Add approximation method
authorhoelzl
Thu Feb 05 11:49:15 2009 +0100 (2009-02-05)
changeset 29805a5da150bd0ab
parent 29804 e15b74577368
child 29809 df25a6b1a475
Add approximation method
NEWS
src/HOL/IsaMakefile
src/HOL/Library/reflection.ML
src/HOL/Reflection/Approximation.thy
src/HOL/Reflection/ROOT.ML
src/HOL/ex/ApproximationEx.thy
     1.1 --- a/NEWS	Thu Feb 05 11:45:15 2009 +0100
     1.2 +++ b/NEWS	Thu Feb 05 11:49:15 2009 +0100
     1.3 @@ -197,7 +197,11 @@
     1.4  are treated as expected by the 'class' command.
     1.5  
     1.6  * Theory "Reflection" now resides in HOL/Library.  Common reflection examples
     1.7 -(Cooper, MIR, Ferrack) now in distinct session directory HOL/Reflection.
     1.8 +(Cooper, MIR, Ferrack, Approximation) now in distinct session directory
     1.9 +HOL/Reflection. Here Approximation provides the new proof method
    1.10 +"approximation". It proves formulas on real values by using interval arithmetic.
    1.11 +In the formulas are also the transcendental functions sin, cos, tan, atan, ln
    1.12 +and exp are allowed.
    1.13  
    1.14  * Entry point to Word library now simply named "Word".  INCOMPATIBILITY.
    1.15  
     2.1 --- a/src/HOL/IsaMakefile	Thu Feb 05 11:45:15 2009 +0100
     2.2 +++ b/src/HOL/IsaMakefile	Thu Feb 05 11:49:15 2009 +0100
     2.3 @@ -684,6 +684,7 @@
     2.4  HOL-Reflection: HOL $(LOG)/HOL-Reflection.gz
     2.5  
     2.6  $(LOG)/HOL-Reflection.gz: $(OUT)/HOL \
     2.7 +  Reflection/Approximation.thy \
     2.8    Reflection/Cooper.thy \
     2.9    Reflection/cooper_tac.ML \
    2.10    Reflection/Ferrack.thy \
    2.11 @@ -836,7 +837,8 @@
    2.12    ex/svc_funcs.ML ex/svc_test.thy	\
    2.13    ex/ImperativeQuicksort.thy	\
    2.14    ex/Arithmetic_Series_Complex.thy ex/HarmonicSeries.thy	\
    2.15 -  ex/Sqrt.thy ex/Sqrt_Script.thy
    2.16 +  ex/Sqrt.thy ex/Sqrt_Script.thy \
    2.17 +  ex/ApproximationEx.thy
    2.18  	@$(ISABELLE_TOOL) usedir $(OUT)/HOL ex
    2.19  
    2.20  
     3.1 --- a/src/HOL/Library/reflection.ML	Thu Feb 05 11:45:15 2009 +0100
     3.2 +++ b/src/HOL/Library/reflection.ML	Thu Feb 05 11:49:15 2009 +0100
     3.3 @@ -306,8 +306,8 @@
     3.4  
     3.5  fun genreify_tac ctxt eqs to i = (fn st =>
     3.6    let
     3.7 -    val P = HOLogic.dest_Trueprop (List.nth (prems_of st, i - 1))
     3.8 -    val t = (case to of NONE => P | SOME x => x)
     3.9 +    fun P () = HOLogic.dest_Trueprop (List.nth (prems_of st, i - 1))
    3.10 +    val t = (case to of NONE => P () | SOME x => x)
    3.11      val th = (genreif ctxt eqs t) RS ssubst
    3.12    in rtac th i st
    3.13    end);
     4.1 --- /dev/null	Thu Jan 01 00:00:00 1970 +0000
     4.2 +++ b/src/HOL/Reflection/Approximation.thy	Thu Feb 05 11:49:15 2009 +0100
     4.3 @@ -0,0 +1,2507 @@
     4.4 +(* Title:     HOL/Reflection/Approximation.thy
     4.5 + * Author:    Johannes Hölzl <hoelzl@in.tum.de> 2008 / 2009
     4.6 + *)
     4.7 +header {* Prove unequations about real numbers by computation *}
     4.8 +theory Approximation
     4.9 +imports Complex_Main Float Reflection Efficient_Nat
    4.10 +begin
    4.11 +
    4.12 +section "Horner Scheme"
    4.13 +
    4.14 +subsection {* Define auxiliary helper @{text horner} function *}
    4.15 +
    4.16 +fun horner :: "(nat \<Rightarrow> nat) \<Rightarrow> (nat \<Rightarrow> nat \<Rightarrow> nat) \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> real \<Rightarrow> real" where
    4.17 +"horner F G 0 i k x       = 0" |
    4.18 +"horner F G (Suc n) i k x = 1 / real k - x * horner F G n (F i) (G i k) x"
    4.19 +
    4.20 +lemma horner_schema': fixes x :: real  and a :: "nat \<Rightarrow> real"
    4.21 +  shows "a 0 - x * (\<Sum> i=0..<n. (-1)^i * a (Suc i) * x^i) = (\<Sum> i=0..<Suc n. (-1)^i * a i * x^i)"
    4.22 +proof -
    4.23 +  have shift_pow: "\<And>i. - (x * ((-1)^i * a (Suc i) * x ^ i)) = (-1)^(Suc i) * a (Suc i) * x ^ (Suc i)" by auto
    4.24 +  show ?thesis unfolding setsum_right_distrib shift_pow real_diff_def setsum_negf[symmetric] setsum_head_upt_Suc[OF zero_less_Suc]
    4.25 +    setsum_reindex[OF inj_Suc, unfolded comp_def, symmetric, of "\<lambda> n. (-1)^n  *a n * x^n"] by auto
    4.26 +qed
    4.27 +
    4.28 +lemma horner_schema: fixes f :: "nat \<Rightarrow> nat" and G :: "nat \<Rightarrow> nat \<Rightarrow> nat" and F :: "nat \<Rightarrow> nat"
    4.29 +  assumes f_Suc: "\<And>n. f (Suc n) = G ((F^n) s) (f n)"
    4.30 +  shows "horner F G n ((F^j') s) (f j') x = (\<Sum> j = 0..< n. -1^j * (1 / real (f (j' + j))) * x^j)"
    4.31 +proof (induct n arbitrary: i k j')
    4.32 +  case (Suc n)
    4.33 +
    4.34 +  show ?case unfolding horner.simps Suc[where j'="Suc j'", unfolded funpow.simps comp_def f_Suc]
    4.35 +    using horner_schema'[of "\<lambda> j. 1 / real (f (j' + j))"] by auto
    4.36 +qed auto
    4.37 +
    4.38 +lemma horner_bounds':
    4.39 +  assumes "0 \<le> Ifloat x" and f_Suc: "\<And>n. f (Suc n) = G ((F^n) s) (f n)"
    4.40 +  and lb_0: "\<And> i k x. lb 0 i k x = 0"
    4.41 +  and lb_Suc: "\<And> n i k x. lb (Suc n) i k x = lapprox_rat prec 1 (int k) - x * (ub n (F i) (G i k) x)"
    4.42 +  and ub_0: "\<And> i k x. ub 0 i k x = 0"
    4.43 +  and ub_Suc: "\<And> n i k x. ub (Suc n) i k x = rapprox_rat prec 1 (int k) - x * (lb n (F i) (G i k) x)"
    4.44 +  shows "Ifloat (lb n ((F^j') s) (f j') x) \<le> horner F G n ((F^j') s) (f j') (Ifloat x) \<and> 
    4.45 +         horner F G n ((F^j') s) (f j') (Ifloat x) \<le> Ifloat (ub n ((F^j') s) (f j') x)"
    4.46 +  (is "?lb n j' \<le> ?horner n j' \<and> ?horner n j' \<le> ?ub n j'")
    4.47 +proof (induct n arbitrary: j')
    4.48 +  case 0 thus ?case unfolding lb_0 ub_0 horner.simps by auto
    4.49 +next
    4.50 +  case (Suc n)
    4.51 +  have "?lb (Suc n) j' \<le> ?horner (Suc n) j'" unfolding lb_Suc ub_Suc horner.simps Ifloat_sub diff_def
    4.52 +  proof (rule add_mono)
    4.53 +    show "Ifloat (lapprox_rat prec 1 (int (f j'))) \<le> 1 / real (f j')" using lapprox_rat[of prec 1  "int (f j')"] by auto
    4.54 +    from Suc[where j'="Suc j'", unfolded funpow.simps comp_def f_Suc, THEN conjunct2] `0 \<le> Ifloat x`
    4.55 +    show "- Ifloat (x * ub n (F ((F ^ j') s)) (G ((F ^ j') s) (f j')) x) \<le> - (Ifloat x * horner F G n (F ((F ^ j') s)) (G ((F ^ j') s) (f j')) (Ifloat x))"
    4.56 +      unfolding Ifloat_mult neg_le_iff_le by (rule mult_left_mono)
    4.57 +  qed
    4.58 +  moreover have "?horner (Suc n) j' \<le> ?ub (Suc n) j'" unfolding ub_Suc ub_Suc horner.simps Ifloat_sub diff_def
    4.59 +  proof (rule add_mono)
    4.60 +    show "1 / real (f j') \<le> Ifloat (rapprox_rat prec 1 (int (f j')))" using rapprox_rat[of 1 "int (f j')" prec] by auto
    4.61 +    from Suc[where j'="Suc j'", unfolded funpow.simps comp_def f_Suc, THEN conjunct1] `0 \<le> Ifloat x`
    4.62 +    show "- (Ifloat x * horner F G n (F ((F ^ j') s)) (G ((F ^ j') s) (f j')) (Ifloat x)) \<le> 
    4.63 +          - Ifloat (x * lb n (F ((F ^ j') s)) (G ((F ^ j') s) (f j')) x)"
    4.64 +      unfolding Ifloat_mult neg_le_iff_le by (rule mult_left_mono)
    4.65 +  qed
    4.66 +  ultimately show ?case by blast
    4.67 +qed
    4.68 +
    4.69 +subsection "Theorems for floating point functions implementing the horner scheme"
    4.70 +
    4.71 +text {*
    4.72 +
    4.73 +Here @{term_type "f :: nat \<Rightarrow> nat"} is the sequence defining the Taylor series, the coefficients are
    4.74 +all alternating and reciprocs. We use @{term G} and @{term F} to describe the computation of @{term f}.
    4.75 +
    4.76 +*}
    4.77 +
    4.78 +lemma horner_bounds: fixes F :: "nat \<Rightarrow> nat" and G :: "nat \<Rightarrow> nat \<Rightarrow> nat"
    4.79 +  assumes "0 \<le> Ifloat x" and f_Suc: "\<And>n. f (Suc n) = G ((F^n) s) (f n)"
    4.80 +  and lb_0: "\<And> i k x. lb 0 i k x = 0"
    4.81 +  and lb_Suc: "\<And> n i k x. lb (Suc n) i k x = lapprox_rat prec 1 (int k) - x * (ub n (F i) (G i k) x)"
    4.82 +  and ub_0: "\<And> i k x. ub 0 i k x = 0"
    4.83 +  and ub_Suc: "\<And> n i k x. ub (Suc n) i k x = rapprox_rat prec 1 (int k) - x * (lb n (F i) (G i k) x)"
    4.84 +  shows "Ifloat (lb n ((F^j') s) (f j') x) \<le> (\<Sum>j=0..<n. -1^j * (1 / real (f (j' + j))) * (Ifloat x)^j)" (is "?lb") and 
    4.85 +        "(\<Sum>j=0..<n. -1^j * (1 / real (f (j' + j))) * (Ifloat x)^j) \<le> Ifloat (ub n ((F^j') s) (f j') x)" (is "?ub")
    4.86 +proof -
    4.87 +  have "?lb  \<and> ?ub" 
    4.88 +    using horner_bounds'[where lb=lb, OF `0 \<le> Ifloat x` f_Suc lb_0 lb_Suc ub_0 ub_Suc]
    4.89 +    unfolding horner_schema[where f=f, OF f_Suc] .
    4.90 +  thus "?lb" and "?ub" by auto
    4.91 +qed
    4.92 +
    4.93 +lemma horner_bounds_nonpos: fixes F :: "nat \<Rightarrow> nat" and G :: "nat \<Rightarrow> nat \<Rightarrow> nat"
    4.94 +  assumes "Ifloat x \<le> 0" and f_Suc: "\<And>n. f (Suc n) = G ((F^n) s) (f n)"
    4.95 +  and lb_0: "\<And> i k x. lb 0 i k x = 0"
    4.96 +  and lb_Suc: "\<And> n i k x. lb (Suc n) i k x = lapprox_rat prec 1 (int k) + x * (ub n (F i) (G i k) x)"
    4.97 +  and ub_0: "\<And> i k x. ub 0 i k x = 0"
    4.98 +  and ub_Suc: "\<And> n i k x. ub (Suc n) i k x = rapprox_rat prec 1 (int k) + x * (lb n (F i) (G i k) x)"
    4.99 +  shows "Ifloat (lb n ((F^j') s) (f j') x) \<le> (\<Sum>j=0..<n. (1 / real (f (j' + j))) * (Ifloat x)^j)" (is "?lb") and 
   4.100 +        "(\<Sum>j=0..<n. (1 / real (f (j' + j))) * (Ifloat x)^j) \<le> Ifloat (ub n ((F^j') s) (f j') x)" (is "?ub")
   4.101 +proof -
   4.102 +  { fix x y z :: float have "x - y * z = x + - y * z"
   4.103 +      by (cases x, cases y, cases z, simp add: plus_float.simps minus_float.simps uminus_float.simps times_float.simps algebra_simps)
   4.104 +  } note diff_mult_minus = this
   4.105 +
   4.106 +  { fix x :: float have "- (- x) = x" by (cases x, auto simp add: uminus_float.simps) } note minus_minus = this
   4.107 +
   4.108 +  have move_minus: "Ifloat (-x) = -1 * Ifloat x" by auto
   4.109 +
   4.110 +  have sum_eq: "(\<Sum>j=0..<n. (1 / real (f (j' + j))) * (Ifloat x)^j) = 
   4.111 +    (\<Sum>j = 0..<n. -1 ^ j * (1 / real (f (j' + j))) * Ifloat (- x) ^ j)"
   4.112 +  proof (rule setsum_cong, simp)
   4.113 +    fix j assume "j \<in> {0 ..< n}"
   4.114 +    show "1 / real (f (j' + j)) * Ifloat x ^ j = -1 ^ j * (1 / real (f (j' + j))) * Ifloat (- x) ^ j"
   4.115 +      unfolding move_minus power_mult_distrib real_mult_assoc[symmetric]
   4.116 +      unfolding real_mult_commute unfolding real_mult_assoc[of "-1^j", symmetric] power_mult_distrib[symmetric]
   4.117 +      by auto
   4.118 +  qed
   4.119 +
   4.120 +  have "0 \<le> Ifloat (-x)" using assms by auto
   4.121 +  from horner_bounds[where G=G and F=F and f=f and s=s and prec=prec
   4.122 +    and lb="\<lambda> n i k x. lb n i k (-x)" and ub="\<lambda> n i k x. ub n i k (-x)", unfolded lb_Suc ub_Suc diff_mult_minus,
   4.123 +    OF this f_Suc lb_0 refl ub_0 refl]
   4.124 +  show "?lb" and "?ub" unfolding minus_minus sum_eq
   4.125 +    by auto
   4.126 +qed
   4.127 +
   4.128 +subsection {* Selectors for next even or odd number *}
   4.129 +
   4.130 +text {*
   4.131 +
   4.132 +The horner scheme computes alternating series. To get the upper and lower bounds we need to
   4.133 +guarantee to access a even or odd member. To do this we use @{term get_odd} and @{term get_even}.
   4.134 +
   4.135 +*}
   4.136 +
   4.137 +definition get_odd :: "nat \<Rightarrow> nat" where
   4.138 +  "get_odd n = (if odd n then n else (Suc n))"
   4.139 +
   4.140 +definition get_even :: "nat \<Rightarrow> nat" where
   4.141 +  "get_even n = (if even n then n else (Suc n))"
   4.142 +
   4.143 +lemma get_odd[simp]: "odd (get_odd n)" unfolding get_odd_def by (cases "odd n", auto)
   4.144 +lemma get_even[simp]: "even (get_even n)" unfolding get_even_def by (cases "even n", auto)
   4.145 +lemma get_odd_ex: "\<exists> k. Suc k = get_odd n \<and> odd (Suc k)"
   4.146 +proof (cases "odd n")
   4.147 +  case True hence "0 < n" by (rule odd_pos)
   4.148 +  from gr0_implies_Suc[OF this] obtain k where "Suc k = n" by auto 
   4.149 +  thus ?thesis unfolding get_odd_def if_P[OF True] using True[unfolded `Suc k = n`[symmetric]] by blast
   4.150 +next
   4.151 +  case False hence "odd (Suc n)" by auto
   4.152 +  thus ?thesis unfolding get_odd_def if_not_P[OF False] by blast
   4.153 +qed
   4.154 +
   4.155 +lemma get_even_double: "\<exists>i. get_even n = 2 * i" using get_even[unfolded even_mult_two_ex] .
   4.156 +lemma get_odd_double: "\<exists>i. get_odd n = 2 * i + 1" using get_odd[unfolded odd_Suc_mult_two_ex] by auto
   4.157 +
   4.158 +section "Power function"
   4.159 +
   4.160 +definition float_power_bnds :: "nat \<Rightarrow> float \<Rightarrow> float \<Rightarrow> float * float" where
   4.161 +"float_power_bnds n l u = (if odd n \<or> 0 < l then (l ^ n, u ^ n)
   4.162 +                      else if u < 0         then (u ^ n, l ^ n)
   4.163 +                                            else (0, (max (-l) u) ^ n))"
   4.164 +
   4.165 +lemma float_power_bnds: assumes "(l1, u1) = float_power_bnds n l u" and "x \<in> {Ifloat l .. Ifloat u}"
   4.166 +  shows "x^n \<in> {Ifloat l1..Ifloat u1}"
   4.167 +proof (cases "even n")
   4.168 +  case True 
   4.169 +  show ?thesis
   4.170 +  proof (cases "0 < l")
   4.171 +    case True hence "odd n \<or> 0 < l" and "0 \<le> Ifloat l" unfolding less_float_def by auto
   4.172 +    have u1: "u1 = u ^ n" and l1: "l1 = l ^ n" using assms unfolding float_power_bnds_def if_P[OF `odd n \<or> 0 < l`] by auto
   4.173 +    have "Ifloat l^n \<le> x^n" and "x^n \<le> Ifloat u^n " using `0 \<le> Ifloat l` and assms unfolding atLeastAtMost_iff using power_mono[of "Ifloat l" x] power_mono[of x "Ifloat u"] by auto
   4.174 +    thus ?thesis using assms `0 < l` unfolding atLeastAtMost_iff l1 u1 float_power less_float_def by auto
   4.175 +  next
   4.176 +    case False hence P: "\<not> (odd n \<or> 0 < l)" using `even n` by auto
   4.177 +    show ?thesis
   4.178 +    proof (cases "u < 0")
   4.179 +      case True hence "0 \<le> - Ifloat u" and "- Ifloat u \<le> - x" and "0 \<le> - x" and "-x \<le> - Ifloat l" using assms unfolding less_float_def by auto
   4.180 +      hence "Ifloat u^n \<le> x^n" and "x^n \<le> Ifloat l^n" using power_mono[of  "-x" "-Ifloat l" n] power_mono[of "-Ifloat u" "-x" n] 
   4.181 +	unfolding power_minus_even[OF `even n`] by auto
   4.182 +      moreover have u1: "u1 = l ^ n" and l1: "l1 = u ^ n" using assms unfolding float_power_bnds_def if_not_P[OF P] if_P[OF True] by auto
   4.183 +      ultimately show ?thesis using float_power by auto
   4.184 +    next
   4.185 +      case False 
   4.186 +      have "\<bar>x\<bar> \<le> Ifloat (max (-l) u)"
   4.187 +      proof (cases "-l \<le> u")
   4.188 +	case True thus ?thesis unfolding max_def if_P[OF True] using assms unfolding le_float_def by auto
   4.189 +      next
   4.190 +	case False thus ?thesis unfolding max_def if_not_P[OF False] using assms unfolding le_float_def by auto
   4.191 +      qed
   4.192 +      hence x_abs: "\<bar>x\<bar> \<le> \<bar>Ifloat (max (-l) u)\<bar>" by auto
   4.193 +      have u1: "u1 = (max (-l) u) ^ n" and l1: "l1 = 0" using assms unfolding float_power_bnds_def if_not_P[OF P] if_not_P[OF False] by auto
   4.194 +      show ?thesis unfolding atLeastAtMost_iff l1 u1 float_power using zero_le_even_power[OF `even n`] power_mono_even[OF `even n` x_abs] by auto
   4.195 +    qed
   4.196 +  qed
   4.197 +next
   4.198 +  case False hence "odd n \<or> 0 < l" by auto
   4.199 +  have u1: "u1 = u ^ n" and l1: "l1 = l ^ n" using assms unfolding float_power_bnds_def if_P[OF `odd n \<or> 0 < l`] by auto
   4.200 +  have "Ifloat l^n \<le> x^n" and "x^n \<le> Ifloat u^n " using assms unfolding atLeastAtMost_iff using power_mono_odd[OF False] by auto
   4.201 +  thus ?thesis unfolding atLeastAtMost_iff l1 u1 float_power less_float_def by auto
   4.202 +qed
   4.203 +
   4.204 +lemma bnds_power: "\<forall> x l u. (l1, u1) = float_power_bnds n l u \<and> x \<in> {Ifloat l .. Ifloat u} \<longrightarrow> Ifloat l1 \<le> x^n \<and> x^n \<le> Ifloat u1"
   4.205 +  using float_power_bnds by auto
   4.206 +
   4.207 +section "Square root"
   4.208 +
   4.209 +text {*
   4.210 +
   4.211 +The square root computation is implemented as newton iteration. As first first step we use the
   4.212 +nearest power of two greater than the square root.
   4.213 +
   4.214 +*}
   4.215 +
   4.216 +fun sqrt_iteration :: "nat \<Rightarrow> nat \<Rightarrow> float \<Rightarrow> float" where
   4.217 +"sqrt_iteration prec 0 (Float m e) = Float 1 ((e + bitlen m) div 2 + 1)" |
   4.218 +"sqrt_iteration prec (Suc m) x = (let y = sqrt_iteration prec m x 
   4.219 +                                  in Float 1 -1 * (y + float_divr prec x y))"
   4.220 +
   4.221 +definition ub_sqrt :: "nat \<Rightarrow> float \<Rightarrow> float option" where 
   4.222 +"ub_sqrt prec x = (if 0 < x then Some (sqrt_iteration prec prec x) else if x < 0 then None else Some 0)"
   4.223 +
   4.224 +definition lb_sqrt :: "nat \<Rightarrow> float \<Rightarrow> float option" where
   4.225 +"lb_sqrt prec x = (if 0 < x then Some (float_divl prec x (sqrt_iteration prec prec x)) else if x < 0 then None else Some 0)"
   4.226 +
   4.227 +lemma sqrt_ub_pos_pos_1:
   4.228 +  assumes "sqrt x < b" and "0 < b" and "0 < x"
   4.229 +  shows "sqrt x < (b + x / b)/2"
   4.230 +proof -
   4.231 +  from assms have "0 < (b - sqrt x) ^ 2 " by simp
   4.232 +  also have "\<dots> = b ^ 2 - 2 * b * sqrt x + (sqrt x) ^ 2" by algebra
   4.233 +  also have "\<dots> = b ^ 2 - 2 * b * sqrt x + x" using assms by (simp add: real_sqrt_pow2)
   4.234 +  finally have "0 < b ^ 2 - 2 * b * sqrt x + x" by assumption
   4.235 +  hence "0 < b / 2 - sqrt x + x / (2 * b)" using assms
   4.236 +    by (simp add: field_simps power2_eq_square)
   4.237 +  thus ?thesis by (simp add: field_simps)
   4.238 +qed
   4.239 +
   4.240 +lemma sqrt_iteration_bound: assumes "0 < Ifloat x"
   4.241 +  shows "sqrt (Ifloat x) < Ifloat (sqrt_iteration prec n x)"
   4.242 +proof (induct n)
   4.243 +  case 0
   4.244 +  show ?case
   4.245 +  proof (cases x)
   4.246 +    case (Float m e)
   4.247 +    hence "0 < m" using float_pos_m_pos[unfolded less_float_def] assms by auto
   4.248 +    hence "0 < sqrt (real m)" by auto
   4.249 +
   4.250 +    have int_nat_bl: "int (nat (bitlen m)) = bitlen m" using bitlen_ge0 by auto
   4.251 +
   4.252 +    have "Ifloat x = (real m / 2^nat (bitlen m)) * pow2 (e + int (nat (bitlen m)))"
   4.253 +      unfolding pow2_add pow2_int Float Ifloat.simps by auto
   4.254 +    also have "\<dots> < 1 * pow2 (e + int (nat (bitlen m)))"
   4.255 +    proof (rule mult_strict_right_mono, auto)
   4.256 +      show "real m < 2^nat (bitlen m)" using bitlen_bounds[OF `0 < m`, THEN conjunct2] 
   4.257 +	unfolding real_of_int_less_iff[of m, symmetric] by auto
   4.258 +    qed
   4.259 +    finally have "sqrt (Ifloat x) < sqrt (pow2 (e + bitlen m))" unfolding int_nat_bl by auto
   4.260 +    also have "\<dots> \<le> pow2 ((e + bitlen m) div 2 + 1)"
   4.261 +    proof -
   4.262 +      let ?E = "e + bitlen m"
   4.263 +      have E_mod_pow: "pow2 (?E mod 2) < 4"
   4.264 +      proof (cases "?E mod 2 = 1")
   4.265 +	case True thus ?thesis by auto
   4.266 +      next
   4.267 +	case False 
   4.268 +	have "0 \<le> ?E mod 2" by auto 
   4.269 +	have "?E mod 2 < 2" by auto
   4.270 +	from this[THEN zless_imp_add1_zle]
   4.271 +	have "?E mod 2 \<le> 0" using False by auto
   4.272 +	from xt1(5)[OF `0 \<le> ?E mod 2` this]
   4.273 +	show ?thesis by auto
   4.274 +      qed
   4.275 +      hence "sqrt (pow2 (?E mod 2)) < sqrt (2 * 2)" by auto
   4.276 +      hence E_mod_pow: "sqrt (pow2 (?E mod 2)) < 2" unfolding real_sqrt_abs2 by auto
   4.277 +
   4.278 +      have E_eq: "pow2 ?E = pow2 (?E div 2 + ?E div 2 + ?E mod 2)" by auto
   4.279 +      have "sqrt (pow2 ?E) = sqrt (pow2 (?E div 2) * pow2 (?E div 2) * pow2 (?E mod 2))"
   4.280 +	unfolding E_eq unfolding pow2_add ..
   4.281 +      also have "\<dots> = pow2 (?E div 2) * sqrt (pow2 (?E mod 2))"
   4.282 +	unfolding real_sqrt_mult[of _ "pow2 (?E mod 2)"] real_sqrt_abs2 by auto
   4.283 +      also have "\<dots> < pow2 (?E div 2) * 2" 
   4.284 +	by (rule mult_strict_left_mono, auto intro: E_mod_pow)
   4.285 +      also have "\<dots> = pow2 (?E div 2 + 1)" unfolding zadd_commute[of _ 1] pow2_add1 by auto
   4.286 +      finally show ?thesis by auto
   4.287 +    qed
   4.288 +    finally show ?thesis 
   4.289 +      unfolding Float sqrt_iteration.simps Ifloat.simps by auto
   4.290 +  qed
   4.291 +next
   4.292 +  case (Suc n)
   4.293 +  let ?b = "sqrt_iteration prec n x"
   4.294 +  have "0 < sqrt (Ifloat x)" using `0 < Ifloat x` by auto
   4.295 +  also have "\<dots> < Ifloat ?b" using Suc .
   4.296 +  finally have "sqrt (Ifloat x) < (Ifloat ?b + Ifloat x / Ifloat ?b)/2" using sqrt_ub_pos_pos_1[OF Suc _ `0 < Ifloat x`] by auto
   4.297 +  also have "\<dots> \<le> (Ifloat ?b + Ifloat (float_divr prec x ?b))/2" by (rule divide_right_mono, auto simp add: float_divr)
   4.298 +  also have "\<dots> = Ifloat (Float 1 -1) * (Ifloat ?b + Ifloat (float_divr prec x ?b))" by auto
   4.299 +  finally show ?case unfolding sqrt_iteration.simps Let_def Ifloat_mult Ifloat_add right_distrib .
   4.300 +qed
   4.301 +
   4.302 +lemma sqrt_iteration_lower_bound: assumes "0 < Ifloat x"
   4.303 +  shows "0 < Ifloat (sqrt_iteration prec n x)" (is "0 < ?sqrt")
   4.304 +proof -
   4.305 +  have "0 < sqrt (Ifloat x)" using assms by auto
   4.306 +  also have "\<dots> < ?sqrt" using sqrt_iteration_bound[OF assms] .
   4.307 +  finally show ?thesis .
