:: The { \bf for } (going up) Macro Instruction
:: by Piotr Rudnicki
::
:: Copyright (c) 1998-2021 Association of Mizar Users

theorem :: SFMASTR3:1
canceled;

::$CT theorem Th1: :: SFMASTR3:2 for s being State of SCM+FSA for p being Instruction-Sequence of SCM+FSA st s . () = 1 holds DataPart (IExec ((),p,s)) = DataPart s proof end; theorem Th2: :: SFMASTR3:3 for aa being Int-Location holds not Stop SCM+FSA refers aa proof end; theorem Th3: :: SFMASTR3:4 for aa, bb, cc being Int-Location st aa <> bb holds not cc := bb refers aa proof end; theorem Th4: :: SFMASTR3:5 for s being State of SCM+FSA for a being read-write Int-Location for bb being Int-Location for f being FinSeq-Location holds (Exec ((a := (f,bb)),s)) . a = (s . f) /. |.(s . bb).| proof end; theorem Th5: :: SFMASTR3:6 for s being State of SCM+FSA for aa, bb being Int-Location for f being FinSeq-Location holds (Exec (((f,aa) := bb),s)) . f = (s . f) +* (|.(s . aa).|,(s . bb)) proof end; registration let a be read-write Int-Location; let b be Int-Location; let I, J be good MacroInstruction of SCM+FSA ; cluster if>0 (a,b,I,J) -> good ; coherence if>0 (a,b,I,J) is good proof end; end; theorem Th6: :: SFMASTR3:7 for aa, bb being Int-Location for I, J being MacroInstruction of SCM+FSA holds UsedILoc (if>0 (aa,bb,I,J)) = ({aa,bb} \/ ()) \/ () proof end; theorem :: SFMASTR3:8 canceled; ::$CT
theorem Th7: :: SFMASTR3:9
for aa, bb, cc being Int-Location
for I, J being really-closed MacroInstruction of SCM+FSA st cc <> aa & not I destroys cc & not J destroys cc holds
not if>0 (aa,bb,I,J) destroys cc
proof end;

definition
let p be Instruction-Sequence of SCM+FSA;
let a, b, c be Int-Location;
let I be MacroInstruction of SCM+FSA ;
let s be State of SCM+FSA;
func StepForUp (a,b,c,I,p,s) -> sequence of equals :: SFMASTR3:def 1
StepWhile>0 ((1 -stRWNotIn ({a,b,c} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,b,c} \/ ())),()))),p,((s +* ((1 -stRWNotIn ({a,b,c} \/ ())),(((s . c) - (s . b)) + 1))) +* (a,(s . b))));
coherence
StepWhile>0 ((1 -stRWNotIn ({a,b,c} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,b,c} \/ ())),()))),p,((s +* ((1 -stRWNotIn ({a,b,c} \/ ())),(((s . c) - (s . b)) + 1))) +* (a,(s . b)))) is sequence of
;
end;

:: deftheorem defines StepForUp SFMASTR3:def 1 :
for p being Instruction-Sequence of SCM+FSA
for a, b, c being Int-Location
for I being MacroInstruction of SCM+FSA
for s being State of SCM+FSA holds StepForUp (a,b,c,I,p,s) = StepWhile>0 ((1 -stRWNotIn ({a,b,c} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,b,c} \/ ())),()))),p,((s +* ((1 -stRWNotIn ({a,b,c} \/ ())),(((s . c) - (s . b)) + 1))) +* (a,(s . b))));

theorem Th8: :: SFMASTR3:10
for s being State of SCM+FSA
for bb, cc being Int-Location
for I being MacroInstruction of SCM+FSA
for p being Instruction-Sequence of SCM+FSA st s . () = 1 holds
((StepForUp (a,bb,cc,I,p,s)) . 0) . () = 1
proof end;

theorem Th9: :: SFMASTR3:11
for s being State of SCM+FSA
for bb, cc being Int-Location
for I being MacroInstruction of SCM+FSA
for p being Instruction-Sequence of SCM+FSA holds ((StepForUp (a,bb,cc,I,p,s)) . 0) . a = s . bb
proof end;

theorem Th10: :: SFMASTR3:12
for s being State of SCM+FSA
for bb, cc being Int-Location
for I being MacroInstruction of SCM+FSA
for p being Instruction-Sequence of SCM+FSA st a <> bb holds
((StepForUp (a,bb,cc,I,p,s)) . 0) . bb = s . bb
proof end;

theorem Th11: :: SFMASTR3:13
for s being State of SCM+FSA
for bb, cc being Int-Location
for I being MacroInstruction of SCM+FSA
for p being Instruction-Sequence of SCM+FSA st a <> cc holds
((StepForUp (a,bb,cc,I,p,s)) . 0) . cc = s . cc
proof end;

theorem Th12: :: SFMASTR3:14
for s being State of SCM+FSA
for bb, cc, dd being Int-Location
for I being MacroInstruction of SCM+FSA
for p being Instruction-Sequence of SCM+FSA st a <> dd & dd in UsedILoc I holds
((StepForUp (a,bb,cc,I,p,s)) . 0) . dd = s . dd
proof end;

theorem Th13: :: SFMASTR3:15
for s being State of SCM+FSA
for bb, cc being Int-Location
for f being FinSeq-Location
for I being MacroInstruction of SCM+FSA
for p being Instruction-Sequence of SCM+FSA holds ((StepForUp (a,bb,cc,I,p,s)) . 0) . f = s . f
proof end;

theorem Th14: :: SFMASTR3:16
for s being State of SCM+FSA
for bb, cc being Int-Location
for I being MacroInstruction of SCM+FSA
for p being Instruction-Sequence of SCM+FSA st s . () = 1 holds
for aux being read-write Int-Location st aux = 1 -stRWNotIn ({a,bb,cc} \/ ()) holds
DataPart (IExec (((((aux := cc) ";" (SubFrom (aux,bb))) ";" (AddTo (aux,()))) ";" (a := bb)),p,s)) = DataPart ((s +* (aux,(((s . cc) - (s . bb)) + 1))) +* (a,(s . bb)))
proof end;

definition
let p be Instruction-Sequence of SCM+FSA;
let a, b, c be Int-Location;
let I be MacroInstruction of SCM+FSA ;
let s be State of SCM+FSA;
pred ProperForUpBody a,b,c,I,s,p means :: SFMASTR3:def 2
for i being Nat st i < ((s . c) - (s . b)) + 1 holds
I is_halting_on (StepForUp (a,b,c,I,p,s)) . i,p +* (while>0 ((1 -stRWNotIn ({a,b,c} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,b,c} \/ ())),())))));
end;

