src/HOL/Decision_Procs/Approximation.thy
 author huffman Wed Sep 07 09:02:58 2011 -0700 (2011-09-07) changeset 44821 a92f65e174cf parent 44568 e6f291cb5810 child 45129 1fce03e3e8ad permissions -rw-r--r--
avoid using legacy theorem names
```     1 (* Author:     Johannes Hoelzl, TU Muenchen
```
```     2    Coercions removed by Dmitriy Traytel *)
```
```     3
```
```     4 header {* Prove Real Valued Inequalities by Computation *}
```
```     5
```
```     6 theory Approximation
```
```     7 imports
```
```     8   Complex_Main
```
```     9   "~~/src/HOL/Library/Float"
```
```    10   "~~/src/HOL/Library/Reflection"
```
```    11   "~~/src/HOL/Decision_Procs/Dense_Linear_Order"
```
```    12   "~~/src/HOL/Library/Efficient_Nat"
```
```    13 begin
```
```    14
```
```    15 section "Horner Scheme"
```
```    16
```
```    17 subsection {* Define auxiliary helper @{text horner} function *}
```
```    18
```
```    19 primrec horner :: "(nat \<Rightarrow> nat) \<Rightarrow> (nat \<Rightarrow> nat \<Rightarrow> nat) \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> real \<Rightarrow> real" where
```
```    20 "horner F G 0 i k x       = 0" |
```
```    21 "horner F G (Suc n) i k x = 1 / k - x * horner F G n (F i) (G i k) x"
```
```    22
```
```    23 lemma horner_schema': fixes x :: real  and a :: "nat \<Rightarrow> real"
```
```    24   shows "a 0 - x * (\<Sum> i=0..<n. (-1)^i * a (Suc i) * x^i) = (\<Sum> i=0..<Suc n. (-1)^i * a i * x^i)"
```
```    25 proof -
```
```    26   have shift_pow: "\<And>i. - (x * ((-1)^i * a (Suc i) * x ^ i)) = (-1)^(Suc i) * a (Suc i) * x ^ (Suc i)" by auto
```
```    27   show ?thesis unfolding setsum_right_distrib shift_pow diff_minus setsum_negf[symmetric] setsum_head_upt_Suc[OF zero_less_Suc]
```
```    28     setsum_reindex[OF inj_Suc, unfolded comp_def, symmetric, of "\<lambda> n. (-1)^n  *a n * x^n"] by auto
```
```    29 qed
```
```    30
```
```    31 lemma horner_schema: fixes f :: "nat \<Rightarrow> nat" and G :: "nat \<Rightarrow> nat \<Rightarrow> nat" and F :: "nat \<Rightarrow> nat"
```
```    32   assumes f_Suc: "\<And>n. f (Suc n) = G ((F ^^ n) s) (f n)"
```
```    33   shows "horner F G n ((F ^^ j') s) (f j') x = (\<Sum> j = 0..< n. -1 ^ j * (1 / (f (j' + j))) * x ^ j)"
```
```    34 proof (induct n arbitrary: i k j')
```
```    35   case (Suc n)
```
```    36
```
```    37   show ?case unfolding horner.simps Suc[where j'="Suc j'", unfolded funpow.simps comp_def f_Suc]
```
```    38     using horner_schema'[of "\<lambda> j. 1 / (f (j' + j))"] by auto
```
```    39 qed auto
```
```    40
```
```    41 lemma horner_bounds':
```
```    42   fixes lb :: "nat \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> float \<Rightarrow> float" and ub :: "nat \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> float \<Rightarrow> float"
```
```    43   assumes "0 \<le> real x" and f_Suc: "\<And>n. f (Suc n) = G ((F ^^ n) s) (f n)"
```
```    44   and lb_0: "\<And> i k x. lb 0 i k x = 0"
```
```    45   and lb_Suc: "\<And> n i k x. lb (Suc n) i k x = lapprox_rat prec 1 k - x * (ub n (F i) (G i k) x)"
```
```    46   and ub_0: "\<And> i k x. ub 0 i k x = 0"
```
```    47   and ub_Suc: "\<And> n i k x. ub (Suc n) i k x = rapprox_rat prec 1 k - x * (lb n (F i) (G i k) x)"
```
```    48   shows "(lb n ((F ^^ j') s) (f j') x) \<le> horner F G n ((F ^^ j') s) (f j') x \<and>
```
```    49          horner F G n ((F ^^ j') s) (f j') x \<le> (ub n ((F ^^ j') s) (f j') x)"
```
```    50   (is "?lb n j' \<le> ?horner n j' \<and> ?horner n j' \<le> ?ub n j'")
```
```    51 proof (induct n arbitrary: j')
```
```    52   case 0 thus ?case unfolding lb_0 ub_0 horner.simps by auto
```
```    53 next
```
```    54   case (Suc n)
```
```    55   have "?lb (Suc n) j' \<le> ?horner (Suc n) j'" unfolding lb_Suc ub_Suc horner.simps real_of_float_sub diff_minus
```
```    56   proof (rule add_mono)
```
```    57     show "(lapprox_rat prec 1 (f j')) \<le> 1 / (f j')" using lapprox_rat[of prec 1  "f j'"] by auto
```
```    58     from Suc[where j'="Suc j'", unfolded funpow.simps comp_def f_Suc, THEN conjunct2] `0 \<le> real x`
```
```    59     show "- real (x * ub n (F ((F ^^ j') s)) (G ((F ^^ j') s) (f j')) x) \<le>
```
```    60           - (x * horner F G n (F ((F ^^ j') s)) (G ((F ^^ j') s) (f j')) x)"
```
```    61       unfolding real_of_float_mult neg_le_iff_le by (rule mult_left_mono)
```
```    62   qed
```
```    63   moreover have "?horner (Suc n) j' \<le> ?ub (Suc n) j'" unfolding ub_Suc ub_Suc horner.simps real_of_float_sub diff_minus
```
```    64   proof (rule add_mono)
```
```    65     show "1 / (f j') \<le> (rapprox_rat prec 1 (f j'))" using rapprox_rat[of 1 "f j'" prec] by auto
```
```    66     from Suc[where j'="Suc j'", unfolded funpow.simps comp_def f_Suc, THEN conjunct1] `0 \<le> real x`
```
```    67     show "- (x * horner F G n (F ((F ^^ j') s)) (G ((F ^^ j') s) (f j')) x) \<le>
```
```    68           - real (x * lb n (F ((F ^^ j') s)) (G ((F ^^ j') s) (f j')) x)"
```
```    69       unfolding real_of_float_mult neg_le_iff_le by (rule mult_left_mono)
```
```    70   qed
```
```    71   ultimately show ?case by blast
```
```    72 qed
```
```    73
```
```    74 subsection "Theorems for floating point functions implementing the horner scheme"
```
```    75
```
```    76 text {*
```
```    77
```
```    78 Here @{term_type "f :: nat \<Rightarrow> nat"} is the sequence defining the Taylor series, the coefficients are
```
```    79 all alternating and reciprocs. We use @{term G} and @{term F} to describe the computation of @{term f}.
```
```    80
```
```    81 *}
```
```    82
```
```    83 lemma horner_bounds: fixes F :: "nat \<Rightarrow> nat" and G :: "nat \<Rightarrow> nat \<Rightarrow> nat"
```
```    84   assumes "0 \<le> real x" and f_Suc: "\<And>n. f (Suc n) = G ((F ^^ n) s) (f n)"
```
```    85   and lb_0: "\<And> i k x. lb 0 i k x = 0"
```
```    86   and lb_Suc: "\<And> n i k x. lb (Suc n) i k x = lapprox_rat prec 1 k - x * (ub n (F i) (G i k) x)"
```
```    87   and ub_0: "\<And> i k x. ub 0 i k x = 0"
```
```    88   and ub_Suc: "\<And> n i k x. ub (Suc n) i k x = rapprox_rat prec 1 k - x * (lb n (F i) (G i k) x)"
```
```    89   shows "(lb n ((F ^^ j') s) (f j') x) \<le> (\<Sum>j=0..<n. -1 ^ j * (1 / (f (j' + j))) * (x ^ j))" (is "?lb") and
```
```    90     "(\<Sum>j=0..<n. -1 ^ j * (1 / (f (j' + j))) * (x ^ j)) \<le> (ub n ((F ^^ j') s) (f j') x)" (is "?ub")
```
```    91 proof -
```
```    92   have "?lb  \<and> ?ub"
```
```    93     using horner_bounds'[where lb=lb, OF `0 \<le> real x` f_Suc lb_0 lb_Suc ub_0 ub_Suc]
```
```    94     unfolding horner_schema[where f=f, OF f_Suc] .
```
```    95   thus "?lb" and "?ub" by auto
```
```    96 qed
```
```    97
```
```    98 lemma horner_bounds_nonpos: fixes F :: "nat \<Rightarrow> nat" and G :: "nat \<Rightarrow> nat \<Rightarrow> nat"
```
```    99   assumes "real x \<le> 0" and f_Suc: "\<And>n. f (Suc n) = G ((F ^^ n) s) (f n)"
```
```   100   and lb_0: "\<And> i k x. lb 0 i k x = 0"
```
```   101   and lb_Suc: "\<And> n i k x. lb (Suc n) i k x = lapprox_rat prec 1 k + x * (ub n (F i) (G i k) x)"
```
```   102   and ub_0: "\<And> i k x. ub 0 i k x = 0"
```
```   103   and ub_Suc: "\<And> n i k x. ub (Suc n) i k x = rapprox_rat prec 1 k + x * (lb n (F i) (G i k) x)"
```
```   104   shows "(lb n ((F ^^ j') s) (f j') x) \<le> (\<Sum>j=0..<n. (1 / (f (j' + j))) * real x ^ j)" (is "?lb") and
```
```   105     "(\<Sum>j=0..<n. (1 / (f (j' + j))) * real x ^ j) \<le> (ub n ((F ^^ j') s) (f j') x)" (is "?ub")
```
```   106 proof -
```
```   107   { fix x y z :: float have "x - y * z = x + - y * z"
```
```   108       by (cases x, cases y, cases z, simp add: plus_float.simps minus_float_def uminus_float.simps times_float.simps algebra_simps)
```
```   109   } note diff_mult_minus = this
```
```   110
```
```   111   { fix x :: float have "- (- x) = x" by (cases x, auto simp add: uminus_float.simps) } note minus_minus = this
```
```   112
```
```   113   have move_minus: "(-x) = -1 * real x" by auto (* coercion "inside" is necessary *)
```
```   114
```
```   115   have sum_eq: "(\<Sum>j=0..<n. (1 / (f (j' + j))) * real x ^ j) =
```
```   116     (\<Sum>j = 0..<n. -1 ^ j * (1 / (f (j' + j))) * real (- x) ^ j)"
```
```   117   proof (rule setsum_cong, simp)
```
```   118     fix j assume "j \<in> {0 ..< n}"
```
```   119     show "1 / (f (j' + j)) * real x ^ j = -1 ^ j * (1 / (f (j' + j))) * real (- x) ^ j"
```
```   120       unfolding move_minus power_mult_distrib mult_assoc[symmetric]
```
```   121       unfolding mult_commute unfolding mult_assoc[of "-1 ^ j", symmetric] power_mult_distrib[symmetric]
```
```   122       by auto
```
```   123   qed
```
```   124
```
```   125   have "0 \<le> real (-x)" using assms by auto
```
```   126   from horner_bounds[where G=G and F=F and f=f and s=s and prec=prec
```
```   127     and lb="\<lambda> n i k x. lb n i k (-x)" and ub="\<lambda> n i k x. ub n i k (-x)", unfolded lb_Suc ub_Suc diff_mult_minus,
```
```   128     OF this f_Suc lb_0 refl ub_0 refl]
```
```   129   show "?lb" and "?ub" unfolding minus_minus sum_eq
```
```   130     by auto
```
```   131 qed
```
```   132
```
```   133 subsection {* Selectors for next even or odd number *}
```
```   134
```
```   135 text {*
```
```   136
```
```   137 The horner scheme computes alternating series. To get the upper and lower bounds we need to
```
```   138 guarantee to access a even or odd member. To do this we use @{term get_odd} and @{term get_even}.
```
```   139
```
```   140 *}
```
```   141
```
```   142 definition get_odd :: "nat \<Rightarrow> nat" where
```
```   143   "get_odd n = (if odd n then n else (Suc n))"
```
```   144
```
```   145 definition get_even :: "nat \<Rightarrow> nat" where
```
```   146   "get_even n = (if even n then n else (Suc n))"
```
```   147
```
```   148 lemma get_odd[simp]: "odd (get_odd n)" unfolding get_odd_def by (cases "odd n", auto)
```
```   149 lemma get_even[simp]: "even (get_even n)" unfolding get_even_def by (cases "even n", auto)
```
```   150 lemma get_odd_ex: "\<exists> k. Suc k = get_odd n \<and> odd (Suc k)"
```
```   151 proof (cases "odd n")
```
```   152   case True hence "0 < n" by (rule odd_pos)
```
```   153   from gr0_implies_Suc[OF this] obtain k where "Suc k = n" by auto
```
```   154   thus ?thesis unfolding get_odd_def if_P[OF True] using True[unfolded `Suc k = n`[symmetric]] by blast
```
```   155 next
```
```   156   case False hence "odd (Suc n)" by auto
```
```   157   thus ?thesis unfolding get_odd_def if_not_P[OF False] by blast
```
```   158 qed
```
```   159
```
```   160 lemma get_even_double: "\<exists>i. get_even n = 2 * i" using get_even[unfolded even_mult_two_ex] .
```
```   161 lemma get_odd_double: "\<exists>i. get_odd n = 2 * i + 1" using get_odd[unfolded odd_Suc_mult_two_ex] by auto
```
```   162
```
```   163 section "Power function"
```
```   164
```
```   165 definition float_power_bnds :: "nat \<Rightarrow> float \<Rightarrow> float \<Rightarrow> float * float" where
```
```   166 "float_power_bnds n l u = (if odd n \<or> 0 < l then (l ^ n, u ^ n)
```
```   167                       else if u < 0         then (u ^ n, l ^ n)
```
```   168                                             else (0, (max (-l) u) ^ n))"
```
```   169
```
```   170 lemma float_power_bnds: fixes x :: real
```
```   171   assumes "(l1, u1) = float_power_bnds n l u" and "x \<in> {l .. u}"
```
```   172   shows "x ^ n \<in> {l1..u1}"
```
```   173 proof (cases "even n")
```
```   174   case True
```
```   175   show ?thesis
```
```   176   proof (cases "0 < l")
```
```   177     case True hence "odd n \<or> 0 < l" and "0 \<le> real l" unfolding less_float_def by auto
```
```   178     have u1: "u1 = u ^ n" and l1: "l1 = l ^ n" using assms unfolding float_power_bnds_def if_P[OF `odd n \<or> 0 < l`] by auto
```
```   179     have "real l ^ n \<le> x ^ n" and "x ^ n \<le> real u ^ n " using `0 \<le> real l` and assms unfolding atLeastAtMost_iff using power_mono[of l x] power_mono[of x u] by auto
```
```   180     thus ?thesis using assms `0 < l` unfolding atLeastAtMost_iff l1 u1 float_power less_float_def by auto
```
```   181   next
```
```   182     case False hence P: "\<not> (odd n \<or> 0 < l)" using `even n` by auto
```
```   183     show ?thesis
```
```   184     proof (cases "u < 0")
```
```   185       case True hence "0 \<le> - real u" and "- real u \<le> - x" and "0 \<le> - x" and "-x \<le> - real l" using assms unfolding less_float_def by auto
```
```   186       hence "real u ^ n \<le> x ^ n" and "x ^ n \<le> real l ^ n" using power_mono[of  "-x" "-real l" n] power_mono[of "-real u" "-x" n]
```
```   187         unfolding power_minus_even[OF `even n`] by auto
```
```   188       moreover have u1: "u1 = l ^ n" and l1: "l1 = u ^ n" using assms unfolding float_power_bnds_def if_not_P[OF P] if_P[OF True] by auto
```
```   189       ultimately show ?thesis using float_power by auto
```
```   190     next
```
```   191       case False
```
```   192       have "\<bar>x\<bar> \<le> real (max (-l) u)"
```
```   193       proof (cases "-l \<le> u")
```
```   194         case True thus ?thesis unfolding max_def if_P[OF True] using assms unfolding le_float_def by auto
```
```   195       next
```
```   196         case False thus ?thesis unfolding max_def if_not_P[OF False] using assms unfolding le_float_def by auto
```
```   197       qed
```
```   198       hence x_abs: "\<bar>x\<bar> \<le> \<bar>real (max (-l) u)\<bar>" by auto
```
```   199       have u1: "u1 = (max (-l) u) ^ n" and l1: "l1 = 0" using assms unfolding float_power_bnds_def if_not_P[OF P] if_not_P[OF False] by auto
```
```   200       show ?thesis unfolding atLeastAtMost_iff l1 u1 float_power using zero_le_even_power[OF `even n`] power_mono_even[OF `even n` x_abs] by auto
```
```   201     qed
```
```   202   qed
```
```   203 next
```
```   204   case False hence "odd n \<or> 0 < l" by auto
```
```   205   have u1: "u1 = u ^ n" and l1: "l1 = l ^ n" using assms unfolding float_power_bnds_def if_P[OF `odd n \<or> 0 < l`] by auto
```
```   206   have "real l ^ n \<le> x ^ n" and "x ^ n \<le> real u ^ n " using assms unfolding atLeastAtMost_iff using power_mono_odd[OF False] by auto
```
```   207   thus ?thesis unfolding atLeastAtMost_iff l1 u1 float_power less_float_def by auto
```
```   208 qed
```
```   209
```
```   210 lemma bnds_power: "\<forall> (x::real) l u. (l1, u1) = float_power_bnds n l u \<and> x \<in> {l .. u} \<longrightarrow> l1 \<le> x ^ n \<and> x ^ n \<le> u1"
```
```   211   using float_power_bnds by auto
```
```   212
```
```   213 section "Square root"
```
```   214
```
```   215 text {*
```
```   216
```
```   217 The square root computation is implemented as newton iteration. As first first step we use the
```
```   218 nearest power of two greater than the square root.
```
```   219
```
```   220 *}
```
```   221
```
```   222 fun sqrt_iteration :: "nat \<Rightarrow> nat \<Rightarrow> float \<Rightarrow> float" where
```
```   223 "sqrt_iteration prec 0 (Float m e) = Float 1 ((e + bitlen m) div 2 + 1)" |
```
```   224 "sqrt_iteration prec (Suc m) x = (let y = sqrt_iteration prec m x
```
```   225                                   in Float 1 -1 * (y + float_divr prec x y))"
```
```   226
```
```   227 function ub_sqrt lb_sqrt :: "nat \<Rightarrow> float \<Rightarrow> float" where
```
```   228 "ub_sqrt prec x = (if 0 < x then (sqrt_iteration prec prec x)
```
```   229               else if x < 0 then - lb_sqrt prec (- x)
```
```   230                             else 0)" |
```
```   231 "lb_sqrt prec x = (if 0 < x then (float_divl prec x (sqrt_iteration prec prec x))
```
```   232               else if x < 0 then - ub_sqrt prec (- x)
```
```   233                             else 0)"
```
```   234 by pat_completeness auto
```
```   235 termination by (relation "measure (\<lambda> v. let (prec, x) = sum_case id id v in (if x < 0 then 1 else 0))", auto simp add: less_float_def)
```
```   236
```
```   237 declare lb_sqrt.simps[simp del]
```
```   238 declare ub_sqrt.simps[simp del]
```
```   239
```
```   240 lemma sqrt_ub_pos_pos_1:
```
```   241   assumes "sqrt x < b" and "0 < b" and "0 < x"
```
```   242   shows "sqrt x < (b + x / b)/2"
```
```   243 proof -
```
```   244   from assms have "0 < (b - sqrt x) ^ 2 " by simp
```
```   245   also have "\<dots> = b ^ 2 - 2 * b * sqrt x + (sqrt x) ^ 2" by algebra
```
```   246   also have "\<dots> = b ^ 2 - 2 * b * sqrt x + x" using assms by (simp add: real_sqrt_pow2)
```
```   247   finally have "0 < b ^ 2 - 2 * b * sqrt x + x" by assumption
```
```   248   hence "0 < b / 2 - sqrt x + x / (2 * b)" using assms
```
```   249     by (simp add: field_simps power2_eq_square)
```
```   250   thus ?thesis by (simp add: field_simps)
```
```   251 qed
```
```   252
```
```   253 lemma sqrt_iteration_bound: assumes "0 < real x"
```
```   254   shows "sqrt x < (sqrt_iteration prec n x)"
```
```   255 proof (induct n)
```
```   256   case 0
```
```   257   show ?case
```
```   258   proof (cases x)
```
```   259     case (Float m e)
```
```   260     hence "0 < m" using float_pos_m_pos[unfolded less_float_def] assms by auto
```
```   261     hence "0 < sqrt m" by auto
```
```   262
```
```   263     have int_nat_bl: "(nat (bitlen m)) = bitlen m" using bitlen_ge0 by auto
```
```   264
```
```   265     have "x = (m / 2^nat (bitlen m)) * pow2 (e + (nat (bitlen m)))"
```
```   266       unfolding pow2_add pow2_int Float real_of_float_simp by auto
```
```   267     also have "\<dots> < 1 * pow2 (e + nat (bitlen m))"
```
```   268     proof (rule mult_strict_right_mono, auto)
```
```   269       show "real m < 2^nat (bitlen m)" using bitlen_bounds[OF `0 < m`, THEN conjunct2]
```
```   270         unfolding real_of_int_less_iff[of m, symmetric] by auto
```
```   271     qed
```
```   272     finally have "sqrt x < sqrt (pow2 (e + bitlen m))" unfolding int_nat_bl by auto
```
```   273     also have "\<dots> \<le> pow2 ((e + bitlen m) div 2 + 1)"
```
```   274     proof -
```
```   275       let ?E = "e + bitlen m"
```
```   276       have E_mod_pow: "pow2 (?E mod 2) < 4"
```
```   277       proof (cases "?E mod 2 = 1")
```
```   278         case True thus ?thesis by auto
```
```   279       next
```
```   280         case False
```
```   281         have "0 \<le> ?E mod 2" by auto
```
```   282         have "?E mod 2 < 2" by auto
```
```   283         from this[THEN zless_imp_add1_zle]
```
```   284         have "?E mod 2 \<le> 0" using False by auto
```
```   285         from xt1(5)[OF `0 \<le> ?E mod 2` this]
```
```   286         show ?thesis by auto
```
```   287       qed
```
```   288       hence "sqrt (pow2 (?E mod 2)) < sqrt (2 * 2)" by auto
```
```   289       hence E_mod_pow: "sqrt (pow2 (?E mod 2)) < 2" unfolding real_sqrt_abs2 by auto
```
```   290
```
```   291       have E_eq: "pow2 ?E = pow2 (?E div 2 + ?E div 2 + ?E mod 2)" by auto
```
```   292       have "sqrt (pow2 ?E) = sqrt (pow2 (?E div 2) * pow2 (?E div 2) * pow2 (?E mod 2))"
```
```   293         unfolding E_eq unfolding pow2_add ..
```
```   294       also have "\<dots> = pow2 (?E div 2) * sqrt (pow2 (?E mod 2))"
```
```   295         unfolding real_sqrt_mult[of _ "pow2 (?E mod 2)"] real_sqrt_abs2 by auto
```
```   296       also have "\<dots> < pow2 (?E div 2) * 2"
```
```   297         by (rule mult_strict_left_mono, auto intro: E_mod_pow)
```
```   298       also have "\<dots> = pow2 (?E div 2 + 1)" unfolding add_commute[of _ 1] pow2_add1 by auto
```
```   299       finally show ?thesis by auto
```
```   300     qed
```
```   301     finally show ?thesis
```
```   302       unfolding Float sqrt_iteration.simps real_of_float_simp by auto
```
```   303   qed
```
```   304 next
```
```   305   case (Suc n)
```
```   306   let ?b = "sqrt_iteration prec n x"
```
```   307   have "0 < sqrt x" using `0 < real x` by auto
```
```   308   also have "\<dots> < real ?b" using Suc .
```
```   309   finally have "sqrt x < (?b + x / ?b)/2" using sqrt_ub_pos_pos_1[OF Suc _ `0 < real x`] by auto
```
```   310   also have "\<dots> \<le> (?b + (float_divr prec x ?b))/2" by (rule divide_right_mono, auto simp add: float_divr)
```
```   311   also have "\<dots> = (Float 1 -1) * (?b + (float_divr prec x ?b))" by auto
```
```   312   finally show ?case unfolding sqrt_iteration.simps Let_def real_of_float_mult real_of_float_add right_distrib .
```
```   313 qed
```
```   314
```
```   315 lemma sqrt_iteration_lower_bound: assumes "0 < real x"
```
```   316   shows "0 < real (sqrt_iteration prec n x)" (is "0 < ?sqrt")
```
```   317 proof -
```
```   318   have "0 < sqrt x" using assms by auto
```
```   319   also have "\<dots> < ?sqrt" using sqrt_iteration_bound[OF assms] .
```
```   320   finally show ?thesis .
```
```   321 qed
```
```   322
```
```   323 lemma lb_sqrt_lower_bound: assumes "0 \<le> real x"
```
```   324   shows "0 \<le> real (lb_sqrt prec x)"
```
```   325 proof (cases "0 < x")
```
```   326   case True hence "0 < real x" and "0 \<le> x" using `0 \<le> real x` unfolding less_float_def le_float_def by auto
```
```   327   hence "0 < sqrt_iteration prec prec x" unfolding less_float_def using sqrt_iteration_lower_bound by auto
```
```   328   hence "0 \<le> real (float_divl prec x (sqrt_iteration prec prec x))" using float_divl_lower_bound[OF `0 \<le> x`] unfolding le_float_def by auto
```
```   329   thus ?thesis unfolding lb_sqrt.simps using True by auto
```
```   330 next
```
```   331   case False with `0 \<le> real x` have "real x = 0" unfolding less_float_def by auto
```
```   332   thus ?thesis unfolding lb_sqrt.simps less_float_def by auto
```
```   333 qed
```
```   334
```
```   335 lemma bnds_sqrt':
```
```   336   shows "sqrt x \<in> {(lb_sqrt prec x) .. (ub_sqrt prec x) }"
```
```   337 proof -
```
```   338   { fix x :: float assume "0 < x"
```
```   339     hence "0 < real x" and "0 \<le> real x" unfolding less_float_def by auto
```
```   340     hence sqrt_gt0: "0 < sqrt x" by auto
```
```   341     hence sqrt_ub: "sqrt x < sqrt_iteration prec prec x" using sqrt_iteration_bound by auto
```
```   342
```
```   343     have "(float_divl prec x (sqrt_iteration prec prec x)) \<le>
```
```   344           x / (sqrt_iteration prec prec x)" by (rule float_divl)
```
```   345     also have "\<dots> < x / sqrt x"
```
```   346       by (rule divide_strict_left_mono[OF sqrt_ub `0 < real x`
```
```   347                mult_pos_pos[OF order_less_trans[OF sqrt_gt0 sqrt_ub] sqrt_gt0]])
```
```   348     also have "\<dots> = sqrt x"
```
```   349       unfolding inverse_eq_iff_eq[of _ "sqrt x", symmetric]
```
```   350                 sqrt_divide_self_eq[OF `0 \<le> real x`, symmetric] by auto
```
```   351     finally have "lb_sqrt prec x \<le> sqrt x"
```
```   352       unfolding lb_sqrt.simps if_P[OF `0 < x`] by auto }
```
```   353   note lb = this
```
```   354
```
```   355   { fix x :: float assume "0 < x"
```
```   356     hence "0 < real x" unfolding less_float_def by auto
```
```   357     hence "0 < sqrt x" by auto
```
```   358     hence "sqrt x < sqrt_iteration prec prec x"
```
```   359       using sqrt_iteration_bound by auto
```
```   360     hence "sqrt x \<le> ub_sqrt prec x"
```
```   361       unfolding ub_sqrt.simps if_P[OF `0 < x`] by auto }
```
```   362   note ub = this
```
```   363
```
```   364   show ?thesis
```
```   365   proof (cases "0 < x")
```
```   366     case True with lb ub show ?thesis by auto
```
```   367   next case False show ?thesis
```
```   368   proof (cases "real x = 0")
```
```   369     case True thus ?thesis
```
```   370       by (auto simp add: less_float_def lb_sqrt.simps ub_sqrt.simps)
```
```   371   next
```
```   372     case False with `\<not> 0 < x` have "x < 0" and "0 < -x"
```
```   373       by (auto simp add: less_float_def)
```
```   374
```
```   375     with `\<not> 0 < x`
```
```   376     show ?thesis using lb[OF `0 < -x`] ub[OF `0 < -x`]
```
```   377       by (auto simp add: real_sqrt_minus lb_sqrt.simps ub_sqrt.simps)
```
```   378   qed qed
```
```   379 qed
```
```   380
```
```   381 lemma bnds_sqrt: "\<forall> (x::real) lx ux. (l, u) = (lb_sqrt prec lx, ub_sqrt prec ux) \<and> x \<in> {lx .. ux} \<longrightarrow> l \<le> sqrt x \<and> sqrt x \<le> u"
```
```   382 proof ((rule allI) +, rule impI, erule conjE, rule conjI)
```
```   383   fix x :: real fix lx ux
```
```   384   assume "(l, u) = (lb_sqrt prec lx, ub_sqrt prec ux)"
```
```   385     and x: "x \<in> {lx .. ux}"
```
```   386   hence l: "l = lb_sqrt prec lx " and u: "u = ub_sqrt prec ux" by auto
```
```   387
```
```   388   have "sqrt lx \<le> sqrt x" using x by auto
```
```   389   from order_trans[OF _ this]
```
```   390   show "l \<le> sqrt x" unfolding l using bnds_sqrt'[of lx prec] by auto
```
```   391
```
```   392   have "sqrt x \<le> sqrt ux" using x by auto
```
```   393   from order_trans[OF this]
```
```   394   show "sqrt x \<le> u" unfolding u using bnds_sqrt'[of ux prec] by auto
```
```   395 qed
```
```   396
```
```   397 section "Arcus tangens and \<pi>"
```
```   398
```
```   399 subsection "Compute arcus tangens series"
```
```   400
```
```   401 text {*
```
```   402
```
```   403 As first step we implement the computation of the arcus tangens series. This is only valid in the range
```
```   404 @{term "{-1 :: real .. 1}"}. This is used to compute \<pi> and then the entire arcus tangens.
```
```   405
```
```   406 *}
```
```   407
```
```   408 fun ub_arctan_horner :: "nat \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> float \<Rightarrow> float"
```
```   409 and lb_arctan_horner :: "nat \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> float \<Rightarrow> float" where
```
```   410   "ub_arctan_horner prec 0 k x = 0"
```
```   411 | "ub_arctan_horner prec (Suc n) k x =
```
```   412     (rapprox_rat prec 1 k) - x * (lb_arctan_horner prec n (k + 2) x)"
```
```   413 | "lb_arctan_horner prec 0 k x = 0"
```
```   414 | "lb_arctan_horner prec (Suc n) k x =
```
```   415     (lapprox_rat prec 1 k) - x * (ub_arctan_horner prec n (k + 2) x)"
```
```   416
```
```   417 lemma arctan_0_1_bounds': assumes "0 \<le> real x" "real x \<le> 1" and "even n"
```
```   418   shows "arctan x \<in> {(x * lb_arctan_horner prec n 1 (x * x)) .. (x * ub_arctan_horner prec (Suc n) 1 (x * x))}"
```
```   419 proof -
```
```   420   let "?c i" = "-1^i * (1 / (i * 2 + (1::nat)) * real x ^ (i * 2 + 1))"
```
```   421   let "?S n" = "\<Sum> i=0..<n. ?c i"
```
```   422
```
```   423   have "0 \<le> real (x * x)" by auto
```
```   424   from `even n` obtain m where "2 * m = n" unfolding even_mult_two_ex by auto
```
```   425
```
```   426   have "arctan x \<in> { ?S n .. ?S (Suc n) }"
```
```   427   proof (cases "real x = 0")
```
```   428     case False
```
```   429     hence "0 < real x" using `0 \<le> real x` by auto
```
```   430     hence prem: "0 < 1 / (0 * 2 + (1::nat)) * real x ^ (0 * 2 + 1)" by auto
```
```   431
```
```   432     have "\<bar> real x \<bar> \<le> 1"  using `0 \<le> real x` `real x \<le> 1` by auto
```
```   433     from mp[OF summable_Leibniz(2)[OF zeroseq_arctan_series[OF this] monoseq_arctan_series[OF this]] prem, THEN spec, of m, unfolded `2 * m = n`]
```
```   434     show ?thesis unfolding arctan_series[OF `\<bar> real x \<bar> \<le> 1`] Suc_eq_plus1  .
```
```   435   qed auto
```
```   436   note arctan_bounds = this[unfolded atLeastAtMost_iff]
```
```   437
```
```   438   have F: "\<And>n. 2 * Suc n + 1 = 2 * n + 1 + 2" by auto
```
```   439
```
```   440   note bounds = horner_bounds[where s=1 and f="\<lambda>i. 2 * i + 1" and j'=0
```
```   441     and lb="\<lambda>n i k x. lb_arctan_horner prec n k x"
```
```   442     and ub="\<lambda>n i k x. ub_arctan_horner prec n k x",
```
```   443     OF `0 \<le> real (x*x)` F lb_arctan_horner.simps ub_arctan_horner.simps]
```
```   444
```
```   445   { have "(x * lb_arctan_horner prec n 1 (x*x)) \<le> ?S n"
```
```   446       using bounds(1) `0 \<le> real x`
```
```   447       unfolding real_of_float_mult power_add power_one_right mult_assoc[symmetric] setsum_left_distrib[symmetric]
```
```   448       unfolding mult_commute[where 'a=real] mult_commute[of _ "2::nat"] power_mult power2_eq_square[of "real x"]
```
```   449       by (auto intro!: mult_left_mono)
```
```   450     also have "\<dots> \<le> arctan x" using arctan_bounds ..
```
```   451     finally have "(x * lb_arctan_horner prec n 1 (x*x)) \<le> arctan x" . }
```
```   452   moreover
```
```   453   { have "arctan x \<le> ?S (Suc n)" using arctan_bounds ..