   4.308 +qed
   4.309 +
   4.310 +lemma lb_sqrt_lower_bound: assumes "0 \<le> Ifloat x"
   4.311 +  shows "0 \<le> Ifloat (the (lb_sqrt prec x))"
   4.312 +proof (cases "0 < x")
   4.313 +  case True hence "0 < Ifloat x" and "0 \<le> x" using `0 \<le> Ifloat x` unfolding less_float_def le_float_def by auto
   4.314 +  hence "0 < sqrt_iteration prec prec x" unfolding less_float_def using sqrt_iteration_lower_bound by auto 
   4.315 +  hence "0 \<le> Ifloat (float_divl prec x (sqrt_iteration prec prec x))" using float_divl_lower_bound[OF `0 \<le> x`] unfolding le_float_def by auto
   4.316 +  thus ?thesis unfolding lb_sqrt_def using True by auto
   4.317 +next
   4.318 +  case False with `0 \<le> Ifloat x` have "Ifloat x = 0" unfolding less_float_def by auto
   4.319 +  thus ?thesis unfolding lb_sqrt_def less_float_def by auto
   4.320 +qed
   4.321 +
   4.322 +lemma lb_sqrt_upper_bound: assumes "0 \<le> Ifloat x"
   4.323 +  shows "Ifloat (the (lb_sqrt prec x)) \<le> sqrt (Ifloat x)"
   4.324 +proof (cases "0 < x")
   4.325 +  case True hence "0 < Ifloat x" and "0 \<le> Ifloat x" unfolding less_float_def by auto
   4.326 +  hence sqrt_gt0: "0 < sqrt (Ifloat x)" by auto
   4.327 +  hence sqrt_ub: "sqrt (Ifloat x) < Ifloat (sqrt_iteration prec prec x)" using sqrt_iteration_bound by auto
   4.328 +  
   4.329 +  have "Ifloat (float_divl prec x (sqrt_iteration prec prec x)) \<le> Ifloat x / Ifloat (sqrt_iteration prec prec x)" by (rule float_divl)
   4.330 +  also have "\<dots> < Ifloat x / sqrt (Ifloat x)" 
   4.331 +    by (rule divide_strict_left_mono[OF sqrt_ub `0 < Ifloat x` mult_pos_pos[OF order_less_trans[OF sqrt_gt0 sqrt_ub] sqrt_gt0]])
   4.332 +  also have "\<dots> = sqrt (Ifloat x)" unfolding inverse_eq_iff_eq[of _ "sqrt (Ifloat x)", symmetric] sqrt_divide_self_eq[OF `0 \<le> Ifloat x`, symmetric] by auto
   4.333 +  finally show ?thesis unfolding lb_sqrt_def if_P[OF `0 < x`] by auto
   4.334 +next
   4.335 +  case False with `0 \<le> Ifloat x`
   4.336 +  have "\<not> x < 0" unfolding less_float_def le_float_def by auto
   4.337 +  show ?thesis unfolding lb_sqrt_def if_not_P[OF False] if_not_P[OF `\<not> x < 0`] using assms by auto
   4.338 +qed
   4.339 +
   4.340 +lemma lb_sqrt: assumes "Some y = lb_sqrt prec x"
   4.341 +  shows "Ifloat y \<le> sqrt (Ifloat x)" and "0 \<le> Ifloat x"
   4.342 +proof -
   4.343 +  show "0 \<le> Ifloat x"
   4.344 +  proof (rule ccontr)
   4.345 +    assume "\<not> 0 \<le> Ifloat x"
   4.346 +    hence "lb_sqrt prec x = None" unfolding lb_sqrt_def less_float_def by auto
   4.347 +    thus False using assms by auto
   4.348 +  qed
   4.349 +  from lb_sqrt_upper_bound[OF this, of prec]
   4.350 +  show "Ifloat y \<le> sqrt (Ifloat x)" unfolding assms[symmetric] by auto
   4.351 +qed
   4.352 +
   4.353 +lemma ub_sqrt_lower_bound: assumes "0 \<le> Ifloat x"
   4.354 +  shows "sqrt (Ifloat x) \<le> Ifloat (the (ub_sqrt prec x))"
   4.355 +proof (cases "0 < x")
   4.356 +  case True hence "0 < Ifloat x" unfolding less_float_def by auto
   4.357 +  hence "0 < sqrt (Ifloat x)" by auto
   4.358 +  hence "sqrt (Ifloat x) < Ifloat (sqrt_iteration prec prec x)" using sqrt_iteration_bound by auto
   4.359 +  thus ?thesis unfolding ub_sqrt_def if_P[OF `0 < x`] by auto
   4.360 +next
   4.361 +  case False with `0 \<le> Ifloat x`
   4.362 +  have "Ifloat x = 0" unfolding less_float_def le_float_def by auto
   4.363 +  thus ?thesis unfolding ub_sqrt_def less_float_def le_float_def by auto
   4.364 +qed
   4.365 +
   4.366 +lemma ub_sqrt: assumes "Some y = ub_sqrt prec x"
   4.367 +  shows "sqrt (Ifloat x) \<le> Ifloat y" and "0 \<le> Ifloat x"
   4.368 +proof -
   4.369 +  show "0 \<le> Ifloat x"
   4.370 +  proof (rule ccontr)
   4.371 +    assume "\<not> 0 \<le> Ifloat x"
   4.372 +    hence "ub_sqrt prec x = None" unfolding ub_sqrt_def less_float_def by auto
   4.373 +    thus False using assms by auto
   4.374 +  qed
   4.375 +  from ub_sqrt_lower_bound[OF this, of prec]
   4.376 +  show "sqrt (Ifloat x) \<le> Ifloat y" unfolding assms[symmetric] by auto
   4.377 +qed
   4.378 +
   4.379 +lemma bnds_sqrt: "\<forall> x lx ux. (Some l, Some u) = (lb_sqrt prec lx, ub_sqrt prec ux) \<and> x \<in> {Ifloat lx .. Ifloat ux} \<longrightarrow> Ifloat l \<le> sqrt x \<and> sqrt x \<le> Ifloat u"
   4.380 +proof (rule allI, rule allI, rule allI, rule impI)
   4.381 +  fix x lx ux
   4.382 +  assume "(Some l, Some u) = (lb_sqrt prec lx, ub_sqrt prec ux) \<and> x \<in> {Ifloat lx .. Ifloat ux}"
   4.383 +  hence l: "Some l = lb_sqrt prec lx " and u: "Some u = ub_sqrt prec ux" and x: "x \<in> {Ifloat lx .. Ifloat ux}" by auto
   4.384 +  
   4.385 +  have "Ifloat lx \<le> x" and "x \<le> Ifloat ux" using x by auto
   4.386 +
   4.387 +  from lb_sqrt(1)[OF l] real_sqrt_le_mono[OF `Ifloat lx \<le> x`]
   4.388 +  have "Ifloat l \<le> sqrt x" by (rule order_trans)
   4.389 +  moreover
   4.390 +  from real_sqrt_le_mono[OF `x \<le> Ifloat ux`] ub_sqrt(1)[OF u]
   4.391 +  have "sqrt x \<le> Ifloat u" by (rule order_trans)
   4.392 +  ultimately show "Ifloat l \<le> sqrt x \<and> sqrt x \<le> Ifloat u" ..
   4.393 +qed
   4.394 +
   4.395 +section "Arcus tangens and \<pi>"
   4.396 +
   4.397 +subsection "Compute arcus tangens series"
   4.398 +
   4.399 +text {*
   4.400 +
   4.401 +As first step we implement the computation of the arcus tangens series. This is only valid in the range
   4.402 +@{term "{-1 :: real .. 1}"}. This is used to compute \<pi> and then the entire arcus tangens.
   4.403 +
   4.404 +*}
   4.405 +
   4.406 +fun ub_arctan_horner :: "nat \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> float \<Rightarrow> float"
   4.407 +and lb_arctan_horner :: "nat \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> float \<Rightarrow> float" where
   4.408 +  "ub_arctan_horner prec 0 k x = 0"
   4.409 +| "ub_arctan_horner prec (Suc n) k x = 
   4.410 +    (rapprox_rat prec 1 (int k)) - x * (lb_arctan_horner prec n (k + 2) x)"
   4.411 +| "lb_arctan_horner prec 0 k x = 0"
   4.412 +| "lb_arctan_horner prec (Suc n) k x = 
   4.413 +    (lapprox_rat prec 1 (int k)) - x * (ub_arctan_horner prec n (k + 2) x)"
   4.414 +
   4.415 +lemma arctan_0_1_bounds': assumes "0 \<le> Ifloat x" "Ifloat x \<le> 1" and "even n"
   4.416 +  shows "arctan (Ifloat x) \<in> {Ifloat (x * lb_arctan_horner prec n 1 (x * x)) .. Ifloat (x * ub_arctan_horner prec (Suc n) 1 (x * x))}"
   4.417 +proof -
   4.418 +  let "?c i" = "-1^i * (1 / real (i * 2 + 1) * Ifloat x ^ (i * 2 + 1))"
   4.419 +  let "?S n" = "\<Sum> i=0..<n. ?c i"
   4.420 +
   4.421 +  have "0 \<le> Ifloat (x * x)" by auto
   4.422 +  from `even n` obtain m where "2 * m = n" unfolding even_mult_two_ex by auto
   4.423 +  
   4.424 +  have "arctan (Ifloat x) \<in> { ?S n .. ?S (Suc n) }"
   4.425 +  proof (cases "Ifloat x = 0")
   4.426 +    case False
   4.427 +    hence "0 < Ifloat x" using `0 \<le> Ifloat x` by auto
   4.428 +    hence prem: "0 < 1 / real (0 * 2 + (1::nat)) * Ifloat x ^ (0 * 2 + 1)" by auto 
   4.429 +
   4.430 +    have "\<bar> Ifloat x \<bar> \<le> 1"  using `0 \<le> Ifloat x` `Ifloat x \<le> 1` by auto
   4.431 +    from mp[OF summable_Leibniz(2)[OF zeroseq_arctan_series[OF this] monoseq_arctan_series[OF this]] prem, THEN spec, of m, unfolded `2 * m = n`]
   4.432 +    show ?thesis unfolding arctan_series[OF `\<bar> Ifloat x \<bar> \<le> 1`] Suc_plus1  .
   4.433 +  qed auto
   4.434 +  note arctan_bounds = this[unfolded atLeastAtMost_iff]
   4.435 +
   4.436 +  have F: "\<And>n. 2 * Suc n + 1 = 2 * n + 1 + 2" by auto
   4.437 +
   4.438 +  note bounds = horner_bounds[where s=1 and f="\<lambda>i. 2 * i + 1" and j'=0 
   4.439 +    and lb="\<lambda>n i k x. lb_arctan_horner prec n k x"
   4.440 +    and ub="\<lambda>n i k x. ub_arctan_horner prec n k x", 
   4.441 +    OF `0 \<le> Ifloat (x*x)` F lb_arctan_horner.simps ub_arctan_horner.simps]
   4.442 +
   4.443 +  { have "Ifloat (x * lb_arctan_horner prec n 1 (x*x)) \<le> ?S n"
   4.444 +      using bounds(1) `0 \<le> Ifloat x`
   4.445 +      unfolding Ifloat_mult power_add power_one_right real_mult_assoc[symmetric] setsum_left_distrib[symmetric]
   4.446 +      unfolding real_mult_commute mult_commute[of _ "2::nat"] power_mult power2_eq_square[of "Ifloat x"]
   4.447 +      by (auto intro!: mult_left_mono)
   4.448 +    also have "\<dots> \<le> arctan (Ifloat x)" using arctan_bounds ..
   4.449 +    finally have "Ifloat (x * lb_arctan_horner prec n 1 (x*x)) \<le> arctan (Ifloat x)" . }
   4.450 +  moreover
   4.451 +  { have "arctan (Ifloat x) \<le> ?S (Suc n)" using arctan_bounds ..
   4.452 +    also have "\<dots> \<le> Ifloat (x * ub_arctan_horner prec (Suc n) 1 (x*x))"
   4.453 +      using bounds(2)[of "Suc n"] `0 \<le> Ifloat x`
   4.454 +      unfolding Ifloat_mult power_add power_one_right real_mult_assoc[symmetric] setsum_left_distrib[symmetric]
   4.455 +      unfolding real_mult_commute mult_commute[of _ "2::nat"] power_mult power2_eq_square[of "Ifloat x"]
   4.456 +      by (auto intro!: mult_left_mono)
   4.457 +    finally have "arctan (Ifloat x) \<le> Ifloat (x * ub_arctan_horner prec (Suc n) 1 (x*x))" . }
   4.458 +  ultimately show ?thesis by auto
   4.459 +qed
   4.460 +
   4.461 +lemma arctan_0_1_bounds: assumes "0 \<le> Ifloat x" "Ifloat x \<le> 1"
   4.462 +  shows "arctan (Ifloat x) \<in> {Ifloat (x * lb_arctan_horner prec (get_even n) 1 (x * x)) .. Ifloat (x * ub_arctan_horner prec (get_odd n) 1 (x * x))}"
   4.463 +proof (cases "even n")
   4.464 +  case True
   4.465 +  obtain n' where "Suc n' = get_odd n" and "odd (Suc n')" using get_odd_ex by auto
   4.466 +  hence "even n'" unfolding even_nat_Suc by auto
   4.467 +  have "arctan (Ifloat x) \<le> Ifloat (x * ub_arctan_horner prec (get_odd n) 1 (x * x))"
   4.468 +    unfolding `Suc n' = get_odd n`[symmetric] using arctan_0_1_bounds'[OF `0 \<le> Ifloat x` `Ifloat x \<le> 1` `even n'`] by auto
   4.469 +  moreover
   4.470 +  have "Ifloat (x * lb_arctan_horner prec (get_even n) 1 (x * x)) \<le> arctan (Ifloat x)"
   4.471 +    unfolding get_even_def if_P[OF True] using arctan_0_1_bounds'[OF `0 \<le> Ifloat x` `Ifloat x \<le> 1` `even n`] by auto
   4.472 +  ultimately show ?thesis by auto
   4.473 +next
   4.474 +  case False hence "0 < n" by (rule odd_pos)
   4.475 +  from gr0_implies_Suc[OF this] obtain n' where "n = Suc n'" ..
   4.476 +  from False[unfolded this even_nat_Suc]
   4.477 +  have "even n'" and "even (Suc (Suc n'))" by auto
   4.478 +  have "get_odd n = Suc n'" unfolding get_odd_def if_P[OF False] using `n = Suc n'` .
   4.479 +
   4.480 +  have "arctan (Ifloat x) \<le> Ifloat (x * ub_arctan_horner prec (get_odd n) 1 (x * x))"
   4.481 +    unfolding `get_odd n = Suc n'` using arctan_0_1_bounds'[OF `0 \<le> Ifloat x` `Ifloat x \<le> 1` `even n'`] by auto
   4.482 +  moreover
   4.483 +  have "Ifloat (x * lb_arctan_horner prec (get_even n) 1 (x * x)) \<le> arctan (Ifloat x)"
   4.484 +    unfolding get_even_def if_not_P[OF False] unfolding `n = Suc n'` using arctan_0_1_bounds'[OF `0 \<le> Ifloat x` `Ifloat x \<le> 1` `even (Suc (Suc n'))`] by auto
   4.485 +  ultimately show ?thesis by auto
   4.486 +qed
   4.487 +
   4.488 +subsection "Compute \<pi>"
   4.489 +
   4.490 +definition ub_pi :: "nat \<Rightarrow> float" where
   4.491 +  "ub_pi prec = (let A = rapprox_rat prec 1 5 ; 
   4.492 +                     B = lapprox_rat prec 1 239
   4.493 +                 in ((Float 1 2) * ((Float 1 2) * A * (ub_arctan_horner prec (get_odd (prec div 4 + 1)) 1 (A * A)) - 
   4.494 +                                                  B * (lb_arctan_horner prec (get_even (prec div 14 + 1)) 1 (B * B)))))"
   4.495 +
   4.496 +definition lb_pi :: "nat \<Rightarrow> float" where
   4.497 +  "lb_pi prec = (let A = lapprox_rat prec 1 5 ; 
   4.498 +                     B = rapprox_rat prec 1 239
   4.499 +                 in ((Float 1 2) * ((Float 1 2) * A * (lb_arctan_horner prec (get_even (prec div 4 + 1)) 1 (A * A)) - 
   4.500 +                                                  B * (ub_arctan_horner prec (get_odd (prec div 14 + 1)) 1 (B * B)))))"
   4.501 +
   4.502 +lemma pi_boundaries: "pi \<in> {Ifloat (lb_pi n) .. Ifloat (ub_pi n)}"
   4.503 +proof -
   4.504 +  have machin_pi: "pi = 4 * (4 * arctan (1 / 5) - arctan (1 / 239))" unfolding machin[symmetric] by auto
   4.505 +
   4.506 +  { fix prec n :: nat fix k :: int assume "1 < k" hence "0 \<le> k" and "0 < k" and "1 \<le> k" by auto
   4.507 +    let ?k = "rapprox_rat prec 1 k"
   4.508 +    have "1 div k = 0" using div_pos_pos_trivial[OF _ `1 < k`] by auto
   4.509 +      
   4.510 +    have "0 \<le> Ifloat ?k" by (rule order_trans[OF _ rapprox_rat], auto simp add: `0 \<le> k`)
   4.511 +    have "Ifloat ?k \<le> 1" unfolding rapprox_rat.simps(2)[OF zero_le_one `0 < k`]
   4.512 +      by (rule rapprox_posrat_le1, auto simp add: `0 < k` `1 \<le> k`)
   4.513 +
   4.514 +    have "1 / real k \<le> Ifloat ?k" using rapprox_rat[where x=1 and y=k] by auto
   4.515 +    hence "arctan (1 / real k) \<le> arctan (Ifloat ?k)" by (rule arctan_monotone')
   4.516 +    also have "\<dots> \<le> Ifloat (?k * ub_arctan_horner prec (get_odd n) 1 (?k * ?k))"
   4.517 +      using arctan_0_1_bounds[OF `0 \<le> Ifloat ?k` `Ifloat ?k \<le> 1`] by auto
   4.518 +    finally have "arctan (1 / (real k)) \<le> Ifloat (?k * ub_arctan_horner prec (get_odd n) 1 (?k * ?k))" .
   4.519 +  } note ub_arctan = this
   4.520 +
   4.521 +  { fix prec n :: nat fix k :: int assume "1 < k" hence "0 \<le> k" and "0 < k" by auto
   4.522 +    let ?k = "lapprox_rat prec 1 k"
   4.523 +    have "1 div k = 0" using div_pos_pos_trivial[OF _ `1 < k`] by auto
   4.524 +    have "1 / real k \<le> 1" using `1 < k` by auto
   4.525 +
   4.526 +    have "\<And>n. 0 \<le> Ifloat ?k" using lapprox_rat_bottom[where x=1 and y=k, OF zero_le_one `0 < k`] by (auto simp add: `1 div k = 0`)
   4.527 +    have "\<And>n. Ifloat ?k \<le> 1" using lapprox_rat by (rule order_trans, auto simp add: `1 / real k \<le> 1`)
   4.528 +
   4.529 +    have "Ifloat ?k \<le> 1 / real k" using lapprox_rat[where x=1 and y=k] by auto
   4.530 +
   4.531 +    have "Ifloat (?k * lb_arctan_horner prec (get_even n) 1 (?k * ?k)) \<le> arctan (Ifloat ?k)"
   4.532 +      using arctan_0_1_bounds[OF `0 \<le> Ifloat ?k` `Ifloat ?k \<le> 1`] by auto
   4.533 +    also have "\<dots> \<le> arctan (1 / real k)" using `Ifloat ?k \<le> 1 / real k` by (rule arctan_monotone')
   4.534 +    finally have "Ifloat (?k * lb_arctan_horner prec (get_even n) 1 (?k * ?k)) \<le> arctan (1 / (real k))" .
   4.535 +  } note lb_arctan = this
   4.536 +
   4.537 +  have "pi \<le> Ifloat (ub_pi n)"
   4.538 +    unfolding ub_pi_def machin_pi Let_def Ifloat_mult Ifloat_sub unfolding Float_num
   4.539 +    using lb_arctan[of 239] ub_arctan[of 5]
   4.540 +    by (auto intro!: mult_left_mono add_mono simp add: diff_minus simp del: lapprox_rat.simps rapprox_rat.simps)
   4.541 +  moreover
   4.542 +  have "Ifloat (lb_pi n) \<le> pi"
   4.543 +    unfolding lb_pi_def machin_pi Let_def Ifloat_mult Ifloat_sub Float_num
   4.544 +    using lb_arctan[of 5] ub_arctan[of 239]
   4.545 +    by (auto intro!: mult_left_mono add_mono simp add: diff_minus simp del: lapprox_rat.simps rapprox_rat.simps)
   4.546 +  ultimately show ?thesis by auto
   4.547 +qed
   4.548 +
   4.549 +subsection "Compute arcus tangens in the entire domain"
   4.550 +
   4.551 +function lb_arctan :: "nat \<Rightarrow> float \<Rightarrow> float" and ub_arctan :: "nat \<Rightarrow> float \<Rightarrow> float" where 
   4.552 +  "lb_arctan prec x = (let ub_horner = \<lambda> x. x * ub_arctan_horner prec (get_odd (prec div 4 + 1)) 1 (x * x) ;
   4.553 +                           lb_horner = \<lambda> x. x * lb_arctan_horner prec (get_even (prec div 4 + 1)) 1 (x * x)
   4.554 +    in (if x < 0          then - ub_arctan prec (-x) else
   4.555 +        if x \<le> Float 1 -1 then lb_horner x else
   4.556 +        if x \<le> Float 1 1  then Float 1 1 * lb_horner (float_divl prec x (1 + the (ub_sqrt prec (1 + x * x))))
   4.557 +                          else (let inv = float_divr prec 1 x 
   4.558 +                                in if inv > 1 then 0 
   4.559 +                                              else lb_pi prec * Float 1 -1 - ub_horner inv)))"
   4.560 +
   4.561 +| "ub_arctan prec x = (let lb_horner = \<lambda> x. x * lb_arctan_horner prec (get_even (prec div 4 + 1)) 1 (x * x) ;
   4.562 +                           ub_horner = \<lambda> x. x * ub_arctan_horner prec (get_odd (prec div 4 + 1)) 1 (x * x)
   4.563 +    in (if x < 0          then - lb_arctan prec (-x) else
   4.564 +        if x \<le> Float 1 -1 then ub_horner x else
   4.565 +        if x \<le> Float 1 1  then let y = float_divr prec x (1 + the (lb_sqrt prec (1 + x * x)))
   4.566 +                               in if y > 1 then ub_pi prec * Float 1 -1 
   4.567 +                                           else Float 1 1 * ub_horner y 
   4.568 +                          else ub_pi prec * Float 1 -1 - lb_horner (float_divl prec 1 x)))"
   4.569 +by pat_completeness auto
   4.570 +termination by (relation "measure (\<lambda> v. let (prec, x) = sum_case id id v in (if x < 0 then 1 else 0))", auto simp add: less_float_def)
   4.571 +
   4.572 +declare ub_arctan_horner.simps[simp del]
   4.573 +declare lb_arctan_horner.simps[simp del]
   4.574 +
   4.575 +lemma lb_arctan_bound': assumes "0 \<le> Ifloat x"
   4.576 +  shows "Ifloat (lb_arctan prec x) \<le> arctan (Ifloat x)"
   4.577 +proof -
   4.578 +  have "\<not> x < 0" and "0 \<le> x" unfolding less_float_def le_float_def using `0 \<le> Ifloat x` by auto
   4.579 +  let "?ub_horner x" = "x * ub_arctan_horner prec (get_odd (prec div 4 + 1)) 1 (x * x)"
   4.580 +    and "?lb_horner x" = "x * lb_arctan_horner prec (get_even (prec div 4 + 1)) 1 (x * x)"
   4.581 +
   4.582 +  show ?thesis
   4.583 +  proof (cases "x \<le> Float 1 -1")
   4.584 +    case True hence "Ifloat x \<le> 1" unfolding le_float_def Float_num by auto
   4.585 +    show ?thesis unfolding lb_arctan.simps Let_def if_not_P[OF `\<not> x < 0`] if_P[OF True]
   4.586 +      using arctan_0_1_bounds[OF `0 \<le> Ifloat x` `Ifloat x \<le> 1`] by auto
   4.587 +  next
   4.588 +    case False hence "0 < Ifloat x" unfolding le_float_def Float_num by auto
   4.589 +    let ?R = "1 + sqrt (1 + Ifloat x * Ifloat x)"
   4.590 +    let ?fR = "1 + the (ub_sqrt prec (1 + x * x))"
   4.591 +    let ?DIV = "float_divl prec x ?fR"
   4.592 +    
   4.593 +    have sqr_ge0: "0 \<le> 1 + Ifloat x * Ifloat x" using sum_power2_ge_zero[of 1 "Ifloat x", unfolded numeral_2_eq_2] by auto
   4.594 +    hence divisor_gt0: "0 < ?R" by (auto intro: add_pos_nonneg)
   4.595 +
   4.596 +    have "sqrt (Ifloat (1 + x * x)) \<le> Ifloat (the (ub_sqrt prec (1 + x * x)))" by (rule ub_sqrt_lower_bound, auto simp add: sqr_ge0)
   4.597 +    hence "?R \<le> Ifloat ?fR" by auto
   4.598 +    hence "0 < ?fR" and "0 < Ifloat ?fR" unfolding less_float_def using `0 < ?R` by auto
   4.599 +
   4.600 +    have monotone: "Ifloat (float_divl prec x ?fR) \<le> Ifloat x / ?R"
   4.601 +    proof -
   4.602 +      have "Ifloat ?DIV \<le> Ifloat x / Ifloat ?fR" by (rule float_divl)
   4.603 +      also have "\<dots> \<le> Ifloat x / ?R" by (rule divide_left_mono[OF `?R \<le> Ifloat ?fR` `0 \<le> Ifloat x` mult_pos_pos[OF order_less_le_trans[OF divisor_gt0 `?R \<le> Ifloat ?fR`] divisor_gt0]])
   4.604 +      finally show ?thesis .
   4.605 +    qed
   4.606 +
   4.607 +    show ?thesis
   4.608 +    proof (cases "x \<le> Float 1 1")
   4.609 +      case True
   4.610 +      
   4.611 +      have "Ifloat x \<le> sqrt (Ifloat (1 + x * x))" using real_sqrt_sum_squares_ge2[where x=1, unfolded numeral_2_eq_2] by auto
   4.612 +      also have "\<dots> \<le> Ifloat (the (ub_sqrt prec (1 + x * x)))" by (rule ub_sqrt_lower_bound, auto simp add: sqr_ge0)
   4.613 +      finally have "Ifloat x \<le> Ifloat ?fR" by auto
   4.614 +      moreover have "Ifloat ?DIV \<le> Ifloat x / Ifloat ?fR" by (rule float_divl)
   4.615 +      ultimately have "Ifloat ?DIV \<le> 1" unfolding divide_le_eq_1_pos[OF `0 < Ifloat ?fR`, symmetric] by auto
   4.616 +
   4.617 +      have "0 \<le> Ifloat ?DIV" using float_divl_lower_bound[OF `0 \<le> x` `0 < ?fR`] unfolding le_float_def by auto
   4.618 +
   4.619 +      have "Ifloat (Float 1 1 * ?lb_horner ?DIV) \<le> 2 * arctan (Ifloat (float_divl prec x ?fR))" unfolding Ifloat_mult[of "Float 1 1"] Float_num
   4.620 +	using arctan_0_1_bounds[OF `0 \<le> Ifloat ?DIV` `Ifloat ?DIV \<le> 1`] by auto
   4.621 +      also have "\<dots> \<le> 2 * arctan (Ifloat x / ?R)"
   4.622 +	using arctan_monotone'[OF monotone] by (auto intro!: mult_left_mono)
   4.623 +      also have "2 * arctan (Ifloat x / ?R) = arctan (Ifloat x)" using arctan_half[symmetric] unfolding numeral_2_eq_2 power_Suc2 realpow_0 real_mult_1 . 
   4.624 +      finally show ?thesis unfolding lb_arctan.simps Let_def if_not_P[OF `\<not> x < 0`] if_not_P[OF `\<not> x \<le> Float 1 -1`] if_P[OF True] .