:: deftheorem defines ProperForUpBody SFMASTR3:def 2 :
for p being Instruction-Sequence of SCM+FSA
for a, b, c being Int-Location
for I being MacroInstruction of SCM+FSA
for s being State of SCM+FSA holds
( ProperForUpBody a,b,c,I,s,p iff for i being Nat st i < ((s . c) - (s . b)) + 1 holds
I is_halting_on (StepForUp (a,b,c,I,p,s)) . i,p +* (while>0 ((1 -stRWNotIn ({a,b,c} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,b,c} \/ ())),()))))) );

theorem Th15: :: SFMASTR3:17
for s being State of SCM+FSA
for aa, bb, cc being Int-Location
for p being Instruction-Sequence of SCM+FSA
for I being parahalting MacroInstruction of SCM+FSA holds ProperForUpBody aa,bb,cc,I,s,p by SCMFSA7B:19;

theorem Th16: :: SFMASTR3:18
for s being State of SCM+FSA
for bb, cc being Int-Location
for k being Nat
for p being Instruction-Sequence of SCM+FSA
for Ig being really-closed good MacroInstruction of SCM+FSA st ((StepForUp (a,bb,cc,Ig,p,s)) . k) . () = 1 & Ig is_halting_on (StepForUp (a,bb,cc,Ig,p,s)) . k,p +* (while>0 ((1 -stRWNotIn ({a,bb,cc} \/ (UsedILoc Ig))),((Ig ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ (UsedILoc Ig))),()))))) holds
((StepForUp (a,bb,cc,Ig,p,s)) . (k + 1)) . () = 1
proof end;

theorem Th17: :: SFMASTR3:19
for s being State of SCM+FSA
for bb, cc being Int-Location
for p being Instruction-Sequence of SCM+FSA
for Ig being really-closed good MacroInstruction of SCM+FSA st s . () = 1 & ProperForUpBody a,bb,cc,Ig,s,p holds
for k being Nat st k <= ((s . cc) - (s . bb)) + 1 holds
( ((StepForUp (a,bb,cc,Ig,p,s)) . k) . () = 1 & ( not Ig destroys a implies ( ((StepForUp (a,bb,cc,Ig,p,s)) . k) . a = k + (s . bb) & ((StepForUp (a,bb,cc,Ig,p,s)) . k) . a <= (s . cc) + 1 ) ) & (((StepForUp (a,bb,cc,Ig,p,s)) . k) . (1 -stRWNotIn ({a,bb,cc} \/ (UsedILoc Ig)))) + k = ((s . cc) - (s . bb)) + 1 )
proof end;

theorem Th18: :: SFMASTR3:20
for s being State of SCM+FSA
for bb, cc being Int-Location
for p being Instruction-Sequence of SCM+FSA
for Ig being really-closed good MacroInstruction of SCM+FSA st s . () = 1 & ProperForUpBody a,bb,cc,Ig,s,p holds
for k being Nat holds
( ((StepForUp (a,bb,cc,Ig,p,s)) . k) . (1 -stRWNotIn ({a,bb,cc} \/ (UsedILoc Ig))) > 0 iff k < ((s . cc) - (s . bb)) + 1 )
proof end;

theorem Th19: :: SFMASTR3:21
for s being State of SCM+FSA
for bb, cc being Int-Location
for k being Nat
for p being Instruction-Sequence of SCM+FSA
for Ig being really-closed good MacroInstruction of SCM+FSA st s . () = 1 & ProperForUpBody a,bb,cc,Ig,s,p & k < ((s . cc) - (s . bb)) + 1 holds
((StepForUp (a,bb,cc,Ig,p,s)) . (k + 1)) | (({a,bb,cc} \/ (UsedILoc Ig)) \/ FinSeq-Locations) = (IExec ((Ig ";" (AddTo (a,()))),(p +* (while>0 ((1 -stRWNotIn ({a,bb,cc} \/ (UsedILoc Ig))),((Ig ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ (UsedILoc Ig))),())))))),((StepForUp (a,bb,cc,Ig,p,s)) . k))) | (({a,bb,cc} \/ (UsedILoc Ig)) \/ FinSeq-Locations)
proof end;

definition
let a, b, c be Int-Location;
let I be MacroInstruction of SCM+FSA ;
func for-up (a,b,c,I) -> MacroInstruction of SCM+FSA equals :: SFMASTR3:def 3
(((((1 -stRWNotIn ({a,b,c} \/ ())) := c) ";" (SubFrom ((1 -stRWNotIn ({a,b,c} \/ ())),b))) ";" (AddTo ((1 -stRWNotIn ({a,b,c} \/ ())),()))) ";" (a := b)) ";" (while>0 ((1 -stRWNotIn ({a,b,c} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,b,c} \/ ())),())))));
coherence
(((((1 -stRWNotIn ({a,b,c} \/ ())) := c) ";" (SubFrom ((1 -stRWNotIn ({a,b,c} \/ ())),b))) ";" (AddTo ((1 -stRWNotIn ({a,b,c} \/ ())),()))) ";" (a := b)) ";" (while>0 ((1 -stRWNotIn ({a,b,c} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,b,c} \/ ())),()))))) is MacroInstruction of SCM+FSA
;
end;

:: deftheorem defines for-up SFMASTR3:def 3 :
for a, b, c being Int-Location
for I being MacroInstruction of SCM+FSA holds for-up (a,b,c,I) = (((((1 -stRWNotIn ({a,b,c} \/ ())) := c) ";" (SubFrom ((1 -stRWNotIn ({a,b,c} \/ ())),b))) ";" (AddTo ((1 -stRWNotIn ({a,b,c} \/ ())),()))) ";" (a := b)) ";" (while>0 ((1 -stRWNotIn ({a,b,c} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,b,c} \/ ())),())))));

registration
let a, b, c be Int-Location;
let I be really-closed MacroInstruction of SCM+FSA ;
cluster for-up (a,b,c,I) -> really-closed ;
coherence
for-up (a,b,c,I) is really-closed
;
end;

theorem Th20: :: SFMASTR3:22
for aa, bb, cc being Int-Location
for I being MacroInstruction of SCM+FSA holds {aa,bb,cc} \/ () c= UsedILoc (for-up (aa,bb,cc,I))
proof end;

registration
let b, c be Int-Location;
let I be good MacroInstruction of SCM+FSA ;
cluster for-up (a,b,c,I) -> good ;
coherence
for-up (a,b,c,I) is good
;
end;

theorem Th21: :: SFMASTR3:23
for aa, bb, cc being Int-Location
for I being MacroInstruction of SCM+FSA st a <> aa & aa <> 1 -stRWNotIn ({a,bb,cc} \/ ()) & not I destroys aa holds
not for-up (a,bb,cc,I) destroys aa
proof end;

theorem Th22: :: SFMASTR3:24
for s being State of SCM+FSA
for bb, cc being Int-Location
for p being Instruction-Sequence of SCM+FSA
for I being really-closed MacroInstruction of SCM+FSA st s . () = 1 & s . bb > s . cc holds
( ( for x being Int-Location st x <> a & x in {bb,cc} \/ () holds
(IExec ((for-up (a,bb,cc,I)),p,s)) . x = s . x ) & ( for f being FinSeq-Location holds (IExec ((for-up (a,bb,cc,I)),p,s)) . f = s . f ) )
proof end;

