) nth_mem sprop1)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>treeList n summary ma. \<lbrakk>s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = Suc n; deg = n + ma; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList' ! i) x) = both_member_options summary' i
 2. \<And>treeList n summary ma mi maa. \<lbrakk>s = Node (Some (mi, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = n; deg = n + ma; \<forall>i<2 ^ ma. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mi = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mi \<le> maa; maa < 2 ^ deg; mi \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ ma. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList' ! i) x) = both_member_options summary' i
 3. \<And>treeList n summary ma mi maa. \<lbrakk>s = Node (Some (mi, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = Suc n; deg = n + ma; \<forall>i<2 ^ ma. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mi = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mi \<le> maa; maa < 2 ^ deg; mi \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ ma. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList' ! i) x) = both_member_options summary' i
[PROOF STEP]
using infsplit sprop1
[PROOF STATE]
proof (prove)
using this:
info = Some (mi, ma)
s = Node info deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n)

goal (3 subgoals):
 1. \<And>treeList n summary ma. \<lbrakk>s = Node None deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = Suc n; deg = n + ma; \<not> Ex (both_member_options summary); \<forall>t\<in>set treeList. \<not> Ex (both_member_options t)\<rbrakk> \<Longrightarrow> \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList' ! i) x) = both_member_options summary' i
 2. \<And>treeList n summary ma mi maa. \<lbrakk>s = Node (Some (mi, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = n; deg = n + ma; \<forall>i<2 ^ ma. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mi = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mi \<le> maa; maa < 2 ^ deg; mi \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ ma. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList' ! i) x) = both_member_options summary' i
 3. \<And>treeList n summary ma mi maa. \<lbrakk>s = Node (Some (mi, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = Suc n; deg = n + ma; \<forall>i<2 ^ ma. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mi = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mi \<le> maa; maa < 2 ^ deg; mi \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ ma. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList' ! i) x) = both_member_options summary' i
[PROOF STEP]
apply force
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>treeList n summary ma mi maa. \<lbrakk>s = Node (Some (mi, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = n; deg = n + ma; \<forall>i<2 ^ ma. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mi = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mi \<le> maa; maa < 2 ^ deg; mi \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ ma. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList' ! i) x) = both_member_options summary' i
 2. \<And>treeList n summary ma mi maa. \<lbrakk>s = Node (Some (mi, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = Suc n; deg = n + ma; \<forall>i<2 ^ ma. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mi = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mi \<le> maa; maa < 2 ^ deg; mi \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ ma. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList' ! i) x) = both_member_options summary' i
[PROOF STEP]
apply (metis VEBT.inject(1) sprop1)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>treeList n summary ma mi maa. \<lbrakk>s = Node (Some (mi, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = Suc n; deg = n + ma; \<forall>i<2 ^ ma. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mi = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mi \<le> maa; maa < 2 ^ deg; mi \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ ma. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList' ! i) x) = both_member_options summary' i
[PROOF STEP]
using sprop1
[PROOF STATE]
proof (prove)
using this:
s = Node info deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n)

goal (1 subgoal):
 1. \<And>treeList n summary ma mi maa. \<lbrakk>s = Node (Some (mi, maa)) deg treeList summary; \<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary ma; length treeList = 2 ^ ma; ma = Suc n; deg = n + ma; \<forall>i<2 ^ ma. Ex (both_member_options (treeList ! i)) = both_member_options summary i; mi = maa \<longrightarrow> (\<forall>t\<in>set treeList. \<not> Ex (both_member_options t)); mi \<le> maa; maa < 2 ^ deg; mi \<noteq> maa \<longrightarrow> (\<forall>i<2 ^ ma. (high maa n = i \<longrightarrow> both_member_options (treeList ! i) (low maa n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> maa))\<rbrakk> \<Longrightarrow> \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList' ! i) x) = both_member_options summary' i
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (state)
this:
\<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList' ! i) x) = both_member_options summary' i

goal (1 subgoal):
 1. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
[PROOF STEP]
hence membercongy:"i < 2^m \<Longrightarrow> vebt_member (treeList! i) x \<longleftrightarrow> vebt_member (treeList' ! i) x" for i x
[PROOF STATE]
proof (prove)
using this:
\<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList' ! i) x) = both_member_options summary' i