   4.625 +    next
   4.626 +      case False
   4.627 +      hence "2 < Ifloat x" unfolding le_float_def Float_num by auto
   4.628 +      hence "1 \<le> Ifloat x" by auto
   4.629 +
   4.630 +      let "?invx" = "float_divr prec 1 x"
   4.631 +      have "0 \<le> arctan (Ifloat x)" using arctan_monotone'[OF `0 \<le> Ifloat x`] using arctan_tan[of 0, unfolded tan_zero] by auto
   4.632 +
   4.633 +      show ?thesis
   4.634 +      proof (cases "1 < ?invx")
   4.635 +	case True
   4.636 +	show ?thesis unfolding lb_arctan.simps Let_def if_not_P[OF `\<not> x < 0`] if_not_P[OF `\<not> x \<le> Float 1 -1`] if_not_P[OF False] if_P[OF True] 
   4.637 +	  using `0 \<le> arctan (Ifloat x)` by auto
   4.638 +      next
   4.639 +	case False
   4.640 +	hence "Ifloat ?invx \<le> 1" unfolding less_float_def by auto
   4.641 +	have "0 \<le> Ifloat ?invx" by (rule order_trans[OF _ float_divr], auto simp add: `0 \<le> Ifloat x`)
   4.642 +
   4.643 +	have "1 / Ifloat x \<noteq> 0" and "0 < 1 / Ifloat x" using `0 < Ifloat x` by auto
   4.644 +	
   4.645 +	have "arctan (1 / Ifloat x) \<le> arctan (Ifloat ?invx)" unfolding Ifloat_1[symmetric] by (rule arctan_monotone', rule float_divr)
   4.646 +	also have "\<dots> \<le> Ifloat (?ub_horner ?invx)" using arctan_0_1_bounds[OF `0 \<le> Ifloat ?invx` `Ifloat ?invx \<le> 1`] by auto
   4.647 +	finally have "pi / 2 - Ifloat (?ub_horner ?invx) \<le> arctan (Ifloat x)" 
   4.648 +	  using `0 \<le> arctan (Ifloat x)` arctan_inverse[OF `1 / Ifloat x \<noteq> 0`] 
   4.649 +	  unfolding real_sgn_pos[OF `0 < 1 / Ifloat x`] le_diff_eq by auto
   4.650 +	moreover
   4.651 +	have "Ifloat (lb_pi prec * Float 1 -1) \<le> pi / 2" unfolding Ifloat_mult Float_num times_divide_eq_right real_mult_1 using pi_boundaries by auto
   4.652 +	ultimately
   4.653 +	show ?thesis unfolding lb_arctan.simps Let_def if_not_P[OF `\<not> x < 0`] if_not_P[OF `\<not> x \<le> Float 1 -1`] if_not_P[OF `\<not> x \<le> Float 1 1`] if_not_P[OF False]
   4.654 +	  by auto
   4.655 +      qed
   4.656 +    qed
   4.657 +  qed
   4.658 +qed
   4.659 +
   4.660 +lemma ub_arctan_bound': assumes "0 \<le> Ifloat x"
   4.661 +  shows "arctan (Ifloat x) \<le> Ifloat (ub_arctan prec x)"
   4.662 +proof -
   4.663 +  have "\<not> x < 0" and "0 \<le> x" unfolding less_float_def le_float_def using `0 \<le> Ifloat x` by auto
   4.664 +
   4.665 +  let "?ub_horner x" = "x * ub_arctan_horner prec (get_odd (prec div 4 + 1)) 1 (x * x)"
   4.666 +    and "?lb_horner x" = "x * lb_arctan_horner prec (get_even (prec div 4 + 1)) 1 (x * x)"
   4.667 +
   4.668 +  show ?thesis
   4.669 +  proof (cases "x \<le> Float 1 -1")
   4.670 +    case True hence "Ifloat x \<le> 1" unfolding le_float_def Float_num by auto
   4.671 +    show ?thesis unfolding ub_arctan.simps Let_def if_not_P[OF `\<not> x < 0`] if_P[OF True]
   4.672 +      using arctan_0_1_bounds[OF `0 \<le> Ifloat x` `Ifloat x \<le> 1`] by auto
   4.673 +  next
   4.674 +    case False hence "0 < Ifloat x" unfolding le_float_def Float_num by auto
   4.675 +    let ?R = "1 + sqrt (1 + Ifloat x * Ifloat x)"
   4.676 +    let ?fR = "1 + the (lb_sqrt prec (1 + x * x))"
   4.677 +    let ?DIV = "float_divr prec x ?fR"
   4.678 +    
   4.679 +    have sqr_ge0: "0 \<le> 1 + Ifloat x * Ifloat x" using sum_power2_ge_zero[of 1 "Ifloat x", unfolded numeral_2_eq_2] by auto
   4.680 +    hence "0 \<le> Ifloat (1 + x*x)" by auto
   4.681 +    
   4.682 +    hence divisor_gt0: "0 < ?R" by (auto intro: add_pos_nonneg)
   4.683 +
   4.684 +    have "Ifloat (the (lb_sqrt prec (1 + x * x))) \<le> sqrt (Ifloat (1 + x * x))" by (rule lb_sqrt_upper_bound, auto simp add: sqr_ge0)
   4.685 +    hence "Ifloat ?fR \<le> ?R" by auto
   4.686 +    have "0 < Ifloat ?fR" unfolding Ifloat_add Ifloat_1 by (rule order_less_le_trans[OF zero_less_one], auto simp add: lb_sqrt_lower_bound[OF `0 \<le> Ifloat (1 + x*x)`])
   4.687 +
   4.688 +    have monotone: "Ifloat x / ?R \<le> Ifloat (float_divr prec x ?fR)"
   4.689 +    proof -
   4.690 +      from divide_left_mono[OF `Ifloat ?fR \<le> ?R` `0 \<le> Ifloat x` mult_pos_pos[OF divisor_gt0 `0 < Ifloat ?fR`]]
   4.691 +      have "Ifloat x / ?R \<le> Ifloat x / Ifloat ?fR" .
   4.692 +      also have "\<dots> \<le> Ifloat ?DIV" by (rule float_divr)
   4.693 +      finally show ?thesis .
   4.694 +    qed
   4.695 +
   4.696 +    show ?thesis
   4.697 +    proof (cases "x \<le> Float 1 1")
   4.698 +      case True
   4.699 +      show ?thesis
   4.700 +      proof (cases "?DIV > 1")
   4.701 +	case True
   4.702 +	have "pi / 2 \<le> Ifloat (ub_pi prec * Float 1 -1)" unfolding Ifloat_mult Float_num times_divide_eq_right real_mult_1 using pi_boundaries by auto
   4.703 +	from order_less_le_trans[OF arctan_ubound this, THEN less_imp_le]
   4.704 +	show ?thesis unfolding ub_arctan.simps Let_def if_not_P[OF `\<not> x < 0`] if_not_P[OF `\<not> x \<le> Float 1 -1`] if_P[OF `x \<le> Float 1 1`] if_P[OF True] .
   4.705 +      next
   4.706 +	case False
   4.707 +	hence "Ifloat ?DIV \<le> 1" unfolding less_float_def by auto
   4.708 +      
   4.709 +	have "0 \<le> Ifloat x / ?R" using `0 \<le> Ifloat x` `0 < ?R` unfolding real_0_le_divide_iff by auto
   4.710 +	hence "0 \<le> Ifloat ?DIV" using monotone by (rule order_trans)
   4.711 +
   4.712 +	have "arctan (Ifloat x) = 2 * arctan (Ifloat x / ?R)" using arctan_half unfolding numeral_2_eq_2 power_Suc2 realpow_0 real_mult_1 .
   4.713 +	also have "\<dots> \<le> 2 * arctan (Ifloat ?DIV)"
   4.714 +	  using arctan_monotone'[OF monotone] by (auto intro!: mult_left_mono)
   4.715 +	also have "\<dots> \<le> Ifloat (Float 1 1 * ?ub_horner ?DIV)" unfolding Ifloat_mult[of "Float 1 1"] Float_num
   4.716 +	  using arctan_0_1_bounds[OF `0 \<le> Ifloat ?DIV` `Ifloat ?DIV \<le> 1`] by auto
   4.717 +	finally show ?thesis unfolding ub_arctan.simps Let_def if_not_P[OF `\<not> x < 0`] if_not_P[OF `\<not> x \<le> Float 1 -1`] if_P[OF `x \<le> Float 1 1`] if_not_P[OF False] .
   4.718 +      qed
   4.719 +    next
   4.720 +      case False
   4.721 +      hence "2 < Ifloat x" unfolding le_float_def Float_num by auto
   4.722 +      hence "1 \<le> Ifloat x" by auto
   4.723 +      hence "0 < Ifloat x" by auto
   4.724 +      hence "0 < x" unfolding less_float_def by auto
   4.725 +
   4.726 +      let "?invx" = "float_divl prec 1 x"
   4.727 +      have "0 \<le> arctan (Ifloat x)" using arctan_monotone'[OF `0 \<le> Ifloat x`] using arctan_tan[of 0, unfolded tan_zero] by auto
   4.728 +
   4.729 +      have "Ifloat ?invx \<le> 1" unfolding less_float_def by (rule order_trans[OF float_divl], auto simp add: `1 \<le> Ifloat x` divide_le_eq_1_pos[OF `0 < Ifloat x`])
   4.730 +      have "0 \<le> Ifloat ?invx" unfolding Ifloat_0[symmetric] by (rule float_divl_lower_bound[unfolded le_float_def], auto simp add: `0 < x`)
   4.731 +	
   4.732 +      have "1 / Ifloat x \<noteq> 0" and "0 < 1 / Ifloat x" using `0 < Ifloat x` by auto
   4.733 +      
   4.734 +      have "Ifloat (?lb_horner ?invx) \<le> arctan (Ifloat ?invx)" using arctan_0_1_bounds[OF `0 \<le> Ifloat ?invx` `Ifloat ?invx \<le> 1`] by auto
   4.735 +      also have "\<dots> \<le> arctan (1 / Ifloat x)" unfolding Ifloat_1[symmetric] by (rule arctan_monotone', rule float_divl)
   4.736 +      finally have "arctan (Ifloat x) \<le> pi / 2 - Ifloat (?lb_horner ?invx)"
   4.737 +	using `0 \<le> arctan (Ifloat x)` arctan_inverse[OF `1 / Ifloat x \<noteq> 0`] 
   4.738 +	unfolding real_sgn_pos[OF `0 < 1 / Ifloat x`] le_diff_eq by auto
   4.739 +      moreover
   4.740 +      have "pi / 2 \<le> Ifloat (ub_pi prec * Float 1 -1)" unfolding Ifloat_mult Float_num times_divide_eq_right mult_1_right using pi_boundaries by auto
   4.741 +      ultimately
   4.742 +      show ?thesis unfolding ub_arctan.simps Let_def if_not_P[OF `\<not> x < 0`] if_not_P[OF `\<not> x \<le> Float 1 -1`] if_not_P[OF `\<not> x \<le> Float 1 1`] if_not_P[OF False]
   4.743 +	by auto
   4.744 +    qed
   4.745 +  qed
   4.746 +qed
   4.747 +
   4.748 +lemma arctan_boundaries:
   4.749 +  "arctan (Ifloat x) \<in> {Ifloat (lb_arctan prec x) .. Ifloat (ub_arctan prec x)}"
   4.750 +proof (cases "0 \<le> x")
   4.751 +  case True hence "0 \<le> Ifloat x" unfolding le_float_def by auto
   4.752 +  show ?thesis using ub_arctan_bound'[OF `0 \<le> Ifloat x`] lb_arctan_bound'[OF `0 \<le> Ifloat x`] unfolding atLeastAtMost_iff by auto
   4.753 +next
   4.754 +  let ?mx = "-x"
   4.755 +  case False hence "x < 0" and "0 \<le> Ifloat ?mx" unfolding le_float_def less_float_def by auto
   4.756 +  hence bounds: "Ifloat (lb_arctan prec ?mx) \<le> arctan (Ifloat ?mx) \<and> arctan (Ifloat ?mx) \<le> Ifloat (ub_arctan prec ?mx)"
   4.757 +    using ub_arctan_bound'[OF `0 \<le> Ifloat ?mx`] lb_arctan_bound'[OF `0 \<le> Ifloat ?mx`] by auto
   4.758 +  show ?thesis unfolding Ifloat_minus arctan_minus lb_arctan.simps[where x=x] ub_arctan.simps[where x=x] Let_def if_P[OF `x < 0`]
   4.759 +    unfolding atLeastAtMost_iff using bounds[unfolded Ifloat_minus arctan_minus] by auto
   4.760 +qed
   4.761 +
   4.762 +lemma bnds_arctan: "\<forall> x lx ux. (l, u) = (lb_arctan prec lx, ub_arctan prec ux) \<and> x \<in> {Ifloat lx .. Ifloat ux} \<longrightarrow> Ifloat l \<le> arctan x \<and> arctan x \<le> Ifloat u"
   4.763 +proof (rule allI, rule allI, rule allI, rule impI)
   4.764 +  fix x lx ux
   4.765 +  assume "(l, u) = (lb_arctan prec lx, ub_arctan prec ux) \<and> x \<in> {Ifloat lx .. Ifloat ux}"
   4.766 +  hence l: "lb_arctan prec lx = l " and u: "ub_arctan prec ux = u" and x: "x \<in> {Ifloat lx .. Ifloat ux}" by auto
   4.767 +
   4.768 +  { from arctan_boundaries[of lx prec, unfolded l]
   4.769 +    have "Ifloat l \<le> arctan (Ifloat lx)" by (auto simp del: lb_arctan.simps)
   4.770 +    also have "\<dots> \<le> arctan x" using x by (auto intro: arctan_monotone')
   4.771 +    finally have "Ifloat l \<le> arctan x" .
   4.772 +  } moreover
   4.773 +  { have "arctan x \<le> arctan (Ifloat ux)" using x by (auto intro: arctan_monotone')
   4.774 +    also have "\<dots> \<le> Ifloat u" using arctan_boundaries[of ux prec, unfolded u] by (auto simp del: ub_arctan.simps)
   4.775 +    finally have "arctan x \<le> Ifloat u" .
   4.776 +  } ultimately show "Ifloat l \<le> arctan x \<and> arctan x \<le> Ifloat u" ..
   4.777 +qed
   4.778 +
   4.779 +section "Sinus and Cosinus"
   4.780 +
   4.781 +subsection "Compute the cosinus and sinus series"
   4.782 +
   4.783 +fun ub_sin_cos_aux :: "nat \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> float \<Rightarrow> float"
   4.784 +and lb_sin_cos_aux :: "nat \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> float \<Rightarrow> float" where
   4.785 +  "ub_sin_cos_aux prec 0 i k x = 0"
   4.786 +| "ub_sin_cos_aux prec (Suc n) i k x = 
   4.787 +    (rapprox_rat prec 1 (int k)) - x * (lb_sin_cos_aux prec n (i + 2) (k * i * (i + 1)) x)"
   4.788 +| "lb_sin_cos_aux prec 0 i k x = 0"
   4.789 +| "lb_sin_cos_aux prec (Suc n) i k x = 
   4.790 +    (lapprox_rat prec 1 (int k)) - x * (ub_sin_cos_aux prec n (i + 2) (k * i * (i + 1)) x)"
   4.791 +
   4.792 +lemma cos_aux:
   4.793 +  shows "Ifloat (lb_sin_cos_aux prec n 1 1 (x * x)) \<le> (\<Sum> i=0..<n. -1^i * (1/real (fact (2 * i))) * (Ifloat x)^(2 * i))" (is "?lb")
   4.794 +  and "(\<Sum> i=0..<n. -1^i * (1/real (fact (2 * i))) * (Ifloat x)^(2 * i)) \<le> Ifloat (ub_sin_cos_aux prec n 1 1 (x * x))" (is "?ub")
   4.795 +proof -
   4.796 +  have "0 \<le> Ifloat (x * x)" unfolding Ifloat_mult by auto
   4.797 +  let "?f n" = "fact (2 * n)"
   4.798 +
   4.799 +  { fix n 
   4.800 +    have F: "\<And>m. ((\<lambda>i. i + 2) ^ n) m = m + 2 * n" by (induct n arbitrary: m, auto)
   4.801 +    have "?f (Suc n) = ?f n * ((\<lambda>i. i + 2) ^ n) 1 * (((\<lambda>i. i + 2) ^ n) 1 + 1)"
   4.802 +      unfolding F by auto } note f_eq = this
   4.803 +    
   4.804 +  from horner_bounds[where lb="lb_sin_cos_aux prec" and ub="ub_sin_cos_aux prec" and j'=0, 
   4.805 +    OF `0 \<le> Ifloat (x * x)` f_eq lb_sin_cos_aux.simps ub_sin_cos_aux.simps]
   4.806 +  show "?lb" and "?ub" by (auto simp add: power_mult power2_eq_square[of "Ifloat x"])
   4.807 +qed
   4.808 +
   4.809 +lemma cos_boundaries: assumes "0 \<le> Ifloat x" and "Ifloat x \<le> pi / 2"
   4.810 +  shows "cos (Ifloat x) \<in> {Ifloat (lb_sin_cos_aux prec (get_even n) 1 1 (x * x)) .. Ifloat (ub_sin_cos_aux prec (get_odd n) 1 1 (x * x))}"
   4.811 +proof (cases "Ifloat x = 0")
   4.812 +  case False hence "Ifloat x \<noteq> 0" by auto
   4.813 +  hence "0 < x" and "0 < Ifloat x" using `0 \<le> Ifloat x` unfolding less_float_def by auto
   4.814 +  have "0 < x * x" using `0 < x` unfolding less_float_def Ifloat_mult Ifloat_0
   4.815 +    using mult_pos_pos[where a="Ifloat x" and b="Ifloat x"] by auto
   4.816 +
   4.817 +  { fix x n have "(\<Sum> i=0..<n. -1^i * (1/real (fact (2 * i))) * x^(2 * i))
   4.818 +    = (\<Sum> i = 0 ..< 2 * n. (if even(i) then (-1 ^ (i div 2))/(real (fact i)) else 0) * x ^ i)" (is "?sum = ?ifsum")
   4.819 +  proof -
   4.820 +    have "?sum = ?sum + (\<Sum> j = 0 ..< n. 0)" by auto
   4.821 +    also have "\<dots> = 
   4.822 +      (\<Sum> j = 0 ..< n. -1 ^ ((2 * j) div 2) / (real (fact (2 * j))) * x ^(2 * j)) + (\<Sum> j = 0 ..< n. 0)" by auto
   4.823 +    also have "\<dots> = (\<Sum> i = 0 ..< 2 * n. if even i then -1 ^ (i div 2) / (real (fact i)) * x ^ i else 0)"
   4.824 +      unfolding sum_split_even_odd ..
   4.825 +    also have "\<dots> = (\<Sum> i = 0 ..< 2 * n. (if even i then -1 ^ (i div 2) / (real (fact i)) else 0) * x ^ i)"
   4.826 +      by (rule setsum_cong2) auto
   4.827 +    finally show ?thesis by assumption
   4.828 +  qed } note morph_to_if_power = this
   4.829 +
   4.830 +
   4.831 +  { fix n :: nat assume "0 < n"
   4.832 +    hence "0 < 2 * n" by auto
   4.833 +    obtain t where "0 < t" and "t < Ifloat x" and
   4.834 +      cos_eq: "cos (Ifloat x) = (\<Sum> i = 0 ..< 2 * n. (if even(i) then (-1 ^ (i div 2))/(real (fact i)) else 0) * (Ifloat x) ^ i) 
   4.835 +      + (cos (t + 1/2 * real (2 * n) * pi) / real (fact (2*n))) * (Ifloat x)^(2*n)" 
   4.836 +      (is "_ = ?SUM + ?rest / ?fact * ?pow")
   4.837 +      using Maclaurin_cos_expansion2[OF `0 < Ifloat x` `0 < 2 * n`] by auto
   4.838 +
   4.839 +    have "cos t * -1^n = cos t * cos (real n * pi) + sin t * sin (real n * pi)" by auto
   4.840 +    also have "\<dots> = cos (t + real n * pi)"  using cos_add by auto
   4.841 +    also have "\<dots> = ?rest" by auto
   4.842 +    finally have "cos t * -1^n = ?rest" .
   4.843 +    moreover
   4.844 +    have "t \<le> pi / 2" using `t < Ifloat x` and `Ifloat x \<le> pi / 2` by auto
   4.845 +    hence "0 \<le> cos t" using `0 < t` and cos_ge_zero by auto
   4.846 +    ultimately have even: "even n \<Longrightarrow> 0 \<le> ?rest" and odd: "odd n \<Longrightarrow> 0 \<le> - ?rest " by auto
   4.847 +
   4.848 +    have "0 < ?fact" by auto
   4.849 +    have "0 < ?pow" using `0 < Ifloat x` by auto
   4.850 +
   4.851 +    {
   4.852 +      assume "even n"
   4.853 +      have "Ifloat (lb_sin_cos_aux prec n 1 1 (x * x)) \<le> ?SUM"
   4.854 +	unfolding morph_to_if_power[symmetric] using cos_aux by auto 
   4.855 +      also have "\<dots> \<le> cos (Ifloat x)"
   4.856 +      proof -
   4.857 +	from even[OF `even n`] `0 < ?fact` `0 < ?pow`
   4.858 +	have "0 \<le> (?rest / ?fact) * ?pow" by (metis mult_nonneg_nonneg divide_nonneg_pos less_imp_le)
   4.859 +	thus ?thesis unfolding cos_eq by auto
   4.860 +      qed
   4.861 +      finally have "Ifloat (lb_sin_cos_aux prec n 1 1 (x * x)) \<le> cos (Ifloat x)" .
   4.862 +    } note lb = this
   4.863 +
   4.864 +    {
   4.865 +      assume "odd n"
   4.866 +      have "cos (Ifloat x) \<le> ?SUM"
   4.867 +      proof -
   4.868 +	from `0 < ?fact` and `0 < ?pow` and odd[OF `odd n`]
   4.869 +	have "0 \<le> (- ?rest) / ?fact * ?pow"
   4.870 +	  by (metis mult_nonneg_nonneg divide_nonneg_pos less_imp_le)
   4.871 +	thus ?thesis unfolding cos_eq by auto
   4.872 +      qed
   4.873 +      also have "\<dots> \<le> Ifloat (ub_sin_cos_aux prec n 1 1 (x * x))"
   4.874 +	unfolding morph_to_if_power[symmetric] using cos_aux by auto
   4.875 +      finally have "cos (Ifloat x) \<le> Ifloat (ub_sin_cos_aux prec n 1 1 (x * x))" .
   4.876 +    } note ub = this and lb
   4.877 +  } note ub = this(1) and lb = this(2)
   4.878 +
   4.879 +  have "cos (Ifloat x) \<le> Ifloat (ub_sin_cos_aux prec (get_odd n) 1 1 (x * x))" using ub[OF odd_pos[OF get_odd] get_odd] .
   4.880 +  moreover have "Ifloat (lb_sin_cos_aux prec (get_even n) 1 1 (x * x)) \<le> cos (Ifloat x)" 
   4.881 +  proof (cases "0 < get_even n")
   4.882 +    case True show ?thesis using lb[OF True get_even] .
   4.883 +  next
   4.884 +    case False
   4.885 +    hence "get_even n = 0" by auto
   4.886 +    have "- (pi / 2) \<le> Ifloat x" by (rule order_trans[OF _ `0 < Ifloat x`[THEN less_imp_le]], auto)
   4.887 +    with `Ifloat x \<le> pi / 2`
   4.888 +    show ?thesis unfolding `get_even n = 0` lb_sin_cos_aux.simps Ifloat_minus Ifloat_0 using cos_ge_zero by auto
   4.889 +  qed
   4.890 +  ultimately show ?thesis by auto
   4.891 +next
   4.892 +  case True
   4.893 +  show ?thesis
   4.894 +  proof (cases "n = 0")
   4.895 +    case True 
   4.896 +    thus ?thesis unfolding `n = 0` get_even_def get_odd_def using `Ifloat x = 0` lapprox_rat[where x="-1" and y=1] by auto
   4.897 +  next
   4.898 +    case False with not0_implies_Suc obtain m where "n = Suc m" by blast
   4.899 +    thus ?thesis unfolding `n = Suc m` get_even_def get_odd_def using `Ifloat x = 0` rapprox_rat[where x=1 and y=1] lapprox_rat[where x=1 and y=1] by (cases "even (Suc m)", auto)
   4.900 +  qed
   4.901 +qed
   4.902 +
   4.903 +lemma sin_aux: assumes "0 \<le> Ifloat x"
   4.904 +  shows "Ifloat (x * lb_sin_cos_aux prec n 2 1 (x * x)) \<le> (\<Sum> i=0..<n. -1^i * (1/real (fact (2 * i + 1))) * (Ifloat x)^(2 * i + 1))" (is "?lb")
   4.905 +  and "(\<Sum> i=0..<n. -1^i * (1/real (fact (2 * i + 1))) * (Ifloat x)^(2 * i + 1)) \<le> Ifloat (x * ub_sin_cos_aux prec n 2 1 (x * x))" (is "?ub")
   4.906 +proof -
   4.907 +  have "0 \<le> Ifloat (x * x)" unfolding Ifloat_mult by auto
   4.908 +  let "?f n" = "fact (2 * n + 1)"
   4.909 +
   4.910 +  { fix n 
   4.911 +    have F: "\<And>m. ((\<lambda>i. i + 2) ^ n) m = m + 2 * n" by (induct n arbitrary: m, auto)
   4.912 +    have "?f (Suc n) = ?f n * ((\<lambda>i. i + 2) ^ n) 2 * (((\<lambda>i. i + 2) ^ n) 2 + 1)"
   4.913 +      unfolding F by auto } note f_eq = this
   4.914 +    
   4.915 +  from horner_bounds[where lb="lb_sin_cos_aux prec" and ub="ub_sin_cos_aux prec" and j'=0,
   4.916 +    OF `0 \<le> Ifloat (x * x)` f_eq lb_sin_cos_aux.simps ub_sin_cos_aux.simps]
   4.917 +  show "?lb" and "?ub" using `0 \<le> Ifloat x` unfolding Ifloat_mult
   4.918 +    unfolding power_add power_one_right real_mult_assoc[symmetric] setsum_left_distrib[symmetric]
   4.919 +    unfolding real_mult_commute
   4.920 +    by (auto intro!: mult_left_mono simp add: power_mult power2_eq_square[of "Ifloat x"])
   4.921 +qed
   4.922 +
   4.923 +lemma sin_boundaries: assumes "0 \<le> Ifloat x" and "Ifloat x \<le> pi / 2"
   4.924 +  shows "sin (Ifloat x) \<in> {Ifloat (x * lb_sin_cos_aux prec (get_even n) 2 1 (x * x)) .. Ifloat (x * ub_sin_cos_aux prec (get_odd n) 2 1 (x * x))}"
   4.925 +proof (cases "Ifloat x = 0")
   4.926 +  case False hence "Ifloat x \<noteq> 0" by auto
   4.927 +  hence "0 < x" and "0 < Ifloat x" using `0 \<le> Ifloat x` unfolding less_float_def by auto
   4.928 +  have "0 < x * x" using `0 < x` unfolding less_float_def Ifloat_mult Ifloat_0
   4.929 +    using mult_pos_pos[where a="Ifloat x" and b="Ifloat x"] by auto
   4.930 +
   4.931 +  { fix x n have "(\<Sum> j = 0 ..< n. -1 ^ (((2 * j + 1) - Suc 0) div 2) / (real (fact (2 * j + 1))) * x ^(2 * j + 1))
   4.932 +    = (\<Sum> i = 0 ..< 2 * n. (if even(i) then 0 else (-1 ^ ((i - Suc 0) div 2))/(real (fact i))) * x ^ i)" (is "?SUM = _")
   4.933 +    proof -
   4.934 +      have pow: "!!i. x ^ (2 * i + 1) = x * x ^ (2 * i)" by auto
   4.935 +      have "?SUM = (\<Sum> j = 0 ..< n. 0) + ?SUM" by auto
   4.936 +      also have "\<dots> = (\<Sum> i = 0 ..< 2 * n. if even i then 0 else -1 ^ ((i - Suc 0) div 2) / (real (fact i)) * x ^ i)"
   4.937 +	unfolding sum_split_even_odd ..
   4.938 +      also have "\<dots> = (\<Sum> i = 0 ..< 2 * n. (if even i then 0 else -1 ^ ((i - Suc 0) div 2) / (real (fact i))) * x ^ i)"
   4.939 +	by (rule setsum_cong2) auto
   4.940 +      finally show ?thesis by assumption
   4.941 +    qed } note setsum_morph = this
   4.942 +
   4.943 +  { fix n :: nat assume "0 < n"
   4.944 +    hence "0 < 2 * n + 1" by auto
   4.945 +    obtain t where "0 < t" and "t < Ifloat x" and
   4.946 +      sin_eq: "sin (Ifloat x) = (\<Sum> i = 0 ..< 2 * n + 1. (if even(i) then 0 else (-1 ^ ((i - Suc 0) div 2))/(real (fact i))) * (Ifloat x) ^ i) 
   4.947 +      + (sin (t + 1/2 * real (2 * n + 1) * pi) / real (fact (2*n + 1))) * (Ifloat x)^(2*n + 1)" 
   4.948 +      (is "_ = ?SUM + ?rest / ?fact * ?pow")
   4.949 +      using Maclaurin_sin_expansion3[OF `0 < 2 * n + 1` `0 < Ifloat x`] by auto
   4.950 +
   4.951 +    have "?rest = cos t * -1^n" unfolding sin_add cos_add real_of_nat_add left_distrib right_distrib by auto
   4.952 +    moreover
   4.953 +    have "t \<le> pi / 2" using `t < Ifloat x` and `Ifloat x \<le> pi / 2` by auto
   4.954 +    hence "0 \<le> cos t" using `0 < t` and cos_ge_zero by auto
   4.955 +    ultimately have even: "even n \<Longrightarrow> 0 \<le> ?rest" and odd: "odd n \<Longrightarrow> 0 \<le> - ?rest " by auto
   4.956 +
   4.957 +    have "0 < ?fact" by (rule real_of_nat_fact_gt_zero)
   4.958 +    have "0 < ?pow" using `0 < Ifloat x` by (rule zero_less_power)
   4.959 +
   4.960 +    {
   4.961 +      assume "even n"
   4.962 +      have "Ifloat (x * lb_sin_cos_aux prec n 2 1 (x * x)) \<le> 
   4.963 +            (\<Sum> i = 0 ..< 2 * n. (if even(i) then 0 else (-1 ^ ((i - Suc 0) div 2))/(real (fact i))) * (Ifloat x) ^ i)"
   4.964 +	using sin_aux[OF `0 \<le> Ifloat x`] unfolding setsum_morph[symmetric] by auto
   4.965 +      also have "\<dots> \<le> ?SUM" by auto
   4.966 +      also have "\<dots> \<le> sin (Ifloat x)"
   4.967 +      proof -
   4.968 +	from even[OF `even n`] `0 < ?fact` `0 < ?pow`
   4.969 +	have "0 \<le> (?rest / ?fact) * ?pow" by (metis mult_nonneg_nonneg divide_nonneg_pos less_imp_le)
   4.970 +	thus ?thesis unfolding sin_eq by auto
   4.971 +      qed
   4.972 +      finally have "Ifloat (x * lb_sin_cos_aux prec n 2 1 (x * x)) \<le> sin (Ifloat x)" .