Lm1: now :: thesis: for s being State of SCM+FSA
for bb, cc being Int-Location
for p being Instruction-Sequence of SCM+FSA
for I being really-closed good MacroInstruction of SCM+FSA st s . () = 1 & ( ProperForUpBody a,bb,cc,I,s,p or I is parahalting ) holds
( ProperBodyWhile>0 1 -stRWNotIn ({a,bb,cc} \/ ()),(I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),())), IExec ((((((1 -stRWNotIn ({a,bb,cc} \/ ())) := cc) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),bb))) ";" (AddTo ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))) ";" (a := bb)),p,s),p & WithVariantWhile>0 1 -stRWNotIn ({a,bb,cc} \/ ()),(I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),())), IExec ((((((1 -stRWNotIn ({a,bb,cc} \/ ())) := cc) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),bb))) ";" (AddTo ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))) ";" (a := bb)),p,s),p )
let s be State of SCM+FSA; :: thesis: for a being read-write Int-Location
for bb, cc being Int-Location
for p being Instruction-Sequence of SCM+FSA
for I being really-closed good MacroInstruction of SCM+FSA st s . () = 1 & ( ProperForUpBody a,bb,cc,I,s,p or I is parahalting ) holds
( ProperBodyWhile>0 1 -stRWNotIn ({a,bb,cc} \/ ()),(I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),())), IExec ((((((1 -stRWNotIn ({a,bb,cc} \/ ())) := cc) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),bb))) ";" (AddTo ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))) ";" (a := bb)),p,s),p & WithVariantWhile>0 1 -stRWNotIn ({a,bb,cc} \/ ()),(I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),())), IExec ((((((1 -stRWNotIn ({a,bb,cc} \/ ())) := cc) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),bb))) ";" (AddTo ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))) ";" (a := bb)),p,s),p )

let a be read-write Int-Location; :: thesis: for bb, cc being Int-Location
for p being Instruction-Sequence of SCM+FSA
for I being really-closed good MacroInstruction of SCM+FSA st s . () = 1 & ( ProperForUpBody a,bb,cc,I,s,p or I is parahalting ) holds
( ProperBodyWhile>0 1 -stRWNotIn ({a,bb,cc} \/ ()),(I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),())), IExec ((((((1 -stRWNotIn ({a,bb,cc} \/ ())) := cc) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),bb))) ";" (AddTo ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))) ";" (a := bb)),p,s),p & WithVariantWhile>0 1 -stRWNotIn ({a,bb,cc} \/ ()),(I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),())), IExec ((((((1 -stRWNotIn ({a,bb,cc} \/ ())) := cc) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),bb))) ";" (AddTo ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))) ";" (a := bb)),p,s),p )

let bb, cc be Int-Location; :: thesis: for p being Instruction-Sequence of SCM+FSA
for I being really-closed good MacroInstruction of SCM+FSA st s . () = 1 & ( ProperForUpBody a,bb,cc,I,s,p or I is parahalting ) holds
( ProperBodyWhile>0 1 -stRWNotIn ({a,bb,cc} \/ ()),(I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),())), IExec ((((((1 -stRWNotIn ({a,bb,cc} \/ ())) := cc) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),bb))) ";" (AddTo ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))) ";" (a := bb)),p,s),p & WithVariantWhile>0 1 -stRWNotIn ({a,bb,cc} \/ ()),(I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),())), IExec ((((((1 -stRWNotIn ({a,bb,cc} \/ ())) := cc) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),bb))) ";" (AddTo ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))) ";" (a := bb)),p,s),p )

let p be Instruction-Sequence of SCM+FSA; :: thesis: for I being really-closed good MacroInstruction of SCM+FSA st s . () = 1 & ( ProperForUpBody a,bb,cc,I,s,p or I is parahalting ) holds
( ProperBodyWhile>0 1 -stRWNotIn ({a,bb,cc} \/ ()),(I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),())), IExec ((((((1 -stRWNotIn ({a,bb,cc} \/ ())) := cc) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),bb))) ";" (AddTo ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))) ";" (a := bb)),p,s),p & WithVariantWhile>0 1 -stRWNotIn ({a,bb,cc} \/ ()),(I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),())), IExec ((((((1 -stRWNotIn ({a,bb,cc} \/ ())) := cc) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),bb))) ";" (AddTo ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))) ";" (a := bb)),p,s),p )

