doc-src/IsarRef/Thy/Generic.thy
author wenzelm
Sun Jun 05 22:02:54 2011 +0200 (2011-06-05)
changeset 42930 41394a61cca9
parent 42929 7f9d7b55ea90
child 43332 dca2c7c598f0
permissions -rw-r--r--
updated and re-unified classical proof methods;
tuned;
wenzelm@26782
     1
theory Generic
wenzelm@42651
     2
imports Base Main
wenzelm@26782
     3
begin
wenzelm@26782
     4
wenzelm@26782
     5
chapter {* Generic tools and packages \label{ch:gen-tools} *}
wenzelm@26782
     6
wenzelm@42655
     7
section {* Configuration options \label{sec:config} *}
wenzelm@26782
     8
wenzelm@40291
     9
text {* Isabelle/Pure maintains a record of named configuration
wenzelm@40291
    10
  options within the theory or proof context, with values of type
wenzelm@40291
    11
  @{ML_type bool}, @{ML_type int}, @{ML_type real}, or @{ML_type
wenzelm@40291
    12
  string}.  Tools may declare options in ML, and then refer to these
wenzelm@40291
    13
  values (relative to the context).  Thus global reference variables
wenzelm@40291
    14
  are easily avoided.  The user may change the value of a
wenzelm@40291
    15
  configuration option by means of an associated attribute of the same
wenzelm@40291
    16
  name.  This form of context declaration works particularly well with
wenzelm@42655
    17
  commands such as @{command "declare"} or @{command "using"} like
wenzelm@42655
    18
  this:
wenzelm@42655
    19
*}
wenzelm@42655
    20
wenzelm@42655
    21
declare [[show_main_goal = false]]
wenzelm@26782
    22
wenzelm@42655
    23
notepad
wenzelm@42655
    24
begin
wenzelm@42655
    25
  note [[show_main_goal = true]]
wenzelm@42655
    26
end
wenzelm@42655
    27
wenzelm@42655
    28
text {* For historical reasons, some tools cannot take the full proof
wenzelm@26782
    29
  context into account and merely refer to the background theory.
wenzelm@26782
    30
  This is accommodated by configuration options being declared as
wenzelm@26782
    31
  ``global'', which may not be changed within a local context.
wenzelm@26782
    32
wenzelm@26782
    33
  \begin{matharray}{rcll}
wenzelm@28761
    34
    @{command_def "print_configs"} & : & @{text "context \<rightarrow>"} \\
wenzelm@26782
    35
  \end{matharray}
wenzelm@26782
    36
wenzelm@42596
    37
  @{rail "
wenzelm@42596
    38
    @{syntax name} ('=' ('true' | 'false' | @{syntax int} | @{syntax float} | @{syntax name}))?
wenzelm@42596
    39
  "}
wenzelm@26782
    40
wenzelm@28760
    41
  \begin{description}
wenzelm@26782
    42
  
wenzelm@28760
    43
  \item @{command "print_configs"} prints the available configuration
wenzelm@28760
    44
  options, with names, types, and current values.
wenzelm@26782
    45
  
wenzelm@28760
    46
  \item @{text "name = value"} as an attribute expression modifies the
wenzelm@28760
    47
  named option, with the syntax of the value depending on the option's
wenzelm@28760
    48
  type.  For @{ML_type bool} the default value is @{text true}.  Any
wenzelm@28760
    49
  attempt to change a global option in a local context is ignored.