   4.973 +    } note lb = this
   4.974 +
   4.975 +    {
   4.976 +      assume "odd n"
   4.977 +      have "sin (Ifloat x) \<le> ?SUM"
   4.978 +      proof -
   4.979 +	from `0 < ?fact` and `0 < ?pow` and odd[OF `odd n`]
   4.980 +	have "0 \<le> (- ?rest) / ?fact * ?pow"
   4.981 +	  by (metis mult_nonneg_nonneg divide_nonneg_pos less_imp_le)
   4.982 +	thus ?thesis unfolding sin_eq by auto
   4.983 +      qed
   4.984 +      also have "\<dots> \<le> (\<Sum> i = 0 ..< 2 * n. (if even(i) then 0 else (-1 ^ ((i - Suc 0) div 2))/(real (fact i))) * (Ifloat x) ^ i)"
   4.985 +	 by auto
   4.986 +      also have "\<dots> \<le> Ifloat (x * ub_sin_cos_aux prec n 2 1 (x * x))" 
   4.987 +	using sin_aux[OF `0 \<le> Ifloat x`] unfolding setsum_morph[symmetric] by auto
   4.988 +      finally have "sin (Ifloat x) \<le> Ifloat (x * ub_sin_cos_aux prec n 2 1 (x * x))" .
   4.989 +    } note ub = this and lb
   4.990 +  } note ub = this(1) and lb = this(2)
   4.991 +
   4.992 +  have "sin (Ifloat x) \<le> Ifloat (x * ub_sin_cos_aux prec (get_odd n) 2 1 (x * x))" using ub[OF odd_pos[OF get_odd] get_odd] .
   4.993 +  moreover have "Ifloat (x * lb_sin_cos_aux prec (get_even n) 2 1 (x * x)) \<le> sin (Ifloat x)" 
   4.994 +  proof (cases "0 < get_even n")
   4.995 +    case True show ?thesis using lb[OF True get_even] .
   4.996 +  next
   4.997 +    case False
   4.998 +    hence "get_even n = 0" by auto
   4.999 +    with `Ifloat x \<le> pi / 2` `0 \<le> Ifloat x`
  4.1000 +    show ?thesis unfolding `get_even n = 0` ub_sin_cos_aux.simps Ifloat_minus Ifloat_0 using sin_ge_zero by auto
  4.1001 +  qed
  4.1002 +  ultimately show ?thesis by auto
  4.1003 +next
  4.1004 +  case True
  4.1005 +  show ?thesis
  4.1006 +  proof (cases "n = 0")
  4.1007 +    case True 
  4.1008 +    thus ?thesis unfolding `n = 0` get_even_def get_odd_def using `Ifloat x = 0` lapprox_rat[where x="-1" and y=1] by auto
  4.1009 +  next
  4.1010 +    case False with not0_implies_Suc obtain m where "n = Suc m" by blast
  4.1011 +    thus ?thesis unfolding `n = Suc m` get_even_def get_odd_def using `Ifloat x = 0` rapprox_rat[where x=1 and y=1] lapprox_rat[where x=1 and y=1] by (cases "even (Suc m)", auto)
  4.1012 +  qed
  4.1013 +qed
  4.1014 +
  4.1015 +subsection "Compute the cosinus in the entire domain"
  4.1016 +
  4.1017 +definition lb_cos :: "nat \<Rightarrow> float \<Rightarrow> float" where
  4.1018 +"lb_cos prec x = (let
  4.1019 +    horner = \<lambda> x. lb_sin_cos_aux prec (get_even (prec div 4 + 1)) 1 1 (x * x) ;
  4.1020 +    half = \<lambda> x. if x < 0 then - 1 else Float 1 1 * x * x - 1
  4.1021 +  in if x < Float 1 -1 then horner x
  4.1022 +else if x < 1          then half (horner (x * Float 1 -1))
  4.1023 +                       else half (half (horner (x * Float 1 -2))))"
  4.1024 +
  4.1025 +definition ub_cos :: "nat \<Rightarrow> float \<Rightarrow> float" where
  4.1026 +"ub_cos prec x = (let
  4.1027 +    horner = \<lambda> x. ub_sin_cos_aux prec (get_odd (prec div 4 + 1)) 1 1 (x * x) ;
  4.1028 +    half = \<lambda> x. Float 1 1 * x * x - 1
  4.1029 +  in if x < Float 1 -1 then horner x
  4.1030 +else if x < 1          then half (horner (x * Float 1 -1))
  4.1031 +                       else half (half (horner (x * Float 1 -2))))"
  4.1032 +
  4.1033 +definition bnds_cos :: "nat \<Rightarrow> float \<Rightarrow> float \<Rightarrow> float * float" where
  4.1034 +"bnds_cos prec lx ux = (let  lpi = lb_pi prec
  4.1035 +  in   if lx < -lpi \<or> ux > lpi   then (Float -1 0, Float 1 0)
  4.1036 +  else if ux \<le> 0                 then (lb_cos prec (-lx), ub_cos prec (-ux))
  4.1037 +  else if 0 \<le> lx                 then (lb_cos prec ux, ub_cos prec lx)
  4.1038 +                                 else (min (lb_cos prec (-lx)) (lb_cos prec ux), Float 1 0))"
  4.1039 +
  4.1040 +lemma lb_cos: assumes "0 \<le> Ifloat x" and "Ifloat x \<le> pi" 
  4.1041 +  shows "cos (Ifloat x) \<in> {Ifloat (lb_cos prec x) .. Ifloat (ub_cos prec x)}" (is "?cos x \<in> { Ifloat (?lb x) .. Ifloat (?ub x) }")
  4.1042 +proof -
  4.1043 +  { fix x :: real
  4.1044 +    have "cos x = cos (x / 2 + x / 2)" by auto
  4.1045 +    also have "\<dots> = cos (x / 2) * cos (x / 2) + sin (x / 2) * sin (x / 2) - sin (x / 2) * sin (x / 2) + cos (x / 2) * cos (x / 2) - 1"
  4.1046 +      unfolding cos_add by auto
  4.1047 +    also have "\<dots> = 2 * cos (x / 2) * cos (x / 2) - 1" by algebra
  4.1048 +    finally have "cos x = 2 * cos (x / 2) * cos (x / 2) - 1" .
  4.1049 +  } note x_half = this[symmetric]
  4.1050 +
  4.1051 +  have "\<not> x < 0" using `0 \<le> Ifloat x` unfolding less_float_def by auto
  4.1052 +  let "?ub_horner x" = "ub_sin_cos_aux prec (get_odd (prec div 4 + 1)) 1 1 (x * x)"
  4.1053 +  let "?lb_horner x" = "lb_sin_cos_aux prec (get_even (prec div 4 + 1)) 1 1 (x * x)"
  4.1054 +  let "?ub_half x" = "Float 1 1 * x * x - 1"
  4.1055 +  let "?lb_half x" = "if x < 0 then - 1 else Float 1 1 * x * x - 1"
  4.1056 +
  4.1057 +  show ?thesis
  4.1058 +  proof (cases "x < Float 1 -1")
  4.1059 +    case True hence "Ifloat x \<le> pi / 2" unfolding less_float_def using pi_ge_two by auto
  4.1060 +    show ?thesis unfolding lb_cos_def[where x=x] ub_cos_def[where x=x] if_not_P[OF `\<not> x < 0`] if_P[OF `x < Float 1 -1`] Let_def
  4.1061 +      using cos_boundaries[OF `0 \<le> Ifloat x` `Ifloat x \<le> pi / 2`] .
  4.1062 +  next
  4.1063 +    case False
  4.1064 +    
  4.1065 +    { fix y x :: float let ?x2 = "Ifloat (x * Float 1 -1)"
  4.1066 +      assume "Ifloat y \<le> cos ?x2" and "-pi \<le> Ifloat x" and "Ifloat x \<le> pi"
  4.1067 +      hence "- (pi / 2) \<le> ?x2" and "?x2 \<le> pi / 2" using pi_ge_two unfolding Ifloat_mult Float_num by auto
  4.1068 +      hence "0 \<le> cos ?x2" by (rule cos_ge_zero)
  4.1069 +      
  4.1070 +      have "Ifloat (?lb_half y) \<le> cos (Ifloat x)"
  4.1071 +      proof (cases "y < 0")
  4.1072 +	case True show ?thesis using cos_ge_minus_one unfolding if_P[OF True] by auto
  4.1073 +      next
  4.1074 +	case False
  4.1075 +	hence "0 \<le> Ifloat y" unfolding less_float_def by auto
  4.1076 +	from mult_mono[OF `Ifloat y \<le> cos ?x2` `Ifloat y \<le> cos ?x2` `0 \<le> cos ?x2` this]
  4.1077 +	have "Ifloat y * Ifloat y \<le> cos ?x2 * cos ?x2" .
  4.1078 +	hence "2 * Ifloat y * Ifloat y \<le> 2 * cos ?x2 * cos ?x2" by auto
  4.1079 +	hence "2 * Ifloat y * Ifloat y - 1 \<le> 2 * cos (Ifloat x / 2) * cos (Ifloat x / 2) - 1" unfolding Float_num Ifloat_mult by auto
  4.1080 +	thus ?thesis unfolding if_not_P[OF False] x_half Float_num Ifloat_mult Ifloat_sub by auto
  4.1081 +      qed
  4.1082 +    } note lb_half = this
  4.1083 +    
  4.1084 +    { fix y x :: float let ?x2 = "Ifloat (x * Float 1 -1)"
  4.1085 +      assume ub: "cos ?x2 \<le> Ifloat y" and "- pi \<le> Ifloat x" and "Ifloat x \<le> pi"
  4.1086 +      hence "- (pi / 2) \<le> ?x2" and "?x2 \<le> pi / 2" using pi_ge_two unfolding Ifloat_mult Float_num by auto
  4.1087 +      hence "0 \<le> cos ?x2" by (rule cos_ge_zero)
  4.1088 +      
  4.1089 +      have "cos (Ifloat x) \<le> Ifloat (?ub_half y)"
  4.1090 +      proof -
  4.1091 +	have "0 \<le> Ifloat y" using `0 \<le> cos ?x2` ub by (rule order_trans)
  4.1092 +	from mult_mono[OF ub ub this `0 \<le> cos ?x2`]
  4.1093 +	have "cos ?x2 * cos ?x2 \<le> Ifloat y * Ifloat y" .
  4.1094 +	hence "2 * cos ?x2 * cos ?x2 \<le> 2 * Ifloat y * Ifloat y" by auto
  4.1095 +	hence "2 * cos (Ifloat x / 2) * cos (Ifloat x / 2) - 1 \<le> 2 * Ifloat y * Ifloat y - 1" unfolding Float_num Ifloat_mult by auto
  4.1096 +	thus ?thesis unfolding x_half Ifloat_mult Float_num Ifloat_sub by auto
  4.1097 +      qed
  4.1098 +    } note ub_half = this
  4.1099 +    
  4.1100 +    let ?x2 = "x * Float 1 -1"
  4.1101 +    let ?x4 = "x * Float 1 -1 * Float 1 -1"
  4.1102 +    
  4.1103 +    have "-pi \<le> Ifloat x" using pi_ge_zero[THEN le_imp_neg_le, unfolded minus_zero] `0 \<le> Ifloat x` by (rule order_trans)
  4.1104 +    
  4.1105 +    show ?thesis
  4.1106 +    proof (cases "x < 1")
  4.1107 +      case True hence "Ifloat x \<le> 1" unfolding less_float_def by auto
  4.1108 +      have "0 \<le> Ifloat ?x2" and "Ifloat ?x2 \<le> pi / 2" using pi_ge_two `0 \<le> Ifloat x` unfolding Ifloat_mult Float_num using assms by auto
  4.1109 +      from cos_boundaries[OF this]
  4.1110 +      have lb: "Ifloat (?lb_horner ?x2) \<le> ?cos ?x2" and ub: "?cos ?x2 \<le> Ifloat (?ub_horner ?x2)" by auto
  4.1111 +      
  4.1112 +      have "Ifloat (?lb x) \<le> ?cos x"
  4.1113 +      proof -
  4.1114 +	from lb_half[OF lb `-pi \<le> Ifloat x` `Ifloat x \<le> pi`]
  4.1115 +	show ?thesis unfolding lb_cos_def[where x=x] Let_def using `\<not> x < 0` `\<not> x < Float 1 -1` `x < 1` by auto
  4.1116 +      qed
  4.1117 +      moreover have "?cos x \<le> Ifloat (?ub x)"
  4.1118 +      proof -
  4.1119 +	from ub_half[OF ub `-pi \<le> Ifloat x` `Ifloat x \<le> pi`]
  4.1120 +	show ?thesis unfolding ub_cos_def[where x=x] Let_def using `\<not> x < 0` `\<not> x < Float 1 -1` `x < 1` by auto 
  4.1121 +      qed
  4.1122 +      ultimately show ?thesis by auto
  4.1123 +    next
  4.1124 +      case False
  4.1125 +      have "0 \<le> Ifloat ?x4" and "Ifloat ?x4 \<le> pi / 2" using pi_ge_two `0 \<le> Ifloat x` `Ifloat x \<le> pi` unfolding Ifloat_mult Float_num by auto
  4.1126 +      from cos_boundaries[OF this]
  4.1127 +      have lb: "Ifloat (?lb_horner ?x4) \<le> ?cos ?x4" and ub: "?cos ?x4 \<le> Ifloat (?ub_horner ?x4)" by auto
  4.1128 +      
  4.1129 +      have eq_4: "?x2 * Float 1 -1 = x * Float 1 -2" by (cases x, auto simp add: times_float.simps)
  4.1130 +      
  4.1131 +      have "Ifloat (?lb x) \<le> ?cos x"
  4.1132 +      proof -
  4.1133 +	have "-pi \<le> Ifloat ?x2" and "Ifloat ?x2 \<le> pi" unfolding Ifloat_mult Float_num using pi_ge_two `0 \<le> Ifloat x` `Ifloat x \<le> pi` by auto
  4.1134 +	from lb_half[OF lb_half[OF lb this] `-pi \<le> Ifloat x` `Ifloat x \<le> pi`, unfolded eq_4]
  4.1135 +	show ?thesis unfolding lb_cos_def[where x=x] if_not_P[OF `\<not> x < 0`] if_not_P[OF `\<not> x < Float 1 -1`] if_not_P[OF `\<not> x < 1`] Let_def .
  4.1136 +      qed
  4.1137 +      moreover have "?cos x \<le> Ifloat (?ub x)"
  4.1138 +      proof -
  4.1139 +	have "-pi \<le> Ifloat ?x2" and "Ifloat ?x2 \<le> pi" unfolding Ifloat_mult Float_num using pi_ge_two `0 \<le> Ifloat x` `Ifloat x \<le> pi` by auto
  4.1140 +	from ub_half[OF ub_half[OF ub this] `-pi \<le> Ifloat x` `Ifloat x \<le> pi`, unfolded eq_4]
  4.1141 +	show ?thesis unfolding ub_cos_def[where x=x] if_not_P[OF `\<not> x < 0`] if_not_P[OF `\<not> x < Float 1 -1`] if_not_P[OF `\<not> x < 1`] Let_def .
  4.1142 +      qed
  4.1143 +      ultimately show ?thesis by auto
  4.1144 +    qed
  4.1145 +  qed
  4.1146 +qed
  4.1147 +
  4.1148 +lemma lb_cos_minus: assumes "-pi \<le> Ifloat x" and "Ifloat x \<le> 0" 
  4.1149 +  shows "cos (Ifloat (-x)) \<in> {Ifloat (lb_cos prec (-x)) .. Ifloat (ub_cos prec (-x))}"
  4.1150 +proof -
  4.1151 +  have "0 \<le> Ifloat (-x)" and "Ifloat (-x) \<le> pi" using `-pi \<le> Ifloat x` `Ifloat x \<le> 0` by auto
  4.1152 +  from lb_cos[OF this] show ?thesis .
  4.1153 +qed
  4.1154 +
  4.1155 +lemma bnds_cos: "\<forall> x lx ux. (l, u) = bnds_cos prec lx ux \<and> x \<in> {Ifloat lx .. Ifloat ux} \<longrightarrow> Ifloat l \<le> cos x \<and> cos x \<le> Ifloat u"
  4.1156 +proof (rule allI, rule allI, rule allI, rule impI)
  4.1157 +  fix x lx ux
  4.1158 +  assume "(l, u) = bnds_cos prec lx ux \<and> x \<in> {Ifloat lx .. Ifloat ux}"
  4.1159 +  hence bnds: "(l, u) = bnds_cos prec lx ux" and x: "x \<in> {Ifloat lx .. Ifloat ux}" by auto
  4.1160 +
  4.1161 +  let ?lpi = "lb_pi prec"  
  4.1162 +  have [intro!]: "Ifloat lx \<le> Ifloat ux" using x by auto
  4.1163 +  hence "lx \<le> ux" unfolding le_float_def .
  4.1164 +
  4.1165 +  show "Ifloat l \<le> cos x \<and> cos x \<le> Ifloat u"
  4.1166 +  proof (cases "lx < -?lpi \<or> ux > ?lpi")
  4.1167 +    case True
  4.1168 +    show ?thesis using bnds unfolding bnds_cos_def if_P[OF True] Let_def using cos_le_one cos_ge_minus_one by auto
  4.1169 +  next
  4.1170 +    case False note not_out = this
  4.1171 +    hence lpi_lx: "- Ifloat ?lpi \<le> Ifloat lx" and lpi_ux: "Ifloat ux \<le> Ifloat ?lpi" unfolding le_float_def less_float_def by auto
  4.1172 +
  4.1173 +    from pi_boundaries[unfolded atLeastAtMost_iff, THEN conjunct1, THEN le_imp_neg_le] lpi_lx
  4.1174 +    have "- pi \<le> Ifloat lx" by (rule order_trans)
  4.1175 +    hence "- pi \<le> x" and "- pi \<le> Ifloat ux" and "x \<le> Ifloat ux" using x by auto
  4.1176 +    
  4.1177 +    from lpi_ux pi_boundaries[unfolded atLeastAtMost_iff, THEN conjunct1]
  4.1178 +    have "Ifloat ux \<le> pi" by (rule order_trans)
  4.1179 +    hence "x \<le> pi" and "Ifloat lx \<le> pi" and "Ifloat lx \<le> x" using x by auto
  4.1180 +
  4.1181 +    note lb_cos_minus_bottom = lb_cos_minus[unfolded atLeastAtMost_iff, THEN conjunct1]
  4.1182 +    note lb_cos_minus_top = lb_cos_minus[unfolded atLeastAtMost_iff, THEN conjunct2]
  4.1183 +    note lb_cos_bottom = lb_cos[unfolded atLeastAtMost_iff, THEN conjunct1]
  4.1184 +    note lb_cos_top = lb_cos[unfolded atLeastAtMost_iff, THEN conjunct2]
  4.1185 +
  4.1186 +    show ?thesis
  4.1187 +    proof (cases "ux \<le> 0")
  4.1188 +      case True hence "Ifloat ux \<le> 0" unfolding le_float_def by auto
  4.1189 +      hence "x \<le> 0" and "Ifloat lx \<le> 0" using x by auto
  4.1190 +      
  4.1191 +      { have "Ifloat (lb_cos prec (-lx)) \<le> cos (Ifloat (-lx))" using lb_cos_minus_bottom[OF `-pi \<le> Ifloat lx` `Ifloat lx \<le> 0`] .
  4.1192 +	also have "\<dots> \<le> cos x" unfolding Ifloat_minus cos_minus using cos_monotone_minus_pi_0'[OF `- pi \<le> Ifloat lx` `Ifloat lx \<le> x` `x \<le> 0`] .
  4.1193 +	finally have "Ifloat (lb_cos prec (-lx)) \<le> cos x" . }
  4.1194 +      moreover
  4.1195 +      { have "cos x \<le> cos (Ifloat (-ux))" unfolding Ifloat_minus cos_minus using cos_monotone_minus_pi_0'[OF `- pi \<le> x` `x \<le> Ifloat ux` `Ifloat ux \<le> 0`] .
  4.1196 +	also have "\<dots> \<le> Ifloat (ub_cos prec (-ux))" using lb_cos_minus_top[OF `-pi \<le> Ifloat ux` `Ifloat ux \<le> 0`] .
  4.1197 +	finally have "cos x \<le> Ifloat (ub_cos prec (-ux))" . }
  4.1198 +      ultimately show ?thesis using bnds unfolding bnds_cos_def Let_def if_not_P[OF not_out] if_P[OF True] by auto
  4.1199 +    next
  4.1200 +      case False note not_ux = this
  4.1201 +      
  4.1202 +      show ?thesis
  4.1203 +      proof (cases "0 \<le> lx")
  4.1204 +	case True hence "0 \<le> Ifloat lx" unfolding le_float_def by auto
  4.1205 +	hence "0 \<le> x" and "0 \<le> Ifloat ux" using x by auto
  4.1206 +      
  4.1207 +	{ have "Ifloat (lb_cos prec ux) \<le> cos (Ifloat ux)" using lb_cos_bottom[OF `0 \<le> Ifloat ux` `Ifloat ux \<le> pi`] .
  4.1208 +	  also have "\<dots> \<le> cos x" using cos_monotone_0_pi'[OF `0 \<le> x` `x \<le> Ifloat ux` `Ifloat ux \<le> pi`] .
  4.1209 +	  finally have "Ifloat (lb_cos prec ux) \<le> cos x" . }
  4.1210 +	moreover
  4.1211 +	{ have "cos x \<le> cos (Ifloat lx)" using cos_monotone_0_pi'[OF `0 \<le> Ifloat lx` `Ifloat lx \<le> x` `x \<le> pi`] .
  4.1212 +	  also have "\<dots> \<le> Ifloat (ub_cos prec lx)" using lb_cos_top[OF `0 \<le> Ifloat lx` `Ifloat lx \<le> pi`] .
  4.1213 +	  finally have "cos x \<le> Ifloat (ub_cos prec lx)" . }
  4.1214 +	ultimately show ?thesis using bnds unfolding bnds_cos_def Let_def if_not_P[OF not_out] if_not_P[OF not_ux] if_P[OF True] by auto
  4.1215 +      next
  4.1216 +	case False with not_ux
  4.1217 +	have "Ifloat lx \<le> 0" and "0 \<le> Ifloat ux" unfolding le_float_def by auto
  4.1218 +
  4.1219 +	have "Ifloat (min (lb_cos prec (-lx)) (lb_cos prec ux)) \<le> cos x"
  4.1220 +	proof (cases "x \<le> 0")
  4.1221 +	  case True
  4.1222 +	  have "Ifloat (lb_cos prec (-lx)) \<le> cos (Ifloat (-lx))" using lb_cos_minus_bottom[OF `-pi \<le> Ifloat lx` `Ifloat lx \<le> 0`] .
  4.1223 +	  also have "\<dots> \<le> cos x" unfolding Ifloat_minus cos_minus using cos_monotone_minus_pi_0'[OF `- pi \<le> Ifloat lx` `Ifloat lx \<le> x` `x \<le> 0`] .
  4.1224 +	  finally show ?thesis unfolding Ifloat_min by auto
  4.1225 +	next
  4.1226 +	  case False hence "0 \<le> x" by auto
  4.1227 +	  have "Ifloat (lb_cos prec ux) \<le> cos (Ifloat ux)" using lb_cos_bottom[OF `0 \<le> Ifloat ux` `Ifloat ux \<le> pi`] .
  4.1228 +	  also have "\<dots> \<le> cos x" using cos_monotone_0_pi'[OF `0 \<le> x` `x \<le> Ifloat ux` `Ifloat ux \<le> pi`] .
  4.1229 +	  finally show ?thesis unfolding Ifloat_min by auto
  4.1230 +	qed
  4.1231 +	moreover have "cos x \<le> Ifloat (Float 1 0)" by auto
  4.1232 +	ultimately show ?thesis using bnds unfolding bnds_cos_def Let_def if_not_P[OF not_out] if_not_P[OF not_ux] if_not_P[OF False] by auto
  4.1233 +      qed
  4.1234 +    qed
  4.1235 +  qed
  4.1236 +qed
  4.1237 +
  4.1238 +subsection "Compute the sinus in the entire domain"
  4.1239 +
  4.1240 +function lb_sin :: "nat \<Rightarrow> float \<Rightarrow> float" and ub_sin :: "nat \<Rightarrow> float \<Rightarrow> float" where
  4.1241 +"lb_sin prec x = (let sqr_diff = \<lambda> x. if x > 1 then 0 else 1 - x * x 
  4.1242 +  in if x < 0           then - ub_sin prec (- x)
  4.1243 +else if x \<le> Float 1 -1  then x * lb_sin_cos_aux prec (get_even (prec div 4 + 1)) 2 1 (x * x)
  4.1244 +                        else the (lb_sqrt prec (sqr_diff (ub_cos prec x))))" |
  4.1245 +
  4.1246 +"ub_sin prec x = (let sqr_diff = \<lambda> x. if x < 0 then 1 else 1 - x * x
  4.1247 +  in if x < 0           then - lb_sin prec (- x)
  4.1248 +else if x \<le> Float 1 -1  then x * ub_sin_cos_aux prec (get_odd (prec div 4 + 1)) 2 1 (x * x)
  4.1249 +                        else the (ub_sqrt prec (sqr_diff (lb_cos prec x))))"
  4.1250 +by pat_completeness auto
  4.1251 +termination by (relation "measure (\<lambda> v. let (prec, x) = sum_case id id v in (if x < 0 then 1 else 0))", auto simp add: less_float_def)
  4.1252 +
  4.1253 +definition bnds_sin :: "nat \<Rightarrow> float \<Rightarrow> float \<Rightarrow> float * float" where
  4.1254 +"bnds_sin prec lx ux = (let 
  4.1255 +    lpi = lb_pi prec ;
  4.1256 +    half_pi = lpi * Float 1 -1
  4.1257 +  in if lx \<le> - half_pi \<or> half_pi \<le> ux then (Float -1 0, Float 1 0)
  4.1258 +                                       else (lb_sin prec lx, ub_sin prec ux))"
  4.1259 +
  4.1260 +lemma lb_sin: assumes "- (pi / 2) \<le> Ifloat x" and "Ifloat x \<le> pi / 2"
  4.1261 +  shows "sin (Ifloat x) \<in> { Ifloat (lb_sin prec x) .. Ifloat (ub_sin prec x) }" (is "?sin x \<in> { ?lb x .. ?ub x}")
  4.1262 +proof -
  4.1263 +  { fix x :: float assume "0 \<le> Ifloat x" and "Ifloat x \<le> pi / 2"
  4.1264 +    hence "\<not> (x < 0)" and "- (pi / 2) \<le> Ifloat x" unfolding less_float_def using pi_ge_two by auto
  4.1265 +
  4.1266 +    have "Ifloat x \<le> pi" using `Ifloat x \<le> pi / 2` using pi_ge_two by auto
  4.1267 +
  4.1268 +    have "?sin x \<in> { ?lb x .. ?ub x}"
  4.1269 +    proof (cases "x \<le> Float 1 -1")
  4.1270 +      case True from sin_boundaries[OF `0 \<le> Ifloat x` `Ifloat x \<le> pi / 2`]
  4.1271 +      show ?thesis unfolding lb_sin.simps[of prec x] ub_sin.simps[of prec x] if_not_P[OF `\<not> (x < 0)`] if_P[OF True] Let_def .
  4.1272 +    next
  4.1273 +      case False
  4.1274 +      have "0 \<le> cos (Ifloat x)" using cos_ge_zero[OF _ `Ifloat x \<le> pi /2`] `0 \<le> Ifloat x` pi_ge_two by auto
  4.1275 +      have "0 \<le> sin (Ifloat x)" using `0 \<le> Ifloat x` and `Ifloat x \<le> pi / 2` using sin_ge_zero by auto
  4.1276 +      
  4.1277 +      have "?sin x \<le> ?ub x"
  4.1278 +      proof (cases "lb_cos prec x < 0")
  4.1279 +	case True
  4.1280 +	have "?sin x \<le> 1" using sin_le_one .
  4.1281 +	also have "\<dots> \<le> Ifloat (the (ub_sqrt prec 1))" using ub_sqrt_lower_bound[where prec=prec and x=1] unfolding Ifloat_1 by auto
  4.1282 +	finally show ?thesis unfolding ub_sin.simps if_not_P[OF `\<not> (x < 0)`] if_not_P[OF `\<not> x \<le> Float 1 -1`] if_P[OF True] Let_def .