let I be really-closed good MacroInstruction of SCM+FSA ; :: thesis: ( s . () = 1 & ( ProperForUpBody a,bb,cc,I,s,p or I is parahalting ) implies ( ProperBodyWhile>0 1 -stRWNotIn ({a,bb,cc} \/ ()),(I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),())), IExec ((((((1 -stRWNotIn ({a,bb,cc} \/ ())) := cc) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),bb))) ";" (AddTo ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))) ";" (a := bb)),p,s),p & WithVariantWhile>0 1 -stRWNotIn ({a,bb,cc} \/ ()),(I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),())), IExec ((((((1 -stRWNotIn ({a,bb,cc} \/ ())) := cc) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),bb))) ";" (AddTo ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))) ";" (a := bb)),p,s),p ) )
assume that
A1: s . () = 1 and
A2: ( ProperForUpBody a,bb,cc,I,s,p or I is parahalting ) ; :: thesis: ( ProperBodyWhile>0 1 -stRWNotIn ({a,bb,cc} \/ ()),(I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),())), IExec ((((((1 -stRWNotIn ({a,bb,cc} \/ ())) := cc) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),bb))) ";" (AddTo ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))) ";" (a := bb)),p,s),p & WithVariantWhile>0 1 -stRWNotIn ({a,bb,cc} \/ ()),(I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),())), IExec ((((((1 -stRWNotIn ({a,bb,cc} \/ ())) := cc) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),bb))) ";" (AddTo ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))) ";" (a := bb)),p,s),p )
A3: ProperForUpBody a,bb,cc,I,s,p by ;
set scb1 = ((s . cc) - (s . bb)) + 1;
set SF = StepForUp (a,bb,cc,I,p,s);
set aux = 1 -stRWNotIn ({a,bb,cc} \/ ());
set IB = (I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),()));
set s2 = (s +* ((1 -stRWNotIn ({a,bb,cc} \/ ())),(((s . cc) - (s . bb)) + 1))) +* (a,(s . bb));
set p2 = p;
set IB2 = (AddTo (a,())) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),()));
set SW2 = StepWhile>0 ((1 -stRWNotIn ({a,bb,cc} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))),p,((s +* ((1 -stRWNotIn ({a,bb,cc} \/ ())),(((s . cc) - (s . bb)) + 1))) +* (a,(s . bb))));
A4: (I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),())) = I ";" ((AddTo (a,())) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))) by SCMFSA6A:28;
A5: ProperBodyWhile>0 1 -stRWNotIn ({a,bb,cc} \/ ()),(I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),())),(s +* ((1 -stRWNotIn ({a,bb,cc} \/ ())),(((s . cc) - (s . bb)) + 1))) +* (a,(s . bb)),p
proof
let k be Nat; :: according to SCMFSA9A:def 4 :: thesis: ( ((StepWhile>0 ((1 -stRWNotIn ({a,bb,cc} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))),p,((s +* ((1 -stRWNotIn ({a,bb,cc} \/ ())),(((s . cc) - (s . bb)) + 1))) +* (a,(s . bb))))) . k) . (1 -stRWNotIn ({a,bb,cc} \/ ())) <= 0 or (I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),())) is_halting_on (StepWhile>0 ((1 -stRWNotIn ({a,bb,cc} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))),p,((s +* ((1 -stRWNotIn ({a,bb,cc} \/ ())),(((s . cc) - (s . bb)) + 1))) +* (a,(s . bb))))) . k,p +* (while>0 ((1 -stRWNotIn ({a,bb,cc} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))))) )
assume ((StepWhile>0 ((1 -stRWNotIn ({a,bb,cc} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))),p,((s +* ((1 -stRWNotIn ({a,bb,cc} \/ ())),(((s . cc) - (s . bb)) + 1))) +* (a,(s . bb))))) . k) . (1 -stRWNotIn ({a,bb,cc} \/ ())) > 0 ; :: thesis: (I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),())) is_halting_on (StepWhile>0 ((1 -stRWNotIn ({a,bb,cc} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))),p,((s +* ((1 -stRWNotIn ({a,bb,cc} \/ ())),(((s . cc) - (s . bb)) + 1))) +* (a,(s . bb))))) . k,p +* (while>0 ((1 -stRWNotIn ({a,bb,cc} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),())))))
then A6: k < ((s . cc) - (s . bb)) + 1 by A1, A3, Th18;
A7: ((StepForUp (a,bb,cc,I,p,s)) . k) . () = 1 by A1, A3, A6, Th17;
I is_halting_on (StepForUp (a,bb,cc,I,p,s)) . k,p +* (while>0 ((1 -stRWNotIn ({a,bb,cc} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))))) by A3, A6;
then A8: I is_halting_on Initialized ((StepForUp (a,bb,cc,I,p,s)) . k),p +* (while>0 ((1 -stRWNotIn ({a,bb,cc} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))))) by ;
(AddTo (a,())) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),())) is_halting_on IExec (I,(p +* (while>0 ((1 -stRWNotIn ({a,bb,cc} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),())))))),((StepForUp (a,bb,cc,I,p,s)) . k)),p +* (while>0 ((1 -stRWNotIn ({a,bb,cc} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))))) by SCMFSA7B:19;
then (I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),())) is_halting_on Initialized ((StepForUp (a,bb,cc,I,p,s)) . k),p +* (while>0 ((1 -stRWNotIn ({a,bb,cc} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))))) by ;
hence (I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),())) is_halting_on (StepWhile>0 ((1 -stRWNotIn ({a,bb,cc} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))),p,((s +* ((1 -stRWNotIn ({a,bb,cc} \/ ())),(((s . cc) - (s . bb)) + 1))) +* (a,(s . bb))))) . k,p +* (while>0 ((1 -stRWNotIn ({a,bb,cc} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))))) by ; :: thesis: verum
end;
set i3 = a := bb;
set i2 = AddTo ((1 -stRWNotIn ({a,bb,cc} \/ ())),());
set i1 = SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),bb);
set i0 = (1 -stRWNotIn ({a,bb,cc} \/ ())) := cc;
set s1 = IExec ((((((1 -stRWNotIn ({a,bb,cc} \/ ())) := cc) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),bb))) ";" (AddTo ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))) ";" (a := bb)),p,s);
set p1 = p;
set SW1 = StepWhile>0 ((1 -stRWNotIn ({a,bb,cc} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))),p,(IExec ((((((1 -stRWNotIn ({a,bb,cc} \/ ())) := cc) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),bb))) ";" (AddTo ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))) ";" (a := bb)),p,s)));
deffunc H1( State of SCM+FSA) -> Element of NAT = |.(\$1 . (1 -stRWNotIn ({a,bb,cc} \/ ()))).|;
consider f being Function of ,NAT such that
A9: for x being Element of product holds f . x = H1(x) from A10: for x being State of SCM+FSA holds f . x = H1(x)
proof
let x be State of SCM+FSA; :: thesis: f . x = H1(x)
reconsider x = x as Element of product by CARD_3:107;
f . x = H1(x) by A9;
hence f . x = H1(x) ; :: thesis: verum
end;
A11: DataPart (IExec ((((((1 -stRWNotIn ({a,bb,cc} \/ ())) := cc) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),bb))) ";" (AddTo ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))) ";" (a := bb)),p,s)) = DataPart ((s +* ((1 -stRWNotIn ({a,bb,cc} \/ ())),(((s . cc) - (s . bb)) + 1))) +* (a,(s . bb))) by ;
thus ProperBodyWhile>0 1 -stRWNotIn ({a,bb,cc} \/ ()),(I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),())), IExec ((((((1 -stRWNotIn ({a,bb,cc} \/ ())) := cc) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),bb))) ";" (AddTo ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))) ";" (a := bb)),p,s),p :: thesis: WithVariantWhile>0 1 -stRWNotIn ({a,bb,cc} \/ ()),(I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),())), IExec ((((((1 -stRWNotIn ({a,bb,cc} \/ ())) := cc) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),bb))) ";" (AddTo ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))) ";" (a := bb)),p,s),p
proof
let k be Nat; :: according to SCMFSA9A:def 4 :: thesis: ( ((StepWhile>0 ((1 -stRWNotIn ({a,bb,cc} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))),p,(IExec ((((((1 -stRWNotIn ({a,bb,cc} \/ ())) := cc) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),bb))) ";" (AddTo ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))) ";" (a := bb)),p,s)))) . k) . (1 -stRWNotIn ({a,bb,cc} \/ ())) <= 0 or (I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),())) is_halting_on (StepWhile>0 ((1 -stRWNotIn ({a,bb,cc} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))),p,(IExec ((((((1 -stRWNotIn ({a,bb,cc} \/ ())) := cc) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),bb))) ";" (AddTo ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))) ";" (a := bb)),p,s)))) . k,p +* (while>0 ((1 -stRWNotIn ({a,bb,cc} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))))) )
assume A12: ((StepWhile>0 ((1 -stRWNotIn ({a,bb,cc} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))),p,(IExec ((((((1 -stRWNotIn ({a,bb,cc} \/ ())) := cc) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),bb))) ";" (AddTo ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))) ";" (a := bb)),p,s)))) . k) . (1 -stRWNotIn ({a,bb,cc} \/ ())) > 0 ; :: thesis: (I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),())) is_halting_on (StepWhile>0 ((1 -stRWNotIn ({a,bb,cc} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))),p,(IExec ((((((1 -stRWNotIn ({a,bb,cc} \/ ())) := cc) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),bb))) ";" (AddTo ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))) ";" (a := bb)),p,s)))) . k,p +* (while>0 ((1 -stRWNotIn ({a,bb,cc} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),())))))