```
```   454     also have "\<dots> \<le> (x * ub_arctan_horner prec (Suc n) 1 (x*x))"
```
```   455       using bounds(2)[of "Suc n"] `0 \<le> real x`
```
```   456       unfolding real_of_float_mult power_add power_one_right mult_assoc[symmetric] setsum_left_distrib[symmetric]
```
```   457       unfolding mult_commute[where 'a=real] mult_commute[of _ "2::nat"] power_mult power2_eq_square[of "real x"]
```
```   458       by (auto intro!: mult_left_mono)
```
```   459     finally have "arctan x \<le> (x * ub_arctan_horner prec (Suc n) 1 (x*x))" . }
```
```   460   ultimately show ?thesis by auto
```
```   461 qed
```
```   462
```
```   463 lemma arctan_0_1_bounds: assumes "0 \<le> real x" "real x \<le> 1"
```
```   464   shows "arctan x \<in> {(x * lb_arctan_horner prec (get_even n) 1 (x * x)) .. (x * ub_arctan_horner prec (get_odd n) 1 (x * x))}"
```
```   465 proof (cases "even n")
```
```   466   case True
```
```   467   obtain n' where "Suc n' = get_odd n" and "odd (Suc n')" using get_odd_ex by auto
```
```   468   hence "even n'" unfolding even_Suc by auto
```
```   469   have "arctan x \<le> x * ub_arctan_horner prec (get_odd n) 1 (x * x)"
```
```   470     unfolding `Suc n' = get_odd n`[symmetric] using arctan_0_1_bounds'[OF `0 \<le> real x` `real x \<le> 1` `even n'`] by auto
```
```   471   moreover
```
```   472   have "x * lb_arctan_horner prec (get_even n) 1 (x * x) \<le> arctan x"
```
```   473     unfolding get_even_def if_P[OF True] using arctan_0_1_bounds'[OF `0 \<le> real x` `real x \<le> 1` `even n`] by auto
```
```   474   ultimately show ?thesis by auto
```
```   475 next
```
```   476   case False hence "0 < n" by (rule odd_pos)
```
```   477   from gr0_implies_Suc[OF this] obtain n' where "n = Suc n'" ..
```
```   478   from False[unfolded this even_Suc]
```
```   479   have "even n'" and "even (Suc (Suc n'))" by auto
```
```   480   have "get_odd n = Suc n'" unfolding get_odd_def if_P[OF False] using `n = Suc n'` .
```
```   481
```
```   482   have "arctan x \<le> x * ub_arctan_horner prec (get_odd n) 1 (x * x)"
```
```   483     unfolding `get_odd n = Suc n'` using arctan_0_1_bounds'[OF `0 \<le> real x` `real x \<le> 1` `even n'`] by auto
```
```   484   moreover
```
```   485   have "(x * lb_arctan_horner prec (get_even n) 1 (x * x)) \<le> arctan x"
```
```   486     unfolding get_even_def if_not_P[OF False] unfolding `n = Suc n'` using arctan_0_1_bounds'[OF `0 \<le> real x` `real x \<le> 1` `even (Suc (Suc n'))`] by auto
```
```   487   ultimately show ?thesis by auto
```
```   488 qed
```
```   489
```
```   490 subsection "Compute \<pi>"
```
```   491
```
```   492 definition ub_pi :: "nat \<Rightarrow> float" where
```
```   493   "ub_pi prec = (let A = rapprox_rat prec 1 5 ;
```
```   494                      B = lapprox_rat prec 1 239
```
```   495                  in ((Float 1 2) * ((Float 1 2) * A * (ub_arctan_horner prec (get_odd (prec div 4 + 1)) 1 (A * A)) -
```
```   496                                                   B * (lb_arctan_horner prec (get_even (prec div 14 + 1)) 1 (B * B)))))"
```
```   497
```
```   498 definition lb_pi :: "nat \<Rightarrow> float" where
```
```   499   "lb_pi prec = (let A = lapprox_rat prec 1 5 ;
```
```   500                      B = rapprox_rat prec 1 239
```
```   501                  in ((Float 1 2) * ((Float 1 2) * A * (lb_arctan_horner prec (get_even (prec div 4 + 1)) 1 (A * A)) -
```
```   502                                                   B * (ub_arctan_horner prec (get_odd (prec div 14 + 1)) 1 (B * B)))))"
```
```   503
```
```   504 lemma pi_boundaries: "pi \<in> {(lb_pi n) .. (ub_pi n)}"
```
```   505 proof -
```
```   506   have machin_pi: "pi = 4 * (4 * arctan (1 / 5) - arctan (1 / 239))" unfolding machin[symmetric] by auto
```
```   507
```
```   508   { fix prec n :: nat fix k :: int assume "1 < k" hence "0 \<le> k" and "0 < k" and "1 \<le> k" by auto
```
```   509     let ?k = "rapprox_rat prec 1 k"
```
```   510     have "1 div k = 0" using div_pos_pos_trivial[OF _ `1 < k`] by auto
```
```   511
```
```   512     have "0 \<le> real ?k" by (rule order_trans[OF _ rapprox_rat], auto simp add: `0 \<le> k`)
```
```   513     have "real ?k \<le> 1" unfolding rapprox_rat.simps(2)[OF zero_le_one `0 < k`]
```
```   514       by (rule rapprox_posrat_le1, auto simp add: `0 < k` `1 \<le> k`)
```
```   515
```
```   516     have "1 / k \<le> ?k" using rapprox_rat[where x=1 and y=k] by auto
```
```   517     hence "arctan (1 / k) \<le> arctan ?k" by (rule arctan_monotone')
```
```   518     also have "\<dots> \<le> (?k * ub_arctan_horner prec (get_odd n) 1 (?k * ?k))"
```
```   519       using arctan_0_1_bounds[OF `0 \<le> real ?k` `real ?k \<le> 1`] by auto
```
```   520     finally have "arctan (1 / k) \<le> ?k * ub_arctan_horner prec (get_odd n) 1 (?k * ?k)" .
```
```   521   } note ub_arctan = this
```
```   522
```
```   523   { fix prec n :: nat fix k :: int assume "1 < k" hence "0 \<le> k" and "0 < k" by auto
```
```   524     let ?k = "lapprox_rat prec 1 k"
```
```   525     have "1 div k = 0" using div_pos_pos_trivial[OF _ `1 < k`] by auto
```
```   526     have "1 / k \<le> 1" using `1 < k` by auto
```
```   527
```
```   528     have "\<And>n. 0 \<le> real ?k" using lapprox_rat_bottom[where x=1 and y=k, OF zero_le_one `0 < k`] by (auto simp add: `1 div k = 0`)
```
```   529     have "\<And>n. real ?k \<le> 1" using lapprox_rat by (rule order_trans, auto simp add: `1 / k \<le> 1`)
```
```   530
```
```   531     have "?k \<le> 1 / k" using lapprox_rat[where x=1 and y=k] by auto
```
```   532
```
```   533     have "?k * lb_arctan_horner prec (get_even n) 1 (?k * ?k) \<le> arctan ?k"
```
```   534       using arctan_0_1_bounds[OF `0 \<le> real ?k` `real ?k \<le> 1`] by auto
```
```   535     also have "\<dots> \<le> arctan (1 / k)" using `?k \<le> 1 / k` by (rule arctan_monotone')
```
```   536     finally have "?k * lb_arctan_horner prec (get_even n) 1 (?k * ?k) \<le> arctan (1 / k)" .
```
```   537   } note lb_arctan = this
```
```   538
```
```   539   have "pi \<le> ub_pi n"
```
```   540     unfolding ub_pi_def machin_pi Let_def real_of_float_mult real_of_float_sub unfolding Float_num
```
```   541     using lb_arctan[of 239] ub_arctan[of 5]
```
```   542     by (auto intro!: mult_left_mono add_mono simp add: diff_minus simp del: lapprox_rat.simps rapprox_rat.simps)
```
```   543   moreover
```
```   544   have "lb_pi n \<le> pi"
```
```   545     unfolding lb_pi_def machin_pi Let_def real_of_float_mult real_of_float_sub Float_num
```
```   546     using lb_arctan[of 5] ub_arctan[of 239]
```
```   547     by (auto intro!: mult_left_mono add_mono simp add: diff_minus simp del: lapprox_rat.simps rapprox_rat.simps)
```
```   548   ultimately show ?thesis by auto
```
```   549 qed
```
```   550
```
```   551 subsection "Compute arcus tangens in the entire domain"
```
```   552
```
```   553 function lb_arctan :: "nat \<Rightarrow> float \<Rightarrow> float" and ub_arctan :: "nat \<Rightarrow> float \<Rightarrow> float" where
```
```   554   "lb_arctan prec x = (let ub_horner = \<lambda> x. x * ub_arctan_horner prec (get_odd (prec div 4 + 1)) 1 (x * x) ;
```
```   555                            lb_horner = \<lambda> x. x * lb_arctan_horner prec (get_even (prec div 4 + 1)) 1 (x * x)
```
```   556     in (if x < 0          then - ub_arctan prec (-x) else
```
```   557         if x \<le> Float 1 -1 then lb_horner x else
```
```   558         if x \<le> Float 1 1  then Float 1 1 * lb_horner (float_divl prec x (1 + ub_sqrt prec (1 + x * x)))
```
```   559                           else (let inv = float_divr prec 1 x
```
```   560                                 in if inv > 1 then 0
```
```   561                                               else lb_pi prec * Float 1 -1 - ub_horner inv)))"
```
```   562
```
```   563 | "ub_arctan prec x = (let lb_horner = \<lambda> x. x * lb_arctan_horner prec (get_even (prec div 4 + 1)) 1 (x * x) ;
```
```   564                            ub_horner = \<lambda> x. x * ub_arctan_horner prec (get_odd (prec div 4 + 1)) 1 (x * x)
```
```   565     in (if x < 0          then - lb_arctan prec (-x) else
```
```   566         if x \<le> Float 1 -1 then ub_horner x else
```
```   567         if x \<le> Float 1 1  then let y = float_divr prec x (1 + lb_sqrt prec (1 + x * x))
```
```   568                                in if y > 1 then ub_pi prec * Float 1 -1
```
```   569                                            else Float 1 1 * ub_horner y
```
```   570                           else ub_pi prec * Float 1 -1 - lb_horner (float_divl prec 1 x)))"
```
```   571 by pat_completeness auto
```
```   572 termination by (relation "measure (\<lambda> v. let (prec, x) = sum_case id id v in (if x < 0 then 1 else 0))", auto simp add: less_float_def)
```
```   573
```
```   574 declare ub_arctan_horner.simps[simp del]
```
```   575 declare lb_arctan_horner.simps[simp del]
```
```   576
```
```   577 lemma lb_arctan_bound': assumes "0 \<le> real x"
```
```   578   shows "lb_arctan prec x \<le> arctan x"
```
```   579 proof -
```
```   580   have "\<not> x < 0" and "0 \<le> x" unfolding less_float_def le_float_def using `0 \<le> real x` by auto
```
```   581   let "?ub_horner x" = "x * ub_arctan_horner prec (get_odd (prec div 4 + 1)) 1 (x * x)"
```
```   582     and "?lb_horner x" = "x * lb_arctan_horner prec (get_even (prec div 4 + 1)) 1 (x * x)"
```
```   583
```
```   584   show ?thesis
```
```   585   proof (cases "x \<le> Float 1 -1")
```
```   586     case True hence "real x \<le> 1" unfolding le_float_def Float_num by auto
```
```   587     show ?thesis unfolding lb_arctan.simps Let_def if_not_P[OF `\<not> x < 0`] if_P[OF True]
```
```   588       using arctan_0_1_bounds[OF `0 \<le> real x` `real x \<le> 1`] by auto
```
```   589   next
```
```   590     case False hence "0 < real x" unfolding le_float_def Float_num by auto
```
```   591     let ?R = "1 + sqrt (1 + real x * real x)"
```
```   592     let ?fR = "1 + ub_sqrt prec (1 + x * x)"
```
```   593     let ?DIV = "float_divl prec x ?fR"
```
```   594
```
```   595     have sqr_ge0: "0 \<le> 1 + real x * real x" using sum_power2_ge_zero[of 1 "real x", unfolded numeral_2_eq_2] by auto
```
```   596     hence divisor_gt0: "0 < ?R" by (auto intro: add_pos_nonneg)
```
```   597
```
```   598     have "sqrt (1 + x * x) \<le> ub_sqrt prec (1 + x * x)"
```
```   599       using bnds_sqrt'[of "1 + x * x"] by auto
```
```   600
```
```   601     hence "?R \<le> ?fR" by auto
```
```   602     hence "0 < ?fR" and "0 < real ?fR" unfolding less_float_def using `0 < ?R` by auto
```
```   603
```
```   604     have monotone: "(float_divl prec x ?fR) \<le> x / ?R"
```
```   605     proof -
```
```   606       have "?DIV \<le> real x / ?fR" by (rule float_divl)
```
```   607       also have "\<dots> \<le> x / ?R" by (rule divide_left_mono[OF `?R \<le> ?fR` `0 \<le> real x` mult_pos_pos[OF order_less_le_trans[OF divisor_gt0 `?R \<le> real ?fR`] divisor_gt0]])
```
```   608       finally show ?thesis .
```
```   609     qed
```
```   610
```
```   611     show ?thesis
```
```   612     proof (cases "x \<le> Float 1 1")
```
```   613       case True
```
```   614
```
```   615       have "x \<le> sqrt (1 + x * x)" using real_sqrt_sum_squares_ge2[where x=1, unfolded numeral_2_eq_2] by auto
```
```   616       also have "\<dots> \<le> (ub_sqrt prec (1 + x * x))"
```
```   617         using bnds_sqrt'[of "1 + x * x"] by auto
```
```   618       finally have "real x \<le> ?fR" by auto
```
```   619       moreover have "?DIV \<le> real x / ?fR" by (rule float_divl)
```
```   620       ultimately have "real ?DIV \<le> 1" unfolding divide_le_eq_1_pos[OF `0 < real ?fR`, symmetric] by auto
```
```   621
```
```   622       have "0 \<le> real ?DIV" using float_divl_lower_bound[OF `0 \<le> x` `0 < ?fR`] unfolding le_float_def by auto
```
```   623
```
```   624       have "(Float 1 1 * ?lb_horner ?DIV) \<le> 2 * arctan (float_divl prec x ?fR)" unfolding real_of_float_mult[of "Float 1 1"] Float_num
```
```   625         using arctan_0_1_bounds[OF `0 \<le> real ?DIV` `real ?DIV \<le> 1`] by auto
```
```   626       also have "\<dots> \<le> 2 * arctan (x / ?R)"
```
```   627         using arctan_monotone'[OF monotone] by (auto intro!: mult_left_mono)
```
```   628       also have "2 * arctan (x / ?R) = arctan x" using arctan_half[symmetric] unfolding numeral_2_eq_2 power_Suc2 power_0 mult_1_left .
```
```   629       finally show ?thesis unfolding lb_arctan.simps Let_def if_not_P[OF `\<not> x < 0`] if_not_P[OF `\<not> x \<le> Float 1 -1`] if_P[OF True] .
```
```   630     next
```
```   631       case False
```
```   632       hence "2 < real x" unfolding le_float_def Float_num by auto
```
```   633       hence "1 \<le> real x" by auto
```
```   634
```
```   635       let "?invx" = "float_divr prec 1 x"
```
```   636       have "0 \<le> arctan x" using arctan_monotone'[OF `0 \<le> real x`] using arctan_tan[of 0, unfolded tan_zero] by auto
```
```   637
```
```   638       show ?thesis
```
```   639       proof (cases "1 < ?invx")
```
```   640         case True
```
```   641         show ?thesis unfolding lb_arctan.simps Let_def if_not_P[OF `\<not> x < 0`] if_not_P[OF `\<not> x \<le> Float 1 -1`] if_not_P[OF False] if_P[OF True]
```
```   642           using `0 \<le> arctan x` by auto
```
```   643       next
```
```   644         case False
```
```   645         hence "real ?invx \<le> 1" unfolding less_float_def by auto
```
```   646         have "0 \<le> real ?invx" by (rule order_trans[OF _ float_divr], auto simp add: `0 \<le> real x`)
```
```   647
```
```   648         have "1 / x \<noteq> 0" and "0 < 1 / x" using `0 < real x` by auto
```
```   649
```
```   650         have "arctan (1 / x) \<le> arctan ?invx" unfolding real_of_float_1[symmetric] by (rule arctan_monotone', rule float_divr)
```
```   651         also have "\<dots> \<le> (?ub_horner ?invx)" using arctan_0_1_bounds[OF `0 \<le> real ?invx` `real ?invx \<le> 1`] by auto
```
```   652         finally have "pi / 2 - (?ub_horner ?invx) \<le> arctan x"
```
```   653           using `0 \<le> arctan x` arctan_inverse[OF `1 / x \<noteq> 0`]
```
```   654           unfolding real_sgn_pos[OF `0 < 1 / real x`] le_diff_eq by auto
```
```   655         moreover
```
```   656         have "lb_pi prec * Float 1 -1 \<le> pi / 2" unfolding real_of_float_mult Float_num times_divide_eq_right mult_1_left using pi_boundaries by auto
```
```   657         ultimately
```
```   658         show ?thesis unfolding lb_arctan.simps Let_def if_not_P[OF `\<not> x < 0`] if_not_P[OF `\<not> x \<le> Float 1 -1`] if_not_P[OF `\<not> x \<le> Float 1 1`] if_not_P[OF False]
```
```   659           by auto
```
```   660       qed
```
```   661     qed
```
```   662   qed
```
```   663 qed
```
```   664
```
```   665 lemma ub_arctan_bound': assumes "0 \<le> real x"
```
```   666   shows "arctan x \<le> ub_arctan prec x"
```
```   667 proof -
```
```   668   have "\<not> x < 0" and "0 \<le> x" unfolding less_float_def le_float_def using `0 \<le> real x` by auto
```
```   669
```
```   670   let "?ub_horner x" = "x * ub_arctan_horner prec (get_odd (prec div 4 + 1)) 1 (x * x)"
```
```   671     and "?lb_horner x" = "x * lb_arctan_horner prec (get_even (prec div 4 + 1)) 1 (x * x)"
```
```   672
```
```   673   show ?thesis
```
```   674   proof (cases "x \<le> Float 1 -1")
```
```   675     case True hence "real x \<le> 1" unfolding le_float_def Float_num by auto
```
```   676     show ?thesis unfolding ub_arctan.simps Let_def if_not_P[OF `\<not> x < 0`] if_P[OF True]
```
```   677       using arctan_0_1_bounds[OF `0 \<le> real x` `real x \<le> 1`] by auto
```
```   678   next
```
```   679     case False hence "0 < real x" unfolding le_float_def Float_num by auto
```
```   680     let ?R = "1 + sqrt (1 + real x * real x)"
```
```   681     let ?fR = "1 + lb_sqrt prec (1 + x * x)"
```
```   682     let ?DIV = "float_divr prec x ?fR"
```
```   683
```
```   684     have sqr_ge0: "0 \<le> 1 + real x * real x" using sum_power2_ge_zero[of 1 "real x", unfolded numeral_2_eq_2] by auto
```
```   685     hence "0 \<le> real (1 + x*x)" by auto
```
```   686
```
```   687     hence divisor_gt0: "0 < ?R" by (auto intro: add_pos_nonneg)
```
```   688
```
```   689     have "lb_sqrt prec (1 + x * x) \<le> sqrt (1 + x * x)"
```
```   690       using bnds_sqrt'[of "1 + x * x"] by auto
```
```   691     hence "?fR \<le> ?R" by auto
```
```   692     have "0 < real ?fR" unfolding real_of_float_add real_of_float_1 by (rule order_less_le_trans[OF zero_less_one], auto simp add: lb_sqrt_lower_bound[OF `0 \<le> real (1 + x*x)`])
```
```   693
```
```   694     have monotone: "x / ?R \<le> (float_divr prec x ?fR)"
```
```   695     proof -
```
```   696       from divide_left_mono[OF `?fR \<le> ?R` `0 \<le> real x` mult_pos_pos[OF divisor_gt0 `0 < real ?fR`]]
```
```   697       have "x / ?R \<le> x / ?fR" .
```
```   698       also have "\<dots> \<le> ?DIV" by (rule float_divr)
```
```   699       finally show ?thesis .
```
```   700     qed
```
```   701
```
```   702     show ?thesis
```
```   703     proof (cases "x \<le> Float 1 1")
```
```   704       case True
```
```   705       show ?thesis
```
```   706       proof (cases "?DIV > 1")
```
```   707         case True
```
```   708         have "pi / 2 \<le> ub_pi prec * Float 1 -1" unfolding real_of_float_mult Float_num times_divide_eq_right mult_1_left using pi_boundaries by auto
```
```   709         from order_less_le_trans[OF arctan_ubound this, THEN less_imp_le]
```
```   710         show ?thesis unfolding ub_arctan.simps Let_def if_not_P[OF `\<not> x < 0`] if_not_P[OF `\<not> x \<le> Float 1 -1`] if_P[OF `x \<le> Float 1 1`] if_P[OF True] .
```
```   711       next
```
```   712         case False
```
```   713         hence "real ?DIV \<le> 1" unfolding less_float_def by auto
```
```   714
```
```   715         have "0 \<le> x / ?R" using `0 \<le> real x` `0 < ?R` unfolding zero_le_divide_iff by auto
```
```   716         hence "0 \<le> real ?DIV" using monotone by (rule order_trans)
```
```   717
```
```   718         have "arctan x = 2 * arctan (x / ?R)" using arctan_half unfolding numeral_2_eq_2 power_Suc2 power_0 mult_1_left .
```
```   719         also have "\<dots> \<le> 2 * arctan (?DIV)"
```
```   720           using arctan_monotone'[OF monotone] by (auto intro!: mult_left_mono)
```
```   721         also have "\<dots> \<le> (Float 1 1 * ?ub_horner ?DIV)" unfolding real_of_float_mult[of "Float 1 1"] Float_num
```
```   722           using arctan_0_1_bounds[OF `0 \<le> real ?DIV` `real ?DIV \<le> 1`] by auto
```
```   723         finally show ?thesis unfolding ub_arctan.simps Let_def if_not_P[OF `\<not> x < 0`] if_not_P[OF `\<not> x \<le> Float 1 -1`] if_P[OF `x \<le> Float 1 1`] if_not_P[OF False] .
```
```   724       qed
```
```   725     next
```
```   726       case False
```
```   727       hence "2 < real x" unfolding le_float_def Float_num by auto
```
```   728       hence "1 \<le> real x" by auto
```
```   729       hence "0 < real x" by auto
```
```   730       hence "0 < x" unfolding less_float_def by auto
```
```   731
```
```   732       let "?invx" = "float_divl prec 1 x"
```
```   733       have "0 \<le> arctan x" using arctan_monotone'[OF `0 \<le> real x`] using arctan_tan[of 0, unfolded tan_zero] by auto
```
```   734
```
```   735       have "real ?invx \<le> 1" unfolding less_float_def by (rule order_trans[OF float_divl], auto simp add: `1 \<le> real x` divide_le_eq_1_pos[OF `0 < real x`])
```
```   736       have "0 \<le> real ?invx" unfolding real_of_float_0[symmetric] by (rule float_divl_lower_bound[unfolded le_float_def], auto simp add: `0 < x`)
```
```   737
```
```   738       have "1 / x \<noteq> 0" and "0 < 1 / x" using `0 < real x` by auto
```
```   739
```
```   740       have "(?lb_horner ?invx) \<le> arctan (?invx)" using arctan_0_1_bounds[OF `0 \<le> real ?invx` `real ?invx \<le> 1`] by auto
```
```   741       also have "\<dots> \<le> arctan (1 / x)" unfolding real_of_float_1[symmetric] by (rule arctan_monotone', rule float_divl)
```
```   742       finally have "arctan x \<le> pi / 2 - (?lb_horner ?invx)"
```
```   743         using `0 \<le> arctan x` arctan_inverse[OF `1 / x \<noteq> 0`]
```
```   744         unfolding real_sgn_pos[OF `0 < 1 / x`] le_diff_eq by auto
```
```   745       moreover
```
```   746       have "pi / 2 \<le> ub_pi prec * Float 1 -1" unfolding real_of_float_mult Float_num times_divide_eq_right mult_1_right using pi_boundaries by auto
```
```   747       ultimately
```
```   748       show ?thesis unfolding ub_arctan.simps Let_def if_not_P[OF `\<not> x < 0`] if_not_P[OF `\<not> x \<le> Float 1 -1`] if_not_P[OF `\<not> x \<le> Float 1 1`] if_not_P[OF False]
```
```   749         by auto
```
```   750     qed
```
```   751   qed
```
```   752 qed
```
```   753
```
```   754 lemma arctan_boundaries:
```
```   755   "arctan x \<in> {(lb_arctan prec x) .. (ub_arctan prec x)}"
```
```   756 proof (cases "0 \<le> x")
```
```   757   case True hence "0 \<le> real x" unfolding le_float_def by auto
```
```   758   show ?thesis using ub_arctan_bound'[OF `0 \<le> real x`] lb_arctan_bound'[OF `0 \<le> real x`] unfolding atLeastAtMost_iff by auto
```
```   759 next
```
```   760   let ?mx = "-x"
```
```   761   case False hence "x < 0" and "0 \<le> real ?mx" unfolding le_float_def less_float_def by auto
```
```   762   hence bounds: "lb_arctan prec ?mx \<le> arctan ?mx \<and> arctan ?mx \<le> ub_arctan prec ?mx"
```
```   763     using ub_arctan_bound'[OF `0 \<le> real ?mx`] lb_arctan_bound'[OF `0 \<le> real ?mx`] by auto
```
```   764   show ?thesis unfolding real_of_float_minus arctan_minus lb_arctan.simps[where x=x] ub_arctan.simps[where x=x] Let_def if_P[OF `x < 0`]
```
```   765     unfolding atLeastAtMost_iff using bounds[unfolded real_of_float_minus arctan_minus] by auto
```
```   766 qed
```
```   767
```
```   768 lemma bnds_arctan: "\<forall> (x::real) lx ux. (l, u) = (lb_arctan prec lx, ub_arctan prec ux) \<and> x \<in> {lx .. ux} \<longrightarrow> l \<le> arctan x \<and> arctan x \<le> u"
```
```   769 proof (rule allI, rule allI, rule allI, rule impI)
```
```   770   fix x :: real fix lx ux
```
```   771   assume "(l, u) = (lb_arctan prec lx, ub_arctan prec ux) \<and> x \<in> {lx .. ux}"
```
```   772   hence l: "lb_arctan prec lx = l " and u: "ub_arctan prec ux = u" and x: "x \<in> {lx .. ux}" by auto
```
```   773
```
```   774   { from arctan_boundaries[of lx prec, unfolded l]
```
```   775     have "l \<le> arctan lx" by (auto simp del: lb_arctan.simps)
```
```   776     also have "\<dots> \<le> arctan x" using x by (auto intro: arctan_monotone')
```
```   777     finally have "l \<le> arctan x" .
```
```   778   } moreover
```
```   779   { have "arctan x \<le> arctan ux" using x by (auto intro: arctan_monotone')
```
```   780     also have "\<dots> \<le> u" using arctan_boundaries[of ux prec, unfolded u] by (auto simp del: ub_arctan.simps)
```
```   781     finally have "arctan x \<le> u" .
```
```   782   } ultimately show "l \<le> arctan x \<and> arctan x \<le> u" ..
```
```   783 qed
```
```   784
```
```   785 section "Sinus and Cosinus"
```
```   786
```
```   787 subsection "Compute the cosinus and sinus series"
```
```   788
```
```   789 fun ub_sin_cos_aux :: "nat \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> float \<Rightarrow> float"
```
```   790 and lb_sin_cos_aux :: "nat \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> float \<Rightarrow> float" where
```
```   791   "ub_sin_cos_aux prec 0 i k x = 0"
```
```   792 | "ub_sin_cos_aux prec (Suc n) i k x =
```
```   793     (rapprox_rat prec 1 k) - x * (lb_sin_cos_aux prec n (i + 2) (k * i * (i + 1)) x)"
```
```   794 | "lb_sin_cos_aux prec 0 i k x = 0"
```
```   795 | "lb_sin_cos_aux prec (Suc n) i k x =
```
```   796     (lapprox_rat prec 1 k) - x * (ub_sin_cos_aux prec n (i + 2) (k * i * (i + 1)) x)"
```
```   797 lemma cos_aux:
```
```   798   shows "(lb_sin_cos_aux prec n 1 1 (x * x)) \<le> (\<Sum> i=0..<n. -1^i * (1/real (fact (2 * i))) * x ^(2 * i))" (is "?lb")
```
```   799   and "(\<Sum> i=0..<n. -1^i * (1/real (fact (2 * i))) * x^(2 * i)) \<le> (ub_sin_cos_aux prec n 1 1 (x * x))" (is "?ub")
```
```   800 proof -
```
```   801   have "0 \<le> real (x * x)" unfolding real_of_float_mult by auto
```
```   802   let "?f n" = "fact (2 * n)"
```
```   803
```
```   804   { fix n
```
```   805     have F: "\<And>m. ((\<lambda>i. i + 2) ^^ n) m = m + 2 * n" by (induct n arbitrary: m, auto)
```
```   806     have "?f (Suc n) = ?f n * ((\<lambda>i. i + 2) ^^ n) 1 * (((\<lambda>i. i + 2) ^^ n) 1 + 1)"
```
```   807       unfolding F by auto } note f_eq = this
```
```   808
```
```   809   from horner_bounds[where lb="lb_sin_cos_aux prec" and ub="ub_sin_cos_aux prec" and j'=0,
```
```   810     OF `0 \<le> real (x * x)` f_eq lb_sin_cos_aux.simps ub_sin_cos_aux.simps]
```
```   811   show "?lb" and "?ub" by (auto simp add: power_mult power2_eq_square[of "real x"])
```
```   812 qed
```
```   813
```
```   814 lemma cos_boundaries: assumes "0 \<le> real x" and "x \<le> pi / 2"
```
```   815   shows "cos x \<in> {(lb_sin_cos_aux prec (get_even n) 1 1 (x * x)) .. (ub_sin_cos_aux prec (get_odd n) 1 1 (x * x))}"
```
```   816 proof (cases "real x = 0")
```
```   817   case False hence "real x \<noteq> 0" by auto
```
```   818   hence "0 < x" and "0 < real x" using `0 \<le> real x` unfolding less_float_def by auto
```
```   819   have "0 < x * x" using `0 < x` unfolding less_float_def real_of_float_mult real_of_float_0
```
```   820     using mult_pos_pos[where a="real x" and b="real x"] by auto
```
```   821
```
```   822   { fix x n have "(\<Sum> i=0..<n. -1^i * (1/real (fact (2 * i))) * x ^ (2 * i))
```
```   823     = (\<Sum> i = 0 ..< 2 * n. (if even(i) then (-1 ^ (i div 2))/(real (fact i)) else 0) * x ^ i)" (is "?sum = ?ifsum")
```
```   824   proof -
```
```   825     have "?sum = ?sum + (\<Sum> j = 0 ..< n. 0)" by auto
```
```   826     also have "\<dots> =
```
```   827       (\<Sum> j = 0 ..< n. -1 ^ ((2 * j) div 2) / (real (fact (2 * j))) * x ^(2 * j)) + (\<Sum> j = 0 ..< n. 0)" by auto
```
```   828     also have "\<dots> = (\<Sum> i = 0 ..< 2 * n. if even i then -1 ^ (i div 2) / (real (fact i)) * x ^ i else 0)"
```
```   829       unfolding sum_split_even_odd ..
```
```   830     also have "\<dots> = (\<Sum> i = 0 ..< 2 * n. (if even i then -1 ^ (i div 2) / (real (fact i)) else 0) * x ^ i)"
```
```   831       by (rule setsum_cong2) auto
```
```   832     finally show ?thesis by assumption
```
```   833   qed } note morph_to_if_power = this
```
```   834
```
```   835
```
```   836   { fix n :: nat assume "0 < n"
```
```   837     hence "0 < 2 * n" by auto
```
```   838     obtain t where "0 < t" and "t < real x" and
```
```   839       cos_eq: "cos x = (\<Sum> i = 0 ..< 2 * n. (if even(i) then (-1 ^ (i div 2))/(real (fact i)) else 0) * (real x) ^ i)
```
```   840       + (cos (t + 1/2 * (2 * n) * pi) / real (fact (2*n))) * (real x)^(2*n)"
```
```   841       (is "_ = ?SUM + ?rest / ?fact * ?pow")
```
```   842       using Maclaurin_cos_expansion2[OF `0 < real x` `0 < 2 * n`]
```
```   843       unfolding cos_coeff_def by auto
```
```   844
```
```   845     have "cos t * -1^n = cos t * cos (n * pi) + sin t * sin (n * pi)" by auto
```
```   846     also have "\<dots> = cos (t + n * pi)"  using cos_add by auto
```
```   847     also have "\<dots> = ?rest" by auto
```
```   848     finally have "cos t * -1^n = ?rest" .
```
```   849     moreover
```
```   850     have "t \<le> pi / 2" using `t < real x` and `x \<le> pi / 2` by auto
```
```   851     hence "0 \<le> cos t" using `0 < t` and cos_ge_zero by auto
```
```   852     ultimately have even: "even n \<Longrightarrow> 0 \<le> ?rest" and odd: "odd n \<Longrightarrow> 0 \<le> - ?rest " by auto
```
```   853
```
```   854     have "0 < ?fact" by auto
```
```   855     have "0 < ?pow" using `0 < real x` by auto
```
```   856
```
```   857     {
```
```   858       assume "even n"
```
```   859       have "(lb_sin_cos_aux prec n 1 1 (x * x)) \<le> ?SUM"
```
```   860         unfolding morph_to_if_power[symmetric] using cos_aux by auto
```
```   861       also have "\<dots> \<le> cos x"
```
```   862       proof -
```
```   863         from even[OF `even n`] `0 < ?fact` `0 < ?pow`
```
```   864         have "0 \<le> (?rest / ?fact) * ?pow" by (metis mult_nonneg_nonneg divide_nonneg_pos less_imp_le)
```
```   865         thus ?thesis unfolding cos_eq by auto
```
```   866       qed
```
```   867       finally have "(lb_sin_cos_aux prec n 1 1 (x * x)) \<le> cos x" .
```
```   868     } note lb = this
```
```   869
```
```   870     {
```
```   871       assume "odd n"
```
```   872       have "cos x \<le> ?SUM"
```
```   873       proof -
```
```   874         from `0 < ?fact` and `0 < ?pow` and odd[OF `odd n`]
```
```   875         have "0 \<le> (- ?rest) / ?fact * ?pow"
```
```   876           by (metis mult_nonneg_nonneg divide_nonneg_pos less_imp_le)
```
```   877         thus ?thesis unfolding cos_eq by auto
```
```   878       qed
```
```   879       also have "\<dots> \<le> (ub_sin_cos_aux prec n 1 1 (x * x))"
```
```   880         unfolding morph_to_if_power[symmetric] using cos_aux by auto
```
```   881       finally have "cos x \<le> (ub_sin_cos_aux prec n 1 1 (x * x))" .