  4.1283 +      next
  4.1284 +	case False hence "0 \<le> Ifloat (lb_cos prec x)" unfolding less_float_def by auto
  4.1285 +	
  4.1286 +	have "sin (Ifloat x) = sqrt (1 - cos (Ifloat x) ^ 2)" unfolding sin_squared_eq[symmetric] real_sqrt_abs using `0 \<le> sin (Ifloat x)` by auto
  4.1287 +	also have "\<dots> \<le> sqrt (Ifloat (1 - lb_cos prec x * lb_cos prec x))" 
  4.1288 +	proof (rule real_sqrt_le_mono)
  4.1289 +	  have "Ifloat (lb_cos prec x * lb_cos prec x) \<le> cos (Ifloat x) ^ 2" unfolding numeral_2_eq_2 power_Suc2 realpow_0 Ifloat_mult
  4.1290 +	    using `0 \<le> Ifloat (lb_cos prec x)` lb_cos[OF `0 \<le> Ifloat x` `Ifloat x \<le> pi`] `0 \<le> cos (Ifloat x)` by(auto intro!: mult_mono)
  4.1291 +	  thus "1 - cos (Ifloat x) ^ 2 \<le> Ifloat (1 - lb_cos prec x * lb_cos prec x)" unfolding Ifloat_sub Ifloat_1 by auto
  4.1292 +	qed
  4.1293 +	also have "\<dots> \<le> Ifloat (the (ub_sqrt prec (1 - lb_cos prec x * lb_cos prec x)))"
  4.1294 +	proof (rule ub_sqrt_lower_bound)
  4.1295 +	  have "Ifloat (lb_cos prec x) \<le> cos (Ifloat x)" using lb_cos[OF `0 \<le> Ifloat x` `Ifloat x \<le> pi`] by auto
  4.1296 +	  from mult_mono[OF order_trans[OF this cos_le_one] order_trans[OF this cos_le_one]]
  4.1297 +	  have "Ifloat (lb_cos prec x) * Ifloat (lb_cos prec x) \<le> 1" using `0 \<le> Ifloat (lb_cos prec x)` by auto
  4.1298 +	  thus "0 \<le> Ifloat (1 - lb_cos prec x * lb_cos prec x)" by auto
  4.1299 +	qed
  4.1300 +	finally show ?thesis unfolding ub_sin.simps if_not_P[OF `\<not> (x < 0)`] if_not_P[OF `\<not> x \<le> Float 1 -1`] if_not_P[OF False] Let_def .
  4.1301 +      qed
  4.1302 +      moreover
  4.1303 +      have "?lb x \<le> ?sin x"
  4.1304 +      proof (cases "1 < ub_cos prec x")
  4.1305 +	case True
  4.1306 +	show ?thesis unfolding lb_sin.simps if_not_P[OF `\<not> (x < 0)`] if_not_P[OF `\<not> x \<le> Float 1 -1`] if_P[OF True] Let_def 
  4.1307 +	  by (rule order_trans[OF _ sin_ge_zero[OF `0 \<le> Ifloat x` `Ifloat x \<le> pi`]]) 
  4.1308 +        (auto simp add: lb_sqrt_upper_bound[where prec=prec and x=0, unfolded Ifloat_0 real_sqrt_zero])
  4.1309 +      next
  4.1310 +	case False hence "Ifloat (ub_cos prec x) \<le> 1" unfolding less_float_def by auto
  4.1311 +	have "0 \<le> Ifloat (ub_cos prec x)" using order_trans[OF `0 \<le> cos (Ifloat x)`] lb_cos `0 \<le> Ifloat x` `Ifloat x \<le> pi` by auto
  4.1312 +	
  4.1313 +	have "Ifloat (the (lb_sqrt prec (1 - ub_cos prec x * ub_cos prec x))) \<le> sqrt (Ifloat (1 - ub_cos prec x * ub_cos prec x))"
  4.1314 +	proof (rule lb_sqrt_upper_bound)
  4.1315 +	  from mult_mono[OF `Ifloat (ub_cos prec x) \<le> 1` `Ifloat (ub_cos prec x) \<le> 1`] `0 \<le> Ifloat (ub_cos prec x)`
  4.1316 +	  have "Ifloat (ub_cos prec x) * Ifloat (ub_cos prec x) \<le> 1" by auto
  4.1317 +	  thus "0 \<le> Ifloat (1 - ub_cos prec x * ub_cos prec x)" by auto
  4.1318 +	qed
  4.1319 +	also have "\<dots> \<le> sqrt (1 - cos (Ifloat x) ^ 2)"
  4.1320 +	proof (rule real_sqrt_le_mono)
  4.1321 +	  have "cos (Ifloat x) ^ 2 \<le> Ifloat (ub_cos prec x * ub_cos prec x)" unfolding numeral_2_eq_2 power_Suc2 realpow_0 Ifloat_mult
  4.1322 +	    using `0 \<le> Ifloat (ub_cos prec x)` lb_cos[OF `0 \<le> Ifloat x` `Ifloat x \<le> pi`] `0 \<le> cos (Ifloat x)` by(auto intro!: mult_mono)
  4.1323 +	  thus "Ifloat (1 - ub_cos prec x * ub_cos prec x) \<le> 1 - cos (Ifloat x) ^ 2" unfolding Ifloat_sub Ifloat_1 by auto
  4.1324 +	qed
  4.1325 +	also have "\<dots> = sin (Ifloat x)" unfolding sin_squared_eq[symmetric] real_sqrt_abs using `0 \<le> sin (Ifloat x)` by auto
  4.1326 +	finally show ?thesis unfolding lb_sin.simps if_not_P[OF `\<not> (x < 0)`] if_not_P[OF `\<not> x \<le> Float 1 -1`] if_not_P[OF False] Let_def .
  4.1327 +      qed
  4.1328 +      ultimately show ?thesis by auto
  4.1329 +    qed
  4.1330 +  } note for_pos = this
  4.1331 +
  4.1332 +  show ?thesis
  4.1333 +  proof (cases "x < 0")
  4.1334 +    case True 
  4.1335 +    hence "0 \<le> Ifloat (-x)" and "Ifloat (- x) \<le> pi / 2" using `-(pi/2) \<le> Ifloat x` unfolding less_float_def by auto
  4.1336 +    from for_pos[OF this]
  4.1337 +    show ?thesis unfolding Ifloat_minus sin_minus lb_sin.simps[of prec x] ub_sin.simps[of prec x] if_P[OF True] Let_def atLeastAtMost_iff by auto
  4.1338 +  next
  4.1339 +    case False hence "0 \<le> Ifloat x" unfolding less_float_def by auto
  4.1340 +    from for_pos[OF this `Ifloat x \<le> pi /2`]
  4.1341 +    show ?thesis .
  4.1342 +  qed
  4.1343 +qed
  4.1344 +
  4.1345 +lemma bnds_sin: "\<forall> x lx ux. (l, u) = bnds_sin prec lx ux \<and> x \<in> {Ifloat lx .. Ifloat ux} \<longrightarrow> Ifloat l \<le> sin x \<and> sin x \<le> Ifloat u"
  4.1346 +proof (rule allI, rule allI, rule allI, rule impI)
  4.1347 +  fix x lx ux
  4.1348 +  assume "(l, u) = bnds_sin prec lx ux \<and> x \<in> {Ifloat lx .. Ifloat ux}"
  4.1349 +  hence bnds: "(l, u) = bnds_sin prec lx ux" and x: "x \<in> {Ifloat lx .. Ifloat ux}" by auto
  4.1350 +  show "Ifloat l \<le> sin x \<and> sin x \<le> Ifloat u"
  4.1351 +  proof (cases "lx \<le> - (lb_pi prec * Float 1 -1) \<or> lb_pi prec * Float 1 -1 \<le> ux")
  4.1352 +    case True show ?thesis using bnds unfolding bnds_sin_def if_P[OF True] Let_def by auto
  4.1353 +  next
  4.1354 +    case False
  4.1355 +    hence "- lb_pi prec * Float 1 -1 \<le> lx" and "ux \<le> lb_pi prec * Float 1 -1" unfolding le_float_def by auto
  4.1356 +    moreover have "Ifloat (lb_pi prec * Float 1 -1) \<le> pi / 2" unfolding Ifloat_mult using pi_boundaries by auto
  4.1357 +    ultimately have "- (pi / 2) \<le> Ifloat lx" and "Ifloat ux \<le> pi / 2" and "Ifloat lx \<le> Ifloat ux" unfolding le_float_def using x by auto
  4.1358 +    hence "- (pi / 2) \<le> Ifloat ux" and "Ifloat lx \<le> pi / 2" by auto
  4.1359 +    
  4.1360 +    have "- (pi / 2) \<le> x""x \<le> pi / 2" using `Ifloat ux \<le> pi / 2` `- (pi /2) \<le> Ifloat lx` x by auto
  4.1361 +    
  4.1362 +    { have "Ifloat (lb_sin prec lx) \<le> sin (Ifloat lx)" using lb_sin[OF `- (pi / 2) \<le> Ifloat lx` `Ifloat lx \<le> pi / 2`] unfolding atLeastAtMost_iff by auto
  4.1363 +      also have "\<dots> \<le> sin x" using sin_monotone_2pi' `- (pi / 2) \<le> Ifloat lx` x `x \<le> pi / 2` by auto
  4.1364 +      finally have "Ifloat (lb_sin prec lx) \<le> sin x" . }
  4.1365 +    moreover
  4.1366 +    { have "sin x \<le> sin (Ifloat ux)" using sin_monotone_2pi' `- (pi / 2) \<le> x` x `Ifloat ux \<le> pi / 2` by auto
  4.1367 +      also have "\<dots> \<le> Ifloat (ub_sin prec ux)" using lb_sin[OF `- (pi / 2) \<le> Ifloat ux` `Ifloat ux \<le> pi / 2`] unfolding atLeastAtMost_iff by auto
  4.1368 +      finally have "sin x \<le> Ifloat (ub_sin prec ux)" . }
  4.1369 +    ultimately
  4.1370 +    show ?thesis using bnds unfolding bnds_sin_def if_not_P[OF False] Let_def by auto
  4.1371 +  qed
  4.1372 +qed
  4.1373 +
  4.1374 +section "Exponential function"
  4.1375 +
  4.1376 +subsection "Compute the series of the exponential function"
  4.1377 +
  4.1378 +fun ub_exp_horner :: "nat \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> float \<Rightarrow> float" and lb_exp_horner :: "nat \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> float \<Rightarrow> float" where
  4.1379 +"ub_exp_horner prec 0 i k x       = 0" |
  4.1380 +"ub_exp_horner prec (Suc n) i k x = rapprox_rat prec 1 (int k) + x * lb_exp_horner prec n (i + 1) (k * i) x" |
  4.1381 +"lb_exp_horner prec 0 i k x       = 0" |
  4.1382 +"lb_exp_horner prec (Suc n) i k x = lapprox_rat prec 1 (int k) + x * ub_exp_horner prec n (i + 1) (k * i) x"
  4.1383 +
  4.1384 +lemma bnds_exp_horner: assumes "Ifloat x \<le> 0"
  4.1385 +  shows "exp (Ifloat x) \<in> { Ifloat (lb_exp_horner prec (get_even n) 1 1 x) .. Ifloat (ub_exp_horner prec (get_odd n) 1 1 x) }"
  4.1386 +proof -
  4.1387 +  { fix n
  4.1388 +    have F: "\<And> m. ((\<lambda>i. i + 1) ^ n) m = n + m" by (induct n, auto)
  4.1389 +    have "fact (Suc n) = fact n * ((\<lambda>i. i + 1) ^ n) 1" unfolding F by auto } note f_eq = this
  4.1390 +    
  4.1391 +  note bounds = horner_bounds_nonpos[where f="fact" and lb="lb_exp_horner prec" and ub="ub_exp_horner prec" and j'=0 and s=1,
  4.1392 +    OF assms f_eq lb_exp_horner.simps ub_exp_horner.simps]
  4.1393 +
  4.1394 +  { have "Ifloat (lb_exp_horner prec (get_even n) 1 1 x) \<le> (\<Sum>j = 0..<get_even n. 1 / real (fact j) * Ifloat x ^ j)"
  4.1395 +      using bounds(1) by auto
  4.1396 +    also have "\<dots> \<le> exp (Ifloat x)"
  4.1397 +    proof -
  4.1398 +      obtain t where "\<bar>t\<bar> \<le> \<bar>Ifloat x\<bar>" and "exp (Ifloat x) = (\<Sum>m = 0..<get_even n. (Ifloat x) ^ m / real (fact m)) + exp t / real (fact (get_even n)) * (Ifloat x) ^ (get_even n)"
  4.1399 +	using Maclaurin_exp_le by blast
  4.1400 +      moreover have "0 \<le> exp t / real (fact (get_even n)) * (Ifloat x) ^ (get_even n)"
  4.1401 +	by (auto intro!: mult_nonneg_nonneg divide_nonneg_pos simp add: get_even zero_le_even_power exp_gt_zero)
  4.1402 +      ultimately show ?thesis
  4.1403 +	using get_odd exp_gt_zero by (auto intro!: pordered_cancel_semiring_class.mult_nonneg_nonneg)
  4.1404 +    qed
  4.1405 +    finally have "Ifloat (lb_exp_horner prec (get_even n) 1 1 x) \<le> exp (Ifloat x)" .
  4.1406 +  } moreover
  4.1407 +  { 
  4.1408 +    have x_less_zero: "Ifloat x ^ get_odd n \<le> 0"
  4.1409 +    proof (cases "Ifloat x = 0")
  4.1410 +      case True
  4.1411 +      have "(get_odd n) \<noteq> 0" using get_odd[THEN odd_pos] by auto
  4.1412 +      thus ?thesis unfolding True power_0_left by auto
  4.1413 +    next
  4.1414 +      case False hence "Ifloat x < 0" using `Ifloat x \<le> 0` by auto
  4.1415 +      show ?thesis by (rule less_imp_le, auto simp add: power_less_zero_eq get_odd `Ifloat x < 0`)
  4.1416 +    qed
  4.1417 +
  4.1418 +    obtain t where "\<bar>t\<bar> \<le> \<bar>Ifloat x\<bar>" and "exp (Ifloat x) = (\<Sum>m = 0..<get_odd n. (Ifloat x) ^ m / real (fact m)) + exp t / real (fact (get_odd n)) * (Ifloat x) ^ (get_odd n)"
  4.1419 +      using Maclaurin_exp_le by blast
  4.1420 +    moreover have "exp t / real (fact (get_odd n)) * (Ifloat x) ^ (get_odd n) \<le> 0"
  4.1421 +      by (auto intro!: mult_nonneg_nonpos divide_nonpos_pos simp add: x_less_zero exp_gt_zero)
  4.1422 +    ultimately have "exp (Ifloat x) \<le> (\<Sum>j = 0..<get_odd n. 1 / real (fact j) * Ifloat x ^ j)"
  4.1423 +      using get_odd exp_gt_zero by (auto intro!: pordered_cancel_semiring_class.mult_nonneg_nonneg)
  4.1424 +    also have "\<dots> \<le> Ifloat (ub_exp_horner prec (get_odd n) 1 1 x)"
  4.1425 +      using bounds(2) by auto
  4.1426 +    finally have "exp (Ifloat x) \<le> Ifloat (ub_exp_horner prec (get_odd n) 1 1 x)" .
  4.1427 +  } ultimately show ?thesis by auto
  4.1428 +qed
  4.1429 +
  4.1430 +subsection "Compute the exponential function on the entire domain"
  4.1431 +
  4.1432 +function ub_exp :: "nat \<Rightarrow> float \<Rightarrow> float" and lb_exp :: "nat \<Rightarrow> float \<Rightarrow> float" where
  4.1433 +"lb_exp prec x = (if 0 < x then float_divl prec 1 (ub_exp prec (-x))
  4.1434 +             else let 
  4.1435 +                horner = (\<lambda> x. let  y = lb_exp_horner prec (get_even (prec + 2)) 1 1 x  in if y \<le> 0 then Float 1 -2 else y)
  4.1436 +             in if x < - 1 then (case floor_fl x of (Float m e) \<Rightarrow> (horner (float_divl prec x (- Float m e))) ^ (nat (-m) * 2 ^ nat e))
  4.1437 +                           else horner x)" |
  4.1438 +"ub_exp prec x = (if 0 < x    then float_divr prec 1 (lb_exp prec (-x))
  4.1439 +             else if x < - 1  then (case floor_fl x of (Float m e) \<Rightarrow> 
  4.1440 +                                    (ub_exp_horner prec (get_odd (prec + 2)) 1 1 (float_divr prec x (- Float m e))) ^ (nat (-m) * 2 ^ nat e))
  4.1441 +                              else ub_exp_horner prec (get_odd (prec + 2)) 1 1 x)"
  4.1442 +by pat_completeness auto
  4.1443 +termination by (relation "measure (\<lambda> v. let (prec, x) = sum_case id id v in (if 0 < x then 1 else 0))", auto simp add: less_float_def)
  4.1444 +
  4.1445 +lemma exp_m1_ge_quarter: "(1 / 4 :: real) \<le> exp (- 1)"
  4.1446 +proof -
  4.1447 +  have eq4: "4 = Suc (Suc (Suc (Suc 0)))" by auto
  4.1448 +
  4.1449 +  have "1 / 4 = Ifloat (Float 1 -2)" unfolding Float_num by auto
  4.1450 +  also have "\<dots> \<le> Ifloat (lb_exp_horner 1 (get_even 4) 1 1 (- 1))"
  4.1451 +    unfolding get_even_def eq4 
  4.1452 +    by (auto simp add: lapprox_posrat_def rapprox_posrat_def normfloat.simps)
  4.1453 +  also have "\<dots> \<le> exp (Ifloat (- 1))" using bnds_exp_horner[where x="- 1"] by auto
  4.1454 +  finally show ?thesis unfolding Ifloat_minus Ifloat_1 . 
  4.1455 +qed
  4.1456 +
  4.1457 +lemma lb_exp_pos: assumes "\<not> 0 < x" shows "0 < lb_exp prec x"
  4.1458 +proof -
  4.1459 +  let "?lb_horner x" = "lb_exp_horner prec (get_even (prec + 2)) 1 1 x"
  4.1460 +  let "?horner x" = "let  y = ?lb_horner x  in if y \<le> 0 then Float 1 -2 else y"
  4.1461 +  have pos_horner: "\<And> x. 0 < ?horner x" unfolding Let_def by (cases "?lb_horner x \<le> 0", auto simp add: le_float_def less_float_def)
  4.1462 +  moreover { fix x :: float fix num :: nat
  4.1463 +    have "0 < Ifloat (?horner x) ^ num" using `0 < ?horner x`[unfolded less_float_def Ifloat_0] by (rule zero_less_power)
  4.1464 +    also have "\<dots> = Ifloat ((?horner x) ^ num)" using float_power by auto
  4.1465 +    finally have "0 < Ifloat ((?horner x) ^ num)" .
  4.1466 +  }
  4.1467 +  ultimately show ?thesis
  4.1468 +    unfolding lb_exp.simps if_not_P[OF `\<not> 0 < x`] Let_def by (cases "floor_fl x", cases "x < - 1", auto simp add: le_float_def less_float_def normfloat) 
  4.1469 +qed
  4.1470 +
  4.1471 +lemma exp_boundaries': assumes "x \<le> 0"
  4.1472 +  shows "exp (Ifloat x) \<in> { Ifloat (lb_exp prec x) .. Ifloat (ub_exp prec x)}"
  4.1473 +proof -
  4.1474 +  let "?lb_exp_horner x" = "lb_exp_horner prec (get_even (prec + 2)) 1 1 x"
  4.1475 +  let "?ub_exp_horner x" = "ub_exp_horner prec (get_odd (prec + 2)) 1 1 x"
  4.1476 +
  4.1477 +  have "Ifloat x \<le> 0" and "\<not> x > 0" using `x \<le> 0` unfolding le_float_def less_float_def by auto
  4.1478 +  show ?thesis
  4.1479 +  proof (cases "x < - 1")
  4.1480 +    case False hence "- 1 \<le> Ifloat x" unfolding less_float_def by auto
  4.1481 +    show ?thesis
  4.1482 +    proof (cases "?lb_exp_horner x \<le> 0")
  4.1483 +      from `\<not> x < - 1` have "- 1 \<le> Ifloat x" unfolding less_float_def by auto
  4.1484 +      hence "exp (- 1) \<le> exp (Ifloat x)" unfolding exp_le_cancel_iff .
  4.1485 +      from order_trans[OF exp_m1_ge_quarter this]
  4.1486 +      have "Ifloat (Float 1 -2) \<le> exp (Ifloat x)" unfolding Float_num .
  4.1487 +      moreover case True
  4.1488 +      ultimately show ?thesis using bnds_exp_horner `Ifloat x \<le> 0` `\<not> x > 0` `\<not> x < - 1` by auto
  4.1489 +    next
  4.1490 +      case False thus ?thesis using bnds_exp_horner `Ifloat x \<le> 0` `\<not> x > 0` `\<not> x < - 1` by (auto simp add: Let_def)
  4.1491 +    qed
  4.1492 +  next
  4.1493 +    case True
  4.1494 +    
  4.1495 +    obtain m e where Float_floor: "floor_fl x = Float m e" by (cases "floor_fl x", auto)
  4.1496 +    let ?num = "nat (- m) * 2 ^ nat e"
  4.1497 +    
  4.1498 +    have "Ifloat (floor_fl x) < - 1" using floor_fl `x < - 1` unfolding le_float_def less_float_def Ifloat_minus Ifloat_1 by (rule order_le_less_trans)
  4.1499 +    hence "Ifloat (floor_fl x) < 0" unfolding Float_floor Ifloat.simps using zero_less_pow2[of xe] by auto
  4.1500 +    hence "m < 0"
  4.1501 +      unfolding less_float_def Ifloat_0 Float_floor Ifloat.simps
  4.1502 +      unfolding pos_prod_lt[OF zero_less_pow2[of e], unfolded real_mult_commute] by auto
  4.1503 +    hence "1 \<le> - m" by auto
  4.1504 +    hence "0 < nat (- m)" by auto
  4.1505 +    moreover
  4.1506 +    have "0 \<le> e" using floor_pos_exp Float_floor[symmetric] by auto
  4.1507 +    hence "(0::nat) < 2 ^ nat e" by auto
  4.1508 +    ultimately have "0 < ?num"  by auto
  4.1509 +    hence "real ?num \<noteq> 0" by auto
  4.1510 +    have e_nat: "int (nat e) = e" using `0 \<le> e` by auto
  4.1511 +    have num_eq: "real ?num = Ifloat (- floor_fl x)" using `0 < nat (- m)`
  4.1512 +      unfolding Float_floor Ifloat_minus Ifloat.simps real_of_nat_mult pow2_int[of "nat e", unfolded e_nat] realpow_real_of_nat[symmetric] by auto
  4.1513 +    have "0 < - floor_fl x" using `0 < ?num`[unfolded real_of_nat_less_iff[symmetric]] unfolding less_float_def num_eq[symmetric] Ifloat_0 real_of_nat_zero .
  4.1514 +    hence "Ifloat (floor_fl x) < 0" unfolding less_float_def by auto
  4.1515 +    
  4.1516 +    have "exp (Ifloat x) \<le> Ifloat (ub_exp prec x)"
  4.1517 +    proof -
  4.1518 +      have div_less_zero: "Ifloat (float_divr prec x (- floor_fl x)) \<le> 0" 
  4.1519 +	using float_divr_nonpos_pos_upper_bound[OF `x \<le> 0` `0 < - floor_fl x`] unfolding le_float_def Ifloat_0 .
  4.1520 +      
  4.1521 +      have "exp (Ifloat x) = exp (real ?num * (Ifloat x / real ?num))" using `real ?num \<noteq> 0` by auto
  4.1522 +      also have "\<dots> = exp (Ifloat x / real ?num) ^ ?num" unfolding exp_real_of_nat_mult ..
  4.1523 +      also have "\<dots> \<le> exp (Ifloat (float_divr prec x (- floor_fl x))) ^ ?num" unfolding num_eq
  4.1524 +	by (rule power_mono, rule exp_le_cancel_iff[THEN iffD2], rule float_divr) auto
  4.1525 +      also have "\<dots> \<le> Ifloat ((?ub_exp_horner (float_divr prec x (- floor_fl x))) ^ ?num)" unfolding float_power
  4.1526 +	by (rule power_mono, rule bnds_exp_horner[OF div_less_zero, unfolded atLeastAtMost_iff, THEN conjunct2], auto)
  4.1527 +      finally show ?thesis unfolding ub_exp.simps if_not_P[OF `\<not> 0 < x`] if_P[OF `x < - 1`] float.cases Float_floor Let_def .
  4.1528 +    qed
  4.1529 +    moreover 
  4.1530 +    have "Ifloat (lb_exp prec x) \<le> exp (Ifloat x)"
  4.1531 +    proof -
  4.1532 +      let ?divl = "float_divl prec x (- Float m e)"
  4.1533 +      let ?horner = "?lb_exp_horner ?divl"
  4.1534 +      
  4.1535 +      show ?thesis
  4.1536 +      proof (cases "?horner \<le> 0")
  4.1537 +	case False hence "0 \<le> Ifloat ?horner" unfolding le_float_def by auto
  4.1538 +	
  4.1539 +	have div_less_zero: "Ifloat (float_divl prec x (- floor_fl x)) \<le> 0"
  4.1540 +	  using `Ifloat (floor_fl x) < 0` `Ifloat x \<le> 0` by (auto intro!: order_trans[OF float_divl] divide_nonpos_neg)
  4.1541 +	
  4.1542 +	have "Ifloat ((?lb_exp_horner (float_divl prec x (- floor_fl x))) ^ ?num) \<le>  
  4.1543 +          exp (Ifloat (float_divl prec x (- floor_fl x))) ^ ?num" unfolding float_power 
  4.1544 +	  using `0 \<le> Ifloat ?horner`[unfolded Float_floor[symmetric]] bnds_exp_horner[OF div_less_zero, unfolded atLeastAtMost_iff, THEN conjunct1] by (auto intro!: power_mono)
  4.1545 +	also have "\<dots> \<le> exp (Ifloat x / real ?num) ^ ?num" unfolding num_eq
  4.1546 +	  using float_divl by (auto intro!: power_mono simp del: Ifloat_minus)
  4.1547 +	also have "\<dots> = exp (real ?num * (Ifloat x / real ?num))" unfolding exp_real_of_nat_mult ..
  4.1548 +	also have "\<dots> = exp (Ifloat x)" using `real ?num \<noteq> 0` by auto
  4.1549 +	finally show ?thesis
  4.1550 +	  unfolding lb_exp.simps if_not_P[OF `\<not> 0 < x`] if_P[OF `x < - 1`] float.cases Float_floor Let_def if_not_P[OF False] by auto
  4.1551 +      next
  4.1552 +	case True
  4.1553 +	have "Ifloat (floor_fl x) \<noteq> 0" and "Ifloat (floor_fl x) \<le> 0" using `Ifloat (floor_fl x) < 0` by auto
  4.1554 +	from divide_right_mono_neg[OF floor_fl[of x] `Ifloat (floor_fl x) \<le> 0`, unfolded divide_self[OF `Ifloat (floor_fl x) \<noteq> 0`]]
  4.1555 +	have "- 1 \<le> Ifloat x / Ifloat (- floor_fl x)" unfolding Ifloat_minus by auto
  4.1556 +	from order_trans[OF exp_m1_ge_quarter this[unfolded exp_le_cancel_iff[where x="- 1", symmetric]]]
  4.1557 +	have "Ifloat (Float 1 -2) \<le> exp (Ifloat x / Ifloat (- floor_fl x))" unfolding Float_num .
  4.1558 +	hence "Ifloat (Float 1 -2) ^ ?num \<le> exp (Ifloat x / Ifloat (- floor_fl x)) ^ ?num"
  4.1559 +	  by (auto intro!: power_mono simp add: Float_num)
  4.1560 +	also have "\<dots> = exp (Ifloat x)" unfolding num_eq exp_real_of_nat_mult[symmetric] using `Ifloat (floor_fl x) \<noteq> 0` by auto
  4.1561 +	finally show ?thesis
  4.1562 +	  unfolding lb_exp.simps if_not_P[OF `\<not> 0 < x`] if_P[OF `x < - 1`] float.cases Float_floor Let_def if_P[OF True] float_power .
  4.1563 +      qed
  4.1564 +    qed
  4.1565 +    ultimately show ?thesis by auto
  4.1566 +  qed
  4.1567 +qed
  4.1568 +
  4.1569 +lemma exp_boundaries: "exp (Ifloat x) \<in> { Ifloat (lb_exp prec x) .. Ifloat (ub_exp prec x)}"
  4.1570 +proof -
  4.1571 +  show ?thesis
  4.1572 +  proof (cases "0 < x")
  4.1573 +    case False hence "x \<le> 0" unfolding less_float_def le_float_def by auto 
  4.1574 +    from exp_boundaries'[OF this] show ?thesis .
  4.1575 +  next
  4.1576 +    case True hence "-x \<le> 0" unfolding less_float_def le_float_def by auto
  4.1577 +    
  4.1578 +    have "Ifloat (lb_exp prec x) \<le> exp (Ifloat x)"
  4.1579 +    proof -
  4.1580 +      from exp_boundaries'[OF `-x \<le> 0`]
  4.1581 +      have ub_exp: "exp (- Ifloat x) \<le> Ifloat (ub_exp prec (-x))" unfolding atLeastAtMost_iff Ifloat_minus by auto
  4.1582 +      
  4.1583 +      have "Ifloat (float_divl prec 1 (ub_exp prec (-x))) \<le> Ifloat 1 / Ifloat (ub_exp prec (-x))" using float_divl .
  4.1584 +      also have "Ifloat 1 / Ifloat (ub_exp prec (-x)) \<le> exp (Ifloat x)"
  4.1585 +	using ub_exp[unfolded inverse_le_iff_le[OF order_less_le_trans[OF exp_gt_zero ub_exp] exp_gt_zero, symmetric]]
  4.1586 +	unfolding exp_minus nonzero_inverse_inverse_eq[OF exp_not_eq_zero] inverse_eq_divide by auto
  4.1587 +      finally show ?thesis unfolding lb_exp.simps if_P[OF True] .