goal (1 subgoal):
 1. i < 2 ^ m \<Longrightarrow> vebt_member (treeList ! i) x = vebt_member (treeList' ! i) x
[PROOF STEP]
proof-
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<lbrakk>i < 2 ^ m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList' ! i) x) = both_member_options summary' i\<rbrakk> \<Longrightarrow> vebt_member (treeList ! i) x = vebt_member (treeList' ! i) x
[PROOF STEP]
assume "i < 2^m"
[PROOF STATE]
proof (state)
this:
i < 2 ^ m

goal (1 subgoal):
 1. \<lbrakk>i < 2 ^ m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList' ! i) x) = both_member_options summary' i\<rbrakk> \<Longrightarrow> vebt_member (treeList ! i) x = vebt_member (treeList' ! i) x
[PROOF STEP]
show "vebt_member (treeList! i) x \<longleftrightarrow> vebt_member (treeList' ! i) x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. vebt_member (treeList ! i) x = vebt_member (treeList' ! i) x
[PROOF STEP]
proof
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. vebt_member (treeList ! i) x \<Longrightarrow> vebt_member (treeList' ! i) x
 2. vebt_member (treeList' ! i) x \<Longrightarrow> vebt_member (treeList ! i) x
[PROOF STEP]
show "vebt_member (treeList ! i) x \<Longrightarrow> vebt_member (treeList' ! i) x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. vebt_member (treeList ! i) x \<Longrightarrow> vebt_member (treeList' ! i) x
[PROOF STEP]
proof-
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. vebt_member (treeList ! i) x \<Longrightarrow> vebt_member (treeList' ! i) x
[PROOF STEP]
assume "vebt_member (treeList ! i) x"
[PROOF STATE]
proof (state)
this:
vebt_member (treeList ! i) x

goal (1 subgoal):
 1. vebt_member (treeList ! i) x \<Longrightarrow> vebt_member (treeList' ! i) x
[PROOF STEP]
hence aaa:"both_member_options (treeList ! i) x"
[PROOF STATE]
proof (prove)
using this:
vebt_member (treeList ! i) x

goal (1 subgoal):
 1. both_member_options (treeList ! i) x
[PROOF STEP]
by (metis \<open>i < 2 ^ m\<close> both_member_options_equiv_member case4(1) case4(4) nth_mem)
[PROOF STATE]
proof (state)
this:
both_member_options (treeList ! i) x

goal (1 subgoal):
 1. vebt_member (treeList ! i) x \<Longrightarrow> vebt_member (treeList' ! i) x
[PROOF STEP]
have "x < 2^n"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x < 2 ^ n
[PROOF STEP]
by (metis \<open>i < 2 ^ m\<close> \<open>vebt_member (treeList ! i) x\<close> case4(1) case4(4) member_bound nth_mem)
[PROOF STATE]
proof (state)
this:
x < 2 ^ n

goal (1 subgoal):
 1. vebt_member (treeList ! i) x \<Longrightarrow> vebt_member (treeList' ! i) x
[PROOF STEP]
hence "both_member_options (Node (Some (mi, ma)) deg treeList summary) (2^n*i+x)"
[PROOF STATE]
proof (prove)
using this:
x < 2 ^ n

goal (1 subgoal):
 1. both_member_options (Node (Some (mi, ma)) deg treeList summary) (2 ^ n * i + x)
[PROOF STEP]
using both_member_options_from_chilf_to_complete_tree
            [of " (2^n*i+x)" deg treeList mi ma summary] aaa high_inv[of x n i]
            \<open>i < 2 ^ m\<close> \<open>vebt_member (treeList ! i) x\<close> low_inv[of x n i]
[PROOF STATE]
proof (prove)
using this:
x < 2 ^ n
\<lbrakk>high (2 ^ n * i + x) (deg div 2) < length treeList; 1 \<le> deg; both_member_options (treeList ! high (2 ^ n * i + x) (deg div 2)) (low (2 ^ n * i + x) (deg div 2))\<rbrakk> \<Longrightarrow> both_member_options (Node (Some (mi, ma)) deg treeList summary) (2 ^ n * i + x)
both_member_options (treeList ! i) x
x < 2 ^ n \<Longrightarrow> high (i * 2 ^ n + x) n = i
i < 2 ^ m
vebt_member (treeList ! i) x
x < 2 ^ n \<Longrightarrow> low (i * 2 ^ n + x) n = x