wenzelm@26782
    50
wenzelm@28760
    51
  \end{description}
wenzelm@26782
    52
*}
wenzelm@26782
    53
wenzelm@26782
    54
wenzelm@27040
    55
section {* Basic proof tools *}
wenzelm@26782
    56
wenzelm@26782
    57
subsection {* Miscellaneous methods and attributes \label{sec:misc-meth-att} *}
wenzelm@26782
    58
wenzelm@26782
    59
text {*
wenzelm@26782
    60
  \begin{matharray}{rcl}
wenzelm@28761
    61
    @{method_def unfold} & : & @{text method} \\
wenzelm@28761
    62
    @{method_def fold} & : & @{text method} \\
wenzelm@28761
    63
    @{method_def insert} & : & @{text method} \\[0.5ex]
wenzelm@28761
    64
    @{method_def erule}@{text "\<^sup>*"} & : & @{text method} \\
wenzelm@28761
    65
    @{method_def drule}@{text "\<^sup>*"} & : & @{text method} \\
wenzelm@28761
    66
    @{method_def frule}@{text "\<^sup>*"} & : & @{text method} \\
wenzelm@28761
    67
    @{method_def succeed} & : & @{text method} \\
wenzelm@28761
    68
    @{method_def fail} & : & @{text method} \\
wenzelm@26782
    69
  \end{matharray}
wenzelm@26782
    70
wenzelm@42596
    71
  @{rail "
wenzelm@42596
    72
    (@@{method fold} | @@{method unfold} | @@{method insert}) @{syntax thmrefs}
wenzelm@26782
    73
    ;
wenzelm@42596
    74
    (@@{method erule} | @@{method drule} | @@{method frule})
wenzelm@42596
    75
      ('(' @{syntax nat} ')')? @{syntax thmrefs}
wenzelm@42596
    76
  "}
wenzelm@26782
    77
wenzelm@28760
    78
  \begin{description}
wenzelm@26782
    79
  
wenzelm@28760
    80
  \item @{method unfold}~@{text "a\<^sub>1 \<dots> a\<^sub>n"} and @{method fold}~@{text
wenzelm@28760
    81
  "a\<^sub>1 \<dots> a\<^sub>n"} expand (or fold back) the given definitions throughout
wenzelm@28760
    82
  all goals; any chained facts provided are inserted into the goal and
wenzelm@28760
    83
  subject to rewriting as well.
wenzelm@26782
    84
wenzelm@28760
    85
  \item @{method insert}~@{text "a\<^sub>1 \<dots> a\<^sub>n"} inserts theorems as facts
wenzelm@28760
    86
  into all goals of the proof state.  Note that current facts
wenzelm@28760
    87
  indicated for forward chaining are ignored.
wenzelm@26782
    88
wenzelm@30397
    89
  \item @{method erule}~@{text "a\<^sub>1 \<dots> a\<^sub>n"}, @{method
wenzelm@30397
    90
  drule}~@{text "a\<^sub>1 \<dots> a\<^sub>n"}, and @{method frule}~@{text
wenzelm@30397
    91
  "a\<^sub>1 \<dots> a\<^sub>n"} are similar to the basic @{method rule}
wenzelm@30397
    92
  method (see \secref{sec:pure-meth-att}), but apply rules by
wenzelm@30397
    93
  elim-resolution, destruct-resolution, and forward-resolution,
wenzelm@30397
    94
  respectively \cite{isabelle-implementation}.  The optional natural
wenzelm@30397
    95
  number argument (default 0) specifies additional assumption steps to
wenzelm@30397
    96
  be performed here.
wenzelm@26782
    97
wenzelm@26782
    98
  Note that these methods are improper ones, mainly serving for
wenzelm@26782
    99
  experimentation and tactic script emulation.  Different modes of
wenzelm@26782
   100
  basic rule application are usually expressed in Isar at the proof
wenzelm@26782
   101
  language level, rather than via implicit proof state manipulations.
wenzelm@26782
   102
  For example, a proper single-step elimination would be done using
wenzelm@26782
   103
  the plain @{method rule} method, with forward chaining of current
wenzelm@26782
   104
  facts.
wenzelm@26782
   105
wenzelm@28760
   106
  \item @{method succeed} yields a single (unchanged) result; it is
wenzelm@26782
   107
  the identity of the ``@{text ","}'' method combinator (cf.\
wenzelm@28754
   108
  \secref{sec:proof-meth}).