  4.1588 +    qed
  4.1589 +    moreover
  4.1590 +    have "exp (Ifloat x) \<le> Ifloat (ub_exp prec x)"
  4.1591 +    proof -
  4.1592 +      have "\<not> 0 < -x" using `0 < x` unfolding less_float_def by auto
  4.1593 +      
  4.1594 +      from exp_boundaries'[OF `-x \<le> 0`]
  4.1595 +      have lb_exp: "Ifloat (lb_exp prec (-x)) \<le> exp (- Ifloat x)" unfolding atLeastAtMost_iff Ifloat_minus by auto
  4.1596 +      
  4.1597 +      have "exp (Ifloat x) \<le> Ifloat 1 / Ifloat (lb_exp prec (-x))"
  4.1598 +	using lb_exp[unfolded inverse_le_iff_le[OF exp_gt_zero lb_exp_pos[OF `\<not> 0 < -x`, unfolded less_float_def Ifloat_0], symmetric]]
  4.1599 +	unfolding exp_minus nonzero_inverse_inverse_eq[OF exp_not_eq_zero] inverse_eq_divide Ifloat_1 by auto
  4.1600 +      also have "\<dots> \<le> Ifloat (float_divr prec 1 (lb_exp prec (-x)))" using float_divr .
  4.1601 +      finally show ?thesis unfolding ub_exp.simps if_P[OF True] .
  4.1602 +    qed
  4.1603 +    ultimately show ?thesis by auto
  4.1604 +  qed
  4.1605 +qed
  4.1606 +
  4.1607 +lemma bnds_exp: "\<forall> x lx ux. (l, u) = (lb_exp prec lx, ub_exp prec ux) \<and> x \<in> {Ifloat lx .. Ifloat ux} \<longrightarrow> Ifloat l \<le> exp x \<and> exp x \<le> Ifloat u"
  4.1608 +proof (rule allI, rule allI, rule allI, rule impI)
  4.1609 +  fix x lx ux
  4.1610 +  assume "(l, u) = (lb_exp prec lx, ub_exp prec ux) \<and> x \<in> {Ifloat lx .. Ifloat ux}"
  4.1611 +  hence l: "lb_exp prec lx = l " and u: "ub_exp prec ux = u" and x: "x \<in> {Ifloat lx .. Ifloat ux}" by auto
  4.1612 +
  4.1613 +  { from exp_boundaries[of lx prec, unfolded l]
  4.1614 +    have "Ifloat l \<le> exp (Ifloat lx)" by (auto simp del: lb_exp.simps)
  4.1615 +    also have "\<dots> \<le> exp x" using x by auto
  4.1616 +    finally have "Ifloat l \<le> exp x" .
  4.1617 +  } moreover
  4.1618 +  { have "exp x \<le> exp (Ifloat ux)" using x by auto
  4.1619 +    also have "\<dots> \<le> Ifloat u" using exp_boundaries[of ux prec, unfolded u] by (auto simp del: ub_exp.simps)
  4.1620 +    finally have "exp x \<le> Ifloat u" .
  4.1621 +  } ultimately show "Ifloat l \<le> exp x \<and> exp x \<le> Ifloat u" ..
  4.1622 +qed
  4.1623 +
  4.1624 +section "Logarithm"
  4.1625 +
  4.1626 +subsection "Compute the logarithm series"
  4.1627 +
  4.1628 +fun ub_ln_horner :: "nat \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> float \<Rightarrow> float" 
  4.1629 +and lb_ln_horner :: "nat \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> float \<Rightarrow> float" where
  4.1630 +"ub_ln_horner prec 0 i x       = 0" |
  4.1631 +"ub_ln_horner prec (Suc n) i x = rapprox_rat prec 1 (int i) - x * lb_ln_horner prec n (Suc i) x" |
  4.1632 +"lb_ln_horner prec 0 i x       = 0" |
  4.1633 +"lb_ln_horner prec (Suc n) i x = lapprox_rat prec 1 (int i) - x * ub_ln_horner prec n (Suc i) x"
  4.1634 +
  4.1635 +lemma ln_bounds:
  4.1636 +  assumes "0 \<le> x" and "x < 1"
  4.1637 +  shows "(\<Sum>i=0..<2*n. -1^i * (1 / real (i + 1)) * x^(Suc i)) \<le> ln (x + 1)" (is "?lb")
  4.1638 +  and "ln (x + 1) \<le> (\<Sum>i=0..<2*n + 1. -1^i * (1 / real (i + 1)) * x^(Suc i))" (is "?ub")
  4.1639 +proof -
  4.1640 +  let "?a n" = "(1/real (n +1)) * x^(Suc n)"
  4.1641 +
  4.1642 +  have ln_eq: "(\<Sum> i. -1^i * ?a i) = ln (x + 1)"
  4.1643 +    using ln_series[of "x + 1"] `0 \<le> x` `x < 1` by auto
  4.1644 +
  4.1645 +  have "norm x < 1" using assms by auto
  4.1646 +  have "?a ----> 0" unfolding Suc_plus1[symmetric] inverse_eq_divide[symmetric] 
  4.1647 +    using LIMSEQ_mult[OF LIMSEQ_inverse_real_of_nat LIMSEQ_Suc[OF LIMSEQ_power_zero[OF `norm x < 1`]]] by auto
  4.1648 +  { fix n have "0 \<le> ?a n" by (rule mult_nonneg_nonneg, auto intro!: mult_nonneg_nonneg simp add: `0 \<le> x`) }
  4.1649 +  { fix n have "?a (Suc n) \<le> ?a n" unfolding inverse_eq_divide[symmetric]
  4.1650 +    proof (rule mult_mono)
  4.1651 +      show "0 \<le> x ^ Suc (Suc n)" by (auto intro!: mult_nonneg_nonneg simp add: `0 \<le> x`)
  4.1652 +      have "x ^ Suc (Suc n) \<le> x ^ Suc n * 1" unfolding power_Suc2 real_mult_assoc[symmetric] 
  4.1653 +	by (rule mult_left_mono, fact less_imp_le[OF `x < 1`], auto intro!: mult_nonneg_nonneg simp add: `0 \<le> x`)
  4.1654 +      thus "x ^ Suc (Suc n) \<le> x ^ Suc n" by auto
  4.1655 +    qed auto }
  4.1656 +  from summable_Leibniz'(2,4)[OF `?a ----> 0` `\<And>n. 0 \<le> ?a n`, OF `\<And>n. ?a (Suc n) \<le> ?a n`, unfolded ln_eq]
  4.1657 +  show "?lb" and "?ub" by auto
  4.1658 +qed
  4.1659 +
  4.1660 +lemma ln_float_bounds: 
  4.1661 +  assumes "0 \<le> Ifloat x" and "Ifloat x < 1"
  4.1662 +  shows "Ifloat (x * lb_ln_horner prec (get_even n) 1 x) \<le> ln (Ifloat x + 1)" (is "?lb \<le> ?ln")
  4.1663 +  and "ln (Ifloat x + 1) \<le> Ifloat (x * ub_ln_horner prec (get_odd n) 1 x)" (is "?ln \<le> ?ub")
  4.1664 +proof -
  4.1665 +  obtain ev where ev: "get_even n = 2 * ev" using get_even_double ..
  4.1666 +  obtain od where od: "get_odd n = 2 * od + 1" using get_odd_double ..
  4.1667 +
  4.1668 +  let "?s n" = "-1^n * (1 / real (1 + n)) * (Ifloat x)^(Suc n)"
  4.1669 +
  4.1670 +  have "?lb \<le> setsum ?s {0 ..< 2 * ev}" unfolding power_Suc2 real_mult_assoc[symmetric] Ifloat_mult setsum_left_distrib[symmetric] unfolding real_mult_commute[of "Ifloat x"] ev
  4.1671 +    using horner_bounds(1)[where G="\<lambda> i k. Suc k" and F="\<lambda>x. x" and f="\<lambda>x. x" and lb="\<lambda>n i k x. lb_ln_horner prec n k x" and ub="\<lambda>n i k x. ub_ln_horner prec n k x" and j'=1 and n="2*ev",
  4.1672 +      OF `0 \<le> Ifloat x` refl lb_ln_horner.simps ub_ln_horner.simps] `0 \<le> Ifloat x`
  4.1673 +    by (rule mult_right_mono)
  4.1674 +  also have "\<dots> \<le> ?ln" using ln_bounds(1)[OF `0 \<le> Ifloat x` `Ifloat x < 1`] by auto
  4.1675 +  finally show "?lb \<le> ?ln" . 
  4.1676 +
  4.1677 +  have "?ln \<le> setsum ?s {0 ..< 2 * od + 1}" using ln_bounds(2)[OF `0 \<le> Ifloat x` `Ifloat x < 1`] by auto
  4.1678 +  also have "\<dots> \<le> ?ub" unfolding power_Suc2 real_mult_assoc[symmetric] Ifloat_mult setsum_left_distrib[symmetric] unfolding real_mult_commute[of "Ifloat x"] od
  4.1679 +    using horner_bounds(2)[where G="\<lambda> i k. Suc k" and F="\<lambda>x. x" and f="\<lambda>x. x" and lb="\<lambda>n i k x. lb_ln_horner prec n k x" and ub="\<lambda>n i k x. ub_ln_horner prec n k x" and j'=1 and n="2*od+1",
  4.1680 +      OF `0 \<le> Ifloat x` refl lb_ln_horner.simps ub_ln_horner.simps] `0 \<le> Ifloat x`
  4.1681 +    by (rule mult_right_mono)
  4.1682 +  finally show "?ln \<le> ?ub" . 
  4.1683 +qed
  4.1684 +
  4.1685 +lemma ln_add: assumes "0 < x" and "0 < y" shows "ln (x + y) = ln x + ln (1 + y / x)"
  4.1686 +proof -
  4.1687 +  have "x \<noteq> 0" using assms by auto
  4.1688 +  have "x + y = x * (1 + y / x)" unfolding right_distrib times_divide_eq_right nonzero_mult_divide_cancel_left[OF `x \<noteq> 0`] by auto
  4.1689 +  moreover 
  4.1690 +  have "0 < y / x" using assms divide_pos_pos by auto
  4.1691 +  hence "0 < 1 + y / x" by auto
  4.1692 +  ultimately show ?thesis using ln_mult assms by auto
  4.1693 +qed
  4.1694 +
  4.1695 +subsection "Compute the logarithm of 2"
  4.1696 +
  4.1697 +definition ub_ln2 where "ub_ln2 prec = (let third = rapprox_rat (max prec 1) 1 3 
  4.1698 +                                        in (Float 1 -1 * ub_ln_horner prec (get_odd prec) 1 (Float 1 -1)) + 
  4.1699 +                                           (third * ub_ln_horner prec (get_odd prec) 1 third))"
  4.1700 +definition lb_ln2 where "lb_ln2 prec = (let third = lapprox_rat prec 1 3 
  4.1701 +                                        in (Float 1 -1 * lb_ln_horner prec (get_even prec) 1 (Float 1 -1)) + 
  4.1702 +                                           (third * lb_ln_horner prec (get_even prec) 1 third))"
  4.1703 +
  4.1704 +lemma ub_ln2: "ln 2 \<le> Ifloat (ub_ln2 prec)" (is "?ub_ln2")
  4.1705 +  and lb_ln2: "Ifloat (lb_ln2 prec) \<le> ln 2" (is "?lb_ln2")
  4.1706 +proof -
  4.1707 +  let ?uthird = "rapprox_rat (max prec 1) 1 3"
  4.1708 +  let ?lthird = "lapprox_rat prec 1 3"
  4.1709 +
  4.1710 +  have ln2_sum: "ln 2 = ln (1/2 + 1) + ln (1 / 3 + 1)"
  4.1711 +    using ln_add[of "3 / 2" "1 / 2"] by auto
  4.1712 +  have lb3: "Ifloat ?lthird \<le> 1 / 3" using lapprox_rat[of prec 1 3] by auto
  4.1713 +  hence lb3_ub: "Ifloat ?lthird < 1" by auto
  4.1714 +  have lb3_lb: "0 \<le> Ifloat ?lthird" using lapprox_rat_bottom[of 1 3] by auto
  4.1715 +  have ub3: "1 / 3 \<le> Ifloat ?uthird" using rapprox_rat[of 1 3] by auto
  4.1716 +  hence ub3_lb: "0 \<le> Ifloat ?uthird" by auto
  4.1717 +
  4.1718 +  have lb2: "0 \<le> Ifloat (Float 1 -1)" and ub2: "Ifloat (Float 1 -1) < 1" unfolding Float_num by auto
  4.1719 +
  4.1720 +  have "0 \<le> (1::int)" and "0 < (3::int)" by auto
  4.1721 +  have ub3_ub: "Ifloat ?uthird < 1" unfolding rapprox_rat.simps(2)[OF `0 \<le> 1` `0 < 3`]
  4.1722 +    by (rule rapprox_posrat_less1, auto)
  4.1723 +
  4.1724 +  have third_gt0: "(0 :: real) < 1 / 3 + 1" by auto
  4.1725 +  have uthird_gt0: "0 < Ifloat ?uthird + 1" using ub3_lb by auto
  4.1726 +  have lthird_gt0: "0 < Ifloat ?lthird + 1" using lb3_lb by auto
  4.1727 +
  4.1728 +  show ?ub_ln2 unfolding ub_ln2_def Let_def Ifloat_add ln2_sum Float_num(4)[symmetric]
  4.1729 +  proof (rule add_mono, fact ln_float_bounds(2)[OF lb2 ub2])
  4.1730 +    have "ln (1 / 3 + 1) \<le> ln (Ifloat ?uthird + 1)" unfolding ln_le_cancel_iff[OF third_gt0 uthird_gt0] using ub3 by auto
  4.1731 +    also have "\<dots> \<le> Ifloat (?uthird * ub_ln_horner prec (get_odd prec) 1 ?uthird)"
  4.1732 +      using ln_float_bounds(2)[OF ub3_lb ub3_ub] .
  4.1733 +    finally show "ln (1 / 3 + 1) \<le> Ifloat (?uthird * ub_ln_horner prec (get_odd prec) 1 ?uthird)" .
  4.1734 +  qed
  4.1735 +  show ?lb_ln2 unfolding lb_ln2_def Let_def Ifloat_add ln2_sum Float_num(4)[symmetric]
  4.1736 +  proof (rule add_mono, fact ln_float_bounds(1)[OF lb2 ub2])
  4.1737 +    have "Ifloat (?lthird * lb_ln_horner prec (get_even prec) 1 ?lthird) \<le> ln (Ifloat ?lthird + 1)"
  4.1738 +      using ln_float_bounds(1)[OF lb3_lb lb3_ub] .
  4.1739 +    also have "\<dots> \<le> ln (1 / 3 + 1)" unfolding ln_le_cancel_iff[OF lthird_gt0 third_gt0] using lb3 by auto
  4.1740 +    finally show "Ifloat (?lthird * lb_ln_horner prec (get_even prec) 1 ?lthird) \<le> ln (1 / 3 + 1)" .
  4.1741 +  qed
  4.1742 +qed
  4.1743 +
  4.1744 +subsection "Compute the logarithm in the entire domain"
  4.1745 +
  4.1746 +function ub_ln :: "nat \<Rightarrow> float \<Rightarrow> float option" and lb_ln :: "nat \<Rightarrow> float \<Rightarrow> float option" where
  4.1747 +"ub_ln prec x = (if x \<le> 0         then None
  4.1748 +            else if x < 1         then Some (- the (lb_ln prec (float_divl (max prec 1) 1 x)))
  4.1749 +            else let horner = \<lambda>x. (x - 1) * ub_ln_horner prec (get_odd prec) 1 (x - 1) in
  4.1750 +                 if x < Float 1 1 then Some (horner x)
  4.1751 +                                  else let l = bitlen (mantissa x) - 1 in 
  4.1752 +                                       Some (ub_ln2 prec * (Float (scale x + l) 0) + horner (Float (mantissa x) (- l))))" |
  4.1753 +"lb_ln prec x = (if x \<le> 0         then None
  4.1754 +            else if x < 1         then Some (- the (ub_ln prec (float_divr prec 1 x)))
  4.1755 +            else let horner = \<lambda>x. (x - 1) * lb_ln_horner prec (get_even prec) 1 (x - 1) in
  4.1756 +                 if x < Float 1 1 then Some (horner x)
  4.1757 +                                  else let l = bitlen (mantissa x) - 1 in 
  4.1758 +                                       Some (lb_ln2 prec * (Float (scale x + l) 0) + horner (Float (mantissa x) (- l))))"
  4.1759 +by pat_completeness auto
  4.1760 +
  4.1761 +termination proof (relation "measure (\<lambda> v. let (prec, x) = sum_case id id v in (if x < 1 then 1 else 0))", auto)
  4.1762 +  fix prec x assume "\<not> x \<le> 0" and "x < 1" and "float_divl (max prec (Suc 0)) 1 x < 1"
  4.1763 +  hence "0 < x" and "0 < max prec (Suc 0)" unfolding less_float_def le_float_def by auto
  4.1764 +  from float_divl_pos_less1_bound[OF `0 < x` `x < 1` `0 < max prec (Suc 0)`]
  4.1765 +  show False using `float_divl (max prec (Suc 0)) 1 x < 1` unfolding less_float_def le_float_def by auto
  4.1766 +next
  4.1767 +  fix prec x assume "\<not> x \<le> 0" and "x < 1" and "float_divr prec 1 x < 1"
  4.1768 +  hence "0 < x" unfolding less_float_def le_float_def by auto
  4.1769 +  from float_divr_pos_less1_lower_bound[OF `0 < x` `x < 1`, of prec]
  4.1770 +  show False using `float_divr prec 1 x < 1` unfolding less_float_def le_float_def by auto
  4.1771 +qed
  4.1772 +
  4.1773 +lemma ln_shifted_float: assumes "0 < m" shows "ln (Ifloat (Float m e)) = ln 2 * real (e + (bitlen m - 1)) + ln (Ifloat (Float m (- (bitlen m - 1))))"
  4.1774 +proof -
  4.1775 +  let ?B = "2^nat (bitlen m - 1)"
  4.1776 +  have "0 < real m" and "\<And>X. (0 :: real) < 2^X" and "0 < (2 :: real)" and "m \<noteq> 0" using assms by auto
  4.1777 +  hence "0 \<le> bitlen m - 1" using bitlen_ge1[OF `m \<noteq> 0`] by auto
  4.1778 +  show ?thesis 
  4.1779 +  proof (cases "0 \<le> e")
  4.1780 +    case True
  4.1781 +    show ?thesis unfolding normalized_float[OF `m \<noteq> 0`]
  4.1782 +      unfolding ln_div[OF `0 < real m` `0 < ?B`] real_of_int_add ln_realpow[OF `0 < 2`] 
  4.1783 +      unfolding Ifloat_ge0_exp[OF True] ln_mult[OF `0 < real m` `0 < 2^nat e`] 
  4.1784 +      ln_realpow[OF `0 < 2`] algebra_simps using `0 \<le> bitlen m - 1` True by auto
  4.1785 +  next
  4.1786 +    case False hence "0 < -e" by auto
  4.1787 +    hence pow_gt0: "(0::real) < 2^nat (-e)" by auto
  4.1788 +    hence inv_gt0: "(0::real) < inverse (2^nat (-e))" by auto
  4.1789 +    show ?thesis unfolding normalized_float[OF `m \<noteq> 0`]
  4.1790 +      unfolding ln_div[OF `0 < real m` `0 < ?B`] real_of_int_add ln_realpow[OF `0 < 2`] 
  4.1791 +      unfolding Ifloat_nge0_exp[OF False] ln_mult[OF `0 < real m` inv_gt0] ln_inverse[OF pow_gt0]
  4.1792 +      ln_realpow[OF `0 < 2`] algebra_simps using `0 \<le> bitlen m - 1` False by auto
  4.1793 +  qed
  4.1794 +qed
  4.1795 +
  4.1796 +lemma ub_ln_lb_ln_bounds': assumes "1 \<le> x"
  4.1797 +  shows "Ifloat (the (lb_ln prec x)) \<le> ln (Ifloat x) \<and> ln (Ifloat x) \<le> Ifloat (the (ub_ln prec x))"
  4.1798 +  (is "?lb \<le> ?ln \<and> ?ln \<le> ?ub")
  4.1799 +proof (cases "x < Float 1 1")
  4.1800 +  case True hence "Ifloat (x - 1) < 1" unfolding less_float_def Float_num by auto
  4.1801 +  have "\<not> x \<le> 0" and "\<not> x < 1" using `1 \<le> x` unfolding less_float_def le_float_def by auto
  4.1802 +  hence "0 \<le> Ifloat (x - 1)" using `1 \<le> x` unfolding less_float_def Float_num by auto
  4.1803 +  show ?thesis unfolding lb_ln.simps unfolding ub_ln.simps Let_def
  4.1804 +    using ln_float_bounds[OF `0 \<le> Ifloat (x - 1)` `Ifloat (x - 1) < 1`] `\<not> x \<le> 0` `\<not> x < 1` True by auto
  4.1805 +next
  4.1806 +  case False
  4.1807 +  have "\<not> x \<le> 0" and "\<not> x < 1" "0 < x" using `1 \<le> x` unfolding less_float_def le_float_def by auto
  4.1808 +  show ?thesis
  4.1809 +  proof (cases x)
  4.1810 +    case (Float m e)
  4.1811 +    let ?s = "Float (e + (bitlen m - 1)) 0"
  4.1812 +    let ?x = "Float m (- (bitlen m - 1))"
  4.1813 +
  4.1814 +    have "0 < m" and "m \<noteq> 0" using float_pos_m_pos `0 < x` Float by auto
  4.1815 +
  4.1816 +    {
  4.1817 +      have "Ifloat (lb_ln2 prec * ?s) \<le> ln 2 * real (e + (bitlen m - 1))" (is "?lb2 \<le> _")
  4.1818 +	unfolding Ifloat_mult Ifloat_ge0_exp[OF order_refl] nat_0 realpow_0 mult_1_right
  4.1819 +	using lb_ln2[of prec]
  4.1820 +      proof (rule mult_right_mono)
  4.1821 +	have "1 \<le> Float m e" using `1 \<le> x` Float unfolding le_float_def by auto
  4.1822 +	from float_gt1_scale[OF this]
  4.1823 +	show "0 \<le> real (e + (bitlen m - 1))" by auto
  4.1824 +      qed
  4.1825 +      moreover
  4.1826 +      from bitlen_div[OF `0 < m`, unfolded normalized_float[OF `m \<noteq> 0`, symmetric]]
  4.1827 +      have "0 \<le> Ifloat (?x - 1)" and "Ifloat (?x - 1) < 1" by auto
  4.1828 +      from ln_float_bounds(1)[OF this]
  4.1829 +      have "Ifloat ((?x - 1) * lb_ln_horner prec (get_even prec) 1 (?x - 1)) \<le> ln (Ifloat ?x)" (is "?lb_horner \<le> _") by auto
  4.1830 +      ultimately have "?lb2 + ?lb_horner \<le> ln (Ifloat x)"
  4.1831 +	unfolding Float ln_shifted_float[OF `0 < m`, of e] by auto
  4.1832 +    } 
  4.1833 +    moreover
  4.1834 +    {
  4.1835 +      from bitlen_div[OF `0 < m`, unfolded normalized_float[OF `m \<noteq> 0`, symmetric]]
  4.1836 +      have "0 \<le> Ifloat (?x - 1)" and "Ifloat (?x - 1) < 1" by auto
  4.1837 +      from ln_float_bounds(2)[OF this]
  4.1838 +      have "ln (Ifloat ?x) \<le> Ifloat ((?x - 1) * ub_ln_horner prec (get_odd prec) 1 (?x - 1))" (is "_ \<le> ?ub_horner") by auto
  4.1839 +      moreover
  4.1840 +      have "ln 2 * real (e + (bitlen m - 1)) \<le> Ifloat (ub_ln2 prec * ?s)" (is "_ \<le> ?ub2")
  4.1841 +	unfolding Ifloat_mult Ifloat_ge0_exp[OF order_refl] nat_0 realpow_0 mult_1_right
  4.1842 +	using ub_ln2[of prec] 
  4.1843 +      proof (rule mult_right_mono)
  4.1844 +	have "1 \<le> Float m e" using `1 \<le> x` Float unfolding le_float_def by auto
  4.1845 +	from float_gt1_scale[OF this]
  4.1846 +	show "0 \<le> real (e + (bitlen m - 1))" by auto
  4.1847 +      qed
  4.1848 +      ultimately have "ln (Ifloat x) \<le> ?ub2 + ?ub_horner"
  4.1849 +	unfolding Float ln_shifted_float[OF `0 < m`, of e] by auto
  4.1850 +    }
  4.1851 +    ultimately show ?thesis unfolding lb_ln.simps unfolding ub_ln.simps
  4.1852 +      unfolding if_not_P[OF `\<not> x \<le> 0`] if_not_P[OF `\<not> x < 1`] if_not_P[OF False] Let_def
  4.1853 +      unfolding scale.simps[of m e, unfolded Float[symmetric]] mantissa.simps[of m e, unfolded Float[symmetric]] Ifloat_add by auto
  4.1854 +  qed
  4.1855 +qed
  4.1856 +
  4.1857 +lemma ub_ln_lb_ln_bounds: assumes "0 < x"
  4.1858 +  shows "Ifloat (the (lb_ln prec x)) \<le> ln (Ifloat x) \<and> ln (Ifloat x) \<le> Ifloat (the (ub_ln prec x))"
  4.1859 +  (is "?lb \<le> ?ln \<and> ?ln \<le> ?ub")
  4.1860 +proof (cases "x < 1")
  4.1861 +  case False hence "1 \<le> x" unfolding less_float_def le_float_def by auto
  4.1862 +  show ?thesis using ub_ln_lb_ln_bounds'[OF `1 \<le> x`] .
  4.1863 +next
  4.1864 +  case True have "\<not> x \<le> 0" using `0 < x` unfolding less_float_def le_float_def by auto
  4.1865 +
  4.1866 +  have "0 < Ifloat x" and "Ifloat x \<noteq> 0" using `0 < x` unfolding less_float_def by auto
  4.1867 +  hence A: "0 < 1 / Ifloat x" by auto
  4.1868 +
  4.1869 +  {
  4.1870 +    let ?divl = "float_divl (max prec 1) 1 x"
  4.1871 +    have A': "1 \<le> ?divl" using float_divl_pos_less1_bound[OF `0 < x` `x < 1`] unfolding le_float_def less_float_def by auto
  4.1872 +    hence B: "0 < Ifloat ?divl" unfolding le_float_def by auto
  4.1873 +    
  4.1874 +    have "ln (Ifloat ?divl) \<le> ln (1 / Ifloat x)" unfolding ln_le_cancel_iff[OF B A] using float_divl[of _ 1 x] by auto
  4.1875 +    hence "ln (Ifloat x) \<le> - ln (Ifloat ?divl)" unfolding nonzero_inverse_eq_divide[OF `Ifloat x \<noteq> 0`, symmetric] ln_inverse[OF `0 < Ifloat x`] by auto
  4.1876 +    from this ub_ln_lb_ln_bounds'[OF A', THEN conjunct1, THEN le_imp_neg_le] 
  4.1877 +    have "?ln \<le> Ifloat (- the (lb_ln prec ?divl))" unfolding Ifloat_minus by (rule order_trans)
  4.1878 +  } moreover
  4.1879 +  {
  4.1880 +    let ?divr = "float_divr prec 1 x"
  4.1881 +    have A': "1 \<le> ?divr" using float_divr_pos_less1_lower_bound[OF `0 < x` `x < 1`] unfolding le_float_def less_float_def by auto
  4.1882 +    hence B: "0 < Ifloat ?divr" unfolding le_float_def by auto
  4.1883 +    
  4.1884 +    have "ln (1 / Ifloat x) \<le> ln (Ifloat ?divr)" unfolding ln_le_cancel_iff[OF A B] using float_divr[of 1 x] by auto
  4.1885 +    hence "- ln (Ifloat ?divr) \<le> ln (Ifloat x)" unfolding nonzero_inverse_eq_divide[OF `Ifloat x \<noteq> 0`, symmetric] ln_inverse[OF `0 < Ifloat x`] by auto
  4.1886 +    from ub_ln_lb_ln_bounds'[OF A', THEN conjunct2, THEN le_imp_neg_le] this
  4.1887 +    have "Ifloat (- the (ub_ln prec ?divr)) \<le> ?ln" unfolding Ifloat_minus by (rule order_trans)
  4.1888 +  }
  4.1889 +  ultimately show ?thesis unfolding lb_ln.simps[where x=x]  ub_ln.simps[where x=x]
  4.1890 +    unfolding if_not_P[OF `\<not> x \<le> 0`] if_P[OF True] by auto
  4.1891 +qed
  4.1892 +
  4.1893 +lemma lb_ln: assumes "Some y = lb_ln prec x"
  4.1894 +  shows "Ifloat y \<le> ln (Ifloat x)" and "0 < Ifloat x"
  4.1895 +proof -
  4.1896 +  have "0 < x"
  4.1897 +  proof (rule ccontr)
  4.1898 +    assume "\<not> 0 < x" hence "x \<le> 0" unfolding le_float_def less_float_def by auto
  4.1899 +    thus False using assms by auto
  4.1900 +  qed
  4.1901 +  thus "0 < Ifloat x" unfolding less_float_def by auto
  4.1902 +  have "Ifloat (the (lb_ln prec x)) \<le> ln (Ifloat x)" using ub_ln_lb_ln_bounds[OF `0 < x`] ..
