Library dirichlet_why

Require Export dirichlet_aux.
Require Export WhyFloatsStrictLegacy.
Local Coercion FtoRradix: Float.float >-> R.

Lemma forward_prop_ensures_default_po_3 :
  forall (ni_0: int32),
  forall (nk: int32),
  forall (dt: double),
  forall (v: double),
  forall (l: double),
  forall (HW_1: ( (integer_of_int32 ni_0) >= 2 /\
                 (integer_of_int32 nk) >= 2 /\
                 ~(eq (double_value l) (0)%R) /\
                 (Rgt (double_value dt) (0)%R) /\
                 (Rgt (double_exact dt) (0)%R) /\
                 (eq (double_exact v) c) /\
                 (eq (double_exact v) (double_value v)) /\
                
                (Rle
                 (1 / 10715086071862673209484250490600018105614048117055336074437503883703510511249361224931983788156958581275946729175531468251871452856923140435984577574698574803934567774824230985421074605062371141877954182153046474983581941267398767559165543946077062914571196477686542167660429831652624386837205668069376)%R
                 (double_exact dt)) /\
                 (integer_of_int32 ni_0) <= 2147483646 /\
                 (integer_of_int32 nk) <= 7598581 /\
                
                (Rle (Rmult (IZR (integer_of_int32 nk)) (double_exact dt))
                 T_max) /\
                
                (Rle
                 (Rdiv
                  (Rabs (Rminus (double_exact dt) (double_value dt))) (
                  double_value dt))
                 (1 / 2251799813685248)%R) /\
                
                (Rle
                 (1 / 3273390607896141870013189696827599152216642046043064789483291368096133796404674554883270092325904157150886684127560071009217256545885393053328527589376)%R
                 (Rmult
                  (Rmult (double_exact dt) (IZR (integer_of_int32 ni_0))) c)) /\
                
                (Rle
                 (Rmult
                  (Rmult (double_exact dt) (IZR (integer_of_int32 ni_0))) c)
                 (Rminus (1)%R (1 / 1125899906842624)%R)) /\
                
                (Rlt
                 (sqrt
                  (Rplus
                   (Rdiv
                    (1)%R (IZR
                           ((integer_of_int32 ni_0) *
                           (integer_of_int32 ni_0)))) (Rmult
                                                       (double_exact dt) (
                                                       double_exact dt))))
                 alpha_conv))),
  forall (result: double),
  forall (HW_10: (eq (double_value result) (1)%R) /\
                 (eq (double_exact result) (1)%R) /\
                 (eq (double_model result) (1)%R)),
  forall (result0: double),
  forall (HW_11: (double_of_real_post
                  nearest_even (IZR (integer_of_int32 ni_0)) result0)),
  forall (result1: double),
  forall (HW_12: ~(eq (double_value result0) (0)%R) /\
                 (div_double_post nearest_even result result0 result1)),
  forall (dx_8: double),
  forall (HW_13: dx_8 = result1),
  
  
  (Rle
   (Rdiv
    (Rabs (Rminus (double_exact dx_8) (double_value dx_8))) (double_value
                                                             dx_8))
   (1 / 9007199254740992)%R).

Lemma forward_prop_ensures_default_po_4 :
  forall (ni_0: int32),
  forall (nk: int32),
  forall (dt: double),
  forall (v: double),
  forall (l: double),
  forall (HW_1: ( (integer_of_int32 ni_0) >= 2 /\
                 (integer_of_int32 nk) >= 2 /\
                 ~(eq (double_value l) (0)%R) /\
                 (Rgt (double_value dt) (0)%R) /\
                 (Rgt (double_exact dt) (0)%R) /\
                 (eq (double_exact v) c) /\
                 (eq (double_exact v) (double_value v)) /\
                
                (Rle
                 (1 / 10715086071862673209484250490600018105614048117055336074437503883703510511249361224931983788156958581275946729175531468251871452856923140435984577574698574803934567774824230985421074605062371141877954182153046474983581941267398767559165543946077062914571196477686542167660429831652624386837205668069376)%R
                 (double_exact dt)) /\
                 (integer_of_int32 ni_0) <= 2147483646 /\
                 (integer_of_int32 nk) <= 7598581 /\
                
                (Rle (Rmult (IZR (integer_of_int32 nk)) (double_exact dt))
                 T_max) /\
                
                (Rle
                 (Rdiv
                  (Rabs (Rminus (double_exact dt) (double_value dt))) (
                  double_value dt))
                 (1 / 2251799813685248)%R) /\
                
                (Rle
                 (1 / 3273390607896141870013189696827599152216642046043064789483291368096133796404674554883270092325904157150886684127560071009217256545885393053328527589376)%R
                 (Rmult
                  (Rmult (double_exact dt) (IZR (integer_of_int32 ni_0))) c)) /\
                
                (Rle
                 (Rmult
                  (Rmult (double_exact dt) (IZR (integer_of_int32 ni_0))) c)
                 (Rminus (1)%R (1 / 1125899906842624)%R)) /\
                
                (Rlt
                 (sqrt
                  (Rplus
                   (Rdiv
                    (1)%R (IZR
                           ((integer_of_int32 ni_0) *
                           (integer_of_int32 ni_0)))) (Rmult
                                                       (double_exact dt) (
                                                       double_exact dt))))
                 alpha_conv))),
  forall (result: double),
  forall (HW_10: (eq (double_value result) (1)%R) /\
                 (eq (double_exact result) (1)%R) /\
                 (eq (double_model result) (1)%R)),
  forall (result0: double),
  forall (HW_11: (double_of_real_post
                  nearest_even (IZR (integer_of_int32 ni_0)) result0)),
  forall (result1: double),
  forall (HW_12: ~(eq (double_value result0) (0)%R) /\
                 (div_double_post nearest_even result result0 result1)),
  forall (dx_8: double),
  forall (HW_13: dx_8 = result1),
  forall (HW_14:
                 ( (Rgt (double_value dx_8) (0)%R) /\
                  (Rle (double_value dx_8) (05 / 10)%R) /\
                 
                 (Rle
                  (Rdiv
                   (Rabs (Rminus (double_exact dx_8) (double_value dx_8))) (
                   double_value dx_8))
                  (1 / 9007199254740992)%R))),
  forall (result2: double),
  forall (HW_15: ~(eq (double_value dx_8) (0)%R) /\
                 (div_double_post nearest_even dt dx_8 result2)),
  forall (result3: double),
  forall (HW_16: (mul_double_post nearest_even result2 v result3)),
  forall (a1: double),
  forall (HW_17: a1 = result3),
  forall (result4: double),
  forall (HW_18: (mul_double_post nearest_even a1 a1 result4)),
  forall (a_1: double),
  forall (HW_19: a_1 = result4),
   (Rle (0)%R (double_value a_1)).

Lemma forward_prop_ensures_default_po_5 :
  forall (ni_0: int32),
  forall (nk: int32),
  forall (dt: double),
  forall (v: double),
  forall (l: double),
  forall (HW_1: ( (integer_of_int32 ni_0) >= 2 /\
                 (integer_of_int32 nk) >= 2 /\
                 ~(eq (double_value l) (0)%R) /\
                 (Rgt (double_value dt) (0)%R) /\
                 (Rgt (double_exact dt) (0)%R) /\
                 (eq (double_exact v) c) /\
                 (eq (double_exact v) (double_value v)) /\
                
                (Rle
                 (1 / 10715086071862673209484250490600018105614048117055336074437503883703510511249361224931983788156958581275946729175531468251871452856923140435984577574698574803934567774824230985421074605062371141877954182153046474983581941267398767559165543946077062914571196477686542167660429831652624386837205668069376)%R
                 (double_exact dt)) /\
                 (integer_of_int32 ni_0) <= 2147483646 /\
                 (integer_of_int32 nk) <= 7598581 /\
                
                (Rle (Rmult (IZR (integer_of_int32 nk)) (double_exact dt))
                 T_max) /\
                
                (Rle
                 (Rdiv
                  (Rabs (Rminus (double_exact dt) (double_value dt))) (
                  double_value dt))
                 (1 / 2251799813685248)%R) /\
                
                (Rle
                 (1 / 3273390607896141870013189696827599152216642046043064789483291368096133796404674554883270092325904157150886684127560071009217256545885393053328527589376)%R
                 (Rmult
                  (Rmult (double_exact dt) (IZR (integer_of_int32 ni_0))) c)) /\
                
                (Rle
                 (Rmult
                  (Rmult (double_exact dt) (IZR (integer_of_int32 ni_0))) c)
                 (Rminus (1)%R (1 / 1125899906842624)%R)) /\
                
                (Rlt
                 (sqrt
                  (Rplus
                   (Rdiv
                    (1)%R (IZR
                           ((integer_of_int32 ni_0) *
                           (integer_of_int32 ni_0)))) (Rmult
                                                       (double_exact dt) (
                                                       double_exact dt))))
                 alpha_conv))),
  forall (result: double),
  forall (HW_10: (eq (double_value result) (1)%R) /\
                 (eq (double_exact result) (1)%R) /\
                 (eq (double_model result) (1)%R)),
  forall (result0: double),
  forall (HW_11: (double_of_real_post
                  nearest_even (IZR (integer_of_int32 ni_0)) result0)),
  forall (result1: double),
  forall (HW_12: ~(eq (double_value result0) (0)%R) /\
                 (div_double_post nearest_even result result0 result1)),
  forall (dx_8: double),
  forall (HW_13: dx_8 = result1),
  forall (HW_14:
                 ( (Rgt (double_value dx_8) (0)%R) /\
                  (Rle (double_value dx_8) (05 / 10)%R) /\
                 
                 (Rle
                  (Rdiv
                   (Rabs (Rminus (double_exact dx_8) (double_value dx_8))) (
                   double_value dx_8))
                  (1 / 9007199254740992)%R))),
  forall (result2: double),
  forall (HW_15: ~(eq (double_value dx_8) (0)%R) /\
                 (div_double_post nearest_even dt dx_8 result2)),
  forall (result3: double),
  forall (HW_16: (mul_double_post nearest_even result2 v result3)),
  forall (a1: double),
  forall (HW_17: a1 = result3),
  forall (result4: double),
  forall (HW_18: (mul_double_post nearest_even a1 a1 result4)),
  forall (a_1: double),
  forall (HW_19: a_1 = result4),
   (Rle (double_value a_1) (1)%R).

Lemma forward_prop_ensures_default_po_6 :
  forall (ni_0: int32),
  forall (nk: int32),
  forall (dt: double),
  forall (v: double),
  forall (l: double),
  forall (HW_1: ( (integer_of_int32 ni_0) >= 2 /\
                 (integer_of_int32 nk) >= 2 /\
                 ~(eq (double_value l) (0)%R) /\
                 (Rgt (double_value dt) (0)%R) /\
                 (Rgt (double_exact dt) (0)%R) /\
                 (eq (double_exact v) c) /\
                 (eq (double_exact v) (double_value v)) /\
                
                (Rle
                 (1 / 10715086071862673209484250490600018105614048117055336074437503883703510511249361224931983788156958581275946729175531468251871452856923140435984577574698574803934567774824230985421074605062371141877954182153046474983581941267398767559165543946077062914571196477686542167660429831652624386837205668069376)%R
                 (double_exact dt)) /\
                 (integer_of_int32 ni_0) <= 2147483646 /\
                 (integer_of_int32 nk) <= 7598581 /\
                
                (Rle (Rmult (IZR (integer_of_int32 nk)) (double_exact dt))
                 T_max) /\
                
                (Rle
                 (Rdiv
                  (Rabs (Rminus (double_exact dt) (double_value dt))) (
                  double_value dt))
                 (1 / 2251799813685248)%R) /\
                
                (Rle
                 (1 / 3273390607896141870013189696827599152216642046043064789483291368096133796404674554883270092325904157150886684127560071009217256545885393053328527589376)%R
                 (Rmult
                  (Rmult (double_exact dt) (IZR (integer_of_int32 ni_0))) c)) /\
                
                (Rle
                 (Rmult
                  (Rmult (double_exact dt) (IZR (integer_of_int32 ni_0))) c)
                 (Rminus (1)%R (1 / 1125899906842624)%R)) /\
                
                (Rlt
                 (sqrt
                  (Rplus
                   (Rdiv
                    (1)%R (IZR
                           ((integer_of_int32 ni_0) *
                           (integer_of_int32 ni_0)))) (Rmult
                                                       (double_exact dt) (
                                                       double_exact dt))))
                 alpha_conv))),
  forall (result: double),
  forall (HW_10: (eq (double_value result) (1)%R) /\
                 (eq (double_exact result) (1)%R) /\
                 (eq (double_model result) (1)%R)),
  forall (result0: double),
  forall (HW_11: (double_of_real_post
                  nearest_even (IZR (integer_of_int32 ni_0)) result0)),
  forall (result1: double),
  forall (HW_12: ~(eq (double_value result0) (0)%R) /\
                 (div_double_post nearest_even result result0 result1)),
  forall (dx_8: double),
  forall (HW_13: dx_8 = result1),
  forall (HW_14:
                 ( (Rgt (double_value dx_8) (0)%R) /\
                  (Rle (double_value dx_8) (05 / 10)%R) /\
                 
                 (Rle
                  (Rdiv
                   (Rabs (Rminus (double_exact dx_8) (double_value dx_8))) (
                   double_value dx_8))
                  (1 / 9007199254740992)%R))),
  forall (result2: double),
  forall (HW_15: ~(eq (double_value dx_8) (0)%R) /\
                 (div_double_post nearest_even dt dx_8 result2)),
  forall (result3: double),
  forall (HW_16: (mul_double_post nearest_even result2 v result3)),
  forall (a1: double),
  forall (HW_17: a1 = result3),
  forall (result4: double),
  forall (HW_18: (mul_double_post nearest_even a1 a1 result4)),
  forall (a_1: double),
  forall (HW_19: a_1 = result4),
   (Rlt (0)%R (double_exact a_1)).

Lemma forward_prop_ensures_default_po_7 :
  forall (ni_0: int32),
  forall (nk: int32),
  forall (dt: double),
  forall (v: double),
  forall (l: double),
  forall (HW_1: ( (integer_of_int32 ni_0) >= 2 /\
                 (integer_of_int32 nk) >= 2 /\
                 ~(eq (double_value l) (0)%R) /\
                 (Rgt (double_value dt) (0)%R) /\
                 (Rgt (double_exact dt) (0)%R) /\
                 (eq (double_exact v) c) /\
                 (eq (double_exact v) (double_value v)) /\
                
                (Rle
                 (1 / 10715086071862673209484250490600018105614048117055336074437503883703510511249361224931983788156958581275946729175531468251871452856923140435984577574698574803934567774824230985421074605062371141877954182153046474983581941267398767559165543946077062914571196477686542167660429831652624386837205668069376)%R
                 (double_exact dt)) /\
                 (integer_of_int32 ni_0) <= 2147483646 /\
                 (integer_of_int32 nk) <= 7598581 /\
                
                (Rle (Rmult (IZR (integer_of_int32 nk)) (double_exact dt))
                 T_max) /\
                
                (Rle
                 (Rdiv
                  (Rabs (Rminus (double_exact dt) (double_value dt))) (
                  double_value dt))
                 (1 / 2251799813685248)%R) /\
                
                (Rle
                 (1 / 3273390607896141870013189696827599152216642046043064789483291368096133796404674554883270092325904157150886684127560071009217256545885393053328527589376)%R
                 (Rmult
                  (Rmult (double_exact dt) (IZR (integer_of_int32 ni_0))) c)) /\
                
                (Rle
                 (Rmult
                  (Rmult (double_exact dt) (IZR (integer_of_int32 ni_0))) c)
                 (Rminus (1)%R (1 / 1125899906842624)%R)) /\
                
                (Rlt
                 (sqrt
                  (Rplus
                   (Rdiv
                    (1)%R (IZR
                           ((integer_of_int32 ni_0) *
                           (integer_of_int32 ni_0)))) (Rmult
                                                       (double_exact dt) (
                                                       double_exact dt))))
                 alpha_conv))),
  forall (result: double),
  forall (HW_10: (eq (double_value result) (1)%R) /\
                 (eq (double_exact result) (1)%R) /\
                 (eq (double_model result) (1)%R)),
  forall (result0: double),
  forall (HW_11: (double_of_real_post
                  nearest_even (IZR (integer_of_int32 ni_0)) result0)),
  forall (result1: double),
  forall (HW_12: ~(eq (double_value result0) (0)%R) /\
                 (div_double_post nearest_even result result0 result1)),
  forall (dx_8: double),
  forall (HW_13: dx_8 = result1),
  forall (HW_14:
                 ( (Rgt (double_value dx_8) (0)%R) /\
                  (Rle (double_value dx_8) (05 / 10)%R) /\
                 
                 (Rle
                  (Rdiv
                   (Rabs (Rminus (double_exact dx_8) (double_value dx_8))) (
                   double_value dx_8))
                  (1 / 9007199254740992)%R))),
  forall (result2: double),
  forall (HW_15: ~(eq (double_value dx_8) (0)%R) /\
                 (div_double_post nearest_even dt dx_8 result2)),
  forall (result3: double),
  forall (HW_16: (mul_double_post nearest_even result2 v result3)),
  forall (a1: double),
  forall (HW_17: a1 = result3),
  forall (result4: double),
  forall (HW_18: (mul_double_post nearest_even a1 a1 result4)),
  forall (a_1: double),
  forall (HW_19: a_1 = result4),
   (Rle (double_exact a_1) (1)%R).

Lemma forward_prop_ensures_default_po_8 :
  forall (ni_0: int32),
  forall (nk: int32),
  forall (dt: double),
  forall (v: double),
  forall (l: double),
  forall (HW_1: ( (integer_of_int32 ni_0) >= 2 /\
                 (integer_of_int32 nk) >= 2 /\
                 ~(eq (double_value l) (0)%R) /\
                 (Rgt (double_value dt) (0)%R) /\
                 (Rgt (double_exact dt) (0)%R) /\
                 (eq (double_exact v) c) /\
                 (eq (double_exact v) (double_value v)) /\
                
                (Rle
                 (1 / 10715086071862673209484250490600018105614048117055336074437503883703510511249361224931983788156958581275946729175531468251871452856923140435984577574698574803934567774824230985421074605062371141877954182153046474983581941267398767559165543946077062914571196477686542167660429831652624386837205668069376)%R
                 (double_exact dt)) /\
                 (integer_of_int32 ni_0) <= 2147483646 /\
                 (integer_of_int32 nk) <= 7598581 /\
                
                (Rle (Rmult (IZR (integer_of_int32 nk)) (double_exact dt))
                 T_max) /\
                
                (Rle
                 (Rdiv
                  (Rabs (Rminus (double_exact dt) (double_value dt))) (
                  double_value dt))
                 (1 / 2251799813685248)%R) /\
                
                (Rle
                 (1 / 3273390607896141870013189696827599152216642046043064789483291368096133796404674554883270092325904157150886684127560071009217256545885393053328527589376)%R
                 (Rmult
                  (Rmult (double_exact dt) (IZR (integer_of_int32 ni_0))) c)) /\
                
                (Rle
                 (Rmult
                  (Rmult (double_exact dt) (IZR (integer_of_int32 ni_0))) c)
                 (Rminus (1)%R (1 / 1125899906842624)%R)) /\
                
                (Rlt
                 (sqrt
                  (Rplus
                   (Rdiv
                    (1)%R (IZR
                           ((integer_of_int32 ni_0) *
                           (integer_of_int32 ni_0)))) (Rmult
                                                       (double_exact dt) (
                                                       double_exact dt))))
                 alpha_conv))),
  forall (result: double),
  forall (HW_10: (eq (double_value result) (1)%R) /\
                 (eq (double_exact result) (1)%R) /\
                 (eq (double_model result) (1)%R)),
  forall (result0: double),
  forall (HW_11: (double_of_real_post
                  nearest_even (IZR (integer_of_int32 ni_0)) result0)),
  forall (result1: double),
  forall (HW_12: ~(eq (double_value result0) (0)%R) /\
                 (div_double_post nearest_even result result0 result1)),
  forall (dx_8: double),
  forall (HW_13: dx_8 = result1),
  forall (HW_14:
                 ( (Rgt (double_value dx_8) (0)%R) /\
                  (Rle (double_value dx_8) (05 / 10)%R) /\
                 
                 (Rle
                  (Rdiv
                   (Rabs (Rminus (double_exact dx_8) (double_value dx_8))) (
                   double_value dx_8))
                  (1 / 9007199254740992)%R))),
  forall (result2: double),
  forall (HW_15: ~(eq (double_value dx_8) (0)%R) /\
                 (div_double_post nearest_even dt dx_8 result2)),
  forall (result3: double),
  forall (HW_16: (mul_double_post nearest_even result2 v result3)),
  forall (a1: double),
  forall (HW_17: a1 = result3),
  forall (result4: double),
  forall (HW_18: (mul_double_post nearest_even a1 a1 result4)),
  forall (a_1: double),
  forall (HW_19: a_1 = result4),
  
   (Rle (double_round_error a_1) (1 / 562949953421312)%R).

Lemma forward_prop_ensures_default_po_11 :
  forall (ni_0: int32),
  forall (nk: int32),
  forall (dt: double),
  forall (v: double),
  forall (l: double),
  forall (doubleP_double_xM_18_alloc_table: (alloc_table doubleP)),
  forall (double_xP_result_7_alloc_table: (alloc_table double_xP)),
  forall (double_xP_double_xM_result_7: (memory double_xP (pointer doubleP))),
  forall (doubleP_doubleM_double_xM_18: (memory doubleP double)),
  forall (HW_1: ( (integer_of_int32 ni_0) >= 2 /\
                 (integer_of_int32 nk) >= 2 /\
                 ~(eq (double_value l) (0)%R) /\
                 (Rgt (double_value dt) (0)%R) /\
                 (Rgt (double_exact dt) (0)%R) /\
                 (eq (double_exact v) c) /\
                 (eq (double_exact v) (double_value v)) /\
                
                (Rle
                 (1 / 10715086071862673209484250490600018105614048117055336074437503883703510511249361224931983788156958581275946729175531468251871452856923140435984577574698574803934567774824230985421074605062371141877954182153046474983581941267398767559165543946077062914571196477686542167660429831652624386837205668069376)%R
                 (double_exact dt)) /\
                 (integer_of_int32 ni_0) <= 2147483646 /\
                 (integer_of_int32 nk) <= 7598581 /\
                
                (Rle (Rmult (IZR (integer_of_int32 nk)) (double_exact dt))
                 T_max) /\
                
                (Rle
                 (Rdiv
                  (Rabs (Rminus (double_exact dt) (double_value dt))) (
                  double_value dt))
                 (1 / 2251799813685248)%R) /\
                
                (Rle
                 (1 / 3273390607896141870013189696827599152216642046043064789483291368096133796404674554883270092325904157150886684127560071009217256545885393053328527589376)%R
                 (Rmult
                  (Rmult (double_exact dt) (IZR (integer_of_int32 ni_0))) c)) /\
                
                (Rle
                 (Rmult
                  (Rmult (double_exact dt) (IZR (integer_of_int32 ni_0))) c)
                 (Rminus (1)%R (1 / 1125899906842624)%R)) /\
                
                (Rlt
                 (sqrt
                  (Rplus
                   (Rdiv
                    (1)%R (IZR
                           ((integer_of_int32 ni_0) *
                           (integer_of_int32 ni_0)))) (Rmult
                                                       (double_exact dt) (
                                                       double_exact dt))))
                 alpha_conv))),
  forall (result: double),
  forall (HW_10: (eq (double_value result) (1)%R) /\
                 (eq (double_exact result) (1)%R) /\
                 (eq (double_model result) (1)%R)),
  forall (result0: double),
  forall (HW_11: (double_of_real_post
                  nearest_even (IZR (integer_of_int32 ni_0)) result0)),
  forall (result1: double),
  forall (HW_12: ~(eq (double_value result0) (0)%R) /\
                 (div_double_post nearest_even result result0 result1)),
  forall (dx_8: double),
  forall (HW_13: dx_8 = result1),
  forall (HW_14:
                 ( (Rgt (double_value dx_8) (0)%R) /\
                  (Rle (double_value dx_8) (05 / 10)%R) /\
                 
                 (Rle
                  (Rdiv
                   (Rabs (Rminus (double_exact dx_8) (double_value dx_8))) (
                   double_value dx_8))
                  (1 / 9007199254740992)%R))),
  forall (result2: double),
  forall (HW_15: ~(eq (double_value dx_8) (0)%R) /\
                 (div_double_post nearest_even dt dx_8 result2)),
  forall (result3: double),
  forall (HW_16: (mul_double_post nearest_even result2 v result3)),
  forall (a1: double),
  forall (HW_17: a1 = result3),
  forall (result4: double),
  forall (HW_18: (mul_double_post nearest_even a1 a1 result4)),
  forall (a_1: double),
  forall (HW_19: a_1 = result4),
  forall (HW_20: ( (Rle (0)%R (double_value a_1)) /\
                  (Rle (double_value a_1) (1)%R) /\
                  (Rlt (0)%R (double_exact a_1)) /\
                  (Rle (double_exact a_1) (1)%R) /\
                 
                 (Rle (double_round_error a_1) (1 / 562949953421312)%R))),
  forall (result5: int32),
  forall (HW_21: (integer_of_int32 result5) = ((integer_of_int32 ni_0) + 1)),
  forall (result6: int32),
  forall (HW_22: (integer_of_int32 result6) = ((integer_of_int32 nk) + 1)),
  forall (result7: (pointer double_xP)),
  forall (HW_23:
                 (
                  (offset_min double_xP_result_7_alloc_table result7) <= 0 /\
                 
                 (offset_max double_xP_result_7_alloc_table result7) >=
                 ((integer_of_int32 result5) - 1) /\
                 
                 (forall (i_4:Z),
                  (0 <= i_4 /\ i_4 < (integer_of_int32 result5) ->
                   (offset_min
                    doubleP_double_xM_18_alloc_table (select
                                                      double_xP_double_xM_result_7 (
                                                      shift result7 i_4))) <=
                   0 /\
                   (offset_max
                    doubleP_double_xM_18_alloc_table (select
                                                      double_xP_double_xM_result_7 (
                                                      shift result7 i_4))) >=
                   ((integer_of_int32 result6) - 1))) /\
                 
                 (separated_matrix
                  result7 (integer_of_int32 result5) double_xP_double_xM_result_7))),
  forall (p_6: (pointer double_xP)),
  forall (HW_24: p_6 = result7),
  forall (result8: double),
  forall (HW_25: (eq (double_value result8) (0)%R) /\
                 (eq (double_exact result8) (0)%R) /\
                 (eq (double_model result8) (0)%R)),
  forall (result9: (pointer doubleP)),
  forall (HW_26: result9 =
                 (select double_xP_double_xM_result_7 (shift p_6 0))),
  forall (doubleP_doubleM_double_xM_18_0: (memory doubleP double)),
  forall (HW_27: doubleP_doubleM_double_xM_18_0 =
                 (store doubleP_doubleM_double_xM_18 result9 result8)),
  forall (result10: int32),
  forall (HW_28: (integer_of_int32 result10) = 1),
  forall (i_6: int32),
  forall (HW_29: i_6 = result10),
  
  
  (analytic_error
   p_6 (integer_of_int32 ni_0) ((integer_of_int32 i_6) - 1) 0 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_0).

Lemma forward_prop_ensures_default_po_14 :
  forall (ni_0: int32),
  forall (nk: int32),
  forall (dt: double),
  forall (v: double),
  forall (l: double),
  forall (doubleP_double_xM_18_alloc_table: (alloc_table doubleP)),
  forall (double_xP_result_7_alloc_table: (alloc_table double_xP)),
  forall (double_xP_double_xM_result_7: (memory double_xP (pointer doubleP))),
  forall (doubleP_doubleM_double_xM_18: (memory doubleP double)),
  forall (HW_1: ( (integer_of_int32 ni_0) >= 2 /\
                 (integer_of_int32 nk) >= 2 /\
                 ~(eq (double_value l) (0)%R) /\
                 (Rgt (double_value dt) (0)%R) /\
                 (Rgt (double_exact dt) (0)%R) /\
                 (eq (double_exact v) c) /\
                 (eq (double_exact v) (double_value v)) /\
                
                (Rle
                 (1 / 10715086071862673209484250490600018105614048117055336074437503883703510511249361224931983788156958581275946729175531468251871452856923140435984577574698574803934567774824230985421074605062371141877954182153046474983581941267398767559165543946077062914571196477686542167660429831652624386837205668069376)%R
                 (double_exact dt)) /\
                 (integer_of_int32 ni_0) <= 2147483646 /\
                 (integer_of_int32 nk) <= 7598581 /\
                
                (Rle (Rmult (IZR (integer_of_int32 nk)) (double_exact dt))
                 T_max) /\
                
                (Rle
                 (Rdiv
                  (Rabs (Rminus (double_exact dt) (double_value dt))) (
                  double_value dt))
                 (1 / 2251799813685248)%R) /\
                
                (Rle
                 (1 / 3273390607896141870013189696827599152216642046043064789483291368096133796404674554883270092325904157150886684127560071009217256545885393053328527589376)%R
                 (Rmult
                  (Rmult (double_exact dt) (IZR (integer_of_int32 ni_0))) c)) /\
                
                (Rle
                 (Rmult
                  (Rmult (double_exact dt) (IZR (integer_of_int32 ni_0))) c)
                 (Rminus (1)%R (1 / 1125899906842624)%R)) /\
                
                (Rlt
                 (sqrt
                  (Rplus
                   (Rdiv
                    (1)%R (IZR
                           ((integer_of_int32 ni_0) *
                           (integer_of_int32 ni_0)))) (Rmult
                                                       (double_exact dt) (
                                                       double_exact dt))))
                 alpha_conv))),
  forall (result: double),
  forall (HW_10: (eq (double_value result) (1)%R) /\
                 (eq (double_exact result) (1)%R) /\
                 (eq (double_model result) (1)%R)),
  forall (result0: double),
  forall (HW_11: (double_of_real_post
                  nearest_even (IZR (integer_of_int32 ni_0)) result0)),
  forall (result1: double),
  forall (HW_12: ~(eq (double_value result0) (0)%R) /\
                 (div_double_post nearest_even result result0 result1)),
  forall (dx_8: double),
  forall (HW_13: dx_8 = result1),
  forall (HW_14:
                 ( (Rgt (double_value dx_8) (0)%R) /\
                  (Rle (double_value dx_8) (05 / 10)%R) /\
                 
                 (Rle
                  (Rdiv
                   (Rabs (Rminus (double_exact dx_8) (double_value dx_8))) (
                   double_value dx_8))
                  (1 / 9007199254740992)%R))),
  forall (result2: double),
  forall (HW_15: ~(eq (double_value dx_8) (0)%R) /\
                 (div_double_post nearest_even dt dx_8 result2)),
  forall (result3: double),
  forall (HW_16: (mul_double_post nearest_even result2 v result3)),
  forall (a1: double),
  forall (HW_17: a1 = result3),
  forall (result4: double),
  forall (HW_18: (mul_double_post nearest_even a1 a1 result4)),
  forall (a_1: double),
  forall (HW_19: a_1 = result4),
  forall (HW_20: ( (Rle (0)%R (double_value a_1)) /\
                  (Rle (double_value a_1) (1)%R) /\
                  (Rlt (0)%R (double_exact a_1)) /\
                  (Rle (double_exact a_1) (1)%R) /\
                 
                 (Rle (double_round_error a_1) (1 / 562949953421312)%R))),
  forall (result5: int32),
  forall (HW_21: (integer_of_int32 result5) = ((integer_of_int32 ni_0) + 1)),
  forall (result6: int32),
  forall (HW_22: (integer_of_int32 result6) = ((integer_of_int32 nk) + 1)),
  forall (result7: (pointer double_xP)),
  forall (HW_23:
                 (
                  (offset_min double_xP_result_7_alloc_table result7) <= 0 /\
                 
                 (offset_max double_xP_result_7_alloc_table result7) >=
                 ((integer_of_int32 result5) - 1) /\
                 
                 (forall (i_4:Z),
                  (0 <= i_4 /\ i_4 < (integer_of_int32 result5) ->
                   (offset_min
                    doubleP_double_xM_18_alloc_table (select
                                                      double_xP_double_xM_result_7 (
                                                      shift result7 i_4))) <=
                   0 /\
                   (offset_max
                    doubleP_double_xM_18_alloc_table (select
                                                      double_xP_double_xM_result_7 (
                                                      shift result7 i_4))) >=
                   ((integer_of_int32 result6) - 1))) /\
                 
                 (separated_matrix
                  result7 (integer_of_int32 result5) double_xP_double_xM_result_7))),
  forall (p_6: (pointer double_xP)),
  forall (HW_24: p_6 = result7),
  forall (result8: double),
  forall (HW_25: (eq (double_value result8) (0)%R) /\
                 (eq (double_exact result8) (0)%R) /\
                 (eq (double_model result8) (0)%R)),
  forall (result9: (pointer doubleP)),
  forall (HW_26: result9 =
                 (select double_xP_double_xM_result_7 (shift p_6 0))),
  forall (doubleP_doubleM_double_xM_18_0: (memory doubleP double)),
  forall (HW_27: doubleP_doubleM_double_xM_18_0 =
                 (store doubleP_doubleM_double_xM_18 result9 result8)),
  forall (result10: int32),
  forall (HW_28: (integer_of_int32 result10) = 1),
  forall (i_6: int32),
  forall (HW_29: i_6 = result10),
  forall (doubleP_doubleM_double_xM_18_1: (memory doubleP double)),
  forall (i_6_0: int32),
  forall (HW_30: ( 1 <= (integer_of_int32 i_6_0) /\
                  (integer_of_int32 i_6_0) <=
                 (integer_of_int32 ni_0) /\
                 
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) ((integer_of_int32 i_6_0) - 1) 0 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_1))),
  forall (HW_32: (integer_of_int32 i_6_0) < (integer_of_int32 ni_0)),
  forall (result11: double),
  forall (HW_33: (double_of_real_post
                  nearest_even (IZR (integer_of_int32 i_6_0)) result11)),
  forall (result12: double),
  forall (HW_34: (mul_double_post nearest_even result11 dx_8 result12)),
  forall (result13: double),
  forall (HW_35:
                 (
                  (Rle (double_round_error result13)
                   (Rmult (14)%R (1 / 4503599627370496)%R)) /\
                 
                 (eq (double_exact result13) (p0 (double_exact result12))))),
  forall (result14: (pointer doubleP)),
  forall (HW_36: result14 =
                 (select
                  double_xP_double_xM_result_7 (shift
                                                p_6 (integer_of_int32 i_6_0)))),
  forall (doubleP_doubleM_double_xM_18_2: (memory doubleP double)),
  forall (HW_37: doubleP_doubleM_double_xM_18_2 =
                 (store doubleP_doubleM_double_xM_18_1 result14 result13)),
  forall (result15: int32),
  forall (HW_38: (integer_of_int32 result15) = ((integer_of_int32 i_6_0) + 1)),
  forall (i_6_1: int32),
  forall (HW_39: i_6_1 = result15),
  
  
  (analytic_error
   p_6 (integer_of_int32 ni_0) ((integer_of_int32 i_6_1) - 1) 0 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_2).

Lemma forward_prop_ensures_default_po_15 :
  forall (ni_0: int32),
  forall (nk: int32),
  forall (dt: double),
  forall (v: double),
  forall (l: double),
  forall (doubleP_double_xM_18_alloc_table: (alloc_table doubleP)),
  forall (double_xP_result_7_alloc_table: (alloc_table double_xP)),
  forall (double_xP_double_xM_result_7: (memory double_xP (pointer doubleP))),
  forall (doubleP_doubleM_double_xM_18: (memory doubleP double)),
  forall (HW_1: ( (integer_of_int32 ni_0) >= 2 /\
                 (integer_of_int32 nk) >= 2 /\
                 ~(eq (double_value l) (0)%R) /\
                 (Rgt (double_value dt) (0)%R) /\
                 (Rgt (double_exact dt) (0)%R) /\
                 (eq (double_exact v) c) /\
                 (eq (double_exact v) (double_value v)) /\
                
                (Rle
                 (1 / 10715086071862673209484250490600018105614048117055336074437503883703510511249361224931983788156958581275946729175531468251871452856923140435984577574698574803934567774824230985421074605062371141877954182153046474983581941267398767559165543946077062914571196477686542167660429831652624386837205668069376)%R
                 (double_exact dt)) /\
                 (integer_of_int32 ni_0) <= 2147483646 /\
                 (integer_of_int32 nk) <= 7598581 /\
                
                (Rle (Rmult (IZR (integer_of_int32 nk)) (double_exact dt))
                 T_max) /\
                
                (Rle
                 (Rdiv
                  (Rabs (Rminus (double_exact dt) (double_value dt))) (
                  double_value dt))
                 (1 / 2251799813685248)%R) /\
                
                (Rle
                 (1 / 3273390607896141870013189696827599152216642046043064789483291368096133796404674554883270092325904157150886684127560071009217256545885393053328527589376)%R
                 (Rmult
                  (Rmult (double_exact dt) (IZR (integer_of_int32 ni_0))) c)) /\
                
                (Rle
                 (Rmult
                  (Rmult (double_exact dt) (IZR (integer_of_int32 ni_0))) c)
                 (Rminus (1)%R (1 / 1125899906842624)%R)) /\
                
                (Rlt
                 (sqrt
                  (Rplus
                   (Rdiv
                    (1)%R (IZR
                           ((integer_of_int32 ni_0) *
                           (integer_of_int32 ni_0)))) (Rmult
                                                       (double_exact dt) (
                                                       double_exact dt))))
                 alpha_conv))),
  forall (result: double),
  forall (HW_10: (eq (double_value result) (1)%R) /\
                 (eq (double_exact result) (1)%R) /\
                 (eq (double_model result) (1)%R)),
  forall (result0: double),
  forall (HW_11: (double_of_real_post
                  nearest_even (IZR (integer_of_int32 ni_0)) result0)),
  forall (result1: double),
  forall (HW_12: ~(eq (double_value result0) (0)%R) /\
                 (div_double_post nearest_even result result0 result1)),
  forall (dx_8: double),
  forall (HW_13: dx_8 = result1),
  forall (HW_14:
                 ( (Rgt (double_value dx_8) (0)%R) /\
                  (Rle (double_value dx_8) (05 / 10)%R) /\
                 
                 (Rle
                  (Rdiv
                   (Rabs (Rminus (double_exact dx_8) (double_value dx_8))) (
                   double_value dx_8))
                  (1 / 9007199254740992)%R))),
  forall (result2: double),
  forall (HW_15: ~(eq (double_value dx_8) (0)%R) /\
                 (div_double_post nearest_even dt dx_8 result2)),
  forall (result3: double),
  forall (HW_16: (mul_double_post nearest_even result2 v result3)),
  forall (a1: double),
  forall (HW_17: a1 = result3),
  forall (result4: double),
  forall (HW_18: (mul_double_post nearest_even a1 a1 result4)),
  forall (a_1: double),
  forall (HW_19: a_1 = result4),
  forall (HW_20: ( (Rle (0)%R (double_value a_1)) /\
                  (Rle (double_value a_1) (1)%R) /\
                  (Rlt (0)%R (double_exact a_1)) /\
                  (Rle (double_exact a_1) (1)%R) /\
                 
                 (Rle (double_round_error a_1) (1 / 562949953421312)%R))),
  forall (result5: int32),
  forall (HW_21: (integer_of_int32 result5) = ((integer_of_int32 ni_0) + 1)),
  forall (result6: int32),
  forall (HW_22: (integer_of_int32 result6) = ((integer_of_int32 nk) + 1)),
  forall (result7: (pointer double_xP)),
  forall (HW_23:
                 (
                  (offset_min double_xP_result_7_alloc_table result7) <= 0 /\
                 
                 (offset_max double_xP_result_7_alloc_table result7) >=
                 ((integer_of_int32 result5) - 1) /\
                 
                 (forall (i_4:Z),
                  (0 <= i_4 /\ i_4 < (integer_of_int32 result5) ->
                   (offset_min
                    doubleP_double_xM_18_alloc_table (select
                                                      double_xP_double_xM_result_7 (
                                                      shift result7 i_4))) <=
                   0 /\
                   (offset_max
                    doubleP_double_xM_18_alloc_table (select
                                                      double_xP_double_xM_result_7 (
                                                      shift result7 i_4))) >=
                   ((integer_of_int32 result6) - 1))) /\
                 
                 (separated_matrix
                  result7 (integer_of_int32 result5) double_xP_double_xM_result_7))),
  forall (p_6: (pointer double_xP)),
  forall (HW_24: p_6 = result7),
  forall (result8: double),
  forall (HW_25: (eq (double_value result8) (0)%R) /\
                 (eq (double_exact result8) (0)%R) /\
                 (eq (double_model result8) (0)%R)),
  forall (result9: (pointer doubleP)),
  forall (HW_26: result9 =
                 (select double_xP_double_xM_result_7 (shift p_6 0))),
  forall (doubleP_doubleM_double_xM_18_0: (memory doubleP double)),
  forall (HW_27: doubleP_doubleM_double_xM_18_0 =
                 (store doubleP_doubleM_double_xM_18 result9 result8)),
  forall (result10: int32),
  forall (HW_28: (integer_of_int32 result10) = 1),
  forall (i_6: int32),
  forall (HW_29: i_6 = result10),
  forall (doubleP_doubleM_double_xM_18_1: (memory doubleP double)),
  forall (i_6_0: int32),
  forall (HW_30: ( 1 <= (integer_of_int32 i_6_0) /\
                  (integer_of_int32 i_6_0) <=
                 (integer_of_int32 ni_0) /\
                 
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) ((integer_of_int32 i_6_0) - 1) 0 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_1))),
  forall (HW_40: (integer_of_int32 i_6_0) >= (integer_of_int32 ni_0)),
  forall (result11: double),
  forall (HW_41: (eq (double_value result11) (0)%R) /\
                 (eq (double_exact result11) (0)%R) /\
                 (eq (double_model result11) (0)%R)),
  forall (result12: (pointer doubleP)),
  forall (HW_42: result12 =
                 (select
                  double_xP_double_xM_result_7 (shift
                                                p_6 (integer_of_int32 ni_0)))),
  forall (doubleP_doubleM_double_xM_18_2: (memory doubleP double)),
  forall (HW_43: doubleP_doubleM_double_xM_18_2 =
                 (store doubleP_doubleM_double_xM_18_1 result12 result11)),
  
  (analytic_error
   p_6 (integer_of_int32 ni_0) (integer_of_int32 ni_0) 0 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_2).