wenzelm@26782
   109
wenzelm@28760
   110
  \item @{method fail} yields an empty result sequence; it is the
wenzelm@26782
   111
  identity of the ``@{text "|"}'' method combinator (cf.\
wenzelm@28754
   112
  \secref{sec:proof-meth}).
wenzelm@26782
   113
wenzelm@28760
   114
  \end{description}
wenzelm@26782
   115
wenzelm@26782
   116
  \begin{matharray}{rcl}
wenzelm@28761
   117
    @{attribute_def tagged} & : & @{text attribute} \\
wenzelm@28761
   118
    @{attribute_def untagged} & : & @{text attribute} \\[0.5ex]
wenzelm@28761
   119
    @{attribute_def THEN} & : & @{text attribute} \\
wenzelm@28761
   120
    @{attribute_def COMP} & : & @{text attribute} \\[0.5ex]
wenzelm@28761
   121
    @{attribute_def unfolded} & : & @{text attribute} \\
wenzelm@28761
   122
    @{attribute_def folded} & : & @{text attribute} \\[0.5ex]
wenzelm@28761
   123
    @{attribute_def rotated} & : & @{text attribute} \\
wenzelm@28761
   124
    @{attribute_def (Pure) elim_format} & : & @{text attribute} \\
wenzelm@28761
   125
    @{attribute_def standard}@{text "\<^sup>*"} & : & @{text attribute} \\
wenzelm@28761
   126
    @{attribute_def no_vars}@{text "\<^sup>*"} & : & @{text attribute} \\
wenzelm@26782
   127
  \end{matharray}
wenzelm@26782
   128
wenzelm@42596
   129
  @{rail "
wenzelm@42596
   130
    @@{attribute tagged} @{syntax name} @{syntax name}
wenzelm@26782
   131
    ;
wenzelm@42596
   132
    @@{attribute untagged} @{syntax name}
wenzelm@26782
   133
    ;
wenzelm@42596
   134
    (@@{attribute THEN} | @@{attribute COMP}) ('[' @{syntax nat} ']')? @{syntax thmref}
wenzelm@26782
   135
    ;
wenzelm@42596
   136
    (@@{attribute unfolded} | @@{attribute folded}) @{syntax thmrefs}
wenzelm@26782
   137
    ;
wenzelm@42596
   138
    @@{attribute rotated} @{syntax int}?
wenzelm@42596
   139
  "}
wenzelm@26782
   140
wenzelm@28760
   141
  \begin{description}
wenzelm@26782
   142
wenzelm@28764
   143
  \item @{attribute tagged}~@{text "name value"} and @{attribute
wenzelm@28760
   144
  untagged}~@{text name} add and remove \emph{tags} of some theorem.
wenzelm@26782
   145
  Tags may be any list of string pairs that serve as formal comment.
wenzelm@28764
   146
  The first string is considered the tag name, the second its value.
wenzelm@28764
   147
  Note that @{attribute untagged} removes any tags of the same name.
wenzelm@26782
   148
wenzelm@28760
   149
  \item @{attribute THEN}~@{text a} and @{attribute COMP}~@{text a}
wenzelm@26782
   150
  compose rules by resolution.  @{attribute THEN} resolves with the
wenzelm@26782
   151
  first premise of @{text a} (an alternative position may be also
wenzelm@26782
   152
  specified); the @{attribute COMP} version skips the automatic
wenzelm@30462
   153
  lifting process that is normally intended (cf.\ @{ML "op RS"} and
wenzelm@30462
   154
  @{ML "op COMP"} in \cite{isabelle-implementation}).