```
```   882     } note ub = this and lb
```
```   883   } note ub = this(1) and lb = this(2)
```
```   884
```
```   885   have "cos x \<le> (ub_sin_cos_aux prec (get_odd n) 1 1 (x * x))" using ub[OF odd_pos[OF get_odd] get_odd] .
```
```   886   moreover have "(lb_sin_cos_aux prec (get_even n) 1 1 (x * x)) \<le> cos x"
```
```   887   proof (cases "0 < get_even n")
```
```   888     case True show ?thesis using lb[OF True get_even] .
```
```   889   next
```
```   890     case False
```
```   891     hence "get_even n = 0" by auto
```
```   892     have "- (pi / 2) \<le> x" by (rule order_trans[OF _ `0 < real x`[THEN less_imp_le]], auto)
```
```   893     with `x \<le> pi / 2`
```
```   894     show ?thesis unfolding `get_even n = 0` lb_sin_cos_aux.simps real_of_float_minus real_of_float_0 using cos_ge_zero by auto
```
```   895   qed
```
```   896   ultimately show ?thesis by auto
```
```   897 next
```
```   898   case True
```
```   899   show ?thesis
```
```   900   proof (cases "n = 0")
```
```   901     case True
```
```   902     thus ?thesis unfolding `n = 0` get_even_def get_odd_def using `real x = 0` lapprox_rat[where x="-1" and y=1] by auto
```
```   903   next
```
```   904     case False with not0_implies_Suc obtain m where "n = Suc m" by blast
```
```   905     thus ?thesis unfolding `n = Suc m` get_even_def get_odd_def using `real x = 0` rapprox_rat[where x=1 and y=1] lapprox_rat[where x=1 and y=1] by (cases "even (Suc m)", auto)
```
```   906   qed
```
```   907 qed
```
```   908
```
```   909 lemma sin_aux: assumes "0 \<le> real x"
```
```   910   shows "(x * lb_sin_cos_aux prec n 2 1 (x * x)) \<le> (\<Sum> i=0..<n. -1^i * (1/real (fact (2 * i + 1))) * x^(2 * i + 1))" (is "?lb")
```
```   911   and "(\<Sum> i=0..<n. -1^i * (1/real (fact (2 * i + 1))) * x^(2 * i + 1)) \<le> (x * ub_sin_cos_aux prec n 2 1 (x * x))" (is "?ub")
```
```   912 proof -
```
```   913   have "0 \<le> real (x * x)" unfolding real_of_float_mult by auto
```
```   914   let "?f n" = "fact (2 * n + 1)"
```
```   915
```
```   916   { fix n
```
```   917     have F: "\<And>m. ((\<lambda>i. i + 2) ^^ n) m = m + 2 * n" by (induct n arbitrary: m, auto)
```
```   918     have "?f (Suc n) = ?f n * ((\<lambda>i. i + 2) ^^ n) 2 * (((\<lambda>i. i + 2) ^^ n) 2 + 1)"
```
```   919       unfolding F by auto } note f_eq = this
```
```   920
```
```   921   from horner_bounds[where lb="lb_sin_cos_aux prec" and ub="ub_sin_cos_aux prec" and j'=0,
```
```   922     OF `0 \<le> real (x * x)` f_eq lb_sin_cos_aux.simps ub_sin_cos_aux.simps]
```
```   923   show "?lb" and "?ub" using `0 \<le> real x` unfolding real_of_float_mult
```
```   924     unfolding power_add power_one_right mult_assoc[symmetric] setsum_left_distrib[symmetric]
```
```   925     unfolding mult_commute[where 'a=real]
```
```   926     by (auto intro!: mult_left_mono simp add: power_mult power2_eq_square[of "real x"])
```
```   927 qed
```
```   928
```
```   929 lemma sin_boundaries: assumes "0 \<le> real x" and "x \<le> pi / 2"
```
```   930   shows "sin x \<in> {(x * lb_sin_cos_aux prec (get_even n) 2 1 (x * x)) .. (x * ub_sin_cos_aux prec (get_odd n) 2 1 (x * x))}"
```
```   931 proof (cases "real x = 0")
```
```   932   case False hence "real x \<noteq> 0" by auto
```
```   933   hence "0 < x" and "0 < real x" using `0 \<le> real x` unfolding less_float_def by auto
```
```   934   have "0 < x * x" using `0 < x` unfolding less_float_def real_of_float_mult real_of_float_0
```
```   935     using mult_pos_pos[where a="real x" and b="real x"] by auto
```
```   936
```
```   937   { fix x n have "(\<Sum> j = 0 ..< n. -1 ^ (((2 * j + 1) - Suc 0) div 2) / (real (fact (2 * j + 1))) * x ^(2 * j + 1))
```
```   938     = (\<Sum> i = 0 ..< 2 * n. (if even(i) then 0 else (-1 ^ ((i - Suc 0) div 2))/(real (fact i))) * x ^ i)" (is "?SUM = _")
```
```   939     proof -
```
```   940       have pow: "!!i. x ^ (2 * i + 1) = x * x ^ (2 * i)" by auto
```
```   941       have "?SUM = (\<Sum> j = 0 ..< n. 0) + ?SUM" by auto
```
```   942       also have "\<dots> = (\<Sum> i = 0 ..< 2 * n. if even i then 0 else -1 ^ ((i - Suc 0) div 2) / (real (fact i)) * x ^ i)"
```
```   943         unfolding sum_split_even_odd ..
```
```   944       also have "\<dots> = (\<Sum> i = 0 ..< 2 * n. (if even i then 0 else -1 ^ ((i - Suc 0) div 2) / (real (fact i))) * x ^ i)"
```
```   945         by (rule setsum_cong2) auto
```
```   946       finally show ?thesis by assumption
```
```   947     qed } note setsum_morph = this
```
```   948
```
```   949   { fix n :: nat assume "0 < n"
```
```   950     hence "0 < 2 * n + 1" by auto
```
```   951     obtain t where "0 < t" and "t < real x" and
```
```   952       sin_eq: "sin x = (\<Sum> i = 0 ..< 2 * n + 1. (if even(i) then 0 else (-1 ^ ((i - Suc 0) div 2))/(real (fact i))) * (real x) ^ i)
```
```   953       + (sin (t + 1/2 * (2 * n + 1) * pi) / real (fact (2*n + 1))) * (real x)^(2*n + 1)"
```
```   954       (is "_ = ?SUM + ?rest / ?fact * ?pow")
```
```   955       using Maclaurin_sin_expansion3[OF `0 < 2 * n + 1` `0 < real x`]
```
```   956       unfolding sin_coeff_def by auto
```
```   957
```
```   958     have "?rest = cos t * -1^n" unfolding sin_add cos_add real_of_nat_add left_distrib right_distrib by auto
```
```   959     moreover
```
```   960     have "t \<le> pi / 2" using `t < real x` and `x \<le> pi / 2` by auto
```
```   961     hence "0 \<le> cos t" using `0 < t` and cos_ge_zero by auto
```
```   962     ultimately have even: "even n \<Longrightarrow> 0 \<le> ?rest" and odd: "odd n \<Longrightarrow> 0 \<le> - ?rest " by auto
```
```   963
```
```   964     have "0 < ?fact" by (simp del: fact_Suc)
```
```   965     have "0 < ?pow" using `0 < real x` by (rule zero_less_power)
```
```   966
```
```   967     {
```
```   968       assume "even n"
```
```   969       have "(x * lb_sin_cos_aux prec n 2 1 (x * x)) \<le>
```
```   970             (\<Sum> i = 0 ..< 2 * n. (if even(i) then 0 else (-1 ^ ((i - Suc 0) div 2))/(real (fact i))) * (real x) ^ i)"
```
```   971         using sin_aux[OF `0 \<le> real x`] unfolding setsum_morph[symmetric] by auto
```
```   972       also have "\<dots> \<le> ?SUM" by auto
```
```   973       also have "\<dots> \<le> sin x"
```
```   974       proof -
```
```   975         from even[OF `even n`] `0 < ?fact` `0 < ?pow`
```
```   976         have "0 \<le> (?rest / ?fact) * ?pow" by (metis mult_nonneg_nonneg divide_nonneg_pos less_imp_le)
```
```   977         thus ?thesis unfolding sin_eq by auto
```
```   978       qed
```
```   979       finally have "(x * lb_sin_cos_aux prec n 2 1 (x * x)) \<le> sin x" .
```
```   980     } note lb = this
```
```   981
```
```   982     {
```
```   983       assume "odd n"
```
```   984       have "sin x \<le> ?SUM"
```
```   985       proof -
```
```   986         from `0 < ?fact` and `0 < ?pow` and odd[OF `odd n`]
```
```   987         have "0 \<le> (- ?rest) / ?fact * ?pow"
```
```   988           by (metis mult_nonneg_nonneg divide_nonneg_pos less_imp_le)
```
```   989         thus ?thesis unfolding sin_eq by auto
```
```   990       qed
```
```   991       also have "\<dots> \<le> (\<Sum> i = 0 ..< 2 * n. (if even(i) then 0 else (-1 ^ ((i - Suc 0) div 2))/(real (fact i))) * (real x) ^ i)"
```
```   992          by auto
```
```   993       also have "\<dots> \<le> (x * ub_sin_cos_aux prec n 2 1 (x * x))"
```
```   994         using sin_aux[OF `0 \<le> real x`] unfolding setsum_morph[symmetric] by auto
```
```   995       finally have "sin x \<le> (x * ub_sin_cos_aux prec n 2 1 (x * x))" .
```
```   996     } note ub = this and lb
```
```   997   } note ub = this(1) and lb = this(2)
```
```   998
```
```   999   have "sin x \<le> (x * ub_sin_cos_aux prec (get_odd n) 2 1 (x * x))" using ub[OF odd_pos[OF get_odd] get_odd] .
```
```  1000   moreover have "(x * lb_sin_cos_aux prec (get_even n) 2 1 (x * x)) \<le> sin x"
```
```  1001   proof (cases "0 < get_even n")
```
```  1002     case True show ?thesis using lb[OF True get_even] .
```
```  1003   next
```
```  1004     case False
```
```  1005     hence "get_even n = 0" by auto
```
```  1006     with `x \<le> pi / 2` `0 \<le> real x`
```
```  1007     show ?thesis unfolding `get_even n = 0` ub_sin_cos_aux.simps real_of_float_minus real_of_float_0 using sin_ge_zero by auto
```
```  1008   qed
```
```  1009   ultimately show ?thesis by auto
```
```  1010 next
```
```  1011   case True
```
```  1012   show ?thesis
```
```  1013   proof (cases "n = 0")
```
```  1014     case True
```
```  1015     thus ?thesis unfolding `n = 0` get_even_def get_odd_def using `real x = 0` lapprox_rat[where x="-1" and y=1] by auto
```
```  1016   next
```
```  1017     case False with not0_implies_Suc obtain m where "n = Suc m" by blast
```
```  1018     thus ?thesis unfolding `n = Suc m` get_even_def get_odd_def using `real x = 0` rapprox_rat[where x=1 and y=1] lapprox_rat[where x=1 and y=1] by (cases "even (Suc m)", auto)
```
```  1019   qed
```
```  1020 qed
```
```  1021
```
```  1022 subsection "Compute the cosinus in the entire domain"
```
```  1023
```
```  1024 definition lb_cos :: "nat \<Rightarrow> float \<Rightarrow> float" where
```
```  1025 "lb_cos prec x = (let
```
```  1026     horner = \<lambda> x. lb_sin_cos_aux prec (get_even (prec div 4 + 1)) 1 1 (x * x) ;
```
```  1027     half = \<lambda> x. if x < 0 then - 1 else Float 1 1 * x * x - 1
```
```  1028   in if x < Float 1 -1 then horner x
```
```  1029 else if x < 1          then half (horner (x * Float 1 -1))
```
```  1030                        else half (half (horner (x * Float 1 -2))))"
```
```  1031
```
```  1032 definition ub_cos :: "nat \<Rightarrow> float \<Rightarrow> float" where
```
```  1033 "ub_cos prec x = (let
```
```  1034     horner = \<lambda> x. ub_sin_cos_aux prec (get_odd (prec div 4 + 1)) 1 1 (x * x) ;
```
```  1035     half = \<lambda> x. Float 1 1 * x * x - 1
```
```  1036   in if x < Float 1 -1 then horner x
```
```  1037 else if x < 1          then half (horner (x * Float 1 -1))
```
```  1038                        else half (half (horner (x * Float 1 -2))))"
```
```  1039
```
```  1040 lemma lb_cos: assumes "0 \<le> real x" and "x \<le> pi"
```
```  1041   shows "cos x \<in> {(lb_cos prec x) .. (ub_cos prec x)}" (is "?cos x \<in> {(?lb x) .. (?ub x) }")
```
```  1042 proof -
```
```  1043   { fix x :: real
```
```  1044     have "cos x = cos (x / 2 + x / 2)" by auto
```
```  1045     also have "\<dots> = cos (x / 2) * cos (x / 2) + sin (x / 2) * sin (x / 2) - sin (x / 2) * sin (x / 2) + cos (x / 2) * cos (x / 2) - 1"
```
```  1046       unfolding cos_add by auto
```
```  1047     also have "\<dots> = 2 * cos (x / 2) * cos (x / 2) - 1" by algebra
```
```  1048     finally have "cos x = 2 * cos (x / 2) * cos (x / 2) - 1" .
```
```  1049   } note x_half = this[symmetric]
```
```  1050
```
```  1051   have "\<not> x < 0" using `0 \<le> real x` unfolding less_float_def by auto
```
```  1052   let "?ub_horner x" = "ub_sin_cos_aux prec (get_odd (prec div 4 + 1)) 1 1 (x * x)"
```
```  1053   let "?lb_horner x" = "lb_sin_cos_aux prec (get_even (prec div 4 + 1)) 1 1 (x * x)"
```
```  1054   let "?ub_half x" = "Float 1 1 * x * x - 1"
```
```  1055   let "?lb_half x" = "if x < 0 then - 1 else Float 1 1 * x * x - 1"
```
```  1056
```
```  1057   show ?thesis
```
```  1058   proof (cases "x < Float 1 -1")
```
```  1059     case True hence "x \<le> pi / 2" unfolding less_float_def using pi_ge_two by auto
```
```  1060     show ?thesis unfolding lb_cos_def[where x=x] ub_cos_def[where x=x] if_not_P[OF `\<not> x < 0`] if_P[OF `x < Float 1 -1`] Let_def
```
```  1061       using cos_boundaries[OF `0 \<le> real x` `x \<le> pi / 2`] .
```
```  1062   next
```
```  1063     case False
```
```  1064     { fix y x :: float let ?x2 = "(x * Float 1 -1)"
```
```  1065       assume "y \<le> cos ?x2" and "-pi \<le> x" and "x \<le> pi"
```
```  1066       hence "- (pi / 2) \<le> ?x2" and "?x2 \<le> pi / 2" using pi_ge_two unfolding real_of_float_mult Float_num by auto
```
```  1067       hence "0 \<le> cos ?x2" by (rule cos_ge_zero)
```
```  1068
```
```  1069       have "(?lb_half y) \<le> cos x"
```
```  1070       proof (cases "y < 0")
```
```  1071         case True show ?thesis using cos_ge_minus_one unfolding if_P[OF True] by auto
```
```  1072       next
```
```  1073         case False
```
```  1074         hence "0 \<le> real y" unfolding less_float_def by auto
```
```  1075         from mult_mono[OF `y \<le> cos ?x2` `y \<le> cos ?x2` `0 \<le> cos ?x2` this]
```
```  1076         have "real y * real y \<le> cos ?x2 * cos ?x2" .
```
```  1077         hence "2 * real y * real y \<le> 2 * cos ?x2 * cos ?x2" by auto
```
```  1078         hence "2 * real y * real y - 1 \<le> 2 * cos (x / 2) * cos (x / 2) - 1" unfolding Float_num real_of_float_mult by auto
```
```  1079         thus ?thesis unfolding if_not_P[OF False] x_half Float_num real_of_float_mult real_of_float_sub by auto
```
```  1080       qed
```
```  1081     } note lb_half = this
```
```  1082
```
```  1083     { fix y x :: float let ?x2 = "(x * Float 1 -1)"
```
```  1084       assume ub: "cos ?x2 \<le> y" and "- pi \<le> x" and "x \<le> pi"
```
```  1085       hence "- (pi / 2) \<le> ?x2" and "?x2 \<le> pi / 2" using pi_ge_two unfolding real_of_float_mult Float_num by auto
```
```  1086       hence "0 \<le> cos ?x2" by (rule cos_ge_zero)
```
```  1087
```
```  1088       have "cos x \<le> (?ub_half y)"
```
```  1089       proof -
```
```  1090         have "0 \<le> real y" using `0 \<le> cos ?x2` ub by (rule order_trans)
```
```  1091         from mult_mono[OF ub ub this `0 \<le> cos ?x2`]
```
```  1092         have "cos ?x2 * cos ?x2 \<le> real y * real y" .
```
```  1093         hence "2 * cos ?x2 * cos ?x2 \<le> 2 * real y * real y" by auto
```
```  1094         hence "2 * cos (x / 2) * cos (x / 2) - 1 \<le> 2 * real y * real y - 1" unfolding Float_num real_of_float_mult by auto
```
```  1095         thus ?thesis unfolding x_half real_of_float_mult Float_num real_of_float_sub by auto
```
```  1096       qed
```
```  1097     } note ub_half = this
```
```  1098
```
```  1099     let ?x2 = "x * Float 1 -1"
```
```  1100     let ?x4 = "x * Float 1 -1 * Float 1 -1"
```
```  1101
```
```  1102     have "-pi \<le> x" using pi_ge_zero[THEN le_imp_neg_le, unfolded minus_zero] `0 \<le> real x` by (rule order_trans)
```
```  1103
```
```  1104     show ?thesis
```
```  1105     proof (cases "x < 1")
```
```  1106       case True hence "real x \<le> 1" unfolding less_float_def by auto
```
```  1107       have "0 \<le> real ?x2" and "?x2 \<le> pi / 2" using pi_ge_two `0 \<le> real x` unfolding real_of_float_mult Float_num using assms by auto
```
```  1108       from cos_boundaries[OF this]
```
```  1109       have lb: "(?lb_horner ?x2) \<le> ?cos ?x2" and ub: "?cos ?x2 \<le> (?ub_horner ?x2)" by auto
```
```  1110
```
```  1111       have "(?lb x) \<le> ?cos x"
```
```  1112       proof -
```
```  1113         from lb_half[OF lb `-pi \<le> x` `x \<le> pi`]
```
```  1114         show ?thesis unfolding lb_cos_def[where x=x] Let_def using `\<not> x < 0` `\<not> x < Float 1 -1` `x < 1` by auto
```
```  1115       qed
```
```  1116       moreover have "?cos x \<le> (?ub x)"
```
```  1117       proof -
```
```  1118         from ub_half[OF ub `-pi \<le> x` `x \<le> pi`]
```
```  1119         show ?thesis unfolding ub_cos_def[where x=x] Let_def using `\<not> x < 0` `\<not> x < Float 1 -1` `x < 1` by auto
```
```  1120       qed
```
```  1121       ultimately show ?thesis by auto
```
```  1122     next
```
```  1123       case False
```
```  1124       have "0 \<le> real ?x4" and "?x4 \<le> pi / 2" using pi_ge_two `0 \<le> real x` `x \<le> pi` unfolding real_of_float_mult Float_num by auto
```
```  1125       from cos_boundaries[OF this]
```
```  1126       have lb: "(?lb_horner ?x4) \<le> ?cos ?x4" and ub: "?cos ?x4 \<le> (?ub_horner ?x4)" by auto
```
```  1127
```
```  1128       have eq_4: "?x2 * Float 1 -1 = x * Float 1 -2" by (cases x, auto simp add: times_float.simps)
```
```  1129
```
```  1130       have "(?lb x) \<le> ?cos x"
```
```  1131       proof -
```
```  1132         have "-pi \<le> ?x2" and "?x2 \<le> pi" unfolding real_of_float_mult Float_num using pi_ge_two `0 \<le> real x` `x \<le> pi` by auto
```
```  1133         from lb_half[OF lb_half[OF lb this] `-pi \<le> x` `x \<le> pi`, unfolded eq_4]
```
```  1134         show ?thesis unfolding lb_cos_def[where x=x] if_not_P[OF `\<not> x < 0`] if_not_P[OF `\<not> x < Float 1 -1`] if_not_P[OF `\<not> x < 1`] Let_def .
```
```  1135       qed
```
```  1136       moreover have "?cos x \<le> (?ub x)"
```
```  1137       proof -
```
```  1138         have "-pi \<le> ?x2" and "?x2 \<le> pi" unfolding real_of_float_mult Float_num using pi_ge_two `0 \<le> real x` ` x \<le> pi` by auto
```
```  1139         from ub_half[OF ub_half[OF ub this] `-pi \<le> x` `x \<le> pi`, unfolded eq_4]
```
```  1140         show ?thesis unfolding ub_cos_def[where x=x] if_not_P[OF `\<not> x < 0`] if_not_P[OF `\<not> x < Float 1 -1`] if_not_P[OF `\<not> x < 1`] Let_def .
```
```  1141       qed
```
```  1142       ultimately show ?thesis by auto
```
```  1143     qed
```
```  1144   qed
```
```  1145 qed
```
```  1146
```
```  1147 lemma lb_cos_minus: assumes "-pi \<le> x" and "real x \<le> 0"
```
```  1148   shows "cos (real(-x)) \<in> {(lb_cos prec (-x)) .. (ub_cos prec (-x))}"
```
```  1149 proof -
```
```  1150   have "0 \<le> real (-x)" and "(-x) \<le> pi" using `-pi \<le> x` `real x \<le> 0` by auto
```
```  1151   from lb_cos[OF this] show ?thesis .
```
```  1152 qed
```
```  1153
```
```  1154 definition bnds_cos :: "nat \<Rightarrow> float \<Rightarrow> float \<Rightarrow> float * float" where
```
```  1155 "bnds_cos prec lx ux = (let
```
```  1156     lpi = round_down prec (lb_pi prec) ;
```
```  1157     upi = round_up prec (ub_pi prec) ;
```
```  1158     k = floor_fl (float_divr prec (lx + lpi) (2 * lpi)) ;
```
```  1159     lx = lx - k * 2 * (if k < 0 then lpi else upi) ;
```
```  1160     ux = ux - k * 2 * (if k < 0 then upi else lpi)
```
```  1161   in   if - lpi \<le> lx \<and> ux \<le> 0    then (lb_cos prec (-lx), ub_cos prec (-ux))
```
```  1162   else if 0 \<le> lx \<and> ux \<le> lpi      then (lb_cos prec ux, ub_cos prec lx)
```
```  1163   else if - lpi \<le> lx \<and> ux \<le> lpi  then (min (lb_cos prec (-lx)) (lb_cos prec ux), Float 1 0)
```
```  1164   else if 0 \<le> lx \<and> ux \<le> 2 * lpi  then (Float -1 0, max (ub_cos prec lx) (ub_cos prec (- (ux - 2 * lpi))))
```
```  1165   else if -2 * lpi \<le> lx \<and> ux \<le> 0 then (Float -1 0, max (ub_cos prec (lx + 2 * lpi)) (ub_cos prec (-ux)))
```
```  1166                                  else (Float -1 0, Float 1 0))"
```
```  1167
```
```  1168 lemma floor_int:
```
```  1169   obtains k :: int where "real k = (floor_fl f)"
```
```  1170 proof -
```
```  1171   assume *: "\<And> k :: int. real k = (floor_fl f) \<Longrightarrow> thesis"
```
```  1172   obtain m e where fl: "Float m e = floor_fl f" by (cases "floor_fl f", auto)
```
```  1173   from floor_pos_exp[OF this]
```
```  1174   have "real (m* 2^(nat e)) = (floor_fl f)"
```
```  1175     by (auto simp add: fl[symmetric] real_of_float_def pow2_def)
```
```  1176   from *[OF this] show thesis by blast
```
```  1177 qed
```
```  1178
```
```  1179 lemma float_remove_real_numeral[simp]: "(number_of k :: float) = (number_of k :: real)"
```
```  1180 proof -
```
```  1181   have "(number_of k :: float) = real k"
```
```  1182     unfolding number_of_float_def real_of_float_def pow2_def by auto
```
```  1183   also have "\<dots> = (number_of k :: int)"
```
```  1184     by (simp add: number_of_is_id)
```
```  1185   finally show ?thesis by auto
```
```  1186 qed
```
```  1187
```
```  1188 lemma cos_periodic_nat[simp]: fixes n :: nat shows "cos (x + n * (2 * pi)) = cos x"
```
```  1189 proof (induct n arbitrary: x)
```
```  1190   case (Suc n)
```
```  1191   have split_pi_off: "x + (Suc n) * (2 * pi) = (x + n * (2 * pi)) + 2 * pi"
```
```  1192     unfolding Suc_eq_plus1 real_of_nat_add real_of_one left_distrib by auto
```
```  1193   show ?case unfolding split_pi_off using Suc by auto
```
```  1194 qed auto
```
```  1195
```
```  1196 lemma cos_periodic_int[simp]: fixes i :: int shows "cos (x + i * (2 * pi)) = cos x"
```
```  1197 proof (cases "0 \<le> i")
```
```  1198   case True hence i_nat: "real i = nat i" by auto
```
```  1199   show ?thesis unfolding i_nat by auto
```
```  1200 next
```
```  1201   case False hence i_nat: "i = - real (nat (-i))" by auto
```
```  1202   have "cos x = cos (x + i * (2 * pi) - i * (2 * pi))" by auto
```
```  1203   also have "\<dots> = cos (x + i * (2 * pi))"
```
```  1204     unfolding i_nat mult_minus_left diff_minus_eq_add by (rule cos_periodic_nat)
```
```  1205   finally show ?thesis by auto
```
```  1206 qed
```
```  1207
```
```  1208 lemma bnds_cos: "\<forall> (x::real) lx ux. (l, u) = bnds_cos prec lx ux \<and> x \<in> {lx .. ux} \<longrightarrow> l \<le> cos x \<and> cos x \<le> u"
```
```  1209 proof ((rule allI | rule impI | erule conjE) +)
```
```  1210   fix x :: real fix lx ux
```
```  1211   assume bnds: "(l, u) = bnds_cos prec lx ux" and x: "x \<in> {lx .. ux}"
```
```  1212
```
```  1213   let ?lpi = "round_down prec (lb_pi prec)"
```
```  1214   let ?upi = "round_up prec (ub_pi prec)"
```
```  1215   let ?k = "floor_fl (float_divr prec (lx + ?lpi) (2 * ?lpi))"
```
```  1216   let ?lx = "lx - ?k * 2 * (if ?k < 0 then ?lpi else ?upi)"
```
```  1217   let ?ux = "ux - ?k * 2 * (if ?k < 0 then ?upi else ?lpi)"
```
```  1218
```
```  1219   obtain k :: int where k: "k = real ?k" using floor_int .
```
```  1220
```
```  1221   have upi: "pi \<le> ?upi" and lpi: "?lpi \<le> pi"
```
```  1222     using round_up[of "ub_pi prec" prec] pi_boundaries[of prec]
```
```  1223           round_down[of prec "lb_pi prec"] by auto
```
```  1224   hence "?lx \<le> x - k * (2 * pi) \<and> x - k * (2 * pi) \<le> ?ux"
```
```  1225     using x by (cases "k = 0") (auto intro!: add_mono
```
```  1226                 simp add: diff_minus k[symmetric] less_float_def)
```
```  1227   note lx = this[THEN conjunct1] and ux = this[THEN conjunct2]
```
```  1228   hence lx_less_ux: "?lx \<le> real ?ux" by (rule order_trans)
```
```  1229
```
```  1230   { assume "- ?lpi \<le> ?lx" and x_le_0: "x - k * (2 * pi) \<le> 0"
```
```  1231     with lpi[THEN le_imp_neg_le] lx
```
```  1232     have pi_lx: "- pi \<le> ?lx" and lx_0: "real ?lx \<le> 0"
```
```  1233       by (simp_all add: le_float_def)
```
```  1234
```
```  1235     have "(lb_cos prec (- ?lx)) \<le> cos (real (- ?lx))"
```
```  1236       using lb_cos_minus[OF pi_lx lx_0] by simp
```
```  1237     also have "\<dots> \<le> cos (x + (-k) * (2 * pi))"
```
```  1238       using cos_monotone_minus_pi_0'[OF pi_lx lx x_le_0]
```
```  1239       by (simp only: real_of_float_minus real_of_int_minus
```
```  1240         cos_minus diff_minus mult_minus_left)
```
```  1241     finally have "(lb_cos prec (- ?lx)) \<le> cos x"
```
```  1242       unfolding cos_periodic_int . }
```
```  1243   note negative_lx = this
```
```  1244
```
```  1245   { assume "0 \<le> ?lx" and pi_x: "x - k * (2 * pi) \<le> pi"
```
```  1246     with lx
```
```  1247     have pi_lx: "?lx \<le> pi" and lx_0: "0 \<le> real ?lx"
```
```  1248       by (auto simp add: le_float_def)
```
```  1249
```
```  1250     have "cos (x + (-k) * (2 * pi)) \<le> cos ?lx"
```
```  1251       using cos_monotone_0_pi'[OF lx_0 lx pi_x]
```
```  1252       by (simp only: real_of_float_minus real_of_int_minus
```
```  1253         cos_minus diff_minus mult_minus_left)
```
```  1254     also have "\<dots> \<le> (ub_cos prec ?lx)"
```
```  1255       using lb_cos[OF lx_0 pi_lx] by simp
```
```  1256     finally have "cos x \<le> (ub_cos prec ?lx)"
```
```  1257       unfolding cos_periodic_int . }
```
```  1258   note positive_lx = this
```
```  1259
```
```  1260   { assume pi_x: "- pi \<le> x - k * (2 * pi)" and "?ux \<le> 0"
```
```  1261     with ux
```
```  1262     have pi_ux: "- pi \<le> ?ux" and ux_0: "real ?ux \<le> 0"
```
```  1263       by (simp_all add: le_float_def)
```
```  1264
```
```  1265     have "cos (x + (-k) * (2 * pi)) \<le> cos (real (- ?ux))"
```
```  1266       using cos_monotone_minus_pi_0'[OF pi_x ux ux_0]
```
```  1267       by (simp only: real_of_float_minus real_of_int_minus
```
```  1268           cos_minus diff_minus mult_minus_left)
```
```  1269     also have "\<dots> \<le> (ub_cos prec (- ?ux))"
```
```  1270       using lb_cos_minus[OF pi_ux ux_0, of prec] by simp
```
```  1271     finally have "cos x \<le> (ub_cos prec (- ?ux))"
```
```  1272       unfolding cos_periodic_int . }
```
```  1273   note negative_ux = this
```
```  1274
```
```  1275   { assume "?ux \<le> ?lpi" and x_ge_0: "0 \<le> x - k * (2 * pi)"
```
```  1276     with lpi ux
```
```  1277     have pi_ux: "?ux \<le> pi" and ux_0: "0 \<le> real ?ux"
```
```  1278       by (simp_all add: le_float_def)
```
```  1279
```
```  1280     have "(lb_cos prec ?ux) \<le> cos ?ux"
```
```  1281       using lb_cos[OF ux_0 pi_ux] by simp
```
```  1282     also have "\<dots> \<le> cos (x + (-k) * (2 * pi))"
```
```  1283       using cos_monotone_0_pi'[OF x_ge_0 ux pi_ux]
```
```  1284       by (simp only: real_of_float_minus real_of_int_minus
```
```  1285         cos_minus diff_minus mult_minus_left)
```
```  1286     finally have "(lb_cos prec ?ux) \<le> cos x"
```
```  1287       unfolding cos_periodic_int . }
```
```  1288   note positive_ux = this
```
```  1289
```
```  1290   show "l \<le> cos x \<and> cos x \<le> u"
```
```  1291   proof (cases "- ?lpi \<le> ?lx \<and> ?ux \<le> 0")
```
```  1292     case True with bnds
```
```  1293     have l: "l = lb_cos prec (-?lx)"
```
```  1294       and u: "u = ub_cos prec (-?ux)"
```
```  1295       by (auto simp add: bnds_cos_def Let_def)
```
```  1296
```
```  1297     from True lpi[THEN le_imp_neg_le] lx ux
```
```  1298     have "- pi \<le> x - k * (2 * pi)"
```
```  1299       and "x - k * (2 * pi) \<le> 0"
```
```  1300       by (auto simp add: le_float_def)
```
```  1301     with True negative_ux negative_lx
```
```  1302     show ?thesis unfolding l u by simp
```
```  1303   next case False note 1 = this show ?thesis
```
```  1304   proof (cases "0 \<le> ?lx \<and> ?ux \<le> ?lpi")
```
```  1305     case True with bnds 1
```
```  1306     have l: "l = lb_cos prec ?ux"
```
```  1307       and u: "u = ub_cos prec ?lx"
```
```  1308       by (auto simp add: bnds_cos_def Let_def)
```
```  1309
```
```  1310     from True lpi lx ux
```
```  1311     have "0 \<le> x - k * (2 * pi)"
```
```  1312       and "x - k * (2 * pi) \<le> pi"
```
```  1313       by (auto simp add: le_float_def)
```
```  1314     with True positive_ux positive_lx
```
```  1315     show ?thesis unfolding l u by simp
```
```  1316   next case False note 2 = this show ?thesis
```
```  1317   proof (cases "- ?lpi \<le> ?lx \<and> ?ux \<le> ?lpi")
```
```  1318     case True note Cond = this with bnds 1 2
```
```  1319     have l: "l = min (lb_cos prec (-?lx)) (lb_cos prec ?ux)"
```
```  1320       and u: "u = Float 1 0"
```
```  1321       by (auto simp add: bnds_cos_def Let_def)
```
```  1322
```
```  1323     show ?thesis unfolding u l using negative_lx positive_ux Cond
```
```  1324       by (cases "x - k * (2 * pi) < 0", simp_all add: real_of_float_min)
```
```  1325   next case False note 3 = this show ?thesis
```
```  1326   proof (cases "0 \<le> ?lx \<and> ?ux \<le> 2 * ?lpi")
```
```  1327     case True note Cond = this with bnds 1 2 3
```
```  1328     have l: "l = Float -1 0"
```
```  1329       and u: "u = max (ub_cos prec ?lx) (ub_cos prec (- (?ux - 2 * ?lpi)))"
```
```  1330       by (auto simp add: bnds_cos_def Let_def)
```
```  1331
```
```  1332     have "cos x \<le> real u"
```
```  1333     proof (cases "x - k * (2 * pi) < pi")
```
```  1334       case True hence "x - k * (2 * pi) \<le> pi" by simp
```
```  1335       from positive_lx[OF Cond[THEN conjunct1] this]
```
```  1336       show ?thesis unfolding u by (simp add: real_of_float_max)
```
```  1337     next
```
```  1338       case False hence "pi \<le> x - k * (2 * pi)" by simp
```
```  1339       hence pi_x: "- pi \<le> x - k * (2 * pi) - 2 * pi" by simp
```
```  1340
```
```  1341       have "?ux \<le> 2 * pi" using Cond lpi by (auto simp add: le_float_def)
```
```  1342       hence "x - k * (2 * pi) - 2 * pi \<le> 0" using ux by simp
```
```  1343
```
```  1344       have ux_0: "real (?ux - 2 * ?lpi) \<le> 0"
```
```  1345         using Cond by (auto simp add: le_float_def)
```
```  1346
```
```  1347       from 2 and Cond have "\<not> ?ux \<le> ?lpi" by auto
```
```  1348       hence "- ?lpi \<le> ?ux - 2 * ?lpi" by (auto simp add: le_float_def)
```
```  1349       hence pi_ux: "- pi \<le> (?ux - 2 * ?lpi)"
```
```  1350         using lpi[THEN le_imp_neg_le] by (auto simp add: le_float_def)
```
```  1351
```
```  1352       have x_le_ux: "x - k * (2 * pi) - 2 * pi \<le> (?ux - 2 * ?lpi)"
```
```  1353         using ux lpi by auto
```
```  1354
```
```  1355       have "cos x = cos (x + (-k) * (2 * pi) + (-1::int) * (2 * pi))"
```
```  1356         unfolding cos_periodic_int ..