Lemma forward_prop_ensures_default_po_18 :
  forall (ni_0: int32),
  forall (nk: int32),
  forall (dt: double),
  forall (v: double),
  forall (l: double),
  forall (doubleP_double_xM_18_alloc_table: (alloc_table doubleP)),
  forall (double_xP_result_7_alloc_table: (alloc_table double_xP)),
  forall (double_xP_double_xM_result_7: (memory double_xP (pointer doubleP))),
  forall (doubleP_doubleM_double_xM_18: (memory doubleP double)),
  forall (HW_1: ( (integer_of_int32 ni_0) >= 2 /\
                 (integer_of_int32 nk) >= 2 /\
                 ~(eq (double_value l) (0)%R) /\
                 (Rgt (double_value dt) (0)%R) /\
                 (Rgt (double_exact dt) (0)%R) /\
                 (eq (double_exact v) c) /\
                 (eq (double_exact v) (double_value v)) /\
                
                (Rle
                 (1 / 10715086071862673209484250490600018105614048117055336074437503883703510511249361224931983788156958581275946729175531468251871452856923140435984577574698574803934567774824230985421074605062371141877954182153046474983581941267398767559165543946077062914571196477686542167660429831652624386837205668069376)%R
                 (double_exact dt)) /\
                 (integer_of_int32 ni_0) <= 2147483646 /\
                 (integer_of_int32 nk) <= 7598581 /\
                
                (Rle (Rmult (IZR (integer_of_int32 nk)) (double_exact dt))
                 T_max) /\
                
                (Rle
                 (Rdiv
                  (Rabs (Rminus (double_exact dt) (double_value dt))) (
                  double_value dt))
                 (1 / 2251799813685248)%R) /\
                
                (Rle
                 (1 / 3273390607896141870013189696827599152216642046043064789483291368096133796404674554883270092325904157150886684127560071009217256545885393053328527589376)%R
                 (Rmult
                  (Rmult (double_exact dt) (IZR (integer_of_int32 ni_0))) c)) /\
                
                (Rle
                 (Rmult
                  (Rmult (double_exact dt) (IZR (integer_of_int32 ni_0))) c)
                 (Rminus (1)%R (1 / 1125899906842624)%R)) /\
                
                (Rlt
                 (sqrt
                  (Rplus
                   (Rdiv
                    (1)%R (IZR
                           ((integer_of_int32 ni_0) *
                           (integer_of_int32 ni_0)))) (Rmult
                                                       (double_exact dt) (
                                                       double_exact dt))))
                 alpha_conv))),
  forall (result: double),
  forall (HW_10: (eq (double_value result) (1)%R) /\
                 (eq (double_exact result) (1)%R) /\
                 (eq (double_model result) (1)%R)),
  forall (result0: double),
  forall (HW_11: (double_of_real_post
                  nearest_even (IZR (integer_of_int32 ni_0)) result0)),
  forall (result1: double),
  forall (HW_12: ~(eq (double_value result0) (0)%R) /\
                 (div_double_post nearest_even result result0 result1)),
  forall (dx_8: double),
  forall (HW_13: dx_8 = result1),
  forall (HW_14:
                 ( (Rgt (double_value dx_8) (0)%R) /\
                  (Rle (double_value dx_8) (05 / 10)%R) /\
                 
                 (Rle
                  (Rdiv
                   (Rabs (Rminus (double_exact dx_8) (double_value dx_8))) (
                   double_value dx_8))
                  (1 / 9007199254740992)%R))),
  forall (result2: double),
  forall (HW_15: ~(eq (double_value dx_8) (0)%R) /\
                 (div_double_post nearest_even dt dx_8 result2)),
  forall (result3: double),
  forall (HW_16: (mul_double_post nearest_even result2 v result3)),
  forall (a1: double),
  forall (HW_17: a1 = result3),
  forall (result4: double),
  forall (HW_18: (mul_double_post nearest_even a1 a1 result4)),
  forall (a_1: double),
  forall (HW_19: a_1 = result4),
  forall (HW_20: ( (Rle (0)%R (double_value a_1)) /\
                  (Rle (double_value a_1) (1)%R) /\
                  (Rlt (0)%R (double_exact a_1)) /\
                  (Rle (double_exact a_1) (1)%R) /\
                 
                 (Rle (double_round_error a_1) (1 / 562949953421312)%R))),
  forall (result5: int32),
  forall (HW_21: (integer_of_int32 result5) = ((integer_of_int32 ni_0) + 1)),
  forall (result6: int32),
  forall (HW_22: (integer_of_int32 result6) = ((integer_of_int32 nk) + 1)),
  forall (result7: (pointer double_xP)),
  forall (HW_23:
                 (
                  (offset_min double_xP_result_7_alloc_table result7) <= 0 /\
                 
                 (offset_max double_xP_result_7_alloc_table result7) >=
                 ((integer_of_int32 result5) - 1) /\
                 
                 (forall (i_4:Z),
                  (0 <= i_4 /\ i_4 < (integer_of_int32 result5) ->
                   (offset_min
                    doubleP_double_xM_18_alloc_table (select
                                                      double_xP_double_xM_result_7 (
                                                      shift result7 i_4))) <=
                   0 /\
                   (offset_max
                    doubleP_double_xM_18_alloc_table (select
                                                      double_xP_double_xM_result_7 (
                                                      shift result7 i_4))) >=
                   ((integer_of_int32 result6) - 1))) /\
                 
                 (separated_matrix
                  result7 (integer_of_int32 result5) double_xP_double_xM_result_7))),
  forall (p_6: (pointer double_xP)),
  forall (HW_24: p_6 = result7),
  forall (result8: double),
  forall (HW_25: (eq (double_value result8) (0)%R) /\
                 (eq (double_exact result8) (0)%R) /\
                 (eq (double_model result8) (0)%R)),
  forall (result9: (pointer doubleP)),
  forall (HW_26: result9 =
                 (select double_xP_double_xM_result_7 (shift p_6 0))),
  forall (doubleP_doubleM_double_xM_18_0: (memory doubleP double)),
  forall (HW_27: doubleP_doubleM_double_xM_18_0 =
                 (store doubleP_doubleM_double_xM_18 result9 result8)),
  forall (result10: int32),
  forall (HW_28: (integer_of_int32 result10) = 1),
  forall (i_6: int32),
  forall (HW_29: i_6 = result10),
  forall (doubleP_doubleM_double_xM_18_1: (memory doubleP double)),
  forall (i_6_0: int32),
  forall (HW_30: ( 1 <= (integer_of_int32 i_6_0) /\
                  (integer_of_int32 i_6_0) <=
                 (integer_of_int32 ni_0) /\
                 
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) ((integer_of_int32 i_6_0) - 1) 0 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_1))),
  forall (HW_40: (integer_of_int32 i_6_0) >= (integer_of_int32 ni_0)),
  forall (result11: double),
  forall (HW_41: (eq (double_value result11) (0)%R) /\
                 (eq (double_exact result11) (0)%R) /\
                 (eq (double_model result11) (0)%R)),
  forall (result12: (pointer doubleP)),
  forall (HW_42: result12 =
                 (select
                  double_xP_double_xM_result_7 (shift
                                                p_6 (integer_of_int32 ni_0)))),
  forall (doubleP_doubleM_double_xM_18_2: (memory doubleP double)),
  forall (HW_43: doubleP_doubleM_double_xM_18_2 =
                 (store doubleP_doubleM_double_xM_18_1 result12 result11)),
  forall (HW_44:
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) (integer_of_int32 ni_0) 0 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_2)),
  forall (result13: double),
  forall (HW_45: (eq (double_value result13) (0)%R) /\
                 (eq (double_exact result13) (0)%R) /\
                 (eq (double_model result13) (0)%R)),
  forall (result14: (pointer doubleP)),
  forall (HW_46: result14 =
                 (select double_xP_double_xM_result_7 (shift p_6 0))),
  forall (doubleP_doubleM_double_xM_18_3: (memory doubleP double)),
  forall (HW_47: doubleP_doubleM_double_xM_18_3 =
                 (store
                  doubleP_doubleM_double_xM_18_2 (shift result14 1) result13)),
  forall (result15: int32),
  forall (HW_48: (integer_of_int32 result15) = 1),
  forall (i_6_1: int32),
  forall (HW_49: i_6_1 = result15),
  
  
  (analytic_error
   p_6 (integer_of_int32 ni_0) ((integer_of_int32 i_6_1) - 1) 1 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_3).

Lemma forward_prop_ensures_default_po_24 :
  forall (ni_0: int32),
  forall (nk: int32),
  forall (dt: double),
  forall (v: double),
  forall (l: double),
  forall (doubleP_double_xM_18_alloc_table: (alloc_table doubleP)),
  forall (double_xP_result_7_alloc_table: (alloc_table double_xP)),
  forall (double_xP_double_xM_result_7: (memory double_xP (pointer doubleP))),
  forall (doubleP_doubleM_double_xM_18: (memory doubleP double)),
  forall (HW_1: ( (integer_of_int32 ni_0) >= 2 /\
                 (integer_of_int32 nk) >= 2 /\
                 ~(eq (double_value l) (0)%R) /\
                 (Rgt (double_value dt) (0)%R) /\
                 (Rgt (double_exact dt) (0)%R) /\
                 (eq (double_exact v) c) /\
                 (eq (double_exact v) (double_value v)) /\
                
                (Rle
                 (1 / 10715086071862673209484250490600018105614048117055336074437503883703510511249361224931983788156958581275946729175531468251871452856923140435984577574698574803934567774824230985421074605062371141877954182153046474983581941267398767559165543946077062914571196477686542167660429831652624386837205668069376)%R
                 (double_exact dt)) /\
                 (integer_of_int32 ni_0) <= 2147483646 /\
                 (integer_of_int32 nk) <= 7598581 /\
                
                (Rle (Rmult (IZR (integer_of_int32 nk)) (double_exact dt))
                 T_max) /\
                
                (Rle
                 (Rdiv
                  (Rabs (Rminus (double_exact dt) (double_value dt))) (
                  double_value dt))
                 (1 / 2251799813685248)%R) /\
                
                (Rle
                 (1 / 3273390607896141870013189696827599152216642046043064789483291368096133796404674554883270092325904157150886684127560071009217256545885393053328527589376)%R
                 (Rmult
                  (Rmult (double_exact dt) (IZR (integer_of_int32 ni_0))) c)) /\
                
                (Rle
                 (Rmult
                  (Rmult (double_exact dt) (IZR (integer_of_int32 ni_0))) c)
                 (Rminus (1)%R (1 / 1125899906842624)%R)) /\
                
                (Rlt
                 (sqrt
                  (Rplus
                   (Rdiv
                    (1)%R (IZR
                           ((integer_of_int32 ni_0) *
                           (integer_of_int32 ni_0)))) (Rmult
                                                       (double_exact dt) (
                                                       double_exact dt))))
                 alpha_conv))),
  forall (result: double),
  forall (HW_10: (eq (double_value result) (1)%R) /\
                 (eq (double_exact result) (1)%R) /\
                 (eq (double_model result) (1)%R)),
  forall (result0: double),
  forall (HW_11: (double_of_real_post
                  nearest_even (IZR (integer_of_int32 ni_0)) result0)),
  forall (result1: double),
  forall (HW_12: ~(eq (double_value result0) (0)%R) /\
                 (div_double_post nearest_even result result0 result1)),
  forall (dx_8: double),
  forall (HW_13: dx_8 = result1),
  forall (HW_14:
                 ( (Rgt (double_value dx_8) (0)%R) /\
                  (Rle (double_value dx_8) (05 / 10)%R) /\
                 
                 (Rle
                  (Rdiv
                   (Rabs (Rminus (double_exact dx_8) (double_value dx_8))) (
                   double_value dx_8))
                  (1 / 9007199254740992)%R))),
  forall (result2: double),
  forall (HW_15: ~(eq (double_value dx_8) (0)%R) /\
                 (div_double_post nearest_even dt dx_8 result2)),
  forall (result3: double),
  forall (HW_16: (mul_double_post nearest_even result2 v result3)),
  forall (a1: double),
  forall (HW_17: a1 = result3),
  forall (result4: double),
  forall (HW_18: (mul_double_post nearest_even a1 a1 result4)),
  forall (a_1: double),
  forall (HW_19: a_1 = result4),
  forall (HW_20: ( (Rle (0)%R (double_value a_1)) /\
                  (Rle (double_value a_1) (1)%R) /\
                  (Rlt (0)%R (double_exact a_1)) /\
                  (Rle (double_exact a_1) (1)%R) /\
                 
                 (Rle (double_round_error a_1) (1 / 562949953421312)%R))),
  forall (result5: int32),
  forall (HW_21: (integer_of_int32 result5) = ((integer_of_int32 ni_0) + 1)),
  forall (result6: int32),
  forall (HW_22: (integer_of_int32 result6) = ((integer_of_int32 nk) + 1)),
  forall (result7: (pointer double_xP)),
  forall (HW_23:
                 (
                  (offset_min double_xP_result_7_alloc_table result7) <= 0 /\
                 
                 (offset_max double_xP_result_7_alloc_table result7) >=
                 ((integer_of_int32 result5) - 1) /\
                 
                 (forall (i_4:Z),
                  (0 <= i_4 /\ i_4 < (integer_of_int32 result5) ->
                   (offset_min
                    doubleP_double_xM_18_alloc_table (select
                                                      double_xP_double_xM_result_7 (
                                                      shift result7 i_4))) <=
                   0 /\
                   (offset_max
                    doubleP_double_xM_18_alloc_table (select
                                                      double_xP_double_xM_result_7 (
                                                      shift result7 i_4))) >=
                   ((integer_of_int32 result6) - 1))) /\
                 
                 (separated_matrix
                  result7 (integer_of_int32 result5) double_xP_double_xM_result_7))),
  forall (p_6: (pointer double_xP)),
  forall (HW_24: p_6 = result7),
  forall (result8: double),
  forall (HW_25: (eq (double_value result8) (0)%R) /\
                 (eq (double_exact result8) (0)%R) /\
                 (eq (double_model result8) (0)%R)),
  forall (result9: (pointer doubleP)),
  forall (HW_26: result9 =
                 (select double_xP_double_xM_result_7 (shift p_6 0))),
  forall (doubleP_doubleM_double_xM_18_0: (memory doubleP double)),
  forall (HW_27: doubleP_doubleM_double_xM_18_0 =
                 (store doubleP_doubleM_double_xM_18 result9 result8)),
  forall (result10: int32),
  forall (HW_28: (integer_of_int32 result10) = 1),
  forall (i_6: int32),
  forall (HW_29: i_6 = result10),
  forall (doubleP_doubleM_double_xM_18_1: (memory doubleP double)),
  forall (i_6_0: int32),
  forall (HW_30: ( 1 <= (integer_of_int32 i_6_0) /\
                  (integer_of_int32 i_6_0) <=
                 (integer_of_int32 ni_0) /\
                 
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) ((integer_of_int32 i_6_0) - 1) 0 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_1))),
  forall (HW_40: (integer_of_int32 i_6_0) >= (integer_of_int32 ni_0)),
  forall (result11: double),
  forall (HW_41: (eq (double_value result11) (0)%R) /\
                 (eq (double_exact result11) (0)%R) /\
                 (eq (double_model result11) (0)%R)),
  forall (result12: (pointer doubleP)),
  forall (HW_42: result12 =
                 (select
                  double_xP_double_xM_result_7 (shift
                                                p_6 (integer_of_int32 ni_0)))),
  forall (doubleP_doubleM_double_xM_18_2: (memory doubleP double)),
  forall (HW_43: doubleP_doubleM_double_xM_18_2 =
                 (store doubleP_doubleM_double_xM_18_1 result12 result11)),
  forall (HW_44:
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) (integer_of_int32 ni_0) 0 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_2)),
  forall (result13: double),
  forall (HW_45: (eq (double_value result13) (0)%R) /\
                 (eq (double_exact result13) (0)%R) /\
                 (eq (double_model result13) (0)%R)),
  forall (result14: (pointer doubleP)),
  forall (HW_46: result14 =
                 (select double_xP_double_xM_result_7 (shift p_6 0))),
  forall (doubleP_doubleM_double_xM_18_3: (memory doubleP double)),
  forall (HW_47: doubleP_doubleM_double_xM_18_3 =
                 (store
                  doubleP_doubleM_double_xM_18_2 (shift result14 1) result13)),
  forall (result15: int32),
  forall (HW_48: (integer_of_int32 result15) = 1),
  forall (i_6_1: int32),
  forall (HW_49: i_6_1 = result15),
  forall (doubleP_doubleM_double_xM_18_4: (memory doubleP double)),
  forall (i_6_2: int32),
  forall (HW_50: ( 1 <= (integer_of_int32 i_6_2) /\
                  (integer_of_int32 i_6_2) <=
                 (integer_of_int32 ni_0) /\
                 
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) ((integer_of_int32 i_6_2) - 1) 1 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_4))),
  forall (HW_52: (integer_of_int32 i_6_2) < (integer_of_int32 ni_0)),
  forall (HW_53:
                 (Rle
                  (Rabs
                   (double_value
                    (select
                     doubleP_doubleM_double_xM_18_4 (shift
                                                     (select
                                                      double_xP_double_xM_result_7 (
                                                      shift
                                                      p_6 ((integer_of_int32
                                                            i_6_2) -
                                                          1))) 0))))
                  (2)%R)),
  forall (HW_54:
                 (Rle
                  (Rabs
                   (double_value
                    (select
                     doubleP_doubleM_double_xM_18_4 (shift
                                                     (select
                                                      double_xP_double_xM_result_7 (
                                                      shift
                                                      p_6 (integer_of_int32
                                                           i_6_2))) 0))))
                  (2)%R)),
  forall (HW_55:
                 (Rle
                  (Rabs
                   (double_value
                    (select
                     doubleP_doubleM_double_xM_18_4 (shift
                                                     (select
                                                      double_xP_double_xM_result_7 (
                                                      shift
                                                      p_6 ((integer_of_int32
                                                            i_6_2) +
                                                          1))) 0))))
                  (2)%R)),
  forall (result16: int32),
  forall (HW_56: (integer_of_int32 result16) = ((integer_of_int32 i_6_2) + 1)),
  forall (result17: (pointer doubleP)),
  forall (HW_57: result17 =
                 (select
                  double_xP_double_xM_result_7 (shift
                                                p_6 (integer_of_int32
                                                     result16)))),
  forall (result18: double),
  forall (HW_58: result18 =
                 (select doubleP_doubleM_double_xM_18_4 (shift result17 0))),
  forall (result19: double),
  forall (HW_59: (eq (double_value result19) (2)%R) /\
                 (eq (double_exact result19) (2)%R) /\
                 (eq (double_model result19) (2)%R)),
  forall (result20: (pointer doubleP)),
  forall (HW_60: result20 =
                 (select
                  double_xP_double_xM_result_7 (shift
                                                p_6 (integer_of_int32 i_6_2)))),
  forall (result21: double),
  forall (HW_61: result21 =
                 (select doubleP_doubleM_double_xM_18_4 (shift result20 0))),
  forall (result22: double),
  forall (HW_62: (mul_double_post nearest_even result19 result21 result22)),
  forall (result23: double),
  forall (HW_63: (sub_double_post nearest_even result18 result22 result23)),
  forall (result24: int32),
  forall (HW_64: (integer_of_int32 result24) = ((integer_of_int32 i_6_2) - 1)),
  forall (result25: (pointer doubleP)),
  forall (HW_65: result25 =
                 (select
                  double_xP_double_xM_result_7 (shift
                                                p_6 (integer_of_int32
                                                     result24)))),
  forall (result26: double),
  forall (HW_66: result26 =
                 (select doubleP_doubleM_double_xM_18_4 (shift result25 0))),
  forall (result27: double),
  forall (HW_67: (add_double_post nearest_even result23 result26 result27)),
  forall (dp: double),
  forall (HW_68: dp = result27),
  forall (result28: (pointer doubleP)),
  forall (HW_69: result28 =
                 (select
                  double_xP_double_xM_result_7 (shift
                                                p_6 (integer_of_int32 i_6_2)))),
  forall (result29: double),
  forall (HW_70: result29 =
                 (select doubleP_doubleM_double_xM_18_4 (shift result28 0))),
  forall (result30: double),
  forall (HW_71: (eq (double_value result30) (05 / 10)%R) /\
                 (eq (double_exact result30) (05 / 10)%R) /\
                 (eq (double_model result30) (05 / 10)%R)),
  forall (result31: double),
  forall (HW_72: (mul_double_post nearest_even result30 a_1 result31)),
  forall (result32: double),
  forall (HW_73: (mul_double_post nearest_even result31 dp result32)),
  forall (result33: double),
  forall (HW_74: (add_double_post nearest_even result29 result32 result33)),
  forall (result34: (pointer doubleP)),
  forall (HW_75: result34 =
                 (select
                  double_xP_double_xM_result_7 (shift
                                                p_6 (integer_of_int32 i_6_2)))),
  forall (doubleP_doubleM_double_xM_18_5: (memory doubleP double)),
  forall (HW_76: doubleP_doubleM_double_xM_18_5 =
                 (store
                  doubleP_doubleM_double_xM_18_4 (shift result34 1) result33)),
  forall (result35: int32),
  forall (HW_77: (integer_of_int32 result35) = ((integer_of_int32 i_6_2) + 1)),
  forall (i_6_3: int32),
  forall (HW_78: i_6_3 = result35),
  
  
  (analytic_error
   p_6 (integer_of_int32 ni_0) ((integer_of_int32 i_6_3) - 1) 1 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_5).

Lemma forward_prop_ensures_default_po_25 :
  forall (ni_0: int32),
  forall (nk: int32),
  forall (dt: double),
  forall (v: double),
  forall (l: double),
  forall (doubleP_double_xM_18_alloc_table: (alloc_table doubleP)),
  forall (double_xP_result_7_alloc_table: (alloc_table double_xP)),
  forall (double_xP_double_xM_result_7: (memory double_xP (pointer doubleP))),
  forall (doubleP_doubleM_double_xM_18: (memory doubleP double)),
  forall (HW_1: ( (integer_of_int32 ni_0) >= 2 /\
                 (integer_of_int32 nk) >= 2 /\
                 ~(eq (double_value l) (0)%R) /\
                 (Rgt (double_value dt) (0)%R) /\
                 (Rgt (double_exact dt) (0)%R) /\
                 (eq (double_exact v) c) /\
                 (eq (double_exact v) (double_value v)) /\
                
                (Rle
                 (1 / 10715086071862673209484250490600018105614048117055336074437503883703510511249361224931983788156958581275946729175531468251871452856923140435984577574698574803934567774824230985421074605062371141877954182153046474983581941267398767559165543946077062914571196477686542167660429831652624386837205668069376)%R
                 (double_exact dt)) /\
                 (integer_of_int32 ni_0) <= 2147483646 /\
                 (integer_of_int32 nk) <= 7598581 /\
                
                (Rle (Rmult (IZR (integer_of_int32 nk)) (double_exact dt))
                 T_max) /\
                
                (Rle
                 (Rdiv
                  (Rabs (Rminus (double_exact dt) (double_value dt))) (
                  double_value dt))
                 (1 / 2251799813685248)%R) /\
                
                (Rle
                 (1 / 3273390607896141870013189696827599152216642046043064789483291368096133796404674554883270092325904157150886684127560071009217256545885393053328527589376)%R
                 (Rmult
                  (Rmult (double_exact dt) (IZR (integer_of_int32 ni_0))) c)) /\
                
                (Rle
                 (Rmult
                  (Rmult (double_exact dt) (IZR (integer_of_int32 ni_0))) c)
                 (Rminus (1)%R (1 / 1125899906842624)%R)) /\
                
                (Rlt
                 (sqrt
                  (Rplus
                   (Rdiv
                    (1)%R (IZR
                           ((integer_of_int32 ni_0) *
                           (integer_of_int32 ni_0)))) (Rmult
                                                       (double_exact dt) (
                                                       double_exact dt))))
                 alpha_conv))),
  forall (result: double),
  forall (HW_10: (eq (double_value result) (1)%R) /\
                 (eq (double_exact result) (1)%R) /\
                 (eq (double_model result) (1)%R)),
  forall (result0: double),
  forall (HW_11: (double_of_real_post
                  nearest_even (IZR (integer_of_int32 ni_0)) result0)),
  forall (result1: double),
  forall (HW_12: ~(eq (double_value result0) (0)%R) /\
                 (div_double_post nearest_even result result0 result1)),
  forall (dx_8: double),
  forall (HW_13: dx_8 = result1),
  forall (HW_14:
                 ( (Rgt (double_value dx_8) (0)%R) /\
                  (Rle (double_value dx_8) (05 / 10)%R) /\
                 
                 (Rle
                  (Rdiv
                   (Rabs (Rminus (double_exact dx_8) (double_value dx_8))) (
                   double_value dx_8))
                  (1 / 9007199254740992)%R))),
  forall (result2: double),
  forall (HW_15: ~(eq (double_value dx_8) (0)%R) /\
                 (div_double_post nearest_even dt dx_8 result2)),
  forall (result3: double),
  forall (HW_16: (mul_double_post nearest_even result2 v result3)),
  forall (a1: double),
  forall (HW_17: a1 = result3),
  forall (result4: double),
  forall (HW_18: (mul_double_post nearest_even a1 a1 result4)),
  forall (a_1: double),
  forall (HW_19: a_1 = result4),
  forall (HW_20: ( (Rle (0)%R (double_value a_1)) /\
                  (Rle (double_value a_1) (1)%R) /\
                  (Rlt (0)%R (double_exact a_1)) /\
                  (Rle (double_exact a_1) (1)%R) /\
                 
                 (Rle (double_round_error a_1) (1 / 562949953421312)%R))),
  forall (result5: int32),
  forall (HW_21: (integer_of_int32 result5) = ((integer_of_int32 ni_0) + 1)),
  forall (result6: int32),
  forall (HW_22: (integer_of_int32 result6) = ((integer_of_int32 nk) + 1)),
  forall (result7: (pointer double_xP)),
  forall (HW_23:
                 (
                  (offset_min double_xP_result_7_alloc_table result7) <= 0 /\
                 
                 (offset_max double_xP_result_7_alloc_table result7) >=
                 ((integer_of_int32 result5) - 1) /\
                 
                 (forall (i_4:Z),
                  (0 <= i_4 /\ i_4 < (integer_of_int32 result5) ->
                   (offset_min
                    doubleP_double_xM_18_alloc_table (select
                                                      double_xP_double_xM_result_7 (
                                                      shift result7 i_4))) <=
                   0 /\
                   (offset_max
                    doubleP_double_xM_18_alloc_table (select
                                                      double_xP_double_xM_result_7 (
                                                      shift result7 i_4))) >=
                   ((integer_of_int32 result6) - 1))) /\
                 
                 (separated_matrix
                  result7 (integer_of_int32 result5) double_xP_double_xM_result_7))),
  forall (p_6: (pointer double_xP)),
  forall (HW_24: p_6 = result7),
  forall (result8: double),
  forall (HW_25: (eq (double_value result8) (0)%R) /\
                 (eq (double_exact result8) (0)%R) /\
                 (eq (double_model result8) (0)%R)),
  forall (result9: (pointer doubleP)),
  forall (HW_26: result9 =
                 (select double_xP_double_xM_result_7 (shift p_6 0))),
  forall (doubleP_doubleM_double_xM_18_0: (memory doubleP double)),
  forall (HW_27: doubleP_doubleM_double_xM_18_0 =
                 (store doubleP_doubleM_double_xM_18 result9 result8)),
  forall (result10: int32),
  forall (HW_28: (integer_of_int32 result10) = 1),
  forall (i_6: int32),
  forall (HW_29: i_6 = result10),
  forall (doubleP_doubleM_double_xM_18_1: (memory doubleP double)),
  forall (i_6_0: int32),
  forall (HW_30: ( 1 <= (integer_of_int32 i_6_0) /\
                  (integer_of_int32 i_6_0) <=
                 (integer_of_int32 ni_0) /\
                 
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) ((integer_of_int32 i_6_0) - 1) 0 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_1))),
  forall (HW_40: (integer_of_int32 i_6_0) >= (integer_of_int32 ni_0)),
  forall (result11: double),
  forall (HW_41: (eq (double_value result11) (0)%R) /\
                 (eq (double_exact result11) (0)%R) /\
                 (eq (double_model result11) (0)%R)),
  forall (result12: (pointer doubleP)),
  forall (HW_42: result12 =
                 (select
                  double_xP_double_xM_result_7 (shift
                                                p_6 (integer_of_int32 ni_0)))),
  forall (doubleP_doubleM_double_xM_18_2: (memory doubleP double)),
  forall (HW_43: doubleP_doubleM_double_xM_18_2 =
                 (store doubleP_doubleM_double_xM_18_1 result12 result11)),
  forall (HW_44:
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) (integer_of_int32 ni_0) 0 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_2)),
  forall (result13: double),
  forall (HW_45: (eq (double_value result13) (0)%R) /\
                 (eq (double_exact result13) (0)%R) /\
                 (eq (double_model result13) (0)%R)),
  forall (result14: (pointer doubleP)),
  forall (HW_46: result14 =
                 (select double_xP_double_xM_result_7 (shift p_6 0))),
  forall (doubleP_doubleM_double_xM_18_3: (memory doubleP double)),
  forall (HW_47: doubleP_doubleM_double_xM_18_3 =
                 (store
                  doubleP_doubleM_double_xM_18_2 (shift result14 1) result13)),
  forall (result15: int32),
  forall (HW_48: (integer_of_int32 result15) = 1),
  forall (i_6_1: int32),
  forall (HW_49: i_6_1 = result15),
  forall (doubleP_doubleM_double_xM_18_4: (memory doubleP double)),
  forall (i_6_2: int32),
  forall (HW_50: ( 1 <= (integer_of_int32 i_6_2) /\
                  (integer_of_int32 i_6_2) <=
                 (integer_of_int32 ni_0) /\
                 
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) ((integer_of_int32 i_6_2) - 1) 1 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_4))),
  forall (HW_79: (integer_of_int32 i_6_2) >= (integer_of_int32 ni_0)),
  forall (result16: double),
  forall (HW_80: (eq (double_value result16) (0)%R) /\
                 (eq (double_exact result16) (0)%R) /\
                 (eq (double_model result16) (0)%R)),
  forall (result17: (pointer doubleP)),
  forall (HW_81: result17 =
                 (select
                  double_xP_double_xM_result_7 (shift
                                                p_6 (integer_of_int32 ni_0)))),
  forall (doubleP_doubleM_double_xM_18_5: (memory doubleP double)),
  forall (HW_82: doubleP_doubleM_double_xM_18_5 =
                 (store
                  doubleP_doubleM_double_xM_18_4 (shift result17 1) result16)),
  
  (analytic_error
   p_6 (integer_of_int32 ni_0) (integer_of_int32 ni_0) 1 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_5).

Lemma forward_prop_ensures_default_po_31 :
  forall (ni_0: int32),
  forall (nk: int32),
  forall (dt: double),
  forall (v: double),
  forall (l: double),
  forall (doubleP_double_xM_18_alloc_table: (alloc_table doubleP)),
  forall (double_xP_result_7_alloc_table: (alloc_table double_xP)),
  forall (double_xP_double_xM_result_7: (memory double_xP (pointer doubleP))),
  forall (doubleP_doubleM_double_xM_18: (memory doubleP double)),
  forall (HW_1: ( (integer_of_int32 ni_0) >= 2 /\
                 (integer_of_int32 nk) >= 2 /\
                 ~(eq (double_value l) (0)%R) /\
                 (Rgt (double_value dt) (0)%R) /\
                 (Rgt (double_exact dt) (0)%R) /\
                 (eq (double_exact v) c) /\
                 (eq (double_exact v) (double_value v)) /\
                
                (Rle
                 (1 / 10715086071862673209484250490600018105614048117055336074437503883703510511249361224931983788156958581275946729175531468251871452856923140435984577574698574803934567774824230985421074605062371141877954182153046474983581941267398767559165543946077062914571196477686542167660429831652624386837205668069376)%R
                 (double_exact dt)) /\
                 (integer_of_int32 ni_0) <= 2147483646 /\
                 (integer_of_int32 nk) <= 7598581 /\
                
                (Rle (Rmult (IZR (integer_of_int32 nk)) (double_exact dt))
                 T_max) /\
                
                (Rle
                 (Rdiv
                  (Rabs (Rminus (double_exact dt) (double_value dt))) (
                  double_value dt))
                 (1 / 2251799813685248)%R) /\
                
                (Rle
                 (1 / 3273390607896141870013189696827599152216642046043064789483291368096133796404674554883270092325904157150886684127560071009217256545885393053328527589376)%R
                 (Rmult
                  (Rmult (double_exact dt) (IZR (integer_of_int32 ni_0))) c)) /\
                
                (Rle
                 (Rmult
                  (Rmult (double_exact dt) (IZR (integer_of_int32 ni_0))) c)
                 (Rminus (1)%R (1 / 1125899906842624)%R)) /\
                
                (Rlt
                 (sqrt
                  (Rplus
                   (Rdiv
                    (1)%R (IZR
                           ((integer_of_int32 ni_0) *
                           (integer_of_int32 ni_0)))) (Rmult
                                                       (double_exact dt) (
                                                       double_exact dt))))
                 alpha_conv))),
  forall (result: double),
  forall (HW_10: (eq (double_value result) (1)%R) /\
                 (eq (double_exact result) (1)%R) /\
                 (eq (double_model result) (1)%R)),
  forall (result0: double),
  forall (HW_11: (double_of_real_post
                  nearest_even (IZR (integer_of_int32 ni_0)) result0)),
  forall (result1: double),
  forall (HW_12: ~(eq (double_value result0) (0)%R) /\
                 (div_double_post nearest_even result result0 result1)),
  forall (dx_8: double),
  forall (HW_13: dx_8 = result1),
  forall (HW_14:
                 ( (Rgt (double_value dx_8) (0)%R) /\
                  (Rle (double_value dx_8) (05 / 10)%R) /\
                 
                 (Rle
                  (Rdiv
                   (Rabs (Rminus (double_exact dx_8) (double_value dx_8))) (
                   double_value dx_8))
                  (1 / 9007199254740992)%R))),
  forall (result2: double),
  forall (HW_15: ~(eq (double_value dx_8) (0)%R) /\
                 (div_double_post nearest_even dt dx_8 result2)),
  forall (result3: double),
  forall (HW_16: (mul_double_post nearest_even result2 v result3)),
  forall (a1: double),
  forall (HW_17: a1 = result3),
  forall (result4: double),
  forall (HW_18: (mul_double_post nearest_even a1 a1 result4)),
  forall (a_1: double),
  forall (HW_19: a_1 = result4),
  forall (HW_20: ( (Rle (0)%R (double_value a_1)) /\
                  (Rle (double_value a_1) (1)%R) /\
                  (Rlt (0)%R (double_exact a_1)) /\
                  (Rle (double_exact a_1) (1)%R) /\
                 
                 (Rle (double_round_error a_1) (1 / 562949953421312)%R))),
  forall (result5: int32),
  forall (HW_21: (integer_of_int32 result5) = ((integer_of_int32 ni_0) + 1)),
  forall (result6: int32),
  forall (HW_22: (integer_of_int32 result6) = ((integer_of_int32 nk) + 1)),
  forall (result7: (pointer double_xP)),
  forall (HW_23:
                 (
                  (offset_min double_xP_result_7_alloc_table result7) <= 0 /\
                 
                 (offset_max double_xP_result_7_alloc_table result7) >=
                 ((integer_of_int32 result5) - 1) /\
                 
                 (forall (i_4:Z),
                  (0 <= i_4 /\ i_4 < (integer_of_int32 result5) ->
                   (offset_min
                    doubleP_double_xM_18_alloc_table (select
                                                      double_xP_double_xM_result_7 (
                                                      shift result7 i_4))) <=
                   0 /\
                   (offset_max
                    doubleP_double_xM_18_alloc_table (select
                                                      double_xP_double_xM_result_7 (
                                                      shift result7 i_4))) >=
                   ((integer_of_int32 result6) - 1))) /\
                 
                 (separated_matrix
                  result7 (integer_of_int32 result5) double_xP_double_xM_result_7))),
  forall (p_6: (pointer double_xP)),
  forall (HW_24: p_6 = result7),
  forall (result8: double),
  forall (HW_25: (eq (double_value result8) (0)%R) /\
                 (eq (double_exact result8) (0)%R) /\
                 (eq (double_model result8) (0)%R)),
  forall (result9: (pointer doubleP)),
  forall (HW_26: result9 =
                 (select double_xP_double_xM_result_7 (shift p_6 0))),
  forall (doubleP_doubleM_double_xM_18_0: (memory doubleP double)),
  forall (HW_27: doubleP_doubleM_double_xM_18_0 =
                 (store doubleP_doubleM_double_xM_18 result9 result8)),
  forall (result10: int32),
  forall (HW_28: (integer_of_int32 result10) = 1),
  forall (i_6: int32),
  forall (HW_29: i_6 = result10),
  forall (doubleP_doubleM_double_xM_18_1: (memory doubleP double)),
  forall (i_6_0: int32),
  forall (HW_30: ( 1 <= (integer_of_int32 i_6_0) /\
                  (integer_of_int32 i_6_0) <=
                 (integer_of_int32 ni_0) /\
                 
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) ((integer_of_int32 i_6_0) - 1) 0 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_1))),
  forall (HW_40: (integer_of_int32 i_6_0) >= (integer_of_int32 ni_0)),
  forall (result11: double),
  forall (HW_41: (eq (double_value result11) (0)%R) /\
                 (eq (double_exact result11) (0)%R) /\
                 (eq (double_model result11) (0)%R)),
  forall (result12: (pointer doubleP)),
  forall (HW_42: result12 =
                 (select
                  double_xP_double_xM_result_7 (shift
                                                p_6 (integer_of_int32 ni_0)))),
  forall (doubleP_doubleM_double_xM_18_2: (memory doubleP double)),
  forall (HW_43: doubleP_doubleM_double_xM_18_2 =
                 (store doubleP_doubleM_double_xM_18_1 result12 result11)),
  forall (HW_44:
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) (integer_of_int32 ni_0) 0 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_2)),
  forall (result13: double),
  forall (HW_45: (eq (double_value result13) (0)%R) /\
                 (eq (double_exact result13) (0)%R) /\
                 (eq (double_model result13) (0)%R)),
  forall (result14: (pointer doubleP)),
  forall (HW_46: result14 =
                 (select double_xP_double_xM_result_7 (shift p_6 0))),
  forall (doubleP_doubleM_double_xM_18_3: (memory doubleP double)),
  forall (HW_47: doubleP_doubleM_double_xM_18_3 =
                 (store
                  doubleP_doubleM_double_xM_18_2 (shift result14 1) result13)),
  forall (result15: int32),
  forall (HW_48: (integer_of_int32 result15) = 1),
  forall (i_6_1: int32),
  forall (HW_49: i_6_1 = result15),
  forall (doubleP_doubleM_double_xM_18_4: (memory doubleP double)),
  forall (i_6_2: int32),
  forall (HW_50: ( 1 <= (integer_of_int32 i_6_2) /\
                  (integer_of_int32 i_6_2) <=
                 (integer_of_int32 ni_0) /\
                 
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) ((integer_of_int32 i_6_2) - 1) 1 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_4))),
  forall (HW_79: (integer_of_int32 i_6_2) >= (integer_of_int32 ni_0)),
  forall (result16: double),
  forall (HW_80: (eq (double_value result16) (0)%R) /\
                 (eq (double_exact result16) (0)%R) /\
                 (eq (double_model result16) (0)%R)),
  forall (result17: (pointer doubleP)),
  forall (HW_81: result17 =
                 (select
                  double_xP_double_xM_result_7 (shift
                                                p_6 (integer_of_int32 ni_0)))),
  forall (doubleP_doubleM_double_xM_18_5: (memory doubleP double)),
  forall (HW_82: doubleP_doubleM_double_xM_18_5 =
                 (store
                  doubleP_doubleM_double_xM_18_4 (shift result17 1) result16)),
  forall (HW_83:
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) (integer_of_int32 ni_0) 1 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_5)),
  forall (result18: int32),
  forall (HW_84: (integer_of_int32 result18) = 1),
  forall (k_7: int32),
  forall (HW_85: k_7 = result18),
  forall (doubleP_doubleM_double_xM_18_6: (memory doubleP double)),
  forall (k_7_0: int32),
  forall (HW_86: ( 1 <= (integer_of_int32 k_7_0) /\
                  (integer_of_int32 k_7_0) <=
                 (integer_of_int32 nk) /\
                 
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) (integer_of_int32 ni_0) (
                  integer_of_int32 k_7_0) a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_6))),
  forall (HW_88: (integer_of_int32 k_7_0) < (integer_of_int32 nk)),
  forall (result19: double),
  forall (HW_89: (eq (double_value result19) (0)%R) /\
                 (eq (double_exact result19) (0)%R) /\
                 (eq (double_model result19) (0)%R)),
  forall (result20: (pointer doubleP)),
  forall (HW_90: result20 =
                 (select double_xP_double_xM_result_7 (shift p_6 0))),
  forall (result21: int32),
  forall (HW_91: (integer_of_int32 result21) = ((integer_of_int32 k_7_0) + 1)),
  forall (doubleP_doubleM_double_xM_18_7: (memory doubleP double)),
  forall (HW_92: doubleP_doubleM_double_xM_18_7 =
                 (store
                  doubleP_doubleM_double_xM_18_6 (shift
                                                  result20 (integer_of_int32
                                                            result21)) result19)),
  forall (result22: int32),
  forall (HW_93: (integer_of_int32 result22) = 1),
  forall (i_6_3: int32),
  forall (HW_94: i_6_3 = result22),
  
  
  (analytic_error
   p_6 (integer_of_int32 ni_0) ((integer_of_int32 i_6_3) - 1) ((integer_of_int32
                                                                k_7_0) +
                                                              1) a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_7).