goal (1 subgoal):
 1. both_member_options (Node (Some (mi, ma)) deg treeList summary) (2 ^ n * i + x)
[PROOF STEP]
by (simp add: case4(4) case4(5) mult.commute sprop1)
[PROOF STATE]
proof (state)
this:
both_member_options (Node (Some (mi, ma)) deg treeList summary) (2 ^ n * i + x)

goal (1 subgoal):
 1. vebt_member (treeList ! i) x \<Longrightarrow> vebt_member (treeList' ! i) x
[PROOF STEP]
hence "vebt_member (Node (Some (mi, ma)) deg treeList summary) (2^n*i+x)"
[PROOF STATE]
proof (prove)
using this:
both_member_options (Node (Some (mi, ma)) deg treeList summary) (2 ^ n * i + x)

goal (1 subgoal):
 1. vebt_member (Node (Some (mi, ma)) deg treeList summary) (2 ^ n * i + x)
[PROOF STEP]
using
            valid_member_both_member_options[of "(Node (Some (mi, ma)) deg treeList summary)" deg "2^n*i+x"]
            invar_vebt.intros(5)[of treeList n summary m deg mi ma]  case4
[PROOF STATE]
proof (prove)
using this:
both_member_options (Node (Some (mi, ma)) deg treeList summary) (2 ^ n * i + x)
\<lbrakk>invar_vebt (Node (Some (mi, ma)) deg treeList summary) deg; both_member_options (Node (Some (mi, ma)) deg treeList summary) (2 ^ n * i + x)\<rbrakk> \<Longrightarrow> vebt_member (Node (Some (mi, ma)) deg treeList summary) (2 ^ n * i + x)
\<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n; invar_vebt summary m; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))\<rbrakk> \<Longrightarrow> invar_vebt (Node (Some (mi, ma)) deg treeList summary) deg
\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t)
\<lbrakk>invar_vebt ?s m; set_vebt' summary = set_vebt' ?s\<rbrakk> \<Longrightarrow> ?s = summary
invar_vebt summary m
length treeList = 2 ^ m
m = Suc n
deg = n + m
\<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i
mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x)
mi \<le> ma
ma < 2 ^ deg
mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))
invar_vebt s deg
set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s

goal (1 subgoal):
 1. vebt_member (Node (Some (mi, ma)) deg treeList summary) (2 ^ n * i + x)
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
vebt_member (Node (Some (mi, ma)) deg treeList summary) (2 ^ n * i + x)

goal (1 subgoal):
 1. vebt_member (treeList ! i) x \<Longrightarrow> vebt_member (treeList' ! i) x
[PROOF STEP]
hence "mi <  (2^n*i+x) \<and>  (2^n*i+x) \<le> ma"
[PROOF STATE]
proof (prove)
using this:
vebt_member (Node (Some (mi, ma)) deg treeList summary) (2 ^ n * i + x)

goal (1 subgoal):
 1. mi < 2 ^ n * i + x \<and> 2 ^ n * i + x \<le> ma
[PROOF STEP]
using vebt_mint.simps(3)[of mi ma deg treeList summary]
[PROOF STATE]
proof (prove)
using this:
vebt_member (Node (Some (mi, ma)) deg treeList summary) (2 ^ n * i + x)
vebt_mint (Node (Some (mi, ma)) deg treeList summary) = Some mi

goal (1 subgoal):
 1. mi < 2 ^ n * i + x \<and> 2 ^ n * i + x \<le> ma
[PROOF STEP]
by (metis \<open>i < 2 ^ m\<close> \<open>x < 2 ^ n\<close> aaa case4(11) case4(4) case4(8) high_inv low_inv mult.commute nth_mem)
[PROOF STATE]
proof (state)
this:
mi < 2 ^ n * i + x \<and> 2 ^ n * i + x \<le> ma