wenzelm@26782
   155
  
wenzelm@28760
   156
  \item @{attribute unfolded}~@{text "a\<^sub>1 \<dots> a\<^sub>n"} and @{attribute
wenzelm@28760
   157
  folded}~@{text "a\<^sub>1 \<dots> a\<^sub>n"} expand and fold back again the given
wenzelm@28760
   158
  definitions throughout a rule.
wenzelm@26782
   159
wenzelm@28760
   160
  \item @{attribute rotated}~@{text n} rotate the premises of a
wenzelm@26782
   161
  theorem by @{text n} (default 1).
wenzelm@26782
   162
wenzelm@28760
   163
  \item @{attribute (Pure) elim_format} turns a destruction rule into
wenzelm@28760
   164
  elimination rule format, by resolving with the rule @{prop "PROP A \<Longrightarrow>
wenzelm@28760
   165
  (PROP A \<Longrightarrow> PROP B) \<Longrightarrow> PROP B"}.
wenzelm@26782
   166
  
wenzelm@26782
   167
  Note that the Classical Reasoner (\secref{sec:classical}) provides
wenzelm@26782
   168
  its own version of this operation.
wenzelm@26782
   169
wenzelm@28760
   170
  \item @{attribute standard} puts a theorem into the standard form of
wenzelm@28760
   171
  object-rules at the outermost theory level.  Note that this
wenzelm@26782
   172
  operation violates the local proof context (including active
wenzelm@26782
   173
  locales).
wenzelm@26782
   174
wenzelm@28760
   175
  \item @{attribute no_vars} replaces schematic variables by free
wenzelm@26782
   176
  ones; this is mainly for tuning output of pretty printed theorems.
wenzelm@26782
   177
wenzelm@28760
   178
  \end{description}
wenzelm@26782
   179
*}
wenzelm@26782
   180
wenzelm@26782
   181
wenzelm@27044
   182
subsection {* Low-level equational reasoning *}
wenzelm@27044
   183
wenzelm@27044
   184
text {*
wenzelm@27044
   185
  \begin{matharray}{rcl}
wenzelm@28761
   186
    @{method_def subst} & : & @{text method} \\
wenzelm@28761
   187
    @{method_def hypsubst} & : & @{text method} \\
wenzelm@28761
   188
    @{method_def split} & : & @{text method} \\
wenzelm@27044
   189
  \end{matharray}
wenzelm@27044
   190
wenzelm@42596
   191
  @{rail "
wenzelm@42704
   192
    @@{method subst} ('(' 'asm' ')')? \\ ('(' (@{syntax nat}+) ')')? @{syntax thmref}
wenzelm@27044
   193
    ;
wenzelm@42596
   194
    @@{method split} ('(' 'asm' ')')? @{syntax thmrefs}
wenzelm@42596
   195
  "}
wenzelm@27044
   196
wenzelm@27044
   197
  These methods provide low-level facilities for equational reasoning
wenzelm@27044
   198
  that are intended for specialized applications only.  Normally,
wenzelm@27044
   199
  single step calculations would be performed in a structured text
wenzelm@27044
   200
  (see also \secref{sec:calculation}), while the Simplifier methods
wenzelm@27044
   201
  provide the canonical way for automated normalization (see
wenzelm@27044
   202
  \secref{sec:simplifier}).
wenzelm@27044
   203
wenzelm@28760
   204
  \begin{description}
wenzelm@27044
   205
wenzelm@28760
   206
  \item @{method subst}~@{text eq} performs a single substitution step
wenzelm@28760
   207
  using rule @{text eq}, which may be either a meta or object
wenzelm@27044
   208
  equality.
wenzelm@27044
   209
wenzelm@28760
   210
  \item @{method subst}~@{text "(asm) eq"} substitutes in an
wenzelm@27044
   211
  assumption.