Lemma forward_prop_ensures_default_po_32 :
  forall (ni_0: int32),
  forall (nk: int32),
  forall (dt: double),
  forall (v: double),
  forall (l: double),
  forall (doubleP_double_xM_18_alloc_table: (alloc_table doubleP)),
  forall (double_xP_result_7_alloc_table: (alloc_table double_xP)),
  forall (double_xP_double_xM_result_7: (memory double_xP (pointer doubleP))),
  forall (doubleP_doubleM_double_xM_18: (memory doubleP double)),
  forall (HW_1: ( (integer_of_int32 ni_0) >= 2 /\
                 (integer_of_int32 nk) >= 2 /\
                 ~(eq (double_value l) (0)%R) /\
                 (Rgt (double_value dt) (0)%R) /\
                 (Rgt (double_exact dt) (0)%R) /\
                 (eq (double_exact v) c) /\
                 (eq (double_exact v) (double_value v)) /\
                
                (Rle
                 (1 / 10715086071862673209484250490600018105614048117055336074437503883703510511249361224931983788156958581275946729175531468251871452856923140435984577574698574803934567774824230985421074605062371141877954182153046474983581941267398767559165543946077062914571196477686542167660429831652624386837205668069376)%R
                 (double_exact dt)) /\
                 (integer_of_int32 ni_0) <= 2147483646 /\
                 (integer_of_int32 nk) <= 7598581 /\
                
                (Rle (Rmult (IZR (integer_of_int32 nk)) (double_exact dt))
                 T_max) /\
                
                (Rle
                 (Rdiv
                  (Rabs (Rminus (double_exact dt) (double_value dt))) (
                  double_value dt))
                 (1 / 2251799813685248)%R) /\
                
                (Rle
                 (1 / 3273390607896141870013189696827599152216642046043064789483291368096133796404674554883270092325904157150886684127560071009217256545885393053328527589376)%R
                 (Rmult
                  (Rmult (double_exact dt) (IZR (integer_of_int32 ni_0))) c)) /\
                
                (Rle
                 (Rmult
                  (Rmult (double_exact dt) (IZR (integer_of_int32 ni_0))) c)
                 (Rminus (1)%R (1 / 1125899906842624)%R)) /\
                
                (Rlt
                 (sqrt
                  (Rplus
                   (Rdiv
                    (1)%R (IZR
                           ((integer_of_int32 ni_0) *
                           (integer_of_int32 ni_0)))) (Rmult
                                                       (double_exact dt) (
                                                       double_exact dt))))
                 alpha_conv))),
  forall (result: double),
  forall (HW_10: (eq (double_value result) (1)%R) /\
                 (eq (double_exact result) (1)%R) /\
                 (eq (double_model result) (1)%R)),
  forall (result0: double),
  forall (HW_11: (double_of_real_post
                  nearest_even (IZR (integer_of_int32 ni_0)) result0)),
  forall (result1: double),
  forall (HW_12: ~(eq (double_value result0) (0)%R) /\
                 (div_double_post nearest_even result result0 result1)),
  forall (dx_8: double),
  forall (HW_13: dx_8 = result1),
  forall (HW_14:
                 ( (Rgt (double_value dx_8) (0)%R) /\
                  (Rle (double_value dx_8) (05 / 10)%R) /\
                 
                 (Rle
                  (Rdiv
                   (Rabs (Rminus (double_exact dx_8) (double_value dx_8))) (
                   double_value dx_8))
                  (1 / 9007199254740992)%R))),
  forall (result2: double),
  forall (HW_15: ~(eq (double_value dx_8) (0)%R) /\
                 (div_double_post nearest_even dt dx_8 result2)),
  forall (result3: double),
  forall (HW_16: (mul_double_post nearest_even result2 v result3)),
  forall (a1: double),
  forall (HW_17: a1 = result3),
  forall (result4: double),
  forall (HW_18: (mul_double_post nearest_even a1 a1 result4)),
  forall (a_1: double),
  forall (HW_19: a_1 = result4),
  forall (HW_20: ( (Rle (0)%R (double_value a_1)) /\
                  (Rle (double_value a_1) (1)%R) /\
                  (Rlt (0)%R (double_exact a_1)) /\
                  (Rle (double_exact a_1) (1)%R) /\
                 
                 (Rle (double_round_error a_1) (1 / 562949953421312)%R))),
  forall (result5: int32),
  forall (HW_21: (integer_of_int32 result5) = ((integer_of_int32 ni_0) + 1)),
  forall (result6: int32),
  forall (HW_22: (integer_of_int32 result6) = ((integer_of_int32 nk) + 1)),
  forall (result7: (pointer double_xP)),
  forall (HW_23:
                 (
                  (offset_min double_xP_result_7_alloc_table result7) <= 0 /\
                 
                 (offset_max double_xP_result_7_alloc_table result7) >=
                 ((integer_of_int32 result5) - 1) /\
                 
                 (forall (i_4:Z),
                  (0 <= i_4 /\ i_4 < (integer_of_int32 result5) ->
                   (offset_min
                    doubleP_double_xM_18_alloc_table (select
                                                      double_xP_double_xM_result_7 (
                                                      shift result7 i_4))) <=
                   0 /\
                   (offset_max
                    doubleP_double_xM_18_alloc_table (select
                                                      double_xP_double_xM_result_7 (
                                                      shift result7 i_4))) >=
                   ((integer_of_int32 result6) - 1))) /\
                 
                 (separated_matrix
                  result7 (integer_of_int32 result5) double_xP_double_xM_result_7))),
  forall (p_6: (pointer double_xP)),
  forall (HW_24: p_6 = result7),
  forall (result8: double),
  forall (HW_25: (eq (double_value result8) (0)%R) /\
                 (eq (double_exact result8) (0)%R) /\
                 (eq (double_model result8) (0)%R)),
  forall (result9: (pointer doubleP)),
  forall (HW_26: result9 =
                 (select double_xP_double_xM_result_7 (shift p_6 0))),
  forall (doubleP_doubleM_double_xM_18_0: (memory doubleP double)),
  forall (HW_27: doubleP_doubleM_double_xM_18_0 =
                 (store doubleP_doubleM_double_xM_18 result9 result8)),
  forall (result10: int32),
  forall (HW_28: (integer_of_int32 result10) = 1),
  forall (i_6: int32),
  forall (HW_29: i_6 = result10),
  forall (doubleP_doubleM_double_xM_18_1: (memory doubleP double)),
  forall (i_6_0: int32),
  forall (HW_30: ( 1 <= (integer_of_int32 i_6_0) /\
                  (integer_of_int32 i_6_0) <=
                 (integer_of_int32 ni_0) /\
                 
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) ((integer_of_int32 i_6_0) - 1) 0 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_1))),
  forall (HW_40: (integer_of_int32 i_6_0) >= (integer_of_int32 ni_0)),
  forall (result11: double),
  forall (HW_41: (eq (double_value result11) (0)%R) /\
                 (eq (double_exact result11) (0)%R) /\
                 (eq (double_model result11) (0)%R)),
  forall (result12: (pointer doubleP)),
  forall (HW_42: result12 =
                 (select
                  double_xP_double_xM_result_7 (shift
                                                p_6 (integer_of_int32 ni_0)))),
  forall (doubleP_doubleM_double_xM_18_2: (memory doubleP double)),
  forall (HW_43: doubleP_doubleM_double_xM_18_2 =
                 (store doubleP_doubleM_double_xM_18_1 result12 result11)),
  forall (HW_44:
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) (integer_of_int32 ni_0) 0 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_2)),
  forall (result13: double),
  forall (HW_45: (eq (double_value result13) (0)%R) /\
                 (eq (double_exact result13) (0)%R) /\
                 (eq (double_model result13) (0)%R)),
  forall (result14: (pointer doubleP)),
  forall (HW_46: result14 =
                 (select double_xP_double_xM_result_7 (shift p_6 0))),
  forall (doubleP_doubleM_double_xM_18_3: (memory doubleP double)),
  forall (HW_47: doubleP_doubleM_double_xM_18_3 =
                 (store
                  doubleP_doubleM_double_xM_18_2 (shift result14 1) result13)),
  forall (result15: int32),
  forall (HW_48: (integer_of_int32 result15) = 1),
  forall (i_6_1: int32),
  forall (HW_49: i_6_1 = result15),
  forall (doubleP_doubleM_double_xM_18_4: (memory doubleP double)),
  forall (i_6_2: int32),
  forall (HW_50: ( 1 <= (integer_of_int32 i_6_2) /\
                  (integer_of_int32 i_6_2) <=
                 (integer_of_int32 ni_0) /\
                 
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) ((integer_of_int32 i_6_2) - 1) 1 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_4))),
  forall (HW_79: (integer_of_int32 i_6_2) >= (integer_of_int32 ni_0)),
  forall (result16: double),
  forall (HW_80: (eq (double_value result16) (0)%R) /\
                 (eq (double_exact result16) (0)%R) /\
                 (eq (double_model result16) (0)%R)),
  forall (result17: (pointer doubleP)),
  forall (HW_81: result17 =
                 (select
                  double_xP_double_xM_result_7 (shift
                                                p_6 (integer_of_int32 ni_0)))),
  forall (doubleP_doubleM_double_xM_18_5: (memory doubleP double)),
  forall (HW_82: doubleP_doubleM_double_xM_18_5 =
                 (store
                  doubleP_doubleM_double_xM_18_4 (shift result17 1) result16)),
  forall (HW_83:
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) (integer_of_int32 ni_0) 1 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_5)),
  forall (result18: int32),
  forall (HW_84: (integer_of_int32 result18) = 1),
  forall (k_7: int32),
  forall (HW_85: k_7 = result18),
  forall (doubleP_doubleM_double_xM_18_6: (memory doubleP double)),
  forall (k_7_0: int32),
  forall (HW_86: ( 1 <= (integer_of_int32 k_7_0) /\
                  (integer_of_int32 k_7_0) <=
                 (integer_of_int32 nk) /\
                 
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) (integer_of_int32 ni_0) (
                  integer_of_int32 k_7_0) a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_6))),
  forall (HW_88: (integer_of_int32 k_7_0) < (integer_of_int32 nk)),
  forall (result19: double),
  forall (HW_89: (eq (double_value result19) (0)%R) /\
                 (eq (double_exact result19) (0)%R) /\
                 (eq (double_model result19) (0)%R)),
  forall (result20: (pointer doubleP)),
  forall (HW_90: result20 =
                 (select double_xP_double_xM_result_7 (shift p_6 0))),
  forall (result21: int32),
  forall (HW_91: (integer_of_int32 result21) = ((integer_of_int32 k_7_0) + 1)),
  forall (doubleP_doubleM_double_xM_18_7: (memory doubleP double)),
  forall (HW_92: doubleP_doubleM_double_xM_18_7 =
                 (store
                  doubleP_doubleM_double_xM_18_6 (shift
                                                  result20 (integer_of_int32
                                                            result21)) result19)),
  forall (result22: int32),
  forall (HW_93: (integer_of_int32 result22) = 1),
  forall (i_6_3: int32),
  forall (HW_94: i_6_3 = result22),
  forall (doubleP_doubleM_double_xM_18_8: (memory doubleP double)),
  forall (i_6_4: int32),
  forall (HW_95: ( 1 <= (integer_of_int32 i_6_4) /\
                  (integer_of_int32 i_6_4) <=
                 (integer_of_int32 ni_0) /\
                 
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) ((integer_of_int32 i_6_4) - 1)
                  ((integer_of_int32 k_7_0) + 1) a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_8))),
  forall (HW_97: (integer_of_int32 i_6_4) < (integer_of_int32 ni_0)),
  
  (Rle
   (Rabs
    (double_value
     (select
      doubleP_doubleM_double_xM_18_8 (shift
                                      (select
                                       double_xP_double_xM_result_7 (
                                       shift
                                       p_6 ((integer_of_int32 i_6_4) - 1))) (
                                      integer_of_int32 k_7_0)))))
   (2)%R).

Lemma forward_prop_ensures_default_po_33 :
  forall (ni_0: int32),
  forall (nk: int32),
  forall (dt: double),
  forall (v: double),
  forall (l: double),
  forall (doubleP_double_xM_18_alloc_table: (alloc_table doubleP)),
  forall (double_xP_result_7_alloc_table: (alloc_table double_xP)),
  forall (double_xP_double_xM_result_7: (memory double_xP (pointer doubleP))),
  forall (doubleP_doubleM_double_xM_18: (memory doubleP double)),
  forall (HW_1: ( (integer_of_int32 ni_0) >= 2 /\
                 (integer_of_int32 nk) >= 2 /\
                 ~(eq (double_value l) (0)%R) /\
                 (Rgt (double_value dt) (0)%R) /\
                 (Rgt (double_exact dt) (0)%R) /\
                 (eq (double_exact v) c) /\
                 (eq (double_exact v) (double_value v)) /\
                
                (Rle
                 (1 / 10715086071862673209484250490600018105614048117055336074437503883703510511249361224931983788156958581275946729175531468251871452856923140435984577574698574803934567774824230985421074605062371141877954182153046474983581941267398767559165543946077062914571196477686542167660429831652624386837205668069376)%R
                 (double_exact dt)) /\
                 (integer_of_int32 ni_0) <= 2147483646 /\
                 (integer_of_int32 nk) <= 7598581 /\
                
                (Rle (Rmult (IZR (integer_of_int32 nk)) (double_exact dt))
                 T_max) /\
                
                (Rle
                 (Rdiv
                  (Rabs (Rminus (double_exact dt) (double_value dt))) (
                  double_value dt))
                 (1 / 2251799813685248)%R) /\
                
                (Rle
                 (1 / 3273390607896141870013189696827599152216642046043064789483291368096133796404674554883270092325904157150886684127560071009217256545885393053328527589376)%R
                 (Rmult
                  (Rmult (double_exact dt) (IZR (integer_of_int32 ni_0))) c)) /\
                
                (Rle
                 (Rmult
                  (Rmult (double_exact dt) (IZR (integer_of_int32 ni_0))) c)
                 (Rminus (1)%R (1 / 1125899906842624)%R)) /\
                
                (Rlt
                 (sqrt
                  (Rplus
                   (Rdiv
                    (1)%R (IZR
                           ((integer_of_int32 ni_0) *
                           (integer_of_int32 ni_0)))) (Rmult
                                                       (double_exact dt) (
                                                       double_exact dt))))
                 alpha_conv))),
  forall (result: double),
  forall (HW_10: (eq (double_value result) (1)%R) /\
                 (eq (double_exact result) (1)%R) /\
                 (eq (double_model result) (1)%R)),
  forall (result0: double),
  forall (HW_11: (double_of_real_post
                  nearest_even (IZR (integer_of_int32 ni_0)) result0)),
  forall (result1: double),
  forall (HW_12: ~(eq (double_value result0) (0)%R) /\
                 (div_double_post nearest_even result result0 result1)),
  forall (dx_8: double),
  forall (HW_13: dx_8 = result1),
  forall (HW_14:
                 ( (Rgt (double_value dx_8) (0)%R) /\
                  (Rle (double_value dx_8) (05 / 10)%R) /\
                 
                 (Rle
                  (Rdiv
                   (Rabs (Rminus (double_exact dx_8) (double_value dx_8))) (
                   double_value dx_8))
                  (1 / 9007199254740992)%R))),
  forall (result2: double),
  forall (HW_15: ~(eq (double_value dx_8) (0)%R) /\
                 (div_double_post nearest_even dt dx_8 result2)),
  forall (result3: double),
  forall (HW_16: (mul_double_post nearest_even result2 v result3)),
  forall (a1: double),
  forall (HW_17: a1 = result3),
  forall (result4: double),
  forall (HW_18: (mul_double_post nearest_even a1 a1 result4)),
  forall (a_1: double),
  forall (HW_19: a_1 = result4),
  forall (HW_20: ( (Rle (0)%R (double_value a_1)) /\
                  (Rle (double_value a_1) (1)%R) /\
                  (Rlt (0)%R (double_exact a_1)) /\
                  (Rle (double_exact a_1) (1)%R) /\
                 
                 (Rle (double_round_error a_1) (1 / 562949953421312)%R))),
  forall (result5: int32),
  forall (HW_21: (integer_of_int32 result5) = ((integer_of_int32 ni_0) + 1)),
  forall (result6: int32),
  forall (HW_22: (integer_of_int32 result6) = ((integer_of_int32 nk) + 1)),
  forall (result7: (pointer double_xP)),
  forall (HW_23:
                 (
                  (offset_min double_xP_result_7_alloc_table result7) <= 0 /\
                 
                 (offset_max double_xP_result_7_alloc_table result7) >=
                 ((integer_of_int32 result5) - 1) /\
                 
                 (forall (i_4:Z),
                  (0 <= i_4 /\ i_4 < (integer_of_int32 result5) ->
                   (offset_min
                    doubleP_double_xM_18_alloc_table (select
                                                      double_xP_double_xM_result_7 (
                                                      shift result7 i_4))) <=
                   0 /\
                   (offset_max
                    doubleP_double_xM_18_alloc_table (select
                                                      double_xP_double_xM_result_7 (
                                                      shift result7 i_4))) >=
                   ((integer_of_int32 result6) - 1))) /\
                 
                 (separated_matrix
                  result7 (integer_of_int32 result5) double_xP_double_xM_result_7))),
  forall (p_6: (pointer double_xP)),
  forall (HW_24: p_6 = result7),
  forall (result8: double),
  forall (HW_25: (eq (double_value result8) (0)%R) /\
                 (eq (double_exact result8) (0)%R) /\
                 (eq (double_model result8) (0)%R)),
  forall (result9: (pointer doubleP)),
  forall (HW_26: result9 =
                 (select double_xP_double_xM_result_7 (shift p_6 0))),
  forall (doubleP_doubleM_double_xM_18_0: (memory doubleP double)),
  forall (HW_27: doubleP_doubleM_double_xM_18_0 =
                 (store doubleP_doubleM_double_xM_18 result9 result8)),
  forall (result10: int32),
  forall (HW_28: (integer_of_int32 result10) = 1),
  forall (i_6: int32),
  forall (HW_29: i_6 = result10),
  forall (doubleP_doubleM_double_xM_18_1: (memory doubleP double)),
  forall (i_6_0: int32),
  forall (HW_30: ( 1 <= (integer_of_int32 i_6_0) /\
                  (integer_of_int32 i_6_0) <=
                 (integer_of_int32 ni_0) /\
                 
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) ((integer_of_int32 i_6_0) - 1) 0 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_1))),
  forall (HW_40: (integer_of_int32 i_6_0) >= (integer_of_int32 ni_0)),
  forall (result11: double),
  forall (HW_41: (eq (double_value result11) (0)%R) /\
                 (eq (double_exact result11) (0)%R) /\
                 (eq (double_model result11) (0)%R)),
  forall (result12: (pointer doubleP)),
  forall (HW_42: result12 =
                 (select
                  double_xP_double_xM_result_7 (shift
                                                p_6 (integer_of_int32 ni_0)))),
  forall (doubleP_doubleM_double_xM_18_2: (memory doubleP double)),
  forall (HW_43: doubleP_doubleM_double_xM_18_2 =
                 (store doubleP_doubleM_double_xM_18_1 result12 result11)),
  forall (HW_44:
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) (integer_of_int32 ni_0) 0 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_2)),
  forall (result13: double),
  forall (HW_45: (eq (double_value result13) (0)%R) /\
                 (eq (double_exact result13) (0)%R) /\
                 (eq (double_model result13) (0)%R)),
  forall (result14: (pointer doubleP)),
  forall (HW_46: result14 =
                 (select double_xP_double_xM_result_7 (shift p_6 0))),
  forall (doubleP_doubleM_double_xM_18_3: (memory doubleP double)),
  forall (HW_47: doubleP_doubleM_double_xM_18_3 =
                 (store
                  doubleP_doubleM_double_xM_18_2 (shift result14 1) result13)),
  forall (result15: int32),
  forall (HW_48: (integer_of_int32 result15) = 1),
  forall (i_6_1: int32),
  forall (HW_49: i_6_1 = result15),
  forall (doubleP_doubleM_double_xM_18_4: (memory doubleP double)),
  forall (i_6_2: int32),
  forall (HW_50: ( 1 <= (integer_of_int32 i_6_2) /\
                  (integer_of_int32 i_6_2) <=
                 (integer_of_int32 ni_0) /\
                 
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) ((integer_of_int32 i_6_2) - 1) 1 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_4))),
  forall (HW_79: (integer_of_int32 i_6_2) >= (integer_of_int32 ni_0)),
  forall (result16: double),
  forall (HW_80: (eq (double_value result16) (0)%R) /\
                 (eq (double_exact result16) (0)%R) /\
                 (eq (double_model result16) (0)%R)),
  forall (result17: (pointer doubleP)),
  forall (HW_81: result17 =
                 (select
                  double_xP_double_xM_result_7 (shift
                                                p_6 (integer_of_int32 ni_0)))),
  forall (doubleP_doubleM_double_xM_18_5: (memory doubleP double)),
  forall (HW_82: doubleP_doubleM_double_xM_18_5 =
                 (store
                  doubleP_doubleM_double_xM_18_4 (shift result17 1) result16)),
  forall (HW_83:
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) (integer_of_int32 ni_0) 1 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_5)),
  forall (result18: int32),
  forall (HW_84: (integer_of_int32 result18) = 1),
  forall (k_7: int32),
  forall (HW_85: k_7 = result18),
  forall (doubleP_doubleM_double_xM_18_6: (memory doubleP double)),
  forall (k_7_0: int32),
  forall (HW_86: ( 1 <= (integer_of_int32 k_7_0) /\
                  (integer_of_int32 k_7_0) <=
                 (integer_of_int32 nk) /\
                 
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) (integer_of_int32 ni_0) (
                  integer_of_int32 k_7_0) a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_6))),
  forall (HW_88: (integer_of_int32 k_7_0) < (integer_of_int32 nk)),
  forall (result19: double),
  forall (HW_89: (eq (double_value result19) (0)%R) /\
                 (eq (double_exact result19) (0)%R) /\
                 (eq (double_model result19) (0)%R)),
  forall (result20: (pointer doubleP)),
  forall (HW_90: result20 =
                 (select double_xP_double_xM_result_7 (shift p_6 0))),
  forall (result21: int32),
  forall (HW_91: (integer_of_int32 result21) = ((integer_of_int32 k_7_0) + 1)),
  forall (doubleP_doubleM_double_xM_18_7: (memory doubleP double)),
  forall (HW_92: doubleP_doubleM_double_xM_18_7 =
                 (store
                  doubleP_doubleM_double_xM_18_6 (shift
                                                  result20 (integer_of_int32
                                                            result21)) result19)),
  forall (result22: int32),
  forall (HW_93: (integer_of_int32 result22) = 1),
  forall (i_6_3: int32),
  forall (HW_94: i_6_3 = result22),
  forall (doubleP_doubleM_double_xM_18_8: (memory doubleP double)),
  forall (i_6_4: int32),
  forall (HW_95: ( 1 <= (integer_of_int32 i_6_4) /\
                  (integer_of_int32 i_6_4) <=
                 (integer_of_int32 ni_0) /\
                 
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) ((integer_of_int32 i_6_4) - 1)
                  ((integer_of_int32 k_7_0) + 1) a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_8))),
  forall (HW_97: (integer_of_int32 i_6_4) < (integer_of_int32 ni_0)),
  forall (HW_98:
                 (Rle
                  (Rabs
                   (double_value
                    (select
                     doubleP_doubleM_double_xM_18_8 (shift
                                                     (select
                                                      double_xP_double_xM_result_7 (
                                                      shift
                                                      p_6 ((integer_of_int32
                                                            i_6_4) -
                                                          1))) (integer_of_int32
                                                                k_7_0)))))
                  (2)%R)),
  
  (Rle
   (Rabs
    (double_value
     (select
      doubleP_doubleM_double_xM_18_8 (shift
                                      (select
                                       double_xP_double_xM_result_7 (
                                       shift p_6 (integer_of_int32 i_6_4))) (
                                      integer_of_int32 k_7_0)))))
   (2)%R).

Lemma forward_prop_ensures_default_po_34 :
  forall (ni_0: int32),
  forall (nk: int32),
  forall (dt: double),
  forall (v: double),
  forall (l: double),
  forall (doubleP_double_xM_18_alloc_table: (alloc_table doubleP)),
  forall (double_xP_result_7_alloc_table: (alloc_table double_xP)),
  forall (double_xP_double_xM_result_7: (memory double_xP (pointer doubleP))),
  forall (doubleP_doubleM_double_xM_18: (memory doubleP double)),
  forall (HW_1: ( (integer_of_int32 ni_0) >= 2 /\
                 (integer_of_int32 nk) >= 2 /\
                 ~(eq (double_value l) (0)%R) /\
                 (Rgt (double_value dt) (0)%R) /\
                 (Rgt (double_exact dt) (0)%R) /\
                 (eq (double_exact v) c) /\
                 (eq (double_exact v) (double_value v)) /\
                
                (Rle
                 (1 / 10715086071862673209484250490600018105614048117055336074437503883703510511249361224931983788156958581275946729175531468251871452856923140435984577574698574803934567774824230985421074605062371141877954182153046474983581941267398767559165543946077062914571196477686542167660429831652624386837205668069376)%R
                 (double_exact dt)) /\
                 (integer_of_int32 ni_0) <= 2147483646 /\
                 (integer_of_int32 nk) <= 7598581 /\
                
                (Rle (Rmult (IZR (integer_of_int32 nk)) (double_exact dt))
                 T_max) /\
                
                (Rle
                 (Rdiv
                  (Rabs (Rminus (double_exact dt) (double_value dt))) (
                  double_value dt))
                 (1 / 2251799813685248)%R) /\
                
                (Rle
                 (1 / 3273390607896141870013189696827599152216642046043064789483291368096133796404674554883270092325904157150886684127560071009217256545885393053328527589376)%R
                 (Rmult
                  (Rmult (double_exact dt) (IZR (integer_of_int32 ni_0))) c)) /\
                
                (Rle
                 (Rmult
                  (Rmult (double_exact dt) (IZR (integer_of_int32 ni_0))) c)
                 (Rminus (1)%R (1 / 1125899906842624)%R)) /\
                
                (Rlt
                 (sqrt
                  (Rplus
                   (Rdiv
                    (1)%R (IZR
                           ((integer_of_int32 ni_0) *
                           (integer_of_int32 ni_0)))) (Rmult
                                                       (double_exact dt) (
                                                       double_exact dt))))
                 alpha_conv))),
  forall (result: double),
  forall (HW_10: (eq (double_value result) (1)%R) /\
                 (eq (double_exact result) (1)%R) /\
                 (eq (double_model result) (1)%R)),
  forall (result0: double),
  forall (HW_11: (double_of_real_post
                  nearest_even (IZR (integer_of_int32 ni_0)) result0)),
  forall (result1: double),
  forall (HW_12: ~(eq (double_value result0) (0)%R) /\
                 (div_double_post nearest_even result result0 result1)),
  forall (dx_8: double),
  forall (HW_13: dx_8 = result1),
  forall (HW_14:
                 ( (Rgt (double_value dx_8) (0)%R) /\
                  (Rle (double_value dx_8) (05 / 10)%R) /\
                 
                 (Rle
                  (Rdiv
                   (Rabs (Rminus (double_exact dx_8) (double_value dx_8))) (
                   double_value dx_8))
                  (1 / 9007199254740992)%R))),
  forall (result2: double),
  forall (HW_15: ~(eq (double_value dx_8) (0)%R) /\
                 (div_double_post nearest_even dt dx_8 result2)),
  forall (result3: double),
  forall (HW_16: (mul_double_post nearest_even result2 v result3)),
  forall (a1: double),
  forall (HW_17: a1 = result3),
  forall (result4: double),
  forall (HW_18: (mul_double_post nearest_even a1 a1 result4)),
  forall (a_1: double),
  forall (HW_19: a_1 = result4),
  forall (HW_20: ( (Rle (0)%R (double_value a_1)) /\
                  (Rle (double_value a_1) (1)%R) /\
                  (Rlt (0)%R (double_exact a_1)) /\
                  (Rle (double_exact a_1) (1)%R) /\
                 
                 (Rle (double_round_error a_1) (1 / 562949953421312)%R))),
  forall (result5: int32),
  forall (HW_21: (integer_of_int32 result5) = ((integer_of_int32 ni_0) + 1)),
  forall (result6: int32),
  forall (HW_22: (integer_of_int32 result6) = ((integer_of_int32 nk) + 1)),
  forall (result7: (pointer double_xP)),
  forall (HW_23:
                 (
                  (offset_min double_xP_result_7_alloc_table result7) <= 0 /\
                 
                 (offset_max double_xP_result_7_alloc_table result7) >=
                 ((integer_of_int32 result5) - 1) /\
                 
                 (forall (i_4:Z),
                  (0 <= i_4 /\ i_4 < (integer_of_int32 result5) ->
                   (offset_min
                    doubleP_double_xM_18_alloc_table (select
                                                      double_xP_double_xM_result_7 (
                                                      shift result7 i_4))) <=
                   0 /\
                   (offset_max
                    doubleP_double_xM_18_alloc_table (select
                                                      double_xP_double_xM_result_7 (
                                                      shift result7 i_4))) >=
                   ((integer_of_int32 result6) - 1))) /\
                 
                 (separated_matrix
                  result7 (integer_of_int32 result5) double_xP_double_xM_result_7))),
  forall (p_6: (pointer double_xP)),
  forall (HW_24: p_6 = result7),
  forall (result8: double),
  forall (HW_25: (eq (double_value result8) (0)%R) /\
                 (eq (double_exact result8) (0)%R) /\
                 (eq (double_model result8) (0)%R)),
  forall (result9: (pointer doubleP)),
  forall (HW_26: result9 =
                 (select double_xP_double_xM_result_7 (shift p_6 0))),
  forall (doubleP_doubleM_double_xM_18_0: (memory doubleP double)),
  forall (HW_27: doubleP_doubleM_double_xM_18_0 =
                 (store doubleP_doubleM_double_xM_18 result9 result8)),
  forall (result10: int32),
  forall (HW_28: (integer_of_int32 result10) = 1),
  forall (i_6: int32),
  forall (HW_29: i_6 = result10),
  forall (doubleP_doubleM_double_xM_18_1: (memory doubleP double)),
  forall (i_6_0: int32),
  forall (HW_30: ( 1 <= (integer_of_int32 i_6_0) /\
                  (integer_of_int32 i_6_0) <=
                 (integer_of_int32 ni_0) /\
                 
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) ((integer_of_int32 i_6_0) - 1) 0 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_1))),
  forall (HW_40: (integer_of_int32 i_6_0) >= (integer_of_int32 ni_0)),
  forall (result11: double),
  forall (HW_41: (eq (double_value result11) (0)%R) /\
                 (eq (double_exact result11) (0)%R) /\
                 (eq (double_model result11) (0)%R)),
  forall (result12: (pointer doubleP)),
  forall (HW_42: result12 =
                 (select
                  double_xP_double_xM_result_7 (shift
                                                p_6 (integer_of_int32 ni_0)))),
  forall (doubleP_doubleM_double_xM_18_2: (memory doubleP double)),
  forall (HW_43: doubleP_doubleM_double_xM_18_2 =
                 (store doubleP_doubleM_double_xM_18_1 result12 result11)),
  forall (HW_44:
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) (integer_of_int32 ni_0) 0 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_2)),
  forall (result13: double),
  forall (HW_45: (eq (double_value result13) (0)%R) /\
                 (eq (double_exact result13) (0)%R) /\
                 (eq (double_model result13) (0)%R)),
  forall (result14: (pointer doubleP)),
  forall (HW_46: result14 =
                 (select double_xP_double_xM_result_7 (shift p_6 0))),
  forall (doubleP_doubleM_double_xM_18_3: (memory doubleP double)),
  forall (HW_47: doubleP_doubleM_double_xM_18_3 =
                 (store
                  doubleP_doubleM_double_xM_18_2 (shift result14 1) result13)),
  forall (result15: int32),
  forall (HW_48: (integer_of_int32 result15) = 1),
  forall (i_6_1: int32),
  forall (HW_49: i_6_1 = result15),
  forall (doubleP_doubleM_double_xM_18_4: (memory doubleP double)),
  forall (i_6_2: int32),
  forall (HW_50: ( 1 <= (integer_of_int32 i_6_2) /\
                  (integer_of_int32 i_6_2) <=
                 (integer_of_int32 ni_0) /\
                 
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) ((integer_of_int32 i_6_2) - 1) 1 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_4))),
  forall (HW_79: (integer_of_int32 i_6_2) >= (integer_of_int32 ni_0)),
  forall (result16: double),
  forall (HW_80: (eq (double_value result16) (0)%R) /\
                 (eq (double_exact result16) (0)%R) /\
                 (eq (double_model result16) (0)%R)),
  forall (result17: (pointer doubleP)),
  forall (HW_81: result17 =
                 (select
                  double_xP_double_xM_result_7 (shift
                                                p_6 (integer_of_int32 ni_0)))),
  forall (doubleP_doubleM_double_xM_18_5: (memory doubleP double)),
  forall (HW_82: doubleP_doubleM_double_xM_18_5 =
                 (store
                  doubleP_doubleM_double_xM_18_4 (shift result17 1) result16)),
  forall (HW_83:
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) (integer_of_int32 ni_0) 1 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_5)),
  forall (result18: int32),
  forall (HW_84: (integer_of_int32 result18) = 1),
  forall (k_7: int32),
  forall (HW_85: k_7 = result18),
  forall (doubleP_doubleM_double_xM_18_6: (memory doubleP double)),
  forall (k_7_0: int32),
  forall (HW_86: ( 1 <= (integer_of_int32 k_7_0) /\
                  (integer_of_int32 k_7_0) <=
                 (integer_of_int32 nk) /\
                 
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) (integer_of_int32 ni_0) (
                  integer_of_int32 k_7_0) a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_6))),
  forall (HW_88: (integer_of_int32 k_7_0) < (integer_of_int32 nk)),
  forall (result19: double),
  forall (HW_89: (eq (double_value result19) (0)%R) /\
                 (eq (double_exact result19) (0)%R) /\
                 (eq (double_model result19) (0)%R)),
  forall (result20: (pointer doubleP)),
  forall (HW_90: result20 =
                 (select double_xP_double_xM_result_7 (shift p_6 0))),
  forall (result21: int32),
  forall (HW_91: (integer_of_int32 result21) = ((integer_of_int32 k_7_0) + 1)),
  forall (doubleP_doubleM_double_xM_18_7: (memory doubleP double)),
  forall (HW_92: doubleP_doubleM_double_xM_18_7 =
                 (store
                  doubleP_doubleM_double_xM_18_6 (shift
                                                  result20 (integer_of_int32
                                                            result21)) result19)),
  forall (result22: int32),
  forall (HW_93: (integer_of_int32 result22) = 1),
  forall (i_6_3: int32),
  forall (HW_94: i_6_3 = result22),
  forall (doubleP_doubleM_double_xM_18_8: (memory doubleP double)),
  forall (i_6_4: int32),
  forall (HW_95: ( 1 <= (integer_of_int32 i_6_4) /\
                  (integer_of_int32 i_6_4) <=
                 (integer_of_int32 ni_0) /\
                 
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) ((integer_of_int32 i_6_4) - 1)
                  ((integer_of_int32 k_7_0) + 1) a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_8))),
  forall (HW_97: (integer_of_int32 i_6_4) < (integer_of_int32 ni_0)),
  forall (HW_98:
                 (Rle
                  (Rabs
                   (double_value
                    (select
                     doubleP_doubleM_double_xM_18_8 (shift
                                                     (select
                                                      double_xP_double_xM_result_7 (
                                                      shift
                                                      p_6 ((integer_of_int32
                                                            i_6_4) -
                                                          1))) (integer_of_int32
                                                                k_7_0)))))
                  (2)%R)),
  forall (HW_99:
                 (Rle
                  (Rabs
                   (double_value
                    (select
                     doubleP_doubleM_double_xM_18_8 (shift
                                                     (select
                                                      double_xP_double_xM_result_7 (
                                                      shift
                                                      p_6 (integer_of_int32
                                                           i_6_4))) (
                                                     integer_of_int32 k_7_0)))))
                  (2)%R)),
  
  (Rle
   (Rabs
    (double_value
     (select
      doubleP_doubleM_double_xM_18_8 (shift
                                      (select
                                       double_xP_double_xM_result_7 (
                                       shift
                                       p_6 ((integer_of_int32 i_6_4) + 1))) (
                                      integer_of_int32 k_7_0)))))
   (2)%R).