goal (1 subgoal):
 1. vebt_member (treeList ! i) x \<Longrightarrow> vebt_member (treeList' ! i) x
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
mi < 2 ^ n * i + x \<and> 2 ^ n * i + x \<le> ma

goal (1 subgoal):
 1. vebt_member (treeList ! i) x \<Longrightarrow> vebt_member (treeList' ! i) x
[PROOF STEP]
have "both_member_options s (2^n*i +x)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. both_member_options s (2 ^ n * i + x)
[PROOF STEP]
using \<open>vebt_member (Node (Some (mi, ma)) deg treeList summary) (2 ^ n * i + x)\<close> both_member_options_equiv_member case4(12) case4(13) case4(5) set_vebt'_def
[PROOF STATE]
proof (prove)
using this:
vebt_member (Node (Some (mi, ma)) deg treeList summary) (2 ^ n * i + x)
invar_vebt ?t ?n \<Longrightarrow> both_member_options ?t ?x = vebt_member ?t ?x
invar_vebt s deg
set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s
m = Suc n
set_vebt' ?t = {x. vebt_member ?t x}

goal (1 subgoal):
 1. both_member_options s (2 ^ n * i + x)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
both_member_options s (2 ^ n * i + x)

goal (1 subgoal):
 1. vebt_member (treeList ! i) x \<Longrightarrow> vebt_member (treeList' ! i) x
[PROOF STEP]
have acffs:"both_member_options (treeList' ! (high ma n)) (low ma n)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. both_member_options (treeList' ! high ma n) (low ma n)
[PROOF STEP]
using acd calculation case4(10) high_bound_aux sprop1 verit_comp_simplify1(3)
[PROOF STATE]
proof (prove)
using this:
mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList' ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList' ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma))
mi < 2 ^ n * i + x \<and> 2 ^ n * i + x \<le> ma
ma < 2 ^ deg
?ma < 2 ^ (?n + ?m) \<Longrightarrow> high ?ma ?n < 2 ^ ?m
s = Node info deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n)
(\<not> ?b' \<le> ?a') = (?a' < ?b')

goal (1 subgoal):
 1. both_member_options (treeList' ! high ma n) (low ma n)
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
both_member_options (treeList' ! high ma n) (low ma n)

goal (1 subgoal):
 1. vebt_member (treeList ! i) x \<Longrightarrow> vebt_member (treeList' ! i) x
[PROOF STEP]
hence "both_member_options (treeList' ! i) x"
[PROOF STATE]
proof (prove)
using this:
both_member_options (treeList' ! high ma n) (low ma n)

goal (1 subgoal):
 1. both_member_options (treeList' ! i) x
[PROOF STEP]
using both_member_options_from_complete_tree_to_child[of deg mi ma treeList' summary' "2^n*i+x"]
            low_inv[of x n i] high_inv[of x n i]
[PROOF STATE]
proof (prove)
using this:
both_member_options (treeList' ! high ma n) (low ma n)
\<lbrakk>1 \<le> deg; both_member_options (Node (Some (mi, ma)) deg treeList' summary') (2 ^ n * i + x)\<rbrakk> \<Longrightarrow> both_member_options (treeList' ! high (2 ^ n * i + x) (deg div 2)) (low (2 ^ n * i + x) (deg div 2)) \<or> 2 ^ n * i + x = mi \<or> 2 ^ n * i + x = ma
x < 2 ^ n \<Longrightarrow> low (i * 2 ^ n + x) n = x
x < 2 ^ n \<Longrightarrow> high (i * 2 ^ n + x) n = i

goal (1 subgoal):
 1. both_member_options (treeList' ! i) x
[PROOF STEP]
by (smt (z3) Nat.add_0_right \<open>vebt_member (Node (Some (mi, ma)) deg treeList summary) (2 ^ n * i + x)\<close> \<open>x < 2 ^ n\<close> a0 add_Suc_right add_leD1 both_member_options_equiv_member calculation case4(12) case4(13) case4(5) diff_Suc_1 div_less div_mult_self4 infsplit le_add_diff_inverse2 mem_Collect_eq mult.commute mult_2 nat_1_add_1 nat_neq_iff one_less_numeral_iff semiring_norm(76) sprop1 set_vebt'_def zero_neq_numeral)
[PROOF STATE]
proof (state)
this:
both_member_options (treeList' ! i) x