```
```  1357       also have "\<dots> \<le> cos ((?ux - 2 * ?lpi))"
```
```  1358         using cos_monotone_minus_pi_0'[OF pi_x x_le_ux ux_0]
```
```  1359         by (simp only: real_of_float_minus real_of_int_minus real_of_one
```
```  1360             number_of_Min diff_minus mult_minus_left mult_1_left)
```
```  1361       also have "\<dots> = cos ((- (?ux - 2 * ?lpi)))"
```
```  1362         unfolding real_of_float_minus cos_minus ..
```
```  1363       also have "\<dots> \<le> (ub_cos prec (- (?ux - 2 * ?lpi)))"
```
```  1364         using lb_cos_minus[OF pi_ux ux_0] by simp
```
```  1365       finally show ?thesis unfolding u by (simp add: real_of_float_max)
```
```  1366     qed
```
```  1367     thus ?thesis unfolding l by auto
```
```  1368   next case False note 4 = this show ?thesis
```
```  1369   proof (cases "-2 * ?lpi \<le> ?lx \<and> ?ux \<le> 0")
```
```  1370     case True note Cond = this with bnds 1 2 3 4
```
```  1371     have l: "l = Float -1 0"
```
```  1372       and u: "u = max (ub_cos prec (?lx + 2 * ?lpi)) (ub_cos prec (-?ux))"
```
```  1373       by (auto simp add: bnds_cos_def Let_def)
```
```  1374
```
```  1375     have "cos x \<le> u"
```
```  1376     proof (cases "-pi < x - k * (2 * pi)")
```
```  1377       case True hence "-pi \<le> x - k * (2 * pi)" by simp
```
```  1378       from negative_ux[OF this Cond[THEN conjunct2]]
```
```  1379       show ?thesis unfolding u by (simp add: real_of_float_max)
```
```  1380     next
```
```  1381       case False hence "x - k * (2 * pi) \<le> -pi" by simp
```
```  1382       hence pi_x: "x - k * (2 * pi) + 2 * pi \<le> pi" by simp
```
```  1383
```
```  1384       have "-2 * pi \<le> ?lx" using Cond lpi by (auto simp add: le_float_def)
```
```  1385
```
```  1386       hence "0 \<le> x - k * (2 * pi) + 2 * pi" using lx by simp
```
```  1387
```
```  1388       have lx_0: "0 \<le> real (?lx + 2 * ?lpi)"
```
```  1389         using Cond lpi by (auto simp add: le_float_def)
```
```  1390
```
```  1391       from 1 and Cond have "\<not> -?lpi \<le> ?lx" by auto
```
```  1392       hence "?lx + 2 * ?lpi \<le> ?lpi" by (auto simp add: le_float_def)
```
```  1393       hence pi_lx: "(?lx + 2 * ?lpi) \<le> pi"
```
```  1394         using lpi[THEN le_imp_neg_le] by (auto simp add: le_float_def)
```
```  1395
```
```  1396       have lx_le_x: "(?lx + 2 * ?lpi) \<le> x - k * (2 * pi) + 2 * pi"
```
```  1397         using lx lpi by auto
```
```  1398
```
```  1399       have "cos x = cos (x + (-k) * (2 * pi) + (1 :: int) * (2 * pi))"
```
```  1400         unfolding cos_periodic_int ..
```
```  1401       also have "\<dots> \<le> cos ((?lx + 2 * ?lpi))"
```
```  1402         using cos_monotone_0_pi'[OF lx_0 lx_le_x pi_x]
```
```  1403         by (simp only: real_of_float_minus real_of_int_minus real_of_one
```
```  1404           number_of_Min diff_minus mult_minus_left mult_1_left)
```
```  1405       also have "\<dots> \<le> (ub_cos prec (?lx + 2 * ?lpi))"
```
```  1406         using lb_cos[OF lx_0 pi_lx] by simp
```
```  1407       finally show ?thesis unfolding u by (simp add: real_of_float_max)
```
```  1408     qed
```
```  1409     thus ?thesis unfolding l by auto
```
```  1410   next
```
```  1411     case False with bnds 1 2 3 4 show ?thesis by (auto simp add: bnds_cos_def Let_def)
```
```  1412   qed qed qed qed qed
```
```  1413 qed
```
```  1414
```
```  1415 section "Exponential function"
```
```  1416
```
```  1417 subsection "Compute the series of the exponential function"
```
```  1418
```
```  1419 fun ub_exp_horner :: "nat \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> float \<Rightarrow> float" and lb_exp_horner :: "nat \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> float \<Rightarrow> float" where
```
```  1420 "ub_exp_horner prec 0 i k x       = 0" |
```
```  1421 "ub_exp_horner prec (Suc n) i k x = rapprox_rat prec 1 (int k) + x * lb_exp_horner prec n (i + 1) (k * i) x" |
```
```  1422 "lb_exp_horner prec 0 i k x       = 0" |
```
```  1423 "lb_exp_horner prec (Suc n) i k x = lapprox_rat prec 1 (int k) + x * ub_exp_horner prec n (i + 1) (k * i) x"
```
```  1424
```
```  1425 lemma bnds_exp_horner: assumes "real x \<le> 0"
```
```  1426   shows "exp x \<in> { lb_exp_horner prec (get_even n) 1 1 x .. ub_exp_horner prec (get_odd n) 1 1 x }"
```
```  1427 proof -
```
```  1428   { fix n
```
```  1429     have F: "\<And> m. ((\<lambda>i. i + 1) ^^ n) m = n + m" by (induct n, auto)
```
```  1430     have "fact (Suc n) = fact n * ((\<lambda>i. i + 1) ^^ n) 1" unfolding F by auto } note f_eq = this
```
```  1431
```
```  1432   note bounds = horner_bounds_nonpos[where f="fact" and lb="lb_exp_horner prec" and ub="ub_exp_horner prec" and j'=0 and s=1,
```
```  1433     OF assms f_eq lb_exp_horner.simps ub_exp_horner.simps]
```
```  1434
```
```  1435   { have "lb_exp_horner prec (get_even n) 1 1 x \<le> (\<Sum>j = 0..<get_even n. 1 / real (fact j) * real x ^ j)"
```
```  1436       using bounds(1) by auto
```
```  1437     also have "\<dots> \<le> exp x"
```
```  1438     proof -
```
```  1439       obtain t where "\<bar>t\<bar> \<le> \<bar>real x\<bar>" and "exp x = (\<Sum>m = 0..<get_even n. real x ^ m / real (fact m)) + exp t / real (fact (get_even n)) * (real x) ^ (get_even n)"
```
```  1440         using Maclaurin_exp_le by blast
```
```  1441       moreover have "0 \<le> exp t / real (fact (get_even n)) * (real x) ^ (get_even n)"
```
```  1442         by (auto intro!: mult_nonneg_nonneg divide_nonneg_pos simp add: get_even zero_le_even_power exp_gt_zero)
```
```  1443       ultimately show ?thesis
```
```  1444         using get_odd exp_gt_zero by (auto intro!: mult_nonneg_nonneg)
```
```  1445     qed
```
```  1446     finally have "lb_exp_horner prec (get_even n) 1 1 x \<le> exp x" .
```
```  1447   } moreover
```
```  1448   {
```
```  1449     have x_less_zero: "real x ^ get_odd n \<le> 0"
```
```  1450     proof (cases "real x = 0")
```
```  1451       case True
```
```  1452       have "(get_odd n) \<noteq> 0" using get_odd[THEN odd_pos] by auto
```
```  1453       thus ?thesis unfolding True power_0_left by auto
```
```  1454     next
```
```  1455       case False hence "real x < 0" using `real x \<le> 0` by auto
```
```  1456       show ?thesis by (rule less_imp_le, auto simp add: power_less_zero_eq get_odd `real x < 0`)
```
```  1457     qed
```
```  1458
```
```  1459     obtain t where "\<bar>t\<bar> \<le> \<bar>real x\<bar>" and "exp x = (\<Sum>m = 0..<get_odd n. (real x) ^ m / real (fact m)) + exp t / real (fact (get_odd n)) * (real x) ^ (get_odd n)"
```
```  1460       using Maclaurin_exp_le by blast
```
```  1461     moreover have "exp t / real (fact (get_odd n)) * (real x) ^ (get_odd n) \<le> 0"
```
```  1462       by (auto intro!: mult_nonneg_nonpos divide_nonpos_pos simp add: x_less_zero exp_gt_zero)
```
```  1463     ultimately have "exp x \<le> (\<Sum>j = 0..<get_odd n. 1 / real (fact j) * real x ^ j)"
```
```  1464       using get_odd exp_gt_zero by (auto intro!: mult_nonneg_nonneg)
```
```  1465     also have "\<dots> \<le> ub_exp_horner prec (get_odd n) 1 1 x"
```
```  1466       using bounds(2) by auto
```
```  1467     finally have "exp x \<le> ub_exp_horner prec (get_odd n) 1 1 x" .
```
```  1468   } ultimately show ?thesis by auto
```
```  1469 qed
```
```  1470
```
```  1471 subsection "Compute the exponential function on the entire domain"
```
```  1472
```
```  1473 function ub_exp :: "nat \<Rightarrow> float \<Rightarrow> float" and lb_exp :: "nat \<Rightarrow> float \<Rightarrow> float" where
```
```  1474 "lb_exp prec x = (if 0 < x then float_divl prec 1 (ub_exp prec (-x))
```
```  1475              else let
```
```  1476                 horner = (\<lambda> x. let  y = lb_exp_horner prec (get_even (prec + 2)) 1 1 x  in if y \<le> 0 then Float 1 -2 else y)
```
```  1477              in if x < - 1 then (case floor_fl x of (Float m e) \<Rightarrow> (horner (float_divl prec x (- Float m e))) ^ (nat (-m) * 2 ^ nat e))
```
```  1478                            else horner x)" |
```
```  1479 "ub_exp prec x = (if 0 < x    then float_divr prec 1 (lb_exp prec (-x))
```
```  1480              else if x < - 1  then (case floor_fl x of (Float m e) \<Rightarrow>
```
```  1481                                     (ub_exp_horner prec (get_odd (prec + 2)) 1 1 (float_divr prec x (- Float m e))) ^ (nat (-m) * 2 ^ nat e))
```
```  1482                               else ub_exp_horner prec (get_odd (prec + 2)) 1 1 x)"
```
```  1483 by pat_completeness auto
```
```  1484 termination by (relation "measure (\<lambda> v. let (prec, x) = sum_case id id v in (if 0 < x then 1 else 0))", auto simp add: less_float_def)
```
```  1485
```
```  1486 lemma exp_m1_ge_quarter: "(1 / 4 :: real) \<le> exp (- 1)"
```
```  1487 proof -
```
```  1488   have eq4: "4 = Suc (Suc (Suc (Suc 0)))" by auto
```
```  1489
```
```  1490   have "1 / 4 = (Float 1 -2)" unfolding Float_num by auto
```
```  1491   also have "\<dots> \<le> lb_exp_horner 1 (get_even 4) 1 1 (- 1)"
```
```  1492     unfolding get_even_def eq4
```
```  1493     by (auto simp add: lapprox_posrat_def rapprox_posrat_def normfloat.simps)
```
```  1494   also have "\<dots> \<le> exp (- 1 :: float)" using bnds_exp_horner[where x="- 1"] by auto
```
```  1495   finally show ?thesis unfolding real_of_float_minus real_of_float_1 .
```
```  1496 qed
```
```  1497
```
```  1498 lemma lb_exp_pos: assumes "\<not> 0 < x" shows "0 < lb_exp prec x"
```
```  1499 proof -
```
```  1500   let "?lb_horner x" = "lb_exp_horner prec (get_even (prec + 2)) 1 1 x"
```
```  1501   let "?horner x" = "let  y = ?lb_horner x  in if y \<le> 0 then Float 1 -2 else y"
```
```  1502   have pos_horner: "\<And> x. 0 < ?horner x" unfolding Let_def by (cases "?lb_horner x \<le> 0", auto simp add: le_float_def less_float_def)
```
```  1503   moreover { fix x :: float fix num :: nat
```
```  1504     have "0 < real (?horner x) ^ num" using `0 < ?horner x`[unfolded less_float_def real_of_float_0] by (rule zero_less_power)
```
```  1505     also have "\<dots> = (?horner x) ^ num" using float_power by auto
```
```  1506     finally have "0 < real ((?horner x) ^ num)" .
```
```  1507   }
```
```  1508   ultimately show ?thesis
```
```  1509     unfolding lb_exp.simps if_not_P[OF `\<not> 0 < x`] Let_def
```
```  1510     by (cases "floor_fl x", cases "x < - 1", auto simp add: float_power le_float_def less_float_def)
```
```  1511 qed
```
```  1512
```
```  1513 lemma exp_boundaries': assumes "x \<le> 0"
```
```  1514   shows "exp x \<in> { (lb_exp prec x) .. (ub_exp prec x)}"
```
```  1515 proof -
```
```  1516   let "?lb_exp_horner x" = "lb_exp_horner prec (get_even (prec + 2)) 1 1 x"
```
```  1517   let "?ub_exp_horner x" = "ub_exp_horner prec (get_odd (prec + 2)) 1 1 x"
```
```  1518
```
```  1519   have "real x \<le> 0" and "\<not> x > 0" using `x \<le> 0` unfolding le_float_def less_float_def by auto
```
```  1520   show ?thesis
```
```  1521   proof (cases "x < - 1")
```
```  1522     case False hence "- 1 \<le> real x" unfolding less_float_def by auto
```
```  1523     show ?thesis
```
```  1524     proof (cases "?lb_exp_horner x \<le> 0")
```
```  1525       from `\<not> x < - 1` have "- 1 \<le> real x" unfolding less_float_def by auto
```
```  1526       hence "exp (- 1) \<le> exp x" unfolding exp_le_cancel_iff .
```
```  1527       from order_trans[OF exp_m1_ge_quarter this]
```
```  1528       have "Float 1 -2 \<le> exp x" unfolding Float_num .
```
```  1529       moreover case True
```
```  1530       ultimately show ?thesis using bnds_exp_horner `real x \<le> 0` `\<not> x > 0` `\<not> x < - 1` by auto
```
```  1531     next
```
```  1532       case False thus ?thesis using bnds_exp_horner `real x \<le> 0` `\<not> x > 0` `\<not> x < - 1` by (auto simp add: Let_def)
```
```  1533     qed
```
```  1534   next
```
```  1535     case True
```
```  1536
```
```  1537     obtain m e where Float_floor: "floor_fl x = Float m e" by (cases "floor_fl x", auto)
```
```  1538     let ?num = "nat (- m) * 2 ^ nat e"
```
```  1539
```
```  1540     have "real (floor_fl x) < - 1" using floor_fl `x < - 1` unfolding le_float_def less_float_def real_of_float_minus real_of_float_1 by (rule order_le_less_trans)
```
```  1541     hence "real (floor_fl x) < 0" unfolding Float_floor real_of_float_simp using zero_less_pow2[of xe] by auto
```
```  1542     hence "m < 0"
```
```  1543       unfolding less_float_def real_of_float_0 Float_floor real_of_float_simp
```
```  1544       unfolding pos_prod_lt[OF zero_less_pow2[of e], unfolded mult_commute] by auto
```
```  1545     hence "1 \<le> - m" by auto
```
```  1546     hence "0 < nat (- m)" by auto
```
```  1547     moreover
```
```  1548     have "0 \<le> e" using floor_pos_exp Float_floor[symmetric] by auto
```
```  1549     hence "(0::nat) < 2 ^ nat e" by auto
```
```  1550     ultimately have "0 < ?num"  by auto
```
```  1551     hence "real ?num \<noteq> 0" by auto
```
```  1552     have e_nat: "(nat e) = e" using `0 \<le> e` by auto
```
```  1553     have num_eq: "real ?num = - floor_fl x" using `0 < nat (- m)`
```
```  1554       unfolding Float_floor real_of_float_minus real_of_float_simp real_of_nat_mult pow2_int[of "nat e", unfolded e_nat] real_of_nat_power by auto
```
```  1555     have "0 < - floor_fl x" using `0 < ?num`[unfolded real_of_nat_less_iff[symmetric]] unfolding less_float_def num_eq[symmetric] real_of_float_0 real_of_nat_zero .
```
```  1556     hence "real (floor_fl x) < 0" unfolding less_float_def by auto
```
```  1557
```
```  1558     have "exp x \<le> ub_exp prec x"
```
```  1559     proof -
```
```  1560       have div_less_zero: "real (float_divr prec x (- floor_fl x)) \<le> 0"
```
```  1561         using float_divr_nonpos_pos_upper_bound[OF `x \<le> 0` `0 < - floor_fl x`] unfolding le_float_def real_of_float_0 .
```
```  1562
```
```  1563       have "exp x = exp (?num * (x / ?num))" using `real ?num \<noteq> 0` by auto
```
```  1564       also have "\<dots> = exp (x / ?num) ^ ?num" unfolding exp_real_of_nat_mult ..
```
```  1565       also have "\<dots> \<le> exp (float_divr prec x (- floor_fl x)) ^ ?num" unfolding num_eq
```
```  1566         by (rule power_mono, rule exp_le_cancel_iff[THEN iffD2], rule float_divr) auto
```
```  1567       also have "\<dots> \<le> (?ub_exp_horner (float_divr prec x (- floor_fl x))) ^ ?num" unfolding float_power
```
```  1568         by (rule power_mono, rule bnds_exp_horner[OF div_less_zero, unfolded atLeastAtMost_iff, THEN conjunct2], auto)
```
```  1569       finally show ?thesis unfolding ub_exp.simps if_not_P[OF `\<not> 0 < x`] if_P[OF `x < - 1`] float.cases Float_floor Let_def .
```
```  1570     qed
```
```  1571     moreover
```
```  1572     have "lb_exp prec x \<le> exp x"
```
```  1573     proof -
```
```  1574       let ?divl = "float_divl prec x (- Float m e)"
```
```  1575       let ?horner = "?lb_exp_horner ?divl"
```
```  1576
```
```  1577       show ?thesis
```
```  1578       proof (cases "?horner \<le> 0")
```
```  1579         case False hence "0 \<le> real ?horner" unfolding le_float_def by auto
```
```  1580
```
```  1581         have div_less_zero: "real (float_divl prec x (- floor_fl x)) \<le> 0"
```
```  1582           using `real (floor_fl x) < 0` `real x \<le> 0` by (auto intro!: order_trans[OF float_divl] divide_nonpos_neg)
```
```  1583
```
```  1584         have "(?lb_exp_horner (float_divl prec x (- floor_fl x))) ^ ?num \<le>
```
```  1585           exp (float_divl prec x (- floor_fl x)) ^ ?num" unfolding float_power
```
```  1586           using `0 \<le> real ?horner`[unfolded Float_floor[symmetric]] bnds_exp_horner[OF div_less_zero, unfolded atLeastAtMost_iff, THEN conjunct1] by (auto intro!: power_mono)
```
```  1587         also have "\<dots> \<le> exp (x / ?num) ^ ?num" unfolding num_eq
```
```  1588           using float_divl by (auto intro!: power_mono simp del: real_of_float_minus)
```
```  1589         also have "\<dots> = exp (?num * (x / ?num))" unfolding exp_real_of_nat_mult ..
```
```  1590         also have "\<dots> = exp x" using `real ?num \<noteq> 0` by auto
```
```  1591         finally show ?thesis
```
```  1592           unfolding lb_exp.simps if_not_P[OF `\<not> 0 < x`] if_P[OF `x < - 1`] float.cases Float_floor Let_def if_not_P[OF False] by auto
```
```  1593       next
```
```  1594         case True
```
```  1595         have "real (floor_fl x) \<noteq> 0" and "real (floor_fl x) \<le> 0" using `real (floor_fl x) < 0` by auto
```
```  1596         from divide_right_mono_neg[OF floor_fl[of x] `real (floor_fl x) \<le> 0`, unfolded divide_self[OF `real (floor_fl x) \<noteq> 0`]]
```
```  1597         have "- 1 \<le> x / (- floor_fl x)" unfolding real_of_float_minus by auto
```
```  1598         from order_trans[OF exp_m1_ge_quarter this[unfolded exp_le_cancel_iff[where x="- 1", symmetric]]]
```
```  1599         have "Float 1 -2 \<le> exp (x / (- floor_fl x))" unfolding Float_num .
```
```  1600         hence "real (Float 1 -2) ^ ?num \<le> exp (x / (- floor_fl x)) ^ ?num"
```
```  1601           by (auto intro!: power_mono simp add: Float_num)
```
```  1602         also have "\<dots> = exp x" unfolding num_eq exp_real_of_nat_mult[symmetric] using `real (floor_fl x) \<noteq> 0` by auto
```
```  1603         finally show ?thesis
```
```  1604           unfolding lb_exp.simps if_not_P[OF `\<not> 0 < x`] if_P[OF `x < - 1`] float.cases Float_floor Let_def if_P[OF True] float_power .
```
```  1605       qed
```
```  1606     qed
```
```  1607     ultimately show ?thesis by auto
```
```  1608   qed
```
```  1609 qed
```
```  1610
```
```  1611 lemma exp_boundaries: "exp x \<in> { lb_exp prec x .. ub_exp prec x }"
```
```  1612 proof -
```
```  1613   show ?thesis
```
```  1614   proof (cases "0 < x")
```
```  1615     case False hence "x \<le> 0" unfolding less_float_def le_float_def by auto
```
```  1616     from exp_boundaries'[OF this] show ?thesis .
```
```  1617   next
```
```  1618     case True hence "-x \<le> 0" unfolding less_float_def le_float_def by auto
```
```  1619
```
```  1620     have "lb_exp prec x \<le> exp x"
```
```  1621     proof -
```
```  1622       from exp_boundaries'[OF `-x \<le> 0`]
```
```  1623       have ub_exp: "exp (- real x) \<le> ub_exp prec (-x)" unfolding atLeastAtMost_iff real_of_float_minus by auto
```
```  1624
```
```  1625       have "float_divl prec 1 (ub_exp prec (-x)) \<le> 1 / ub_exp prec (-x)" using float_divl[where x=1] by auto
```
```  1626       also have "\<dots> \<le> exp x"
```
```  1627         using ub_exp[unfolded inverse_le_iff_le[OF order_less_le_trans[OF exp_gt_zero ub_exp] exp_gt_zero, symmetric]]
```
```  1628         unfolding exp_minus nonzero_inverse_inverse_eq[OF exp_not_eq_zero] inverse_eq_divide by auto
```
```  1629       finally show ?thesis unfolding lb_exp.simps if_P[OF True] .
```
```  1630     qed
```
```  1631     moreover
```
```  1632     have "exp x \<le> ub_exp prec x"
```
```  1633     proof -
```
```  1634       have "\<not> 0 < -x" using `0 < x` unfolding less_float_def by auto
```
```  1635
```
```  1636       from exp_boundaries'[OF `-x \<le> 0`]
```
```  1637       have lb_exp: "lb_exp prec (-x) \<le> exp (- real x)" unfolding atLeastAtMost_iff real_of_float_minus by auto
```
```  1638
```
```  1639       have "exp x \<le> (1 :: float) / lb_exp prec (-x)"
```
```  1640         using lb_exp[unfolded inverse_le_iff_le[OF exp_gt_zero lb_exp_pos[OF `\<not> 0 < -x`, unfolded less_float_def real_of_float_0],
```
```  1641                                                 symmetric]]
```
```  1642         unfolding exp_minus nonzero_inverse_inverse_eq[OF exp_not_eq_zero] inverse_eq_divide real_of_float_1 by auto
```
```  1643       also have "\<dots> \<le> float_divr prec 1 (lb_exp prec (-x))" using float_divr .
```
```  1644       finally show ?thesis unfolding ub_exp.simps if_P[OF True] .
```
```  1645     qed
```
```  1646     ultimately show ?thesis by auto
```
```  1647   qed
```
```  1648 qed
```
```  1649
```
```  1650 lemma bnds_exp: "\<forall> (x::real) lx ux. (l, u) = (lb_exp prec lx, ub_exp prec ux) \<and> x \<in> {lx .. ux} \<longrightarrow> l \<le> exp x \<and> exp x \<le> u"
```
```  1651 proof (rule allI, rule allI, rule allI, rule impI)
```
```  1652   fix x::real and lx ux
```
```  1653   assume "(l, u) = (lb_exp prec lx, ub_exp prec ux) \<and> x \<in> {lx .. ux}"
```
```  1654   hence l: "lb_exp prec lx = l " and u: "ub_exp prec ux = u" and x: "x \<in> {lx .. ux}" by auto
```
```  1655
```
```  1656   { from exp_boundaries[of lx prec, unfolded l]
```
```  1657     have "l \<le> exp lx" by (auto simp del: lb_exp.simps)
```
```  1658     also have "\<dots> \<le> exp x" using x by auto
```
```  1659     finally have "l \<le> exp x" .
```
```  1660   } moreover
```
```  1661   { have "exp x \<le> exp ux" using x by auto
```
```  1662     also have "\<dots> \<le> u" using exp_boundaries[of ux prec, unfolded u] by (auto simp del: ub_exp.simps)
```
```  1663     finally have "exp x \<le> u" .
```
```  1664   } ultimately show "l \<le> exp x \<and> exp x \<le> u" ..
```
```  1665 qed
```
```  1666
```
```  1667 section "Logarithm"
```
```  1668
```
```  1669 subsection "Compute the logarithm series"
```
```  1670
```
```  1671 fun ub_ln_horner :: "nat \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> float \<Rightarrow> float"
```
```  1672 and lb_ln_horner :: "nat \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> float \<Rightarrow> float" where
```
```  1673 "ub_ln_horner prec 0 i x       = 0" |
```
```  1674 "ub_ln_horner prec (Suc n) i x = rapprox_rat prec 1 (int i) - x * lb_ln_horner prec n (Suc i) x" |
```
```  1675 "lb_ln_horner prec 0 i x       = 0" |
```
```  1676 "lb_ln_horner prec (Suc n) i x = lapprox_rat prec 1 (int i) - x * ub_ln_horner prec n (Suc i) x"
```
```  1677
```
```  1678 lemma ln_bounds:
```
```  1679   assumes "0 \<le> x" and "x < 1"
```
```  1680   shows "(\<Sum>i=0..<2*n. -1^i * (1 / real (i + 1)) * x ^ (Suc i)) \<le> ln (x + 1)" (is "?lb")
```
```  1681   and "ln (x + 1) \<le> (\<Sum>i=0..<2*n + 1. -1^i * (1 / real (i + 1)) * x ^ (Suc i))" (is "?ub")
```
```  1682 proof -
```
```  1683   let "?a n" = "(1/real (n +1)) * x ^ (Suc n)"
```
```  1684
```
```  1685   have ln_eq: "(\<Sum> i. -1^i * ?a i) = ln (x + 1)"
```
```  1686     using ln_series[of "x + 1"] `0 \<le> x` `x < 1` by auto
```
```  1687
```
```  1688   have "norm x < 1" using assms by auto
```
```  1689   have "?a ----> 0" unfolding Suc_eq_plus1[symmetric] inverse_eq_divide[symmetric]
```
```  1690     using tendsto_mult[OF LIMSEQ_inverse_real_of_nat LIMSEQ_Suc[OF LIMSEQ_power_zero[OF `norm x < 1`]]] by auto
```
```  1691   { fix n have "0 \<le> ?a n" by (rule mult_nonneg_nonneg, auto intro!: mult_nonneg_nonneg simp add: `0 \<le> x`) }
```
```  1692   { fix n have "?a (Suc n) \<le> ?a n" unfolding inverse_eq_divide[symmetric]
```
```  1693     proof (rule mult_mono)
```
```  1694       show "0 \<le> x ^ Suc (Suc n)" by (auto intro!: mult_nonneg_nonneg simp add: `0 \<le> x`)
```
```  1695       have "x ^ Suc (Suc n) \<le> x ^ Suc n * 1" unfolding power_Suc2 mult_assoc[symmetric]
```
```  1696         by (rule mult_left_mono, fact less_imp_le[OF `x < 1`], auto intro!: mult_nonneg_nonneg simp add: `0 \<le> x`)
```
```  1697       thus "x ^ Suc (Suc n) \<le> x ^ Suc n" by auto
```
```  1698     qed auto }
```
```  1699   from summable_Leibniz'(2,4)[OF `?a ----> 0` `\<And>n. 0 \<le> ?a n`, OF `\<And>n. ?a (Suc n) \<le> ?a n`, unfolded ln_eq]
```
```  1700   show "?lb" and "?ub" by auto
```
```  1701 qed
```
```  1702
```
```  1703 lemma ln_float_bounds:
```
```  1704   assumes "0 \<le> real x" and "real x < 1"
```
```  1705   shows "x * lb_ln_horner prec (get_even n) 1 x \<le> ln (x + 1)" (is "?lb \<le> ?ln")
```
```  1706   and "ln (x + 1) \<le> x * ub_ln_horner prec (get_odd n) 1 x" (is "?ln \<le> ?ub")
```
```  1707 proof -
```
```  1708   obtain ev where ev: "get_even n = 2 * ev" using get_even_double ..
```
```  1709   obtain od where od: "get_odd n = 2 * od + 1" using get_odd_double ..
```
```  1710
```
```  1711   let "?s n" = "-1^n * (1 / real (1 + n)) * (real x)^(Suc n)"
```
```  1712
```
```  1713   have "?lb \<le> setsum ?s {0 ..< 2 * ev}" unfolding power_Suc2 mult_assoc[symmetric] real_of_float_mult setsum_left_distrib[symmetric] unfolding mult_commute[of "real x"] ev
```
```  1714     using horner_bounds(1)[where G="\<lambda> i k. Suc k" and F="\<lambda>x. x" and f="\<lambda>x. x" and lb="\<lambda>n i k x. lb_ln_horner prec n k x" and ub="\<lambda>n i k x. ub_ln_horner prec n k x" and j'=1 and n="2*ev",
```
```  1715       OF `0 \<le> real x` refl lb_ln_horner.simps ub_ln_horner.simps] `0 \<le> real x`
```
```  1716     by (rule mult_right_mono)
```
```  1717   also have "\<dots> \<le> ?ln" using ln_bounds(1)[OF `0 \<le> real x` `real x < 1`] by auto
```
```  1718   finally show "?lb \<le> ?ln" .
```
```  1719
```
```  1720   have "?ln \<le> setsum ?s {0 ..< 2 * od + 1}" using ln_bounds(2)[OF `0 \<le> real x` `real x < 1`] by auto
```
```  1721   also have "\<dots> \<le> ?ub" unfolding power_Suc2 mult_assoc[symmetric] real_of_float_mult setsum_left_distrib[symmetric] unfolding mult_commute[of "real x"] od
```
```  1722     using horner_bounds(2)[where G="\<lambda> i k. Suc k" and F="\<lambda>x. x" and f="\<lambda>x. x" and lb="\<lambda>n i k x. lb_ln_horner prec n k x" and ub="\<lambda>n i k x. ub_ln_horner prec n k x" and j'=1 and n="2*od+1",
```
```  1723       OF `0 \<le> real x` refl lb_ln_horner.simps ub_ln_horner.simps] `0 \<le> real x`
```
```  1724     by (rule mult_right_mono)
```
```  1725   finally show "?ln \<le> ?ub" .