Lemma forward_prop_ensures_default_po_35 :
  forall (ni_0: int32),
  forall (nk: int32),
  forall (dt: double),
  forall (v: double),
  forall (l: double),
  forall (doubleP_double_xM_18_alloc_table: (alloc_table doubleP)),
  forall (double_xP_result_7_alloc_table: (alloc_table double_xP)),
  forall (double_xP_double_xM_result_7: (memory double_xP (pointer doubleP))),
  forall (doubleP_doubleM_double_xM_18: (memory doubleP double)),
  forall (HW_1: ( (integer_of_int32 ni_0) >= 2 /\
                 (integer_of_int32 nk) >= 2 /\
                 ~(eq (double_value l) (0)%R) /\
                 (Rgt (double_value dt) (0)%R) /\
                 (Rgt (double_exact dt) (0)%R) /\
                 (eq (double_exact v) c) /\
                 (eq (double_exact v) (double_value v)) /\
                
                (Rle
                 (1 / 10715086071862673209484250490600018105614048117055336074437503883703510511249361224931983788156958581275946729175531468251871452856923140435984577574698574803934567774824230985421074605062371141877954182153046474983581941267398767559165543946077062914571196477686542167660429831652624386837205668069376)%R
                 (double_exact dt)) /\
                 (integer_of_int32 ni_0) <= 2147483646 /\
                 (integer_of_int32 nk) <= 7598581 /\
                
                (Rle (Rmult (IZR (integer_of_int32 nk)) (double_exact dt))
                 T_max) /\
                
                (Rle
                 (Rdiv
                  (Rabs (Rminus (double_exact dt) (double_value dt))) (
                  double_value dt))
                 (1 / 2251799813685248)%R) /\
                
                (Rle
                 (1 / 3273390607896141870013189696827599152216642046043064789483291368096133796404674554883270092325904157150886684127560071009217256545885393053328527589376)%R
                 (Rmult
                  (Rmult (double_exact dt) (IZR (integer_of_int32 ni_0))) c)) /\
                
                (Rle
                 (Rmult
                  (Rmult (double_exact dt) (IZR (integer_of_int32 ni_0))) c)
                 (Rminus (1)%R (1 / 1125899906842624)%R)) /\
                
                (Rlt
                 (sqrt
                  (Rplus
                   (Rdiv
                    (1)%R (IZR
                           ((integer_of_int32 ni_0) *
                           (integer_of_int32 ni_0)))) (Rmult
                                                       (double_exact dt) (
                                                       double_exact dt))))
                 alpha_conv))),
  forall (result: double),
  forall (HW_10: (eq (double_value result) (1)%R) /\
                 (eq (double_exact result) (1)%R) /\
                 (eq (double_model result) (1)%R)),
  forall (result0: double),
  forall (HW_11: (double_of_real_post
                  nearest_even (IZR (integer_of_int32 ni_0)) result0)),
  forall (result1: double),
  forall (HW_12: ~(eq (double_value result0) (0)%R) /\
                 (div_double_post nearest_even result result0 result1)),
  forall (dx_8: double),
  forall (HW_13: dx_8 = result1),
  forall (HW_14:
                 ( (Rgt (double_value dx_8) (0)%R) /\
                  (Rle (double_value dx_8) (05 / 10)%R) /\
                 
                 (Rle
                  (Rdiv
                   (Rabs (Rminus (double_exact dx_8) (double_value dx_8))) (
                   double_value dx_8))
                  (1 / 9007199254740992)%R))),
  forall (result2: double),
  forall (HW_15: ~(eq (double_value dx_8) (0)%R) /\
                 (div_double_post nearest_even dt dx_8 result2)),
  forall (result3: double),
  forall (HW_16: (mul_double_post nearest_even result2 v result3)),
  forall (a1: double),
  forall (HW_17: a1 = result3),
  forall (result4: double),
  forall (HW_18: (mul_double_post nearest_even a1 a1 result4)),
  forall (a_1: double),
  forall (HW_19: a_1 = result4),
  forall (HW_20: ( (Rle (0)%R (double_value a_1)) /\
                  (Rle (double_value a_1) (1)%R) /\
                  (Rlt (0)%R (double_exact a_1)) /\
                  (Rle (double_exact a_1) (1)%R) /\
                 
                 (Rle (double_round_error a_1) (1 / 562949953421312)%R))),
  forall (result5: int32),
  forall (HW_21: (integer_of_int32 result5) = ((integer_of_int32 ni_0) + 1)),
  forall (result6: int32),
  forall (HW_22: (integer_of_int32 result6) = ((integer_of_int32 nk) + 1)),
  forall (result7: (pointer double_xP)),
  forall (HW_23:
                 (
                  (offset_min double_xP_result_7_alloc_table result7) <= 0 /\
                 
                 (offset_max double_xP_result_7_alloc_table result7) >=
                 ((integer_of_int32 result5) - 1) /\
                 
                 (forall (i_4:Z),
                  (0 <= i_4 /\ i_4 < (integer_of_int32 result5) ->
                   (offset_min
                    doubleP_double_xM_18_alloc_table (select
                                                      double_xP_double_xM_result_7 (
                                                      shift result7 i_4))) <=
                   0 /\
                   (offset_max
                    doubleP_double_xM_18_alloc_table (select
                                                      double_xP_double_xM_result_7 (
                                                      shift result7 i_4))) >=
                   ((integer_of_int32 result6) - 1))) /\
                 
                 (separated_matrix
                  result7 (integer_of_int32 result5) double_xP_double_xM_result_7))),
  forall (p_6: (pointer double_xP)),
  forall (HW_24: p_6 = result7),
  forall (result8: double),
  forall (HW_25: (eq (double_value result8) (0)%R) /\
                 (eq (double_exact result8) (0)%R) /\
                 (eq (double_model result8) (0)%R)),
  forall (result9: (pointer doubleP)),
  forall (HW_26: result9 =
                 (select double_xP_double_xM_result_7 (shift p_6 0))),
  forall (doubleP_doubleM_double_xM_18_0: (memory doubleP double)),
  forall (HW_27: doubleP_doubleM_double_xM_18_0 =
                 (store doubleP_doubleM_double_xM_18 result9 result8)),
  forall (result10: int32),
  forall (HW_28: (integer_of_int32 result10) = 1),
  forall (i_6: int32),
  forall (HW_29: i_6 = result10),
  forall (doubleP_doubleM_double_xM_18_1: (memory doubleP double)),
  forall (i_6_0: int32),
  forall (HW_30: ( 1 <= (integer_of_int32 i_6_0) /\
                  (integer_of_int32 i_6_0) <=
                 (integer_of_int32 ni_0) /\
                 
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) ((integer_of_int32 i_6_0) - 1) 0 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_1))),
  forall (HW_40: (integer_of_int32 i_6_0) >= (integer_of_int32 ni_0)),
  forall (result11: double),
  forall (HW_41: (eq (double_value result11) (0)%R) /\
                 (eq (double_exact result11) (0)%R) /\
                 (eq (double_model result11) (0)%R)),
  forall (result12: (pointer doubleP)),
  forall (HW_42: result12 =
                 (select
                  double_xP_double_xM_result_7 (shift
                                                p_6 (integer_of_int32 ni_0)))),
  forall (doubleP_doubleM_double_xM_18_2: (memory doubleP double)),
  forall (HW_43: doubleP_doubleM_double_xM_18_2 =
                 (store doubleP_doubleM_double_xM_18_1 result12 result11)),
  forall (HW_44:
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) (integer_of_int32 ni_0) 0 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_2)),
  forall (result13: double),
  forall (HW_45: (eq (double_value result13) (0)%R) /\
                 (eq (double_exact result13) (0)%R) /\
                 (eq (double_model result13) (0)%R)),
  forall (result14: (pointer doubleP)),
  forall (HW_46: result14 =
                 (select double_xP_double_xM_result_7 (shift p_6 0))),
  forall (doubleP_doubleM_double_xM_18_3: (memory doubleP double)),
  forall (HW_47: doubleP_doubleM_double_xM_18_3 =
                 (store
                  doubleP_doubleM_double_xM_18_2 (shift result14 1) result13)),
  forall (result15: int32),
  forall (HW_48: (integer_of_int32 result15) = 1),
  forall (i_6_1: int32),
  forall (HW_49: i_6_1 = result15),
  forall (doubleP_doubleM_double_xM_18_4: (memory doubleP double)),
  forall (i_6_2: int32),
  forall (HW_50: ( 1 <= (integer_of_int32 i_6_2) /\
                  (integer_of_int32 i_6_2) <=
                 (integer_of_int32 ni_0) /\
                 
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) ((integer_of_int32 i_6_2) - 1) 1 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_4))),
  forall (HW_79: (integer_of_int32 i_6_2) >= (integer_of_int32 ni_0)),
  forall (result16: double),
  forall (HW_80: (eq (double_value result16) (0)%R) /\
                 (eq (double_exact result16) (0)%R) /\
                 (eq (double_model result16) (0)%R)),
  forall (result17: (pointer doubleP)),
  forall (HW_81: result17 =
                 (select
                  double_xP_double_xM_result_7 (shift
                                                p_6 (integer_of_int32 ni_0)))),
  forall (doubleP_doubleM_double_xM_18_5: (memory doubleP double)),
  forall (HW_82: doubleP_doubleM_double_xM_18_5 =
                 (store
                  doubleP_doubleM_double_xM_18_4 (shift result17 1) result16)),
  forall (HW_83:
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) (integer_of_int32 ni_0) 1 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_5)),
  forall (result18: int32),
  forall (HW_84: (integer_of_int32 result18) = 1),
  forall (k_7: int32),
  forall (HW_85: k_7 = result18),
  forall (doubleP_doubleM_double_xM_18_6: (memory doubleP double)),
  forall (k_7_0: int32),
  forall (HW_86: ( 1 <= (integer_of_int32 k_7_0) /\
                  (integer_of_int32 k_7_0) <=
                 (integer_of_int32 nk) /\
                 
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) (integer_of_int32 ni_0) (
                  integer_of_int32 k_7_0) a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_6))),
  forall (HW_88: (integer_of_int32 k_7_0) < (integer_of_int32 nk)),
  forall (result19: double),
  forall (HW_89: (eq (double_value result19) (0)%R) /\
                 (eq (double_exact result19) (0)%R) /\
                 (eq (double_model result19) (0)%R)),
  forall (result20: (pointer doubleP)),
  forall (HW_90: result20 =
                 (select double_xP_double_xM_result_7 (shift p_6 0))),
  forall (result21: int32),
  forall (HW_91: (integer_of_int32 result21) = ((integer_of_int32 k_7_0) + 1)),
  forall (doubleP_doubleM_double_xM_18_7: (memory doubleP double)),
  forall (HW_92: doubleP_doubleM_double_xM_18_7 =
                 (store
                  doubleP_doubleM_double_xM_18_6 (shift
                                                  result20 (integer_of_int32
                                                            result21)) result19)),
  forall (result22: int32),
  forall (HW_93: (integer_of_int32 result22) = 1),
  forall (i_6_3: int32),
  forall (HW_94: i_6_3 = result22),
  forall (doubleP_doubleM_double_xM_18_8: (memory doubleP double)),
  forall (i_6_4: int32),
  forall (HW_95: ( 1 <= (integer_of_int32 i_6_4) /\
                  (integer_of_int32 i_6_4) <=
                 (integer_of_int32 ni_0) /\
                 
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) ((integer_of_int32 i_6_4) - 1)
                  ((integer_of_int32 k_7_0) + 1) a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_8))),
  forall (HW_97: (integer_of_int32 i_6_4) < (integer_of_int32 ni_0)),
  forall (HW_98:
                 (Rle
                  (Rabs
                   (double_value
                    (select
                     doubleP_doubleM_double_xM_18_8 (shift
                                                     (select
                                                      double_xP_double_xM_result_7 (
                                                      shift
                                                      p_6 ((integer_of_int32
                                                            i_6_4) -
                                                          1))) (integer_of_int32
                                                                k_7_0)))))
                  (2)%R)),
  forall (HW_99:
                 (Rle
                  (Rabs
                   (double_value
                    (select
                     doubleP_doubleM_double_xM_18_8 (shift
                                                     (select
                                                      double_xP_double_xM_result_7 (
                                                      shift
                                                      p_6 (integer_of_int32
                                                           i_6_4))) (
                                                     integer_of_int32 k_7_0)))))
                  (2)%R)),
  forall (HW_100:
                  (Rle
                   (Rabs
                    (double_value
                     (select
                      doubleP_doubleM_double_xM_18_8 (shift
                                                      (select
                                                       double_xP_double_xM_result_7 (
                                                       shift
                                                       p_6 ((integer_of_int32
                                                             i_6_4) +
                                                           1))) (integer_of_int32
                                                                 k_7_0)))))
                   (2)%R)),
  
  (Rle
   (Rabs
    (double_value
     (select
      doubleP_doubleM_double_xM_18_8 (shift
                                      (select
                                       double_xP_double_xM_result_7 (
                                       shift p_6 (integer_of_int32 i_6_4)))
                                      ((integer_of_int32 k_7_0) - 1)))))
   (2)%R).

Lemma forward_prop_ensures_default_po_38 :
  forall (ni_0: int32),
  forall (nk: int32),
  forall (dt: double),
  forall (v: double),
  forall (l: double),
  forall (doubleP_double_xM_18_alloc_table: (alloc_table doubleP)),
  forall (double_xP_result_7_alloc_table: (alloc_table double_xP)),
  forall (double_xP_double_xM_result_7: (memory double_xP (pointer doubleP))),
  forall (doubleP_doubleM_double_xM_18: (memory doubleP double)),
  forall (HW_1: ( (integer_of_int32 ni_0) >= 2 /\
                 (integer_of_int32 nk) >= 2 /\
                 ~(eq (double_value l) (0)%R) /\
                 (Rgt (double_value dt) (0)%R) /\
                 (Rgt (double_exact dt) (0)%R) /\
                 (eq (double_exact v) c) /\
                 (eq (double_exact v) (double_value v)) /\
                
                (Rle
                 (1 / 10715086071862673209484250490600018105614048117055336074437503883703510511249361224931983788156958581275946729175531468251871452856923140435984577574698574803934567774824230985421074605062371141877954182153046474983581941267398767559165543946077062914571196477686542167660429831652624386837205668069376)%R
                 (double_exact dt)) /\
                 (integer_of_int32 ni_0) <= 2147483646 /\
                 (integer_of_int32 nk) <= 7598581 /\
                
                (Rle (Rmult (IZR (integer_of_int32 nk)) (double_exact dt))
                 T_max) /\
                
                (Rle
                 (Rdiv
                  (Rabs (Rminus (double_exact dt) (double_value dt))) (
                  double_value dt))
                 (1 / 2251799813685248)%R) /\
                
                (Rle
                 (1 / 3273390607896141870013189696827599152216642046043064789483291368096133796404674554883270092325904157150886684127560071009217256545885393053328527589376)%R
                 (Rmult
                  (Rmult (double_exact dt) (IZR (integer_of_int32 ni_0))) c)) /\
                
                (Rle
                 (Rmult
                  (Rmult (double_exact dt) (IZR (integer_of_int32 ni_0))) c)
                 (Rminus (1)%R (1 / 1125899906842624)%R)) /\
                
                (Rlt
                 (sqrt
                  (Rplus
                   (Rdiv
                    (1)%R (IZR
                           ((integer_of_int32 ni_0) *
                           (integer_of_int32 ni_0)))) (Rmult
                                                       (double_exact dt) (
                                                       double_exact dt))))
                 alpha_conv))),
  forall (result: double),
  forall (HW_10: (eq (double_value result) (1)%R) /\
                 (eq (double_exact result) (1)%R) /\
                 (eq (double_model result) (1)%R)),
  forall (result0: double),
  forall (HW_11: (double_of_real_post
                  nearest_even (IZR (integer_of_int32 ni_0)) result0)),
  forall (result1: double),
  forall (HW_12: ~(eq (double_value result0) (0)%R) /\
                 (div_double_post nearest_even result result0 result1)),
  forall (dx_8: double),
  forall (HW_13: dx_8 = result1),
  forall (HW_14:
                 ( (Rgt (double_value dx_8) (0)%R) /\
                  (Rle (double_value dx_8) (05 / 10)%R) /\
                 
                 (Rle
                  (Rdiv
                   (Rabs (Rminus (double_exact dx_8) (double_value dx_8))) (
                   double_value dx_8))
                  (1 / 9007199254740992)%R))),
  forall (result2: double),
  forall (HW_15: ~(eq (double_value dx_8) (0)%R) /\
                 (div_double_post nearest_even dt dx_8 result2)),
  forall (result3: double),
  forall (HW_16: (mul_double_post nearest_even result2 v result3)),
  forall (a1: double),
  forall (HW_17: a1 = result3),
  forall (result4: double),
  forall (HW_18: (mul_double_post nearest_even a1 a1 result4)),
  forall (a_1: double),
  forall (HW_19: a_1 = result4),
  forall (HW_20: ( (Rle (0)%R (double_value a_1)) /\
                  (Rle (double_value a_1) (1)%R) /\
                  (Rlt (0)%R (double_exact a_1)) /\
                  (Rle (double_exact a_1) (1)%R) /\
                 
                 (Rle (double_round_error a_1) (1 / 562949953421312)%R))),
  forall (result5: int32),
  forall (HW_21: (integer_of_int32 result5) = ((integer_of_int32 ni_0) + 1)),
  forall (result6: int32),
  forall (HW_22: (integer_of_int32 result6) = ((integer_of_int32 nk) + 1)),
  forall (result7: (pointer double_xP)),
  forall (HW_23:
                 (
                  (offset_min double_xP_result_7_alloc_table result7) <= 0 /\
                 
                 (offset_max double_xP_result_7_alloc_table result7) >=
                 ((integer_of_int32 result5) - 1) /\
                 
                 (forall (i_4:Z),
                  (0 <= i_4 /\ i_4 < (integer_of_int32 result5) ->
                   (offset_min
                    doubleP_double_xM_18_alloc_table (select
                                                      double_xP_double_xM_result_7 (
                                                      shift result7 i_4))) <=
                   0 /\
                   (offset_max
                    doubleP_double_xM_18_alloc_table (select
                                                      double_xP_double_xM_result_7 (
                                                      shift result7 i_4))) >=
                   ((integer_of_int32 result6) - 1))) /\
                 
                 (separated_matrix
                  result7 (integer_of_int32 result5) double_xP_double_xM_result_7))),
  forall (p_6: (pointer double_xP)),
  forall (HW_24: p_6 = result7),
  forall (result8: double),
  forall (HW_25: (eq (double_value result8) (0)%R) /\
                 (eq (double_exact result8) (0)%R) /\
                 (eq (double_model result8) (0)%R)),
  forall (result9: (pointer doubleP)),
  forall (HW_26: result9 =
                 (select double_xP_double_xM_result_7 (shift p_6 0))),
  forall (doubleP_doubleM_double_xM_18_0: (memory doubleP double)),
  forall (HW_27: doubleP_doubleM_double_xM_18_0 =
                 (store doubleP_doubleM_double_xM_18 result9 result8)),
  forall (result10: int32),
  forall (HW_28: (integer_of_int32 result10) = 1),
  forall (i_6: int32),
  forall (HW_29: i_6 = result10),
  forall (doubleP_doubleM_double_xM_18_1: (memory doubleP double)),
  forall (i_6_0: int32),
  forall (HW_30: ( 1 <= (integer_of_int32 i_6_0) /\
                  (integer_of_int32 i_6_0) <=
                 (integer_of_int32 ni_0) /\
                 
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) ((integer_of_int32 i_6_0) - 1) 0 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_1))),
  forall (HW_40: (integer_of_int32 i_6_0) >= (integer_of_int32 ni_0)),
  forall (result11: double),
  forall (HW_41: (eq (double_value result11) (0)%R) /\
                 (eq (double_exact result11) (0)%R) /\
                 (eq (double_model result11) (0)%R)),
  forall (result12: (pointer doubleP)),
  forall (HW_42: result12 =
                 (select
                  double_xP_double_xM_result_7 (shift
                                                p_6 (integer_of_int32 ni_0)))),
  forall (doubleP_doubleM_double_xM_18_2: (memory doubleP double)),
  forall (HW_43: doubleP_doubleM_double_xM_18_2 =
                 (store doubleP_doubleM_double_xM_18_1 result12 result11)),
  forall (HW_44:
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) (integer_of_int32 ni_0) 0 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_2)),
  forall (result13: double),
  forall (HW_45: (eq (double_value result13) (0)%R) /\
                 (eq (double_exact result13) (0)%R) /\
                 (eq (double_model result13) (0)%R)),
  forall (result14: (pointer doubleP)),
  forall (HW_46: result14 =
                 (select double_xP_double_xM_result_7 (shift p_6 0))),
  forall (doubleP_doubleM_double_xM_18_3: (memory doubleP double)),
  forall (HW_47: doubleP_doubleM_double_xM_18_3 =
                 (store
                  doubleP_doubleM_double_xM_18_2 (shift result14 1) result13)),
  forall (result15: int32),
  forall (HW_48: (integer_of_int32 result15) = 1),
  forall (i_6_1: int32),
  forall (HW_49: i_6_1 = result15),
  forall (doubleP_doubleM_double_xM_18_4: (memory doubleP double)),
  forall (i_6_2: int32),
  forall (HW_50: ( 1 <= (integer_of_int32 i_6_2) /\
                  (integer_of_int32 i_6_2) <=
                 (integer_of_int32 ni_0) /\
                 
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) ((integer_of_int32 i_6_2) - 1) 1 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_4))),
  forall (HW_79: (integer_of_int32 i_6_2) >= (integer_of_int32 ni_0)),
  forall (result16: double),
  forall (HW_80: (eq (double_value result16) (0)%R) /\
                 (eq (double_exact result16) (0)%R) /\
                 (eq (double_model result16) (0)%R)),
  forall (result17: (pointer doubleP)),
  forall (HW_81: result17 =
                 (select
                  double_xP_double_xM_result_7 (shift
                                                p_6 (integer_of_int32 ni_0)))),
  forall (doubleP_doubleM_double_xM_18_5: (memory doubleP double)),
  forall (HW_82: doubleP_doubleM_double_xM_18_5 =
                 (store
                  doubleP_doubleM_double_xM_18_4 (shift result17 1) result16)),
  forall (HW_83:
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) (integer_of_int32 ni_0) 1 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_5)),
  forall (result18: int32),
  forall (HW_84: (integer_of_int32 result18) = 1),
  forall (k_7: int32),
  forall (HW_85: k_7 = result18),
  forall (doubleP_doubleM_double_xM_18_6: (memory doubleP double)),
  forall (k_7_0: int32),
  forall (HW_86: ( 1 <= (integer_of_int32 k_7_0) /\
                  (integer_of_int32 k_7_0) <=
                 (integer_of_int32 nk) /\
                 
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) (integer_of_int32 ni_0) (
                  integer_of_int32 k_7_0) a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_6))),
  forall (HW_88: (integer_of_int32 k_7_0) < (integer_of_int32 nk)),
  forall (result19: double),
  forall (HW_89: (eq (double_value result19) (0)%R) /\
                 (eq (double_exact result19) (0)%R) /\
                 (eq (double_model result19) (0)%R)),
  forall (result20: (pointer doubleP)),
  forall (HW_90: result20 =
                 (select double_xP_double_xM_result_7 (shift p_6 0))),
  forall (result21: int32),
  forall (HW_91: (integer_of_int32 result21) = ((integer_of_int32 k_7_0) + 1)),
  forall (doubleP_doubleM_double_xM_18_7: (memory doubleP double)),
  forall (HW_92: doubleP_doubleM_double_xM_18_7 =
                 (store
                  doubleP_doubleM_double_xM_18_6 (shift
                                                  result20 (integer_of_int32
                                                            result21)) result19)),
  forall (result22: int32),
  forall (HW_93: (integer_of_int32 result22) = 1),
  forall (i_6_3: int32),
  forall (HW_94: i_6_3 = result22),
  forall (doubleP_doubleM_double_xM_18_8: (memory doubleP double)),
  forall (i_6_4: int32),
  forall (HW_95: ( 1 <= (integer_of_int32 i_6_4) /\
                  (integer_of_int32 i_6_4) <=
                 (integer_of_int32 ni_0) /\
                 
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) ((integer_of_int32 i_6_4) - 1)
                  ((integer_of_int32 k_7_0) + 1) a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_8))),
  forall (HW_97: (integer_of_int32 i_6_4) < (integer_of_int32 ni_0)),
  forall (HW_98:
                 (Rle
                  (Rabs
                   (double_value
                    (select
                     doubleP_doubleM_double_xM_18_8 (shift
                                                     (select
                                                      double_xP_double_xM_result_7 (
                                                      shift
                                                      p_6 ((integer_of_int32
                                                            i_6_4) -
                                                          1))) (integer_of_int32
                                                                k_7_0)))))
                  (2)%R)),
  forall (HW_99:
                 (Rle
                  (Rabs
                   (double_value
                    (select
                     doubleP_doubleM_double_xM_18_8 (shift
                                                     (select
                                                      double_xP_double_xM_result_7 (
                                                      shift
                                                      p_6 (integer_of_int32
                                                           i_6_4))) (
                                                     integer_of_int32 k_7_0)))))
                  (2)%R)),
  forall (HW_100:
                  (Rle
                   (Rabs
                    (double_value
                     (select
                      doubleP_doubleM_double_xM_18_8 (shift
                                                      (select
                                                       double_xP_double_xM_result_7 (
                                                       shift
                                                       p_6 ((integer_of_int32
                                                             i_6_4) +
                                                           1))) (integer_of_int32
                                                                 k_7_0)))))
                   (2)%R)),
  forall (HW_101:
                  (Rle
                   (Rabs
                    (double_value
                     (select
                      doubleP_doubleM_double_xM_18_8 (shift
                                                      (select
                                                       double_xP_double_xM_result_7 (
                                                       shift
                                                       p_6 (integer_of_int32
                                                            i_6_4)))
                                                      ((integer_of_int32
                                                        k_7_0) -
                                                      1)))))
                   (2)%R)),
  forall (result23: int32),
  forall (HW_102: (integer_of_int32 result23) =
                  ((integer_of_int32 i_6_4) + 1)),
  forall (result24: (pointer doubleP)),
  forall (HW_103: result24 =
                  (select
                   double_xP_double_xM_result_7 (shift
                                                 p_6 (integer_of_int32
                                                      result23)))),
  forall (result25: double),
  forall (HW_104: result25 =
                  (select
                   doubleP_doubleM_double_xM_18_8 (shift
                                                   result24 (integer_of_int32
                                                             k_7_0)))),
  forall (result26: double),
  forall (HW_105: (eq (double_value result26) (2)%R) /\
                  (eq (double_exact result26) (2)%R) /\
                  (eq (double_model result26) (2)%R)),
  forall (result27: (pointer doubleP)),
  forall (HW_106: result27 =
                  (select
                   double_xP_double_xM_result_7 (shift
                                                 p_6 (integer_of_int32 i_6_4)))),
  forall (result28: double),
  forall (HW_107: result28 =
                  (select
                   doubleP_doubleM_double_xM_18_8 (shift
                                                   result27 (integer_of_int32
                                                             k_7_0)))),
  forall (result29: double),
  forall (HW_108: (mul_double_post nearest_even result26 result28 result29)),
  forall (result30: double),
  forall (HW_109: (sub_double_post nearest_even result25 result29 result30)),
  forall (result31: int32),
  forall (HW_110: (integer_of_int32 result31) =
                  ((integer_of_int32 i_6_4) - 1)),
  forall (result32: (pointer doubleP)),
  forall (HW_111: result32 =
                  (select
                   double_xP_double_xM_result_7 (shift
                                                 p_6 (integer_of_int32
                                                      result31)))),
  forall (result33: double),
  forall (HW_112: result33 =
                  (select
                   doubleP_doubleM_double_xM_18_8 (shift
                                                   result32 (integer_of_int32
                                                             k_7_0)))),
  forall (result34: double),
  forall (HW_113: (add_double_post nearest_even result30 result33 result34)),
  forall (dp: double),
  forall (HW_114: dp = result34),
  forall (result35: double),
  forall (HW_115: (eq (double_value result35) (2)%R) /\
                  (eq (double_exact result35) (2)%R) /\
                  (eq (double_model result35) (2)%R)),
  forall (result36: (pointer doubleP)),
  forall (HW_116: result36 =
                  (select
                   double_xP_double_xM_result_7 (shift
                                                 p_6 (integer_of_int32 i_6_4)))),
  forall (result37: double),
  forall (HW_117: result37 =
                  (select
                   doubleP_doubleM_double_xM_18_8 (shift
                                                   result36 (integer_of_int32
                                                             k_7_0)))),
  forall (result38: double),
  forall (HW_118: (mul_double_post nearest_even result35 result37 result38)),
  forall (result39: (pointer doubleP)),
  forall (HW_119: result39 =
                  (select
                   double_xP_double_xM_result_7 (shift
                                                 p_6 (integer_of_int32 i_6_4)))),
  forall (result40: int32),
  forall (HW_120: (integer_of_int32 result40) =
                  ((integer_of_int32 k_7_0) - 1)),
  forall (result41: double),
  forall (HW_121: result41 =
                  (select
                   doubleP_doubleM_double_xM_18_8 (shift
                                                   result39 (integer_of_int32
                                                             result40)))),
  forall (result42: double),
  forall (HW_122: (sub_double_post nearest_even result38 result41 result42)),
  forall (result43: double),
  forall (HW_123: (mul_double_post nearest_even a_1 dp result43)),
  forall (result44: double),
  forall (HW_124: (add_double_post nearest_even result42 result43 result44)),
  forall (result45: (pointer doubleP)),
  forall (HW_125: result45 =
                  (select
                   double_xP_double_xM_result_7 (shift
                                                 p_6 (integer_of_int32 i_6_4)))),
  forall (result46: int32),
  forall (HW_126: (integer_of_int32 result46) =
                  ((integer_of_int32 k_7_0) + 1)),
  forall (doubleP_doubleM_double_xM_18_9: (memory doubleP double)),
  forall (HW_127: doubleP_doubleM_double_xM_18_9 =
                  (store
                   doubleP_doubleM_double_xM_18_8 (shift
                                                   result45 (integer_of_int32
                                                             result46)) result44)),
  forall (result47: int32),
  forall (HW_128: (integer_of_int32 result47) =
                  ((integer_of_int32 i_6_4) + 1)),
  forall (i_6_5: int32),
  forall (HW_129: i_6_5 = result47),
  
  
  (analytic_error
   p_6 (integer_of_int32 ni_0) ((integer_of_int32 i_6_5) - 1) ((integer_of_int32
                                                                k_7_0) +
                                                              1) a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_9).

Lemma forward_prop_ensures_default_po_39 :
  forall (ni_0: int32),
  forall (nk: int32),
  forall (dt: double),
  forall (v: double),
  forall (l: double),
  forall (doubleP_double_xM_18_alloc_table: (alloc_table doubleP)),
  forall (double_xP_result_7_alloc_table: (alloc_table double_xP)),
  forall (double_xP_double_xM_result_7: (memory double_xP (pointer doubleP))),
  forall (doubleP_doubleM_double_xM_18: (memory doubleP double)),
  forall (HW_1: ( (integer_of_int32 ni_0) >= 2 /\
                 (integer_of_int32 nk) >= 2 /\
                 ~(eq (double_value l) (0)%R) /\
                 (Rgt (double_value dt) (0)%R) /\
                 (Rgt (double_exact dt) (0)%R) /\
                 (eq (double_exact v) c) /\
                 (eq (double_exact v) (double_value v)) /\
                
                (Rle
                 (1 / 10715086071862673209484250490600018105614048117055336074437503883703510511249361224931983788156958581275946729175531468251871452856923140435984577574698574803934567774824230985421074605062371141877954182153046474983581941267398767559165543946077062914571196477686542167660429831652624386837205668069376)%R
                 (double_exact dt)) /\
                 (integer_of_int32 ni_0) <= 2147483646 /\
                 (integer_of_int32 nk) <= 7598581 /\
                
                (Rle (Rmult (IZR (integer_of_int32 nk)) (double_exact dt))
                 T_max) /\
                
                (Rle
                 (Rdiv
                  (Rabs (Rminus (double_exact dt) (double_value dt))) (
                  double_value dt))
                 (1 / 2251799813685248)%R) /\
                
                (Rle
                 (1 / 3273390607896141870013189696827599152216642046043064789483291368096133796404674554883270092325904157150886684127560071009217256545885393053328527589376)%R
                 (Rmult
                  (Rmult (double_exact dt) (IZR (integer_of_int32 ni_0))) c)) /\
                
                (Rle
                 (Rmult
                  (Rmult (double_exact dt) (IZR (integer_of_int32 ni_0))) c)
                 (Rminus (1)%R (1 / 1125899906842624)%R)) /\
                
                (Rlt
                 (sqrt
                  (Rplus
                   (Rdiv
                    (1)%R (IZR
                           ((integer_of_int32 ni_0) *
                           (integer_of_int32 ni_0)))) (Rmult
                                                       (double_exact dt) (
                                                       double_exact dt))))
                 alpha_conv))),
  forall (result: double),
  forall (HW_10: (eq (double_value result) (1)%R) /\
                 (eq (double_exact result) (1)%R) /\
                 (eq (double_model result) (1)%R)),
  forall (result0: double),
  forall (HW_11: (double_of_real_post
                  nearest_even (IZR (integer_of_int32 ni_0)) result0)),
  forall (result1: double),
  forall (HW_12: ~(eq (double_value result0) (0)%R) /\
                 (div_double_post nearest_even result result0 result1)),
  forall (dx_8: double),
  forall (HW_13: dx_8 = result1),
  forall (HW_14:
                 ( (Rgt (double_value dx_8) (0)%R) /\
                  (Rle (double_value dx_8) (05 / 10)%R) /\
                 
                 (Rle
                  (Rdiv
                   (Rabs (Rminus (double_exact dx_8) (double_value dx_8))) (
                   double_value dx_8))
                  (1 / 9007199254740992)%R))),
  forall (result2: double),
  forall (HW_15: ~(eq (double_value dx_8) (0)%R) /\
                 (div_double_post nearest_even dt dx_8 result2)),
  forall (result3: double),
  forall (HW_16: (mul_double_post nearest_even result2 v result3)),
  forall (a1: double),
  forall (HW_17: a1 = result3),
  forall (result4: double),
  forall (HW_18: (mul_double_post nearest_even a1 a1 result4)),
  forall (a_1: double),
  forall (HW_19: a_1 = result4),
  forall (HW_20: ( (Rle (0)%R (double_value a_1)) /\
                  (Rle (double_value a_1) (1)%R) /\
                  (Rlt (0)%R (double_exact a_1)) /\
                  (Rle (double_exact a_1) (1)%R) /\
                 
                 (Rle (double_round_error a_1) (1 / 562949953421312)%R))),
  forall (result5: int32),
  forall (HW_21: (integer_of_int32 result5) = ((integer_of_int32 ni_0) + 1)),
  forall (result6: int32),
  forall (HW_22: (integer_of_int32 result6) = ((integer_of_int32 nk) + 1)),
  forall (result7: (pointer double_xP)),
  forall (HW_23:
                 (
                  (offset_min double_xP_result_7_alloc_table result7) <= 0 /\
                 
                 (offset_max double_xP_result_7_alloc_table result7) >=
                 ((integer_of_int32 result5) - 1) /\
                 
                 (forall (i_4:Z),
                  (0 <= i_4 /\ i_4 < (integer_of_int32 result5) ->
                   (offset_min
                    doubleP_double_xM_18_alloc_table (select
                                                      double_xP_double_xM_result_7 (
                                                      shift result7 i_4))) <=
                   0 /\
                   (offset_max
                    doubleP_double_xM_18_alloc_table (select
                                                      double_xP_double_xM_result_7 (
                                                      shift result7 i_4))) >=
                   ((integer_of_int32 result6) - 1))) /\
                 
                 (separated_matrix
                  result7 (integer_of_int32 result5) double_xP_double_xM_result_7))),
  forall (p_6: (pointer double_xP)),
  forall (HW_24: p_6 = result7),
  forall (result8: double),
  forall (HW_25: (eq (double_value result8) (0)%R) /\
                 (eq (double_exact result8) (0)%R) /\
                 (eq (double_model result8) (0)%R)),
  forall (result9: (pointer doubleP)),
  forall (HW_26: result9 =
                 (select double_xP_double_xM_result_7 (shift p_6 0))),
  forall (doubleP_doubleM_double_xM_18_0: (memory doubleP double)),
  forall (HW_27: doubleP_doubleM_double_xM_18_0 =
                 (store doubleP_doubleM_double_xM_18 result9 result8)),
  forall (result10: int32),
  forall (HW_28: (integer_of_int32 result10) = 1),
  forall (i_6: int32),
  forall (HW_29: i_6 = result10),
  forall (doubleP_doubleM_double_xM_18_1: (memory doubleP double)),
  forall (i_6_0: int32),
  forall (HW_30: ( 1 <= (integer_of_int32 i_6_0) /\
                  (integer_of_int32 i_6_0) <=
                 (integer_of_int32 ni_0) /\
                 
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) ((integer_of_int32 i_6_0) - 1) 0 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_1))),
  forall (HW_40: (integer_of_int32 i_6_0) >= (integer_of_int32 ni_0)),
  forall (result11: double),
  forall (HW_41: (eq (double_value result11) (0)%R) /\
                 (eq (double_exact result11) (0)%R) /\
                 (eq (double_model result11) (0)%R)),
  forall (result12: (pointer doubleP)),
  forall (HW_42: result12 =
                 (select
                  double_xP_double_xM_result_7 (shift
                                                p_6 (integer_of_int32 ni_0)))),
  forall (doubleP_doubleM_double_xM_18_2: (memory doubleP double)),
  forall (HW_43: doubleP_doubleM_double_xM_18_2 =
                 (store doubleP_doubleM_double_xM_18_1 result12 result11)),
  forall (HW_44:
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) (integer_of_int32 ni_0) 0 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_2)),
  forall (result13: double),
  forall (HW_45: (eq (double_value result13) (0)%R) /\
                 (eq (double_exact result13) (0)%R) /\
                 (eq (double_model result13) (0)%R)),
  forall (result14: (pointer doubleP)),
  forall (HW_46: result14 =
                 (select double_xP_double_xM_result_7 (shift p_6 0))),
  forall (doubleP_doubleM_double_xM_18_3: (memory doubleP double)),
  forall (HW_47: doubleP_doubleM_double_xM_18_3 =
                 (store
                  doubleP_doubleM_double_xM_18_2 (shift result14 1) result13)),
  forall (result15: int32),
  forall (HW_48: (integer_of_int32 result15) = 1),
  forall (i_6_1: int32),
  forall (HW_49: i_6_1 = result15),
  forall (doubleP_doubleM_double_xM_18_4: (memory doubleP double)),
  forall (i_6_2: int32),
  forall (HW_50: ( 1 <= (integer_of_int32 i_6_2) /\
                  (integer_of_int32 i_6_2) <=
                 (integer_of_int32 ni_0) /\
                 
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) ((integer_of_int32 i_6_2) - 1) 1 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_4))),
  forall (HW_79: (integer_of_int32 i_6_2) >= (integer_of_int32 ni_0)),
  forall (result16: double),
  forall (HW_80: (eq (double_value result16) (0)%R) /\
                 (eq (double_exact result16) (0)%R) /\
                 (eq (double_model result16) (0)%R)),
  forall (result17: (pointer doubleP)),
  forall (HW_81: result17 =
                 (select
                  double_xP_double_xM_result_7 (shift
                                                p_6 (integer_of_int32 ni_0)))),
  forall (doubleP_doubleM_double_xM_18_5: (memory doubleP double)),
  forall (HW_82: doubleP_doubleM_double_xM_18_5 =
                 (store
                  doubleP_doubleM_double_xM_18_4 (shift result17 1) result16)),
  forall (HW_83:
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) (integer_of_int32 ni_0) 1 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_5)),
  forall (result18: int32),
  forall (HW_84: (integer_of_int32 result18) = 1),
  forall (k_7: int32),
  forall (HW_85: k_7 = result18),
  forall (doubleP_doubleM_double_xM_18_6: (memory doubleP double)),
  forall (k_7_0: int32),
  forall (HW_86: ( 1 <= (integer_of_int32 k_7_0) /\
                  (integer_of_int32 k_7_0) <=
                 (integer_of_int32 nk) /\
                 
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) (integer_of_int32 ni_0) (
                  integer_of_int32 k_7_0) a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_6))),
  forall (HW_88: (integer_of_int32 k_7_0) < (integer_of_int32 nk)),
  forall (result19: double),
  forall (HW_89: (eq (double_value result19) (0)%R) /\
                 (eq (double_exact result19) (0)%R) /\
                 (eq (double_model result19) (0)%R)),
  forall (result20: (pointer doubleP)),
  forall (HW_90: result20 =
                 (select double_xP_double_xM_result_7 (shift p_6 0))),
  forall (result21: int32),
  forall (HW_91: (integer_of_int32 result21) = ((integer_of_int32 k_7_0) + 1)),
  forall (doubleP_doubleM_double_xM_18_7: (memory doubleP double)),
  forall (HW_92: doubleP_doubleM_double_xM_18_7 =
                 (store
                  doubleP_doubleM_double_xM_18_6 (shift
                                                  result20 (integer_of_int32
                                                            result21)) result19)),
  forall (result22: int32),
  forall (HW_93: (integer_of_int32 result22) = 1),
  forall (i_6_3: int32),
  forall (HW_94: i_6_3 = result22),
  forall (doubleP_doubleM_double_xM_18_8: (memory doubleP double)),
  forall (i_6_4: int32),
  forall (HW_95: ( 1 <= (integer_of_int32 i_6_4) /\
                  (integer_of_int32 i_6_4) <=
                 (integer_of_int32 ni_0) /\
                 
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) ((integer_of_int32 i_6_4) - 1)
                  ((integer_of_int32 k_7_0) + 1) a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_8))),
  forall (HW_130: (integer_of_int32 i_6_4) >= (integer_of_int32 ni_0)),
  forall (result23: double),
  forall (HW_131: (eq (double_value result23) (0)%R) /\
                  (eq (double_exact result23) (0)%R) /\
                  (eq (double_model result23) (0)%R)),
  forall (result24: (pointer doubleP)),
  forall (HW_132: result24 =
                  (select
                   double_xP_double_xM_result_7 (shift
                                                 p_6 (integer_of_int32 ni_0)))),
  forall (result25: int32),
  forall (HW_133: (integer_of_int32 result25) =
                  ((integer_of_int32 k_7_0) + 1)),
  forall (doubleP_doubleM_double_xM_18_9: (memory doubleP double)),
  forall (HW_134: doubleP_doubleM_double_xM_18_9 =
                  (store
                   doubleP_doubleM_double_xM_18_8 (shift
                                                   result24 (integer_of_int32
                                                             result25)) result23)),
  
  (analytic_error
   p_6 (integer_of_int32 ni_0) (integer_of_int32 ni_0) ((integer_of_int32
                                                         k_7_0) +
                                                       1) a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_9).