goal (1 subgoal):
 1. vebt_member (treeList ! i) x \<Longrightarrow> vebt_member (treeList' ! i) x
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
both_member_options (treeList' ! i) x
[PROOF STEP]
show "vebt_member (treeList' ! i) x"
[PROOF STATE]
proof (prove)
using this:
both_member_options (treeList' ! i) x

goal (1 subgoal):
 1. vebt_member (treeList' ! i) x
[PROOF STEP]
by (metis \<open>i < 2 ^ m\<close> nth_mem sprop1 valid_member_both_member_options)
[PROOF STATE]
proof (state)
this:
vebt_member (treeList' ! i) x

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
vebt_member (treeList ! i) x \<Longrightarrow> vebt_member (treeList' ! i) x

goal (1 subgoal):
 1. vebt_member (treeList' ! i) x \<Longrightarrow> vebt_member (treeList ! i) x
[PROOF STEP]
show "vebt_member (treeList' ! i) x \<Longrightarrow> vebt_member (treeList ! i) x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. vebt_member (treeList' ! i) x \<Longrightarrow> vebt_member (treeList ! i) x
[PROOF STEP]
proof-
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. vebt_member (treeList' ! i) x \<Longrightarrow> vebt_member (treeList ! i) x
[PROOF STEP]
assume "vebt_member (treeList' ! i) x"
[PROOF STATE]
proof (state)
this:
vebt_member (treeList' ! i) x

goal (1 subgoal):
 1. vebt_member (treeList' ! i) x \<Longrightarrow> vebt_member (treeList ! i) x
[PROOF STEP]
hence "vebt_member s (2^n*i +x)"
[PROOF STATE]
proof (prove)
using this:
vebt_member (treeList' ! i) x

goal (1 subgoal):
 1. vebt_member s (2 ^ n * i + x)
[PROOF STEP]
using sprop1 both_member_options_from_chilf_to_complete_tree
            [of "(2^n*i +x)" deg treeList' mi ma summary']
[PROOF STATE]
proof (prove)
using this:
vebt_member (treeList' ! i) x
s = Node info deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n)
\<lbrakk>high (2 ^ n * i + x) (deg div 2) < length treeList'; 1 \<le> deg; both_member_options (treeList' ! high (2 ^ n * i + x) (deg div 2)) (low (2 ^ n * i + x) (deg div 2))\<rbrakk> \<Longrightarrow> both_member_options (Node (Some (mi, ma)) deg treeList' summary') (2 ^ n * i + x)

goal (1 subgoal):
 1. vebt_member s (2 ^ n * i + x)
[PROOF STEP]
by (smt (z3) Nat.add_0_right Suc_leD \<open>i < 2 ^ m\<close> a0 add_Suc_right both_member_options_equiv_member case4(12) case4(5) diff_Suc_1 div_less div_mult_self4 even_Suc high_def infsplit low_inv member_bound mult.commute mult_2_right nat_1_add_1 nth_mem odd_add odd_two_times_div_two_nat plus_1_eq_Suc power_not_zero zero_neq_numeral)
[PROOF STATE]
proof (state)
this:
vebt_member s (2 ^ n * i + x)

goal (1 subgoal):
 1. vebt_member (treeList' ! i) x \<Longrightarrow> vebt_member (treeList ! i) x
[PROOF STEP]
hence "mi < (2^n*i +x) \<and> (2^n*i +x) \<le> ma "
[PROOF STATE]
proof (prove)
using this:
vebt_member s (2 ^ n * i + x)

goal (1 subgoal):
 1. mi < 2 ^ n * i + x \<and> 2 ^ n * i + x \<le> ma
[PROOF STEP]
using vebt_mint.simps(3)[of mi ma deg treeList' summary'] vebt_maxt.simps(3)[of mi ma deg treeList' summary']
[PROOF STATE]
proof (prove)
using this:
vebt_member s (2 ^ n * i + x)
vebt_mint (Node (Some (mi, ma)) deg treeList' summary') = Some mi
vebt_maxt (Node (Some (mi, ma)) deg treeList' summary') = Some ma