A13: DataPart ((StepWhile>0 ((1 -stRWNotIn ({a,bb,cc} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))),p,((s +* ((1 -stRWNotIn ({a,bb,cc} \/ ())),(((s . cc) - (s . bb)) + 1))) +* (a,(s . bb))))) . k) = DataPart ((StepWhile>0 ((1 -stRWNotIn ({a,bb,cc} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))),p,(IExec ((((((1 -stRWNotIn ({a,bb,cc} \/ ())) := cc) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),bb))) ";" (AddTo ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))) ";" (a := bb)),p,s)))) . k) by ;
then A14: ((StepWhile>0 ((1 -stRWNotIn ({a,bb,cc} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))),p,(IExec ((((((1 -stRWNotIn ({a,bb,cc} \/ ())) := cc) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),bb))) ";" (AddTo ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))) ";" (a := bb)),p,s)))) . k) . (1 -stRWNotIn ({a,bb,cc} \/ ())) = ((StepWhile>0 ((1 -stRWNotIn ({a,bb,cc} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))),p,((s +* ((1 -stRWNotIn ({a,bb,cc} \/ ())),(((s . cc) - (s . bb)) + 1))) +* (a,(s . bb))))) . k) . (1 -stRWNotIn ({a,bb,cc} \/ ())) by SCMFSA_M:2;
(I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),())) is_halting_on (StepWhile>0 ((1 -stRWNotIn ({a,bb,cc} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))),p,((s +* ((1 -stRWNotIn ({a,bb,cc} \/ ())),(((s . cc) - (s . bb)) + 1))) +* (a,(s . bb))))) . k,p +* (while>0 ((1 -stRWNotIn ({a,bb,cc} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))))) by A5, A12, A14;
hence (I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),())) is_halting_on (StepWhile>0 ((1 -stRWNotIn ({a,bb,cc} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))),p,(IExec ((((((1 -stRWNotIn ({a,bb,cc} \/ ())) := cc) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),bb))) ";" (AddTo ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))) ";" (a := bb)),p,s)))) . k,p +* (while>0 ((1 -stRWNotIn ({a,bb,cc} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))))) by ; :: thesis: verum
end;
A15: for k being Nat holds
( f . ((StepWhile>0 ((1 -stRWNotIn ({a,bb,cc} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))),p,(IExec ((((((1 -stRWNotIn ({a,bb,cc} \/ ())) := cc) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),bb))) ";" (AddTo ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))) ";" (a := bb)),p,s)))) . (k + 1)) < f . ((StepWhile>0 ((1 -stRWNotIn ({a,bb,cc} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))),p,(IExec ((((((1 -stRWNotIn ({a,bb,cc} \/ ())) := cc) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),bb))) ";" (AddTo ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))) ";" (a := bb)),p,s)))) . k) or ((StepWhile>0 ((1 -stRWNotIn ({a,bb,cc} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))),p,(IExec ((((((1 -stRWNotIn ({a,bb,cc} \/ ())) := cc) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),bb))) ";" (AddTo ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))) ";" (a := bb)),p,s)))) . k) . (1 -stRWNotIn ({a,bb,cc} \/ ())) <= 0 )
proof
let k be Nat; :: thesis: ( f . ((StepWhile>0 ((1 -stRWNotIn ({a,bb,cc} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))),p,(IExec ((((((1 -stRWNotIn ({a,bb,cc} \/ ())) := cc) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),bb))) ";" (AddTo ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))) ";" (a := bb)),p,s)))) . (k + 1)) < f . ((StepWhile>0 ((1 -stRWNotIn ({a,bb,cc} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))),p,(IExec ((((((1 -stRWNotIn ({a,bb,cc} \/ ())) := cc) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),bb))) ";" (AddTo ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))) ";" (a := bb)),p,s)))) . k) or ((StepWhile>0 ((1 -stRWNotIn ({a,bb,cc} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))),p,(IExec ((((((1 -stRWNotIn ({a,bb,cc} \/ ())) := cc) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),bb))) ";" (AddTo ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))) ";" (a := bb)),p,s)))) . k) . (1 -stRWNotIn ({a,bb,cc} \/ ())) <= 0 )
A16: DataPart ((StepWhile>0 ((1 -stRWNotIn ({a,bb,cc} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))),p,(IExec ((((((1 -stRWNotIn ({a,bb,cc} \/ ())) := cc) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),bb))) ";" (AddTo ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))) ";" (a := bb)),p,s)))) . k) = DataPart ((StepWhile>0 ((1 -stRWNotIn ({a,bb,cc} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))),p,((s +* ((1 -stRWNotIn ({a,bb,cc} \/ ())),(((s . cc) - (s . bb)) + 1))) +* (a,(s . bb))))) . k) by ;
then A17: ((StepWhile>0 ((1 -stRWNotIn ({a,bb,cc} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))),p,(IExec ((((((1 -stRWNotIn ({a,bb,cc} \/ ())) := cc) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),bb))) ";" (AddTo ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))) ";" (a := bb)),p,s)))) . k) . (1 -stRWNotIn ({a,bb,cc} \/ ())) = ((StepWhile>0 ((1 -stRWNotIn ({a,bb,cc} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))),p,((s +* ((1 -stRWNotIn ({a,bb,cc} \/ ())),(((s . cc) - (s . bb)) + 1))) +* (a,(s . bb))))) . k) . (1 -stRWNotIn ({a,bb,cc} \/ ())) by SCMFSA_M:2;
DataPart ((StepWhile>0 ((1 -stRWNotIn ({a,bb,cc} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))),p,((s +* ((1 -stRWNotIn ({a,bb,cc} \/ ())),(((s . cc) - (s . bb)) + 1))) +* (a,(s . bb))))) . (k + 1)) = DataPart ((StepWhile>0 ((1 -stRWNotIn ({a,bb,cc} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))),p,(IExec ((((((1 -stRWNotIn ({a,bb,cc} \/ ())) := cc) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),bb))) ";" (AddTo ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))) ";" (a := bb)),p,s)))) . (k + 1)) by ;
then A18: ((StepWhile>0 ((1 -stRWNotIn ({a,bb,cc} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))),p,(IExec ((((((1 -stRWNotIn ({a,bb,cc} \/ ())) := cc) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),bb))) ";" (AddTo ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))) ";" (a := bb)),p,s)))) . (k + 1)) . (1 -stRWNotIn ({a,bb,cc} \/ ())) = ((StepWhile>0 ((1 -stRWNotIn ({a,bb,cc} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))),p,((s +* ((1 -stRWNotIn ({a,bb,cc} \/ ())),(((s . cc) - (s . bb)) + 1))) +* (a,(s . bb))))) . (k + 1)) . (1 -stRWNotIn ({a,bb,cc} \/ ())) by SCMFSA_M:2;
now :: thesis: ( ((StepWhile>0 ((1 -stRWNotIn ({a,bb,cc} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))),p,(IExec ((((((1 -stRWNotIn ({a,bb,cc} \/ ())) := cc) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),bb))) ";" (AddTo ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))) ";" (a := bb)),p,s)))) . k) . (1 -stRWNotIn ({a,bb,cc} \/ ())) > 0 implies f . ((StepWhile>0 ((1 -stRWNotIn ({a,bb,cc} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))),p,(IExec ((((((1 -stRWNotIn ({a,bb,cc} \/ ())) := cc) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),bb))) ";" (AddTo ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))) ";" (a := bb)),p,s)))) . (k + 1)) < f . ((StepWhile>0 ((1 -stRWNotIn ({a,bb,cc} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))),p,(IExec ((((((1 -stRWNotIn ({a,bb,cc} \/ ())) := cc) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),bb))) ";" (AddTo ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))) ";" (a := bb)),p,s)))) . k) )
assume A19: ((StepWhile>0 ((1 -stRWNotIn ({a,bb,cc} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))),p,(IExec ((((((1 -stRWNotIn ({a,bb,cc} \/ ())) := cc) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),bb))) ";" (AddTo ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))) ";" (a := bb)),p,s)))) . k) . (1 -stRWNotIn ({a,bb,cc} \/ ())) > 0 ; :: thesis: f . ((StepWhile>0 ((1 -stRWNotIn ({a,bb,cc} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))),p,(IExec ((((((1 -stRWNotIn ({a,bb,cc} \/ ())) := cc) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),bb))) ";" (AddTo ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))) ";" (a := bb)),p,s)))) . (k + 1)) < f . ((StepWhile>0 ((1 -stRWNotIn ({a,bb,cc} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))),p,(IExec ((((((1 -stRWNotIn ({a,bb,cc} \/ ())) := cc) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),bb))) ";" (AddTo ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))) ";" (a := bb)),p,s)))) . k)
then A20: k < ((s . cc) - (s . bb)) + 1 by A1, A3, A17, Th18;
k < ((s . cc) - (s . bb)) + 1 by A1, A3, A17, A19, Th18;
then A21: (((StepWhile>0 ((1 -stRWNotIn ({a,bb,cc} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))),p,((s +* ((1 -stRWNotIn ({a,bb,cc} \/ ())),(((s . cc) - (s . bb)) + 1))) +* (a,(s . bb))))) . k) . (1 -stRWNotIn ({a,bb,cc} \/ ()))) + k = ((s . cc) - (s . bb)) + 1 by A1, A3, Th17;