  4.1903 +  thus "Ifloat y \<le> ln (Ifloat x)" unfolding assms[symmetric] by auto
  4.1904 +qed
  4.1905 +
  4.1906 +lemma ub_ln: assumes "Some y = ub_ln prec x"
  4.1907 +  shows "ln (Ifloat x) \<le> Ifloat y" and "0 < Ifloat x"
  4.1908 +proof -
  4.1909 +  have "0 < x"
  4.1910 +  proof (rule ccontr)
  4.1911 +    assume "\<not> 0 < x" hence "x \<le> 0" unfolding le_float_def less_float_def by auto
  4.1912 +    thus False using assms by auto
  4.1913 +  qed
  4.1914 +  thus "0 < Ifloat x" unfolding less_float_def by auto
  4.1915 +  have "ln (Ifloat x) \<le> Ifloat (the (ub_ln prec x))" using ub_ln_lb_ln_bounds[OF `0 < x`] ..
  4.1916 +  thus "ln (Ifloat x) \<le> Ifloat y" unfolding assms[symmetric] by auto
  4.1917 +qed
  4.1918 +
  4.1919 +lemma bnds_ln: "\<forall> x lx ux. (Some l, Some u) = (lb_ln prec lx, ub_ln prec ux) \<and> x \<in> {Ifloat lx .. Ifloat ux} \<longrightarrow> Ifloat l \<le> ln x \<and> ln x \<le> Ifloat u"
  4.1920 +proof (rule allI, rule allI, rule allI, rule impI)
  4.1921 +  fix x lx ux
  4.1922 +  assume "(Some l, Some u) = (lb_ln prec lx, ub_ln prec ux) \<and> x \<in> {Ifloat lx .. Ifloat ux}"
  4.1923 +  hence l: "Some l = lb_ln prec lx " and u: "Some u = ub_ln prec ux" and x: "x \<in> {Ifloat lx .. Ifloat ux}" by auto
  4.1924 +
  4.1925 +  have "ln (Ifloat ux) \<le> Ifloat u" and "0 < Ifloat ux" using ub_ln u by auto
  4.1926 +  have "Ifloat l \<le> ln (Ifloat lx)" and "0 < Ifloat lx" and "0 < x" using lb_ln[OF l] x by auto
  4.1927 +
  4.1928 +  from ln_le_cancel_iff[OF `0 < Ifloat lx` `0 < x`] `Ifloat l \<le> ln (Ifloat lx)` 
  4.1929 +  have "Ifloat l \<le> ln x" using x unfolding atLeastAtMost_iff by auto
  4.1930 +  moreover
  4.1931 +  from ln_le_cancel_iff[OF `0 < x` `0 < Ifloat ux`] `ln (Ifloat ux) \<le> Ifloat u` 
  4.1932 +  have "ln x \<le> Ifloat u" using x unfolding atLeastAtMost_iff by auto
  4.1933 +  ultimately show "Ifloat l \<le> ln x \<and> ln x \<le> Ifloat u" ..
  4.1934 +qed
  4.1935 +
  4.1936 +
  4.1937 +section "Implement floatarith"
  4.1938 +
  4.1939 +subsection "Define syntax and semantics"
  4.1940 +
  4.1941 +datatype floatarith
  4.1942 +  = Add floatarith floatarith
  4.1943 +  | Minus floatarith
  4.1944 +  | Mult floatarith floatarith
  4.1945 +  | Inverse floatarith
  4.1946 +  | Sin floatarith
  4.1947 +  | Cos floatarith
  4.1948 +  | Arctan floatarith
  4.1949 +  | Abs floatarith
  4.1950 +  | Max floatarith floatarith
  4.1951 +  | Min floatarith floatarith
  4.1952 +  | Pi
  4.1953 +  | Sqrt floatarith
  4.1954 +  | Exp floatarith
  4.1955 +  | Ln floatarith
  4.1956 +  | Power floatarith nat
  4.1957 +  | Atom nat
  4.1958 +  | Num float
  4.1959 +
  4.1960 +fun Ifloatarith :: "floatarith \<Rightarrow> real list \<Rightarrow> real"
  4.1961 +where
  4.1962 +"Ifloatarith (Add a b) vs   = (Ifloatarith a vs) + (Ifloatarith b vs)" |
  4.1963 +"Ifloatarith (Minus a) vs    = - (Ifloatarith a vs)" |
  4.1964 +"Ifloatarith (Mult a b) vs   = (Ifloatarith a vs) * (Ifloatarith b vs)" |
  4.1965 +"Ifloatarith (Inverse a) vs  = inverse (Ifloatarith a vs)" |
  4.1966 +"Ifloatarith (Sin a) vs      = sin (Ifloatarith a vs)" |
  4.1967 +"Ifloatarith (Cos a) vs      = cos (Ifloatarith a vs)" |
  4.1968 +"Ifloatarith (Arctan a) vs   = arctan (Ifloatarith a vs)" |
  4.1969 +"Ifloatarith (Min a b) vs    = min (Ifloatarith a vs) (Ifloatarith b vs)" |
  4.1970 +"Ifloatarith (Max a b) vs    = max (Ifloatarith a vs) (Ifloatarith b vs)" |
  4.1971 +"Ifloatarith (Abs a) vs      = abs (Ifloatarith a vs)" |
  4.1972 +"Ifloatarith Pi vs           = pi" |
  4.1973 +"Ifloatarith (Sqrt a) vs     = sqrt (Ifloatarith a vs)" |
  4.1974 +"Ifloatarith (Exp a) vs      = exp (Ifloatarith a vs)" |
  4.1975 +"Ifloatarith (Ln a) vs       = ln (Ifloatarith a vs)" |
  4.1976 +"Ifloatarith (Power a n) vs  = (Ifloatarith a vs)^n" |
  4.1977 +"Ifloatarith (Num f) vs      = Ifloat f" |
  4.1978 +"Ifloatarith (Atom n) vs     = vs ! n"
  4.1979 +
  4.1980 +subsection "Implement approximation function"
  4.1981 +
  4.1982 +fun lift_bin :: "(float * float) option \<Rightarrow> (float * float) option \<Rightarrow> (float \<Rightarrow> float \<Rightarrow> float \<Rightarrow> float \<Rightarrow> (float option * float option)) \<Rightarrow> (float * float) option" where
  4.1983 +"lift_bin (Some (l1, u1)) (Some (l2, u2)) f = (case (f l1 u1 l2 u2) of (Some l, Some u) \<Rightarrow> Some (l, u)
  4.1984 +                                                                     | t \<Rightarrow> None)" |
  4.1985 +"lift_bin a b f = None"
  4.1986 +
  4.1987 +fun lift_bin' :: "(float * float) option \<Rightarrow> (float * float) option \<Rightarrow> (float \<Rightarrow> float \<Rightarrow> float \<Rightarrow> float \<Rightarrow> (float * float)) \<Rightarrow> (float * float) option" where
  4.1988 +"lift_bin' (Some (l1, u1)) (Some (l2, u2)) f = Some (f l1 u1 l2 u2)" |
  4.1989 +"lift_bin' a b f = None"
  4.1990 +
  4.1991 +fun lift_un :: "(float * float) option \<Rightarrow> (float \<Rightarrow> float \<Rightarrow> ((float option) * (float option))) \<Rightarrow> (float * float) option" where
  4.1992 +"lift_un (Some (l1, u1)) f = (case (f l1 u1) of (Some l, Some u) \<Rightarrow> Some (l, u)
  4.1993 +                                             | t \<Rightarrow> None)" |
  4.1994 +"lift_un b f = None"
  4.1995 +
  4.1996 +fun lift_un' :: "(float * float) option \<Rightarrow> (float \<Rightarrow> float \<Rightarrow> (float * float)) \<Rightarrow> (float * float) option" where
  4.1997 +"lift_un' (Some (l1, u1)) f = Some (f l1 u1)" |
  4.1998 +"lift_un' b f = None"
  4.1999 +
  4.2000 +fun bounded_by :: "real list \<Rightarrow> (float * float) list \<Rightarrow> bool " where
  4.2001 +bounded_by_Cons: "bounded_by (v#vs) ((l, u)#bs) = ((Ifloat l \<le> v \<and> v \<le> Ifloat u) \<and> bounded_by vs bs)" |
  4.2002 +bounded_by_Nil: "bounded_by [] [] = True" |
  4.2003 +"bounded_by _ _ = False"
  4.2004 +
  4.2005 +lemma bounded_by: assumes "bounded_by vs bs" and "i < length bs"
  4.2006 +  shows "Ifloat (fst (bs ! i)) \<le> vs ! i \<and> vs ! i \<le> Ifloat (snd (bs ! i))"
  4.2007 +  using `bounded_by vs bs` and `i < length bs`
  4.2008 +proof (induct arbitrary: i rule: bounded_by.induct)
  4.2009 +  fix v :: real and vs :: "real list" and l u :: float and bs :: "(float * float) list" and i :: nat
  4.2010 +  assume hyp: "\<And>i. \<lbrakk>bounded_by vs bs; i < length bs\<rbrakk> \<Longrightarrow> Ifloat (fst (bs ! i)) \<le> vs ! i \<and> vs ! i \<le> Ifloat (snd (bs ! i))"
  4.2011 +  assume bounded: "bounded_by (v # vs) ((l, u) # bs)" and length: "i < length ((l, u) # bs)"
  4.2012 +  show "Ifloat (fst (((l, u) # bs) ! i)) \<le> (v # vs) ! i \<and> (v # vs) ! i \<le> Ifloat (snd (((l, u) # bs) ! i))"
  4.2013 +  proof (cases i)
  4.2014 +    case 0
  4.2015 +    show ?thesis using bounded unfolding 0 nth_Cons_0 fst_conv snd_conv bounded_by.simps ..
  4.2016 +  next
  4.2017 +    case (Suc i) with length have "i < length bs" by auto
  4.2018 +    show ?thesis unfolding Suc nth_Cons_Suc bounded_by.simps
  4.2019 +      using hyp[OF bounded[unfolded bounded_by.simps, THEN conjunct2] `i < length bs`] .
  4.2020 +  qed
  4.2021 +qed auto
  4.2022 +
  4.2023 +fun approx approx' :: "nat \<Rightarrow> floatarith \<Rightarrow> (float * float) list \<Rightarrow> (float * float) option" where
  4.2024 +"approx' prec a bs          = (case (approx prec a bs) of Some (l, u) \<Rightarrow> Some (round_down prec l, round_up prec u) | None \<Rightarrow> None)" |
  4.2025 +"approx prec (Add a b) bs  = lift_bin' (approx' prec a bs) (approx' prec b bs) (\<lambda> l1 u1 l2 u2. (l1 + l2, u1 + u2))" | 
  4.2026 +"approx prec (Minus a) bs   = lift_un' (approx' prec a bs) (\<lambda> l u. (-u, -l))" |
  4.2027 +"approx prec (Mult a b) bs  = lift_bin' (approx' prec a bs) (approx' prec b bs)
  4.2028 +                                    (\<lambda> a1 a2 b1 b2. (float_nprt a1 * float_pprt b2 + float_nprt a2 * float_nprt b2 + float_pprt a1 * float_pprt b1 + float_pprt a2 * float_nprt b1, 
  4.2029 +                                                     float_pprt a2 * float_pprt b2 + float_pprt a1 * float_nprt b2 + float_nprt a2 * float_pprt b1 + float_nprt a1 * float_nprt b1))" |
  4.2030 +"approx prec (Inverse a) bs = lift_un (approx' prec a bs) (\<lambda> l u. if (0 < l \<or> u < 0) then (Some (float_divl prec 1 u), Some (float_divr prec 1 l)) else (None, None))" |
  4.2031 +"approx prec (Sin a) bs     = lift_un' (approx' prec a bs) (bnds_sin prec)" |
  4.2032 +"approx prec (Cos a) bs     = lift_un' (approx' prec a bs) (bnds_cos prec)" |
  4.2033 +"approx prec Pi bs          = Some (lb_pi prec, ub_pi prec)" |
  4.2034 +"approx prec (Min a b) bs   = lift_bin' (approx' prec a bs) (approx' prec b bs) (\<lambda> l1 u1 l2 u2. (min l1 l2, min u1 u2))" |
  4.2035 +"approx prec (Max a b) bs   = lift_bin' (approx' prec a bs) (approx' prec b bs) (\<lambda> l1 u1 l2 u2. (max l1 l2, max u1 u2))" |
  4.2036 +"approx prec (Abs a) bs     = lift_un' (approx' prec a bs) (\<lambda>l u. (if l < 0 \<and> 0 < u then 0 else min \<bar>l\<bar> \<bar>u\<bar>, max \<bar>l\<bar> \<bar>u\<bar>))" |
  4.2037 +"approx prec (Arctan a) bs  = lift_un' (approx' prec a bs) (\<lambda> l u. (lb_arctan prec l, ub_arctan prec u))" |
  4.2038 +"approx prec (Sqrt a) bs    = lift_un (approx' prec a bs) (\<lambda> l u. (lb_sqrt prec l, ub_sqrt prec u))" |
  4.2039 +"approx prec (Exp a) bs     = lift_un' (approx' prec a bs) (\<lambda> l u. (lb_exp prec l, ub_exp prec u))" |
  4.2040 +"approx prec (Ln a) bs      = lift_un (approx' prec a bs) (\<lambda> l u. (lb_ln prec l, ub_ln prec u))" |
  4.2041 +"approx prec (Power a n) bs = lift_un' (approx' prec a bs) (float_power_bnds n)" |
  4.2042 +"approx prec (Num f) bs     = Some (f, f)" |
  4.2043 +"approx prec (Atom i) bs    = (if i < length bs then Some (bs ! i) else None)"
  4.2044 +
  4.2045 +lemma lift_bin'_ex:
  4.2046 +  assumes lift_bin'_Some: "Some (l, u) = lift_bin' a b f"
  4.2047 +  shows "\<exists> l1 u1 l2 u2. Some (l1, u1) = a \<and> Some (l2, u2) = b"
  4.2048 +proof (cases a)
  4.2049 +  case None hence "None = lift_bin' a b f" unfolding None lift_bin'.simps ..
  4.2050 +  thus ?thesis using lift_bin'_Some by auto
  4.2051 +next
  4.2052 +  case (Some a')
  4.2053 +  show ?thesis
  4.2054 +  proof (cases b)
  4.2055 +    case None hence "None = lift_bin' a b f" unfolding None lift_bin'.simps ..
  4.2056 +    thus ?thesis using lift_bin'_Some by auto
  4.2057 +  next
  4.2058 +    case (Some b')
  4.2059 +    obtain la ua where a': "a' = (la, ua)" by (cases a', auto)
  4.2060 +    obtain lb ub where b': "b' = (lb, ub)" by (cases b', auto)
  4.2061 +    thus ?thesis unfolding `a = Some a'` `b = Some b'` a' b' by auto
  4.2062 +  qed
  4.2063 +qed
  4.2064 +
  4.2065 +lemma lift_bin'_f:
  4.2066 +  assumes lift_bin'_Some: "Some (l, u) = lift_bin' (g a) (g b) f"
  4.2067 +  and Pa: "\<And>l u. Some (l, u) = g a \<Longrightarrow> P l u a" and Pb: "\<And>l u. Some (l, u) = g b \<Longrightarrow> P l u b"
  4.2068 +  shows "\<exists> l1 u1 l2 u2. P l1 u1 a \<and> P l2 u2 b \<and> l = fst (f l1 u1 l2 u2) \<and> u = snd (f l1 u1 l2 u2)"
  4.2069 +proof -
  4.2070 +  obtain l1 u1 l2 u2
  4.2071 +    where Sa: "Some (l1, u1) = g a" and Sb: "Some (l2, u2) = g b" using lift_bin'_ex[OF assms(1)] by auto
  4.2072 +  have lu: "(l, u) = f l1 u1 l2 u2" using lift_bin'_Some[unfolded Sa[symmetric] Sb[symmetric] lift_bin'.simps] by auto 
  4.2073 +  have "l = fst (f l1 u1 l2 u2)" and "u = snd (f l1 u1 l2 u2)" unfolding lu[symmetric] by auto
  4.2074 +  thus ?thesis using Pa[OF Sa] Pb[OF Sb] by auto 
  4.2075 +qed
  4.2076 +
  4.2077 +lemma approx_approx':
  4.2078 +  assumes Pa: "\<And>l u. Some (l, u) = approx prec a vs \<Longrightarrow> Ifloat l \<le> Ifloatarith a xs \<and> Ifloatarith a xs \<le> Ifloat u"
  4.2079 +  and approx': "Some (l, u) = approx' prec a vs"
  4.2080 +  shows "Ifloat l \<le> Ifloatarith a xs \<and> Ifloatarith a xs \<le> Ifloat u"
  4.2081 +proof -
  4.2082 +  obtain l' u' where S: "Some (l', u') = approx prec a vs"
  4.2083 +    using approx' unfolding approx'.simps by (cases "approx prec a vs", auto)
  4.2084 +  have l': "l = round_down prec l'" and u': "u = round_up prec u'"
  4.2085 +    using approx' unfolding approx'.simps S[symmetric] by auto
  4.2086 +  show ?thesis unfolding l' u' 
  4.2087 +    using order_trans[OF Pa[OF S, THEN conjunct2] round_up[of u']]
  4.2088 +    using order_trans[OF round_down[of _ l'] Pa[OF S, THEN conjunct1]] by auto
  4.2089 +qed
  4.2090 +
  4.2091 +lemma lift_bin':
  4.2092 +  assumes lift_bin'_Some: "Some (l, u) = lift_bin' (approx' prec a bs) (approx' prec b bs) f"
  4.2093 +  and Pa: "\<And>l u. Some (l, u) = approx prec a bs \<Longrightarrow> Ifloat l \<le> Ifloatarith a xs \<and> Ifloatarith a xs \<le> Ifloat u" (is "\<And>l u. _ = ?g a \<Longrightarrow> ?P l u a")
  4.2094 +  and Pb: "\<And>l u. Some (l, u) = approx prec b bs \<Longrightarrow> Ifloat l \<le> Ifloatarith b xs \<and> Ifloatarith b xs \<le> Ifloat u"
  4.2095 +  shows "\<exists> l1 u1 l2 u2. (Ifloat l1 \<le> Ifloatarith a xs \<and> Ifloatarith a xs \<le> Ifloat u1) \<and> 
  4.2096 +                        (Ifloat l2 \<le> Ifloatarith b xs \<and> Ifloatarith b xs \<le> Ifloat u2) \<and> 
  4.2097 +                        l = fst (f l1 u1 l2 u2) \<and> u = snd (f l1 u1 l2 u2)"
  4.2098 +proof -
  4.2099 +  { fix l u assume "Some (l, u) = approx' prec a bs"
  4.2100 +    with approx_approx'[of prec a bs, OF _ this] Pa
  4.2101 +    have "Ifloat l \<le> Ifloatarith a xs \<and> Ifloatarith a xs \<le> Ifloat u" by auto } note Pa = this
  4.2102 +  { fix l u assume "Some (l, u) = approx' prec b bs"
  4.2103 +    with approx_approx'[of prec b bs, OF _ this] Pb
  4.2104 +    have "Ifloat l \<le> Ifloatarith b xs \<and> Ifloatarith b xs \<le> Ifloat u" by auto } note Pb = this
  4.2105 +
  4.2106 +  from lift_bin'_f[where g="\<lambda>a. approx' prec a bs" and P = ?P, OF lift_bin'_Some, OF Pa Pb]
  4.2107 +  show ?thesis by auto
  4.2108 +qed
  4.2109 +
  4.2110 +lemma lift_un'_ex:
  4.2111 +  assumes lift_un'_Some: "Some (l, u) = lift_un' a f"
  4.2112 +  shows "\<exists> l u. Some (l, u) = a"
  4.2113 +proof (cases a)
  4.2114 +  case None hence "None = lift_un' a f" unfolding None lift_un'.simps ..
  4.2115 +  thus ?thesis using lift_un'_Some by auto
  4.2116 +next
  4.2117 +  case (Some a')
  4.2118 +  obtain la ua where a': "a' = (la, ua)" by (cases a', auto)
  4.2119 +  thus ?thesis unfolding `a = Some a'` a' by auto
  4.2120 +qed
  4.2121 +
  4.2122 +lemma lift_un'_f:
  4.2123 +  assumes lift_un'_Some: "Some (l, u) = lift_un' (g a) f"
  4.2124 +  and Pa: "\<And>l u. Some (l, u) = g a \<Longrightarrow> P l u a"
  4.2125 +  shows "\<exists> l1 u1. P l1 u1 a \<and> l = fst (f l1 u1) \<and> u = snd (f l1 u1)"
  4.2126 +proof -
  4.2127 +  obtain l1 u1 where Sa: "Some (l1, u1) = g a" using lift_un'_ex[OF assms(1)] by auto
  4.2128 +  have lu: "(l, u) = f l1 u1" using lift_un'_Some[unfolded Sa[symmetric] lift_un'.simps] by auto
  4.2129 +  have "l = fst (f l1 u1)" and "u = snd (f l1 u1)" unfolding lu[symmetric] by auto
  4.2130 +  thus ?thesis using Pa[OF Sa] by auto
  4.2131 +qed
  4.2132 +
  4.2133 +lemma lift_un':
  4.2134 +  assumes lift_un'_Some: "Some (l, u) = lift_un' (approx' prec a bs) f"
  4.2135 +  and Pa: "\<And>l u. Some (l, u) = approx prec a bs \<Longrightarrow> Ifloat l \<le> Ifloatarith a xs \<and> Ifloatarith a xs \<le> Ifloat u" (is "\<And>l u. _ = ?g a \<Longrightarrow> ?P l u a")
  4.2136 +  shows "\<exists> l1 u1. (Ifloat l1 \<le> Ifloatarith a xs \<and> Ifloatarith a xs \<le> Ifloat u1) \<and> 
  4.2137 +                        l = fst (f l1 u1) \<and> u = snd (f l1 u1)"
  4.2138 +proof -
  4.2139 +  { fix l u assume "Some (l, u) = approx' prec a bs"
  4.2140 +    with approx_approx'[of prec a bs, OF _ this] Pa
  4.2141 +    have "Ifloat l \<le> Ifloatarith a xs \<and> Ifloatarith a xs \<le> Ifloat u" by auto } note Pa = this
  4.2142 +  from lift_un'_f[where g="\<lambda>a. approx' prec a bs" and P = ?P, OF lift_un'_Some, OF Pa]
  4.2143 +  show ?thesis by auto
  4.2144 +qed
  4.2145 +
  4.2146 +lemma lift_un'_bnds:
  4.2147 +  assumes bnds: "\<forall> x lx ux. (l, u) = f lx ux \<and> x \<in> { Ifloat lx .. Ifloat ux } \<longrightarrow> Ifloat l \<le> f' x \<and> f' x \<le> Ifloat u"
  4.2148 +  and lift_un'_Some: "Some (l, u) = lift_un' (approx' prec a bs) f"
  4.2149 +  and Pa: "\<And>l u. Some (l, u) = approx prec a bs \<Longrightarrow> Ifloat l \<le> Ifloatarith a xs \<and> Ifloatarith a xs \<le> Ifloat u"
  4.2150 +  shows "Ifloat l \<le> f' (Ifloatarith a xs) \<and> f' (Ifloatarith a xs) \<le> Ifloat u"
  4.2151 +proof -
  4.2152 +  from lift_un'[OF lift_un'_Some Pa]
  4.2153 +  obtain l1 u1 where "Ifloat l1 \<le> Ifloatarith a xs" and "Ifloatarith a xs \<le> Ifloat u1" and "l = fst (f l1 u1)" and "u = snd (f l1 u1)" by blast
  4.2154 +  hence "(l, u) = f l1 u1" and "Ifloatarith a xs \<in> {Ifloat l1 .. Ifloat u1}" by auto
  4.2155 +  thus ?thesis using bnds by auto
  4.2156 +qed
  4.2157 +
  4.2158 +lemma lift_un_ex:
  4.2159 +  assumes lift_un_Some: "Some (l, u) = lift_un a f"
  4.2160 +  shows "\<exists> l u. Some (l, u) = a"
  4.2161 +proof (cases a)
  4.2162 +  case None hence "None = lift_un a f" unfolding None lift_un.simps ..