goal (1 subgoal):
 1. mi < 2 ^ n * i + x \<and> 2 ^ n * i + x \<le> ma
[PROOF STEP]
by (metis \<open>i < 2 ^ m\<close> \<open>vebt_member (treeList' ! i) x\<close> acd both_member_options_equiv_member case4(12) high_inv infsplit low_inv member_bound mi_eq_ma_no_ch mult.commute nth_mem sprop1)
[PROOF STATE]
proof (state)
this:
mi < 2 ^ n * i + x \<and> 2 ^ n * i + x \<le> ma

goal (1 subgoal):
 1. vebt_member (treeList' ! i) x \<Longrightarrow> vebt_member (treeList ! i) x
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
mi < 2 ^ n * i + x \<and> 2 ^ n * i + x \<le> ma

goal (1 subgoal):
 1. vebt_member (treeList' ! i) x \<Longrightarrow> vebt_member (treeList ! i) x
[PROOF STEP]
have "both_member_options (Node (Some (mi, ma)) deg treeList summary) (2^n*i +x)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. both_member_options (Node (Some (mi, ma)) deg treeList summary) (2 ^ n * i + x)
[PROOF STEP]
by (metis \<open>vebt_member s (2 ^ n * i + x)\<close> add_leD1 both_member_options_equiv_member both_member_options_from_chilf_to_complete_tree calculation case4(1) case4(13) case4(5) maxbmo vebt_maxt.simps(3) mem_Collect_eq member_inv nat_neq_iff nth_mem one_add_one set_vebt'_def)
[PROOF STATE]
proof (state)
this:
both_member_options (Node (Some (mi, ma)) deg treeList summary) (2 ^ n * i + x)

goal (1 subgoal):
 1. vebt_member (treeList' ! i) x \<Longrightarrow> vebt_member (treeList ! i) x
[PROOF STEP]
have "invar_vebt (treeList' ! i) n"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. invar_vebt (treeList' ! i) n
[PROOF STEP]
by (simp add: \<open>i < 2 ^ m\<close> sprop1)
[PROOF STATE]
proof (state)
this:
invar_vebt (treeList' ! i) n

goal (1 subgoal):
 1. vebt_member (treeList' ! i) x \<Longrightarrow> vebt_member (treeList ! i) x
[PROOF STEP]
hence "x < 2^n"
[PROOF STATE]
proof (prove)
using this:
invar_vebt (treeList' ! i) n

goal (1 subgoal):
 1. x < 2 ^ n
[PROOF STEP]
using \<open>vebt_member (treeList' ! i) x\<close> member_bound
[PROOF STATE]
proof (prove)
using this:
invar_vebt (treeList' ! i) n
vebt_member (treeList' ! i) x
\<lbrakk>vebt_member ?tree ?x; invar_vebt ?tree ?n\<rbrakk> \<Longrightarrow> ?x < 2 ^ ?n

goal (1 subgoal):
 1. x < 2 ^ n
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
x < 2 ^ n

goal (1 subgoal):
 1. vebt_member (treeList' ! i) x \<Longrightarrow> vebt_member (treeList ! i) x
[PROOF STEP]
hence "both_member_options (treeList ! i) x"
[PROOF STATE]
proof (prove)
using this:
x < 2 ^ n

goal (1 subgoal):
 1. both_member_options (treeList ! i) x
[PROOF STEP]
using both_member_options_from_complete_tree_to_child[of deg mi ma treeList summary "(2^n*i +x)"]
            low_inv[of x n i] high_inv[of x n i]
[PROOF STATE]
proof (prove)
using this:
x < 2 ^ n
\<lbrakk>1 \<le> deg; both_member_options (Node (Some (mi, ma)) deg treeList summary) (2 ^ n * i + x)\<rbrakk> \<Longrightarrow> both_member_options (treeList ! high (2 ^ n * i + x) (deg div 2)) (low (2 ^ n * i + x) (deg div 2)) \<or> 2 ^ n * i + x = mi \<or> 2 ^ n * i + x = ma
x < 2 ^ n \<Longrightarrow> low (i * 2 ^ n + x) n = x
x < 2 ^ n \<Longrightarrow> high (i * 2 ^ n + x) n = i