Lemma forward_prop_ensures_default_po_43 :
  forall (ni_0: int32),
  forall (nk: int32),
  forall (dt: double),
  forall (v: double),
  forall (l: double),
  forall (doubleP_double_xM_18_alloc_table: (alloc_table doubleP)),
  forall (double_xP_result_7_alloc_table: (alloc_table double_xP)),
  forall (double_xP_double_xM_result_7: (memory double_xP (pointer doubleP))),
  forall (doubleP_doubleM_double_xM_18: (memory doubleP double)),
  forall (HW_1: ( (integer_of_int32 ni_0) >= 2 /\
                 (integer_of_int32 nk) >= 2 /\
                 ~(eq (double_value l) (0)%R) /\
                 (Rgt (double_value dt) (0)%R) /\
                 (Rgt (double_exact dt) (0)%R) /\
                 (eq (double_exact v) c) /\
                 (eq (double_exact v) (double_value v)) /\
                
                (Rle
                 (1 / 10715086071862673209484250490600018105614048117055336074437503883703510511249361224931983788156958581275946729175531468251871452856923140435984577574698574803934567774824230985421074605062371141877954182153046474983581941267398767559165543946077062914571196477686542167660429831652624386837205668069376)%R
                 (double_exact dt)) /\
                 (integer_of_int32 ni_0) <= 2147483646 /\
                 (integer_of_int32 nk) <= 7598581 /\
                
                (Rle (Rmult (IZR (integer_of_int32 nk)) (double_exact dt))
                 T_max) /\
                
                (Rle
                 (Rdiv
                  (Rabs (Rminus (double_exact dt) (double_value dt))) (
                  double_value dt))
                 (1 / 2251799813685248)%R) /\
                
                (Rle
                 (1 / 3273390607896141870013189696827599152216642046043064789483291368096133796404674554883270092325904157150886684127560071009217256545885393053328527589376)%R
                 (Rmult
                  (Rmult (double_exact dt) (IZR (integer_of_int32 ni_0))) c)) /\
                
                (Rle
                 (Rmult
                  (Rmult (double_exact dt) (IZR (integer_of_int32 ni_0))) c)
                 (Rminus (1)%R (1 / 1125899906842624)%R)) /\
                
                (Rlt
                 (sqrt
                  (Rplus
                   (Rdiv
                    (1)%R (IZR
                           ((integer_of_int32 ni_0) *
                           (integer_of_int32 ni_0)))) (Rmult
                                                       (double_exact dt) (
                                                       double_exact dt))))
                 alpha_conv))),
  forall (result: double),
  forall (HW_10: (eq (double_value result) (1)%R) /\
                 (eq (double_exact result) (1)%R) /\
                 (eq (double_model result) (1)%R)),
  forall (result0: double),
  forall (HW_11: (double_of_real_post
                  nearest_even (IZR (integer_of_int32 ni_0)) result0)),
  forall (result1: double),
  forall (HW_12: ~(eq (double_value result0) (0)%R) /\
                 (div_double_post nearest_even result result0 result1)),
  forall (dx_8: double),
  forall (HW_13: dx_8 = result1),
  forall (HW_14:
                 ( (Rgt (double_value dx_8) (0)%R) /\
                  (Rle (double_value dx_8) (05 / 10)%R) /\
                 
                 (Rle
                  (Rdiv
                   (Rabs (Rminus (double_exact dx_8) (double_value dx_8))) (
                   double_value dx_8))
                  (1 / 9007199254740992)%R))),
  forall (result2: double),
  forall (HW_15: ~(eq (double_value dx_8) (0)%R) /\
                 (div_double_post nearest_even dt dx_8 result2)),
  forall (result3: double),
  forall (HW_16: (mul_double_post nearest_even result2 v result3)),
  forall (a1: double),
  forall (HW_17: a1 = result3),
  forall (result4: double),
  forall (HW_18: (mul_double_post nearest_even a1 a1 result4)),
  forall (a_1: double),
  forall (HW_19: a_1 = result4),
  forall (HW_20: ( (Rle (0)%R (double_value a_1)) /\
                  (Rle (double_value a_1) (1)%R) /\
                  (Rlt (0)%R (double_exact a_1)) /\
                  (Rle (double_exact a_1) (1)%R) /\
                 
                 (Rle (double_round_error a_1) (1 / 562949953421312)%R))),
  forall (result5: int32),
  forall (HW_21: (integer_of_int32 result5) = ((integer_of_int32 ni_0) + 1)),
  forall (result6: int32),
  forall (HW_22: (integer_of_int32 result6) = ((integer_of_int32 nk) + 1)),
  forall (result7: (pointer double_xP)),
  forall (HW_23:
                 (
                  (offset_min double_xP_result_7_alloc_table result7) <= 0 /\
                 
                 (offset_max double_xP_result_7_alloc_table result7) >=
                 ((integer_of_int32 result5) - 1) /\
                 
                 (forall (i_4:Z),
                  (0 <= i_4 /\ i_4 < (integer_of_int32 result5) ->
                   (offset_min
                    doubleP_double_xM_18_alloc_table (select
                                                      double_xP_double_xM_result_7 (
                                                      shift result7 i_4))) <=
                   0 /\
                   (offset_max
                    doubleP_double_xM_18_alloc_table (select
                                                      double_xP_double_xM_result_7 (
                                                      shift result7 i_4))) >=
                   ((integer_of_int32 result6) - 1))) /\
                 
                 (separated_matrix
                  result7 (integer_of_int32 result5) double_xP_double_xM_result_7))),
  forall (p_6: (pointer double_xP)),
  forall (HW_24: p_6 = result7),
  forall (result8: double),
  forall (HW_25: (eq (double_value result8) (0)%R) /\
                 (eq (double_exact result8) (0)%R) /\
                 (eq (double_model result8) (0)%R)),
  forall (result9: (pointer doubleP)),
  forall (HW_26: result9 =
                 (select double_xP_double_xM_result_7 (shift p_6 0))),
  forall (doubleP_doubleM_double_xM_18_0: (memory doubleP double)),
  forall (HW_27: doubleP_doubleM_double_xM_18_0 =
                 (store doubleP_doubleM_double_xM_18 result9 result8)),
  forall (result10: int32),
  forall (HW_28: (integer_of_int32 result10) = 1),
  forall (i_6: int32),
  forall (HW_29: i_6 = result10),
  forall (doubleP_doubleM_double_xM_18_1: (memory doubleP double)),
  forall (i_6_0: int32),
  forall (HW_30: ( 1 <= (integer_of_int32 i_6_0) /\
                  (integer_of_int32 i_6_0) <=
                 (integer_of_int32 ni_0) /\
                 
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) ((integer_of_int32 i_6_0) - 1) 0 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_1))),
  forall (HW_40: (integer_of_int32 i_6_0) >= (integer_of_int32 ni_0)),
  forall (result11: double),
  forall (HW_41: (eq (double_value result11) (0)%R) /\
                 (eq (double_exact result11) (0)%R) /\
                 (eq (double_model result11) (0)%R)),
  forall (result12: (pointer doubleP)),
  forall (HW_42: result12 =
                 (select
                  double_xP_double_xM_result_7 (shift
                                                p_6 (integer_of_int32 ni_0)))),
  forall (doubleP_doubleM_double_xM_18_2: (memory doubleP double)),
  forall (HW_43: doubleP_doubleM_double_xM_18_2 =
                 (store doubleP_doubleM_double_xM_18_1 result12 result11)),
  forall (HW_44:
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) (integer_of_int32 ni_0) 0 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_2)),
  forall (result13: double),
  forall (HW_45: (eq (double_value result13) (0)%R) /\
                 (eq (double_exact result13) (0)%R) /\
                 (eq (double_model result13) (0)%R)),
  forall (result14: (pointer doubleP)),
  forall (HW_46: result14 =
                 (select double_xP_double_xM_result_7 (shift p_6 0))),
  forall (doubleP_doubleM_double_xM_18_3: (memory doubleP double)),
  forall (HW_47: doubleP_doubleM_double_xM_18_3 =
                 (store
                  doubleP_doubleM_double_xM_18_2 (shift result14 1) result13)),
  forall (result15: int32),
  forall (HW_48: (integer_of_int32 result15) = 1),
  forall (i_6_1: int32),
  forall (HW_49: i_6_1 = result15),
  forall (doubleP_doubleM_double_xM_18_4: (memory doubleP double)),
  forall (i_6_2: int32),
  forall (HW_50: ( 1 <= (integer_of_int32 i_6_2) /\
                  (integer_of_int32 i_6_2) <=
                 (integer_of_int32 ni_0) /\
                 
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) ((integer_of_int32 i_6_2) - 1) 1 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_4))),
  forall (HW_79: (integer_of_int32 i_6_2) >= (integer_of_int32 ni_0)),
  forall (result16: double),
  forall (HW_80: (eq (double_value result16) (0)%R) /\
                 (eq (double_exact result16) (0)%R) /\
                 (eq (double_model result16) (0)%R)),
  forall (result17: (pointer doubleP)),
  forall (HW_81: result17 =
                 (select
                  double_xP_double_xM_result_7 (shift
                                                p_6 (integer_of_int32 ni_0)))),
  forall (doubleP_doubleM_double_xM_18_5: (memory doubleP double)),
  forall (HW_82: doubleP_doubleM_double_xM_18_5 =
                 (store
                  doubleP_doubleM_double_xM_18_4 (shift result17 1) result16)),
  forall (HW_83:
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) (integer_of_int32 ni_0) 1 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_5)),
  forall (result18: int32),
  forall (HW_84: (integer_of_int32 result18) = 1),
  forall (k_7: int32),
  forall (HW_85: k_7 = result18),
  forall (doubleP_doubleM_double_xM_18_6: (memory doubleP double)),
  forall (k_7_0: int32),
  forall (HW_86: ( 1 <= (integer_of_int32 k_7_0) /\
                  (integer_of_int32 k_7_0) <=
                 (integer_of_int32 nk) /\
                 
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) (integer_of_int32 ni_0) (
                  integer_of_int32 k_7_0) a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_6))),
  forall (HW_138: (integer_of_int32 k_7_0) >= (integer_of_int32 nk)),
  forall (why__return: (pointer double_xP)),
  forall (HW_139: why__return = p_6),
  forall (i_5: Z),
  forall (k_5: Z),
  forall (HW_140: 0 <= i_5 /\ i_5 <= (integer_of_int32 ni_0)),
  forall (HW_141: 0 <= k_5 /\ k_5 <= (integer_of_int32 nk)),
  
  
  (Rle
   (double_round_error
    (select
     doubleP_doubleM_double_xM_18_6 (shift
                                     (select
                                      double_xP_double_xM_result_7 (shift
                                                                    why__return i_5)) k_5)))
   (Rmult
    (Rmult
     (Rmult (Rdiv (78)%R (2)%R) (1 / 4503599627370496)%R) (IZR (k_5 + 1))) (
    IZR (k_5 + 2)))).

Lemma forward_prop_ensures_default_po_44 :
  forall (ni_0: int32),
  forall (nk: int32),
  forall (dt: double),
  forall (v: double),
  forall (l: double),
  forall (doubleP_double_xM_18_alloc_table: (alloc_table doubleP)),
  forall (double_xP_result_7_alloc_table: (alloc_table double_xP)),
  forall (double_xP_double_xM_result_7: (memory double_xP (pointer doubleP))),
  forall (doubleP_doubleM_double_xM_18: (memory doubleP double)),
  forall (HW_1: ( (integer_of_int32 ni_0) >= 2 /\
                 (integer_of_int32 nk) >= 2 /\
                 ~(eq (double_value l) (0)%R) /\
                 (Rgt (double_value dt) (0)%R) /\
                 (Rgt (double_exact dt) (0)%R) /\
                 (eq (double_exact v) c) /\
                 (eq (double_exact v) (double_value v)) /\
                
                (Rle
                 (1 / 10715086071862673209484250490600018105614048117055336074437503883703510511249361224931983788156958581275946729175531468251871452856923140435984577574698574803934567774824230985421074605062371141877954182153046474983581941267398767559165543946077062914571196477686542167660429831652624386837205668069376)%R
                 (double_exact dt)) /\
                 (integer_of_int32 ni_0) <= 2147483646 /\
                 (integer_of_int32 nk) <= 7598581 /\
                
                (Rle (Rmult (IZR (integer_of_int32 nk)) (double_exact dt))
                 T_max) /\
                
                (Rle
                 (Rdiv
                  (Rabs (Rminus (double_exact dt) (double_value dt))) (
                  double_value dt))
                 (1 / 2251799813685248)%R) /\
                
                (Rle
                 (1 / 3273390607896141870013189696827599152216642046043064789483291368096133796404674554883270092325904157150886684127560071009217256545885393053328527589376)%R
                 (Rmult
                  (Rmult (double_exact dt) (IZR (integer_of_int32 ni_0))) c)) /\
                
                (Rle
                 (Rmult
                  (Rmult (double_exact dt) (IZR (integer_of_int32 ni_0))) c)
                 (Rminus (1)%R (1 / 1125899906842624)%R)) /\
                
                (Rlt
                 (sqrt
                  (Rplus
                   (Rdiv
                    (1)%R (IZR
                           ((integer_of_int32 ni_0) *
                           (integer_of_int32 ni_0)))) (Rmult
                                                       (double_exact dt) (
                                                       double_exact dt))))
                 alpha_conv))),
  forall (result: double),
  forall (HW_10: (eq (double_value result) (1)%R) /\
                 (eq (double_exact result) (1)%R) /\
                 (eq (double_model result) (1)%R)),
  forall (result0: double),
  forall (HW_11: (double_of_real_post
                  nearest_even (IZR (integer_of_int32 ni_0)) result0)),
  forall (result1: double),
  forall (HW_12: ~(eq (double_value result0) (0)%R) /\
                 (div_double_post nearest_even result result0 result1)),
  forall (dx_8: double),
  forall (HW_13: dx_8 = result1),
  forall (HW_14:
                 ( (Rgt (double_value dx_8) (0)%R) /\
                  (Rle (double_value dx_8) (05 / 10)%R) /\
                 
                 (Rle
                  (Rdiv
                   (Rabs (Rminus (double_exact dx_8) (double_value dx_8))) (
                   double_value dx_8))
                  (1 / 9007199254740992)%R))),
  forall (result2: double),
  forall (HW_15: ~(eq (double_value dx_8) (0)%R) /\
                 (div_double_post nearest_even dt dx_8 result2)),
  forall (result3: double),
  forall (HW_16: (mul_double_post nearest_even result2 v result3)),
  forall (a1: double),
  forall (HW_17: a1 = result3),
  forall (result4: double),
  forall (HW_18: (mul_double_post nearest_even a1 a1 result4)),
  forall (a_1: double),
  forall (HW_19: a_1 = result4),
  forall (HW_20: ( (Rle (0)%R (double_value a_1)) /\
                  (Rle (double_value a_1) (1)%R) /\
                  (Rlt (0)%R (double_exact a_1)) /\
                  (Rle (double_exact a_1) (1)%R) /\
                 
                 (Rle (double_round_error a_1) (1 / 562949953421312)%R))),
  forall (result5: int32),
  forall (HW_21: (integer_of_int32 result5) = ((integer_of_int32 ni_0) + 1)),
  forall (result6: int32),
  forall (HW_22: (integer_of_int32 result6) = ((integer_of_int32 nk) + 1)),
  forall (result7: (pointer double_xP)),
  forall (HW_23:
                 (
                  (offset_min double_xP_result_7_alloc_table result7) <= 0 /\
                 
                 (offset_max double_xP_result_7_alloc_table result7) >=
                 ((integer_of_int32 result5) - 1) /\
                 
                 (forall (i_4:Z),
                  (0 <= i_4 /\ i_4 < (integer_of_int32 result5) ->
                   (offset_min
                    doubleP_double_xM_18_alloc_table (select
                                                      double_xP_double_xM_result_7 (
                                                      shift result7 i_4))) <=
                   0 /\
                   (offset_max
                    doubleP_double_xM_18_alloc_table (select
                                                      double_xP_double_xM_result_7 (
                                                      shift result7 i_4))) >=
                   ((integer_of_int32 result6) - 1))) /\
                 
                 (separated_matrix
                  result7 (integer_of_int32 result5) double_xP_double_xM_result_7))),
  forall (p_6: (pointer double_xP)),
  forall (HW_24: p_6 = result7),
  forall (result8: double),
  forall (HW_25: (eq (double_value result8) (0)%R) /\
                 (eq (double_exact result8) (0)%R) /\
                 (eq (double_model result8) (0)%R)),
  forall (result9: (pointer doubleP)),
  forall (HW_26: result9 =
                 (select double_xP_double_xM_result_7 (shift p_6 0))),
  forall (doubleP_doubleM_double_xM_18_0: (memory doubleP double)),
  forall (HW_27: doubleP_doubleM_double_xM_18_0 =
                 (store doubleP_doubleM_double_xM_18 result9 result8)),
  forall (result10: int32),
  forall (HW_28: (integer_of_int32 result10) = 1),
  forall (i_6: int32),
  forall (HW_29: i_6 = result10),
  forall (doubleP_doubleM_double_xM_18_1: (memory doubleP double)),
  forall (i_6_0: int32),
  forall (HW_30: ( 1 <= (integer_of_int32 i_6_0) /\
                  (integer_of_int32 i_6_0) <=
                 (integer_of_int32 ni_0) /\
                 
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) ((integer_of_int32 i_6_0) - 1) 0 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_1))),
  forall (HW_40: (integer_of_int32 i_6_0) >= (integer_of_int32 ni_0)),
  forall (result11: double),
  forall (HW_41: (eq (double_value result11) (0)%R) /\
                 (eq (double_exact result11) (0)%R) /\
                 (eq (double_model result11) (0)%R)),
  forall (result12: (pointer doubleP)),
  forall (HW_42: result12 =
                 (select
                  double_xP_double_xM_result_7 (shift
                                                p_6 (integer_of_int32 ni_0)))),
  forall (doubleP_doubleM_double_xM_18_2: (memory doubleP double)),
  forall (HW_43: doubleP_doubleM_double_xM_18_2 =
                 (store doubleP_doubleM_double_xM_18_1 result12 result11)),
  forall (HW_44:
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) (integer_of_int32 ni_0) 0 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_2)),
  forall (result13: double),
  forall (HW_45: (eq (double_value result13) (0)%R) /\
                 (eq (double_exact result13) (0)%R) /\
                 (eq (double_model result13) (0)%R)),
  forall (result14: (pointer doubleP)),
  forall (HW_46: result14 =
                 (select double_xP_double_xM_result_7 (shift p_6 0))),
  forall (doubleP_doubleM_double_xM_18_3: (memory doubleP double)),
  forall (HW_47: doubleP_doubleM_double_xM_18_3 =
                 (store
                  doubleP_doubleM_double_xM_18_2 (shift result14 1) result13)),
  forall (result15: int32),
  forall (HW_48: (integer_of_int32 result15) = 1),
  forall (i_6_1: int32),
  forall (HW_49: i_6_1 = result15),
  forall (doubleP_doubleM_double_xM_18_4: (memory doubleP double)),
  forall (i_6_2: int32),
  forall (HW_50: ( 1 <= (integer_of_int32 i_6_2) /\
                  (integer_of_int32 i_6_2) <=
                 (integer_of_int32 ni_0) /\
                 
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) ((integer_of_int32 i_6_2) - 1) 1 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_4))),
  forall (HW_79: (integer_of_int32 i_6_2) >= (integer_of_int32 ni_0)),
  forall (result16: double),
  forall (HW_80: (eq (double_value result16) (0)%R) /\
                 (eq (double_exact result16) (0)%R) /\
                 (eq (double_model result16) (0)%R)),
  forall (result17: (pointer doubleP)),
  forall (HW_81: result17 =
                 (select
                  double_xP_double_xM_result_7 (shift
                                                p_6 (integer_of_int32 ni_0)))),
  forall (doubleP_doubleM_double_xM_18_5: (memory doubleP double)),
  forall (HW_82: doubleP_doubleM_double_xM_18_5 =
                 (store
                  doubleP_doubleM_double_xM_18_4 (shift result17 1) result16)),
  forall (HW_83:
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) (integer_of_int32 ni_0) 1 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_5)),
  forall (result18: int32),
  forall (HW_84: (integer_of_int32 result18) = 1),
  forall (k_7: int32),
  forall (HW_85: k_7 = result18),
  forall (doubleP_doubleM_double_xM_18_6: (memory doubleP double)),
  forall (k_7_0: int32),
  forall (HW_86: ( 1 <= (integer_of_int32 k_7_0) /\
                  (integer_of_int32 k_7_0) <=
                 (integer_of_int32 nk) /\
                 
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) (integer_of_int32 ni_0) (
                  integer_of_int32 k_7_0) a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_6))),
  forall (HW_138: (integer_of_int32 k_7_0) >= (integer_of_int32 nk)),
  forall (why__return: (pointer double_xP)),
  forall (HW_139: why__return = p_6),
  forall (k_6: Z),
  forall (HW_142: 0 <= k_6 /\ k_6 <= (integer_of_int32 nk)),
  
  
  (Rle
   (norm_dx_conv_err
    why__return (double_exact dt) (integer_of_int32 ni_0) k_6 double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_6)
   (Rmult
    C_conv (Rplus
            (Rdiv
             (1)%R (IZR ((integer_of_int32 ni_0) * (integer_of_int32 ni_0)))) (
            Rmult (double_exact dt) (double_exact dt))))).

Lemma forward_prop_safety_po_5 :
  forall (ni_0: int32),
  forall (nk: int32),
  forall (dt: double),
  forall (v: double),
  forall (l: double),
  forall (HW_1: ( (integer_of_int32 ni_0) >= 2 /\
                 (integer_of_int32 nk) >= 2 /\
                 ~(eq (double_value l) (0)%R) /\
                 (Rgt (double_value dt) (0)%R) /\
                 (Rgt (double_exact dt) (0)%R) /\
                 (eq (double_exact v) c) /\
                 (eq (double_exact v) (double_value v)) /\
                
                (Rle
                 (1 / 10715086071862673209484250490600018105614048117055336074437503883703510511249361224931983788156958581275946729175531468251871452856923140435984577574698574803934567774824230985421074605062371141877954182153046474983581941267398767559165543946077062914571196477686542167660429831652624386837205668069376)%R
                 (double_exact dt)) /\
                 (integer_of_int32 ni_0) <= 2147483646 /\
                 (integer_of_int32 nk) <= 7598581 /\
                
                (Rle (Rmult (IZR (integer_of_int32 nk)) (double_exact dt))
                 T_max) /\
                
                (Rle
                 (Rdiv
                  (Rabs (Rminus (double_exact dt) (double_value dt))) (
                  double_value dt))
                 (1 / 2251799813685248)%R) /\
                
                (Rle
                 (1 / 3273390607896141870013189696827599152216642046043064789483291368096133796404674554883270092325904157150886684127560071009217256545885393053328527589376)%R
                 (Rmult
                  (Rmult (double_exact dt) (IZR (integer_of_int32 ni_0))) c)) /\
                
                (Rle
                 (Rmult
                  (Rmult (double_exact dt) (IZR (integer_of_int32 ni_0))) c)
                 (Rminus (1)%R (1 / 1125899906842624)%R)) /\
                
                (Rlt
                 (sqrt
                  (Rplus
                   (Rdiv
                    (1)%R (IZR
                           ((integer_of_int32 ni_0) *
                           (integer_of_int32 ni_0)))) (Rmult
                                                       (double_exact dt) (
                                                       double_exact dt))))
                 alpha_conv))),
  forall (result: double),
  forall (HW_10: (eq (double_value result) (1)%R) /\
                 (eq (double_exact result) (1)%R) /\
                 (eq (double_model result) (1)%R)),
  forall (HW_11: (no_overflow_double
                  nearest_even (IZR (integer_of_int32 ni_0)))),
  forall (result0: double),
  forall (HW_12: (double_of_real_post
                  nearest_even (IZR (integer_of_int32 ni_0)) result0)),
  forall (HW_13: ~(eq (double_value result0) (0)%R) /\
                 (no_overflow_double
                  nearest_even (Rdiv
                                (double_value result) (double_value result0)))),
  forall (result1: double),
  forall (HW_14: (div_double_post nearest_even result result0 result1)),
  forall (dx_8: double),
  forall (HW_15: dx_8 = result1),
  forall (HW_16: ( (Rgt (double_value dx_8) (0)%R) /\
                  (Rle (double_value dx_8) (05 / 10)%R) /\
                 
                 (Rle
                  (Rdiv
                   (Rabs (Rminus (double_exact dx_8) (double_value dx_8))) (
                   double_value dx_8))
                  (1 / 9007199254740992)%R))),
  (no_overflow_double
   nearest_even (Rdiv (double_value dt) (double_value dx_8))).

Lemma forward_prop_safety_po_6 :
  forall (ni_0: int32),
  forall (nk: int32),
  forall (dt: double),
  forall (v: double),
  forall (l: double),
  forall (HW_1: ( (integer_of_int32 ni_0) >= 2 /\
                 (integer_of_int32 nk) >= 2 /\
                 ~(eq (double_value l) (0)%R) /\
                 (Rgt (double_value dt) (0)%R) /\
                 (Rgt (double_exact dt) (0)%R) /\
                 (eq (double_exact v) c) /\
                 (eq (double_exact v) (double_value v)) /\
                
                (Rle
                 (1 / 10715086071862673209484250490600018105614048117055336074437503883703510511249361224931983788156958581275946729175531468251871452856923140435984577574698574803934567774824230985421074605062371141877954182153046474983581941267398767559165543946077062914571196477686542167660429831652624386837205668069376)%R
                 (double_exact dt)) /\
                 (integer_of_int32 ni_0) <= 2147483646 /\
                 (integer_of_int32 nk) <= 7598581 /\
                
                (Rle (Rmult (IZR (integer_of_int32 nk)) (double_exact dt))
                 T_max) /\
                
                (Rle
                 (Rdiv
                  (Rabs (Rminus (double_exact dt) (double_value dt))) (
                  double_value dt))
                 (1 / 2251799813685248)%R) /\
                
                (Rle
                 (1 / 3273390607896141870013189696827599152216642046043064789483291368096133796404674554883270092325904157150886684127560071009217256545885393053328527589376)%R
                 (Rmult
                  (Rmult (double_exact dt) (IZR (integer_of_int32 ni_0))) c)) /\
                
                (Rle
                 (Rmult
                  (Rmult (double_exact dt) (IZR (integer_of_int32 ni_0))) c)
                 (Rminus (1)%R (1 / 1125899906842624)%R)) /\
                
                (Rlt
                 (sqrt
                  (Rplus
                   (Rdiv
                    (1)%R (IZR
                           ((integer_of_int32 ni_0) *
                           (integer_of_int32 ni_0)))) (Rmult
                                                       (double_exact dt) (
                                                       double_exact dt))))
                 alpha_conv))),
  forall (result: double),
  forall (HW_10: (eq (double_value result) (1)%R) /\
                 (eq (double_exact result) (1)%R) /\
                 (eq (double_model result) (1)%R)),
  forall (HW_11: (no_overflow_double
                  nearest_even (IZR (integer_of_int32 ni_0)))),
  forall (result0: double),
  forall (HW_12: (double_of_real_post
                  nearest_even (IZR (integer_of_int32 ni_0)) result0)),
  forall (HW_13: ~(eq (double_value result0) (0)%R) /\
                 (no_overflow_double
                  nearest_even (Rdiv
                                (double_value result) (double_value result0)))),
  forall (result1: double),
  forall (HW_14: (div_double_post nearest_even result result0 result1)),
  forall (dx_8: double),
  forall (HW_15: dx_8 = result1),
  forall (HW_16: ( (Rgt (double_value dx_8) (0)%R) /\
                  (Rle (double_value dx_8) (05 / 10)%R) /\
                 
                 (Rle
                  (Rdiv
                   (Rabs (Rminus (double_exact dx_8) (double_value dx_8))) (
                   double_value dx_8))
                  (1 / 9007199254740992)%R))),
  forall (HW_17: ~(eq (double_value dx_8) (0)%R) /\
                 (no_overflow_double
                  nearest_even (Rdiv (double_value dt) (double_value dx_8)))),
  forall (result2: double),
  forall (HW_18: (div_double_post nearest_even dt dx_8 result2)),
  (no_overflow_double
   nearest_even (Rmult (double_value result2) (double_value v))).

Lemma forward_prop_safety_po_7 :
  forall (ni_0: int32),
  forall (nk: int32),
  forall (dt: double),
  forall (v: double),
  forall (l: double),
  forall (HW_1: ( (integer_of_int32 ni_0) >= 2 /\
                 (integer_of_int32 nk) >= 2 /\
                 ~(eq (double_value l) (0)%R) /\
                 (Rgt (double_value dt) (0)%R) /\
                 (Rgt (double_exact dt) (0)%R) /\
                 (eq (double_exact v) c) /\
                 (eq (double_exact v) (double_value v)) /\
                
                (Rle
                 (1 / 10715086071862673209484250490600018105614048117055336074437503883703510511249361224931983788156958581275946729175531468251871452856923140435984577574698574803934567774824230985421074605062371141877954182153046474983581941267398767559165543946077062914571196477686542167660429831652624386837205668069376)%R
                 (double_exact dt)) /\
                 (integer_of_int32 ni_0) <= 2147483646 /\
                 (integer_of_int32 nk) <= 7598581 /\
                
                (Rle (Rmult (IZR (integer_of_int32 nk)) (double_exact dt))
                 T_max) /\
                
                (Rle
                 (Rdiv
                  (Rabs (Rminus (double_exact dt) (double_value dt))) (
                  double_value dt))
                 (1 / 2251799813685248)%R) /\
                
                (Rle
                 (1 / 3273390607896141870013189696827599152216642046043064789483291368096133796404674554883270092325904157150886684127560071009217256545885393053328527589376)%R
                 (Rmult
                  (Rmult (double_exact dt) (IZR (integer_of_int32 ni_0))) c)) /\
                
                (Rle
                 (Rmult
                  (Rmult (double_exact dt) (IZR (integer_of_int32 ni_0))) c)
                 (Rminus (1)%R (1 / 1125899906842624)%R)) /\
                
                (Rlt
                 (sqrt
                  (Rplus
                   (Rdiv
                    (1)%R (IZR
                           ((integer_of_int32 ni_0) *
                           (integer_of_int32 ni_0)))) (Rmult
                                                       (double_exact dt) (
                                                       double_exact dt))))
                 alpha_conv))),
  forall (result: double),
  forall (HW_10: (eq (double_value result) (1)%R) /\
                 (eq (double_exact result) (1)%R) /\
                 (eq (double_model result) (1)%R)),
  forall (HW_11: (no_overflow_double
                  nearest_even (IZR (integer_of_int32 ni_0)))),
  forall (result0: double),
  forall (HW_12: (double_of_real_post
                  nearest_even (IZR (integer_of_int32 ni_0)) result0)),
  forall (HW_13: ~(eq (double_value result0) (0)%R) /\
                 (no_overflow_double
                  nearest_even (Rdiv
                                (double_value result) (double_value result0)))),
  forall (result1: double),
  forall (HW_14: (div_double_post nearest_even result result0 result1)),
  forall (dx_8: double),
  forall (HW_15: dx_8 = result1),
  forall (HW_16: ( (Rgt (double_value dx_8) (0)%R) /\
                  (Rle (double_value dx_8) (05 / 10)%R) /\
                 
                 (Rle
                  (Rdiv
                   (Rabs (Rminus (double_exact dx_8) (double_value dx_8))) (
                   double_value dx_8))
                  (1 / 9007199254740992)%R))),
  forall (HW_17: ~(eq (double_value dx_8) (0)%R) /\
                 (no_overflow_double
                  nearest_even (Rdiv (double_value dt) (double_value dx_8)))),
  forall (result2: double),
  forall (HW_18: (div_double_post nearest_even dt dx_8 result2)),
  forall (HW_19: (no_overflow_double
                  nearest_even (Rmult (double_value result2) (double_value v)))),
  forall (result3: double),
  forall (HW_20: (mul_double_post nearest_even result2 v result3)),
  forall (a1: double),
  forall (HW_21: a1 = result3),
  (no_overflow_double
   nearest_even (Rmult (double_value a1) (double_value a1))).

Lemma forward_prop_safety_po_18 :
  forall (ni_0: int32),
  forall (nk: int32),
  forall (dt: double),
  forall (v: double),
  forall (l: double),
  forall (doubleP_double_xM_18_alloc_table: (alloc_table doubleP)),
  forall (double_xP_result_7_alloc_table: (alloc_table double_xP)),
  forall (double_xP_double_xM_result_7: (memory double_xP (pointer doubleP))),
  forall (doubleP_doubleM_double_xM_18: (memory doubleP double)),
  forall (HW_1: ( (integer_of_int32 ni_0) >= 2 /\
                 (integer_of_int32 nk) >= 2 /\
                 ~(eq (double_value l) (0)%R) /\
                 (Rgt (double_value dt) (0)%R) /\
                 (Rgt (double_exact dt) (0)%R) /\
                 (eq (double_exact v) c) /\
                 (eq (double_exact v) (double_value v)) /\
                
                (Rle
                 (1 / 10715086071862673209484250490600018105614048117055336074437503883703510511249361224931983788156958581275946729175531468251871452856923140435984577574698574803934567774824230985421074605062371141877954182153046474983581941267398767559165543946077062914571196477686542167660429831652624386837205668069376)%R
                 (double_exact dt)) /\
                 (integer_of_int32 ni_0) <= 2147483646 /\
                 (integer_of_int32 nk) <= 7598581 /\
                
                (Rle (Rmult (IZR (integer_of_int32 nk)) (double_exact dt))
                 T_max) /\
                
                (Rle
                 (Rdiv
                  (Rabs (Rminus (double_exact dt) (double_value dt))) (
                  double_value dt))
                 (1 / 2251799813685248)%R) /\
                
                (Rle
                 (1 / 3273390607896141870013189696827599152216642046043064789483291368096133796404674554883270092325904157150886684127560071009217256545885393053328527589376)%R
                 (Rmult
                  (Rmult (double_exact dt) (IZR (integer_of_int32 ni_0))) c)) /\
                
                (Rle
                 (Rmult
                  (Rmult (double_exact dt) (IZR (integer_of_int32 ni_0))) c)
                 (Rminus (1)%R (1 / 1125899906842624)%R)) /\
                
                (Rlt
                 (sqrt
                  (Rplus
                   (Rdiv
                    (1)%R (IZR
                           ((integer_of_int32 ni_0) *
                           (integer_of_int32 ni_0)))) (Rmult
                                                       (double_exact dt) (
                                                       double_exact dt))))
                 alpha_conv))),
  forall (result: double),
  forall (HW_10: (eq (double_value result) (1)%R) /\
                 (eq (double_exact result) (1)%R) /\
                 (eq (double_model result) (1)%R)),
  forall (HW_11: (no_overflow_double
                  nearest_even (IZR (integer_of_int32 ni_0)))),
  forall (result0: double),
  forall (HW_12: (double_of_real_post
                  nearest_even (IZR (integer_of_int32 ni_0)) result0)),
  forall (HW_13: ~(eq (double_value result0) (0)%R) /\
                 (no_overflow_double
                  nearest_even (Rdiv
                                (double_value result) (double_value result0)))),
  forall (result1: double),
  forall (HW_14: (div_double_post nearest_even result result0 result1)),
  forall (dx_8: double),
  forall (HW_15: dx_8 = result1),
  forall (HW_16: ( (Rgt (double_value dx_8) (0)%R) /\
                  (Rle (double_value dx_8) (05 / 10)%R) /\
                 
                 (Rle
                  (Rdiv
                   (Rabs (Rminus (double_exact dx_8) (double_value dx_8))) (
                   double_value dx_8))
                  (1 / 9007199254740992)%R))),
  forall (HW_17: ~(eq (double_value dx_8) (0)%R) /\
                 (no_overflow_double
                  nearest_even (Rdiv (double_value dt) (double_value dx_8)))),
  forall (result2: double),
  forall (HW_18: (div_double_post nearest_even dt dx_8 result2)),
  forall (HW_19: (no_overflow_double
                  nearest_even (Rmult (double_value result2) (double_value v)))),
  forall (result3: double),
  forall (HW_20: (mul_double_post nearest_even result2 v result3)),
  forall (a1: double),
  forall (HW_21: a1 = result3),
  forall (HW_22: (no_overflow_double
                  nearest_even (Rmult (double_value a1) (double_value a1)))),
  forall (result4: double),
  forall (HW_23: (mul_double_post nearest_even a1 a1 result4)),
  forall (a_1: double),
  forall (HW_24: a_1 = result4),
  forall (HW_25: ( (Rle (0)%R (double_value a_1)) /\
                  (Rle (double_value a_1) (1)%R) /\
                  (Rlt (0)%R (double_exact a_1)) /\
                  (Rle (double_exact a_1) (1)%R) /\
                 
                 (Rle (double_round_error a_1) (1 / 562949953421312)%R))),
  forall (HW_26: (-2147483648) <= ((integer_of_int32 ni_0) + 1) /\
                 ((integer_of_int32 ni_0) + 1) <= 2147483647),
  forall (result5: int32),
  forall (HW_27: (integer_of_int32 result5) = ((integer_of_int32 ni_0) + 1)),
  forall (HW_28: (-2147483648) <= ((integer_of_int32 nk) + 1) /\
                 ((integer_of_int32 nk) + 1) <= 2147483647),
  forall (result6: int32),
  forall (HW_29: (integer_of_int32 result6) = ((integer_of_int32 nk) + 1)),
  forall (HW_30: ( (integer_of_int32 result5) >= 1 /\
                  (integer_of_int32 result6) >= 1)),
  forall (result7: (pointer double_xP)),
  forall (HW_31:
                 (
                  (offset_min double_xP_result_7_alloc_table result7) <= 0 /\
                 
                 (offset_max double_xP_result_7_alloc_table result7) >=
                 ((integer_of_int32 result5) - 1) /\
                 
                 (forall (i_4:Z),
                  (0 <= i_4 /\ i_4 < (integer_of_int32 result5) ->
                   (offset_min
                    doubleP_double_xM_18_alloc_table (select
                                                      double_xP_double_xM_result_7 (
                                                      shift result7 i_4))) <=
                   0 /\
                   (offset_max
                    doubleP_double_xM_18_alloc_table (select
                                                      double_xP_double_xM_result_7 (
                                                      shift result7 i_4))) >=
                   ((integer_of_int32 result6) - 1))) /\
                 
                 (separated_matrix
                  result7 (integer_of_int32 result5) double_xP_double_xM_result_7))),
  forall (p_6: (pointer double_xP)),
  forall (HW_32: p_6 = result7),
  forall (result8: double),
  forall (HW_33: (eq (double_value result8) (0)%R) /\
                 (eq (double_exact result8) (0)%R) /\
                 (eq (double_model result8) (0)%R)),
  forall (HW_34: (offset_min double_xP_result_7_alloc_table p_6) <= 0 /\ 0 <=
                 (offset_max double_xP_result_7_alloc_table p_6)),
  forall (result9: (pointer doubleP)),
  forall (HW_35: result9 = (select double_xP_double_xM_result_7 p_6)),
  forall (HW_36: (offset_min doubleP_double_xM_18_alloc_table result9) <=
                 0 /\ 0 <=
                 (offset_max doubleP_double_xM_18_alloc_table result9)),
  forall (doubleP_doubleM_double_xM_18_0: (memory doubleP double)),
  forall (HW_37: doubleP_doubleM_double_xM_18_0 =
                 (store doubleP_doubleM_double_xM_18 result9 result8)),
  forall (result10: int32),
  forall (HW_38: (integer_of_int32 result10) = 1),
  forall (i_6: int32),
  forall (HW_39: i_6 = result10),
  forall (doubleP_doubleM_double_xM_18_1: (memory doubleP double)),
  forall (i_6_0: int32),
  forall (HW_40: True),
  forall (HW_41: ( 1 <= (integer_of_int32 i_6_0) /\
                  (integer_of_int32 i_6_0) <=
                 (integer_of_int32 ni_0) /\
                 
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) ((integer_of_int32 i_6_0) - 1) 0 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_1))),
  forall (HW_42: (integer_of_int32 i_6_0) < (integer_of_int32 ni_0)),
  (no_overflow_double nearest_even (IZR (integer_of_int32 i_6_0))).

Lemma forward_prop_safety_po_46 :
  forall (ni_0: int32),
  forall (nk: int32),
  forall (dt: double),
  forall (v: double),
  forall (l: double),
  forall (doubleP_double_xM_18_alloc_table: (alloc_table doubleP)),
  forall (double_xP_result_7_alloc_table: (alloc_table double_xP)),
  forall (double_xP_double_xM_result_7: (memory double_xP (pointer doubleP))),
  forall (doubleP_doubleM_double_xM_18: (memory doubleP double)),
  forall (HW_1: ( (integer_of_int32 ni_0) >= 2 /\
                 (integer_of_int32 nk) >= 2 /\
                 ~(eq (double_value l) (0)%R) /\
                 (Rgt (double_value dt) (0)%R) /\
                 (Rgt (double_exact dt) (0)%R) /\
                 (eq (double_exact v) c) /\
                 (eq (double_exact v) (double_value v)) /\
                
                (Rle
                 (1 / 10715086071862673209484250490600018105614048117055336074437503883703510511249361224931983788156958581275946729175531468251871452856923140435984577574698574803934567774824230985421074605062371141877954182153046474983581941267398767559165543946077062914571196477686542167660429831652624386837205668069376)%R
                 (double_exact dt)) /\
                 (integer_of_int32 ni_0) <= 2147483646 /\
                 (integer_of_int32 nk) <= 7598581 /\
                
                (Rle (Rmult (IZR (integer_of_int32 nk)) (double_exact dt))
                 T_max) /\
                
                (Rle
                 (Rdiv
                  (Rabs (Rminus (double_exact dt) (double_value dt))) (
                  double_value dt))
                 (1 / 2251799813685248)%R) /\
                
                (Rle
                 (1 / 3273390607896141870013189696827599152216642046043064789483291368096133796404674554883270092325904157150886684127560071009217256545885393053328527589376)%R
                 (Rmult
                  (Rmult (double_exact dt) (IZR (integer_of_int32 ni_0))) c)) /\
                
                (Rle
                 (Rmult
                  (Rmult (double_exact dt) (IZR (integer_of_int32 ni_0))) c)
                 (Rminus (1)%R (1 / 1125899906842624)%R)) /\
                
                (Rlt
                 (sqrt
                  (Rplus
                   (Rdiv
                    (1)%R (IZR
                           ((integer_of_int32 ni_0) *
                           (integer_of_int32 ni_0)))) (Rmult
                                                       (double_exact dt) (
                                                       double_exact dt))))
                 alpha_conv))),
  forall (result: double),
  forall (HW_10: (eq (double_value result) (1)%R) /\
                 (eq (double_exact result) (1)%R) /\
                 (eq (double_model result) (1)%R)),
  forall (HW_11: (no_overflow_double
                  nearest_even (IZR (integer_of_int32 ni_0)))),
  forall (result0: double),
  forall (HW_12: (double_of_real_post
                  nearest_even (IZR (integer_of_int32 ni_0)) result0)),
  forall (HW_13: ~(eq (double_value result0) (0)%R) /\
                 (no_overflow_double
                  nearest_even (Rdiv
                                (double_value result) (double_value result0)))),
  forall (result1: double),
  forall (HW_14: (div_double_post nearest_even result result0 result1)),
  forall (dx_8: double),
  forall (HW_15: dx_8 = result1),
  forall (HW_16: ( (Rgt (double_value dx_8) (0)%R) /\
                  (Rle (double_value dx_8) (05 / 10)%R) /\
                 
                 (Rle
                  (Rdiv
                   (Rabs (Rminus (double_exact dx_8) (double_value dx_8))) (
                   double_value dx_8))
                  (1 / 9007199254740992)%R))),
  forall (HW_17: ~(eq (double_value dx_8) (0)%R) /\
                 (no_overflow_double
                  nearest_even (Rdiv (double_value dt) (double_value dx_8)))),
  forall (result2: double),
  forall (HW_18: (div_double_post nearest_even dt dx_8 result2)),
  forall (HW_19: (no_overflow_double
                  nearest_even (Rmult (double_value result2) (double_value v)))),
  forall (result3: double),
  forall (HW_20: (mul_double_post nearest_even result2 v result3)),
  forall (a1: double),
  forall (HW_21: a1 = result3),
  forall (HW_22: (no_overflow_double
                  nearest_even (Rmult (double_value a1) (double_value a1)))),
  forall (result4: double),
  forall (HW_23: (mul_double_post nearest_even a1 a1 result4)),
  forall (a_1: double),
  forall (HW_24: a_1 = result4),
  forall (HW_25: ( (Rle (0)%R (double_value a_1)) /\
                  (Rle (double_value a_1) (1)%R) /\
                  (Rlt (0)%R (double_exact a_1)) /\
                  (Rle (double_exact a_1) (1)%R) /\
                 
                 (Rle (double_round_error a_1) (1 / 562949953421312)%R))),
  forall (HW_26: (-2147483648) <= ((integer_of_int32 ni_0) + 1) /\
                 ((integer_of_int32 ni_0) + 1) <= 2147483647),
  forall (result5: int32),
  forall (HW_27: (integer_of_int32 result5) = ((integer_of_int32 ni_0) + 1)),
  forall (HW_28: (-2147483648) <= ((integer_of_int32 nk) + 1) /\
                 ((integer_of_int32 nk) + 1) <= 2147483647),
  forall (result6: int32),
  forall (HW_29: (integer_of_int32 result6) = ((integer_of_int32 nk) + 1)),
  forall (HW_30: ( (integer_of_int32 result5) >= 1 /\
                  (integer_of_int32 result6) >= 1)),
  forall (result7: (pointer double_xP)),
  forall (HW_31:
                 (
                  (offset_min double_xP_result_7_alloc_table result7) <= 0 /\
                 
                 (offset_max double_xP_result_7_alloc_table result7) >=
                 ((integer_of_int32 result5) - 1) /\
                 
                 (forall (i_4:Z),
                  (0 <= i_4 /\ i_4 < (integer_of_int32 result5) ->
                   (offset_min
                    doubleP_double_xM_18_alloc_table (select
                                                      double_xP_double_xM_result_7 (
                                                      shift result7 i_4))) <=
                   0 /\
                   (offset_max
                    doubleP_double_xM_18_alloc_table (select
                                                      double_xP_double_xM_result_7 (
                                                      shift result7 i_4))) >=
                   ((integer_of_int32 result6) - 1))) /\
                 
                 (separated_matrix
                  result7 (integer_of_int32 result5) double_xP_double_xM_result_7))),
  forall (p_6: (pointer double_xP)),
  forall (HW_32: p_6 = result7),
  forall (result8: double),
  forall (HW_33: (eq (double_value result8) (0)%R) /\
                 (eq (double_exact result8) (0)%R) /\
                 (eq (double_model result8) (0)%R)),
  forall (HW_34: (offset_min double_xP_result_7_alloc_table p_6) <= 0 /\ 0 <=
                 (offset_max double_xP_result_7_alloc_table p_6)),
  forall (result9: (pointer doubleP)),
  forall (HW_35: result9 = (select double_xP_double_xM_result_7 p_6)),
  forall (HW_36: (offset_min doubleP_double_xM_18_alloc_table result9) <=
                 0 /\ 0 <=
                 (offset_max doubleP_double_xM_18_alloc_table result9)),
  forall (doubleP_doubleM_double_xM_18_0: (memory doubleP double)),
  forall (HW_37: doubleP_doubleM_double_xM_18_0 =
                 (store doubleP_doubleM_double_xM_18 result9 result8)),
  forall (result10: int32),
  forall (HW_38: (integer_of_int32 result10) = 1),
  forall (i_6: int32),
  forall (HW_39: i_6 = result10),
  forall (doubleP_doubleM_double_xM_18_1: (memory doubleP double)),
  forall (i_6_0: int32),
  forall (HW_40: True),
  forall (HW_41: ( 1 <= (integer_of_int32 i_6_0) /\
                  (integer_of_int32 i_6_0) <=
                 (integer_of_int32 ni_0) /\
                 