```
```  1726 qed
```
```  1727
```
```  1728 lemma ln_add: assumes "0 < x" and "0 < y" shows "ln (x + y) = ln x + ln (1 + y / x)"
```
```  1729 proof -
```
```  1730   have "x \<noteq> 0" using assms by auto
```
```  1731   have "x + y = x * (1 + y / x)" unfolding right_distrib times_divide_eq_right nonzero_mult_divide_cancel_left[OF `x \<noteq> 0`] by auto
```
```  1732   moreover
```
```  1733   have "0 < y / x" using assms divide_pos_pos by auto
```
```  1734   hence "0 < 1 + y / x" by auto
```
```  1735   ultimately show ?thesis using ln_mult assms by auto
```
```  1736 qed
```
```  1737
```
```  1738 subsection "Compute the logarithm of 2"
```
```  1739
```
```  1740 definition ub_ln2 where "ub_ln2 prec = (let third = rapprox_rat (max prec 1) 1 3
```
```  1741                                         in (Float 1 -1 * ub_ln_horner prec (get_odd prec) 1 (Float 1 -1)) +
```
```  1742                                            (third * ub_ln_horner prec (get_odd prec) 1 third))"
```
```  1743 definition lb_ln2 where "lb_ln2 prec = (let third = lapprox_rat prec 1 3
```
```  1744                                         in (Float 1 -1 * lb_ln_horner prec (get_even prec) 1 (Float 1 -1)) +
```
```  1745                                            (third * lb_ln_horner prec (get_even prec) 1 third))"
```
```  1746
```
```  1747 lemma ub_ln2: "ln 2 \<le> ub_ln2 prec" (is "?ub_ln2")
```
```  1748   and lb_ln2: "lb_ln2 prec \<le> ln 2" (is "?lb_ln2")
```
```  1749 proof -
```
```  1750   let ?uthird = "rapprox_rat (max prec 1) 1 3"
```
```  1751   let ?lthird = "lapprox_rat prec 1 3"
```
```  1752
```
```  1753   have ln2_sum: "ln 2 = ln (1/2 + 1) + ln (1 / 3 + 1)"
```
```  1754     using ln_add[of "3 / 2" "1 / 2"] by auto
```
```  1755   have lb3: "?lthird \<le> 1 / 3" using lapprox_rat[of prec 1 3] by auto
```
```  1756   hence lb3_ub: "real ?lthird < 1" by auto
```
```  1757   have lb3_lb: "0 \<le> real ?lthird" using lapprox_rat_bottom[of 1 3] by auto
```
```  1758   have ub3: "1 / 3 \<le> ?uthird" using rapprox_rat[of 1 3] by auto
```
```  1759   hence ub3_lb: "0 \<le> real ?uthird" by auto
```
```  1760
```
```  1761   have lb2: "0 \<le> real (Float 1 -1)" and ub2: "real (Float 1 -1) < 1" unfolding Float_num by auto
```
```  1762
```
```  1763   have "0 \<le> (1::int)" and "0 < (3::int)" by auto
```
```  1764   have ub3_ub: "real ?uthird < 1" unfolding rapprox_rat.simps(2)[OF `0 \<le> 1` `0 < 3`]
```
```  1765     by (rule rapprox_posrat_less1, auto)
```
```  1766
```
```  1767   have third_gt0: "(0 :: real) < 1 / 3 + 1" by auto
```
```  1768   have uthird_gt0: "0 < real ?uthird + 1" using ub3_lb by auto
```
```  1769   have lthird_gt0: "0 < real ?lthird + 1" using lb3_lb by auto
```
```  1770
```
```  1771   show ?ub_ln2 unfolding ub_ln2_def Let_def real_of_float_add ln2_sum Float_num(4)[symmetric]
```
```  1772   proof (rule add_mono, fact ln_float_bounds(2)[OF lb2 ub2])
```
```  1773     have "ln (1 / 3 + 1) \<le> ln (real ?uthird + 1)" unfolding ln_le_cancel_iff[OF third_gt0 uthird_gt0] using ub3 by auto
```
```  1774     also have "\<dots> \<le> ?uthird * ub_ln_horner prec (get_odd prec) 1 ?uthird"
```
```  1775       using ln_float_bounds(2)[OF ub3_lb ub3_ub] .
```
```  1776     finally show "ln (1 / 3 + 1) \<le> ?uthird * ub_ln_horner prec (get_odd prec) 1 ?uthird" .
```
```  1777   qed
```
```  1778   show ?lb_ln2 unfolding lb_ln2_def Let_def real_of_float_add ln2_sum Float_num(4)[symmetric]
```
```  1779   proof (rule add_mono, fact ln_float_bounds(1)[OF lb2 ub2])
```
```  1780     have "?lthird * lb_ln_horner prec (get_even prec) 1 ?lthird \<le> ln (real ?lthird + 1)"
```
```  1781       using ln_float_bounds(1)[OF lb3_lb lb3_ub] .
```
```  1782     also have "\<dots> \<le> ln (1 / 3 + 1)" unfolding ln_le_cancel_iff[OF lthird_gt0 third_gt0] using lb3 by auto
```
```  1783     finally show "?lthird * lb_ln_horner prec (get_even prec) 1 ?lthird \<le> ln (1 / 3 + 1)" .
```
```  1784   qed
```
```  1785 qed
```
```  1786
```
```  1787 subsection "Compute the logarithm in the entire domain"
```
```  1788
```
```  1789 function ub_ln :: "nat \<Rightarrow> float \<Rightarrow> float option" and lb_ln :: "nat \<Rightarrow> float \<Rightarrow> float option" where
```
```  1790 "ub_ln prec x = (if x \<le> 0          then None
```
```  1791             else if x < 1          then Some (- the (lb_ln prec (float_divl (max prec 1) 1 x)))
```
```  1792             else let horner = \<lambda>x. x * ub_ln_horner prec (get_odd prec) 1 x in
```
```  1793                  if x \<le> Float 3 -1 then Some (horner (x - 1))
```
```  1794             else if x < Float 1 1  then Some (horner (Float 1 -1) + horner (x * rapprox_rat prec 2 3 - 1))
```
```  1795                                    else let l = bitlen (mantissa x) - 1 in
```
```  1796                                         Some (ub_ln2 prec * (Float (scale x + l) 0) + horner (Float (mantissa x) (- l) - 1)))" |
```
```  1797 "lb_ln prec x = (if x \<le> 0          then None
```
```  1798             else if x < 1          then Some (- the (ub_ln prec (float_divr prec 1 x)))
```
```  1799             else let horner = \<lambda>x. x * lb_ln_horner prec (get_even prec) 1 x in
```
```  1800                  if x \<le> Float 3 -1 then Some (horner (x - 1))
```
```  1801             else if x < Float 1 1  then Some (horner (Float 1 -1) +
```
```  1802                                               horner (max (x * lapprox_rat prec 2 3 - 1) 0))
```
```  1803                                    else let l = bitlen (mantissa x) - 1 in
```
```  1804                                         Some (lb_ln2 prec * (Float (scale x + l) 0) + horner (Float (mantissa x) (- l) - 1)))"
```
```  1805 by pat_completeness auto
```
```  1806
```
```  1807 termination proof (relation "measure (\<lambda> v. let (prec, x) = sum_case id id v in (if x < 1 then 1 else 0))", auto)
```
```  1808   fix prec x assume "\<not> x \<le> 0" and "x < 1" and "float_divl (max prec (Suc 0)) 1 x < 1"
```
```  1809   hence "0 < x" and "0 < max prec (Suc 0)" unfolding less_float_def le_float_def by auto
```
```  1810   from float_divl_pos_less1_bound[OF `0 < x` `x < 1` `0 < max prec (Suc 0)`]
```
```  1811   show False using `float_divl (max prec (Suc 0)) 1 x < 1` unfolding less_float_def le_float_def by auto
```
```  1812 next
```
```  1813   fix prec x assume "\<not> x \<le> 0" and "x < 1" and "float_divr prec 1 x < 1"
```
```  1814   hence "0 < x" unfolding less_float_def le_float_def by auto
```
```  1815   from float_divr_pos_less1_lower_bound[OF `0 < x` `x < 1`, of prec]
```
```  1816   show False using `float_divr prec 1 x < 1` unfolding less_float_def le_float_def by auto
```
```  1817 qed
```
```  1818
```
```  1819 lemma ln_shifted_float: assumes "0 < m" shows "ln (Float m e) = ln 2 * (e + (bitlen m - 1)) + ln (Float m (- (bitlen m - 1)))"
```
```  1820 proof -
```
```  1821   let ?B = "2^nat (bitlen m - 1)"
```
```  1822   have "0 < real m" and "\<And>X. (0 :: real) < 2^X" and "0 < (2 :: real)" and "m \<noteq> 0" using assms by auto
```
```  1823   hence "0 \<le> bitlen m - 1" using bitlen_ge1[OF `m \<noteq> 0`] by auto
```
```  1824   show ?thesis
```
```  1825   proof (cases "0 \<le> e")
```
```  1826     case True
```
```  1827     show ?thesis unfolding normalized_float[OF `m \<noteq> 0`]
```
```  1828       unfolding ln_div[OF `0 < real m` `0 < ?B`] real_of_int_add ln_realpow[OF `0 < 2`]
```
```  1829       unfolding real_of_float_ge0_exp[OF True] ln_mult[OF `0 < real m` `0 < 2^nat e`]
```
```  1830       ln_realpow[OF `0 < 2`] algebra_simps using `0 \<le> bitlen m - 1` True by auto
```
```  1831   next
```
```  1832     case False hence "0 < -e" by auto
```
```  1833     hence pow_gt0: "(0::real) < 2^nat (-e)" by auto
```
```  1834     hence inv_gt0: "(0::real) < inverse (2^nat (-e))" by auto
```
```  1835     show ?thesis unfolding normalized_float[OF `m \<noteq> 0`]
```
```  1836       unfolding ln_div[OF `0 < real m` `0 < ?B`] real_of_int_add ln_realpow[OF `0 < 2`]
```
```  1837       unfolding real_of_float_nge0_exp[OF False] ln_mult[OF `0 < real m` inv_gt0] ln_inverse[OF pow_gt0]
```
```  1838       ln_realpow[OF `0 < 2`] algebra_simps using `0 \<le> bitlen m - 1` False by auto
```
```  1839   qed
```
```  1840 qed
```
```  1841
```
```  1842 lemma ub_ln_lb_ln_bounds': assumes "1 \<le> x"
```
```  1843   shows "the (lb_ln prec x) \<le> ln x \<and> ln x \<le> the (ub_ln prec x)"
```
```  1844   (is "?lb \<le> ?ln \<and> ?ln \<le> ?ub")
```
```  1845 proof (cases "x < Float 1 1")
```
```  1846   case True
```
```  1847   hence "real (x - 1) < 1" and "real x < 2" unfolding less_float_def Float_num by auto
```
```  1848   have "\<not> x \<le> 0" and "\<not> x < 1" using `1 \<le> x` unfolding less_float_def le_float_def by auto
```
```  1849   hence "0 \<le> real (x - 1)" using `1 \<le> x` unfolding less_float_def Float_num by auto
```
```  1850
```
```  1851   have [simp]: "(Float 3 -1) = 3 / 2" by (simp add: real_of_float_def pow2_def)
```
```  1852
```
```  1853   show ?thesis
```
```  1854   proof (cases "x \<le> Float 3 -1")
```
```  1855     case True
```
```  1856     show ?thesis unfolding lb_ln.simps unfolding ub_ln.simps Let_def
```
```  1857       using ln_float_bounds[OF `0 \<le> real (x - 1)` `real (x - 1) < 1`, of prec] `\<not> x \<le> 0` `\<not> x < 1` True
```
```  1858       by auto
```
```  1859   next
```
```  1860     case False hence *: "3 / 2 < x" by (auto simp add: le_float_def)
```
```  1861
```
```  1862     with ln_add[of "3 / 2" "x - 3 / 2"]
```
```  1863     have add: "ln x = ln (3 / 2) + ln (real x * 2 / 3)"
```
```  1864       by (auto simp add: algebra_simps diff_divide_distrib)
```
```  1865
```
```  1866     let "?ub_horner x" = "x * ub_ln_horner prec (get_odd prec) 1 x"
```
```  1867     let "?lb_horner x" = "x * lb_ln_horner prec (get_even prec) 1 x"
```
```  1868
```
```  1869     { have up: "real (rapprox_rat prec 2 3) \<le> 1"
```
```  1870         by (rule rapprox_rat_le1) simp_all
```
```  1871       have low: "2 / 3 \<le> rapprox_rat prec 2 3"
```
```  1872         by (rule order_trans[OF _ rapprox_rat]) simp
```
```  1873       from mult_less_le_imp_less[OF * low] *
```
```  1874       have pos: "0 < real (x * rapprox_rat prec 2 3 - 1)" by auto
```
```  1875
```
```  1876       have "ln (real x * 2/3)
```
```  1877         \<le> ln (real (x * rapprox_rat prec 2 3 - 1) + 1)"
```
```  1878       proof (rule ln_le_cancel_iff[symmetric, THEN iffD1])
```
```  1879         show "real x * 2 / 3 \<le> real (x * rapprox_rat prec 2 3 - 1) + 1"
```
```  1880           using * low by auto
```
```  1881         show "0 < real x * 2 / 3" using * by simp
```
```  1882         show "0 < real (x * rapprox_rat prec 2 3 - 1) + 1" using pos by auto
```
```  1883       qed
```
```  1884       also have "\<dots> \<le> ?ub_horner (x * rapprox_rat prec 2 3 - 1)"
```
```  1885       proof (rule ln_float_bounds(2))
```
```  1886         from mult_less_le_imp_less[OF `real x < 2` up] low *
```
```  1887         show "real (x * rapprox_rat prec 2 3 - 1) < 1" by auto
```
```  1888         show "0 \<le> real (x * rapprox_rat prec 2 3 - 1)" using pos by auto
```
```  1889       qed
```
```  1890       finally have "ln x
```
```  1891         \<le> ?ub_horner (Float 1 -1)
```
```  1892           + ?ub_horner (x * rapprox_rat prec 2 3 - 1)"
```
```  1893         using ln_float_bounds(2)[of "Float 1 -1" prec prec] add by auto }
```
```  1894     moreover
```
```  1895     { let ?max = "max (x * lapprox_rat prec 2 3 - 1) 0"
```
```  1896
```
```  1897       have up: "lapprox_rat prec 2 3 \<le> 2/3"
```
```  1898         by (rule order_trans[OF lapprox_rat], simp)
```
```  1899
```
```  1900       have low: "0 \<le> real (lapprox_rat prec 2 3)"
```
```  1901         using lapprox_rat_bottom[of 2 3 prec] by simp
```
```  1902
```
```  1903       have "?lb_horner ?max
```
```  1904         \<le> ln (real ?max + 1)"
```
```  1905       proof (rule ln_float_bounds(1))
```
```  1906         from mult_less_le_imp_less[OF `real x < 2` up] * low
```
```  1907         show "real ?max < 1" by (cases "real (lapprox_rat prec 2 3) = 0",
```
```  1908           auto simp add: real_of_float_max)
```
```  1909         show "0 \<le> real ?max" by (auto simp add: real_of_float_max)
```
```  1910       qed
```
```  1911       also have "\<dots> \<le> ln (real x * 2/3)"
```
```  1912       proof (rule ln_le_cancel_iff[symmetric, THEN iffD1])
```
```  1913         show "0 < real ?max + 1" by (auto simp add: real_of_float_max)
```
```  1914         show "0 < real x * 2/3" using * by auto
```
```  1915         show "real ?max + 1 \<le> real x * 2/3" using * up
```
```  1916           by (cases "0 < real x * real (lapprox_posrat prec 2 3) - 1",
```
```  1917               auto simp add: real_of_float_max min_max.sup_absorb1)
```
```  1918       qed
```
```  1919       finally have "?lb_horner (Float 1 -1) + ?lb_horner ?max
```
```  1920         \<le> ln x"
```
```  1921         using ln_float_bounds(1)[of "Float 1 -1" prec prec] add by auto }
```
```  1922     ultimately
```
```  1923     show ?thesis unfolding lb_ln.simps unfolding ub_ln.simps Let_def
```
```  1924       using `\<not> x \<le> 0` `\<not> x < 1` True False by auto
```
```  1925   qed
```
```  1926 next
```
```  1927   case False
```
```  1928   hence "\<not> x \<le> 0" and "\<not> x < 1" "0 < x" "\<not> x \<le> Float 3 -1"
```
```  1929     using `1 \<le> x` unfolding less_float_def le_float_def real_of_float_simp pow2_def
```
```  1930     by auto
```
```  1931   show ?thesis
```
```  1932   proof (cases x)
```
```  1933     case (Float m e)
```
```  1934     let ?s = "Float (e + (bitlen m - 1)) 0"
```
```  1935     let ?x = "Float m (- (bitlen m - 1))"
```
```  1936
```
```  1937     have "0 < m" and "m \<noteq> 0" using float_pos_m_pos `0 < x` Float by auto
```
```  1938
```
```  1939     {
```
```  1940       have "lb_ln2 prec * ?s \<le> ln 2 * (e + (bitlen m - 1))" (is "?lb2 \<le> _")
```
```  1941         unfolding real_of_float_mult real_of_float_ge0_exp[OF order_refl] nat_0 power_0 mult_1_right
```
```  1942         using lb_ln2[of prec]
```
```  1943       proof (rule mult_right_mono)
```
```  1944         have "1 \<le> Float m e" using `1 \<le> x` Float unfolding le_float_def by auto
```
```  1945         from float_gt1_scale[OF this]
```
```  1946         show "0 \<le> real (e + (bitlen m - 1))" by auto
```
```  1947       qed
```
```  1948       moreover
```
```  1949       from bitlen_div[OF `0 < m`, unfolded normalized_float[OF `m \<noteq> 0`, symmetric]]
```
```  1950       have "0 \<le> real (?x - 1)" and "real (?x - 1) < 1" by auto
```
```  1951       from ln_float_bounds(1)[OF this]
```
```  1952       have "(?x - 1) * lb_ln_horner prec (get_even prec) 1 (?x - 1) \<le> ln ?x" (is "?lb_horner \<le> _") by auto
```
```  1953       ultimately have "?lb2 + ?lb_horner \<le> ln x"
```
```  1954         unfolding Float ln_shifted_float[OF `0 < m`, of e] by auto
```
```  1955     }
```
```  1956     moreover
```
```  1957     {
```
```  1958       from bitlen_div[OF `0 < m`, unfolded normalized_float[OF `m \<noteq> 0`, symmetric]]
```
```  1959       have "0 \<le> real (?x - 1)" and "real (?x - 1) < 1" by auto
```
```  1960       from ln_float_bounds(2)[OF this]
```
```  1961       have "ln ?x \<le> (?x - 1) * ub_ln_horner prec (get_odd prec) 1 (?x - 1)" (is "_ \<le> ?ub_horner") by auto
```
```  1962       moreover
```
```  1963       have "ln 2 * (e + (bitlen m - 1)) \<le> ub_ln2 prec * ?s" (is "_ \<le> ?ub2")
```
```  1964         unfolding real_of_float_mult real_of_float_ge0_exp[OF order_refl] nat_0 power_0 mult_1_right
```
```  1965         using ub_ln2[of prec]
```
```  1966       proof (rule mult_right_mono)
```
```  1967         have "1 \<le> Float m e" using `1 \<le> x` Float unfolding le_float_def by auto
```
```  1968         from float_gt1_scale[OF this]
```
```  1969         show "0 \<le> real (e + (bitlen m - 1))" by auto
```
```  1970       qed
```
```  1971       ultimately have "ln x \<le> ?ub2 + ?ub_horner"
```
```  1972         unfolding Float ln_shifted_float[OF `0 < m`, of e] by auto
```
```  1973     }
```
```  1974     ultimately show ?thesis unfolding lb_ln.simps unfolding ub_ln.simps
```
```  1975       unfolding if_not_P[OF `\<not> x \<le> 0`] if_not_P[OF `\<not> x < 1`] if_not_P[OF False] if_not_P[OF `\<not> x \<le> Float 3 -1`] Let_def
```
```  1976       unfolding scale.simps[of m e, unfolded Float[symmetric]] mantissa.simps[of m e, unfolded Float[symmetric]] real_of_float_add
```
```  1977       by auto
```
```  1978   qed
```
```  1979 qed
```
```  1980
```
```  1981 lemma ub_ln_lb_ln_bounds: assumes "0 < x"
```
```  1982   shows "the (lb_ln prec x) \<le> ln x \<and> ln x \<le> the (ub_ln prec x)"
```
```  1983   (is "?lb \<le> ?ln \<and> ?ln \<le> ?ub")
```
```  1984 proof (cases "x < 1")
```
```  1985   case False hence "1 \<le> x" unfolding less_float_def le_float_def by auto
```
```  1986   show ?thesis using ub_ln_lb_ln_bounds'[OF `1 \<le> x`] .
```
```  1987 next
```
```  1988   case True have "\<not> x \<le> 0" using `0 < x` unfolding less_float_def le_float_def by auto
```
```  1989
```
```  1990   have "0 < real x" and "real x \<noteq> 0" using `0 < x` unfolding less_float_def by auto
```
```  1991   hence A: "0 < 1 / real x" by auto
```
```  1992
```
```  1993   {
```
```  1994     let ?divl = "float_divl (max prec 1) 1 x"
```
```  1995     have A': "1 \<le> ?divl" using float_divl_pos_less1_bound[OF `0 < x` `x < 1`] unfolding le_float_def less_float_def by auto
```
```  1996     hence B: "0 < real ?divl" unfolding le_float_def by auto
```
```  1997
```
```  1998     have "ln ?divl \<le> ln (1 / x)" unfolding ln_le_cancel_iff[OF B A] using float_divl[of _ 1 x] by auto
```
```  1999     hence "ln x \<le> - ln ?divl" unfolding nonzero_inverse_eq_divide[OF `real x \<noteq> 0`, symmetric] ln_inverse[OF `0 < real x`] by auto
```
```  2000     from this ub_ln_lb_ln_bounds'[OF A', THEN conjunct1, THEN le_imp_neg_le]
```
```  2001     have "?ln \<le> - the (lb_ln prec ?divl)" unfolding real_of_float_minus by (rule order_trans)
```
```  2002   } moreover
```
```  2003   {
```
```  2004     let ?divr = "float_divr prec 1 x"
```
```  2005     have A': "1 \<le> ?divr" using float_divr_pos_less1_lower_bound[OF `0 < x` `x < 1`] unfolding le_float_def less_float_def by auto
```
```  2006     hence B: "0 < real ?divr" unfolding le_float_def by auto
```
```  2007
```
```  2008     have "ln (1 / x) \<le> ln ?divr" unfolding ln_le_cancel_iff[OF A B] using float_divr[of 1 x] by auto
```
```  2009     hence "- ln ?divr \<le> ln x" unfolding nonzero_inverse_eq_divide[OF `real x \<noteq> 0`, symmetric] ln_inverse[OF `0 < real x`] by auto
```
```  2010     from ub_ln_lb_ln_bounds'[OF A', THEN conjunct2, THEN le_imp_neg_le] this
```
```  2011     have "- the (ub_ln prec ?divr) \<le> ?ln" unfolding real_of_float_minus by (rule order_trans)
```
```  2012   }
```
```  2013   ultimately show ?thesis unfolding lb_ln.simps[where x=x]  ub_ln.simps[where x=x]
```
```  2014     unfolding if_not_P[OF `\<not> x \<le> 0`] if_P[OF True] by auto
```
```  2015 qed
```
```  2016
```
```  2017 lemma lb_ln: assumes "Some y = lb_ln prec x"
```
```  2018   shows "y \<le> ln x" and "0 < real x"
```
```  2019 proof -
```
```  2020   have "0 < x"
```
```  2021   proof (rule ccontr)
```
```  2022     assume "\<not> 0 < x" hence "x \<le> 0" unfolding le_float_def less_float_def by auto
```
```  2023     thus False using assms by auto
```
```  2024   qed
```
```  2025   thus "0 < real x" unfolding less_float_def by auto
```
```  2026   have "the (lb_ln prec x) \<le> ln x" using ub_ln_lb_ln_bounds[OF `0 < x`] ..
```
```  2027   thus "y \<le> ln x" unfolding assms[symmetric] by auto
```
```  2028 qed
```
```  2029
```
```  2030 lemma ub_ln: assumes "Some y = ub_ln prec x"
```
```  2031   shows "ln x \<le> y" and "0 < real x"
```
```  2032 proof -
```
```  2033   have "0 < x"
```
```  2034   proof (rule ccontr)
```
```  2035     assume "\<not> 0 < x" hence "x \<le> 0" unfolding le_float_def less_float_def by auto
```
```  2036     thus False using assms by auto
```
```  2037   qed
```
```  2038   thus "0 < real x" unfolding less_float_def by auto
```
```  2039   have "ln x \<le> the (ub_ln prec x)" using ub_ln_lb_ln_bounds[OF `0 < x`] ..
```
```  2040   thus "ln x \<le> y" unfolding assms[symmetric] by auto
```
```  2041 qed
```
```  2042
```
```  2043 lemma bnds_ln: "\<forall> (x::real) lx ux. (Some l, Some u) = (lb_ln prec lx, ub_ln prec ux) \<and> x \<in> {lx .. ux} \<longrightarrow> l \<le> ln x \<and> ln x \<le> u"
```
```  2044 proof (rule allI, rule allI, rule allI, rule impI)
```
```  2045   fix x::real and lx ux
```
```  2046   assume "(Some l, Some u) = (lb_ln prec lx, ub_ln prec ux) \<and> x \<in> {lx .. ux}"
```
```  2047   hence l: "Some l = lb_ln prec lx " and u: "Some u = ub_ln prec ux" and x: "x \<in> {lx .. ux}" by auto
```
```  2048
```
```  2049   have "ln ux \<le> u" and "0 < real ux" using ub_ln u by auto
```
```  2050   have "l \<le> ln lx" and "0 < real lx" and "0 < x" using lb_ln[OF l] x by auto
```
```  2051
```
```  2052   from ln_le_cancel_iff[OF `0 < real lx` `0 < x`] `l \<le> ln lx`
```
```  2053   have "l \<le> ln x" using x unfolding atLeastAtMost_iff by auto
```
```  2054   moreover
```
```  2055   from ln_le_cancel_iff[OF `0 < x` `0 < real ux`] `ln ux \<le> real u`
```
```  2056   have "ln x \<le> u" using x unfolding atLeastAtMost_iff by auto
```
```  2057   ultimately show "l \<le> ln x \<and> ln x \<le> u" ..
```
```  2058 qed
```
```  2059
```
```  2060 section "Implement floatarith"
```
```  2061
```
```  2062 subsection "Define syntax and semantics"
```
```  2063
```
```  2064 datatype floatarith
```
```  2065   = Add floatarith floatarith
```
```  2066   | Minus floatarith
```
```  2067   | Mult floatarith floatarith
```
```  2068   | Inverse floatarith
```
```  2069   | Cos floatarith
```
```  2070   | Arctan floatarith
```
```  2071   | Abs floatarith
```
```  2072   | Max floatarith floatarith
```
```  2073   | Min floatarith floatarith
```
```  2074   | Pi
```
```  2075   | Sqrt floatarith
```
```  2076   | Exp floatarith
```
```  2077   | Ln floatarith
```
```  2078   | Power floatarith nat
```
```  2079   | Var nat
```
```  2080   | Num float
```
```  2081
```
```  2082 fun interpret_floatarith :: "floatarith \<Rightarrow> real list \<Rightarrow> real" where
```
```  2083 "interpret_floatarith (Add a b) vs   = (interpret_floatarith a vs) + (interpret_floatarith b vs)" |
```
```  2084 "interpret_floatarith (Minus a) vs    = - (interpret_floatarith a vs)" |
```
```  2085 "interpret_floatarith (Mult a b) vs   = (interpret_floatarith a vs) * (interpret_floatarith b vs)" |
```
```  2086 "interpret_floatarith (Inverse a) vs  = inverse (interpret_floatarith a vs)" |
```
```  2087 "interpret_floatarith (Cos a) vs      = cos (interpret_floatarith a vs)" |
```
```  2088 "interpret_floatarith (Arctan a) vs   = arctan (interpret_floatarith a vs)" |
```
```  2089 "interpret_floatarith (Min a b) vs    = min (interpret_floatarith a vs) (interpret_floatarith b vs)" |
```
```  2090 "interpret_floatarith (Max a b) vs    = max (interpret_floatarith a vs) (interpret_floatarith b vs)" |
```
```  2091 "interpret_floatarith (Abs a) vs      = abs (interpret_floatarith a vs)" |
```
```  2092 "interpret_floatarith Pi vs           = pi" |
```
```  2093 "interpret_floatarith (Sqrt a) vs     = sqrt (interpret_floatarith a vs)" |
```
```  2094 "interpret_floatarith (Exp a) vs      = exp (interpret_floatarith a vs)" |
```
```  2095 "interpret_floatarith (Ln a) vs       = ln (interpret_floatarith a vs)" |
```
```  2096 "interpret_floatarith (Power a n) vs  = (interpret_floatarith a vs)^n" |
```
```  2097 "interpret_floatarith (Num f) vs      = f" |
```
```  2098 "interpret_floatarith (Var n) vs     = vs ! n"
```
```  2099
```
```  2100 lemma interpret_floatarith_divide: "interpret_floatarith (Mult a (Inverse b)) vs = (interpret_floatarith a vs) / (interpret_floatarith b vs)"
```
```  2101   unfolding divide_inverse interpret_floatarith.simps ..
```
```  2102
```
```  2103 lemma interpret_floatarith_diff: "interpret_floatarith (Add a (Minus b)) vs = (interpret_floatarith a vs) - (interpret_floatarith b vs)"
```
```  2104   unfolding diff_minus interpret_floatarith.simps ..
```
```  2105
```
```  2106 lemma interpret_floatarith_sin: "interpret_floatarith (Cos (Add (Mult Pi (Num (Float 1 -1))) (Minus a))) vs =
```
```  2107   sin (interpret_floatarith a vs)"
```
```  2108   unfolding sin_cos_eq interpret_floatarith.simps
```
```  2109             interpret_floatarith_divide interpret_floatarith_diff diff_minus
```
```  2110   by auto
```
```  2111
```
```  2112 lemma interpret_floatarith_tan:
```
```  2113   "interpret_floatarith (Mult (Cos (Add (Mult Pi (Num (Float 1 -1))) (Minus a))) (Inverse (Cos a))) vs =
```
```  2114    tan (interpret_floatarith a vs)"
```
```  2115   unfolding interpret_floatarith.simps(3,4) interpret_floatarith_sin tan_def divide_inverse
```
```  2116   by auto
```
```  2117
```
```  2118 lemma interpret_floatarith_powr: "interpret_floatarith (Exp (Mult b (Ln a))) vs = (interpret_floatarith a vs) powr (interpret_floatarith b vs)"
```
```  2119   unfolding powr_def interpret_floatarith.simps ..
```
```  2120
```
```  2121 lemma interpret_floatarith_log: "interpret_floatarith ((Mult (Ln x) (Inverse (Ln b)))) vs = log (interpret_floatarith b vs) (interpret_floatarith x vs)"
```
```  2122   unfolding log_def interpret_floatarith.simps divide_inverse ..
```
```  2123
```
```  2124 lemma interpret_floatarith_num:
```
```  2125   shows "interpret_floatarith (Num (Float 0 0)) vs = 0"
```
```  2126   and "interpret_floatarith (Num (Float 1 0)) vs = 1"
```
```  2127   and "interpret_floatarith (Num (Float (number_of a) 0)) vs = number_of a" by auto
```
```  2128
```
```  2129 subsection "Implement approximation function"
```
```  2130
```
```  2131 fun lift_bin' :: "(float * float) option \<Rightarrow> (float * float) option \<Rightarrow> (float \<Rightarrow> float \<Rightarrow> float \<Rightarrow> float \<Rightarrow> (float * float)) \<Rightarrow> (float * float) option" where
```
```  2132 "lift_bin' (Some (l1, u1)) (Some (l2, u2)) f = Some (f l1 u1 l2 u2)" |
```
```  2133 "lift_bin' a b f = None"
```
```  2134
```
```  2135 fun lift_un :: "(float * float) option \<Rightarrow> (float \<Rightarrow> float \<Rightarrow> ((float option) * (float option))) \<Rightarrow> (float * float) option" where
```
```  2136 "lift_un (Some (l1, u1)) f = (case (f l1 u1) of (Some l, Some u) \<Rightarrow> Some (l, u)
```
```  2137                                              | t \<Rightarrow> None)" |
```
```  2138 "lift_un b f = None"
```
```  2139
```
```  2140 fun lift_un' :: "(float * float) option \<Rightarrow> (float \<Rightarrow> float \<Rightarrow> (float * float)) \<Rightarrow> (float * float) option" where
```
```  2141 "lift_un' (Some (l1, u1)) f = Some (f l1 u1)" |
```
```  2142 "lift_un' b f = None"
```
```  2143
```
```  2144 definition
```
```  2145 "bounded_by xs vs \<longleftrightarrow>
```
```  2146   (\<forall> i < length vs. case vs ! i of None \<Rightarrow> True
```
```  2147          | Some (l, u) \<Rightarrow> xs ! i \<in> { real l .. real u })"
```
```  2148
```
```  2149 lemma bounded_byE:
```
```  2150   assumes "bounded_by xs vs"
```
```  2151   shows "\<And> i. i < length vs \<Longrightarrow> case vs ! i of None \<Rightarrow> True
```
```  2152          | Some (l, u) \<Rightarrow> xs ! i \<in> { real l .. real u }"
```
```  2153   using assms bounded_by_def by blast
```
```  2154
```
```  2155 lemma bounded_by_update:
```
```  2156   assumes "bounded_by xs vs"
```
```  2157   and bnd: "xs ! i \<in> { real l .. real u }"
```
```  2158   shows "bounded_by xs (vs[i := Some (l,u)])"
```
```  2159 proof -
```
```  2160 { fix j
```
```  2161   let ?vs = "vs[i := Some (l,u)]"
```
```  2162   assume "j < length ?vs" hence [simp]: "j < length vs" by simp
```
```  2163   have "case ?vs ! j of None \<Rightarrow> True | Some (l, u) \<Rightarrow> xs ! j \<in> { real l .. real u }"
```
```  2164   proof (cases "?vs ! j")
```
```  2165     case (Some b)
```
```  2166     thus ?thesis
```
```  2167     proof (cases "i = j")
```
```  2168       case True
```
```  2169       thus ?thesis using `?vs ! j = Some b` and bnd by auto
```
```  2170     next
```
```  2171       case False
```
```  2172       thus ?thesis using `bounded_by xs vs` unfolding bounded_by_def by auto
```
```  2173     qed
```
```  2174   qed auto }
```
```  2175   thus ?thesis unfolding bounded_by_def by auto
```
```  2176 qed
```
```  2177
```
```  2178 lemma bounded_by_None:
```
```  2179   shows "bounded_by xs (replicate (length xs) None)"
```
```  2180   unfolding bounded_by_def by auto
```
```  2181
```
```  2182 fun approx approx' :: "nat \<Rightarrow> floatarith \<Rightarrow> (float * float) option list \<Rightarrow> (float * float) option" where
```
```  2183 "approx' prec a bs          = (case (approx prec a bs) of Some (l, u) \<Rightarrow> Some (round_down prec l, round_up prec u) | None \<Rightarrow> None)" |
```
```  2184 "approx prec (Add a b) bs   = lift_bin' (approx' prec a bs) (approx' prec b bs) (\<lambda> l1 u1 l2 u2. (l1 + l2, u1 + u2))" |
```
```  2185 "approx prec (Minus a) bs   = lift_un' (approx' prec a bs) (\<lambda> l u. (-u, -l))" |
```
```  2186 "approx prec (Mult a b) bs  = lift_bin' (approx' prec a bs) (approx' prec b bs)
```
```  2187                                     (\<lambda> a1 a2 b1 b2. (float_nprt a1 * float_pprt b2 + float_nprt a2 * float_nprt b2 + float_pprt a1 * float_pprt b1 + float_pprt a2 * float_nprt b1,
```
```  2188                                                      float_pprt a2 * float_pprt b2 + float_pprt a1 * float_nprt b2 + float_nprt a2 * float_pprt b1 + float_nprt a1 * float_nprt b1))" |
```
```  2189 "approx prec (Inverse a) bs = lift_un (approx' prec a bs) (\<lambda> l u. if (0 < l \<or> u < 0) then (Some (float_divl prec 1 u), Some (float_divr prec 1 l)) else (None, None))" |
```
```  2190 "approx prec (Cos a) bs     = lift_un' (approx' prec a bs) (bnds_cos prec)" |
```
```  2191 "approx prec Pi bs          = Some (lb_pi prec, ub_pi prec)" |
```
```  2192 "approx prec (Min a b) bs   = lift_bin' (approx' prec a bs) (approx' prec b bs) (\<lambda> l1 u1 l2 u2. (min l1 l2, min u1 u2))" |
```
```  2193 "approx prec (Max a b) bs   = lift_bin' (approx' prec a bs) (approx' prec b bs) (\<lambda> l1 u1 l2 u2. (max l1 l2, max u1 u2))" |
```
```  2194 "approx prec (Abs a) bs     = lift_un' (approx' prec a bs) (\<lambda>l u. (if l < 0 \<and> 0 < u then 0 else min \<bar>l\<bar> \<bar>u\<bar>, max \<bar>l\<bar> \<bar>u\<bar>))" |
```
```  2195 "approx prec (Arctan a) bs  = lift_un' (approx' prec a bs) (\<lambda> l u. (lb_arctan prec l, ub_arctan prec u))" |
```
```  2196 "approx prec (Sqrt a) bs    = lift_un' (approx' prec a bs) (\<lambda> l u. (lb_sqrt prec l, ub_sqrt prec u))" |
```
```  2197 "approx prec (Exp a) bs     = lift_un' (approx' prec a bs) (\<lambda> l u. (lb_exp prec l, ub_exp prec u))" |
```
```  2198 "approx prec (Ln a) bs      = lift_un (approx' prec a bs) (\<lambda> l u. (lb_ln prec l, ub_ln prec u))" |
```
```  2199 "approx prec (Power a n) bs = lift_un' (approx' prec a bs) (float_power_bnds n)" |
```
```  2200 "approx prec (Num f) bs     = Some (f, f)" |
```
```  2201 "approx prec (Var i) bs    = (if i < length bs then bs ! i else None)"
```
```  2202
```
```  2203 lemma lift_bin'_ex:
```
```  2204   assumes lift_bin'_Some: "Some (l, u) = lift_bin' a b f"
```
```  2205   shows "\<exists> l1 u1 l2 u2. Some (l1, u1) = a \<and> Some (l2, u2) = b"
```
```  2206 proof (cases a)
```
```  2207   case None hence "None = lift_bin' a b f" unfolding None lift_bin'.simps ..