reconsider scb1 = ((s . cc) - (s . bb)) + 1 as Element of NAT by ;
A22: k + 1 <= scb1 by ;
then A23: (((StepWhile>0 ((1 -stRWNotIn ({a,bb,cc} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))),p,((s +* ((1 -stRWNotIn ({a,bb,cc} \/ ())),(((s . cc) - (s . bb)) + 1))) +* (a,(s . bb))))) . (k + 1)) . (1 -stRWNotIn ({a,bb,cc} \/ ()))) + (k + 1) = ((s . cc) - (s . bb)) + 1 by A1, A3, Th17;
A24: f . ((StepWhile>0 ((1 -stRWNotIn ({a,bb,cc} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))),p,(IExec ((((((1 -stRWNotIn ({a,bb,cc} \/ ())) := cc) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),bb))) ";" (AddTo ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))) ";" (a := bb)),p,s)))) . k) = |.(((StepWhile>0 ((1 -stRWNotIn ({a,bb,cc} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))),p,(IExec ((((((1 -stRWNotIn ({a,bb,cc} \/ ())) := cc) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),bb))) ";" (AddTo ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))) ";" (a := bb)),p,s)))) . k) . (1 -stRWNotIn ({a,bb,cc} \/ ()))).| by A10
.= ((StepWhile>0 ((1 -stRWNotIn ({a,bb,cc} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))),p,((s +* ((1 -stRWNotIn ({a,bb,cc} \/ ())),(((s . cc) - (s . bb)) + 1))) +* (a,(s . bb))))) . k) . (1 -stRWNotIn ({a,bb,cc} \/ ())) by ;
per cases ( ((StepWhile>0 ((1 -stRWNotIn ({a,bb,cc} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))),p,(IExec ((((((1 -stRWNotIn ({a,bb,cc} \/ ())) := cc) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),bb))) ";" (AddTo ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))) ";" (a := bb)),p,s)))) . (k + 1)) . (1 -stRWNotIn ({a,bb,cc} \/ ())) > 0 or ((StepWhile>0 ((1 -stRWNotIn ({a,bb,cc} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))),p,(IExec ((((((1 -stRWNotIn ({a,bb,cc} \/ ())) := cc) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),bb))) ";" (AddTo ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))) ";" (a := bb)),p,s)))) . (k + 1)) . (1 -stRWNotIn ({a,bb,cc} \/ ())) <= 0 ) ;
suppose A25: ((StepWhile>0 ((1 -stRWNotIn ({a,bb,cc} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))),p,(IExec ((((((1 -stRWNotIn ({a,bb,cc} \/ ())) := cc) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),bb))) ";" (AddTo ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))) ";" (a := bb)),p,s)))) . (k + 1)) . (1 -stRWNotIn ({a,bb,cc} \/ ())) > 0 ; :: thesis: f . ((StepWhile>0 ((1 -stRWNotIn ({a,bb,cc} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))),p,(IExec ((((((1 -stRWNotIn ({a,bb,cc} \/ ())) := cc) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),bb))) ";" (AddTo ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))) ";" (a := bb)),p,s)))) . (k + 1)) < f . ((StepWhile>0 ((1 -stRWNotIn ({a,bb,cc} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))),p,(IExec ((((((1 -stRWNotIn ({a,bb,cc} \/ ())) := cc) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),bb))) ";" (AddTo ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))) ";" (a := bb)),p,s)))) . k)
f . ((StepWhile>0 ((1 -stRWNotIn ({a,bb,cc} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))),p,(IExec ((((((1 -stRWNotIn ({a,bb,cc} \/ ())) := cc) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),bb))) ";" (AddTo ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))) ";" (a := bb)),p,s)))) . (k + 1)) = |.(((StepWhile>0 ((1 -stRWNotIn ({a,bb,cc} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))),p,(IExec ((((((1 -stRWNotIn ({a,bb,cc} \/ ())) := cc) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),bb))) ";" (AddTo ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))) ";" (a := bb)),p,s)))) . (k + 1)) . (1 -stRWNotIn ({a,bb,cc} \/ ()))).| by A10
.= (scb1 - k) - 1 by ;
hence f . ((StepWhile>0 ((1 -stRWNotIn ({a,bb,cc} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))),p,(IExec ((((((1 -stRWNotIn ({a,bb,cc} \/ ())) := cc) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),bb))) ";" (AddTo ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))) ";" (a := bb)),p,s)))) . (k + 1)) < f . ((StepWhile>0 ((1 -stRWNotIn ({a,bb,cc} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))),p,(IExec ((((((1 -stRWNotIn ({a,bb,cc} \/ ())) := cc) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),bb))) ";" (AddTo ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))) ";" (a := bb)),p,s)))) . k) by ; :: thesis: verum
end;
suppose A26: ((StepWhile>0 ((1 -stRWNotIn ({a,bb,cc} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))),p,(IExec ((((((1 -stRWNotIn ({a,bb,cc} \/ ())) := cc) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),bb))) ";" (AddTo ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))) ";" (a := bb)),p,s)))) . (k + 1)) . (1 -stRWNotIn ({a,bb,cc} \/ ())) <= 0 ; :: thesis: f . ((StepWhile>0 ((1 -stRWNotIn ({a,bb,cc} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))),p,(IExec ((((((1 -stRWNotIn ({a,bb,cc} \/ ())) := cc) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),bb))) ";" (AddTo ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))) ";" (a := bb)),p,s)))) . (k + 1)) < f . ((StepWhile>0 ((1 -stRWNotIn ({a,bb,cc} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))),p,(IExec ((((((1 -stRWNotIn ({a,bb,cc} \/ ())) := cc) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),bb))) ";" (AddTo ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))) ";" (a := bb)),p,s)))) . k)
((StepWhile>0 ((1 -stRWNotIn ({a,bb,cc} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))),p,((s +* ((1 -stRWNotIn ({a,bb,cc} \/ ())),(((s . cc) - (s . bb)) + 1))) +* (a,(s . bb))))) . (k + 1)) . (1 -stRWNotIn ({a,bb,cc} \/ ())) = scb1 - (k + 1) by A23;
then A27: ((StepWhile>0 ((1 -stRWNotIn ({a,bb,cc} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))),p,(IExec ((((((1 -stRWNotIn ({a,bb,cc} \/ ())) := cc) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),bb))) ";" (AddTo ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))) ";" (a := bb)),p,s)))) . (k + 1)) . (1 -stRWNotIn ({a,bb,cc} \/ ())) = 0 by ;
f . ((StepWhile>0 ((1 -stRWNotIn ({a,bb,cc} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))),p,(IExec ((((((1 -stRWNotIn ({a,bb,cc} \/ ())) := cc) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),bb))) ";" (AddTo ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))) ";" (a := bb)),p,s)))) . (k + 1)) = |.(((StepWhile>0 ((1 -stRWNotIn ({a,bb,cc} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))),p,(IExec ((((((1 -stRWNotIn ({a,bb,cc} \/ ())) := cc) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),bb))) ";" (AddTo ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))) ";" (a := bb)),p,s)))) . (k + 1)) . (1 -stRWNotIn ({a,bb,cc} \/ ()))).| by A10
.= 0 by ;
hence f . ((StepWhile>0 ((1 -stRWNotIn ({a,bb,cc} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))),p,(IExec ((((((1 -stRWNotIn ({a,bb,cc} \/ ())) := cc) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),bb))) ";" (AddTo ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))) ";" (a := bb)),p,s)))) . (k + 1)) < f . ((StepWhile>0 ((1 -stRWNotIn ({a,bb,cc} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))),p,(IExec ((((((1 -stRWNotIn ({a,bb,cc} \/ ())) := cc) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),bb))) ";" (AddTo ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))) ";" (a := bb)),p,s)))) . k) by ; :: thesis: verum
end;
end;
end;
hence ( f . ((StepWhile>0 ((1 -stRWNotIn ({a,bb,cc} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))),p,(IExec ((((((1 -stRWNotIn ({a,bb,cc} \/ ())) := cc) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),bb))) ";" (AddTo ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))) ";" (a := bb)),p,s)))) . (k + 1)) < f . ((StepWhile>0 ((1 -stRWNotIn ({a,bb,cc} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))),p,(IExec ((((((1 -stRWNotIn ({a,bb,cc} \/ ())) := cc) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),bb))) ";" (AddTo ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))) ";" (a := bb)),p,s)))) . k) or ((StepWhile>0 ((1 -stRWNotIn ({a,bb,cc} \/ ())),((I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))),p,(IExec ((((((1 -stRWNotIn ({a,bb,cc} \/ ())) := cc) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),bb))) ";" (AddTo ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))) ";" (a := bb)),p,s)))) . k) . (1 -stRWNotIn ({a,bb,cc} \/ ())) <= 0 ) ; :: thesis: verum
end;
thus WithVariantWhile>0 1 -stRWNotIn ({a,bb,cc} \/ ()),(I ";" (AddTo (a,()))) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),())), IExec ((((((1 -stRWNotIn ({a,bb,cc} \/ ())) := cc) ";" (SubFrom ((1 -stRWNotIn ({a,bb,cc} \/ ())),bb))) ";" (AddTo ((1 -stRWNotIn ({a,bb,cc} \/ ())),()))) ";" (a := bb)),p,s),p by A15; :: thesis: verum
end;