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) ((integer_of_int32 i_6_0) - 1) 0 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_1))),
  forall (HW_56: (integer_of_int32 i_6_0) >= (integer_of_int32 ni_0)),
  forall (result11: double),
  forall (HW_57: (eq (double_value result11) (0)%R) /\
                 (eq (double_exact result11) (0)%R) /\
                 (eq (double_model result11) (0)%R)),
  forall (HW_58: (offset_min double_xP_result_7_alloc_table p_6) <=
                 (integer_of_int32 ni_0) /\ (integer_of_int32 ni_0) <=
                 (offset_max double_xP_result_7_alloc_table p_6)),
  forall (result12: (pointer doubleP)),
  forall (HW_59: result12 =
                 (select
                  double_xP_double_xM_result_7 (shift
                                                p_6 (integer_of_int32 ni_0)))),
  forall (HW_60: (offset_min doubleP_double_xM_18_alloc_table result12) <=
                 0 /\ 0 <=
                 (offset_max doubleP_double_xM_18_alloc_table result12)),
  forall (doubleP_doubleM_double_xM_18_2: (memory doubleP double)),
  forall (HW_61: doubleP_doubleM_double_xM_18_2 =
                 (store doubleP_doubleM_double_xM_18_1 result12 result11)),
  forall (HW_62:
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) (integer_of_int32 ni_0) 0 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_2)),
  forall (result13: double),
  forall (HW_63: (eq (double_value result13) (0)%R) /\
                 (eq (double_exact result13) (0)%R) /\
                 (eq (double_model result13) (0)%R)),
  forall (HW_64: (offset_min double_xP_result_7_alloc_table p_6) <= 0 /\ 0 <=
                 (offset_max double_xP_result_7_alloc_table p_6)),
  forall (result14: (pointer doubleP)),
  forall (HW_65: result14 = (select double_xP_double_xM_result_7 p_6)),
  forall (HW_66: (offset_min
                  doubleP_double_xM_18_alloc_table (shift result14 1)) <=
                 0 /\ 0 <=
                 (offset_max
                  doubleP_double_xM_18_alloc_table (shift result14 1))),
  forall (doubleP_doubleM_double_xM_18_3: (memory doubleP double)),
  forall (HW_67: doubleP_doubleM_double_xM_18_3 =
                 (store
                  doubleP_doubleM_double_xM_18_2 (shift result14 1) result13)),
  forall (result15: int32),
  forall (HW_68: (integer_of_int32 result15) = 1),
  forall (i_6_1: int32),
  forall (HW_69: i_6_1 = result15),
  forall (doubleP_doubleM_double_xM_18_4: (memory doubleP double)),
  forall (i_6_2: int32),
  forall (HW_70: True),
  forall (HW_71: ( 1 <= (integer_of_int32 i_6_2) /\
                  (integer_of_int32 i_6_2) <=
                 (integer_of_int32 ni_0) /\
                 
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) ((integer_of_int32 i_6_2) - 1) 1 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_4))),
  forall (HW_72: (integer_of_int32 i_6_2) < (integer_of_int32 ni_0)),
  forall (HW_73:
                 (Rle
                  (Rabs
                   (double_value
                    (select
                     doubleP_doubleM_double_xM_18_4 (shift
                                                     (select
                                                      double_xP_double_xM_result_7 (
                                                      shift
                                                      p_6 ((integer_of_int32
                                                            i_6_2) -
                                                          1))) 0))))
                  (2)%R)),
  forall (HW_74:
                 (Rle
                  (Rabs
                   (double_value
                    (select
                     doubleP_doubleM_double_xM_18_4 (shift
                                                     (select
                                                      double_xP_double_xM_result_7 (
                                                      shift
                                                      p_6 (integer_of_int32
                                                           i_6_2))) 0))))
                  (2)%R)),
  forall (HW_75:
                 (Rle
                  (Rabs
                   (double_value
                    (select
                     doubleP_doubleM_double_xM_18_4 (shift
                                                     (select
                                                      double_xP_double_xM_result_7 (
                                                      shift
                                                      p_6 ((integer_of_int32
                                                            i_6_2) +
                                                          1))) 0))))
                  (2)%R)),
  forall (HW_76: (-2147483648) <= ((integer_of_int32 i_6_2) + 1) /\
                 ((integer_of_int32 i_6_2) + 1) <= 2147483647),
  forall (result16: int32),
  forall (HW_77: (integer_of_int32 result16) = ((integer_of_int32 i_6_2) + 1)),
  forall (HW_78: (offset_min double_xP_result_7_alloc_table p_6) <=
                 (integer_of_int32 result16) /\
                 (integer_of_int32 result16) <=
                 (offset_max double_xP_result_7_alloc_table p_6)),
  forall (result17: (pointer doubleP)),
  forall (HW_79: result17 =
                 (select
                  double_xP_double_xM_result_7 (shift
                                                p_6 (integer_of_int32
                                                     result16)))),
  forall (HW_80: (offset_min doubleP_double_xM_18_alloc_table result17) <=
                 0 /\ 0 <=
                 (offset_max doubleP_double_xM_18_alloc_table result17)),
  forall (result18: double),
  forall (HW_81: result18 = (select doubleP_doubleM_double_xM_18_4 result17)),
  forall (result19: double),
  forall (HW_82: (eq (double_value result19) (2)%R) /\
                 (eq (double_exact result19) (2)%R) /\
                 (eq (double_model result19) (2)%R)),
  forall (HW_83: (offset_min double_xP_result_7_alloc_table p_6) <=
                 (integer_of_int32 i_6_2) /\ (integer_of_int32 i_6_2) <=
                 (offset_max double_xP_result_7_alloc_table p_6)),
  forall (result20: (pointer doubleP)),
  forall (HW_84: result20 =
                 (select
                  double_xP_double_xM_result_7 (shift
                                                p_6 (integer_of_int32 i_6_2)))),
  forall (HW_85: (offset_min doubleP_double_xM_18_alloc_table result20) <=
                 0 /\ 0 <=
                 (offset_max doubleP_double_xM_18_alloc_table result20)),
  forall (result21: double),
  forall (HW_86: result21 = (select doubleP_doubleM_double_xM_18_4 result20)),
  forall (HW_87: (no_overflow_double
                  nearest_even (Rmult
                                (double_value result19) (double_value
                                                         result21)))),
  forall (result22: double),
  forall (HW_88: (mul_double_post nearest_even result19 result21 result22)),
  (no_overflow_double
   nearest_even (Rminus (double_value result18) (double_value result22))).

Lemma forward_prop_safety_po_53 :
  forall (ni_0: int32),
  forall (nk: int32),
  forall (dt: double),
  forall (v: double),
  forall (l: double),
  forall (doubleP_double_xM_18_alloc_table: (alloc_table doubleP)),
  forall (double_xP_result_7_alloc_table: (alloc_table double_xP)),
  forall (double_xP_double_xM_result_7: (memory double_xP (pointer doubleP))),
  forall (doubleP_doubleM_double_xM_18: (memory doubleP double)),
  forall (HW_1: ( (integer_of_int32 ni_0) >= 2 /\
                 (integer_of_int32 nk) >= 2 /\
                 ~(eq (double_value l) (0)%R) /\
                 (Rgt (double_value dt) (0)%R) /\
                 (Rgt (double_exact dt) (0)%R) /\
                 (eq (double_exact v) c) /\
                 (eq (double_exact v) (double_value v)) /\
                
                (Rle
                 (1 / 10715086071862673209484250490600018105614048117055336074437503883703510511249361224931983788156958581275946729175531468251871452856923140435984577574698574803934567774824230985421074605062371141877954182153046474983581941267398767559165543946077062914571196477686542167660429831652624386837205668069376)%R
                 (double_exact dt)) /\
                 (integer_of_int32 ni_0) <= 2147483646 /\
                 (integer_of_int32 nk) <= 7598581 /\
                
                (Rle (Rmult (IZR (integer_of_int32 nk)) (double_exact dt))
                 T_max) /\
                
                (Rle
                 (Rdiv
                  (Rabs (Rminus (double_exact dt) (double_value dt))) (
                  double_value dt))
                 (1 / 2251799813685248)%R) /\
                
                (Rle
                 (1 / 3273390607896141870013189696827599152216642046043064789483291368096133796404674554883270092325904157150886684127560071009217256545885393053328527589376)%R
                 (Rmult
                  (Rmult (double_exact dt) (IZR (integer_of_int32 ni_0))) c)) /\
                
                (Rle
                 (Rmult
                  (Rmult (double_exact dt) (IZR (integer_of_int32 ni_0))) c)
                 (Rminus (1)%R (1 / 1125899906842624)%R)) /\
                
                (Rlt
                 (sqrt
                  (Rplus
                   (Rdiv
                    (1)%R (IZR
                           ((integer_of_int32 ni_0) *
                           (integer_of_int32 ni_0)))) (Rmult
                                                       (double_exact dt) (
                                                       double_exact dt))))
                 alpha_conv))),
  forall (result: double),
  forall (HW_10: (eq (double_value result) (1)%R) /\
                 (eq (double_exact result) (1)%R) /\
                 (eq (double_model result) (1)%R)),
  forall (HW_11: (no_overflow_double
                  nearest_even (IZR (integer_of_int32 ni_0)))),
  forall (result0: double),
  forall (HW_12: (double_of_real_post
                  nearest_even (IZR (integer_of_int32 ni_0)) result0)),
  forall (HW_13: ~(eq (double_value result0) (0)%R) /\
                 (no_overflow_double
                  nearest_even (Rdiv
                                (double_value result) (double_value result0)))),
  forall (result1: double),
  forall (HW_14: (div_double_post nearest_even result result0 result1)),
  forall (dx_8: double),
  forall (HW_15: dx_8 = result1),
  forall (HW_16: ( (Rgt (double_value dx_8) (0)%R) /\
                  (Rle (double_value dx_8) (05 / 10)%R) /\
                 
                 (Rle
                  (Rdiv
                   (Rabs (Rminus (double_exact dx_8) (double_value dx_8))) (
                   double_value dx_8))
                  (1 / 9007199254740992)%R))),
  forall (HW_17: ~(eq (double_value dx_8) (0)%R) /\
                 (no_overflow_double
                  nearest_even (Rdiv (double_value dt) (double_value dx_8)))),
  forall (result2: double),
  forall (HW_18: (div_double_post nearest_even dt dx_8 result2)),
  forall (HW_19: (no_overflow_double
                  nearest_even (Rmult (double_value result2) (double_value v)))),
  forall (result3: double),
  forall (HW_20: (mul_double_post nearest_even result2 v result3)),
  forall (a1: double),
  forall (HW_21: a1 = result3),
  forall (HW_22: (no_overflow_double
                  nearest_even (Rmult (double_value a1) (double_value a1)))),
  forall (result4: double),
  forall (HW_23: (mul_double_post nearest_even a1 a1 result4)),
  forall (a_1: double),
  forall (HW_24: a_1 = result4),
  forall (HW_25: ( (Rle (0)%R (double_value a_1)) /\
                  (Rle (double_value a_1) (1)%R) /\
                  (Rlt (0)%R (double_exact a_1)) /\
                  (Rle (double_exact a_1) (1)%R) /\
                 
                 (Rle (double_round_error a_1) (1 / 562949953421312)%R))),
  forall (HW_26: (-2147483648) <= ((integer_of_int32 ni_0) + 1) /\
                 ((integer_of_int32 ni_0) + 1) <= 2147483647),
  forall (result5: int32),
  forall (HW_27: (integer_of_int32 result5) = ((integer_of_int32 ni_0) + 1)),
  forall (HW_28: (-2147483648) <= ((integer_of_int32 nk) + 1) /\
                 ((integer_of_int32 nk) + 1) <= 2147483647),
  forall (result6: int32),
  forall (HW_29: (integer_of_int32 result6) = ((integer_of_int32 nk) + 1)),
  forall (HW_30: ( (integer_of_int32 result5) >= 1 /\
                  (integer_of_int32 result6) >= 1)),
  forall (result7: (pointer double_xP)),
  forall (HW_31:
                 (
                  (offset_min double_xP_result_7_alloc_table result7) <= 0 /\
                 
                 (offset_max double_xP_result_7_alloc_table result7) >=
                 ((integer_of_int32 result5) - 1) /\
                 
                 (forall (i_4:Z),
                  (0 <= i_4 /\ i_4 < (integer_of_int32 result5) ->
                   (offset_min
                    doubleP_double_xM_18_alloc_table (select
                                                      double_xP_double_xM_result_7 (
                                                      shift result7 i_4))) <=
                   0 /\
                   (offset_max
                    doubleP_double_xM_18_alloc_table (select
                                                      double_xP_double_xM_result_7 (
                                                      shift result7 i_4))) >=
                   ((integer_of_int32 result6) - 1))) /\
                 
                 (separated_matrix
                  result7 (integer_of_int32 result5) double_xP_double_xM_result_7))),
  forall (p_6: (pointer double_xP)),
  forall (HW_32: p_6 = result7),
  forall (result8: double),
  forall (HW_33: (eq (double_value result8) (0)%R) /\
                 (eq (double_exact result8) (0)%R) /\
                 (eq (double_model result8) (0)%R)),
  forall (HW_34: (offset_min double_xP_result_7_alloc_table p_6) <= 0 /\ 0 <=
                 (offset_max double_xP_result_7_alloc_table p_6)),
  forall (result9: (pointer doubleP)),
  forall (HW_35: result9 = (select double_xP_double_xM_result_7 p_6)),
  forall (HW_36: (offset_min doubleP_double_xM_18_alloc_table result9) <=
                 0 /\ 0 <=
                 (offset_max doubleP_double_xM_18_alloc_table result9)),
  forall (doubleP_doubleM_double_xM_18_0: (memory doubleP double)),
  forall (HW_37: doubleP_doubleM_double_xM_18_0 =
                 (store doubleP_doubleM_double_xM_18 result9 result8)),
  forall (result10: int32),
  forall (HW_38: (integer_of_int32 result10) = 1),
  forall (i_6: int32),
  forall (HW_39: i_6 = result10),
  forall (doubleP_doubleM_double_xM_18_1: (memory doubleP double)),
  forall (i_6_0: int32),
  forall (HW_40: True),
  forall (HW_41: ( 1 <= (integer_of_int32 i_6_0) /\
                  (integer_of_int32 i_6_0) <=
                 (integer_of_int32 ni_0) /\
                 
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) ((integer_of_int32 i_6_0) - 1) 0 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_1))),
  forall (HW_56: (integer_of_int32 i_6_0) >= (integer_of_int32 ni_0)),
  forall (result11: double),
  forall (HW_57: (eq (double_value result11) (0)%R) /\
                 (eq (double_exact result11) (0)%R) /\
                 (eq (double_model result11) (0)%R)),
  forall (HW_58: (offset_min double_xP_result_7_alloc_table p_6) <=
                 (integer_of_int32 ni_0) /\ (integer_of_int32 ni_0) <=
                 (offset_max double_xP_result_7_alloc_table p_6)),
  forall (result12: (pointer doubleP)),
  forall (HW_59: result12 =
                 (select
                  double_xP_double_xM_result_7 (shift
                                                p_6 (integer_of_int32 ni_0)))),
  forall (HW_60: (offset_min doubleP_double_xM_18_alloc_table result12) <=
                 0 /\ 0 <=
                 (offset_max doubleP_double_xM_18_alloc_table result12)),
  forall (doubleP_doubleM_double_xM_18_2: (memory doubleP double)),
  forall (HW_61: doubleP_doubleM_double_xM_18_2 =
                 (store doubleP_doubleM_double_xM_18_1 result12 result11)),
  forall (HW_62:
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) (integer_of_int32 ni_0) 0 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_2)),
  forall (result13: double),
  forall (HW_63: (eq (double_value result13) (0)%R) /\
                 (eq (double_exact result13) (0)%R) /\
                 (eq (double_model result13) (0)%R)),
  forall (HW_64: (offset_min double_xP_result_7_alloc_table p_6) <= 0 /\ 0 <=
                 (offset_max double_xP_result_7_alloc_table p_6)),
  forall (result14: (pointer doubleP)),
  forall (HW_65: result14 = (select double_xP_double_xM_result_7 p_6)),
  forall (HW_66: (offset_min
                  doubleP_double_xM_18_alloc_table (shift result14 1)) <=
                 0 /\ 0 <=
                 (offset_max
                  doubleP_double_xM_18_alloc_table (shift result14 1))),
  forall (doubleP_doubleM_double_xM_18_3: (memory doubleP double)),
  forall (HW_67: doubleP_doubleM_double_xM_18_3 =
                 (store
                  doubleP_doubleM_double_xM_18_2 (shift result14 1) result13)),
  forall (result15: int32),
  forall (HW_68: (integer_of_int32 result15) = 1),
  forall (i_6_1: int32),
  forall (HW_69: i_6_1 = result15),
  forall (doubleP_doubleM_double_xM_18_4: (memory doubleP double)),
  forall (i_6_2: int32),
  forall (HW_70: True),
  forall (HW_71: ( 1 <= (integer_of_int32 i_6_2) /\
                  (integer_of_int32 i_6_2) <=
                 (integer_of_int32 ni_0) /\
                 
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) ((integer_of_int32 i_6_2) - 1) 1 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_4))),
  forall (HW_72: (integer_of_int32 i_6_2) < (integer_of_int32 ni_0)),
  forall (HW_73:
                 (Rle
                  (Rabs
                   (double_value
                    (select
                     doubleP_doubleM_double_xM_18_4 (shift
                                                     (select
                                                      double_xP_double_xM_result_7 (
                                                      shift
                                                      p_6 ((integer_of_int32
                                                            i_6_2) -
                                                          1))) 0))))
                  (2)%R)),
  forall (HW_74:
                 (Rle
                  (Rabs
                   (double_value
                    (select
                     doubleP_doubleM_double_xM_18_4 (shift
                                                     (select
                                                      double_xP_double_xM_result_7 (
                                                      shift
                                                      p_6 (integer_of_int32
                                                           i_6_2))) 0))))
                  (2)%R)),
  forall (HW_75:
                 (Rle
                  (Rabs
                   (double_value
                    (select
                     doubleP_doubleM_double_xM_18_4 (shift
                                                     (select
                                                      double_xP_double_xM_result_7 (
                                                      shift
                                                      p_6 ((integer_of_int32
                                                            i_6_2) +
                                                          1))) 0))))
                  (2)%R)),
  forall (HW_76: (-2147483648) <= ((integer_of_int32 i_6_2) + 1) /\
                 ((integer_of_int32 i_6_2) + 1) <= 2147483647),
  forall (result16: int32),
  forall (HW_77: (integer_of_int32 result16) = ((integer_of_int32 i_6_2) + 1)),
  forall (HW_78: (offset_min double_xP_result_7_alloc_table p_6) <=
                 (integer_of_int32 result16) /\
                 (integer_of_int32 result16) <=
                 (offset_max double_xP_result_7_alloc_table p_6)),
  forall (result17: (pointer doubleP)),
  forall (HW_79: result17 =
                 (select
                  double_xP_double_xM_result_7 (shift
                                                p_6 (integer_of_int32
                                                     result16)))),
  forall (HW_80: (offset_min doubleP_double_xM_18_alloc_table result17) <=
                 0 /\ 0 <=
                 (offset_max doubleP_double_xM_18_alloc_table result17)),
  forall (result18: double),
  forall (HW_81: result18 = (select doubleP_doubleM_double_xM_18_4 result17)),
  forall (result19: double),
  forall (HW_82: (eq (double_value result19) (2)%R) /\
                 (eq (double_exact result19) (2)%R) /\
                 (eq (double_model result19) (2)%R)),
  forall (HW_83: (offset_min double_xP_result_7_alloc_table p_6) <=
                 (integer_of_int32 i_6_2) /\ (integer_of_int32 i_6_2) <=
                 (offset_max double_xP_result_7_alloc_table p_6)),
  forall (result20: (pointer doubleP)),
  forall (HW_84: result20 =
                 (select
                  double_xP_double_xM_result_7 (shift
                                                p_6 (integer_of_int32 i_6_2)))),
  forall (HW_85: (offset_min doubleP_double_xM_18_alloc_table result20) <=
                 0 /\ 0 <=
                 (offset_max doubleP_double_xM_18_alloc_table result20)),
  forall (result21: double),
  forall (HW_86: result21 = (select doubleP_doubleM_double_xM_18_4 result20)),
  forall (HW_87: (no_overflow_double
                  nearest_even (Rmult
                                (double_value result19) (double_value
                                                         result21)))),
  forall (result22: double),
  forall (HW_88: (mul_double_post nearest_even result19 result21 result22)),
  forall (HW_89: (no_overflow_double
                  nearest_even (Rminus
                                (double_value result18) (double_value
                                                         result22)))),
  forall (result23: double),
  forall (HW_90: (sub_double_post nearest_even result18 result22 result23)),
  forall (HW_91: (-2147483648) <= ((integer_of_int32 i_6_2) - 1) /\
                 ((integer_of_int32 i_6_2) - 1) <= 2147483647),
  forall (result24: int32),
  forall (HW_92: (integer_of_int32 result24) = ((integer_of_int32 i_6_2) - 1)),
  forall (HW_93: (offset_min double_xP_result_7_alloc_table p_6) <=
                 (integer_of_int32 result24) /\
                 (integer_of_int32 result24) <=
                 (offset_max double_xP_result_7_alloc_table p_6)),
  forall (result25: (pointer doubleP)),
  forall (HW_94: result25 =
                 (select
                  double_xP_double_xM_result_7 (shift
                                                p_6 (integer_of_int32
                                                     result24)))),
  forall (HW_95: (offset_min doubleP_double_xM_18_alloc_table result25) <=
                 0 /\ 0 <=
                 (offset_max doubleP_double_xM_18_alloc_table result25)),
  forall (result26: double),
  forall (HW_96: result26 = (select doubleP_doubleM_double_xM_18_4 result25)),
  (no_overflow_double
   nearest_even (Rplus (double_value result23) (double_value result26))).

Lemma forward_prop_safety_po_58 :
  forall (ni_0: int32),
  forall (nk: int32),
  forall (dt: double),
  forall (v: double),
  forall (l: double),
  forall (doubleP_double_xM_18_alloc_table: (alloc_table doubleP)),
  forall (double_xP_result_7_alloc_table: (alloc_table double_xP)),
  forall (double_xP_double_xM_result_7: (memory double_xP (pointer doubleP))),
  forall (doubleP_doubleM_double_xM_18: (memory doubleP double)),
  forall (HW_1: ( (integer_of_int32 ni_0) >= 2 /\
                 (integer_of_int32 nk) >= 2 /\
                 ~(eq (double_value l) (0)%R) /\
                 (Rgt (double_value dt) (0)%R) /\
                 (Rgt (double_exact dt) (0)%R) /\
                 (eq (double_exact v) c) /\
                 (eq (double_exact v) (double_value v)) /\
                
                (Rle
                 (1 / 10715086071862673209484250490600018105614048117055336074437503883703510511249361224931983788156958581275946729175531468251871452856923140435984577574698574803934567774824230985421074605062371141877954182153046474983581941267398767559165543946077062914571196477686542167660429831652624386837205668069376)%R
                 (double_exact dt)) /\
                 (integer_of_int32 ni_0) <= 2147483646 /\
                 (integer_of_int32 nk) <= 7598581 /\
                
                (Rle (Rmult (IZR (integer_of_int32 nk)) (double_exact dt))
                 T_max) /\
                
                (Rle
                 (Rdiv
                  (Rabs (Rminus (double_exact dt) (double_value dt))) (
                  double_value dt))
                 (1 / 2251799813685248)%R) /\
                
                (Rle
                 (1 / 3273390607896141870013189696827599152216642046043064789483291368096133796404674554883270092325904157150886684127560071009217256545885393053328527589376)%R
                 (Rmult
                  (Rmult (double_exact dt) (IZR (integer_of_int32 ni_0))) c)) /\
                
                (Rle
                 (Rmult
                  (Rmult (double_exact dt) (IZR (integer_of_int32 ni_0))) c)
                 (Rminus (1)%R (1 / 1125899906842624)%R)) /\
                
                (Rlt
                 (sqrt
                  (Rplus
                   (Rdiv
                    (1)%R (IZR
                           ((integer_of_int32 ni_0) *
                           (integer_of_int32 ni_0)))) (Rmult
                                                       (double_exact dt) (
                                                       double_exact dt))))
                 alpha_conv))),
  forall (result: double),
  forall (HW_10: (eq (double_value result) (1)%R) /\
                 (eq (double_exact result) (1)%R) /\
                 (eq (double_model result) (1)%R)),
  forall (HW_11: (no_overflow_double
                  nearest_even (IZR (integer_of_int32 ni_0)))),
  forall (result0: double),
  forall (HW_12: (double_of_real_post
                  nearest_even (IZR (integer_of_int32 ni_0)) result0)),
  forall (HW_13: ~(eq (double_value result0) (0)%R) /\
                 (no_overflow_double
                  nearest_even (Rdiv
                                (double_value result) (double_value result0)))),
  forall (result1: double),
  forall (HW_14: (div_double_post nearest_even result result0 result1)),
  forall (dx_8: double),
  forall (HW_15: dx_8 = result1),
  forall (HW_16: ( (Rgt (double_value dx_8) (0)%R) /\
                  (Rle (double_value dx_8) (05 / 10)%R) /\
                 
                 (Rle
                  (Rdiv
                   (Rabs (Rminus (double_exact dx_8) (double_value dx_8))) (
                   double_value dx_8))
                  (1 / 9007199254740992)%R))),
  forall (HW_17: ~(eq (double_value dx_8) (0)%R) /\
                 (no_overflow_double
                  nearest_even (Rdiv (double_value dt) (double_value dx_8)))),
  forall (result2: double),
  forall (HW_18: (div_double_post nearest_even dt dx_8 result2)),
  forall (HW_19: (no_overflow_double
                  nearest_even (Rmult (double_value result2) (double_value v)))),
  forall (result3: double),
  forall (HW_20: (mul_double_post nearest_even result2 v result3)),
  forall (a1: double),
  forall (HW_21: a1 = result3),
  forall (HW_22: (no_overflow_double
                  nearest_even (Rmult (double_value a1) (double_value a1)))),
  forall (result4: double),
  forall (HW_23: (mul_double_post nearest_even a1 a1 result4)),
  forall (a_1: double),
  forall (HW_24: a_1 = result4),
  forall (HW_25: ( (Rle (0)%R (double_value a_1)) /\
                  (Rle (double_value a_1) (1)%R) /\
                  (Rlt (0)%R (double_exact a_1)) /\
                  (Rle (double_exact a_1) (1)%R) /\
                 
                 (Rle (double_round_error a_1) (1 / 562949953421312)%R))),
  forall (HW_26: (-2147483648) <= ((integer_of_int32 ni_0) + 1) /\
                 ((integer_of_int32 ni_0) + 1) <= 2147483647),
  forall (result5: int32),
  forall (HW_27: (integer_of_int32 result5) = ((integer_of_int32 ni_0) + 1)),
  forall (HW_28: (-2147483648) <= ((integer_of_int32 nk) + 1) /\
                 ((integer_of_int32 nk) + 1) <= 2147483647),
  forall (result6: int32),
  forall (HW_29: (integer_of_int32 result6) = ((integer_of_int32 nk) + 1)),
  forall (HW_30: ( (integer_of_int32 result5) >= 1 /\
                  (integer_of_int32 result6) >= 1)),
  forall (result7: (pointer double_xP)),
  forall (HW_31:
                 (
                  (offset_min double_xP_result_7_alloc_table result7) <= 0 /\
                 
                 (offset_max double_xP_result_7_alloc_table result7) >=
                 ((integer_of_int32 result5) - 1) /\
                 
                 (forall (i_4:Z),
                  (0 <= i_4 /\ i_4 < (integer_of_int32 result5) ->
                   (offset_min
                    doubleP_double_xM_18_alloc_table (select
                                                      double_xP_double_xM_result_7 (
                                                      shift result7 i_4))) <=
                   0 /\
                   (offset_max
                    doubleP_double_xM_18_alloc_table (select
                                                      double_xP_double_xM_result_7 (
                                                      shift result7 i_4))) >=
                   ((integer_of_int32 result6) - 1))) /\
                 
                 (separated_matrix
                  result7 (integer_of_int32 result5) double_xP_double_xM_result_7))),
  forall (p_6: (pointer double_xP)),
  forall (HW_32: p_6 = result7),
  forall (result8: double),
  forall (HW_33: (eq (double_value result8) (0)%R) /\
                 (eq (double_exact result8) (0)%R) /\
                 (eq (double_model result8) (0)%R)),
  forall (HW_34: (offset_min double_xP_result_7_alloc_table p_6) <= 0 /\ 0 <=
                 (offset_max double_xP_result_7_alloc_table p_6)),
  forall (result9: (pointer doubleP)),
  forall (HW_35: result9 = (select double_xP_double_xM_result_7 p_6)),
  forall (HW_36: (offset_min doubleP_double_xM_18_alloc_table result9) <=
                 0 /\ 0 <=
                 (offset_max doubleP_double_xM_18_alloc_table result9)),
  forall (doubleP_doubleM_double_xM_18_0: (memory doubleP double)),
  forall (HW_37: doubleP_doubleM_double_xM_18_0 =
                 (store doubleP_doubleM_double_xM_18 result9 result8)),
  forall (result10: int32),
  forall (HW_38: (integer_of_int32 result10) = 1),
  forall (i_6: int32),
  forall (HW_39: i_6 = result10),
  forall (doubleP_doubleM_double_xM_18_1: (memory doubleP double)),
  forall (i_6_0: int32),
  forall (HW_40: True),
  forall (HW_41: ( 1 <= (integer_of_int32 i_6_0) /\
                  (integer_of_int32 i_6_0) <=
                 (integer_of_int32 ni_0) /\
                 
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) ((integer_of_int32 i_6_0) - 1) 0 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_1))),
  forall (HW_56: (integer_of_int32 i_6_0) >= (integer_of_int32 ni_0)),
  forall (result11: double),
  forall (HW_57: (eq (double_value result11) (0)%R) /\
                 (eq (double_exact result11) (0)%R) /\
                 (eq (double_model result11) (0)%R)),
  forall (HW_58: (offset_min double_xP_result_7_alloc_table p_6) <=
                 (integer_of_int32 ni_0) /\ (integer_of_int32 ni_0) <=
                 (offset_max double_xP_result_7_alloc_table p_6)),
  forall (result12: (pointer doubleP)),
  forall (HW_59: result12 =
                 (select
                  double_xP_double_xM_result_7 (shift
                                                p_6 (integer_of_int32 ni_0)))),
  forall (HW_60: (offset_min doubleP_double_xM_18_alloc_table result12) <=
                 0 /\ 0 <=
                 (offset_max doubleP_double_xM_18_alloc_table result12)),
  forall (doubleP_doubleM_double_xM_18_2: (memory doubleP double)),
  forall (HW_61: doubleP_doubleM_double_xM_18_2 =
                 (store doubleP_doubleM_double_xM_18_1 result12 result11)),
  forall (HW_62:
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) (integer_of_int32 ni_0) 0 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_2)),
  forall (result13: double),
  forall (HW_63: (eq (double_value result13) (0)%R) /\
                 (eq (double_exact result13) (0)%R) /\
                 (eq (double_model result13) (0)%R)),
  forall (HW_64: (offset_min double_xP_result_7_alloc_table p_6) <= 0 /\ 0 <=
                 (offset_max double_xP_result_7_alloc_table p_6)),
  forall (result14: (pointer doubleP)),
  forall (HW_65: result14 = (select double_xP_double_xM_result_7 p_6)),
  forall (HW_66: (offset_min
                  doubleP_double_xM_18_alloc_table (shift result14 1)) <=
                 0 /\ 0 <=
                 (offset_max
                  doubleP_double_xM_18_alloc_table (shift result14 1))),
  forall (doubleP_doubleM_double_xM_18_3: (memory doubleP double)),
  forall (HW_67: doubleP_doubleM_double_xM_18_3 =
                 (store
                  doubleP_doubleM_double_xM_18_2 (shift result14 1) result13)),
  forall (result15: int32),
  forall (HW_68: (integer_of_int32 result15) = 1),
  forall (i_6_1: int32),
  forall (HW_69: i_6_1 = result15),
  forall (doubleP_doubleM_double_xM_18_4: (memory doubleP double)),
  forall (i_6_2: int32),
  forall (HW_70: True),
  forall (HW_71: ( 1 <= (integer_of_int32 i_6_2) /\
                  (integer_of_int32 i_6_2) <=
                 (integer_of_int32 ni_0) /\
                 
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) ((integer_of_int32 i_6_2) - 1) 1 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_4))),
  forall (HW_72: (integer_of_int32 i_6_2) < (integer_of_int32 ni_0)),
  forall (HW_73:
                 (Rle
                  (Rabs
                   (double_value
                    (select
                     doubleP_doubleM_double_xM_18_4 (shift
                                                     (select
                                                      double_xP_double_xM_result_7 (
                                                      shift
                                                      p_6 ((integer_of_int32
                                                            i_6_2) -
                                                          1))) 0))))
                  (2)%R)),
  forall (HW_74:
                 (Rle
                  (Rabs
                   (double_value
                    (select
                     doubleP_doubleM_double_xM_18_4 (shift
                                                     (select
                                                      double_xP_double_xM_result_7 (
                                                      shift
                                                      p_6 (integer_of_int32
                                                           i_6_2))) 0))))
                  (2)%R)),
  forall (HW_75:
                 (Rle
                  (Rabs
                   (double_value
                    (select
                     doubleP_doubleM_double_xM_18_4 (shift
                                                     (select
                                                      double_xP_double_xM_result_7 (
                                                      shift
                                                      p_6 ((integer_of_int32
                                                            i_6_2) +
                                                          1))) 0))))
                  (2)%R)),
  forall (HW_76: (-2147483648) <= ((integer_of_int32 i_6_2) + 1) /\
                 ((integer_of_int32 i_6_2) + 1) <= 2147483647),
  forall (result16: int32),
  forall (HW_77: (integer_of_int32 result16) = ((integer_of_int32 i_6_2) + 1)),
  forall (HW_78: (offset_min double_xP_result_7_alloc_table p_6) <=
                 (integer_of_int32 result16) /\
                 (integer_of_int32 result16) <=
                 (offset_max double_xP_result_7_alloc_table p_6)),
  forall (result17: (pointer doubleP)),
  forall (HW_79: result17 =
                 (select
                  double_xP_double_xM_result_7 (shift
                                                p_6 (integer_of_int32
                                                     result16)))),
  forall (HW_80: (offset_min doubleP_double_xM_18_alloc_table result17) <=
                 0 /\ 0 <=
                 (offset_max doubleP_double_xM_18_alloc_table result17)),
  forall (result18: double),
  forall (HW_81: result18 = (select doubleP_doubleM_double_xM_18_4 result17)),
  forall (result19: double),
  forall (HW_82: (eq (double_value result19) (2)%R) /\
                 (eq (double_exact result19) (2)%R) /\
                 (eq (double_model result19) (2)%R)),
  forall (HW_83: (offset_min double_xP_result_7_alloc_table p_6) <=
                 (integer_of_int32 i_6_2) /\ (integer_of_int32 i_6_2) <=
                 (offset_max double_xP_result_7_alloc_table p_6)),
  forall (result20: (pointer doubleP)),
  forall (HW_84: result20 =
                 (select
                  double_xP_double_xM_result_7 (shift
                                                p_6 (integer_of_int32 i_6_2)))),
  forall (HW_85: (offset_min doubleP_double_xM_18_alloc_table result20) <=
                 0 /\ 0 <=
                 (offset_max doubleP_double_xM_18_alloc_table result20)),
  forall (result21: double),
  forall (HW_86: result21 = (select doubleP_doubleM_double_xM_18_4 result20)),
  forall (HW_87: (no_overflow_double
                  nearest_even (Rmult
                                (double_value result19) (double_value
                                                         result21)))),
  forall (result22: double),
  forall (HW_88: (mul_double_post nearest_even result19 result21 result22)),
  forall (HW_89: (no_overflow_double
                  nearest_even (Rminus
                                (double_value result18) (double_value
                                                         result22)))),
  forall (result23: double),
  forall (HW_90: (sub_double_post nearest_even result18 result22 result23)),
  forall (HW_91: (-2147483648) <= ((integer_of_int32 i_6_2) - 1) /\
                 ((integer_of_int32 i_6_2) - 1) <= 2147483647),
  forall (result24: int32),
  forall (HW_92: (integer_of_int32 result24) = ((integer_of_int32 i_6_2) - 1)),
  forall (HW_93: (offset_min double_xP_result_7_alloc_table p_6) <=
                 (integer_of_int32 result24) /\
                 (integer_of_int32 result24) <=
                 (offset_max double_xP_result_7_alloc_table p_6)),
  forall (result25: (pointer doubleP)),
  forall (HW_94: result25 =
                 (select
                  double_xP_double_xM_result_7 (shift
                                                p_6 (integer_of_int32
                                                     result24)))),
  forall (HW_95: (offset_min doubleP_double_xM_18_alloc_table result25) <=
                 0 /\ 0 <=
                 (offset_max doubleP_double_xM_18_alloc_table result25)),
  forall (result26: double),
  forall (HW_96: result26 = (select doubleP_doubleM_double_xM_18_4 result25)),
  forall (HW_97: (no_overflow_double
                  nearest_even (Rplus
                                (double_value result23) (double_value
                                                         result26)))),
  forall (result27: double),
  forall (HW_98: (add_double_post nearest_even result23 result26 result27)),
  forall (dp: double),
  forall (HW_99: dp = result27),
  forall (HW_100: (offset_min double_xP_result_7_alloc_table p_6) <=
                  (integer_of_int32 i_6_2) /\ (integer_of_int32 i_6_2) <=
                  (offset_max double_xP_result_7_alloc_table p_6)),
  forall (result28: (pointer doubleP)),
  forall (HW_101: result28 =
                  (select
                   double_xP_double_xM_result_7 (shift
                                                 p_6 (integer_of_int32 i_6_2)))),
  forall (HW_102: (offset_min doubleP_double_xM_18_alloc_table result28) <=
                  0 /\ 0 <=
                  (offset_max doubleP_double_xM_18_alloc_table result28)),
  forall (result29: double),
  forall (HW_103: result29 = (select doubleP_doubleM_double_xM_18_4 result28)),
  forall (result30: double),
  forall (HW_104: (eq (double_value result30) (05 / 10)%R) /\
                  (eq (double_exact result30) (05 / 10)%R) /\
                  (eq (double_model result30) (05 / 10)%R)),
  forall (HW_105: (no_overflow_double
                   nearest_even (Rmult
                                 (double_value result30) (double_value a_1)))),
  forall (result31: double),
  forall (HW_106: (mul_double_post nearest_even result30 a_1 result31)),
  forall (HW_107: (no_overflow_double
                   nearest_even (Rmult
                                 (double_value result31) (double_value dp)))),
  forall (result32: double),
  forall (HW_108: (mul_double_post nearest_even result31 dp result32)),
  (no_overflow_double
   nearest_even (Rplus (double_value result29) (double_value result32))).