```
```  2208   thus ?thesis using lift_bin'_Some by auto
```
```  2209 next
```
```  2210   case (Some a')
```
```  2211   show ?thesis
```
```  2212   proof (cases b)
```
```  2213     case None hence "None = lift_bin' a b f" unfolding None lift_bin'.simps ..
```
```  2214     thus ?thesis using lift_bin'_Some by auto
```
```  2215   next
```
```  2216     case (Some b')
```
```  2217     obtain la ua where a': "a' = (la, ua)" by (cases a', auto)
```
```  2218     obtain lb ub where b': "b' = (lb, ub)" by (cases b', auto)
```
```  2219     thus ?thesis unfolding `a = Some a'` `b = Some b'` a' b' by auto
```
```  2220   qed
```
```  2221 qed
```
```  2222
```
```  2223 lemma lift_bin'_f:
```
```  2224   assumes lift_bin'_Some: "Some (l, u) = lift_bin' (g a) (g b) f"
```
```  2225   and Pa: "\<And>l u. Some (l, u) = g a \<Longrightarrow> P l u a" and Pb: "\<And>l u. Some (l, u) = g b \<Longrightarrow> P l u b"
```
```  2226   shows "\<exists> l1 u1 l2 u2. P l1 u1 a \<and> P l2 u2 b \<and> l = fst (f l1 u1 l2 u2) \<and> u = snd (f l1 u1 l2 u2)"
```
```  2227 proof -
```
```  2228   obtain l1 u1 l2 u2
```
```  2229     where Sa: "Some (l1, u1) = g a" and Sb: "Some (l2, u2) = g b" using lift_bin'_ex[OF assms(1)] by auto
```
```  2230   have lu: "(l, u) = f l1 u1 l2 u2" using lift_bin'_Some[unfolded Sa[symmetric] Sb[symmetric] lift_bin'.simps] by auto
```
```  2231   have "l = fst (f l1 u1 l2 u2)" and "u = snd (f l1 u1 l2 u2)" unfolding lu[symmetric] by auto
```
```  2232   thus ?thesis using Pa[OF Sa] Pb[OF Sb] by auto
```
```  2233 qed
```
```  2234
```
```  2235 lemma approx_approx':
```
```  2236   assumes Pa: "\<And>l u. Some (l, u) = approx prec a vs \<Longrightarrow> l \<le> interpret_floatarith a xs \<and> interpret_floatarith a xs \<le> u"
```
```  2237   and approx': "Some (l, u) = approx' prec a vs"
```
```  2238   shows "l \<le> interpret_floatarith a xs \<and> interpret_floatarith a xs \<le> u"
```
```  2239 proof -
```
```  2240   obtain l' u' where S: "Some (l', u') = approx prec a vs"
```
```  2241     using approx' unfolding approx'.simps by (cases "approx prec a vs", auto)
```
```  2242   have l': "l = round_down prec l'" and u': "u = round_up prec u'"
```
```  2243     using approx' unfolding approx'.simps S[symmetric] by auto
```
```  2244   show ?thesis unfolding l' u'
```
```  2245     using order_trans[OF Pa[OF S, THEN conjunct2] round_up[of u']]
```
```  2246     using order_trans[OF round_down[of _ l'] Pa[OF S, THEN conjunct1]] by auto
```
```  2247 qed
```
```  2248
```
```  2249 lemma lift_bin':
```
```  2250   assumes lift_bin'_Some: "Some (l, u) = lift_bin' (approx' prec a bs) (approx' prec b bs) f"
```
```  2251   and Pa: "\<And>l u. Some (l, u) = approx prec a bs \<Longrightarrow> l \<le> interpret_floatarith a xs \<and> interpret_floatarith a xs \<le> u" (is "\<And>l u. _ = ?g a \<Longrightarrow> ?P l u a")
```
```  2252   and Pb: "\<And>l u. Some (l, u) = approx prec b bs \<Longrightarrow> l \<le> interpret_floatarith b xs \<and> interpret_floatarith b xs \<le> u"
```
```  2253   shows "\<exists> l1 u1 l2 u2. (l1 \<le> interpret_floatarith a xs \<and> interpret_floatarith a xs \<le> u1) \<and>
```
```  2254                         (l2 \<le> interpret_floatarith b xs \<and> interpret_floatarith b xs \<le> u2) \<and>
```
```  2255                         l = fst (f l1 u1 l2 u2) \<and> u = snd (f l1 u1 l2 u2)"
```
```  2256 proof -
```
```  2257   { fix l u assume "Some (l, u) = approx' prec a bs"
```
```  2258     with approx_approx'[of prec a bs, OF _ this] Pa
```
```  2259     have "l \<le> interpret_floatarith a xs \<and> interpret_floatarith a xs \<le> u" by auto } note Pa = this
```
```  2260   { fix l u assume "Some (l, u) = approx' prec b bs"
```
```  2261     with approx_approx'[of prec b bs, OF _ this] Pb
```
```  2262     have "l \<le> interpret_floatarith b xs \<and> interpret_floatarith b xs \<le> u" by auto } note Pb = this
```
```  2263
```
```  2264   from lift_bin'_f[where g="\<lambda>a. approx' prec a bs" and P = ?P, OF lift_bin'_Some, OF Pa Pb]
```
```  2265   show ?thesis by auto
```
```  2266 qed
```
```  2267
```
```  2268 lemma lift_un'_ex:
```
```  2269   assumes lift_un'_Some: "Some (l, u) = lift_un' a f"
```
```  2270   shows "\<exists> l u. Some (l, u) = a"
```
```  2271 proof (cases a)
```
```  2272   case None hence "None = lift_un' a f" unfolding None lift_un'.simps ..
```
```  2273   thus ?thesis using lift_un'_Some by auto
```
```  2274 next
```
```  2275   case (Some a')
```
```  2276   obtain la ua where a': "a' = (la, ua)" by (cases a', auto)
```
```  2277   thus ?thesis unfolding `a = Some a'` a' by auto
```
```  2278 qed
```
```  2279
```
```  2280 lemma lift_un'_f:
```
```  2281   assumes lift_un'_Some: "Some (l, u) = lift_un' (g a) f"
```
```  2282   and Pa: "\<And>l u. Some (l, u) = g a \<Longrightarrow> P l u a"
```
```  2283   shows "\<exists> l1 u1. P l1 u1 a \<and> l = fst (f l1 u1) \<and> u = snd (f l1 u1)"
```
```  2284 proof -
```
```  2285   obtain l1 u1 where Sa: "Some (l1, u1) = g a" using lift_un'_ex[OF assms(1)] by auto
```
```  2286   have lu: "(l, u) = f l1 u1" using lift_un'_Some[unfolded Sa[symmetric] lift_un'.simps] by auto
```
```  2287   have "l = fst (f l1 u1)" and "u = snd (f l1 u1)" unfolding lu[symmetric] by auto
```
```  2288   thus ?thesis using Pa[OF Sa] by auto
```
```  2289 qed
```
```  2290
```
```  2291 lemma lift_un':
```
```  2292   assumes lift_un'_Some: "Some (l, u) = lift_un' (approx' prec a bs) f"
```
```  2293   and Pa: "\<And>l u. Some (l, u) = approx prec a bs \<Longrightarrow> l \<le> interpret_floatarith a xs \<and> interpret_floatarith a xs \<le> u" (is "\<And>l u. _ = ?g a \<Longrightarrow> ?P l u a")
```
```  2294   shows "\<exists> l1 u1. (l1 \<le> interpret_floatarith a xs \<and> interpret_floatarith a xs \<le> u1) \<and>
```
```  2295                         l = fst (f l1 u1) \<and> u = snd (f l1 u1)"
```
```  2296 proof -
```
```  2297   { fix l u assume "Some (l, u) = approx' prec a bs"
```
```  2298     with approx_approx'[of prec a bs, OF _ this] Pa
```
```  2299     have "l \<le> interpret_floatarith a xs \<and> interpret_floatarith a xs \<le> u" by auto } note Pa = this
```
```  2300   from lift_un'_f[where g="\<lambda>a. approx' prec a bs" and P = ?P, OF lift_un'_Some, OF Pa]
```
```  2301   show ?thesis by auto
```
```  2302 qed
```
```  2303
```
```  2304 lemma lift_un'_bnds:
```
```  2305   assumes bnds: "\<forall> (x::real) lx ux. (l, u) = f lx ux \<and> x \<in> { lx .. ux } \<longrightarrow> l \<le> f' x \<and> f' x \<le> u"
```
```  2306   and lift_un'_Some: "Some (l, u) = lift_un' (approx' prec a bs) f"
```
```  2307   and Pa: "\<And>l u. Some (l, u) = approx prec a bs \<Longrightarrow> l \<le> interpret_floatarith a xs \<and> interpret_floatarith a xs \<le> u"
```
```  2308   shows "real l \<le> f' (interpret_floatarith a xs) \<and> f' (interpret_floatarith a xs) \<le> real u"
```
```  2309 proof -
```
```  2310   from lift_un'[OF lift_un'_Some Pa]
```
```  2311   obtain l1 u1 where "l1 \<le> interpret_floatarith a xs" and "interpret_floatarith a xs \<le> u1" and "l = fst (f l1 u1)" and "u = snd (f l1 u1)" by blast
```
```  2312   hence "(l, u) = f l1 u1" and "interpret_floatarith a xs \<in> {l1 .. u1}" by auto
```
```  2313   thus ?thesis using bnds by auto
```
```  2314 qed
```
```  2315
```
```  2316 lemma lift_un_ex:
```
```  2317   assumes lift_un_Some: "Some (l, u) = lift_un a f"
```
```  2318   shows "\<exists> l u. Some (l, u) = a"
```
```  2319 proof (cases a)
```
```  2320   case None hence "None = lift_un a f" unfolding None lift_un.simps ..
```
```  2321   thus ?thesis using lift_un_Some by auto
```
```  2322 next
```
```  2323   case (Some a')
```
```  2324   obtain la ua where a': "a' = (la, ua)" by (cases a', auto)
```
```  2325   thus ?thesis unfolding `a = Some a'` a' by auto
```
```  2326 qed
```
```  2327
```
```  2328 lemma lift_un_f:
```
```  2329   assumes lift_un_Some: "Some (l, u) = lift_un (g a) f"
```
```  2330   and Pa: "\<And>l u. Some (l, u) = g a \<Longrightarrow> P l u a"
```
```  2331   shows "\<exists> l1 u1. P l1 u1 a \<and> Some l = fst (f l1 u1) \<and> Some u = snd (f l1 u1)"
```
```  2332 proof -
```
```  2333   obtain l1 u1 where Sa: "Some (l1, u1) = g a" using lift_un_ex[OF assms(1)] by auto
```
```  2334   have "fst (f l1 u1) \<noteq> None \<and> snd (f l1 u1) \<noteq> None"
```
```  2335   proof (rule ccontr)
```
```  2336     assume "\<not> (fst (f l1 u1) \<noteq> None \<and> snd (f l1 u1) \<noteq> None)"
```
```  2337     hence or: "fst (f l1 u1) = None \<or> snd (f l1 u1) = None" by auto
```
```  2338     hence "lift_un (g a) f = None"
```
```  2339     proof (cases "fst (f l1 u1) = None")
```
```  2340       case True
```
```  2341       then obtain b where b: "f l1 u1 = (None, b)" by (cases "f l1 u1", auto)
```
```  2342       thus ?thesis unfolding Sa[symmetric] lift_un.simps b by auto
```
```  2343     next
```
```  2344       case False hence "snd (f l1 u1) = None" using or by auto
```
```  2345       with False obtain b where b: "f l1 u1 = (Some b, None)" by (cases "f l1 u1", auto)
```
```  2346       thus ?thesis unfolding Sa[symmetric] lift_un.simps b by auto
```
```  2347     qed
```
```  2348     thus False using lift_un_Some by auto
```
```  2349   qed
```
```  2350   then obtain a' b' where f: "f l1 u1 = (Some a', Some b')" by (cases "f l1 u1", auto)
```
```  2351   from lift_un_Some[unfolded Sa[symmetric] lift_un.simps f]
```
```  2352   have "Some l = fst (f l1 u1)" and "Some u = snd (f l1 u1)" unfolding f by auto
```
```  2353   thus ?thesis unfolding Sa[symmetric] lift_un.simps using Pa[OF Sa] by auto
```
```  2354 qed
```
```  2355
```
```  2356 lemma lift_un:
```
```  2357   assumes lift_un_Some: "Some (l, u) = lift_un (approx' prec a bs) f"
```
```  2358   and Pa: "\<And>l u. Some (l, u) = approx prec a bs \<Longrightarrow> l \<le> interpret_floatarith a xs \<and> interpret_floatarith a xs \<le> u" (is "\<And>l u. _ = ?g a \<Longrightarrow> ?P l u a")
```
```  2359   shows "\<exists> l1 u1. (l1 \<le> interpret_floatarith a xs \<and> interpret_floatarith a xs \<le> u1) \<and>
```
```  2360                   Some l = fst (f l1 u1) \<and> Some u = snd (f l1 u1)"
```
```  2361 proof -
```
```  2362   { fix l u assume "Some (l, u) = approx' prec a bs"
```
```  2363     with approx_approx'[of prec a bs, OF _ this] Pa
```
```  2364     have "l \<le> interpret_floatarith a xs \<and> interpret_floatarith a xs \<le> u" by auto } note Pa = this
```
```  2365   from lift_un_f[where g="\<lambda>a. approx' prec a bs" and P = ?P, OF lift_un_Some, OF Pa]
```
```  2366   show ?thesis by auto
```
```  2367 qed
```
```  2368
```
```  2369 lemma lift_un_bnds:
```
```  2370   assumes bnds: "\<forall> (x::real) lx ux. (Some l, Some u) = f lx ux \<and> x \<in> { lx .. ux } \<longrightarrow> l \<le> f' x \<and> f' x \<le> u"
```
```  2371   and lift_un_Some: "Some (l, u) = lift_un (approx' prec a bs) f"
```
```  2372   and Pa: "\<And>l u. Some (l, u) = approx prec a bs \<Longrightarrow> l \<le> interpret_floatarith a xs \<and> interpret_floatarith a xs \<le> u"
```
```  2373   shows "real l \<le> f' (interpret_floatarith a xs) \<and> f' (interpret_floatarith a xs) \<le> real u"
```
```  2374 proof -
```
```  2375   from lift_un[OF lift_un_Some Pa]
```
```  2376   obtain l1 u1 where "l1 \<le> interpret_floatarith a xs" and "interpret_floatarith a xs \<le> u1" and "Some l = fst (f l1 u1)" and "Some u = snd (f l1 u1)" by blast
```
```  2377   hence "(Some l, Some u) = f l1 u1" and "interpret_floatarith a xs \<in> {l1 .. u1}" by auto
```
```  2378   thus ?thesis using bnds by auto
```
```  2379 qed
```
```  2380
```
```  2381 lemma approx:
```
```  2382   assumes "bounded_by xs vs"
```
```  2383   and "Some (l, u) = approx prec arith vs" (is "_ = ?g arith")
```
```  2384   shows "l \<le> interpret_floatarith arith xs \<and> interpret_floatarith arith xs \<le> u" (is "?P l u arith")
```
```  2385   using `Some (l, u) = approx prec arith vs`
```
```  2386 proof (induct arith arbitrary: l u x)
```
```  2387   case (Add a b)
```
```  2388   from lift_bin'[OF Add.prems[unfolded approx.simps]] Add.hyps
```
```  2389   obtain l1 u1 l2 u2 where "l = l1 + l2" and "u = u1 + u2"
```
```  2390     "l1 \<le> interpret_floatarith a xs" and "interpret_floatarith a xs \<le> u1"
```
```  2391     "l2 \<le> interpret_floatarith b xs" and "interpret_floatarith b xs \<le> u2" unfolding fst_conv snd_conv by blast
```
```  2392   thus ?case unfolding interpret_floatarith.simps by auto
```
```  2393 next
```
```  2394   case (Minus a)
```
```  2395   from lift_un'[OF Minus.prems[unfolded approx.simps]] Minus.hyps
```
```  2396   obtain l1 u1 where "l = -u1" and "u = -l1"
```
```  2397     "l1 \<le> interpret_floatarith a xs" and "interpret_floatarith a xs \<le> u1" unfolding fst_conv snd_conv by blast
```
```  2398   thus ?case unfolding interpret_floatarith.simps using real_of_float_minus by auto
```
```  2399 next
```
```  2400   case (Mult a b)
```
```  2401   from lift_bin'[OF Mult.prems[unfolded approx.simps]] Mult.hyps
```
```  2402   obtain l1 u1 l2 u2
```
```  2403     where l: "l = float_nprt l1 * float_pprt u2 + float_nprt u1 * float_nprt u2 + float_pprt l1 * float_pprt l2 + float_pprt u1 * float_nprt l2"
```
```  2404     and u: "u = float_pprt u1 * float_pprt u2 + float_pprt l1 * float_nprt u2 + float_nprt u1 * float_pprt l2 + float_nprt l1 * float_nprt l2"
```
```  2405     and "l1 \<le> interpret_floatarith a xs" and "interpret_floatarith a xs \<le> u1"
```
```  2406     and "l2 \<le> interpret_floatarith b xs" and "interpret_floatarith b xs \<le> u2" unfolding fst_conv snd_conv by blast
```
```  2407   thus ?case unfolding interpret_floatarith.simps l u real_of_float_add real_of_float_mult real_of_float_nprt real_of_float_pprt
```
```  2408     using mult_le_prts mult_ge_prts by auto
```
```  2409 next
```
```  2410   case (Inverse a)
```
```  2411   from lift_un[OF Inverse.prems[unfolded approx.simps], unfolded if_distrib[of fst] if_distrib[of snd] fst_conv snd_conv] Inverse.hyps
```
```  2412   obtain l1 u1 where l': "Some l = (if 0 < l1 \<or> u1 < 0 then Some (float_divl prec 1 u1) else None)"
```
```  2413     and u': "Some u = (if 0 < l1 \<or> u1 < 0 then Some (float_divr prec 1 l1) else None)"
```
```  2414     and l1: "l1 \<le> interpret_floatarith a xs" and u1: "interpret_floatarith a xs \<le> u1" by blast
```
```  2415   have either: "0 < l1 \<or> u1 < 0" proof (rule ccontr) assume P: "\<not> (0 < l1 \<or> u1 < 0)" show False using l' unfolding if_not_P[OF P] by auto qed
```
```  2416   moreover have l1_le_u1: "real l1 \<le> real u1" using l1 u1 by auto
```
```  2417   ultimately have "real l1 \<noteq> 0" and "real u1 \<noteq> 0" unfolding less_float_def by auto
```
```  2418
```
```  2419   have inv: "inverse u1 \<le> inverse (interpret_floatarith a xs)
```
```  2420            \<and> inverse (interpret_floatarith a xs) \<le> inverse l1"
```
```  2421   proof (cases "0 < l1")
```
```  2422     case True hence "0 < real u1" and "0 < real l1" "0 < interpret_floatarith a xs"
```
```  2423       unfolding less_float_def using l1_le_u1 l1 by auto
```
```  2424     show ?thesis
```
```  2425       unfolding inverse_le_iff_le[OF `0 < real u1` `0 < interpret_floatarith a xs`]
```
```  2426         inverse_le_iff_le[OF `0 < interpret_floatarith a xs` `0 < real l1`]
```
```  2427       using l1 u1 by auto
```
```  2428   next
```
```  2429     case False hence "u1 < 0" using either by blast
```
```  2430     hence "real u1 < 0" and "real l1 < 0" "interpret_floatarith a xs < 0"
```
```  2431       unfolding less_float_def using l1_le_u1 u1 by auto
```
```  2432     show ?thesis
```
```  2433       unfolding inverse_le_iff_le_neg[OF `real u1 < 0` `interpret_floatarith a xs < 0`]
```
```  2434         inverse_le_iff_le_neg[OF `interpret_floatarith a xs < 0` `real l1 < 0`]
```
```  2435       using l1 u1 by auto
```
```  2436   qed
```
```  2437
```
```  2438   from l' have "l = float_divl prec 1 u1" by (cases "0 < l1 \<or> u1 < 0", auto)
```
```  2439   hence "l \<le> inverse u1" unfolding nonzero_inverse_eq_divide[OF `real u1 \<noteq> 0`] using float_divl[of prec 1 u1] by auto
```
```  2440   also have "\<dots> \<le> inverse (interpret_floatarith a xs)" using inv by auto
```
```  2441   finally have "l \<le> inverse (interpret_floatarith a xs)" .
```
```  2442   moreover
```
```  2443   from u' have "u = float_divr prec 1 l1" by (cases "0 < l1 \<or> u1 < 0", auto)
```
```  2444   hence "inverse l1 \<le> u" unfolding nonzero_inverse_eq_divide[OF `real l1 \<noteq> 0`] using float_divr[of 1 l1 prec] by auto
```
```  2445   hence "inverse (interpret_floatarith a xs) \<le> u" by (rule order_trans[OF inv[THEN conjunct2]])
```
```  2446   ultimately show ?case unfolding interpret_floatarith.simps using l1 u1 by auto
```
```  2447 next
```
```  2448   case (Abs x)
```
```  2449   from lift_un'[OF Abs.prems[unfolded approx.simps], unfolded fst_conv snd_conv] Abs.hyps
```
```  2450   obtain l1 u1 where l': "l = (if l1 < 0 \<and> 0 < u1 then 0 else min \<bar>l1\<bar> \<bar>u1\<bar>)" and u': "u = max \<bar>l1\<bar> \<bar>u1\<bar>"
```
```  2451     and l1: "l1 \<le> interpret_floatarith x xs" and u1: "interpret_floatarith x xs \<le> u1" by blast
```
```  2452   thus ?case unfolding l' u' by (cases "l1 < 0 \<and> 0 < u1", auto simp add: real_of_float_min real_of_float_max real_of_float_abs less_float_def)
```
```  2453 next
```
```  2454   case (Min a b)
```
```  2455   from lift_bin'[OF Min.prems[unfolded approx.simps], unfolded fst_conv snd_conv] Min.hyps
```
```  2456   obtain l1 u1 l2 u2 where l': "l = min l1 l2" and u': "u = min u1 u2"
```
```  2457     and l1: "l1 \<le> interpret_floatarith a xs" and u1: "interpret_floatarith a xs \<le> u1"
```
```  2458     and l1: "l2 \<le> interpret_floatarith b xs" and u1: "interpret_floatarith b xs \<le> u2" by blast
```
```  2459   thus ?case unfolding l' u' by (auto simp add: real_of_float_min)
```
```  2460 next
```
```  2461   case (Max a b)
```
```  2462   from lift_bin'[OF Max.prems[unfolded approx.simps], unfolded fst_conv snd_conv] Max.hyps
```
```  2463   obtain l1 u1 l2 u2 where l': "l = max l1 l2" and u': "u = max u1 u2"
```
```  2464     and l1: "l1 \<le> interpret_floatarith a xs" and u1: "interpret_floatarith a xs \<le> u1"
```
```  2465     and l1: "l2 \<le> interpret_floatarith b xs" and u1: "interpret_floatarith b xs \<le> u2" by blast
```
```  2466   thus ?case unfolding l' u' by (auto simp add: real_of_float_max)
```
```  2467 next case (Cos a) with lift_un'_bnds[OF bnds_cos] show ?case by auto
```
```  2468 next case (Arctan a) with lift_un'_bnds[OF bnds_arctan] show ?case by auto
```
```  2469 next case Pi with pi_boundaries show ?case by auto
```
```  2470 next case (Sqrt a) with lift_un'_bnds[OF bnds_sqrt] show ?case by auto
```
```  2471 next case (Exp a) with lift_un'_bnds[OF bnds_exp] show ?case by auto
```
```  2472 next case (Ln a) with lift_un_bnds[OF bnds_ln] show ?case by auto
```
```  2473 next case (Power a n) with lift_un'_bnds[OF bnds_power] show ?case by auto
```
```  2474 next case (Num f) thus ?case by auto
```
```  2475 next
```
```  2476   case (Var n)
```
```  2477   from this[symmetric] `bounded_by xs vs`[THEN bounded_byE, of n]
```
```  2478   show ?case by (cases "n < length vs", auto)
```
```  2479 qed
```
```  2480
```
```  2481 datatype form = Bound floatarith floatarith floatarith form
```
```  2482               | Assign floatarith floatarith form
```
```  2483               | Less floatarith floatarith
```
```  2484               | LessEqual floatarith floatarith
```
```  2485               | AtLeastAtMost floatarith floatarith floatarith
```
```  2486
```
```  2487 fun interpret_form :: "form \<Rightarrow> real list \<Rightarrow> bool" where
```
```  2488 "interpret_form (Bound x a b f) vs = (interpret_floatarith x vs \<in> { interpret_floatarith a vs .. interpret_floatarith b vs } \<longrightarrow> interpret_form f vs)" |
```
```  2489 "interpret_form (Assign x a f) vs  = (interpret_floatarith x vs = interpret_floatarith a vs \<longrightarrow> interpret_form f vs)" |
```
```  2490 "interpret_form (Less a b) vs      = (interpret_floatarith a vs < interpret_floatarith b vs)" |
```
```  2491 "interpret_form (LessEqual a b) vs = (interpret_floatarith a vs \<le> interpret_floatarith b vs)" |
```
```  2492 "interpret_form (AtLeastAtMost x a b) vs = (interpret_floatarith x vs \<in> { interpret_floatarith a vs .. interpret_floatarith b vs })"
```
```  2493
```
```  2494 fun approx_form' and approx_form :: "nat \<Rightarrow> form \<Rightarrow> (float * float) option list \<Rightarrow> nat list \<Rightarrow> bool" where
```
```  2495 "approx_form' prec f 0 n l u bs ss = approx_form prec f (bs[n := Some (l, u)]) ss" |
```
```  2496 "approx_form' prec f (Suc s) n l u bs ss =
```
```  2497   (let m = (l + u) * Float 1 -1
```
```  2498    in (if approx_form' prec f s n l m bs ss then approx_form' prec f s n m u bs ss else False))" |
```
```  2499 "approx_form prec (Bound (Var n) a b f) bs ss =
```
```  2500    (case (approx prec a bs, approx prec b bs)
```
```  2501    of (Some (l, _), Some (_, u)) \<Rightarrow> approx_form' prec f (ss ! n) n l u bs ss
```
```  2502     | _ \<Rightarrow> False)" |
```
```  2503 "approx_form prec (Assign (Var n) a f) bs ss =
```
```  2504    (case (approx prec a bs)
```
```  2505    of (Some (l, u)) \<Rightarrow> approx_form' prec f (ss ! n) n l u bs ss
```
```  2506     | _ \<Rightarrow> False)" |
```
```  2507 "approx_form prec (Less a b) bs ss =
```
```  2508    (case (approx prec a bs, approx prec b bs)
```
```  2509    of (Some (l, u), Some (l', u')) \<Rightarrow> u < l'
```
```  2510     | _ \<Rightarrow> False)" |
```
```  2511 "approx_form prec (LessEqual a b) bs ss =
```
```  2512    (case (approx prec a bs, approx prec b bs)
```
```  2513    of (Some (l, u), Some (l', u')) \<Rightarrow> u \<le> l'
```
```  2514     | _ \<Rightarrow> False)" |
```
```  2515 "approx_form prec (AtLeastAtMost x a b) bs ss =
```
```  2516    (case (approx prec x bs, approx prec a bs, approx prec b bs)
```
```  2517    of (Some (lx, ux), Some (l, u), Some (l', u')) \<Rightarrow> u \<le> lx \<and> ux \<le> l'
```
```  2518     | _ \<Rightarrow> False)" |
```
```  2519 "approx_form _ _ _ _ = False"
```
```  2520
```
```  2521 lemma lazy_conj: "(if A then B else False) = (A \<and> B)" by simp
```
```  2522
```
```  2523 lemma approx_form_approx_form':
```
```  2524   assumes "approx_form' prec f s n l u bs ss" and "(x::real) \<in> { l .. u }"
```
```  2525   obtains l' u' where "x \<in> { l' .. u' }"
```
```  2526   and "approx_form prec f (bs[n := Some (l', u')]) ss"
```
```  2527 using assms proof (induct s arbitrary: l u)
```
```  2528   case 0
```
```  2529   from this(1)[of l u] this(2,3)
```
```  2530   show thesis by auto
```
```  2531 next
```
```  2532   case (Suc s)
```
```  2533
```
```  2534   let ?m = "(l + u) * Float 1 -1"
```
```  2535   have "real l \<le> ?m" and "?m \<le> real u"
```
```  2536     unfolding le_float_def using Suc.prems by auto
```
```  2537
```
```  2538   with `x \<in> { l .. u }`
```
```  2539   have "x \<in> { l .. ?m} \<or> x \<in> { ?m .. u }" by auto
```
```  2540   thus thesis
```
```  2541   proof (rule disjE)
```
```  2542     assume *: "x \<in> { l .. ?m }"
```
```  2543     with Suc.hyps[OF _ _ *] Suc.prems
```
```  2544     show thesis by (simp add: Let_def lazy_conj)
```
```  2545   next
```
```  2546     assume *: "x \<in> { ?m .. u }"
```
```  2547     with Suc.hyps[OF _ _ *] Suc.prems
```
```  2548     show thesis by (simp add: Let_def lazy_conj)
```
```  2549   qed
```
```  2550 qed
```
```  2551
```
```  2552 lemma approx_form_aux:
```
```  2553   assumes "approx_form prec f vs ss"
```
```  2554   and "bounded_by xs vs"
```
```  2555   shows "interpret_form f xs"
```
```  2556 using assms proof (induct f arbitrary: vs)
```
```  2557   case (Bound x a b f)
```
```  2558   then obtain n
```
```  2559     where x_eq: "x = Var n" by (cases x) auto
```
```  2560
```
```  2561   with Bound.prems obtain l u' l' u
```
```  2562     where l_eq: "Some (l, u') = approx prec a vs"
```
```  2563     and u_eq: "Some (l', u) = approx prec b vs"
```
```  2564     and approx_form': "approx_form' prec f (ss ! n) n l u vs ss"
```
```  2565     by (cases "approx prec a vs", simp) (cases "approx prec b vs", auto)
```
```  2566
```
```  2567   { assume "xs ! n \<in> { interpret_floatarith a xs .. interpret_floatarith b xs }"
```
```  2568     with approx[OF Bound.prems(2) l_eq] and approx[OF Bound.prems(2) u_eq]
```
```  2569     have "xs ! n \<in> { l .. u}" by auto
```
```  2570
```
```  2571     from approx_form_approx_form'[OF approx_form' this]
```
```  2572     obtain lx ux where bnds: "xs ! n \<in> { lx .. ux }"
```
```  2573       and approx_form: "approx_form prec f (vs[n := Some (lx, ux)]) ss" .
```
```  2574
```
```  2575     from `bounded_by xs vs` bnds
```
```  2576     have "bounded_by xs (vs[n := Some (lx, ux)])" by (rule bounded_by_update)
```
```  2577     with Bound.hyps[OF approx_form]
```
```  2578     have "interpret_form f xs" by blast }
```
```  2579   thus ?case using interpret_form.simps x_eq and interpret_floatarith.simps by simp
```
```  2580 next
```
```  2581   case (Assign x a f)
```
```  2582   then obtain n
```
```  2583     where x_eq: "x = Var n" by (cases x) auto
```
```  2584
```
```  2585   with Assign.prems obtain l u' l' u
```
```  2586     where bnd_eq: "Some (l, u) = approx prec a vs"
```
```  2587     and x_eq: "x = Var n"
```
```  2588     and approx_form': "approx_form' prec f (ss ! n) n l u vs ss"
```
```  2589     by (cases "approx prec a vs") auto
```
```  2590
```
```  2591   { assume bnds: "xs ! n = interpret_floatarith a xs"
```
```  2592     with approx[OF Assign.prems(2) bnd_eq]
```
```  2593     have "xs ! n \<in> { l .. u}" by auto
```
```  2594     from approx_form_approx_form'[OF approx_form' this]
```
```  2595     obtain lx ux where bnds: "xs ! n \<in> { lx .. ux }"
```
```  2596       and approx_form: "approx_form prec f (vs[n := Some (lx, ux)]) ss" .