goal (1 subgoal):
 1. both_member_options (treeList ! i) x
[PROOF STEP]
by (smt (z3) Nat.add_0_right Suc_leD \<open>both_member_options (Node (Some (mi, ma)) deg treeList summary) (2 ^ n * i + x)\<close> \<open>i < 2 ^ m\<close> a0 add_Suc_right calculation case4(11) case4(5) div_less div_mult_self4 mult.commute mult_2 nat_1_add_1 nat_neq_iff one_less_numeral_iff plus_1_eq_Suc semiring_norm(76) sprop1 zero_neq_numeral)
[PROOF STATE]
proof (state)
this:
both_member_options (treeList ! i) x

goal (1 subgoal):
 1. vebt_member (treeList' ! i) x \<Longrightarrow> vebt_member (treeList ! i) x
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
both_member_options (treeList ! i) x
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
both_member_options (treeList ! i) x

goal (1 subgoal):
 1. vebt_member (treeList ! i) x
[PROOF STEP]
by (metis \<open>i < 2 ^ m\<close> aca case4(1) nth_mem sprop1 valid_member_both_member_options)
[PROOF STATE]
proof (state)
this:
vebt_member (treeList ! i) x

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
vebt_member (treeList' ! i) x \<Longrightarrow> vebt_member (treeList ! i) x

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
vebt_member (treeList ! i) x = vebt_member (treeList' ! i) x

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
?i < 2 ^ m \<Longrightarrow> vebt_member (treeList ! ?i) ?x = vebt_member (treeList' ! ?i) ?x

goal (1 subgoal):
 1. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
[PROOF STEP]
hence setcongy: "i < 2^m \<Longrightarrow> set_vebt' (treeList ! i) = set_vebt' (treeList' ! i)" for i
[PROOF STATE]
proof (prove)
using this:
?i < 2 ^ m \<Longrightarrow> vebt_member (treeList ! ?i) ?x = vebt_member (treeList' ! ?i) ?x

goal (1 subgoal):
 1. i < 2 ^ m \<Longrightarrow> set_vebt' (treeList ! i) = set_vebt' (treeList' ! i)
[PROOF STEP]
unfolding set_vebt'_def
[PROOF STATE]
proof (prove)
using this:
?i < 2 ^ m \<Longrightarrow> vebt_member (treeList ! ?i) ?x = vebt_member (treeList' ! ?i) ?x

goal (1 subgoal):
 1. i < 2 ^ m \<Longrightarrow> Collect (vebt_member (treeList ! i)) = Collect (vebt_member (treeList' ! i))
[PROOF STEP]
by presburger
[PROOF STATE]
proof (state)
this:
?i < 2 ^ m \<Longrightarrow> set_vebt' (treeList ! ?i) = set_vebt' (treeList' ! ?i)

goal (1 subgoal):
 1. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
[PROOF STEP]
hence treecongy: "i < 2^m \<Longrightarrow> treeList ! i = treeList' ! i" for i
[PROOF STATE]
proof (prove)
using this:
?i < 2 ^ m \<Longrightarrow> set_vebt' (treeList ! ?i) = set_vebt' (treeList' ! ?i)

goal (1 subgoal):
 1. i < 2 ^ m \<Longrightarrow> treeList ! i = treeList' ! i
[PROOF STEP]
by (metis case4(1) case4(4) nth_mem sprop1)
[PROOF STATE]
proof (state)
this:
?i < 2 ^ m \<Longrightarrow> treeList ! ?i = treeList' ! ?i

goal (1 subgoal):
 1. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
[PROOF STEP]
hence "treeList = treeList'"
[PROOF STATE]
proof (prove)
using this:
?i < 2 ^ m \<Longrightarrow> treeList ! ?i = treeList' ! ?i

goal (1 subgoal):
 1. treeList = treeList'
[PROOF STEP]
by (metis aca case4(4) nth_equalityI)
[PROOF STATE]
proof (state)
this:
treeList = treeList'