theorem Th23: :: SFMASTR3:25
for s being State of SCM+FSA
for bb, cc being Int-Location
for k being Nat
for p being Instruction-Sequence of SCM+FSA
for Ig being really-closed good MacroInstruction of SCM+FSA st s . () = 1 & k = ((s . cc) - (s . bb)) + 1 & ( ProperForUpBody a,bb,cc,Ig,s,p or Ig is parahalting ) holds
DataPart (IExec ((for-up (a,bb,cc,Ig)),p,s)) = DataPart ((StepForUp (a,bb,cc,Ig,p,s)) . k)
proof end;

theorem Th24: :: SFMASTR3:26
for s being State of SCM+FSA
for bb, cc being Int-Location
for p being Instruction-Sequence of SCM+FSA
for Ig being really-closed good MacroInstruction of SCM+FSA st s . () = 1 & ( ProperForUpBody a,bb,cc,Ig,s,p or Ig is parahalting ) holds
for-up (a,bb,cc,Ig) is_halting_on s,p
proof end;

definition
let start, finish, minpos be Int-Location;
let f be FinSeq-Location ;
func FinSeqMin (f,start,finish,minpos) -> MacroInstruction of SCM+FSA equals :: SFMASTR3:def 4
(minpos := start) ";" (for-up ((3 -rdRWNotIn {start,finish,minpos}),start,finish,((((1 -stRWNotIn {start,finish,minpos}) := (f,(3 -rdRWNotIn {start,finish,minpos}))) ";" ((2 -ndRWNotIn {start,finish,minpos}) := (f,minpos))) ";" (if>0 ((2 -ndRWNotIn {start,finish,minpos}),(1 -stRWNotIn {start,finish,minpos}),(Macro (minpos := (3 -rdRWNotIn {start,finish,minpos}))),())))));
coherence
(minpos := start) ";" (for-up ((3 -rdRWNotIn {start,finish,minpos}),start,finish,((((1 -stRWNotIn {start,finish,minpos}) := (f,(3 -rdRWNotIn {start,finish,minpos}))) ";" ((2 -ndRWNotIn {start,finish,minpos}) := (f,minpos))) ";" (if>0 ((2 -ndRWNotIn {start,finish,minpos}),(1 -stRWNotIn {start,finish,minpos}),(Macro (minpos := (3 -rdRWNotIn {start,finish,minpos}))),()))))) is MacroInstruction of SCM+FSA
;
end;

:: deftheorem defines FinSeqMin SFMASTR3:def 4 :
for start, finish, minpos being Int-Location
for f being FinSeq-Location holds FinSeqMin (f,start,finish,minpos) = (minpos := start) ";" (for-up ((3 -rdRWNotIn {start,finish,minpos}),start,finish,((((1 -stRWNotIn {start,finish,minpos}) := (f,(3 -rdRWNotIn {start,finish,minpos}))) ";" ((2 -ndRWNotIn {start,finish,minpos}) := (f,minpos))) ";" (if>0 ((2 -ndRWNotIn {start,finish,minpos}),(1 -stRWNotIn {start,finish,minpos}),(Macro (minpos := (3 -rdRWNotIn {start,finish,minpos}))),())))));