```
```  2597
```
```  2598     from `bounded_by xs vs` bnds
```
```  2599     have "bounded_by xs (vs[n := Some (lx, ux)])" by (rule bounded_by_update)
```
```  2600     with Assign.hyps[OF approx_form]
```
```  2601     have "interpret_form f xs" by blast }
```
```  2602   thus ?case using interpret_form.simps x_eq and interpret_floatarith.simps by simp
```
```  2603 next
```
```  2604   case (Less a b)
```
```  2605   then obtain l u l' u'
```
```  2606     where l_eq: "Some (l, u) = approx prec a vs"
```
```  2607     and u_eq: "Some (l', u') = approx prec b vs"
```
```  2608     and inequality: "u < l'"
```
```  2609     by (cases "approx prec a vs", auto,
```
```  2610       cases "approx prec b vs", auto)
```
```  2611   from inequality[unfolded less_float_def] approx[OF Less.prems(2) l_eq] approx[OF Less.prems(2) u_eq]
```
```  2612   show ?case by auto
```
```  2613 next
```
```  2614   case (LessEqual a b)
```
```  2615   then obtain l u l' u'
```
```  2616     where l_eq: "Some (l, u) = approx prec a vs"
```
```  2617     and u_eq: "Some (l', u') = approx prec b vs"
```
```  2618     and inequality: "u \<le> l'"
```
```  2619     by (cases "approx prec a vs", auto,
```
```  2620       cases "approx prec b vs", auto)
```
```  2621   from inequality[unfolded le_float_def] approx[OF LessEqual.prems(2) l_eq] approx[OF LessEqual.prems(2) u_eq]
```
```  2622   show ?case by auto
```
```  2623 next
```
```  2624   case (AtLeastAtMost x a b)
```
```  2625   then obtain lx ux l u l' u'
```
```  2626     where x_eq: "Some (lx, ux) = approx prec x vs"
```
```  2627     and l_eq: "Some (l, u) = approx prec a vs"
```
```  2628     and u_eq: "Some (l', u') = approx prec b vs"
```
```  2629     and inequality: "u \<le> lx \<and> ux \<le> l'"
```
```  2630     by (cases "approx prec x vs", auto,
```
```  2631       cases "approx prec a vs", auto,
```
```  2632       cases "approx prec b vs", auto, blast)
```
```  2633   from inequality[unfolded le_float_def] approx[OF AtLeastAtMost.prems(2) l_eq] approx[OF AtLeastAtMost.prems(2) u_eq] approx[OF AtLeastAtMost.prems(2) x_eq]
```
```  2634   show ?case by auto
```
```  2635 qed
```
```  2636
```
```  2637 lemma approx_form:
```
```  2638   assumes "n = length xs"
```
```  2639   assumes "approx_form prec f (replicate n None) ss"
```
```  2640   shows "interpret_form f xs"
```
```  2641   using approx_form_aux[OF _ bounded_by_None] assms by auto
```
```  2642
```
```  2643 subsection {* Implementing Taylor series expansion *}
```
```  2644
```
```  2645 fun isDERIV :: "nat \<Rightarrow> floatarith \<Rightarrow> real list \<Rightarrow> bool" where
```
```  2646 "isDERIV x (Add a b) vs         = (isDERIV x a vs \<and> isDERIV x b vs)" |
```
```  2647 "isDERIV x (Mult a b) vs        = (isDERIV x a vs \<and> isDERIV x b vs)" |
```
```  2648 "isDERIV x (Minus a) vs         = isDERIV x a vs" |
```
```  2649 "isDERIV x (Inverse a) vs       = (isDERIV x a vs \<and> interpret_floatarith a vs \<noteq> 0)" |
```
```  2650 "isDERIV x (Cos a) vs           = isDERIV x a vs" |
```
```  2651 "isDERIV x (Arctan a) vs        = isDERIV x a vs" |
```
```  2652 "isDERIV x (Min a b) vs         = False" |
```
```  2653 "isDERIV x (Max a b) vs         = False" |
```
```  2654 "isDERIV x (Abs a) vs           = False" |
```
```  2655 "isDERIV x Pi vs                = True" |
```
```  2656 "isDERIV x (Sqrt a) vs          = (isDERIV x a vs \<and> interpret_floatarith a vs > 0)" |
```
```  2657 "isDERIV x (Exp a) vs           = isDERIV x a vs" |
```
```  2658 "isDERIV x (Ln a) vs            = (isDERIV x a vs \<and> interpret_floatarith a vs > 0)" |
```
```  2659 "isDERIV x (Power a 0) vs       = True" |
```
```  2660 "isDERIV x (Power a (Suc n)) vs = isDERIV x a vs" |
```
```  2661 "isDERIV x (Num f) vs           = True" |
```
```  2662 "isDERIV x (Var n) vs          = True"
```
```  2663
```
```  2664 fun DERIV_floatarith :: "nat \<Rightarrow> floatarith \<Rightarrow> floatarith" where
```
```  2665 "DERIV_floatarith x (Add a b)         = Add (DERIV_floatarith x a) (DERIV_floatarith x b)" |
```
```  2666 "DERIV_floatarith x (Mult a b)        = Add (Mult a (DERIV_floatarith x b)) (Mult (DERIV_floatarith x a) b)" |
```
```  2667 "DERIV_floatarith x (Minus a)         = Minus (DERIV_floatarith x a)" |
```
```  2668 "DERIV_floatarith x (Inverse a)       = Minus (Mult (DERIV_floatarith x a) (Inverse (Power a 2)))" |
```
```  2669 "DERIV_floatarith x (Cos a)           = Minus (Mult (Cos (Add (Mult Pi (Num (Float 1 -1))) (Minus a))) (DERIV_floatarith x a))" |
```
```  2670 "DERIV_floatarith x (Arctan a)        = Mult (Inverse (Add (Num 1) (Power a 2))) (DERIV_floatarith x a)" |
```
```  2671 "DERIV_floatarith x (Min a b)         = Num 0" |
```
```  2672 "DERIV_floatarith x (Max a b)         = Num 0" |
```
```  2673 "DERIV_floatarith x (Abs a)           = Num 0" |
```
```  2674 "DERIV_floatarith x Pi                = Num 0" |
```
```  2675 "DERIV_floatarith x (Sqrt a)          = (Mult (Inverse (Mult (Sqrt a) (Num 2))) (DERIV_floatarith x a))" |
```
```  2676 "DERIV_floatarith x (Exp a)           = Mult (Exp a) (DERIV_floatarith x a)" |
```
```  2677 "DERIV_floatarith x (Ln a)            = Mult (Inverse a) (DERIV_floatarith x a)" |
```
```  2678 "DERIV_floatarith x (Power a 0)       = Num 0" |
```
```  2679 "DERIV_floatarith x (Power a (Suc n)) = Mult (Num (Float (int (Suc n)) 0)) (Mult (Power a n) (DERIV_floatarith x a))" |
```
```  2680 "DERIV_floatarith x (Num f)           = Num 0" |
```
```  2681 "DERIV_floatarith x (Var n)          = (if x = n then Num 1 else Num 0)"
```
```  2682
```
```  2683 lemma DERIV_floatarith:
```
```  2684   assumes "n < length vs"
```
```  2685   assumes isDERIV: "isDERIV n f (vs[n := x])"
```
```  2686   shows "DERIV (\<lambda> x'. interpret_floatarith f (vs[n := x'])) x :>
```
```  2687                interpret_floatarith (DERIV_floatarith n f) (vs[n := x])"
```
```  2688    (is "DERIV (?i f) x :> _")
```
```  2689 using isDERIV proof (induct f arbitrary: x)
```
```  2690      case (Inverse a) thus ?case
```
```  2691     by (auto intro!: DERIV_intros
```
```  2692              simp add: algebra_simps power2_eq_square)
```
```  2693 next case (Cos a) thus ?case
```
```  2694   by (auto intro!: DERIV_intros
```
```  2695            simp del: interpret_floatarith.simps(5)
```
```  2696            simp add: interpret_floatarith_sin interpret_floatarith.simps(5)[of a])
```
```  2697 next case (Power a n) thus ?case
```
```  2698   by (cases n, auto intro!: DERIV_intros
```
```  2699                     simp del: power_Suc simp add: real_eq_of_nat)
```
```  2700 next case (Ln a) thus ?case
```
```  2701     by (auto intro!: DERIV_intros simp add: divide_inverse)
```
```  2702 next case (Var i) thus ?case using `n < length vs` by auto
```
```  2703 qed (auto intro!: DERIV_intros)
```
```  2704
```
```  2705 declare approx.simps[simp del]
```
```  2706
```
```  2707 fun isDERIV_approx :: "nat \<Rightarrow> nat \<Rightarrow> floatarith \<Rightarrow> (float * float) option list \<Rightarrow> bool" where
```
```  2708 "isDERIV_approx prec x (Add a b) vs         = (isDERIV_approx prec x a vs \<and> isDERIV_approx prec x b vs)" |
```
```  2709 "isDERIV_approx prec x (Mult a b) vs        = (isDERIV_approx prec x a vs \<and> isDERIV_approx prec x b vs)" |
```
```  2710 "isDERIV_approx prec x (Minus a) vs         = isDERIV_approx prec x a vs" |
```
```  2711 "isDERIV_approx prec x (Inverse a) vs       =
```
```  2712   (isDERIV_approx prec x a vs \<and> (case approx prec a vs of Some (l, u) \<Rightarrow> 0 < l \<or> u < 0 | None \<Rightarrow> False))" |
```
```  2713 "isDERIV_approx prec x (Cos a) vs           = isDERIV_approx prec x a vs" |
```
```  2714 "isDERIV_approx prec x (Arctan a) vs        = isDERIV_approx prec x a vs" |
```
```  2715 "isDERIV_approx prec x (Min a b) vs         = False" |
```
```  2716 "isDERIV_approx prec x (Max a b) vs         = False" |
```
```  2717 "isDERIV_approx prec x (Abs a) vs           = False" |
```
```  2718 "isDERIV_approx prec x Pi vs                = True" |
```
```  2719 "isDERIV_approx prec x (Sqrt a) vs          =
```
```  2720   (isDERIV_approx prec x a vs \<and> (case approx prec a vs of Some (l, u) \<Rightarrow> 0 < l | None \<Rightarrow> False))" |
```
```  2721 "isDERIV_approx prec x (Exp a) vs           = isDERIV_approx prec x a vs" |
```
```  2722 "isDERIV_approx prec x (Ln a) vs            =
```
```  2723   (isDERIV_approx prec x a vs \<and> (case approx prec a vs of Some (l, u) \<Rightarrow> 0 < l | None \<Rightarrow> False))" |
```
```  2724 "isDERIV_approx prec x (Power a 0) vs       = True" |
```
```  2725 "isDERIV_approx prec x (Power a (Suc n)) vs = isDERIV_approx prec x a vs" |
```
```  2726 "isDERIV_approx prec x (Num f) vs           = True" |
```
```  2727 "isDERIV_approx prec x (Var n) vs          = True"
```
```  2728
```
```  2729 lemma isDERIV_approx:
```
```  2730   assumes "bounded_by xs vs"
```
```  2731   and isDERIV_approx: "isDERIV_approx prec x f vs"
```
```  2732   shows "isDERIV x f xs"
```
```  2733 using isDERIV_approx proof (induct f)
```
```  2734   case (Inverse a)
```
```  2735   then obtain l u where approx_Some: "Some (l, u) = approx prec a vs"
```
```  2736     and *: "0 < l \<or> u < 0"
```
```  2737     by (cases "approx prec a vs", auto)
```
```  2738   with approx[OF `bounded_by xs vs` approx_Some]
```
```  2739   have "interpret_floatarith a xs \<noteq> 0" unfolding less_float_def by auto
```
```  2740   thus ?case using Inverse by auto
```
```  2741 next
```
```  2742   case (Ln a)
```
```  2743   then obtain l u where approx_Some: "Some (l, u) = approx prec a vs"
```
```  2744     and *: "0 < l"
```
```  2745     by (cases "approx prec a vs", auto)
```
```  2746   with approx[OF `bounded_by xs vs` approx_Some]
```
```  2747   have "0 < interpret_floatarith a xs" unfolding less_float_def by auto
```
```  2748   thus ?case using Ln by auto
```
```  2749 next
```
```  2750   case (Sqrt a)
```
```  2751   then obtain l u where approx_Some: "Some (l, u) = approx prec a vs"
```
```  2752     and *: "0 < l"
```
```  2753     by (cases "approx prec a vs", auto)
```
```  2754   with approx[OF `bounded_by xs vs` approx_Some]
```
```  2755   have "0 < interpret_floatarith a xs" unfolding less_float_def by auto
```
```  2756   thus ?case using Sqrt by auto
```
```  2757 next
```
```  2758   case (Power a n) thus ?case by (cases n, auto)
```
```  2759 qed auto
```
```  2760
```
```  2761 lemma bounded_by_update_var:
```
```  2762   assumes "bounded_by xs vs" and "vs ! i = Some (l, u)"
```
```  2763   and bnd: "x \<in> { real l .. real u }"
```
```  2764   shows "bounded_by (xs[i := x]) vs"
```
```  2765 proof (cases "i < length xs")
```
```  2766   case False thus ?thesis using `bounded_by xs vs` by auto
```
```  2767 next
```
```  2768   let ?xs = "xs[i := x]"
```
```  2769   case True hence "i < length ?xs" by auto
```
```  2770 { fix j
```
```  2771   assume "j < length vs"
```
```  2772   have "case vs ! j of None \<Rightarrow> True | Some (l, u) \<Rightarrow> ?xs ! j \<in> { real l .. real u }"
```
```  2773   proof (cases "vs ! j")
```
```  2774     case (Some b)
```
```  2775     thus ?thesis
```
```  2776     proof (cases "i = j")
```
```  2777       case True
```
```  2778       thus ?thesis using `vs ! i = Some (l, u)` Some and bnd `i < length ?xs`
```
```  2779         by auto
```
```  2780     next
```
```  2781       case False
```
```  2782       thus ?thesis using `bounded_by xs vs`[THEN bounded_byE, OF `j < length vs`] Some
```
```  2783         by auto
```
```  2784     qed
```
```  2785   qed auto }
```
```  2786   thus ?thesis unfolding bounded_by_def by auto
```
```  2787 qed
```
```  2788
```
```  2789 lemma isDERIV_approx':
```
```  2790   assumes "bounded_by xs vs"
```
```  2791   and vs_x: "vs ! x = Some (l, u)" and X_in: "X \<in> { real l .. real u }"
```
```  2792   and approx: "isDERIV_approx prec x f vs"
```
```  2793   shows "isDERIV x f (xs[x := X])"
```
```  2794 proof -
```
```  2795   note bounded_by_update_var[OF `bounded_by xs vs` vs_x X_in] approx
```
```  2796   thus ?thesis by (rule isDERIV_approx)
```
```  2797 qed
```
```  2798
```
```  2799 lemma DERIV_approx:
```
```  2800   assumes "n < length xs" and bnd: "bounded_by xs vs"
```
```  2801   and isD: "isDERIV_approx prec n f vs"
```
```  2802   and app: "Some (l, u) = approx prec (DERIV_floatarith n f) vs" (is "_ = approx _ ?D _")
```
```  2803   shows "\<exists>(x::real). l \<le> x \<and> x \<le> u \<and>
```
```  2804              DERIV (\<lambda> x. interpret_floatarith f (xs[n := x])) (xs!n) :> x"
```
```  2805          (is "\<exists> x. _ \<and> _ \<and> DERIV (?i f) _ :> _")
```
```  2806 proof (rule exI[of _ "?i ?D (xs!n)"], rule conjI[OF _ conjI])
```
```  2807   let "?i f x" = "interpret_floatarith f (xs[n := x])"
```
```  2808   from approx[OF bnd app]
```
```  2809   show "l \<le> ?i ?D (xs!n)" and "?i ?D (xs!n) \<le> u"
```
```  2810     using `n < length xs` by auto
```
```  2811   from DERIV_floatarith[OF `n < length xs`, of f "xs!n"] isDERIV_approx[OF bnd isD]
```
```  2812   show "DERIV (?i f) (xs!n) :> (?i ?D (xs!n))" by simp
```
```  2813 qed
```
```  2814
```
```  2815 fun lift_bin :: "(float * float) option \<Rightarrow> (float * float) option \<Rightarrow> (float \<Rightarrow> float \<Rightarrow> float \<Rightarrow> float \<Rightarrow> (float * float) option) \<Rightarrow> (float * float) option" where
```
```  2816 "lift_bin (Some (l1, u1)) (Some (l2, u2)) f = f l1 u1 l2 u2" |
```
```  2817 "lift_bin a b f = None"
```
```  2818
```
```  2819 lemma lift_bin:
```
```  2820   assumes lift_bin_Some: "Some (l, u) = lift_bin a b f"
```
```  2821   obtains l1 u1 l2 u2
```
```  2822   where "a = Some (l1, u1)"
```
```  2823   and "b = Some (l2, u2)"
```
```  2824   and "f l1 u1 l2 u2 = Some (l, u)"
```
```  2825 using assms by (cases a, simp, cases b, simp, auto)
```
```  2826
```
```  2827 fun approx_tse where
```
```  2828 "approx_tse prec n 0 c k f bs = approx prec f bs" |
```
```  2829 "approx_tse prec n (Suc s) c k f bs =
```
```  2830   (if isDERIV_approx prec n f bs then
```
```  2831     lift_bin (approx prec f (bs[n := Some (c,c)]))
```
```  2832              (approx_tse prec n s c (Suc k) (DERIV_floatarith n f) bs)
```
```  2833              (\<lambda> l1 u1 l2 u2. approx prec
```
```  2834                  (Add (Var 0)
```
```  2835                       (Mult (Inverse (Num (Float (int k) 0)))
```
```  2836                                  (Mult (Add (Var (Suc (Suc 0))) (Minus (Num c)))
```
```  2837                                        (Var (Suc 0))))) [Some (l1, u1), Some (l2, u2), bs!n])
```
```  2838   else approx prec f bs)"
```
```  2839
```
```  2840 lemma bounded_by_Cons:
```
```  2841   assumes bnd: "bounded_by xs vs"
```
```  2842   and x: "x \<in> { real l .. real u }"
```
```  2843   shows "bounded_by (x#xs) ((Some (l, u))#vs)"
```
```  2844 proof -
```
```  2845   { fix i assume *: "i < length ((Some (l, u))#vs)"
```
```  2846     have "case ((Some (l,u))#vs) ! i of Some (l, u) \<Rightarrow> (x#xs)!i \<in> { real l .. real u } | None \<Rightarrow> True"
```
```  2847     proof (cases i)
```
```  2848       case 0 with x show ?thesis by auto
```
```  2849     next
```
```  2850       case (Suc i) with * have "i < length vs" by auto
```
```  2851       from bnd[THEN bounded_byE, OF this]
```
```  2852       show ?thesis unfolding Suc nth_Cons_Suc .
```
```  2853     qed }
```
```  2854   thus ?thesis by (auto simp add: bounded_by_def)
```
```  2855 qed
```
```  2856
```
```  2857 lemma approx_tse_generic:
```
```  2858   assumes "bounded_by xs vs"
```
```  2859   and bnd_c: "bounded_by (xs[x := c]) vs" and "x < length vs" and "x < length xs"
```
```  2860   and bnd_x: "vs ! x = Some (lx, ux)"
```
```  2861   and ate: "Some (l, u) = approx_tse prec x s c k f vs"
```
```  2862   shows "\<exists> n. (\<forall> m < n. \<forall> (z::real) \<in> {lx .. ux}.
```
```  2863       DERIV (\<lambda> y. interpret_floatarith ((DERIV_floatarith x ^^ m) f) (xs[x := y])) z :>
```
```  2864             (interpret_floatarith ((DERIV_floatarith x ^^ (Suc m)) f) (xs[x := z])))
```
```  2865    \<and> (\<forall> (t::real) \<in> {lx .. ux}.  (\<Sum> i = 0..<n. inverse (real (\<Prod> j \<in> {k..<k+i}. j)) *
```
```  2866                   interpret_floatarith ((DERIV_floatarith x ^^ i) f) (xs[x := c]) *
```
```  2867                   (xs!x - c)^i) +
```
```  2868       inverse (real (\<Prod> j \<in> {k..<k+n}. j)) *
```
```  2869       interpret_floatarith ((DERIV_floatarith x ^^ n) f) (xs[x := t]) *
```
```  2870       (xs!x - c)^n \<in> {l .. u})" (is "\<exists> n. ?taylor f k l u n")
```
```  2871 using ate proof (induct s arbitrary: k f l u)
```
```  2872   case 0
```
```  2873   { fix t::real assume "t \<in> {lx .. ux}"
```
```  2874     note bounded_by_update_var[OF `bounded_by xs vs` bnd_x this]
```
```  2875     from approx[OF this 0[unfolded approx_tse.simps]]
```
```  2876     have "(interpret_floatarith f (xs[x := t])) \<in> {l .. u}"
```
```  2877       by (auto simp add: algebra_simps)
```
```  2878   } thus ?case by (auto intro!: exI[of _ 0])
```
```  2879 next
```
```  2880   case (Suc s)
```
```  2881   show ?case
```
```  2882   proof (cases "isDERIV_approx prec x f vs")
```
```  2883     case False
```
```  2884     note ap = Suc.prems[unfolded approx_tse.simps if_not_P[OF False]]
```
```  2885
```
```  2886     { fix t::real assume "t \<in> {lx .. ux}"
```
```  2887       note bounded_by_update_var[OF `bounded_by xs vs` bnd_x this]
```
```  2888       from approx[OF this ap]
```
```  2889       have "(interpret_floatarith f (xs[x := t])) \<in> {l .. u}"
```
```  2890         by (auto simp add: algebra_simps)
```
```  2891     } thus ?thesis by (auto intro!: exI[of _ 0])
```
```  2892   next
```
```  2893     case True
```
```  2894     with Suc.prems
```
```  2895     obtain l1 u1 l2 u2
```
```  2896       where a: "Some (l1, u1) = approx prec f (vs[x := Some (c,c)])"
```
```  2897       and ate: "Some (l2, u2) = approx_tse prec x s c (Suc k) (DERIV_floatarith x f) vs"
```
```  2898       and final: "Some (l, u) = approx prec
```
```  2899         (Add (Var 0)
```
```  2900              (Mult (Inverse (Num (Float (int k) 0)))
```
```  2901                    (Mult (Add (Var (Suc (Suc 0))) (Minus (Num c)))
```
```  2902                          (Var (Suc 0))))) [Some (l1, u1), Some (l2, u2), vs!x]"
```
```  2903       by (auto elim!: lift_bin) blast
```
```  2904
```
```  2905     from bnd_c `x < length xs`
```
```  2906     have bnd: "bounded_by (xs[x:=c]) (vs[x:= Some (c,c)])"
```
```  2907       by (auto intro!: bounded_by_update)
```
```  2908
```
```  2909     from approx[OF this a]
```
```  2910     have f_c: "interpret_floatarith ((DERIV_floatarith x ^^ 0) f) (xs[x := c]) \<in> { l1 .. u1 }"
```
```  2911               (is "?f 0 (real c) \<in> _")
```
```  2912       by auto
```
```  2913
```
```  2914     { fix f :: "'a \<Rightarrow> 'a" fix n :: nat fix x :: 'a
```
```  2915       have "(f ^^ Suc n) x = (f ^^ n) (f x)"
```
```  2916         by (induct n, auto) }
```
```  2917     note funpow_Suc = this[symmetric]
```
```  2918     from Suc.hyps[OF ate, unfolded this]
```
```  2919     obtain n
```
```  2920       where DERIV_hyp: "\<And> m z. \<lbrakk> m < n ; (z::real) \<in> { lx .. ux } \<rbrakk> \<Longrightarrow> DERIV (?f (Suc m)) z :> ?f (Suc (Suc m)) z"
```
```  2921       and hyp: "\<forall> t \<in> {real lx .. real ux}. (\<Sum> i = 0..<n. inverse (real (\<Prod> j \<in> {Suc k..<Suc k + i}. j)) * ?f (Suc i) c * (xs!x - c)^i) +
```
```  2922            inverse (real (\<Prod> j \<in> {Suc k..<Suc k + n}. j)) * ?f (Suc n) t * (xs!x - c)^n \<in> {l2 .. u2}"
```
```  2923           (is "\<forall> t \<in> _. ?X (Suc k) f n t \<in> _")
```
```  2924       by blast
```
```  2925
```
```  2926     { fix m and z::real
```
```  2927       assume "m < Suc n" and bnd_z: "z \<in> { lx .. ux }"
```
```  2928       have "DERIV (?f m) z :> ?f (Suc m) z"
```
```  2929       proof (cases m)
```
```  2930         case 0
```
```  2931         with DERIV_floatarith[OF `x < length xs` isDERIV_approx'[OF `bounded_by xs vs` bnd_x bnd_z True]]
```
```  2932         show ?thesis by simp
```
```  2933       next
```
```  2934         case (Suc m')
```
```  2935         hence "m' < n" using `m < Suc n` by auto
```
```  2936         from DERIV_hyp[OF this bnd_z]
```
```  2937         show ?thesis using Suc by simp
```
```  2938       qed } note DERIV = this
```
```  2939
```
```  2940     have "\<And> k i. k < i \<Longrightarrow> {k ..< i} = insert k {Suc k ..< i}" by auto
```
```  2941     hence setprod_head_Suc: "\<And> k i. \<Prod> {k ..< k + Suc i} = k * \<Prod> {Suc k ..< Suc k + i}" by auto
```
```  2942     have setsum_move0: "\<And> k F. setsum F {0..<Suc k} = F 0 + setsum (\<lambda> k. F (Suc k)) {0..<k}"
```
```  2943       unfolding setsum_shift_bounds_Suc_ivl[symmetric]
```
```  2944       unfolding setsum_head_upt_Suc[OF zero_less_Suc] ..