  4.2163 +  thus ?thesis using lift_un_Some by auto
  4.2164 +next
  4.2165 +  case (Some a')
  4.2166 +  obtain la ua where a': "a' = (la, ua)" by (cases a', auto)
  4.2167 +  thus ?thesis unfolding `a = Some a'` a' by auto
  4.2168 +qed
  4.2169 +
  4.2170 +lemma lift_un_f:
  4.2171 +  assumes lift_un_Some: "Some (l, u) = lift_un (g a) f"
  4.2172 +  and Pa: "\<And>l u. Some (l, u) = g a \<Longrightarrow> P l u a"
  4.2173 +  shows "\<exists> l1 u1. P l1 u1 a \<and> Some l = fst (f l1 u1) \<and> Some u = snd (f l1 u1)"
  4.2174 +proof -
  4.2175 +  obtain l1 u1 where Sa: "Some (l1, u1) = g a" using lift_un_ex[OF assms(1)] by auto
  4.2176 +  have "fst (f l1 u1) \<noteq> None \<and> snd (f l1 u1) \<noteq> None"
  4.2177 +  proof (rule ccontr)
  4.2178 +    assume "\<not> (fst (f l1 u1) \<noteq> None \<and> snd (f l1 u1) \<noteq> None)"
  4.2179 +    hence or: "fst (f l1 u1) = None \<or> snd (f l1 u1) = None" by auto
  4.2180 +    hence "lift_un (g a) f = None" 
  4.2181 +    proof (cases "fst (f l1 u1) = None")
  4.2182 +      case True
  4.2183 +      then obtain b where b: "f l1 u1 = (None, b)" by (cases "f l1 u1", auto)
  4.2184 +      thus ?thesis unfolding Sa[symmetric] lift_un.simps b by auto
  4.2185 +    next
  4.2186 +      case False hence "snd (f l1 u1) = None" using or by auto
  4.2187 +      with False obtain b where b: "f l1 u1 = (Some b, None)" by (cases "f l1 u1", auto)
  4.2188 +      thus ?thesis unfolding Sa[symmetric] lift_un.simps b by auto
  4.2189 +    qed
  4.2190 +    thus False using lift_un_Some by auto
  4.2191 +  qed
  4.2192 +  then obtain a' b' where f: "f l1 u1 = (Some a', Some b')" by (cases "f l1 u1", auto)
  4.2193 +  from lift_un_Some[unfolded Sa[symmetric] lift_un.simps f]
  4.2194 +  have "Some l = fst (f l1 u1)" and "Some u = snd (f l1 u1)" unfolding f by auto
  4.2195 +  thus ?thesis unfolding Sa[symmetric] lift_un.simps using Pa[OF Sa] by auto
  4.2196 +qed
  4.2197 +
  4.2198 +lemma lift_un:
  4.2199 +  assumes lift_un_Some: "Some (l, u) = lift_un (approx' prec a bs) f"
  4.2200 +  and Pa: "\<And>l u. Some (l, u) = approx prec a bs \<Longrightarrow> Ifloat l \<le> Ifloatarith a xs \<and> Ifloatarith a xs \<le> Ifloat u" (is "\<And>l u. _ = ?g a \<Longrightarrow> ?P l u a")
  4.2201 +  shows "\<exists> l1 u1. (Ifloat l1 \<le> Ifloatarith a xs \<and> Ifloatarith a xs \<le> Ifloat u1) \<and> 
  4.2202 +                  Some l = fst (f l1 u1) \<and> Some u = snd (f l1 u1)"
  4.2203 +proof -
  4.2204 +  { fix l u assume "Some (l, u) = approx' prec a bs"
  4.2205 +    with approx_approx'[of prec a bs, OF _ this] Pa
  4.2206 +    have "Ifloat l \<le> Ifloatarith a xs \<and> Ifloatarith a xs \<le> Ifloat u" by auto } note Pa = this
  4.2207 +  from lift_un_f[where g="\<lambda>a. approx' prec a bs" and P = ?P, OF lift_un_Some, OF Pa]
  4.2208 +  show ?thesis by auto
  4.2209 +qed
  4.2210 +
  4.2211 +lemma lift_un_bnds:
  4.2212 +  assumes bnds: "\<forall> x lx ux. (Some l, Some u) = f lx ux \<and> x \<in> { Ifloat lx .. Ifloat ux } \<longrightarrow> Ifloat l \<le> f' x \<and> f' x \<le> Ifloat u"
  4.2213 +  and lift_un_Some: "Some (l, u) = lift_un (approx' prec a bs) f"
  4.2214 +  and Pa: "\<And>l u. Some (l, u) = approx prec a bs \<Longrightarrow> Ifloat l \<le> Ifloatarith a xs \<and> Ifloatarith a xs \<le> Ifloat u"
  4.2215 +  shows "Ifloat l \<le> f' (Ifloatarith a xs) \<and> f' (Ifloatarith a xs) \<le> Ifloat u"
  4.2216 +proof -
  4.2217 +  from lift_un[OF lift_un_Some Pa]
  4.2218 +  obtain l1 u1 where "Ifloat l1 \<le> Ifloatarith a xs" and "Ifloatarith a xs \<le> Ifloat u1" and "Some l = fst (f l1 u1)" and "Some u = snd (f l1 u1)" by blast
  4.2219 +  hence "(Some l, Some u) = f l1 u1" and "Ifloatarith a xs \<in> {Ifloat l1 .. Ifloat u1}" by auto
  4.2220 +  thus ?thesis using bnds by auto
  4.2221 +qed
  4.2222 +
  4.2223 +lemma approx:
  4.2224 +  assumes "bounded_by xs vs"
  4.2225 +  and "Some (l, u) = approx prec arith vs" (is "_ = ?g arith")
  4.2226 +  shows "Ifloat l \<le> Ifloatarith arith xs \<and> Ifloatarith arith xs \<le> Ifloat u" (is "?P l u arith")
  4.2227 +  using `Some (l, u) = approx prec arith vs` 
  4.2228 +proof (induct arith arbitrary: l u x)
  4.2229 +  case (Add a b)
  4.2230 +  from lift_bin'[OF Add.prems[unfolded approx.simps]] Add.hyps
  4.2231 +  obtain l1 u1 l2 u2 where "l = l1 + l2" and "u = u1 + u2"
  4.2232 +    "Ifloat l1 \<le> Ifloatarith a xs" and "Ifloatarith a xs \<le> Ifloat u1"
  4.2233 +    "Ifloat l2 \<le> Ifloatarith b xs" and "Ifloatarith b xs \<le> Ifloat u2" unfolding fst_conv snd_conv by blast
  4.2234 +  thus ?case unfolding Ifloatarith.simps by auto
  4.2235 +next
  4.2236 +  case (Minus a)
  4.2237 +  from lift_un'[OF Minus.prems[unfolded approx.simps]] Minus.hyps
  4.2238 +  obtain l1 u1 where "l = -u1" and "u = -l1"
  4.2239 +    "Ifloat l1 \<le> Ifloatarith a xs" and "Ifloatarith a xs \<le> Ifloat u1" unfolding fst_conv snd_conv by blast
  4.2240 +  thus ?case unfolding Ifloatarith.simps using Ifloat_minus by auto
  4.2241 +next
  4.2242 +  case (Mult a b)
  4.2243 +  from lift_bin'[OF Mult.prems[unfolded approx.simps]] Mult.hyps
  4.2244 +  obtain l1 u1 l2 u2 
  4.2245 +    where l: "l = float_nprt l1 * float_pprt u2 + float_nprt u1 * float_nprt u2 + float_pprt l1 * float_pprt l2 + float_pprt u1 * float_nprt l2"
  4.2246 +    and u: "u = float_pprt u1 * float_pprt u2 + float_pprt l1 * float_nprt u2 + float_nprt u1 * float_pprt l2 + float_nprt l1 * float_nprt l2"
  4.2247 +    and "Ifloat l1 \<le> Ifloatarith a xs" and "Ifloatarith a xs \<le> Ifloat u1"
  4.2248 +    and "Ifloat l2 \<le> Ifloatarith b xs" and "Ifloatarith b xs \<le> Ifloat u2" unfolding fst_conv snd_conv by blast
  4.2249 +  thus ?case unfolding Ifloatarith.simps l u Ifloat_add Ifloat_mult Ifloat_nprt Ifloat_pprt 
  4.2250 +    using mult_le_prts mult_ge_prts by auto
  4.2251 +next
  4.2252 +  case (Inverse a)
  4.2253 +  from lift_un[OF Inverse.prems[unfolded approx.simps], unfolded if_distrib[of fst] if_distrib[of snd] fst_conv snd_conv] Inverse.hyps
  4.2254 +  obtain l1 u1 where l': "Some l = (if 0 < l1 \<or> u1 < 0 then Some (float_divl prec 1 u1) else None)" 
  4.2255 +    and u': "Some u = (if 0 < l1 \<or> u1 < 0 then Some (float_divr prec 1 l1) else None)"
  4.2256 +    and l1: "Ifloat l1 \<le> Ifloatarith a xs" and u1: "Ifloatarith a xs \<le> Ifloat u1" by blast
  4.2257 +  have either: "0 < l1 \<or> u1 < 0" proof (rule ccontr) assume P: "\<not> (0 < l1 \<or> u1 < 0)" show False using l' unfolding if_not_P[OF P] by auto qed
  4.2258 +  moreover have l1_le_u1: "Ifloat l1 \<le> Ifloat u1" using l1 u1 by auto
  4.2259 +  ultimately have "Ifloat l1 \<noteq> 0" and "Ifloat u1 \<noteq> 0" unfolding less_float_def by auto
  4.2260 +
  4.2261 +  have inv: "inverse (Ifloat u1) \<le> inverse (Ifloatarith a xs)
  4.2262 +           \<and> inverse (Ifloatarith a xs) \<le> inverse (Ifloat l1)"
  4.2263 +  proof (cases "0 < l1")
  4.2264 +    case True hence "0 < Ifloat u1" and "0 < Ifloat l1" "0 < Ifloatarith a xs" 
  4.2265 +      unfolding less_float_def using l1_le_u1 l1 by auto
  4.2266 +    show ?thesis
  4.2267 +      unfolding inverse_le_iff_le[OF `0 < Ifloat u1` `0 < Ifloatarith a xs`]
  4.2268 +	inverse_le_iff_le[OF `0 < Ifloatarith a xs` `0 < Ifloat l1`]
  4.2269 +      using l1 u1 by auto
  4.2270 +  next
  4.2271 +    case False hence "u1 < 0" using either by blast
  4.2272 +    hence "Ifloat u1 < 0" and "Ifloat l1 < 0" "Ifloatarith a xs < 0" 
  4.2273 +      unfolding less_float_def using l1_le_u1 u1 by auto
  4.2274 +    show ?thesis
  4.2275 +      unfolding inverse_le_iff_le_neg[OF `Ifloat u1 < 0` `Ifloatarith a xs < 0`]
  4.2276 +	inverse_le_iff_le_neg[OF `Ifloatarith a xs < 0` `Ifloat l1 < 0`]
  4.2277 +      using l1 u1 by auto
  4.2278 +  qed
  4.2279 +    
  4.2280 +  from l' have "l = float_divl prec 1 u1" by (cases "0 < l1 \<or> u1 < 0", auto)
  4.2281 +  hence "Ifloat l \<le> inverse (Ifloat u1)" unfolding nonzero_inverse_eq_divide[OF `Ifloat u1 \<noteq> 0`] using float_divl[of prec 1 u1] by auto
  4.2282 +  also have "\<dots> \<le> inverse (Ifloatarith a xs)" using inv by auto
  4.2283 +  finally have "Ifloat l \<le> inverse (Ifloatarith a xs)" .
  4.2284 +  moreover
  4.2285 +  from u' have "u = float_divr prec 1 l1" by (cases "0 < l1 \<or> u1 < 0", auto)
  4.2286 +  hence "inverse (Ifloat l1) \<le> Ifloat u" unfolding nonzero_inverse_eq_divide[OF `Ifloat l1 \<noteq> 0`] using float_divr[of 1 l1 prec] by auto
  4.2287 +  hence "inverse (Ifloatarith a xs) \<le> Ifloat u" by (rule order_trans[OF inv[THEN conjunct2]])
  4.2288 +  ultimately show ?case unfolding Ifloatarith.simps using l1 u1 by auto
  4.2289 +next
  4.2290 +  case (Abs x)
  4.2291 +  from lift_un'[OF Abs.prems[unfolded approx.simps], unfolded fst_conv snd_conv] Abs.hyps
  4.2292 +  obtain l1 u1 where l': "l = (if l1 < 0 \<and> 0 < u1 then 0 else min \<bar>l1\<bar> \<bar>u1\<bar>)" and u': "u = max \<bar>l1\<bar> \<bar>u1\<bar>"
  4.2293 +    and l1: "Ifloat l1 \<le> Ifloatarith x xs" and u1: "Ifloatarith x xs \<le> Ifloat u1" by blast
  4.2294 +  thus ?case unfolding l' u' by (cases "l1 < 0 \<and> 0 < u1", auto simp add: Ifloat_min Ifloat_max Ifloat_abs less_float_def)
  4.2295 +next
  4.2296 +  case (Min a b)
  4.2297 +  from lift_bin'[OF Min.prems[unfolded approx.simps], unfolded fst_conv snd_conv] Min.hyps
  4.2298 +  obtain l1 u1 l2 u2 where l': "l = min l1 l2" and u': "u = min u1 u2"
  4.2299 +    and l1: "Ifloat l1 \<le> Ifloatarith a xs" and u1: "Ifloatarith a xs \<le> Ifloat u1"
  4.2300 +    and l1: "Ifloat l2 \<le> Ifloatarith b xs" and u1: "Ifloatarith b xs \<le> Ifloat u2" by blast
  4.2301 +  thus ?case unfolding l' u' by (auto simp add: Ifloat_min)
  4.2302 +next
  4.2303 +  case (Max a b)
  4.2304 +  from lift_bin'[OF Max.prems[unfolded approx.simps], unfolded fst_conv snd_conv] Max.hyps
  4.2305 +  obtain l1 u1 l2 u2 where l': "l = max l1 l2" and u': "u = max u1 u2"
  4.2306 +    and l1: "Ifloat l1 \<le> Ifloatarith a xs" and u1: "Ifloatarith a xs \<le> Ifloat u1"
  4.2307 +    and l1: "Ifloat l2 \<le> Ifloatarith b xs" and u1: "Ifloatarith b xs \<le> Ifloat u2" by blast
  4.2308 +  thus ?case unfolding l' u' by (auto simp add: Ifloat_max)
  4.2309 +next case (Sin a) with lift_un'_bnds[OF bnds_sin] show ?case by auto
  4.2310 +next case (Cos a) with lift_un'_bnds[OF bnds_cos] show ?case by auto
  4.2311 +next case (Arctan a) with lift_un'_bnds[OF bnds_arctan] show ?case by auto
  4.2312 +next case Pi with pi_boundaries show ?case by auto
  4.2313 +next case (Sqrt a) with lift_un_bnds[OF bnds_sqrt] show ?case by auto
  4.2314 +next case (Exp a) with lift_un'_bnds[OF bnds_exp] show ?case by auto
  4.2315 +next case (Ln a) with lift_un_bnds[OF bnds_ln] show ?case by auto
  4.2316 +next case (Power a n) with lift_un'_bnds[OF bnds_power] show ?case by auto
  4.2317 +next case (Num f) thus ?case by auto
  4.2318 +next
  4.2319 +  case (Atom n) 
  4.2320 +  show ?case
  4.2321 +  proof (cases "n < length vs")
  4.2322 +    case True
  4.2323 +    with Atom have "vs ! n = (l, u)" by auto
  4.2324 +    thus ?thesis using bounded_by[OF assms(1) True] by auto
  4.2325 +  next
  4.2326 +    case False thus ?thesis using Atom by auto
  4.2327 +  qed
  4.2328 +qed
  4.2329 +
  4.2330 +datatype ApproxEq = Less floatarith floatarith 
  4.2331 +                  | LessEqual floatarith floatarith 
  4.2332 +
  4.2333 +fun uneq :: "ApproxEq \<Rightarrow> real list \<Rightarrow> bool" where 
  4.2334 +"uneq (Less a b) vs                   = (Ifloatarith a vs < Ifloatarith b vs)" |
  4.2335 +"uneq (LessEqual a b) vs              = (Ifloatarith a vs \<le> Ifloatarith b vs)"
  4.2336 +
  4.2337 +fun uneq' :: "nat \<Rightarrow> ApproxEq \<Rightarrow> (float * float) list \<Rightarrow> bool" where 
  4.2338 +"uneq' prec (Less a b) bs = (case (approx prec a bs, approx prec b bs) of (Some (l, u), Some (l', u')) \<Rightarrow> u < l' | _ \<Rightarrow> False)" |
  4.2339 +"uneq' prec (LessEqual a b) bs = (case (approx prec a bs, approx prec b bs) of (Some (l, u), Some (l', u')) \<Rightarrow> u \<le> l' | _ \<Rightarrow> False)"
  4.2340 +
  4.2341 +lemma uneq_approx: fixes m :: nat assumes "bounded_by vs bs" and "uneq' prec eq bs"
  4.2342 +  shows "uneq eq vs"
  4.2343 +proof (cases eq)
  4.2344 +  case (Less a b)
  4.2345 +  show ?thesis
  4.2346 +  proof (cases "\<exists> u l u' l'. approx prec a bs = Some (l, u) \<and> 
  4.2347 +                             approx prec b bs = Some (l', u')")
  4.2348 +    case True
  4.2349 +    then obtain l u l' u' where a_approx: "approx prec a bs = Some (l, u)"
  4.2350 +      and b_approx: "approx prec b bs = Some (l', u') " by auto
  4.2351 +    with `uneq' prec eq bs` have "Ifloat u < Ifloat l'"
  4.2352 +      unfolding Less uneq'.simps less_float_def by auto
  4.2353 +    moreover from a_approx[symmetric] and b_approx[symmetric] and `bounded_by vs bs`
  4.2354 +    have "Ifloatarith a vs \<le> Ifloat u" and "Ifloat l' \<le> Ifloatarith b vs"
  4.2355 +      using approx by auto
  4.2356 +    ultimately show ?thesis unfolding uneq.simps Less by auto
  4.2357 +  next
  4.2358 +    case False
  4.2359 +    hence "approx prec a bs = None \<or> approx prec b bs = None"
  4.2360 +      unfolding not_Some_eq[symmetric] by auto
  4.2361 +    hence "\<not> uneq' prec eq bs" unfolding Less uneq'.simps 
  4.2362 +      by (cases "approx prec a bs = None", auto)
  4.2363 +    thus ?thesis using assms by auto
  4.2364 +  qed
  4.2365 +next
  4.2366 +  case (LessEqual a b)
  4.2367 +  show ?thesis
  4.2368 +  proof (cases "\<exists> u l u' l'. approx prec a bs = Some (l, u) \<and> 
  4.2369 +                             approx prec b bs = Some (l', u')")
  4.2370 +    case True
  4.2371 +    then obtain l u l' u' where a_approx: "approx prec a bs = Some (l, u)"
  4.2372 +      and b_approx: "approx prec b bs = Some (l', u') " by auto
  4.2373 +    with `uneq' prec eq bs` have "Ifloat u \<le> Ifloat l'"
  4.2374 +      unfolding LessEqual uneq'.simps le_float_def by auto
  4.2375 +    moreover from a_approx[symmetric] and b_approx[symmetric] and `bounded_by vs bs`
  4.2376 +    have "Ifloatarith a vs \<le> Ifloat u" and "Ifloat l' \<le> Ifloatarith b vs"
  4.2377 +      using approx by auto
  4.2378 +    ultimately show ?thesis unfolding uneq.simps LessEqual by auto
  4.2379 +  next
  4.2380 +    case False
  4.2381 +    hence "approx prec a bs = None \<or> approx prec b bs = None"
  4.2382 +      unfolding not_Some_eq[symmetric] by auto
  4.2383 +    hence "\<not> uneq' prec eq bs" unfolding LessEqual uneq'.simps 
  4.2384 +      by (cases "approx prec a bs = None", auto)
  4.2385 +    thus ?thesis using assms by auto
  4.2386 +  qed
  4.2387 +qed
  4.2388 +
  4.2389 +lemma Ifloatarith_divide: "Ifloatarith (Mult a (Inverse b)) vs = (Ifloatarith a vs) / (Ifloatarith b vs)"
  4.2390 +  unfolding real_divide_def Ifloatarith.simps ..
  4.2391 +
  4.2392 +lemma Ifloatarith_diff: "Ifloatarith (Add a (Minus b)) vs = (Ifloatarith a vs) - (Ifloatarith b vs)"
  4.2393 +  unfolding real_diff_def Ifloatarith.simps ..
  4.2394 +
  4.2395 +lemma Ifloatarith_tan: "Ifloatarith (Mult (Sin a) (Inverse (Cos a))) vs = tan (Ifloatarith a vs)"
  4.2396 +  unfolding tan_def Ifloatarith.simps real_divide_def ..
  4.2397 +
  4.2398 +lemma Ifloatarith_powr: "Ifloatarith (Exp (Mult b (Ln a))) vs = (Ifloatarith a vs) powr (Ifloatarith b vs)"
  4.2399 +  unfolding powr_def Ifloatarith.simps ..
  4.2400 +
  4.2401 +lemma Ifloatarith_log: "Ifloatarith ((Mult (Ln x) (Inverse (Ln b)))) vs = log (Ifloatarith b vs) (Ifloatarith x vs)"
  4.2402 +  unfolding log_def Ifloatarith.simps real_divide_def ..
  4.2403 +
  4.2404 +lemma Ifloatarith_num: shows "Ifloatarith (Num (Float 0 0)) vs = 0" and "Ifloatarith (Num (Float 1 0)) vs = 1" and "Ifloatarith (Num (Float (number_of a) 0)) vs = number_of a" by auto
  4.2405 +
  4.2406 +subsection {* Implement proof method \texttt{approximation} *}
  4.2407 +
  4.2408 +lemma bounded_divl: assumes "Ifloat a / Ifloat b \<le> x" shows "Ifloat (float_divl p a b) \<le> x" by (rule order_trans[OF _ assms], rule float_divl)
  4.2409 +lemma bounded_divr: assumes "x \<le> Ifloat a / Ifloat b" shows "x \<le> Ifloat (float_divr p a b)" by (rule order_trans[OF assms _], rule float_divr)
  4.2410 +lemma bounded_num: shows "Ifloat (Float 5 1) = 10" and "Ifloat (Float 0 0) = 0" and "Ifloat (Float 1 0) = 1" and "Ifloat (Float (number_of n) 0) = (number_of n)"
  4.2411 +                     and "0 * pow2 e = Ifloat (Float 0 e)" and "1 * pow2 e = Ifloat (Float 1 e)" and "number_of m * pow2 e = Ifloat (Float (number_of m) e)"
  4.2412 +  by (auto simp add: Ifloat.simps pow2_def)
  4.2413 +
  4.2414 +lemmas bounded_by_equations = bounded_by_Cons bounded_by_Nil float_power bounded_divl bounded_divr bounded_num HOL.simp_thms
  4.2415 +lemmas uneq_equations = uneq.simps Ifloatarith.simps Ifloatarith_num Ifloatarith_divide Ifloatarith_diff Ifloatarith_tan Ifloatarith_powr Ifloatarith_log
  4.2416 +
  4.2417 +lemma "x div (0::int) = 0" by auto -- "What happens in the zero case for div"
  4.2418 +lemma "x mod (0::int) = x" by auto -- "What happens in the zero case for mod"
  4.2419 +
  4.2420 +text {* The following equations must hold for div & mod 
  4.2421 +        -- see "The Definition of Standard ML" by R. Milner, M. Tofte and R. Harper (pg. 79) *}
  4.2422 +lemma "d * (i div d) + i mod d = (i::int)" by auto
  4.2423 +lemma "0 < (d :: int) \<Longrightarrow> 0 \<le> i mod d \<and> i mod d < d" by auto
  4.2424 +lemma "(d :: int) < 0 \<Longrightarrow> d < i mod d \<and> i mod d \<le> 0" by auto
  4.2425 +
  4.2426 +code_const "op div :: int \<Rightarrow> int \<Rightarrow> int" (SML "(fn i => fn d => if d = 0 then 0 else i div d)")
  4.2427 +code_const "op mod :: int \<Rightarrow> int \<Rightarrow> int" (SML "(fn i => fn d => if d = 0 then i else i mod d)")
  4.2428 +code_const "divmod :: int \<Rightarrow> int \<Rightarrow> (int * int)" (SML "(fn i => fn d => if d = 0 then (0, i) else IntInf.divMod (i, d))")
  4.2429 +
  4.2430 +ML {*
  4.2431 +  val uneq_equations = PureThy.get_thms @{theory} "uneq_equations";
  4.2432 +  val bounded_by_equations = PureThy.get_thms @{theory} "bounded_by_equations";
  4.2433 +  val bounded_by_simpset = (HOL_basic_ss addsimps bounded_by_equations)
  4.2434 +
  4.2435 +  fun reify_uneq ctxt i = (fn st =>
  4.2436 +    let
  4.2437 +      val to = HOLogic.dest_Trueprop (Logic.strip_imp_concl (List.nth (prems_of st, i - 1)))
  4.2438 +    in (Reflection.genreify_tac ctxt uneq_equations (SOME to) i) st
  4.2439 +    end)
  4.2440 +
  4.2441 +  fun rule_uneq ctxt prec i thm = let
  4.2442 +    fun conv_num typ = HOLogic.dest_number #> snd #> HOLogic.mk_number typ
  4.2443 +    val to_natc = conv_num @{typ "nat"} #> Thm.cterm_of (ProofContext.theory_of ctxt)
  4.2444 +    val to_nat = conv_num @{typ "nat"}
  4.2445 +    val to_int = conv_num @{typ "int"}
  4.2446 +
  4.2447 +    val prec' = to_nat prec
  4.2448 +
  4.2449 +    fun bot_float (Const (@{const_name "times"}, _) $ mantisse $ (Const (@{const_name "pow2"}, _) $ exp))
  4.2450 +                   = @{term "Float"} $ to_int mantisse $ to_int exp
  4.2451 +      | bot_float (Const (@{const_name "divide"}, _) $ mantisse $ (Const (@{const_name "power"}, _) $ ten $ exp))
  4.2452 +                   = @{term "float_divl"} $ prec' $ (@{term "Float"} $ to_int mantisse $ @{term "0 :: int"}) $ (@{term "power_float (Float 5 1)"} $ to_nat exp)
  4.2453 +      | bot_float (Const (@{const_name "divide"}, _) $ mantisse $ ten)
  4.2454 +                   = @{term "float_divl"} $ prec' $ (@{term "Float"} $ to_int mantisse $ @{term "0 :: int"}) $ @{term "Float 5 1"}
  4.2455 +      | bot_float mantisse = @{term "Float"} $ to_int mantisse $ @{term "0 :: int"}
  4.2456 +
  4.2457 +    fun top_float (Const (@{const_name "times"}, _) $ mantisse $ (Const (@{const_name "pow2"}, _) $ exp))
  4.2458 +                   = @{term "Float"} $ to_int mantisse $ to_int exp
  4.2459 +      | top_float (Const (@{const_name "divide"}, _) $ mantisse $ (Const (@{const_name "power"}, _) $ ten $ exp))
  4.2460 +                   = @{term "float_divr"} $ prec' $ (@{term "Float"} $ to_int mantisse $ @{term "0 :: int"}) $ (@{term "power_float (Float 5 1)"} $ to_nat exp)
  4.2461 +      | top_float (Const (@{const_name "divide"}, _) $ mantisse $ ten)
  4.2462 +                   = @{term "float_divr"} $ prec' $ (@{term "Float"} $ to_int mantisse $ @{term "0 :: int"}) $ @{term "Float 5 1"}
  4.2463 +      | top_float mantisse = @{term "Float"} $ to_int mantisse $ @{term "0 :: int"}
  4.2464 +
  4.2465 +    val goal' : term = List.nth (prems_of thm, i - 1)
  4.2466 +
  4.2467 +    fun lift_bnd (t as (Const (@{const_name "op &"}, _) $ 
  4.2468 +                        (Const (@{const_name "less_eq"}, _) $ 
  4.2469 +                         bottom $ (Free (name, _))) $ 
  4.2470 +                        (Const (@{const_name "less_eq"}, _) $ _ $ top)))
  4.2471 +         = ((name, HOLogic.mk_prod (bot_float bottom, top_float top))
  4.2472 +            handle TERM (txt, ts) => raise TERM ("Premisse needs format '<num> <= <var> & <var> <= <num>', but found " ^
  4.2473 +                                  (Syntax.string_of_term ctxt t), [t]))
  4.2474 +      | lift_bnd t = raise TERM ("Premisse needs format '<num> <= <var> & <var> <= <num>', but found " ^
  4.2475 +                                 (Syntax.string_of_term ctxt t), [t])
  4.2476 +    val bound_eqs = map (HOLogic.dest_Trueprop #> lift_bnd)  (Logic.strip_imp_prems goal')
  4.2477 +
  4.2478 +    fun lift_var (Free (varname, _)) = (case AList.lookup (op =) bound_eqs varname of
  4.2479 +                                          SOME bound => bound
  4.2480 +                                        | NONE => raise TERM ("No bound equations found for " ^ varname, []))
  4.2481 +      | lift_var t = raise TERM ("Can not convert expression " ^ 
  4.2482 +                                 (Syntax.string_of_term ctxt t), [t])
  4.2483 +
  4.2484 +    val _ $ vs = HOLogic.dest_Trueprop (Logic.strip_imp_concl goal')
  4.2485 +
  4.2486 +    val bs = (HOLogic.dest_list #> map lift_var #> HOLogic.mk_list @{typ "float * float"}) vs
  4.2487 +    val map = [(@{cpat "?prec::nat"}, to_natc prec),
  4.2488 +               (@{cpat "?bs::(float * float) list"}, Thm.cterm_of (ProofContext.theory_of ctxt) bs)]
  4.2489 +  in rtac (Thm.instantiate ([], map) @{thm "uneq_approx"}) i thm end
  4.2490 +
  4.2491 +  val eval_tac = CSUBGOAL (fn (ct, i) => rtac (eval_oracle ct) i)
  4.2492 +
  4.2493 +  fun gen_eval_tac conv ctxt = CONVERSION (Conv.params_conv (~1) (K (Conv.concl_conv (~1) conv)) ctxt)
  4.2494 +                               THEN' rtac TrueI
  4.2495 +
  4.2496 +*}
  4.2497 +
  4.2498 +method_setup approximation = {* fn src => 
  4.2499 +  Method.syntax Args.term src #>
  4.2500 +  (fn (prec, ctxt) => let
  4.2501 +   in Method.SIMPLE_METHOD' (fn i =>
  4.2502 +     (DETERM (reify_uneq ctxt i)
  4.2503 +      THEN rule_uneq ctxt prec i
  4.2504 +      THEN Simplifier.asm_full_simp_tac bounded_by_simpset i 
  4.2505 +      THEN (TRY (filter_prems_tac (fn t => false) i))
  4.2506 +      THEN (gen_eval_tac eval_oracle ctxt) i))
  4.2507 +   end)
  4.2508 +*} "real number approximation"
  4.2509 +
  4.2510 +end
     5.1 --- a/src/HOL/Reflection/ROOT.ML	Thu Feb 05 11:45:15 2009 +0100
     5.2 +++ b/src/HOL/Reflection/ROOT.ML	Thu Feb 05 11:49:15 2009 +0100
     5.3 @@ -1,2 +1,2 @@
     5.4  
     5.5 -use_thys ["Cooper", "Ferrack", "MIR"];
     5.6 \ No newline at end of file
     5.7 +use_thys ["Cooper", "Ferrack", "MIR", "Approximation"];
     6.1 --- /dev/null	Thu Jan 01 00:00:00 1970 +0000
     6.2 +++ b/src/HOL/ex/ApproximationEx.thy	Thu Feb 05 11:49:15 2009 +0100
     6.3 @@ -0,0 +1,46 @@
     6.4 +(* Title:    HOL/ex/ApproximationEx.thy
     6.5 +   Author:   Johannes Hoelzl <hoelzl@in.tum.de> 2009
     6.6 +*)
     6.7 +theory ApproximationEx
     6.8 +imports "~~/src/HOL/Reflection/Approximation"
     6.9 +begin
    6.10 +
    6.11 +text {*
    6.12 +
    6.13 +Here are some examples how to use the approximation method.
    6.14 +
    6.15 +The parameter passed to the method specifies the precision used by the computations, it is specified
    6.16 +as number of bits to calculate. When a variable is used it needs to be bounded by an interval. This
    6.17 +interval is specified as a conjunction of the lower and upper bound. It must have the form
    6.18 +@{text "\<lbrakk> l\<^isub>1 \<le> x\<^isub>1 \<and> x\<^isub>1 \<le> u\<^isub>1 ; \<dots> ; l\<^isub>n \<le> x\<^isub>n \<and> x\<^isub>n \<le> u\<^isub>n \<rbrakk> \<Longrightarrow> F"} where @{term F} is the formula, and
    6.19 +@{text "x\<^isub>1, \<dots>, x\<^isub>n"} are the variables. The lower bounds @{text "l\<^isub>1, \<dots>, l\<^isub>n"} and the upper bounds
    6.20 +@{text "u\<^isub>1, \<dots>, u\<^isub>n"} must either be integer numerals, floating point numbers or of the form
    6.21 +@{term "m * pow2 e"} to specify a exact floating point value.
    6.22 +
    6.23 +*}
    6.24 +
    6.25 +section "Compute some transcendental values"
    6.26 +
    6.27 +lemma "\<bar> ln 2 - 544531980202654583340825686620847 / 785593587443817081832229725798400 \<bar> < inverse (2^51) "
    6.28 +  by (approximation 80)
    6.29 +
    6.30 +lemma "\<bar> exp 1.626 - 5.083499996273 \<bar> < (inverse 10 ^ 10 :: real)"
    6.31 +  by (approximation 80)
    6.32 +
    6.33 +lemma "\<bar> sqrt 2 - 1.4142135623730951 \<bar> < inverse 10 ^ 16"
    6.34 +  by (approximation 80)
    6.35 +   
    6.36 +lemma "\<bar> pi - 3.1415926535897932385 \<bar> < inverse 10 ^ 18"
    6.37 +  by (approximation 80)
    6.38 +
    6.39 +section "Use variable ranges"
    6.40 +
    6.41 +lemma "0.5 \<le> x \<and> x \<le> 4.5 \<Longrightarrow> \<bar> arctan x - 0.91 \<bar> < 0.455"
    6.42 +  by (approximation 10)
    6.43 +
    6.44 +lemma "0 \<le> x \<and> x \<le> 1 \<Longrightarrow> 0 \<le> sin x"
    6.45 +  by (approximation 10)
    6.46 +
    6.47 +
    6.48 +end
    6.49 +