Lemma forward_prop_safety_po_80 :
  forall (ni_0: int32),
  forall (nk: int32),
  forall (dt: double),
  forall (v: double),
  forall (l: double),
  forall (doubleP_double_xM_18_alloc_table: (alloc_table doubleP)),
  forall (double_xP_result_7_alloc_table: (alloc_table double_xP)),
  forall (double_xP_double_xM_result_7: (memory double_xP (pointer doubleP))),
  forall (doubleP_doubleM_double_xM_18: (memory doubleP double)),
  forall (HW_1: ( (integer_of_int32 ni_0) >= 2 /\
                 (integer_of_int32 nk) >= 2 /\
                 ~(eq (double_value l) (0)%R) /\
                 (Rgt (double_value dt) (0)%R) /\
                 (Rgt (double_exact dt) (0)%R) /\
                 (eq (double_exact v) c) /\
                 (eq (double_exact v) (double_value v)) /\
                
                (Rle
                 (1 / 10715086071862673209484250490600018105614048117055336074437503883703510511249361224931983788156958581275946729175531468251871452856923140435984577574698574803934567774824230985421074605062371141877954182153046474983581941267398767559165543946077062914571196477686542167660429831652624386837205668069376)%R
                 (double_exact dt)) /\
                 (integer_of_int32 ni_0) <= 2147483646 /\
                 (integer_of_int32 nk) <= 7598581 /\
                
                (Rle (Rmult (IZR (integer_of_int32 nk)) (double_exact dt))
                 T_max) /\
                
                (Rle
                 (Rdiv
                  (Rabs (Rminus (double_exact dt) (double_value dt))) (
                  double_value dt))
                 (1 / 2251799813685248)%R) /\
                
                (Rle
                 (1 / 3273390607896141870013189696827599152216642046043064789483291368096133796404674554883270092325904157150886684127560071009217256545885393053328527589376)%R
                 (Rmult
                  (Rmult (double_exact dt) (IZR (integer_of_int32 ni_0))) c)) /\
                
                (Rle
                 (Rmult
                  (Rmult (double_exact dt) (IZR (integer_of_int32 ni_0))) c)
                 (Rminus (1)%R (1 / 1125899906842624)%R)) /\
                
                (Rlt
                 (sqrt
                  (Rplus
                   (Rdiv
                    (1)%R (IZR
                           ((integer_of_int32 ni_0) *
                           (integer_of_int32 ni_0)))) (Rmult
                                                       (double_exact dt) (
                                                       double_exact dt))))
                 alpha_conv))),
  forall (result: double),
  forall (HW_10: (eq (double_value result) (1)%R) /\
                 (eq (double_exact result) (1)%R) /\
                 (eq (double_model result) (1)%R)),
  forall (HW_11: (no_overflow_double
                  nearest_even (IZR (integer_of_int32 ni_0)))),
  forall (result0: double),
  forall (HW_12: (double_of_real_post
                  nearest_even (IZR (integer_of_int32 ni_0)) result0)),
  forall (HW_13: ~(eq (double_value result0) (0)%R) /\
                 (no_overflow_double
                  nearest_even (Rdiv
                                (double_value result) (double_value result0)))),
  forall (result1: double),
  forall (HW_14: (div_double_post nearest_even result result0 result1)),
  forall (dx_8: double),
  forall (HW_15: dx_8 = result1),
  forall (HW_16: ( (Rgt (double_value dx_8) (0)%R) /\
                  (Rle (double_value dx_8) (05 / 10)%R) /\
                 
                 (Rle
                  (Rdiv
                   (Rabs (Rminus (double_exact dx_8) (double_value dx_8))) (
                   double_value dx_8))
                  (1 / 9007199254740992)%R))),
  forall (HW_17: ~(eq (double_value dx_8) (0)%R) /\
                 (no_overflow_double
                  nearest_even (Rdiv (double_value dt) (double_value dx_8)))),
  forall (result2: double),
  forall (HW_18: (div_double_post nearest_even dt dx_8 result2)),
  forall (HW_19: (no_overflow_double
                  nearest_even (Rmult (double_value result2) (double_value v)))),
  forall (result3: double),
  forall (HW_20: (mul_double_post nearest_even result2 v result3)),
  forall (a1: double),
  forall (HW_21: a1 = result3),
  forall (HW_22: (no_overflow_double
                  nearest_even (Rmult (double_value a1) (double_value a1)))),
  forall (result4: double),
  forall (HW_23: (mul_double_post nearest_even a1 a1 result4)),
  forall (a_1: double),
  forall (HW_24: a_1 = result4),
  forall (HW_25: ( (Rle (0)%R (double_value a_1)) /\
                  (Rle (double_value a_1) (1)%R) /\
                  (Rlt (0)%R (double_exact a_1)) /\
                  (Rle (double_exact a_1) (1)%R) /\
                 
                 (Rle (double_round_error a_1) (1 / 562949953421312)%R))),
  forall (HW_26: (-2147483648) <= ((integer_of_int32 ni_0) + 1) /\
                 ((integer_of_int32 ni_0) + 1) <= 2147483647),
  forall (result5: int32),
  forall (HW_27: (integer_of_int32 result5) = ((integer_of_int32 ni_0) + 1)),
  forall (HW_28: (-2147483648) <= ((integer_of_int32 nk) + 1) /\
                 ((integer_of_int32 nk) + 1) <= 2147483647),
  forall (result6: int32),
  forall (HW_29: (integer_of_int32 result6) = ((integer_of_int32 nk) + 1)),
  forall (HW_30: ( (integer_of_int32 result5) >= 1 /\
                  (integer_of_int32 result6) >= 1)),
  forall (result7: (pointer double_xP)),
  forall (HW_31:
                 (
                  (offset_min double_xP_result_7_alloc_table result7) <= 0 /\
                 
                 (offset_max double_xP_result_7_alloc_table result7) >=
                 ((integer_of_int32 result5) - 1) /\
                 
                 (forall (i_4:Z),
                  (0 <= i_4 /\ i_4 < (integer_of_int32 result5) ->
                   (offset_min
                    doubleP_double_xM_18_alloc_table (select
                                                      double_xP_double_xM_result_7 (
                                                      shift result7 i_4))) <=
                   0 /\
                   (offset_max
                    doubleP_double_xM_18_alloc_table (select
                                                      double_xP_double_xM_result_7 (
                                                      shift result7 i_4))) >=
                   ((integer_of_int32 result6) - 1))) /\
                 
                 (separated_matrix
                  result7 (integer_of_int32 result5) double_xP_double_xM_result_7))),
  forall (p_6: (pointer double_xP)),
  forall (HW_32: p_6 = result7),
  forall (result8: double),
  forall (HW_33: (eq (double_value result8) (0)%R) /\
                 (eq (double_exact result8) (0)%R) /\
                 (eq (double_model result8) (0)%R)),
  forall (HW_34: (offset_min double_xP_result_7_alloc_table p_6) <= 0 /\ 0 <=
                 (offset_max double_xP_result_7_alloc_table p_6)),
  forall (result9: (pointer doubleP)),
  forall (HW_35: result9 = (select double_xP_double_xM_result_7 p_6)),
  forall (HW_36: (offset_min doubleP_double_xM_18_alloc_table result9) <=
                 0 /\ 0 <=
                 (offset_max doubleP_double_xM_18_alloc_table result9)),
  forall (doubleP_doubleM_double_xM_18_0: (memory doubleP double)),
  forall (HW_37: doubleP_doubleM_double_xM_18_0 =
                 (store doubleP_doubleM_double_xM_18 result9 result8)),
  forall (result10: int32),
  forall (HW_38: (integer_of_int32 result10) = 1),
  forall (i_6: int32),
  forall (HW_39: i_6 = result10),
  forall (doubleP_doubleM_double_xM_18_1: (memory doubleP double)),
  forall (i_6_0: int32),
  forall (HW_40: True),
  forall (HW_41: ( 1 <= (integer_of_int32 i_6_0) /\
                  (integer_of_int32 i_6_0) <=
                 (integer_of_int32 ni_0) /\
                 
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) ((integer_of_int32 i_6_0) - 1) 0 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_1))),
  forall (HW_56: (integer_of_int32 i_6_0) >= (integer_of_int32 ni_0)),
  forall (result11: double),
  forall (HW_57: (eq (double_value result11) (0)%R) /\
                 (eq (double_exact result11) (0)%R) /\
                 (eq (double_model result11) (0)%R)),
  forall (HW_58: (offset_min double_xP_result_7_alloc_table p_6) <=
                 (integer_of_int32 ni_0) /\ (integer_of_int32 ni_0) <=
                 (offset_max double_xP_result_7_alloc_table p_6)),
  forall (result12: (pointer doubleP)),
  forall (HW_59: result12 =
                 (select
                  double_xP_double_xM_result_7 (shift
                                                p_6 (integer_of_int32 ni_0)))),
  forall (HW_60: (offset_min doubleP_double_xM_18_alloc_table result12) <=
                 0 /\ 0 <=
                 (offset_max doubleP_double_xM_18_alloc_table result12)),
  forall (doubleP_doubleM_double_xM_18_2: (memory doubleP double)),
  forall (HW_61: doubleP_doubleM_double_xM_18_2 =
                 (store doubleP_doubleM_double_xM_18_1 result12 result11)),
  forall (HW_62:
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) (integer_of_int32 ni_0) 0 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_2)),
  forall (result13: double),
  forall (HW_63: (eq (double_value result13) (0)%R) /\
                 (eq (double_exact result13) (0)%R) /\
                 (eq (double_model result13) (0)%R)),
  forall (HW_64: (offset_min double_xP_result_7_alloc_table p_6) <= 0 /\ 0 <=
                 (offset_max double_xP_result_7_alloc_table p_6)),
  forall (result14: (pointer doubleP)),
  forall (HW_65: result14 = (select double_xP_double_xM_result_7 p_6)),
  forall (HW_66: (offset_min
                  doubleP_double_xM_18_alloc_table (shift result14 1)) <=
                 0 /\ 0 <=
                 (offset_max
                  doubleP_double_xM_18_alloc_table (shift result14 1))),
  forall (doubleP_doubleM_double_xM_18_3: (memory doubleP double)),
  forall (HW_67: doubleP_doubleM_double_xM_18_3 =
                 (store
                  doubleP_doubleM_double_xM_18_2 (shift result14 1) result13)),
  forall (result15: int32),
  forall (HW_68: (integer_of_int32 result15) = 1),
  forall (i_6_1: int32),
  forall (HW_69: i_6_1 = result15),
  forall (doubleP_doubleM_double_xM_18_4: (memory doubleP double)),
  forall (i_6_2: int32),
  forall (HW_70: True),
  forall (HW_71: ( 1 <= (integer_of_int32 i_6_2) /\
                  (integer_of_int32 i_6_2) <=
                 (integer_of_int32 ni_0) /\
                 
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) ((integer_of_int32 i_6_2) - 1) 1 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_4))),
  forall (HW_118: (integer_of_int32 i_6_2) >= (integer_of_int32 ni_0)),
  forall (result16: double),
  forall (HW_119: (eq (double_value result16) (0)%R) /\
                  (eq (double_exact result16) (0)%R) /\
                  (eq (double_model result16) (0)%R)),
  forall (HW_120: (offset_min double_xP_result_7_alloc_table p_6) <=
                  (integer_of_int32 ni_0) /\ (integer_of_int32 ni_0) <=
                  (offset_max double_xP_result_7_alloc_table p_6)),
  forall (result17: (pointer doubleP)),
  forall (HW_121: result17 =
                  (select
                   double_xP_double_xM_result_7 (shift
                                                 p_6 (integer_of_int32 ni_0)))),
  forall (HW_122: (offset_min
                   doubleP_double_xM_18_alloc_table (shift result17 1)) <=
                  0 /\ 0 <=
                  (offset_max
                   doubleP_double_xM_18_alloc_table (shift result17 1))),
  forall (doubleP_doubleM_double_xM_18_5: (memory doubleP double)),
  forall (HW_123: doubleP_doubleM_double_xM_18_5 =
                  (store
                   doubleP_doubleM_double_xM_18_4 (shift result17 1) result16)),
  forall (HW_124:
                  (analytic_error
                   p_6 (integer_of_int32 ni_0) (integer_of_int32 ni_0) 1 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_5)),
  forall (result18: int32),
  forall (HW_125: (integer_of_int32 result18) = 1),
  forall (k_7: int32),
  forall (HW_126: k_7 = result18),
  forall (doubleP_doubleM_double_xM_18_6: (memory doubleP double)),
  forall (k_7_0: int32),
  forall (HW_127: True),
  forall (HW_128: ( 1 <= (integer_of_int32 k_7_0) /\
                   (integer_of_int32 k_7_0) <=
                  (integer_of_int32 nk) /\
                  
                  (analytic_error
                   p_6 (integer_of_int32 ni_0) (integer_of_int32 ni_0) (
                   integer_of_int32 k_7_0) a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_6))),
  forall (HW_129: (integer_of_int32 k_7_0) < (integer_of_int32 nk)),
  forall (result19: double),
  forall (HW_130: (eq (double_value result19) (0)%R) /\
                  (eq (double_exact result19) (0)%R) /\
                  (eq (double_model result19) (0)%R)),
  forall (HW_131: (offset_min double_xP_result_7_alloc_table p_6) <= 0 /\
                  0 <= (offset_max double_xP_result_7_alloc_table p_6)),
  forall (result20: (pointer doubleP)),
  forall (HW_132: result20 = (select double_xP_double_xM_result_7 p_6)),
  forall (HW_133: (-2147483648) <= ((integer_of_int32 k_7_0) + 1) /\
                  ((integer_of_int32 k_7_0) + 1) <= 2147483647),
  forall (result21: int32),
  forall (HW_134: (integer_of_int32 result21) =
                  ((integer_of_int32 k_7_0) + 1)),
  forall (HW_135: (offset_min doubleP_double_xM_18_alloc_table result20) <=
                  (integer_of_int32 result21) /\
                  (integer_of_int32 result21) <=
                  (offset_max doubleP_double_xM_18_alloc_table result20)),
  forall (doubleP_doubleM_double_xM_18_7: (memory doubleP double)),
  forall (HW_136: doubleP_doubleM_double_xM_18_7 =
                  (store
                   doubleP_doubleM_double_xM_18_6 (shift
                                                   result20 (integer_of_int32
                                                             result21)) result19)),
  forall (result22: int32),
  forall (HW_137: (integer_of_int32 result22) = 1),
  forall (i_6_3: int32),
  forall (HW_138: i_6_3 = result22),
  forall (doubleP_doubleM_double_xM_18_8: (memory doubleP double)),
  forall (i_6_4: int32),
  forall (HW_139: True),
  forall (HW_140: ( 1 <= (integer_of_int32 i_6_4) /\
                   (integer_of_int32 i_6_4) <=
                  (integer_of_int32 ni_0) /\
                  
                  (analytic_error
                   p_6 (integer_of_int32 ni_0) ((integer_of_int32 i_6_4) - 1)
                   ((integer_of_int32 k_7_0) + 1) a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_8))),
  forall (HW_141: (integer_of_int32 i_6_4) < (integer_of_int32 ni_0)),
  forall (HW_142:
                  (Rle
                   (Rabs
                    (double_value
                     (select
                      doubleP_doubleM_double_xM_18_8 (shift
                                                      (select
                                                       double_xP_double_xM_result_7 (
                                                       shift
                                                       p_6 ((integer_of_int32
                                                             i_6_4) -
                                                           1))) (integer_of_int32
                                                                 k_7_0)))))
                   (2)%R)),
  forall (HW_143:
                  (Rle
                   (Rabs
                    (double_value
                     (select
                      doubleP_doubleM_double_xM_18_8 (shift
                                                      (select
                                                       double_xP_double_xM_result_7 (
                                                       shift
                                                       p_6 (integer_of_int32
                                                            i_6_4))) (
                                                      integer_of_int32 k_7_0)))))
                   (2)%R)),
  forall (HW_144:
                  (Rle
                   (Rabs
                    (double_value
                     (select
                      doubleP_doubleM_double_xM_18_8 (shift
                                                      (select
                                                       double_xP_double_xM_result_7 (
                                                       shift
                                                       p_6 ((integer_of_int32
                                                             i_6_4) +
                                                           1))) (integer_of_int32
                                                                 k_7_0)))))
                   (2)%R)),
  forall (HW_145:
                  (Rle
                   (Rabs
                    (double_value
                     (select
                      doubleP_doubleM_double_xM_18_8 (shift
                                                      (select
                                                       double_xP_double_xM_result_7 (
                                                       shift
                                                       p_6 (integer_of_int32
                                                            i_6_4)))
                                                      ((integer_of_int32
                                                        k_7_0) -
                                                      1)))))
                   (2)%R)),
  forall (HW_146: (-2147483648) <= ((integer_of_int32 i_6_4) + 1) /\
                  ((integer_of_int32 i_6_4) + 1) <= 2147483647),
  forall (result23: int32),
  forall (HW_147: (integer_of_int32 result23) =
                  ((integer_of_int32 i_6_4) + 1)),
  forall (HW_148: (offset_min double_xP_result_7_alloc_table p_6) <=
                  (integer_of_int32 result23) /\
                  (integer_of_int32 result23) <=
                  (offset_max double_xP_result_7_alloc_table p_6)),
  forall (result24: (pointer doubleP)),
  forall (HW_149: result24 =
                  (select
                   double_xP_double_xM_result_7 (shift
                                                 p_6 (integer_of_int32
                                                      result23)))),
  forall (HW_150: (offset_min doubleP_double_xM_18_alloc_table result24) <=
                  (integer_of_int32 k_7_0) /\ (integer_of_int32 k_7_0) <=
                  (offset_max doubleP_double_xM_18_alloc_table result24)),
  forall (result25: double),
  forall (HW_151: result25 =
                  (select
                   doubleP_doubleM_double_xM_18_8 (shift
                                                   result24 (integer_of_int32
                                                             k_7_0)))),
  forall (result26: double),
  forall (HW_152: (eq (double_value result26) (2)%R) /\
                  (eq (double_exact result26) (2)%R) /\
                  (eq (double_model result26) (2)%R)),
  forall (HW_153: (offset_min double_xP_result_7_alloc_table p_6) <=
                  (integer_of_int32 i_6_4) /\ (integer_of_int32 i_6_4) <=
                  (offset_max double_xP_result_7_alloc_table p_6)),
  forall (result27: (pointer doubleP)),
  forall (HW_154: result27 =
                  (select
                   double_xP_double_xM_result_7 (shift
                                                 p_6 (integer_of_int32 i_6_4)))),
  forall (HW_155: (offset_min doubleP_double_xM_18_alloc_table result27) <=
                  (integer_of_int32 k_7_0) /\ (integer_of_int32 k_7_0) <=
                  (offset_max doubleP_double_xM_18_alloc_table result27)),
  forall (result28: double),
  forall (HW_156: result28 =
                  (select
                   doubleP_doubleM_double_xM_18_8 (shift
                                                   result27 (integer_of_int32
                                                             k_7_0)))),
  forall (HW_157: (no_overflow_double
                   nearest_even (Rmult
                                 (double_value result26) (double_value
                                                          result28)))),
  forall (result29: double),
  forall (HW_158: (mul_double_post nearest_even result26 result28 result29)),
  (no_overflow_double
   nearest_even (Rminus (double_value result25) (double_value result29))).

Lemma forward_prop_safety_po_87 :
  forall (ni_0: int32),
  forall (nk: int32),
  forall (dt: double),
  forall (v: double),
  forall (l: double),
  forall (doubleP_double_xM_18_alloc_table: (alloc_table doubleP)),
  forall (double_xP_result_7_alloc_table: (alloc_table double_xP)),
  forall (double_xP_double_xM_result_7: (memory double_xP (pointer doubleP))),
  forall (doubleP_doubleM_double_xM_18: (memory doubleP double)),
  forall (HW_1: ( (integer_of_int32 ni_0) >= 2 /\
                 (integer_of_int32 nk) >= 2 /\
                 ~(eq (double_value l) (0)%R) /\
                 (Rgt (double_value dt) (0)%R) /\
                 (Rgt (double_exact dt) (0)%R) /\
                 (eq (double_exact v) c) /\
                 (eq (double_exact v) (double_value v)) /\
                
                (Rle
                 (1 / 10715086071862673209484250490600018105614048117055336074437503883703510511249361224931983788156958581275946729175531468251871452856923140435984577574698574803934567774824230985421074605062371141877954182153046474983581941267398767559165543946077062914571196477686542167660429831652624386837205668069376)%R
                 (double_exact dt)) /\
                 (integer_of_int32 ni_0) <= 2147483646 /\
                 (integer_of_int32 nk) <= 7598581 /\
                
                (Rle (Rmult (IZR (integer_of_int32 nk)) (double_exact dt))
                 T_max) /\
                
                (Rle
                 (Rdiv
                  (Rabs (Rminus (double_exact dt) (double_value dt))) (
                  double_value dt))
                 (1 / 2251799813685248)%R) /\
                
                (Rle
                 (1 / 3273390607896141870013189696827599152216642046043064789483291368096133796404674554883270092325904157150886684127560071009217256545885393053328527589376)%R
                 (Rmult
                  (Rmult (double_exact dt) (IZR (integer_of_int32 ni_0))) c)) /\
                
                (Rle
                 (Rmult
                  (Rmult (double_exact dt) (IZR (integer_of_int32 ni_0))) c)
                 (Rminus (1)%R (1 / 1125899906842624)%R)) /\
                
                (Rlt
                 (sqrt
                  (Rplus
                   (Rdiv
                    (1)%R (IZR
                           ((integer_of_int32 ni_0) *
                           (integer_of_int32 ni_0)))) (Rmult
                                                       (double_exact dt) (
                                                       double_exact dt))))
                 alpha_conv))),
  forall (result: double),
  forall (HW_10: (eq (double_value result) (1)%R) /\
                 (eq (double_exact result) (1)%R) /\
                 (eq (double_model result) (1)%R)),
  forall (HW_11: (no_overflow_double
                  nearest_even (IZR (integer_of_int32 ni_0)))),
  forall (result0: double),
  forall (HW_12: (double_of_real_post
                  nearest_even (IZR (integer_of_int32 ni_0)) result0)),
  forall (HW_13: ~(eq (double_value result0) (0)%R) /\
                 (no_overflow_double
                  nearest_even (Rdiv
                                (double_value result) (double_value result0)))),
  forall (result1: double),
  forall (HW_14: (div_double_post nearest_even result result0 result1)),
  forall (dx_8: double),
  forall (HW_15: dx_8 = result1),
  forall (HW_16: ( (Rgt (double_value dx_8) (0)%R) /\
                  (Rle (double_value dx_8) (05 / 10)%R) /\
                 
                 (Rle
                  (Rdiv
                   (Rabs (Rminus (double_exact dx_8) (double_value dx_8))) (
                   double_value dx_8))
                  (1 / 9007199254740992)%R))),
  forall (HW_17: ~(eq (double_value dx_8) (0)%R) /\
                 (no_overflow_double
                  nearest_even (Rdiv (double_value dt) (double_value dx_8)))),
  forall (result2: double),
  forall (HW_18: (div_double_post nearest_even dt dx_8 result2)),
  forall (HW_19: (no_overflow_double
                  nearest_even (Rmult (double_value result2) (double_value v)))),
  forall (result3: double),
  forall (HW_20: (mul_double_post nearest_even result2 v result3)),
  forall (a1: double),
  forall (HW_21: a1 = result3),
  forall (HW_22: (no_overflow_double
                  nearest_even (Rmult (double_value a1) (double_value a1)))),
  forall (result4: double),
  forall (HW_23: (mul_double_post nearest_even a1 a1 result4)),
  forall (a_1: double),
  forall (HW_24: a_1 = result4),
  forall (HW_25: ( (Rle (0)%R (double_value a_1)) /\
                  (Rle (double_value a_1) (1)%R) /\
                  (Rlt (0)%R (double_exact a_1)) /\
                  (Rle (double_exact a_1) (1)%R) /\
                 
                 (Rle (double_round_error a_1) (1 / 562949953421312)%R))),
  forall (HW_26: (-2147483648) <= ((integer_of_int32 ni_0) + 1) /\
                 ((integer_of_int32 ni_0) + 1) <= 2147483647),
  forall (result5: int32),
  forall (HW_27: (integer_of_int32 result5) = ((integer_of_int32 ni_0) + 1)),
  forall (HW_28: (-2147483648) <= ((integer_of_int32 nk) + 1) /\
                 ((integer_of_int32 nk) + 1) <= 2147483647),
  forall (result6: int32),
  forall (HW_29: (integer_of_int32 result6) = ((integer_of_int32 nk) + 1)),
  forall (HW_30: ( (integer_of_int32 result5) >= 1 /\
                  (integer_of_int32 result6) >= 1)),
  forall (result7: (pointer double_xP)),
  forall (HW_31:
                 (
                  (offset_min double_xP_result_7_alloc_table result7) <= 0 /\
                 
                 (offset_max double_xP_result_7_alloc_table result7) >=
                 ((integer_of_int32 result5) - 1) /\
                 
                 (forall (i_4:Z),
                  (0 <= i_4 /\ i_4 < (integer_of_int32 result5) ->
                   (offset_min
                    doubleP_double_xM_18_alloc_table (select
                                                      double_xP_double_xM_result_7 (
                                                      shift result7 i_4))) <=
                   0 /\
                   (offset_max
                    doubleP_double_xM_18_alloc_table (select
                                                      double_xP_double_xM_result_7 (
                                                      shift result7 i_4))) >=
                   ((integer_of_int32 result6) - 1))) /\
                 
                 (separated_matrix
                  result7 (integer_of_int32 result5) double_xP_double_xM_result_7))),
  forall (p_6: (pointer double_xP)),
  forall (HW_32: p_6 = result7),
  forall (result8: double),
  forall (HW_33: (eq (double_value result8) (0)%R) /\
                 (eq (double_exact result8) (0)%R) /\
                 (eq (double_model result8) (0)%R)),
  forall (HW_34: (offset_min double_xP_result_7_alloc_table p_6) <= 0 /\ 0 <=
                 (offset_max double_xP_result_7_alloc_table p_6)),
  forall (result9: (pointer doubleP)),
  forall (HW_35: result9 = (select double_xP_double_xM_result_7 p_6)),
  forall (HW_36: (offset_min doubleP_double_xM_18_alloc_table result9) <=
                 0 /\ 0 <=
                 (offset_max doubleP_double_xM_18_alloc_table result9)),
  forall (doubleP_doubleM_double_xM_18_0: (memory doubleP double)),
  forall (HW_37: doubleP_doubleM_double_xM_18_0 =
                 (store doubleP_doubleM_double_xM_18 result9 result8)),
  forall (result10: int32),
  forall (HW_38: (integer_of_int32 result10) = 1),
  forall (i_6: int32),
  forall (HW_39: i_6 = result10),
  forall (doubleP_doubleM_double_xM_18_1: (memory doubleP double)),
  forall (i_6_0: int32),
  forall (HW_40: True),
  forall (HW_41: ( 1 <= (integer_of_int32 i_6_0) /\
                  (integer_of_int32 i_6_0) <=
                 (integer_of_int32 ni_0) /\
                 
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) ((integer_of_int32 i_6_0) - 1) 0 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_1))),
  forall (HW_56: (integer_of_int32 i_6_0) >= (integer_of_int32 ni_0)),
  forall (result11: double),
  forall (HW_57: (eq (double_value result11) (0)%R) /\
                 (eq (double_exact result11) (0)%R) /\
                 (eq (double_model result11) (0)%R)),
  forall (HW_58: (offset_min double_xP_result_7_alloc_table p_6) <=
                 (integer_of_int32 ni_0) /\ (integer_of_int32 ni_0) <=
                 (offset_max double_xP_result_7_alloc_table p_6)),
  forall (result12: (pointer doubleP)),
  forall (HW_59: result12 =
                 (select
                  double_xP_double_xM_result_7 (shift
                                                p_6 (integer_of_int32 ni_0)))),
  forall (HW_60: (offset_min doubleP_double_xM_18_alloc_table result12) <=
                 0 /\ 0 <=
                 (offset_max doubleP_double_xM_18_alloc_table result12)),
  forall (doubleP_doubleM_double_xM_18_2: (memory doubleP double)),
  forall (HW_61: doubleP_doubleM_double_xM_18_2 =
                 (store doubleP_doubleM_double_xM_18_1 result12 result11)),
  forall (HW_62:
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) (integer_of_int32 ni_0) 0 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_2)),
  forall (result13: double),
  forall (HW_63: (eq (double_value result13) (0)%R) /\
                 (eq (double_exact result13) (0)%R) /\
                 (eq (double_model result13) (0)%R)),
  forall (HW_64: (offset_min double_xP_result_7_alloc_table p_6) <= 0 /\ 0 <=
                 (offset_max double_xP_result_7_alloc_table p_6)),
  forall (result14: (pointer doubleP)),
  forall (HW_65: result14 = (select double_xP_double_xM_result_7 p_6)),
  forall (HW_66: (offset_min
                  doubleP_double_xM_18_alloc_table (shift result14 1)) <=
                 0 /\ 0 <=
                 (offset_max
                  doubleP_double_xM_18_alloc_table (shift result14 1))),
  forall (doubleP_doubleM_double_xM_18_3: (memory doubleP double)),
  forall (HW_67: doubleP_doubleM_double_xM_18_3 =
                 (store
                  doubleP_doubleM_double_xM_18_2 (shift result14 1) result13)),
  forall (result15: int32),
  forall (HW_68: (integer_of_int32 result15) = 1),
  forall (i_6_1: int32),
  forall (HW_69: i_6_1 = result15),
  forall (doubleP_doubleM_double_xM_18_4: (memory doubleP double)),
  forall (i_6_2: int32),
  forall (HW_70: True),
  forall (HW_71: ( 1 <= (integer_of_int32 i_6_2) /\
                  (integer_of_int32 i_6_2) <=
                 (integer_of_int32 ni_0) /\
                 
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) ((integer_of_int32 i_6_2) - 1) 1 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_4))),
  forall (HW_118: (integer_of_int32 i_6_2) >= (integer_of_int32 ni_0)),
  forall (result16: double),
  forall (HW_119: (eq (double_value result16) (0)%R) /\
                  (eq (double_exact result16) (0)%R) /\
                  (eq (double_model result16) (0)%R)),
  forall (HW_120: (offset_min double_xP_result_7_alloc_table p_6) <=
                  (integer_of_int32 ni_0) /\ (integer_of_int32 ni_0) <=
                  (offset_max double_xP_result_7_alloc_table p_6)),
  forall (result17: (pointer doubleP)),
  forall (HW_121: result17 =
                  (select
                   double_xP_double_xM_result_7 (shift
                                                 p_6 (integer_of_int32 ni_0)))),
  forall (HW_122: (offset_min
                   doubleP_double_xM_18_alloc_table (shift result17 1)) <=
                  0 /\ 0 <=
                  (offset_max
                   doubleP_double_xM_18_alloc_table (shift result17 1))),
  forall (doubleP_doubleM_double_xM_18_5: (memory doubleP double)),
  forall (HW_123: doubleP_doubleM_double_xM_18_5 =
                  (store
                   doubleP_doubleM_double_xM_18_4 (shift result17 1) result16)),
  forall (HW_124:
                  (analytic_error
                   p_6 (integer_of_int32 ni_0) (integer_of_int32 ni_0) 1 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_5)),
  forall (result18: int32),
  forall (HW_125: (integer_of_int32 result18) = 1),
  forall (k_7: int32),
  forall (HW_126: k_7 = result18),
  forall (doubleP_doubleM_double_xM_18_6: (memory doubleP double)),
  forall (k_7_0: int32),
  forall (HW_127: True),
  forall (HW_128: ( 1 <= (integer_of_int32 k_7_0) /\
                   (integer_of_int32 k_7_0) <=
                  (integer_of_int32 nk) /\
                  
                  (analytic_error
                   p_6 (integer_of_int32 ni_0) (integer_of_int32 ni_0) (
                   integer_of_int32 k_7_0) a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_6))),
  forall (HW_129: (integer_of_int32 k_7_0) < (integer_of_int32 nk)),
  forall (result19: double),
  forall (HW_130: (eq (double_value result19) (0)%R) /\
                  (eq (double_exact result19) (0)%R) /\
                  (eq (double_model result19) (0)%R)),
  forall (HW_131: (offset_min double_xP_result_7_alloc_table p_6) <= 0 /\
                  0 <= (offset_max double_xP_result_7_alloc_table p_6)),
  forall (result20: (pointer doubleP)),
  forall (HW_132: result20 = (select double_xP_double_xM_result_7 p_6)),
  forall (HW_133: (-2147483648) <= ((integer_of_int32 k_7_0) + 1) /\
                  ((integer_of_int32 k_7_0) + 1) <= 2147483647),
  forall (result21: int32),
  forall (HW_134: (integer_of_int32 result21) =
                  ((integer_of_int32 k_7_0) + 1)),
  forall (HW_135: (offset_min doubleP_double_xM_18_alloc_table result20) <=
                  (integer_of_int32 result21) /\
                  (integer_of_int32 result21) <=
                  (offset_max doubleP_double_xM_18_alloc_table result20)),
  forall (doubleP_doubleM_double_xM_18_7: (memory doubleP double)),
  forall (HW_136: doubleP_doubleM_double_xM_18_7 =
                  (store
                   doubleP_doubleM_double_xM_18_6 (shift
                                                   result20 (integer_of_int32
                                                             result21)) result19)),
  forall (result22: int32),
  forall (HW_137: (integer_of_int32 result22) = 1),
  forall (i_6_3: int32),
  forall (HW_138: i_6_3 = result22),
  forall (doubleP_doubleM_double_xM_18_8: (memory doubleP double)),
  forall (i_6_4: int32),
  forall (HW_139: True),
  forall (HW_140: ( 1 <= (integer_of_int32 i_6_4) /\
                   (integer_of_int32 i_6_4) <=
                  (integer_of_int32 ni_0) /\
                  
                  (analytic_error
                   p_6 (integer_of_int32 ni_0) ((integer_of_int32 i_6_4) - 1)
                   ((integer_of_int32 k_7_0) + 1) a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_8))),
  forall (HW_141: (integer_of_int32 i_6_4) < (integer_of_int32 ni_0)),
  forall (HW_142:
                  (Rle
                   (Rabs
                    (double_value
                     (select
                      doubleP_doubleM_double_xM_18_8 (shift
                                                      (select
                                                       double_xP_double_xM_result_7 (
                                                       shift
                                                       p_6 ((integer_of_int32
                                                             i_6_4) -
                                                           1))) (integer_of_int32
                                                                 k_7_0)))))
                   (2)%R)),
  forall (HW_143:
                  (Rle
                   (Rabs
                    (double_value
                     (select
                      doubleP_doubleM_double_xM_18_8 (shift
                                                      (select
                                                       double_xP_double_xM_result_7 (
                                                       shift
                                                       p_6 (integer_of_int32
                                                            i_6_4))) (
                                                      integer_of_int32 k_7_0)))))
                   (2)%R)),
  forall (HW_144:
                  (Rle
                   (Rabs
                    (double_value
                     (select
                      doubleP_doubleM_double_xM_18_8 (shift
                                                      (select
                                                       double_xP_double_xM_result_7 (
                                                       shift
                                                       p_6 ((integer_of_int32
                                                             i_6_4) +
                                                           1))) (integer_of_int32
                                                                 k_7_0)))))
                   (2)%R)),
  forall (HW_145:
                  (Rle
                   (Rabs
                    (double_value
                     (select
                      doubleP_doubleM_double_xM_18_8 (shift
                                                      (select
                                                       double_xP_double_xM_result_7 (
                                                       shift
                                                       p_6 (integer_of_int32
                                                            i_6_4)))
                                                      ((integer_of_int32
                                                        k_7_0) -
                                                      1)))))
                   (2)%R)),
  forall (HW_146: (-2147483648) <= ((integer_of_int32 i_6_4) + 1) /\
                  ((integer_of_int32 i_6_4) + 1) <= 2147483647),
  forall (result23: int32),
  forall (HW_147: (integer_of_int32 result23) =
                  ((integer_of_int32 i_6_4) + 1)),
  forall (HW_148: (offset_min double_xP_result_7_alloc_table p_6) <=
                  (integer_of_int32 result23) /\
                  (integer_of_int32 result23) <=
                  (offset_max double_xP_result_7_alloc_table p_6)),
  forall (result24: (pointer doubleP)),
  forall (HW_149: result24 =
                  (select
                   double_xP_double_xM_result_7 (shift
                                                 p_6 (integer_of_int32
                                                      result23)))),
  forall (HW_150: (offset_min doubleP_double_xM_18_alloc_table result24) <=
                  (integer_of_int32 k_7_0) /\ (integer_of_int32 k_7_0) <=
                  (offset_max doubleP_double_xM_18_alloc_table result24)),
  forall (result25: double),
  forall (HW_151: result25 =
                  (select
                   doubleP_doubleM_double_xM_18_8 (shift
                                                   result24 (integer_of_int32
                                                             k_7_0)))),
  forall (result26: double),
  forall (HW_152: (eq (double_value result26) (2)%R) /\
                  (eq (double_exact result26) (2)%R) /\
                  (eq (double_model result26) (2)%R)),
  forall (HW_153: (offset_min double_xP_result_7_alloc_table p_6) <=
                  (integer_of_int32 i_6_4) /\ (integer_of_int32 i_6_4) <=
                  (offset_max double_xP_result_7_alloc_table p_6)),
  forall (result27: (pointer doubleP)),
  forall (HW_154: result27 =
                  (select
                   double_xP_double_xM_result_7 (shift
                                                 p_6 (integer_of_int32 i_6_4)))),
  forall (HW_155: (offset_min doubleP_double_xM_18_alloc_table result27) <=
                  (integer_of_int32 k_7_0) /\ (integer_of_int32 k_7_0) <=
                  (offset_max doubleP_double_xM_18_alloc_table result27)),
  forall (result28: double),
  forall (HW_156: result28 =
                  (select
                   doubleP_doubleM_double_xM_18_8 (shift
                                                   result27 (integer_of_int32
                                                             k_7_0)))),
  forall (HW_157: (no_overflow_double
                   nearest_even (Rmult
                                 (double_value result26) (double_value
                                                          result28)))),
  forall (result29: double),
  forall (HW_158: (mul_double_post nearest_even result26 result28 result29)),
  forall (HW_159: (no_overflow_double
                   nearest_even (Rminus
                                 (double_value result25) (double_value
                                                          result29)))),
  forall (result30: double),
  forall (HW_160: (sub_double_post nearest_even result25 result29 result30)),
  forall (HW_161: (-2147483648) <= ((integer_of_int32 i_6_4) - 1) /\
                  ((integer_of_int32 i_6_4) - 1) <= 2147483647),
  forall (result31: int32),
  forall (HW_162: (integer_of_int32 result31) =
                  ((integer_of_int32 i_6_4) - 1)),
  forall (HW_163: (offset_min double_xP_result_7_alloc_table p_6) <=
                  (integer_of_int32 result31) /\
                  (integer_of_int32 result31) <=
                  (offset_max double_xP_result_7_alloc_table p_6)),
  forall (result32: (pointer doubleP)),
  forall (HW_164: result32 =
                  (select
                   double_xP_double_xM_result_7 (shift
                                                 p_6 (integer_of_int32
                                                      result31)))),
  forall (HW_165: (offset_min doubleP_double_xM_18_alloc_table result32) <=
                  (integer_of_int32 k_7_0) /\ (integer_of_int32 k_7_0) <=
                  (offset_max doubleP_double_xM_18_alloc_table result32)),
  forall (result33: double),
  forall (HW_166: result33 =
                  (select
                   doubleP_doubleM_double_xM_18_8 (shift
                                                   result32 (integer_of_int32
                                                             k_7_0)))),
  (no_overflow_double
   nearest_even (Rplus (double_value result30) (double_value result33))).