goal (1 subgoal):
 1. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
[PROOF STEP]
have "vebt_member summary x \<longleftrightarrow> vebt_member summary' x" for x
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. vebt_member summary x = vebt_member summary' x
[PROOF STEP]
by (metis \<open>treeList = treeList'\<close> both_member_options_equiv_member case4(3) case4(7) member_bound sprop1 sumtreelistcong)
[PROOF STATE]
proof (state)
this:
vebt_member summary ?x = vebt_member summary' ?x

goal (1 subgoal):
 1. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
[PROOF STEP]
hence "set_vebt' summary = set_vebt' summary'"
[PROOF STATE]
proof (prove)
using this:
vebt_member summary ?x = vebt_member summary' ?x

goal (1 subgoal):
 1. set_vebt' summary = set_vebt' summary'
[PROOF STEP]
unfolding set_vebt'_def
[PROOF STATE]
proof (prove)
using this:
vebt_member summary ?x = vebt_member summary' ?x

goal (1 subgoal):
 1. Collect (vebt_member summary) = Collect (vebt_member summary')
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
set_vebt' summary = set_vebt' summary'

goal (1 subgoal):
 1. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
[PROOF STEP]
hence "summary = summary'"
[PROOF STATE]
proof (prove)
using this:
set_vebt' summary = set_vebt' summary'

goal (1 subgoal):
 1. summary = summary'
[PROOF STEP]
using case4(2) sprop1
[PROOF STATE]
proof (prove)
using this:
set_vebt' summary = set_vebt' summary'
\<lbrakk>invar_vebt ?s m; set_vebt' summary = set_vebt' ?s\<rbrakk> \<Longrightarrow> ?s = summary
s = Node info deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n)

goal (1 subgoal):
 1. summary = summary'
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
summary = summary'

goal (1 subgoal):
 1. \<And>treeList n summary m deg mi ma s. \<lbrakk>\<forall>t\<in>set treeList. invar_vebt t n \<and> (\<forall>x. invar_vebt x n \<longrightarrow> set_vebt' t = set_vebt' x \<longrightarrow> x = t); invar_vebt summary m; \<And>s. \<lbrakk>invar_vebt s m; set_vebt' summary = set_vebt' s\<rbrakk> \<Longrightarrow> s = summary; length treeList = 2 ^ m; m = Suc n; deg = n + m; \<forall>i<2 ^ m. (\<exists>x. both_member_options (treeList ! i) x) = both_member_options summary i; mi = ma \<longrightarrow> (\<forall>t\<in>set treeList. \<nexists>x. both_member_options t x); mi \<le> ma; ma < 2 ^ deg; mi \<noteq> ma \<longrightarrow> (\<forall>i<2 ^ m. (high ma n = i \<longrightarrow> both_member_options (treeList ! i) (low ma n)) \<and> (\<forall>x. high x n = i \<and> both_member_options (treeList ! i) (low x n) \<longrightarrow> mi < x \<and> x \<le> ma)); invar_vebt s deg; set_vebt' (Node (Some (mi, ma)) deg treeList summary) = set_vebt' s\<rbrakk> \<Longrightarrow> s = Node (Some (mi, ma)) deg treeList summary
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
summary = summary'
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
using this:
summary = summary'

goal (1 subgoal):
 1. s = Node (Some (mi, ma)) deg treeList summary
[PROOF STEP]
using \<open>treeList = treeList'\<close> infsplit sprop1
[PROOF STATE]
proof (prove)
using this:
summary = summary'
treeList = treeList'
info = Some (mi, ma)
s = Node info deg treeList' summary' \<and> deg = n + m \<and> length treeList' = 2 ^ m \<and> invar_vebt summary' m \<and> (\<forall>t\<in>set treeList'. invar_vebt t n)

goal (1 subgoal):
 1. s = Node (Some (mi, ma)) deg treeList summary
[PROOF STEP]
by fastforce
[PROOF STATE]
proof (state)
this:
s = Node (Some (mi, ma)) deg treeList summary

goal:
No subgoals!
[PROOF STEP]
qed