```
```  2945     def C \<equiv> "xs!x - c"
```
```  2946
```
```  2947     { fix t::real assume t: "t \<in> {lx .. ux}"
```
```  2948       hence "bounded_by [xs!x] [vs!x]"
```
```  2949         using `bounded_by xs vs`[THEN bounded_byE, OF `x < length vs`]
```
```  2950         by (cases "vs!x", auto simp add: bounded_by_def)
```
```  2951
```
```  2952       with hyp[THEN bspec, OF t] f_c
```
```  2953       have "bounded_by [?f 0 c, ?X (Suc k) f n t, xs!x] [Some (l1, u1), Some (l2, u2), vs!x]"
```
```  2954         by (auto intro!: bounded_by_Cons)
```
```  2955       from approx[OF this final, unfolded atLeastAtMost_iff[symmetric]]
```
```  2956       have "?X (Suc k) f n t * (xs!x - real c) * inverse k + ?f 0 c \<in> {l .. u}"
```
```  2957         by (auto simp add: algebra_simps)
```
```  2958       also have "?X (Suc k) f n t * (xs!x - real c) * inverse (real k) + ?f 0 c =
```
```  2959                (\<Sum> i = 0..<Suc n. inverse (real (\<Prod> j \<in> {k..<k+i}. j)) * ?f i c * (xs!x - c)^i) +
```
```  2960                inverse (real (\<Prod> j \<in> {k..<k+Suc n}. j)) * ?f (Suc n) t * (xs!x - c)^Suc n" (is "_ = ?T")
```
```  2961         unfolding funpow_Suc C_def[symmetric] setsum_move0 setprod_head_Suc
```
```  2962         by (auto simp add: algebra_simps)
```
```  2963           (simp only: mult_left_commute [of _ "inverse (real k)"] setsum_right_distrib [symmetric])
```
```  2964       finally have "?T \<in> {l .. u}" . }
```
```  2965     thus ?thesis using DERIV by blast
```
```  2966   qed
```
```  2967 qed
```
```  2968
```
```  2969 lemma setprod_fact: "\<Prod> {1..<1 + k} = fact (k :: nat)"
```
```  2970 proof (induct k)
```
```  2971   case (Suc k)
```
```  2972   have "{ 1 ..< Suc (Suc k) } = insert (Suc k) { 1 ..< Suc k }" by auto
```
```  2973   hence "\<Prod> { 1 ..< Suc (Suc k) } = (Suc k) * \<Prod> { 1 ..< Suc k }" by auto
```
```  2974   thus ?case using Suc by auto
```
```  2975 qed simp
```
```  2976
```
```  2977 lemma approx_tse:
```
```  2978   assumes "bounded_by xs vs"
```
```  2979   and bnd_x: "vs ! x = Some (lx, ux)" and bnd_c: "real c \<in> {lx .. ux}"
```
```  2980   and "x < length vs" and "x < length xs"
```
```  2981   and ate: "Some (l, u) = approx_tse prec x s c 1 f vs"
```
```  2982   shows "interpret_floatarith f xs \<in> { l .. u }"
```
```  2983 proof -
```
```  2984   def F \<equiv> "\<lambda> n z. interpret_floatarith ((DERIV_floatarith x ^^ n) f) (xs[x := z])"
```
```  2985   hence F0: "F 0 = (\<lambda> z. interpret_floatarith f (xs[x := z]))" by auto
```
```  2986
```
```  2987   hence "bounded_by (xs[x := c]) vs" and "x < length vs" "x < length xs"
```
```  2988     using `bounded_by xs vs` bnd_x bnd_c `x < length vs` `x < length xs`
```
```  2989     by (auto intro!: bounded_by_update_var)
```
```  2990
```
```  2991   from approx_tse_generic[OF `bounded_by xs vs` this bnd_x ate]
```
```  2992   obtain n
```
```  2993     where DERIV: "\<forall> m z. m < n \<and> real lx \<le> z \<and> z \<le> real ux \<longrightarrow> DERIV (F m) z :> F (Suc m) z"
```
```  2994     and hyp: "\<And> (t::real). t \<in> {lx .. ux} \<Longrightarrow>
```
```  2995            (\<Sum> j = 0..<n. inverse (real (fact j)) * F j c * (xs!x - c)^j) +
```
```  2996              inverse (real (fact n)) * F n t * (xs!x - c)^n
```
```  2997              \<in> {l .. u}" (is "\<And> t. _ \<Longrightarrow> ?taylor t \<in> _")
```
```  2998     unfolding F_def atLeastAtMost_iff[symmetric] setprod_fact by blast
```
```  2999
```
```  3000   have bnd_xs: "xs ! x \<in> { lx .. ux }"
```
```  3001     using `bounded_by xs vs`[THEN bounded_byE, OF `x < length vs`] bnd_x by auto
```
```  3002
```
```  3003   show ?thesis
```
```  3004   proof (cases n)
```
```  3005     case 0 thus ?thesis using hyp[OF bnd_xs] unfolding F_def by auto
```
```  3006   next
```
```  3007     case (Suc n')
```
```  3008     show ?thesis
```
```  3009     proof (cases "xs ! x = c")
```
```  3010       case True
```
```  3011       from True[symmetric] hyp[OF bnd_xs] Suc show ?thesis
```
```  3012         unfolding F_def Suc setsum_head_upt_Suc[OF zero_less_Suc] setsum_shift_bounds_Suc_ivl by auto
```
```  3013     next
```
```  3014       case False
```
```  3015
```
```  3016       have "lx \<le> real c" "real c \<le> ux" "lx \<le> xs!x" "xs!x \<le> ux"
```
```  3017         using Suc bnd_c `bounded_by xs vs`[THEN bounded_byE, OF `x < length vs`] bnd_x by auto
```
```  3018       from Taylor.taylor[OF zero_less_Suc, of F, OF F0 DERIV[unfolded Suc] this False]
```
```  3019       obtain t::real where t_bnd: "if xs ! x < c then xs ! x < t \<and> t < c else c < t \<and> t < xs ! x"
```
```  3020         and fl_eq: "interpret_floatarith f (xs[x := xs ! x]) =
```
```  3021            (\<Sum>m = 0..<Suc n'. F m c / real (fact m) * (xs ! x - c) ^ m) +
```
```  3022            F (Suc n') t / real (fact (Suc n')) * (xs ! x - c) ^ Suc n'"
```
```  3023         by blast
```
```  3024
```
```  3025       from t_bnd bnd_xs bnd_c have *: "t \<in> {lx .. ux}"
```
```  3026         by (cases "xs ! x < c", auto)
```
```  3027
```
```  3028       have "interpret_floatarith f (xs[x := xs ! x]) = ?taylor t"
```
```  3029         unfolding fl_eq Suc by (auto simp add: algebra_simps divide_inverse)
```
```  3030       also have "\<dots> \<in> {l .. u}" using * by (rule hyp)
```
```  3031       finally show ?thesis by simp
```
```  3032     qed
```
```  3033   qed
```
```  3034 qed
```
```  3035
```
```  3036 fun approx_tse_form' where
```
```  3037 "approx_tse_form' prec t f 0 l u cmp =
```
```  3038   (case approx_tse prec 0 t ((l + u) * Float 1 -1) 1 f [Some (l, u)]
```
```  3039      of Some (l, u) \<Rightarrow> cmp l u | None \<Rightarrow> False)" |
```
```  3040 "approx_tse_form' prec t f (Suc s) l u cmp =
```
```  3041   (let m = (l + u) * Float 1 -1
```
```  3042    in (if approx_tse_form' prec t f s l m cmp then
```
```  3043       approx_tse_form' prec t f s m u cmp else False))"
```
```  3044
```
```  3045 lemma approx_tse_form':
```
```  3046   fixes x :: real
```
```  3047   assumes "approx_tse_form' prec t f s l u cmp" and "x \<in> {l .. u}"
```
```  3048   shows "\<exists> l' u' ly uy. x \<in> { l' .. u' } \<and> real l \<le> l' \<and> u' \<le> real u \<and> cmp ly uy \<and>
```
```  3049                   approx_tse prec 0 t ((l' + u') * Float 1 -1) 1 f [Some (l', u')] = Some (ly, uy)"
```
```  3050 using assms proof (induct s arbitrary: l u)
```
```  3051   case 0
```
```  3052   then obtain ly uy
```
```  3053     where *: "approx_tse prec 0 t ((l + u) * Float 1 -1) 1 f [Some (l, u)] = Some (ly, uy)"
```
```  3054     and **: "cmp ly uy" by (auto elim!: option_caseE)
```
```  3055   with 0 show ?case by (auto intro!: exI)
```
```  3056 next
```
```  3057   case (Suc s)
```
```  3058   let ?m = "(l + u) * Float 1 -1"
```
```  3059   from Suc.prems
```
```  3060   have l: "approx_tse_form' prec t f s l ?m cmp"
```
```  3061     and u: "approx_tse_form' prec t f s ?m u cmp"
```
```  3062     by (auto simp add: Let_def lazy_conj)
```
```  3063
```
```  3064   have m_l: "real l \<le> ?m" and m_u: "?m \<le> real u"
```
```  3065     unfolding le_float_def using Suc.prems by auto
```
```  3066
```
```  3067   with `x \<in> { l .. u }`
```
```  3068   have "x \<in> { l .. ?m} \<or> x \<in> { ?m .. u }" by auto
```
```  3069   thus ?case
```
```  3070   proof (rule disjE)
```
```  3071     assume "x \<in> { l .. ?m}"
```
```  3072     from Suc.hyps[OF l this]
```
```  3073     obtain l' u' ly uy
```
```  3074       where "x \<in> { l' .. u' } \<and> real l \<le> l' \<and> real u' \<le> ?m \<and> cmp ly uy \<and>
```
```  3075                   approx_tse prec 0 t ((l' + u') * Float 1 -1) 1 f [Some (l', u')] = Some (ly, uy)" by blast
```
```  3076     with m_u show ?thesis by (auto intro!: exI)
```
```  3077   next
```
```  3078     assume "x \<in> { ?m .. u }"
```
```  3079     from Suc.hyps[OF u this]
```
```  3080     obtain l' u' ly uy
```
```  3081       where "x \<in> { l' .. u' } \<and> ?m \<le> real l' \<and> u' \<le> real u \<and> cmp ly uy \<and>
```
```  3082                   approx_tse prec 0 t ((l' + u') * Float 1 -1) 1 f [Some (l', u')] = Some (ly, uy)" by blast
```
```  3083     with m_u show ?thesis by (auto intro!: exI)
```
```  3084   qed
```
```  3085 qed
```
```  3086
```
```  3087 lemma approx_tse_form'_less:
```
```  3088   fixes x :: real
```
```  3089   assumes tse: "approx_tse_form' prec t (Add a (Minus b)) s l u (\<lambda> l u. 0 < l)"
```
```  3090   and x: "x \<in> {l .. u}"
```
```  3091   shows "interpret_floatarith b [x] < interpret_floatarith a [x]"
```
```  3092 proof -
```
```  3093   from approx_tse_form'[OF tse x]
```
```  3094   obtain l' u' ly uy
```
```  3095     where x': "x \<in> { l' .. u' }" and "l \<le> real l'"
```
```  3096     and "real u' \<le> u" and "0 < ly"
```
```  3097     and tse: "approx_tse prec 0 t ((l' + u') * Float 1 -1) 1 (Add a (Minus b)) [Some (l', u')] = Some (ly, uy)"
```
```  3098     by blast
```
```  3099
```
```  3100   hence "bounded_by [x] [Some (l', u')]" by (auto simp add: bounded_by_def)
```
```  3101
```
```  3102   from approx_tse[OF this _ _ _ _ tse[symmetric], of l' u'] x'
```
```  3103   have "ly \<le> interpret_floatarith a [x] - interpret_floatarith b [x]"
```
```  3104     by (auto simp add: diff_minus)
```
```  3105   from order_less_le_trans[OF `0 < ly`[unfolded less_float_def] this]
```
```  3106   show ?thesis by auto
```
```  3107 qed
```
```  3108
```
```  3109 lemma approx_tse_form'_le:
```
```  3110   fixes x :: real
```
```  3111   assumes tse: "approx_tse_form' prec t (Add a (Minus b)) s l u (\<lambda> l u. 0 \<le> l)"
```
```  3112   and x: "x \<in> {l .. u}"
```
```  3113   shows "interpret_floatarith b [x] \<le> interpret_floatarith a [x]"
```
```  3114 proof -
```
```  3115   from approx_tse_form'[OF tse x]
```
```  3116   obtain l' u' ly uy
```
```  3117     where x': "x \<in> { l' .. u' }" and "l \<le> real l'"
```
```  3118     and "real u' \<le> u" and "0 \<le> ly"
```
```  3119     and tse: "approx_tse prec 0 t ((l' + u') * Float 1 -1) 1 (Add a (Minus b)) [Some (l', u')] = Some (ly, uy)"
```
```  3120     by blast
```
```  3121
```
```  3122   hence "bounded_by [x] [Some (l', u')]" by (auto simp add: bounded_by_def)
```
```  3123
```
```  3124   from approx_tse[OF this _ _ _ _ tse[symmetric], of l' u'] x'
```
```  3125   have "ly \<le> interpret_floatarith a [x] - interpret_floatarith b [x]"
```
```  3126     by (auto simp add: diff_minus)
```
```  3127   from order_trans[OF `0 \<le> ly`[unfolded le_float_def] this]
```
```  3128   show ?thesis by auto
```
```  3129 qed
```
```  3130
```
```  3131 definition
```
```  3132 "approx_tse_form prec t s f =
```
```  3133   (case f
```
```  3134    of (Bound x a b f) \<Rightarrow> x = Var 0 \<and>
```
```  3135      (case (approx prec a [None], approx prec b [None])
```
```  3136       of (Some (l, u), Some (l', u')) \<Rightarrow>
```
```  3137         (case f
```
```  3138          of Less lf rt \<Rightarrow> approx_tse_form' prec t (Add rt (Minus lf)) s l u' (\<lambda> l u. 0 < l)
```
```  3139           | LessEqual lf rt \<Rightarrow> approx_tse_form' prec t (Add rt (Minus lf)) s l u' (\<lambda> l u. 0 \<le> l)
```
```  3140           | AtLeastAtMost x lf rt \<Rightarrow>
```
```  3141             (if approx_tse_form' prec t (Add x (Minus lf)) s l u' (\<lambda> l u. 0 \<le> l) then
```
```  3142             approx_tse_form' prec t (Add rt (Minus x)) s l u' (\<lambda> l u. 0 \<le> l) else False)
```
```  3143           | _ \<Rightarrow> False)
```
```  3144        | _ \<Rightarrow> False)
```
```  3145    | _ \<Rightarrow> False)"
```
```  3146
```
```  3147 lemma approx_tse_form:
```
```  3148   assumes "approx_tse_form prec t s f"
```
```  3149   shows "interpret_form f [x]"
```
```  3150 proof (cases f)
```
```  3151   case (Bound i a b f') note f_def = this
```
```  3152   with assms obtain l u l' u'
```
```  3153     where a: "approx prec a [None] = Some (l, u)"
```
```  3154     and b: "approx prec b [None] = Some (l', u')"
```
```  3155     unfolding approx_tse_form_def by (auto elim!: option_caseE)
```
```  3156
```
```  3157   from Bound assms have "i = Var 0" unfolding approx_tse_form_def by auto
```
```  3158   hence i: "interpret_floatarith i [x] = x" by auto
```
```  3159
```
```  3160   { let "?f z" = "interpret_floatarith z [x]"
```
```  3161     assume "?f i \<in> { ?f a .. ?f b }"
```
```  3162     with approx[OF _ a[symmetric], of "[x]"] approx[OF _ b[symmetric], of "[x]"]
```
```  3163     have bnd: "x \<in> { l .. u'}" unfolding bounded_by_def i by auto
```
```  3164
```
```  3165     have "interpret_form f' [x]"
```
```  3166     proof (cases f')
```
```  3167       case (Less lf rt)
```
```  3168       with Bound a b assms
```
```  3169       have "approx_tse_form' prec t (Add rt (Minus lf)) s l u' (\<lambda> l u. 0 < l)"
```
```  3170         unfolding approx_tse_form_def by auto
```
```  3171       from approx_tse_form'_less[OF this bnd]
```
```  3172       show ?thesis using Less by auto
```
```  3173     next
```
```  3174       case (LessEqual lf rt)
```
```  3175       with Bound a b assms
```
```  3176       have "approx_tse_form' prec t (Add rt (Minus lf)) s l u' (\<lambda> l u. 0 \<le> l)"
```
```  3177         unfolding approx_tse_form_def by auto
```
```  3178       from approx_tse_form'_le[OF this bnd]
```
```  3179       show ?thesis using LessEqual by auto
```
```  3180     next
```
```  3181       case (AtLeastAtMost x lf rt)
```
```  3182       with Bound a b assms
```
```  3183       have "approx_tse_form' prec t (Add rt (Minus x)) s l u' (\<lambda> l u. 0 \<le> l)"
```
```  3184         and "approx_tse_form' prec t (Add x (Minus lf)) s l u' (\<lambda> l u. 0 \<le> l)"
```
```  3185         unfolding approx_tse_form_def lazy_conj by auto
```
```  3186       from approx_tse_form'_le[OF this(1) bnd] approx_tse_form'_le[OF this(2) bnd]
```
```  3187       show ?thesis using AtLeastAtMost by auto
```
```  3188     next
```
```  3189       case (Bound x a b f') with assms
```
```  3190       show ?thesis by (auto elim!: option_caseE simp add: f_def approx_tse_form_def)
```
```  3191     next
```
```  3192       case (Assign x a f') with assms
```
```  3193       show ?thesis by (auto elim!: option_caseE simp add: f_def approx_tse_form_def)
```
```  3194     qed } thus ?thesis unfolding f_def by auto
```
```  3195 next case Assign with assms show ?thesis by (auto simp add: approx_tse_form_def)
```
```  3196 next case LessEqual with assms show ?thesis by (auto simp add: approx_tse_form_def)
```
```  3197 next case Less with assms show ?thesis by (auto simp add: approx_tse_form_def)
```
```  3198 next case AtLeastAtMost with assms show ?thesis by (auto simp add: approx_tse_form_def)
```
```  3199 qed
```
```  3200
```
```  3201 text {* @{term approx_form_eval} is only used for the {\tt value}-command. *}
```
```  3202
```
```  3203 fun approx_form_eval :: "nat \<Rightarrow> form \<Rightarrow> (float * float) option list \<Rightarrow> (float * float) option list" where
```
```  3204 "approx_form_eval prec (Bound (Var n) a b f) bs =
```
```  3205    (case (approx prec a bs, approx prec b bs)
```
```  3206    of (Some (l, _), Some (_, u)) \<Rightarrow> approx_form_eval prec f (bs[n := Some (l, u)])
```
```  3207     | _ \<Rightarrow> bs)" |
```
```  3208 "approx_form_eval prec (Assign (Var n) a f) bs =
```
```  3209    (case (approx prec a bs)
```
```  3210    of (Some (l, u)) \<Rightarrow> approx_form_eval prec f (bs[n := Some (l, u)])
```
```  3211     | _ \<Rightarrow> bs)" |
```
```  3212 "approx_form_eval prec (Less a b) bs = bs @ [approx prec a bs, approx prec b bs]" |
```
```  3213 "approx_form_eval prec (LessEqual a b) bs = bs @ [approx prec a bs, approx prec b bs]" |
```
```  3214 "approx_form_eval prec (AtLeastAtMost x a b) bs =
```
```  3215    bs @ [approx prec x bs, approx prec a bs, approx prec b bs]" |
```
```  3216 "approx_form_eval _ _ bs = bs"
```
```  3217
```
```  3218 subsection {* Implement proof method \texttt{approximation} *}
```
```  3219
```
```  3220 lemmas interpret_form_equations = interpret_form.simps interpret_floatarith.simps interpret_floatarith_num
```
```  3221   interpret_floatarith_divide interpret_floatarith_diff interpret_floatarith_tan interpret_floatarith_powr interpret_floatarith_log
```
```  3222   interpret_floatarith_sin
```
```  3223
```
```  3224 oracle approximation_oracle = {* fn (thy, t) =>
```
```  3225 let
```
```  3226
```
```  3227   fun bad t = error ("Bad term: " ^ Syntax.string_of_term_global thy t);
```
```  3228
```
```  3229   fun term_of_bool true = @{term True}
```
```  3230     | term_of_bool false = @{term False};
```
```  3231
```
```  3232   fun term_of_float (@{code Float} (k, l)) =
```
```  3233     @{term Float} \$ HOLogic.mk_number @{typ int} k \$ HOLogic.mk_number @{typ int} l;
```
```  3234
```
```  3235   fun term_of_float_float_option NONE = @{term "None :: (float \<times> float) option"}
```
```  3236     | term_of_float_float_option (SOME ff) = @{term "Some :: float \<times> float \<Rightarrow> _"}
```
```  3237         \$ HOLogic.mk_prod (pairself term_of_float ff);
```
```  3238
```
```  3239   val term_of_float_float_option_list =
```
```  3240     HOLogic.mk_list @{typ "(float \<times> float) option"} o map term_of_float_float_option;
```
```  3241
```
```  3242   fun nat_of_term t = HOLogic.dest_nat t handle TERM _ => snd (HOLogic.dest_number t);
```
```  3243
```
```  3244   fun float_of_term (@{term Float} \$ k \$ l) =
```
```  3245         @{code Float} (snd (HOLogic.dest_number k), snd (HOLogic.dest_number l))
```
```  3246     | float_of_term t = bad t;
```
```  3247
```
```  3248   fun floatarith_of_term (@{term Add} \$ a \$ b) = @{code Add} (floatarith_of_term a, floatarith_of_term b)
```
```  3249     | floatarith_of_term (@{term Minus} \$ a) = @{code Minus} (floatarith_of_term a)
```
```  3250     | floatarith_of_term (@{term Mult} \$ a \$ b) = @{code Mult} (floatarith_of_term a, floatarith_of_term b)
```
```  3251     | floatarith_of_term (@{term Inverse} \$ a) = @{code Inverse} (floatarith_of_term a)
```
```  3252     | floatarith_of_term (@{term Cos} \$ a) = @{code Cos} (floatarith_of_term a)
```
```  3253     | floatarith_of_term (@{term Arctan} \$ a) = @{code Arctan} (floatarith_of_term a)
```
```  3254     | floatarith_of_term (@{term Abs} \$ a) = @{code Abs} (floatarith_of_term a)
```
```  3255     | floatarith_of_term (@{term Max} \$ a \$ b) = @{code Max} (floatarith_of_term a, floatarith_of_term b)
```
```  3256     | floatarith_of_term (@{term Min} \$ a \$ b) = @{code Min} (floatarith_of_term a, floatarith_of_term b)
```
```  3257     | floatarith_of_term @{term Pi} = @{code Pi}
```
```  3258     | floatarith_of_term (@{term Sqrt} \$ a) = @{code Sqrt} (floatarith_of_term a)
```
```  3259     | floatarith_of_term (@{term Exp} \$ a) = @{code Exp} (floatarith_of_term a)
```
```  3260     | floatarith_of_term (@{term Ln} \$ a) = @{code Ln} (floatarith_of_term a)
```
```  3261     | floatarith_of_term (@{term Power} \$ a \$ n) =
```
```  3262         @{code Power} (floatarith_of_term a, nat_of_term n)
```
```  3263     | floatarith_of_term (@{term Var} \$ n) = @{code Var} (nat_of_term n)
```
```  3264     | floatarith_of_term (@{term Num} \$ m) = @{code Num} (float_of_term m)
```
```  3265     | floatarith_of_term t = bad t;
```
```  3266
```
```  3267   fun form_of_term (@{term Bound} \$ a \$ b \$ c \$ p) = @{code Bound}
```
```  3268         (floatarith_of_term a, floatarith_of_term b, floatarith_of_term c, form_of_term p)
```
```  3269     | form_of_term (@{term Assign} \$ a \$ b \$ p) = @{code Assign}
```
```  3270         (floatarith_of_term a, floatarith_of_term b, form_of_term p)
```
```  3271     | form_of_term (@{term Less} \$ a \$ b) = @{code Less}
```
```  3272         (floatarith_of_term a, floatarith_of_term b)
```
```  3273     | form_of_term (@{term LessEqual} \$ a \$ b) = @{code LessEqual}
```
```  3274         (floatarith_of_term a, floatarith_of_term b)
```
```  3275     | form_of_term (@{term AtLeastAtMost} \$ a \$ b \$ c) = @{code AtLeastAtMost}
```
```  3276         (floatarith_of_term a, floatarith_of_term b, floatarith_of_term c)
```
```  3277     | form_of_term t = bad t;
```
```  3278
```
```  3279   fun float_float_option_of_term @{term "None :: (float \<times> float) option"} = NONE
```
```  3280     | float_float_option_of_term (@{term "Some :: float \<times> float \<Rightarrow> _"} \$ ff) =
```
```  3281         SOME (pairself float_of_term (HOLogic.dest_prod ff))
```
```  3282     | float_float_option_of_term (@{term approx'} \$ n \$ a \$ ffs) = @{code approx'}
```
```  3283         (nat_of_term n) (floatarith_of_term a) (float_float_option_list_of_term ffs)
```
```  3284     | float_float_option_of_term t = bad t
```
```  3285   and float_float_option_list_of_term
```
```  3286         (@{term "replicate :: _ \<Rightarrow> (float \<times> float) option \<Rightarrow> _"} \$ n \$ @{term "None :: (float \<times> float) option"}) =
```
```  3287           @{code replicate} (nat_of_term n) NONE
```
```  3288     | float_float_option_list_of_term (@{term approx_form_eval} \$ n \$ p \$ ffs) =
```
```  3289         @{code approx_form_eval} (nat_of_term n) (form_of_term p) (float_float_option_list_of_term ffs)
```
```  3290     | float_float_option_list_of_term t = map float_float_option_of_term
```
```  3291         (HOLogic.dest_list t);
```
```  3292
```
```  3293   val nat_list_of_term = map nat_of_term o HOLogic.dest_list ;
```
```  3294
```
```  3295   fun bool_of_term (@{term approx_form} \$ n \$ p \$ ffs \$ ms) = @{code approx_form}
```
```  3296         (nat_of_term n) (form_of_term p) (float_float_option_list_of_term ffs) (nat_list_of_term ms)
```
```  3297     | bool_of_term (@{term approx_tse_form} \$ m \$ n \$ q \$ p) =
```
```  3298         @{code approx_tse_form} (nat_of_term m) (nat_of_term n) (nat_of_term q) (form_of_term p)
```
```  3299     | bool_of_term t = bad t;
```
```  3300
```
```  3301   fun eval t = case fastype_of t
```
```  3302    of @{typ bool} =>
```
```  3303         (term_of_bool o bool_of_term) t
```
```  3304     | @{typ "(float \<times> float) option"} =>
```
```  3305         (term_of_float_float_option o float_float_option_of_term) t
```
```  3306     | @{typ "(float \<times> float) option list"} =>
```
```  3307         (term_of_float_float_option_list o float_float_option_list_of_term) t
```
```  3308     | _ => bad t;
```
```  3309
```
```  3310   val normalize = eval o Envir.beta_norm o Pattern.eta_long [];
```
```  3311
```
```  3312 in Thm.cterm_of thy (Logic.mk_equals (t, normalize t)) end
```
```  3313 *}
```
```  3314
```
```  3315 ML {*
```
```  3316   fun reorder_bounds_tac prems i =
```
```  3317     let
```
```  3318       fun variable_of_bound (Const (@{const_name Trueprop}, _) \$
```
```  3319                              (Const (@{const_name Set.member}, _) \$
```
```  3320                               Free (name, _) \$ _)) = name
```
```  3321         | variable_of_bound (Const (@{const_name Trueprop}, _) \$
```
```  3322                              (Const (@{const_name HOL.eq}, _) \$
```
```  3323                               Free (name, _) \$ _)) = name
```
```  3324         | variable_of_bound t = raise TERM ("variable_of_bound", [t])
```
```  3325
```
```  3326       val variable_bounds
```
```  3327         = map (` (variable_of_bound o prop_of)) prems
```
```  3328
```
```  3329       fun add_deps (name, bnds)
```
```  3330         = Graph.add_deps_acyclic (name,
```
```  3331             remove (op =) name (Term.add_free_names (prop_of bnds) []))
```
```  3332
```
```  3333       val order = Graph.empty
```
```  3334                   |> fold Graph.new_node variable_bounds
```
```  3335                   |> fold add_deps variable_bounds
```
```  3336                   |> Graph.strong_conn |> map the_single |> rev
```
```  3337                   |> map_filter (AList.lookup (op =) variable_bounds)
```
```  3338
```
```  3339       fun prepend_prem th tac
```
```  3340         = tac THEN rtac (th RSN (2, @{thm mp})) i
```
```  3341     in
```
```  3342       fold prepend_prem order all_tac
```
```  3343     end
```
```  3344
```
```  3345   fun approximation_conv ctxt ct =
```
```  3346     approximation_oracle (Proof_Context.theory_of ctxt, Thm.term_of ct |> tap (tracing o Syntax.string_of_term ctxt));
```
```  3347
```
```  3348   fun approximate ctxt t =
```
```  3349     approximation_oracle (Proof_Context.theory_of ctxt, t)
```
```  3350     |> Thm.prop_of |> Logic.dest_equals |> snd;
```
```  3351
```
```  3352   (* Should be in HOL.thy ? *)
```
```  3353   fun gen_eval_tac conv ctxt = CONVERSION
```
```  3354     (Object_Logic.judgment_conv (Conv.params_conv (~1) (K (Conv.concl_conv (~1) conv)) ctxt))
```
```  3355     THEN' rtac TrueI
```
```  3356
```
```  3357   val form_equations = @{thms interpret_form_equations};
```
```  3358
```
```  3359   fun rewrite_interpret_form_tac ctxt prec splitting taylor i st = let
```
```  3360       fun lookup_splitting (Free (name, typ))
```
```  3361         = case AList.lookup (op =) splitting name
```
```  3362           of SOME s => HOLogic.mk_number @{typ nat} s
```
```  3363            | NONE => @{term "0 :: nat"}
```
```  3364       val vs = nth (prems_of st) (i - 1)
```
```  3365                |> Logic.strip_imp_concl
```
```  3366                |> HOLogic.dest_Trueprop
```
```  3367                |> Term.strip_comb |> snd |> List.last
```
```  3368                |> HOLogic.dest_list
```
```  3369       val p = prec
```
```  3370               |> HOLogic.mk_number @{typ nat}
```
```  3371               |> Thm.cterm_of (Proof_Context.theory_of ctxt)
```
```  3372     in case taylor
```
```  3373     of NONE => let
```
```  3374          val n = vs |> length
```
```  3375                  |> HOLogic.mk_number @{typ nat}
```
```  3376                  |> Thm.cterm_of (Proof_Context.theory_of ctxt)
```
```  3377          val s = vs
```
```  3378                  |> map lookup_splitting
```
```  3379                  |> HOLogic.mk_list @{typ nat}
```
```  3380                  |> Thm.cterm_of (Proof_Context.theory_of ctxt)
```
```  3381        in
```
```  3382          (rtac (Thm.instantiate ([], [(@{cpat "?n::nat"}, n),
```
```  3383                                      (@{cpat "?prec::nat"}, p),
```
```  3384                                      (@{cpat "?ss::nat list"}, s)])
```
```  3385               @{thm "approx_form"}) i
```
```  3386           THEN simp_tac @{simpset} i) st
```
```  3387        end
```
```  3388
```
```  3389      | SOME t => if length vs <> 1 then raise (TERM ("More than one variable used for taylor series expansion", [prop_of st]))
```
```  3390        else let
```
```  3391          val t = t
```
```  3392               |> HOLogic.mk_number @{typ nat}
```
```  3393               |> Thm.cterm_of (Proof_Context.theory_of ctxt)
```
```  3394          val s = vs |> map lookup_splitting |> hd
```
```  3395               |> Thm.cterm_of (Proof_Context.theory_of ctxt)
```
```  3396        in
```
```  3397          rtac (Thm.instantiate ([], [(@{cpat "?s::nat"}, s),
```
```  3398                                      (@{cpat "?t::nat"}, t),
```
```  3399                                      (@{cpat "?prec::nat"}, p)])
```
```  3400               @{thm "approx_tse_form"}) i st
```
```  3401        end
```
```  3402     end
```
```  3403
```
```  3404   (* copied from Tools/induct.ML should probably in args.ML *)
```
```  3405   val free = Args.context -- Args.term >> (fn (_, Free (n, t)) => n | (ctxt, t) =>
```
```  3406     error ("Bad free variable: " ^ Syntax.string_of_term ctxt t));
```
```  3407
```
```  3408 *}
```
```  3409
```
```  3410 lemma intervalE: "a \<le> x \<and> x \<le> b \<Longrightarrow> \<lbrakk> x \<in> { a .. b } \<Longrightarrow> P\<rbrakk> \<Longrightarrow> P"
```
```  3411   by auto
```
```  3412
```
```  3413 lemma meta_eqE: "x \<equiv> a \<Longrightarrow> \<lbrakk> x = a \<Longrightarrow> P\<rbrakk> \<Longrightarrow> P"
```
```  3414   by auto
```
```  3415
```
```  3416 method_setup approximation = {*
```
```  3417   Scan.lift Parse.nat
```
```  3418   --
```
```  3419   Scan.optional (Scan.lift (Args.\$\$\$ "splitting" |-- Args.colon)
```
```  3420     |-- Parse.and_list' (free --| Scan.lift (Args.\$\$\$ "=") -- Scan.lift Parse.nat)) []
```
```  3421   --
```
```  3422   Scan.option (Scan.lift (Args.\$\$\$ "taylor" |-- Args.colon)
```
```  3423     |-- (free |-- Scan.lift (Args.\$\$\$ "=") |-- Scan.lift Parse.nat))
```
```  3424   >>
```
```  3425   (fn ((prec, splitting), taylor) => fn ctxt =>
```
```  3426     SIMPLE_METHOD' (fn i =>
```
```  3427       REPEAT (FIRST' [etac @{thm intervalE},
```
```  3428                       etac @{thm meta_eqE},
```
```  3429                       rtac @{thm impI}] i)
```
```  3430       THEN Subgoal.FOCUS (fn {prems, ...} => reorder_bounds_tac prems i) @{context} i
```
```  3431       THEN DETERM (TRY (filter_prems_tac (K false) i))
```
```  3432       THEN DETERM (Reflection.genreify_tac ctxt form_equations NONE i)
```
```  3433       THEN rewrite_interpret_form_tac ctxt prec splitting taylor i
```
```  3434       THEN gen_eval_tac (approximation_conv ctxt) ctxt i))
```
```  3435  *} "real number approximation"
```
```  3436
```
```  3437 ML {*
```
```  3438   fun calculated_subterms (@{const Trueprop} \$ t) = calculated_subterms t
```
```  3439     | calculated_subterms (@{const HOL.implies} \$ _ \$ t) = calculated_subterms t
```
```  3440     | calculated_subterms (@{term "op <= :: real \<Rightarrow> real \<Rightarrow> bool"} \$ t1 \$ t2) = [t1, t2]
```
```  3441     | calculated_subterms (@{term "op < :: real \<Rightarrow> real \<Rightarrow> bool"} \$ t1 \$ t2) = [t1, t2]
```
```  3442     | calculated_subterms (@{term "op : :: real \<Rightarrow> real set \<Rightarrow> bool"} \$ t1 \$
```
```  3443                            (@{term "atLeastAtMost :: real \<Rightarrow> real \<Rightarrow> real set"} \$ t2 \$ t3)) = [t1, t2, t3]
```
```  3444     | calculated_subterms t = raise TERM ("calculated_subterms", [t])
```
```  3445
```
```  3446   fun dest_interpret_form (@{const "interpret_form"} \$ b \$ xs) = (b, xs)
```
```  3447     | dest_interpret_form t = raise TERM ("dest_interpret_form", [t])
```
```  3448
```
```  3449   fun dest_interpret (@{const "interpret_floatarith"} \$ b \$ xs) = (b, xs)
```
```  3450     | dest_interpret t = raise TERM ("dest_interpret", [t])
```
```  3451
```
```  3452
```
```  3453   fun dest_float (@{const "Float"} \$ m \$ e) = (snd (HOLogic.dest_number m), snd (HOLogic.dest_number e))
```
```  3454   fun dest_ivl (Const (@{const_name "Some"}, _) \$
```
```  3455                 (Const (@{const_name Pair}, _) \$ u \$ l)) = SOME (dest_float u, dest_float l)
```
```  3456     | dest_ivl (Const (@{const_name "None"}, _)) = NONE
```
```  3457     | dest_ivl t = raise TERM ("dest_result", [t])
```
```  3458
```
```  3459   fun mk_approx' prec t = (@{const "approx'"}
```
```  3460                          \$ HOLogic.mk_number @{typ nat} prec
```
```  3461                          \$ t \$ @{term "[] :: (float * float) option list"})
```
```  3462
```
```  3463   fun mk_approx_form_eval prec t xs = (@{const "approx_form_eval"}
```
```  3464                          \$ HOLogic.mk_number @{typ nat} prec
```
```  3465                          \$ t \$ xs)
```
```  3466
```
```  3467   fun float2_float10 prec round_down (m, e) = (
```
```  3468     let
```
```  3469       val (m, e) = (if e < 0 then (m,e) else (m * Integer.pow e 2, 0))
```
```  3470
```
```  3471       fun frac c p 0 digits cnt = (digits, cnt, 0)
```
```  3472         | frac c 0 r digits cnt = (digits, cnt, r)
```
```  3473         | frac c p r digits cnt = (let
```
```  3474           val (d, r) = Integer.div_mod (r * 10) (Integer.pow (~e) 2)
```
```  3475         in frac (c orelse d <> 0) (if d <> 0 orelse c then p - 1 else p) r
```
```  3476                 (digits * 10 + d) (cnt + 1)
```
```  3477         end)
```
```  3478
```
```  3479       val sgn = Int.sign m
```
```  3480       val m = abs m
```
```  3481
```
```  3482       val round_down = (sgn = 1 andalso round_down) orelse
```
```  3483                        (sgn = ~1 andalso not round_down)
```
```  3484
```
```  3485       val (x, r) = Integer.div_mod m (Integer.pow (~e) 2)
```
```  3486
```
```  3487       val p = ((if x = 0 then prec else prec - (IntInf.log2 x + 1)) * 3) div 10 + 1
```
```  3488
```
```  3489       val (digits, e10, r) = if p > 0 then frac (x <> 0) p r 0 0 else (0,0,0)
```
```  3490
```
```  3491       val digits = if round_down orelse r = 0 then digits else digits + 1
```
```  3492
```
```  3493     in (sgn * (digits + x * (Integer.pow e10 10)), ~e10)
```
```  3494     end)
```
```  3495
```
```  3496   fun mk_result prec (SOME (l, u)) = (let
```
```  3497       fun mk_float10 rnd x = (let val (m, e) = float2_float10 prec rnd x
```
```  3498                          in if e = 0 then HOLogic.mk_number @{typ real} m
```
```  3499                        else if e = 1 then @{term "divide :: real \<Rightarrow> real \<Rightarrow> real"} \$
```
```  3500                                           HOLogic.mk_number @{typ real} m \$
```
```  3501                                           @{term "10"}
```
```  3502                                      else @{term "divide :: real \<Rightarrow> real \<Rightarrow> real"} \$
```
```  3503                                           HOLogic.mk_number @{typ real} m \$
```
```  3504                                           (@{term "power 10 :: nat \<Rightarrow> real"} \$
```
```  3505                                            HOLogic.mk_number @{typ nat} (~e)) end)
```
```  3506       in @{term "atLeastAtMost :: real \<Rightarrow> real \<Rightarrow> real set"} \$ mk_float10 true l \$ mk_float10 false u end)
```
```  3507     | mk_result prec NONE = @{term "UNIV :: real set"}
```
```  3508
```
```  3509   fun realify t = let
```
```  3510       val t = Logic.varify_global t
```
```  3511       val m = map (fn (name, sort) => (name, @{typ real})) (Term.add_tvars t [])
```
```  3512       val t = Term.subst_TVars m t
```
```  3513     in t end
```
```  3514
```
```  3515   fun converted_result t =
```
```  3516           prop_of t
```
```  3517        |> HOLogic.dest_Trueprop
```
```  3518        |> HOLogic.dest_eq |> snd
```
```  3519
```
```  3520   fun apply_tactic context term tactic = cterm_of context term
```
```  3521     |> Goal.init
```
```  3522     |> SINGLE tactic
```
```  3523     |> the |> prems_of |> hd
```
```  3524
```
```  3525   fun prepare_form context term = apply_tactic context term (
```
```  3526       REPEAT (FIRST' [etac @{thm intervalE}, etac @{thm meta_eqE}, rtac @{thm impI}] 1)
```
```  3527       THEN Subgoal.FOCUS (fn {prems, ...} => reorder_bounds_tac prems 1) @{context} 1
```
```  3528       THEN DETERM (TRY (filter_prems_tac (K false) 1)))
```
```  3529
```
```  3530   fun reify_form context term = apply_tactic context term
```
```  3531      (Reflection.genreify_tac @{context} form_equations NONE 1)
```
```  3532
```
```  3533   fun approx_form prec ctxt t =
```
```  3534           realify t
```
```  3535        |> prepare_form (Proof_Context.theory_of ctxt)
```
```  3536        |> (fn arith_term =>
```
```  3537           reify_form (Proof_Context.theory_of ctxt) arith_term
```
```  3538        |> HOLogic.dest_Trueprop |> dest_interpret_form
```
```  3539        |> (fn (data, xs) =>
```
```  3540           mk_approx_form_eval prec data (HOLogic.mk_list @{typ "(float * float) option"}
```
```  3541             (map (fn _ => @{term "None :: (float * float) option"}) (HOLogic.dest_list xs)))
```
```  3542        |> approximate ctxt
```
```  3543        |> HOLogic.dest_list
```
```  3544        |> curry ListPair.zip (HOLogic.dest_list xs @ calculated_subterms arith_term)
```
```  3545        |> map (fn (elem, s) => @{term "op : :: real \<Rightarrow> real set \<Rightarrow> bool"} \$ elem \$ mk_result prec (dest_ivl s))
```
```  3546        |> foldr1 HOLogic.mk_conj))
```
```  3547
```
```  3548   fun approx_arith prec ctxt t = realify t
```
```  3549        |> Reflection.genreif ctxt form_equations
```
```  3550        |> prop_of
```
```  3551        |> HOLogic.dest_Trueprop
```
```  3552        |> HOLogic.dest_eq |> snd
```
```  3553        |> dest_interpret |> fst
```
```  3554        |> mk_approx' prec
```
```  3555        |> approximate ctxt
```
```  3556        |> dest_ivl
```
```  3557        |> mk_result prec
```
```  3558
```
```  3559    fun approx prec ctxt t = if type_of t = @{typ prop} then approx_form prec ctxt t
```
```  3560      else if type_of t = @{typ bool} then approx_form prec ctxt (@{const Trueprop} \$ t)
```
```  3561      else approx_arith prec ctxt t
```
```  3562 *}
```
```  3563
```
```  3564 setup {*
```
```  3565   Value.add_evaluator ("approximate", approx 30)
```
```  3566 *}
```
```  3567
```
```  3568 end
```
```  3569
```