Lemma forward_prop_safety_po_95 :
  forall (ni_0: int32),
  forall (nk: int32),
  forall (dt: double),
  forall (v: double),
  forall (l: double),
  forall (doubleP_double_xM_18_alloc_table: (alloc_table doubleP)),
  forall (double_xP_result_7_alloc_table: (alloc_table double_xP)),
  forall (double_xP_double_xM_result_7: (memory double_xP (pointer doubleP))),
  forall (doubleP_doubleM_double_xM_18: (memory doubleP double)),
  forall (HW_1: ( (integer_of_int32 ni_0) >= 2 /\
                 (integer_of_int32 nk) >= 2 /\
                 ~(eq (double_value l) (0)%R) /\
                 (Rgt (double_value dt) (0)%R) /\
                 (Rgt (double_exact dt) (0)%R) /\
                 (eq (double_exact v) c) /\
                 (eq (double_exact v) (double_value v)) /\
                
                (Rle
                 (1 / 10715086071862673209484250490600018105614048117055336074437503883703510511249361224931983788156958581275946729175531468251871452856923140435984577574698574803934567774824230985421074605062371141877954182153046474983581941267398767559165543946077062914571196477686542167660429831652624386837205668069376)%R
                 (double_exact dt)) /\
                 (integer_of_int32 ni_0) <= 2147483646 /\
                 (integer_of_int32 nk) <= 7598581 /\
                
                (Rle (Rmult (IZR (integer_of_int32 nk)) (double_exact dt))
                 T_max) /\
                
                (Rle
                 (Rdiv
                  (Rabs (Rminus (double_exact dt) (double_value dt))) (
                  double_value dt))
                 (1 / 2251799813685248)%R) /\
                
                (Rle
                 (1 / 3273390607896141870013189696827599152216642046043064789483291368096133796404674554883270092325904157150886684127560071009217256545885393053328527589376)%R
                 (Rmult
                  (Rmult (double_exact dt) (IZR (integer_of_int32 ni_0))) c)) /\
                
                (Rle
                 (Rmult
                  (Rmult (double_exact dt) (IZR (integer_of_int32 ni_0))) c)
                 (Rminus (1)%R (1 / 1125899906842624)%R)) /\
                
                (Rlt
                 (sqrt
                  (Rplus
                   (Rdiv
                    (1)%R (IZR
                           ((integer_of_int32 ni_0) *
                           (integer_of_int32 ni_0)))) (Rmult
                                                       (double_exact dt) (
                                                       double_exact dt))))
                 alpha_conv))),
  forall (result: double),
  forall (HW_10: (eq (double_value result) (1)%R) /\
                 (eq (double_exact result) (1)%R) /\
                 (eq (double_model result) (1)%R)),
  forall (HW_11: (no_overflow_double
                  nearest_even (IZR (integer_of_int32 ni_0)))),
  forall (result0: double),
  forall (HW_12: (double_of_real_post
                  nearest_even (IZR (integer_of_int32 ni_0)) result0)),
  forall (HW_13: ~(eq (double_value result0) (0)%R) /\
                 (no_overflow_double
                  nearest_even (Rdiv
                                (double_value result) (double_value result0)))),
  forall (result1: double),
  forall (HW_14: (div_double_post nearest_even result result0 result1)),
  forall (dx_8: double),
  forall (HW_15: dx_8 = result1),
  forall (HW_16: ( (Rgt (double_value dx_8) (0)%R) /\
                  (Rle (double_value dx_8) (05 / 10)%R) /\
                 
                 (Rle
                  (Rdiv
                   (Rabs (Rminus (double_exact dx_8) (double_value dx_8))) (
                   double_value dx_8))
                  (1 / 9007199254740992)%R))),
  forall (HW_17: ~(eq (double_value dx_8) (0)%R) /\
                 (no_overflow_double
                  nearest_even (Rdiv (double_value dt) (double_value dx_8)))),
  forall (result2: double),
  forall (HW_18: (div_double_post nearest_even dt dx_8 result2)),
  forall (HW_19: (no_overflow_double
                  nearest_even (Rmult (double_value result2) (double_value v)))),
  forall (result3: double),
  forall (HW_20: (mul_double_post nearest_even result2 v result3)),
  forall (a1: double),
  forall (HW_21: a1 = result3),
  forall (HW_22: (no_overflow_double
                  nearest_even (Rmult (double_value a1) (double_value a1)))),
  forall (result4: double),
  forall (HW_23: (mul_double_post nearest_even a1 a1 result4)),
  forall (a_1: double),
  forall (HW_24: a_1 = result4),
  forall (HW_25: ( (Rle (0)%R (double_value a_1)) /\
                  (Rle (double_value a_1) (1)%R) /\
                  (Rlt (0)%R (double_exact a_1)) /\
                  (Rle (double_exact a_1) (1)%R) /\
                 
                 (Rle (double_round_error a_1) (1 / 562949953421312)%R))),
  forall (HW_26: (-2147483648) <= ((integer_of_int32 ni_0) + 1) /\
                 ((integer_of_int32 ni_0) + 1) <= 2147483647),
  forall (result5: int32),
  forall (HW_27: (integer_of_int32 result5) = ((integer_of_int32 ni_0) + 1)),
  forall (HW_28: (-2147483648) <= ((integer_of_int32 nk) + 1) /\
                 ((integer_of_int32 nk) + 1) <= 2147483647),
  forall (result6: int32),
  forall (HW_29: (integer_of_int32 result6) = ((integer_of_int32 nk) + 1)),
  forall (HW_30: ( (integer_of_int32 result5) >= 1 /\
                  (integer_of_int32 result6) >= 1)),
  forall (result7: (pointer double_xP)),
  forall (HW_31:
                 (
                  (offset_min double_xP_result_7_alloc_table result7) <= 0 /\
                 
                 (offset_max double_xP_result_7_alloc_table result7) >=
                 ((integer_of_int32 result5) - 1) /\
                 
                 (forall (i_4:Z),
                  (0 <= i_4 /\ i_4 < (integer_of_int32 result5) ->
                   (offset_min
                    doubleP_double_xM_18_alloc_table (select
                                                      double_xP_double_xM_result_7 (
                                                      shift result7 i_4))) <=
                   0 /\
                   (offset_max
                    doubleP_double_xM_18_alloc_table (select
                                                      double_xP_double_xM_result_7 (
                                                      shift result7 i_4))) >=
                   ((integer_of_int32 result6) - 1))) /\
                 
                 (separated_matrix
                  result7 (integer_of_int32 result5) double_xP_double_xM_result_7))),
  forall (p_6: (pointer double_xP)),
  forall (HW_32: p_6 = result7),
  forall (result8: double),
  forall (HW_33: (eq (double_value result8) (0)%R) /\
                 (eq (double_exact result8) (0)%R) /\
                 (eq (double_model result8) (0)%R)),
  forall (HW_34: (offset_min double_xP_result_7_alloc_table p_6) <= 0 /\ 0 <=
                 (offset_max double_xP_result_7_alloc_table p_6)),
  forall (result9: (pointer doubleP)),
  forall (HW_35: result9 = (select double_xP_double_xM_result_7 p_6)),
  forall (HW_36: (offset_min doubleP_double_xM_18_alloc_table result9) <=
                 0 /\ 0 <=
                 (offset_max doubleP_double_xM_18_alloc_table result9)),
  forall (doubleP_doubleM_double_xM_18_0: (memory doubleP double)),
  forall (HW_37: doubleP_doubleM_double_xM_18_0 =
                 (store doubleP_doubleM_double_xM_18 result9 result8)),
  forall (result10: int32),
  forall (HW_38: (integer_of_int32 result10) = 1),
  forall (i_6: int32),
  forall (HW_39: i_6 = result10),
  forall (doubleP_doubleM_double_xM_18_1: (memory doubleP double)),
  forall (i_6_0: int32),
  forall (HW_40: True),
  forall (HW_41: ( 1 <= (integer_of_int32 i_6_0) /\
                  (integer_of_int32 i_6_0) <=
                 (integer_of_int32 ni_0) /\
                 
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) ((integer_of_int32 i_6_0) - 1) 0 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_1))),
  forall (HW_56: (integer_of_int32 i_6_0) >= (integer_of_int32 ni_0)),
  forall (result11: double),
  forall (HW_57: (eq (double_value result11) (0)%R) /\
                 (eq (double_exact result11) (0)%R) /\
                 (eq (double_model result11) (0)%R)),
  forall (HW_58: (offset_min double_xP_result_7_alloc_table p_6) <=
                 (integer_of_int32 ni_0) /\ (integer_of_int32 ni_0) <=
                 (offset_max double_xP_result_7_alloc_table p_6)),
  forall (result12: (pointer doubleP)),
  forall (HW_59: result12 =
                 (select
                  double_xP_double_xM_result_7 (shift
                                                p_6 (integer_of_int32 ni_0)))),
  forall (HW_60: (offset_min doubleP_double_xM_18_alloc_table result12) <=
                 0 /\ 0 <=
                 (offset_max doubleP_double_xM_18_alloc_table result12)),
  forall (doubleP_doubleM_double_xM_18_2: (memory doubleP double)),
  forall (HW_61: doubleP_doubleM_double_xM_18_2 =
                 (store doubleP_doubleM_double_xM_18_1 result12 result11)),
  forall (HW_62:
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) (integer_of_int32 ni_0) 0 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_2)),
  forall (result13: double),
  forall (HW_63: (eq (double_value result13) (0)%R) /\
                 (eq (double_exact result13) (0)%R) /\
                 (eq (double_model result13) (0)%R)),
  forall (HW_64: (offset_min double_xP_result_7_alloc_table p_6) <= 0 /\ 0 <=
                 (offset_max double_xP_result_7_alloc_table p_6)),
  forall (result14: (pointer doubleP)),
  forall (HW_65: result14 = (select double_xP_double_xM_result_7 p_6)),
  forall (HW_66: (offset_min
                  doubleP_double_xM_18_alloc_table (shift result14 1)) <=
                 0 /\ 0 <=
                 (offset_max
                  doubleP_double_xM_18_alloc_table (shift result14 1))),
  forall (doubleP_doubleM_double_xM_18_3: (memory doubleP double)),
  forall (HW_67: doubleP_doubleM_double_xM_18_3 =
                 (store
                  doubleP_doubleM_double_xM_18_2 (shift result14 1) result13)),
  forall (result15: int32),
  forall (HW_68: (integer_of_int32 result15) = 1),
  forall (i_6_1: int32),
  forall (HW_69: i_6_1 = result15),
  forall (doubleP_doubleM_double_xM_18_4: (memory doubleP double)),
  forall (i_6_2: int32),
  forall (HW_70: True),
  forall (HW_71: ( 1 <= (integer_of_int32 i_6_2) /\
                  (integer_of_int32 i_6_2) <=
                 (integer_of_int32 ni_0) /\
                 
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) ((integer_of_int32 i_6_2) - 1) 1 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_4))),
  forall (HW_118: (integer_of_int32 i_6_2) >= (integer_of_int32 ni_0)),
  forall (result16: double),
  forall (HW_119: (eq (double_value result16) (0)%R) /\
                  (eq (double_exact result16) (0)%R) /\
                  (eq (double_model result16) (0)%R)),
  forall (HW_120: (offset_min double_xP_result_7_alloc_table p_6) <=
                  (integer_of_int32 ni_0) /\ (integer_of_int32 ni_0) <=
                  (offset_max double_xP_result_7_alloc_table p_6)),
  forall (result17: (pointer doubleP)),
  forall (HW_121: result17 =
                  (select
                   double_xP_double_xM_result_7 (shift
                                                 p_6 (integer_of_int32 ni_0)))),
  forall (HW_122: (offset_min
                   doubleP_double_xM_18_alloc_table (shift result17 1)) <=
                  0 /\ 0 <=
                  (offset_max
                   doubleP_double_xM_18_alloc_table (shift result17 1))),
  forall (doubleP_doubleM_double_xM_18_5: (memory doubleP double)),
  forall (HW_123: doubleP_doubleM_double_xM_18_5 =
                  (store
                   doubleP_doubleM_double_xM_18_4 (shift result17 1) result16)),
  forall (HW_124:
                  (analytic_error
                   p_6 (integer_of_int32 ni_0) (integer_of_int32 ni_0) 1 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_5)),
  forall (result18: int32),
  forall (HW_125: (integer_of_int32 result18) = 1),
  forall (k_7: int32),
  forall (HW_126: k_7 = result18),
  forall (doubleP_doubleM_double_xM_18_6: (memory doubleP double)),
  forall (k_7_0: int32),
  forall (HW_127: True),
  forall (HW_128: ( 1 <= (integer_of_int32 k_7_0) /\
                   (integer_of_int32 k_7_0) <=
                  (integer_of_int32 nk) /\
                  
                  (analytic_error
                   p_6 (integer_of_int32 ni_0) (integer_of_int32 ni_0) (
                   integer_of_int32 k_7_0) a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_6))),
  forall (HW_129: (integer_of_int32 k_7_0) < (integer_of_int32 nk)),
  forall (result19: double),
  forall (HW_130: (eq (double_value result19) (0)%R) /\
                  (eq (double_exact result19) (0)%R) /\
                  (eq (double_model result19) (0)%R)),
  forall (HW_131: (offset_min double_xP_result_7_alloc_table p_6) <= 0 /\
                  0 <= (offset_max double_xP_result_7_alloc_table p_6)),
  forall (result20: (pointer doubleP)),
  forall (HW_132: result20 = (select double_xP_double_xM_result_7 p_6)),
  forall (HW_133: (-2147483648) <= ((integer_of_int32 k_7_0) + 1) /\
                  ((integer_of_int32 k_7_0) + 1) <= 2147483647),
  forall (result21: int32),
  forall (HW_134: (integer_of_int32 result21) =
                  ((integer_of_int32 k_7_0) + 1)),
  forall (HW_135: (offset_min doubleP_double_xM_18_alloc_table result20) <=
                  (integer_of_int32 result21) /\
                  (integer_of_int32 result21) <=
                  (offset_max doubleP_double_xM_18_alloc_table result20)),
  forall (doubleP_doubleM_double_xM_18_7: (memory doubleP double)),
  forall (HW_136: doubleP_doubleM_double_xM_18_7 =
                  (store
                   doubleP_doubleM_double_xM_18_6 (shift
                                                   result20 (integer_of_int32
                                                             result21)) result19)),
  forall (result22: int32),
  forall (HW_137: (integer_of_int32 result22) = 1),
  forall (i_6_3: int32),
  forall (HW_138: i_6_3 = result22),
  forall (doubleP_doubleM_double_xM_18_8: (memory doubleP double)),
  forall (i_6_4: int32),
  forall (HW_139: True),
  forall (HW_140: ( 1 <= (integer_of_int32 i_6_4) /\
                   (integer_of_int32 i_6_4) <=
                  (integer_of_int32 ni_0) /\
                  
                  (analytic_error
                   p_6 (integer_of_int32 ni_0) ((integer_of_int32 i_6_4) - 1)
                   ((integer_of_int32 k_7_0) + 1) a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_8))),
  forall (HW_141: (integer_of_int32 i_6_4) < (integer_of_int32 ni_0)),
  forall (HW_142:
                  (Rle
                   (Rabs
                    (double_value
                     (select
                      doubleP_doubleM_double_xM_18_8 (shift
                                                      (select
                                                       double_xP_double_xM_result_7 (
                                                       shift
                                                       p_6 ((integer_of_int32
                                                             i_6_4) -
                                                           1))) (integer_of_int32
                                                                 k_7_0)))))
                   (2)%R)),
  forall (HW_143:
                  (Rle
                   (Rabs
                    (double_value
                     (select
                      doubleP_doubleM_double_xM_18_8 (shift
                                                      (select
                                                       double_xP_double_xM_result_7 (
                                                       shift
                                                       p_6 (integer_of_int32
                                                            i_6_4))) (
                                                      integer_of_int32 k_7_0)))))
                   (2)%R)),
  forall (HW_144:
                  (Rle
                   (Rabs
                    (double_value
                     (select
                      doubleP_doubleM_double_xM_18_8 (shift
                                                      (select
                                                       double_xP_double_xM_result_7 (
                                                       shift
                                                       p_6 ((integer_of_int32
                                                             i_6_4) +
                                                           1))) (integer_of_int32
                                                                 k_7_0)))))
                   (2)%R)),
  forall (HW_145:
                  (Rle
                   (Rabs
                    (double_value
                     (select
                      doubleP_doubleM_double_xM_18_8 (shift
                                                      (select
                                                       double_xP_double_xM_result_7 (
                                                       shift
                                                       p_6 (integer_of_int32
                                                            i_6_4)))
                                                      ((integer_of_int32
                                                        k_7_0) -
                                                      1)))))
                   (2)%R)),
  forall (HW_146: (-2147483648) <= ((integer_of_int32 i_6_4) + 1) /\
                  ((integer_of_int32 i_6_4) + 1) <= 2147483647),
  forall (result23: int32),
  forall (HW_147: (integer_of_int32 result23) =
                  ((integer_of_int32 i_6_4) + 1)),
  forall (HW_148: (offset_min double_xP_result_7_alloc_table p_6) <=
                  (integer_of_int32 result23) /\
                  (integer_of_int32 result23) <=
                  (offset_max double_xP_result_7_alloc_table p_6)),
  forall (result24: (pointer doubleP)),
  forall (HW_149: result24 =
                  (select
                   double_xP_double_xM_result_7 (shift
                                                 p_6 (integer_of_int32
                                                      result23)))),
  forall (HW_150: (offset_min doubleP_double_xM_18_alloc_table result24) <=
                  (integer_of_int32 k_7_0) /\ (integer_of_int32 k_7_0) <=
                  (offset_max doubleP_double_xM_18_alloc_table result24)),
  forall (result25: double),
  forall (HW_151: result25 =
                  (select
                   doubleP_doubleM_double_xM_18_8 (shift
                                                   result24 (integer_of_int32
                                                             k_7_0)))),
  forall (result26: double),
  forall (HW_152: (eq (double_value result26) (2)%R) /\
                  (eq (double_exact result26) (2)%R) /\
                  (eq (double_model result26) (2)%R)),
  forall (HW_153: (offset_min double_xP_result_7_alloc_table p_6) <=
                  (integer_of_int32 i_6_4) /\ (integer_of_int32 i_6_4) <=
                  (offset_max double_xP_result_7_alloc_table p_6)),
  forall (result27: (pointer doubleP)),
  forall (HW_154: result27 =
                  (select
                   double_xP_double_xM_result_7 (shift
                                                 p_6 (integer_of_int32 i_6_4)))),
  forall (HW_155: (offset_min doubleP_double_xM_18_alloc_table result27) <=
                  (integer_of_int32 k_7_0) /\ (integer_of_int32 k_7_0) <=
                  (offset_max doubleP_double_xM_18_alloc_table result27)),
  forall (result28: double),
  forall (HW_156: result28 =
                  (select
                   doubleP_doubleM_double_xM_18_8 (shift
                                                   result27 (integer_of_int32
                                                             k_7_0)))),
  forall (HW_157: (no_overflow_double
                   nearest_even (Rmult
                                 (double_value result26) (double_value
                                                          result28)))),
  forall (result29: double),
  forall (HW_158: (mul_double_post nearest_even result26 result28 result29)),
  forall (HW_159: (no_overflow_double
                   nearest_even (Rminus
                                 (double_value result25) (double_value
                                                          result29)))),
  forall (result30: double),
  forall (HW_160: (sub_double_post nearest_even result25 result29 result30)),
  forall (HW_161: (-2147483648) <= ((integer_of_int32 i_6_4) - 1) /\
                  ((integer_of_int32 i_6_4) - 1) <= 2147483647),
  forall (result31: int32),
  forall (HW_162: (integer_of_int32 result31) =
                  ((integer_of_int32 i_6_4) - 1)),
  forall (HW_163: (offset_min double_xP_result_7_alloc_table p_6) <=
                  (integer_of_int32 result31) /\
                  (integer_of_int32 result31) <=
                  (offset_max double_xP_result_7_alloc_table p_6)),
  forall (result32: (pointer doubleP)),
  forall (HW_164: result32 =
                  (select
                   double_xP_double_xM_result_7 (shift
                                                 p_6 (integer_of_int32
                                                      result31)))),
  forall (HW_165: (offset_min doubleP_double_xM_18_alloc_table result32) <=
                  (integer_of_int32 k_7_0) /\ (integer_of_int32 k_7_0) <=
                  (offset_max doubleP_double_xM_18_alloc_table result32)),
  forall (result33: double),
  forall (HW_166: result33 =
                  (select
                   doubleP_doubleM_double_xM_18_8 (shift
                                                   result32 (integer_of_int32
                                                             k_7_0)))),
  forall (HW_167: (no_overflow_double
                   nearest_even (Rplus
                                 (double_value result30) (double_value
                                                          result33)))),
  forall (result34: double),
  forall (HW_168: (add_double_post nearest_even result30 result33 result34)),
  forall (dp: double),
  forall (HW_169: dp = result34),
  forall (result35: double),
  forall (HW_170: (eq (double_value result35) (2)%R) /\
                  (eq (double_exact result35) (2)%R) /\
                  (eq (double_model result35) (2)%R)),
  forall (HW_171: (offset_min double_xP_result_7_alloc_table p_6) <=
                  (integer_of_int32 i_6_4) /\ (integer_of_int32 i_6_4) <=
                  (offset_max double_xP_result_7_alloc_table p_6)),
  forall (result36: (pointer doubleP)),
  forall (HW_172: result36 =
                  (select
                   double_xP_double_xM_result_7 (shift
                                                 p_6 (integer_of_int32 i_6_4)))),
  forall (HW_173: (offset_min doubleP_double_xM_18_alloc_table result36) <=
                  (integer_of_int32 k_7_0) /\ (integer_of_int32 k_7_0) <=
                  (offset_max doubleP_double_xM_18_alloc_table result36)),
  forall (result37: double),
  forall (HW_174: result37 =
                  (select
                   doubleP_doubleM_double_xM_18_8 (shift
                                                   result36 (integer_of_int32
                                                             k_7_0)))),
  forall (HW_175: (no_overflow_double
                   nearest_even (Rmult
                                 (double_value result35) (double_value
                                                          result37)))),
  forall (result38: double),
  forall (HW_176: (mul_double_post nearest_even result35 result37 result38)),
  forall (HW_177: (offset_min double_xP_result_7_alloc_table p_6) <=
                  (integer_of_int32 i_6_4) /\ (integer_of_int32 i_6_4) <=
                  (offset_max double_xP_result_7_alloc_table p_6)),
  forall (result39: (pointer doubleP)),
  forall (HW_178: result39 =
                  (select
                   double_xP_double_xM_result_7 (shift
                                                 p_6 (integer_of_int32 i_6_4)))),
  forall (HW_179: (-2147483648) <= ((integer_of_int32 k_7_0) - 1) /\
                  ((integer_of_int32 k_7_0) - 1) <= 2147483647),
  forall (result40: int32),
  forall (HW_180: (integer_of_int32 result40) =
                  ((integer_of_int32 k_7_0) - 1)),
  forall (HW_181: (offset_min doubleP_double_xM_18_alloc_table result39) <=
                  (integer_of_int32 result40) /\
                  (integer_of_int32 result40) <=
                  (offset_max doubleP_double_xM_18_alloc_table result39)),
  forall (result41: double),
  forall (HW_182: result41 =
                  (select
                   doubleP_doubleM_double_xM_18_8 (shift
                                                   result39 (integer_of_int32
                                                             result40)))),
  (no_overflow_double
   nearest_even (Rminus (double_value result38) (double_value result41))).

Lemma forward_prop_safety_po_97 :
  forall (ni_0: int32),
  forall (nk: int32),
  forall (dt: double),
  forall (v: double),
  forall (l: double),
  forall (doubleP_double_xM_18_alloc_table: (alloc_table doubleP)),
  forall (double_xP_result_7_alloc_table: (alloc_table double_xP)),
  forall (double_xP_double_xM_result_7: (memory double_xP (pointer doubleP))),
  forall (doubleP_doubleM_double_xM_18: (memory doubleP double)),
  forall (HW_1: ( (integer_of_int32 ni_0) >= 2 /\
                 (integer_of_int32 nk) >= 2 /\
                 ~(eq (double_value l) (0)%R) /\
                 (Rgt (double_value dt) (0)%R) /\
                 (Rgt (double_exact dt) (0)%R) /\
                 (eq (double_exact v) c) /\
                 (eq (double_exact v) (double_value v)) /\
                
                (Rle
                 (1 / 10715086071862673209484250490600018105614048117055336074437503883703510511249361224931983788156958581275946729175531468251871452856923140435984577574698574803934567774824230985421074605062371141877954182153046474983581941267398767559165543946077062914571196477686542167660429831652624386837205668069376)%R
                 (double_exact dt)) /\
                 (integer_of_int32 ni_0) <= 2147483646 /\
                 (integer_of_int32 nk) <= 7598581 /\
                
                (Rle (Rmult (IZR (integer_of_int32 nk)) (double_exact dt))
                 T_max) /\
                
                (Rle
                 (Rdiv
                  (Rabs (Rminus (double_exact dt) (double_value dt))) (
                  double_value dt))
                 (1 / 2251799813685248)%R) /\
                
                (Rle
                 (1 / 3273390607896141870013189696827599152216642046043064789483291368096133796404674554883270092325904157150886684127560071009217256545885393053328527589376)%R
                 (Rmult
                  (Rmult (double_exact dt) (IZR (integer_of_int32 ni_0))) c)) /\
                
                (Rle
                 (Rmult
                  (Rmult (double_exact dt) (IZR (integer_of_int32 ni_0))) c)
                 (Rminus (1)%R (1 / 1125899906842624)%R)) /\
                
                (Rlt
                 (sqrt
                  (Rplus
                   (Rdiv
                    (1)%R (IZR
                           ((integer_of_int32 ni_0) *
                           (integer_of_int32 ni_0)))) (Rmult
                                                       (double_exact dt) (
                                                       double_exact dt))))
                 alpha_conv))),
  forall (result: double),
  forall (HW_10: (eq (double_value result) (1)%R) /\
                 (eq (double_exact result) (1)%R) /\
                 (eq (double_model result) (1)%R)),
  forall (HW_11: (no_overflow_double
                  nearest_even (IZR (integer_of_int32 ni_0)))),
  forall (result0: double),
  forall (HW_12: (double_of_real_post
                  nearest_even (IZR (integer_of_int32 ni_0)) result0)),
  forall (HW_13: ~(eq (double_value result0) (0)%R) /\
                 (no_overflow_double
                  nearest_even (Rdiv
                                (double_value result) (double_value result0)))),
  forall (result1: double),
  forall (HW_14: (div_double_post nearest_even result result0 result1)),
  forall (dx_8: double),
  forall (HW_15: dx_8 = result1),
  forall (HW_16: ( (Rgt (double_value dx_8) (0)%R) /\
                  (Rle (double_value dx_8) (05 / 10)%R) /\
                 
                 (Rle
                  (Rdiv
                   (Rabs (Rminus (double_exact dx_8) (double_value dx_8))) (
                   double_value dx_8))
                  (1 / 9007199254740992)%R))),
  forall (HW_17: ~(eq (double_value dx_8) (0)%R) /\
                 (no_overflow_double
                  nearest_even (Rdiv (double_value dt) (double_value dx_8)))),
  forall (result2: double),
  forall (HW_18: (div_double_post nearest_even dt dx_8 result2)),
  forall (HW_19: (no_overflow_double
                  nearest_even (Rmult (double_value result2) (double_value v)))),
  forall (result3: double),
  forall (HW_20: (mul_double_post nearest_even result2 v result3)),
  forall (a1: double),
  forall (HW_21: a1 = result3),
  forall (HW_22: (no_overflow_double
                  nearest_even (Rmult (double_value a1) (double_value a1)))),
  forall (result4: double),
  forall (HW_23: (mul_double_post nearest_even a1 a1 result4)),
  forall (a_1: double),
  forall (HW_24: a_1 = result4),
  forall (HW_25: ( (Rle (0)%R (double_value a_1)) /\
                  (Rle (double_value a_1) (1)%R) /\
                  (Rlt (0)%R (double_exact a_1)) /\
                  (Rle (double_exact a_1) (1)%R) /\
                 
                 (Rle (double_round_error a_1) (1 / 562949953421312)%R))),
  forall (HW_26: (-2147483648) <= ((integer_of_int32 ni_0) + 1) /\
                 ((integer_of_int32 ni_0) + 1) <= 2147483647),
  forall (result5: int32),
  forall (HW_27: (integer_of_int32 result5) = ((integer_of_int32 ni_0) + 1)),
  forall (HW_28: (-2147483648) <= ((integer_of_int32 nk) + 1) /\
                 ((integer_of_int32 nk) + 1) <= 2147483647),
  forall (result6: int32),
  forall (HW_29: (integer_of_int32 result6) = ((integer_of_int32 nk) + 1)),
  forall (HW_30: ( (integer_of_int32 result5) >= 1 /\
                  (integer_of_int32 result6) >= 1)),
  forall (result7: (pointer double_xP)),
  forall (HW_31:
                 (
                  (offset_min double_xP_result_7_alloc_table result7) <= 0 /\
                 
                 (offset_max double_xP_result_7_alloc_table result7) >=
                 ((integer_of_int32 result5) - 1) /\
                 
                 (forall (i_4:Z),
                  (0 <= i_4 /\ i_4 < (integer_of_int32 result5) ->
                   (offset_min
                    doubleP_double_xM_18_alloc_table (select
                                                      double_xP_double_xM_result_7 (
                                                      shift result7 i_4))) <=
                   0 /\
                   (offset_max
                    doubleP_double_xM_18_alloc_table (select
                                                      double_xP_double_xM_result_7 (
                                                      shift result7 i_4))) >=
                   ((integer_of_int32 result6) - 1))) /\
                 
                 (separated_matrix
                  result7 (integer_of_int32 result5) double_xP_double_xM_result_7))),
  forall (p_6: (pointer double_xP)),
  forall (HW_32: p_6 = result7),
  forall (result8: double),
  forall (HW_33: (eq (double_value result8) (0)%R) /\
                 (eq (double_exact result8) (0)%R) /\
                 (eq (double_model result8) (0)%R)),
  forall (HW_34: (offset_min double_xP_result_7_alloc_table p_6) <= 0 /\ 0 <=
                 (offset_max double_xP_result_7_alloc_table p_6)),
  forall (result9: (pointer doubleP)),
  forall (HW_35: result9 = (select double_xP_double_xM_result_7 p_6)),
  forall (HW_36: (offset_min doubleP_double_xM_18_alloc_table result9) <=
                 0 /\ 0 <=
                 (offset_max doubleP_double_xM_18_alloc_table result9)),
  forall (doubleP_doubleM_double_xM_18_0: (memory doubleP double)),
  forall (HW_37: doubleP_doubleM_double_xM_18_0 =
                 (store doubleP_doubleM_double_xM_18 result9 result8)),
  forall (result10: int32),
  forall (HW_38: (integer_of_int32 result10) = 1),
  forall (i_6: int32),
  forall (HW_39: i_6 = result10),
  forall (doubleP_doubleM_double_xM_18_1: (memory doubleP double)),
  forall (i_6_0: int32),
  forall (HW_40: True),
  forall (HW_41: ( 1 <= (integer_of_int32 i_6_0) /\
                  (integer_of_int32 i_6_0) <=
                 (integer_of_int32 ni_0) /\
                 
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) ((integer_of_int32 i_6_0) - 1) 0 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_1))),
  forall (HW_56: (integer_of_int32 i_6_0) >= (integer_of_int32 ni_0)),
  forall (result11: double),
  forall (HW_57: (eq (double_value result11) (0)%R) /\
                 (eq (double_exact result11) (0)%R) /\
                 (eq (double_model result11) (0)%R)),
  forall (HW_58: (offset_min double_xP_result_7_alloc_table p_6) <=
                 (integer_of_int32 ni_0) /\ (integer_of_int32 ni_0) <=
                 (offset_max double_xP_result_7_alloc_table p_6)),
  forall (result12: (pointer doubleP)),
  forall (HW_59: result12 =
                 (select
                  double_xP_double_xM_result_7 (shift
                                                p_6 (integer_of_int32 ni_0)))),
  forall (HW_60: (offset_min doubleP_double_xM_18_alloc_table result12) <=
                 0 /\ 0 <=
                 (offset_max doubleP_double_xM_18_alloc_table result12)),
  forall (doubleP_doubleM_double_xM_18_2: (memory doubleP double)),
  forall (HW_61: doubleP_doubleM_double_xM_18_2 =
                 (store doubleP_doubleM_double_xM_18_1 result12 result11)),
  forall (HW_62:
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) (integer_of_int32 ni_0) 0 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_2)),
  forall (result13: double),
  forall (HW_63: (eq (double_value result13) (0)%R) /\
                 (eq (double_exact result13) (0)%R) /\
                 (eq (double_model result13) (0)%R)),
  forall (HW_64: (offset_min double_xP_result_7_alloc_table p_6) <= 0 /\ 0 <=
                 (offset_max double_xP_result_7_alloc_table p_6)),
  forall (result14: (pointer doubleP)),
  forall (HW_65: result14 = (select double_xP_double_xM_result_7 p_6)),
  forall (HW_66: (offset_min
                  doubleP_double_xM_18_alloc_table (shift result14 1)) <=
                 0 /\ 0 <=
                 (offset_max
                  doubleP_double_xM_18_alloc_table (shift result14 1))),
  forall (doubleP_doubleM_double_xM_18_3: (memory doubleP double)),
  forall (HW_67: doubleP_doubleM_double_xM_18_3 =
                 (store
                  doubleP_doubleM_double_xM_18_2 (shift result14 1) result13)),
  forall (result15: int32),
  forall (HW_68: (integer_of_int32 result15) = 1),
  forall (i_6_1: int32),
  forall (HW_69: i_6_1 = result15),
  forall (doubleP_doubleM_double_xM_18_4: (memory doubleP double)),
  forall (i_6_2: int32),
  forall (HW_70: True),
  forall (HW_71: ( 1 <= (integer_of_int32 i_6_2) /\
                  (integer_of_int32 i_6_2) <=
                 (integer_of_int32 ni_0) /\
                 
                 (analytic_error
                  p_6 (integer_of_int32 ni_0) ((integer_of_int32 i_6_2) - 1) 1 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_4))),
  forall (HW_118: (integer_of_int32 i_6_2) >= (integer_of_int32 ni_0)),
  forall (result16: double),
  forall (HW_119: (eq (double_value result16) (0)%R) /\
                  (eq (double_exact result16) (0)%R) /\
                  (eq (double_model result16) (0)%R)),
  forall (HW_120: (offset_min double_xP_result_7_alloc_table p_6) <=
                  (integer_of_int32 ni_0) /\ (integer_of_int32 ni_0) <=
                  (offset_max double_xP_result_7_alloc_table p_6)),
  forall (result17: (pointer doubleP)),
  forall (HW_121: result17 =
                  (select
                   double_xP_double_xM_result_7 (shift
                                                 p_6 (integer_of_int32 ni_0)))),
  forall (HW_122: (offset_min
                   doubleP_double_xM_18_alloc_table (shift result17 1)) <=
                  0 /\ 0 <=
                  (offset_max
                   doubleP_double_xM_18_alloc_table (shift result17 1))),
  forall (doubleP_doubleM_double_xM_18_5: (memory doubleP double)),
  forall (HW_123: doubleP_doubleM_double_xM_18_5 =
                  (store
                   doubleP_doubleM_double_xM_18_4 (shift result17 1) result16)),
  forall (HW_124:
                  (analytic_error
                   p_6 (integer_of_int32 ni_0) (integer_of_int32 ni_0) 1 a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_5)),
  forall (result18: int32),
  forall (HW_125: (integer_of_int32 result18) = 1),
  forall (k_7: int32),
  forall (HW_126: k_7 = result18),
  forall (doubleP_doubleM_double_xM_18_6: (memory doubleP double)),
  forall (k_7_0: int32),
  forall (HW_127: True),
  forall (HW_128: ( 1 <= (integer_of_int32 k_7_0) /\
                   (integer_of_int32 k_7_0) <=
                  (integer_of_int32 nk) /\
                  
                  (analytic_error
                   p_6 (integer_of_int32 ni_0) (integer_of_int32 ni_0) (
                   integer_of_int32 k_7_0) a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_6))),
  forall (HW_129: (integer_of_int32 k_7_0) < (integer_of_int32 nk)),
  forall (result19: double),
  forall (HW_130: (eq (double_value result19) (0)%R) /\
                  (eq (double_exact result19) (0)%R) /\
                  (eq (double_model result19) (0)%R)),
  forall (HW_131: (offset_min double_xP_result_7_alloc_table p_6) <= 0 /\
                  0 <= (offset_max double_xP_result_7_alloc_table p_6)),
  forall (result20: (pointer doubleP)),
  forall (HW_132: result20 = (select double_xP_double_xM_result_7 p_6)),
  forall (HW_133: (-2147483648) <= ((integer_of_int32 k_7_0) + 1) /\
                  ((integer_of_int32 k_7_0) + 1) <= 2147483647),
  forall (result21: int32),
  forall (HW_134: (integer_of_int32 result21) =
                  ((integer_of_int32 k_7_0) + 1)),
  forall (HW_135: (offset_min doubleP_double_xM_18_alloc_table result20) <=
                  (integer_of_int32 result21) /\
                  (integer_of_int32 result21) <=
                  (offset_max doubleP_double_xM_18_alloc_table result20)),
  forall (doubleP_doubleM_double_xM_18_7: (memory doubleP double)),
  forall (HW_136: doubleP_doubleM_double_xM_18_7 =
                  (store
                   doubleP_doubleM_double_xM_18_6 (shift
                                                   result20 (integer_of_int32
                                                             result21)) result19)),
  forall (result22: int32),
  forall (HW_137: (integer_of_int32 result22) = 1),
  forall (i_6_3: int32),
  forall (HW_138: i_6_3 = result22),
  forall (doubleP_doubleM_double_xM_18_8: (memory doubleP double)),
  forall (i_6_4: int32),
  forall (HW_139: True),
  forall (HW_140: ( 1 <= (integer_of_int32 i_6_4) /\
                   (integer_of_int32 i_6_4) <=
                  (integer_of_int32 ni_0) /\
                  
                  (analytic_error
                   p_6 (integer_of_int32 ni_0) ((integer_of_int32 i_6_4) - 1)
                   ((integer_of_int32 k_7_0) + 1) a_1 dt double_xP_double_xM_result_7 doubleP_doubleM_double_xM_18_8))),
  forall (HW_141: (integer_of_int32 i_6_4) < (integer_of_int32 ni_0)),
  forall (HW_142:
                  (Rle
                   (Rabs
                    (double_value
                     (select
                      doubleP_doubleM_double_xM_18_8 (shift
                                                      (select
                                                       double_xP_double_xM_result_7 (
                                                       shift
                                                       p_6 ((integer_of_int32
                                                             i_6_4) -
                                                           1))) (integer_of_int32
                                                                 k_7_0)))))
                   (2)%R)),
  forall (HW_143:
                  (Rle
                   (Rabs
                    (double_value
                     (select
                      doubleP_doubleM_double_xM_18_8 (shift
                                                      (select
                                                       double_xP_double_xM_result_7 (
                                                       shift
                                                       p_6 (integer_of_int32
                                                            i_6_4))) (
                                                      integer_of_int32 k_7_0)))))
                   (2)%R)),
  forall (HW_144:
                  (Rle
                   (Rabs
                    (double_value
                     (select
                      doubleP_doubleM_double_xM_18_8 (shift
                                                      (select
                                                       double_xP_double_xM_result_7 (
                                                       shift
                                                       p_6 ((integer_of_int32
                                                             i_6_4) +
                                                           1))) (integer_of_int32
                                                                 k_7_0)))))
                   (2)%R)),
  forall (HW_145:
                  (Rle
                   (Rabs
                    (double_value
                     (select
                      doubleP_doubleM_double_xM_18_8 (shift
                                                      (select
                                                       double_xP_double_xM_result_7 (
                                                       shift
                                                       p_6 (integer_of_int32
                                                            i_6_4)))
                                                      ((integer_of_int32
                                                        k_7_0) -
                                                      1)))))
                   (2)%R)),
  forall (HW_146: (-2147483648) <= ((integer_of_int32 i_6_4) + 1) /\
                  ((integer_of_int32 i_6_4) + 1) <= 2147483647),
  forall (result23: int32),
  forall (HW_147: (integer_of_int32 result23) =
                  ((integer_of_int32 i_6_4) + 1)),
  forall (HW_148: (offset_min double_xP_result_7_alloc_table p_6) <=
                  (integer_of_int32 result23) /\
                  (integer_of_int32 result23) <=
                  (offset_max double_xP_result_7_alloc_table p_6)),
  forall (result24: (pointer doubleP)),
  forall (HW_149: result24 =
                  (select
                   double_xP_double_xM_result_7 (shift
                                                 p_6 (integer_of_int32
                                                      result23)))),
  forall (HW_150: (offset_min doubleP_double_xM_18_alloc_table result24) <=
                  (integer_of_int32 k_7_0) /\ (integer_of_int32 k_7_0) <=
                  (offset_max doubleP_double_xM_18_alloc_table result24)),
  forall (result25: double),
  forall (HW_151: result25 =
                  (select
                   doubleP_doubleM_double_xM_18_8 (shift
                                                   result24 (integer_of_int32
                                                             k_7_0)))),
  forall (result26: double),
  forall (HW_152: (eq (double_value result26) (2)%R) /\
                  (eq (double_exact result26) (2)%R) /\
                  (eq (double_model result26) (2)%R)),
  forall (HW_153: (offset_min double_xP_result_7_alloc_table p_6) <=
                  (integer_of_int32 i_6_4) /\ (integer_of_int32 i_6_4) <=
                  (offset_max double_xP_result_7_alloc_table p_6)),
  forall (result27: (pointer doubleP)),
  forall (HW_154: result27 =
                  (select
                   double_xP_double_xM_result_7 (shift
                                                 p_6 (integer_of_int32 i_6_4)))),
  forall (HW_155: (offset_min doubleP_double_xM_18_alloc_table result27) <=
                  (integer_of_int32 k_7_0) /\ (integer_of_int32 k_7_0) <=
                  (offset_max doubleP_double_xM_18_alloc_table result27)),
  forall (result28: double),
  forall (HW_156: result28 =
                  (select
                   doubleP_doubleM_double_xM_18_8 (shift
                                                   result27 (integer_of_int32
                                                             k_7_0)))),
  forall (HW_157: (no_overflow_double
                   nearest_even (Rmult
                                 (double_value result26) (double_value
                                                          result28)))),
  forall (result29: double),
  forall (HW_158: (mul_double_post nearest_even result26 result28 result29)),
  forall (HW_159: (no_overflow_double
                   nearest_even (Rminus
                                 (double_value result25) (double_value
                                                          result29)))),
  forall (result30: double),
  forall (HW_160: (sub_double_post nearest_even result25 result29 result30)),
  forall (HW_161: (-2147483648) <= ((integer_of_int32 i_6_4) - 1) /\
                  ((integer_of_int32 i_6_4) - 1) <= 2147483647),
  forall (result31: int32),
  forall (HW_162: (integer_of_int32 result31) =
                  ((integer_of_int32 i_6_4) - 1)),
  forall (HW_163: (offset_min double_xP_result_7_alloc_table p_6) <=
                  (integer_of_int32 result31) /\
                  (integer_of_int32 result31) <=
                  (offset_max double_xP_result_7_alloc_table p_6)),
  forall (result32: (pointer doubleP)),
  forall (HW_164: result32 =
                  (select
                   double_xP_double_xM_result_7 (shift
                                                 p_6 (integer_of_int32
                                                      result31)))),
  forall (HW_165: (offset_min doubleP_double_xM_18_alloc_table result32) <=
                  (integer_of_int32 k_7_0) /\ (integer_of_int32 k_7_0) <=
                  (offset_max doubleP_double_xM_18_alloc_table result32)),
  forall (result33: double),
  forall (HW_166: result33 =
                  (select
                   doubleP_doubleM_double_xM_18_8 (shift
                                                   result32 (integer_of_int32
                                                             k_7_0)))),
  forall (HW_167: (no_overflow_double
                   nearest_even (Rplus
                                 (double_value result30) (double_value
                                                          result33)))),
  forall (result34: double),
  forall (HW_168: (add_double_post nearest_even result30 result33 result34)),
  forall (dp: double),
  forall (HW_169: dp = result34),
  forall (result35: double),
  forall (HW_170: (eq (double_value result35) (2)%R) /\
                  (eq (double_exact result35) (2)%R) /\
                  (eq (double_model result35) (2)%R)),
  forall (HW_171: (offset_min double_xP_result_7_alloc_table p_6) <=
                  (integer_of_int32 i_6_4) /\ (integer_of_int32 i_6_4) <=
                  (offset_max double_xP_result_7_alloc_table p_6)),
  forall (result36: (pointer doubleP)),
  forall (HW_172: result36 =
                  (select
                   double_xP_double_xM_result_7 (shift
                                                 p_6 (integer_of_int32 i_6_4)))),
  forall (HW_173: (offset_min doubleP_double_xM_18_alloc_table result36) <=
                  (integer_of_int32 k_7_0) /\ (integer_of_int32 k_7_0) <=
                  (offset_max doubleP_double_xM_18_alloc_table result36)),
  forall (result37: double),
  forall (HW_174: result37 =
                  (select
                   doubleP_doubleM_double_xM_18_8 (shift
                                                   result36 (integer_of_int32
                                                             k_7_0)))),
  forall (HW_175: (no_overflow_double
                   nearest_even (Rmult
                                 (double_value result35) (double_value
                                                          result37)))),
  forall (result38: double),
  forall (HW_176: (mul_double_post nearest_even result35 result37 result38)),
  forall (HW_177: (offset_min double_xP_result_7_alloc_table p_6) <=
                  (integer_of_int32 i_6_4) /\ (integer_of_int32 i_6_4) <=
                  (offset_max double_xP_result_7_alloc_table p_6)),
  forall (result39: (pointer doubleP)),
  forall (HW_178: result39 =
                  (select
                   double_xP_double_xM_result_7 (shift
                                                 p_6 (integer_of_int32 i_6_4)))),
  forall (HW_179: (-2147483648) <= ((integer_of_int32 k_7_0) - 1) /\
                  ((integer_of_int32 k_7_0) - 1) <= 2147483647),
  forall (result40: int32),
  forall (HW_180: (integer_of_int32 result40) =
                  ((integer_of_int32 k_7_0) - 1)),
  forall (HW_181: (offset_min doubleP_double_xM_18_alloc_table result39) <=
                  (integer_of_int32 result40) /\
                  (integer_of_int32 result40) <=
                  (offset_max doubleP_double_xM_18_alloc_table result39)),
  forall (result41: double),
  forall (HW_182: result41 =
                  (select
                   doubleP_doubleM_double_xM_18_8 (shift
                                                   result39 (integer_of_int32
                                                             result40)))),
  forall (HW_183: (no_overflow_double
                   nearest_even (Rminus
                                 (double_value result38) (double_value
                                                          result41)))),
  forall (result42: double),
  forall (HW_184: (sub_double_post nearest_even result38 result41 result42)),
  forall (HW_185: (no_overflow_double
                   nearest_even (Rmult (double_value a_1) (double_value dp)))),
  forall (result43: double),
  forall (HW_186: (mul_double_post nearest_even a_1 dp result43)),
  (no_overflow_double
   nearest_even (Rplus (double_value result42) (double_value result43))).