:: set aux1 = 1-stRWNotIn {start, finish, min_pos};
:: set aux2 = 2-ndRWNotIn {start, finish, min_pos};
:: set cv = 3-rdRWNotIn {start, finish, min_pos};
registration
let start, finish be Int-Location;
let f be FinSeq-Location ;
cluster FinSeqMin (f,start,finish,minpos) -> really-closed good ;
coherence
( FinSeqMin (f,start,finish,minpos) is good & FinSeqMin (f,start,finish,minpos) is really-closed )
;
end;

theorem Th25: :: SFMASTR3:27
for aa, bb being Int-Location
for f being FinSeq-Location st c <> aa holds
not FinSeqMin (f,aa,bb,c) destroys aa
proof end;

theorem Th26: :: SFMASTR3:28
for aa, bb being Int-Location
for f being FinSeq-Location holds {aa,bb,c} c= UsedILoc (FinSeqMin (f,aa,bb,c))
proof end;

theorem Th27: :: SFMASTR3:29
for s being State of SCM+FSA
for aa, bb being Int-Location
for f being FinSeq-Location
for p being Instruction-Sequence of SCM+FSA st s . () = 1 holds
FinSeqMin (f,aa,bb,c) is_halting_on s,p
proof end;

theorem Th28: :: SFMASTR3:30
for s being State of SCM+FSA
for aa, bb being Int-Location
for f being FinSeq-Location
for p being Instruction-Sequence of SCM+FSA st aa <> c & bb <> c & s . () = 1 holds
( (IExec ((FinSeqMin (f,aa,bb,c)),p,s)) . f = s . f & (IExec ((FinSeqMin (f,aa,bb,c)),p,s)) . aa = s . aa & (IExec ((FinSeqMin (f,aa,bb,c)),p,s)) . bb = s . bb )
proof end;

theorem Th29: :: SFMASTR3:31
for s being State of SCM+FSA
for aa, bb being Int-Location
for f being FinSeq-Location
for p being Instruction-Sequence of SCM+FSA st 1 <= s . aa & s . aa <= s . bb & s . bb <= len (s . f) & aa <> c & bb <> c & s . () = 1 holds
(IExec ((FinSeqMin (f,aa,bb,c)),p,s)) . c = min_at ((s . f),|.(s . aa).|,|.(s . bb).|)
proof end;

definition
let f be FinSeq-Location ;
let a, b be Int-Location;
func swap (f,a,b) -> MacroInstruction of SCM+FSA equals :: SFMASTR3:def 5
((((1 -stRWNotIn {a,b}) := (f,a)) ";" ((2 -ndRWNotIn {a,b}) := (f,b))) ";" ((f,a) := (2 -ndRWNotIn {a,b}))) ";" ((f,b) := (1 -stRWNotIn {a,b}));
coherence
((((1 -stRWNotIn {a,b}) := (f,a)) ";" ((2 -ndRWNotIn {a,b}) := (f,b))) ";" ((f,a) := (2 -ndRWNotIn {a,b}))) ";" ((f,b) := (1 -stRWNotIn {a,b})) is MacroInstruction of SCM+FSA
;
end;

:: deftheorem defines swap SFMASTR3:def 5 :
for f being FinSeq-Location
for a, b being Int-Location holds swap (f,a,b) = ((((1 -stRWNotIn {a,b}) := (f,a)) ";" ((2 -ndRWNotIn {a,b}) := (f,b))) ";" ((f,a) := (2 -ndRWNotIn {a,b}))) ";" ((f,b) := (1 -stRWNotIn {a,b}));

registration
let f be FinSeq-Location ;
let a, b be Int-Location;
cluster swap (f,a,b) -> parahalting good ;
coherence
( swap (f,a,b) is good & swap (f,a,b) is parahalting )
;
end;

theorem Th30: :: SFMASTR3:32
for aa, bb, cc being Int-Location
for f being FinSeq-Location st cc <> 1 -stRWNotIn {aa,bb} & cc <> 2 -ndRWNotIn {aa,bb} holds
not swap (f,aa,bb) destroys cc
proof end;

theorem Th31: :: SFMASTR3:33
for s being State of SCM+FSA
for aa, bb being Int-Location
for f being FinSeq-Location
for p being Instruction-Sequence of SCM+FSA st 1 <= s . aa & s . aa <= len (s . f) & 1 <= s . bb & s . bb <= len (s . f) & s . () = 1 holds
(IExec ((swap (f,aa,bb)),p,s)) . f = ((s . f) +* ((s . aa),((s . f) . (s . bb)))) +* ((s . bb),((s . f) . (s . aa)))
proof end;

theorem :: SFMASTR3:34
for s being State of SCM+FSA
for aa, bb being Int-Location
for f being FinSeq-Location
for p being Instruction-Sequence of SCM+FSA st 1 <= s . aa & s . aa <= len (s . f) & 1 <= s . bb & s . bb <= len (s . f) & s . () = 1 holds
( ((IExec ((swap (f,aa,bb)),p,s)) . f) . (s . aa) = (s . f) . (s . bb) & ((IExec ((swap (f,aa,bb)),p,s)) . f) . (s . bb) = (s . f) . (s . aa) )
proof end;

theorem Th33: :: SFMASTR3:35
for aa, bb being Int-Location
for f being FinSeq-Location holds {aa,bb} c= UsedILoc (swap (f,aa,bb))
proof end;

theorem :: SFMASTR3:36
for aa, bb being Int-Location
for f being FinSeq-Location holds UsedI*Loc (swap (f,aa,bb)) = {f}
proof end;

definition
let f be FinSeq-Location ;
func Selection-sort f -> Program of equals :: SFMASTR3:def 6
((1 -stNotUsed (swap (f,(),()))) :=len f) ";" (for-up ((),(),(1 -stNotUsed (swap (f,(),()))),((FinSeqMin (f,(),(1 -stNotUsed (swap (f,(),()))),())) ";" (swap (f,(),())))));
coherence
((1 -stNotUsed (swap (f,(),()))) :=len f) ";" (for-up ((),(),(1 -stNotUsed (swap (f,(),()))),((FinSeqMin (f,(),(1 -stNotUsed (swap (f,(),()))),())) ";" (swap (f,(),()))))) is Program of
;
end;

:: deftheorem defines Selection-sort SFMASTR3:def 6 :
for f being FinSeq-Location holds Selection-sort f = ((1 -stNotUsed (swap (f,(),()))) :=len f) ";" (for-up ((),(),(1 -stNotUsed (swap (f,(),()))),((FinSeqMin (f,(),(1 -stNotUsed (swap (f,(),()))),())) ";" (swap (f,(),())))));

theorem :: SFMASTR3:37
for s being State of SCM+FSA
for f being FinSeq-Location
for p being Instruction-Sequence of SCM+FSA
for S being State of SCM+FSA st S = IExec ((),p,s) holds
( S . f is_non_decreasing_on 1, len (S . f) & ex p being Permutation of (dom (s . f)) st S . f = (s . f) * p )
proof end;