wenzelm@27044
   212
wenzelm@28760
   213
  \item @{method subst}~@{text "(i \<dots> j) eq"} performs several
wenzelm@27044
   214
  substitutions in the conclusion. The numbers @{text i} to @{text j}
wenzelm@27044
   215
  indicate the positions to substitute at.  Positions are ordered from
wenzelm@27044
   216
  the top of the term tree moving down from left to right. For
wenzelm@27044
   217
  example, in @{text "(a + b) + (c + d)"} there are three positions
wenzelm@28760
   218
  where commutativity of @{text "+"} is applicable: 1 refers to @{text
wenzelm@28760
   219
  "a + b"}, 2 to the whole term, and 3 to @{text "c + d"}.
wenzelm@27044
   220
wenzelm@27044
   221
  If the positions in the list @{text "(i \<dots> j)"} are non-overlapping
wenzelm@27044
   222
  (e.g.\ @{text "(2 3)"} in @{text "(a + b) + (c + d)"}) you may
wenzelm@27044
   223
  assume all substitutions are performed simultaneously.  Otherwise
wenzelm@27044
   224
  the behaviour of @{text subst} is not specified.
wenzelm@27044
   225
wenzelm@28760
   226
  \item @{method subst}~@{text "(asm) (i \<dots> j) eq"} performs the
wenzelm@27071
   227
  substitutions in the assumptions. The positions refer to the
wenzelm@27071
   228
  assumptions in order from left to right.  For example, given in a
wenzelm@27071
   229
  goal of the form @{text "P (a + b) \<Longrightarrow> P (c + d) \<Longrightarrow> \<dots>"}, position 1 of
wenzelm@27071
   230
  commutativity of @{text "+"} is the subterm @{text "a + b"} and
wenzelm@27071
   231
  position 2 is the subterm @{text "c + d"}.
wenzelm@27044
   232
wenzelm@28760
   233
  \item @{method hypsubst} performs substitution using some
wenzelm@27044
   234
  assumption; this only works for equations of the form @{text "x =
wenzelm@27044
   235
  t"} where @{text x} is a free or bound variable.
wenzelm@27044
   236
wenzelm@28760
   237
  \item @{method split}~@{text "a\<^sub>1 \<dots> a\<^sub>n"} performs single-step case
wenzelm@28760
   238
  splitting using the given rules.  By default, splitting is performed
wenzelm@28760
   239
  in the conclusion of a goal; the @{text "(asm)"} option indicates to
wenzelm@28760
   240
  operate on assumptions instead.
wenzelm@27044
   241
  
wenzelm@27044
   242
  Note that the @{method simp} method already involves repeated
wenzelm@27044
   243
  application of split rules as declared in the current context.
wenzelm@27044
   244
wenzelm@28760
   245
  \end{description}
wenzelm@27044
   246
*}
wenzelm@27044
   247
wenzelm@27044
   248
wenzelm@26782
   249
subsection {* Further tactic emulations \label{sec:tactics} *}
wenzelm@26782
   250
wenzelm@26782
   251
text {*
wenzelm@26782
   252
  The following improper proof methods emulate traditional tactics.
wenzelm@26782
   253
  These admit direct access to the goal state, which is normally
wenzelm@26782
   254
  considered harmful!  In particular, this may involve both numbered
wenzelm@26782
   255
  goal addressing (default 1), and dynamic instantiation within the
wenzelm@26782
   256
  scope of some subgoal.
wenzelm@26782
   257
wenzelm@26782
   258
  \begin{warn}
wenzelm@26782
   259
    Dynamic instantiations refer to universally quantified parameters
wenzelm@26782
   260
    of a subgoal (the dynamic context) rather than fixed variables and
wenzelm@26782
   261
    term abbreviations of a (static) Isar context.
wenzelm@26782
   262
  \end{warn}
wenzelm@26782
   263
wenzelm@26782
   264
  Tactic emulation methods, unlike their ML counterparts, admit
wenzelm@26782
   265
  simultaneous instantiation from both dynamic and static contexts.
wenzelm@26782
   266
  If names occur in both contexts goal parameters hide locally fixed
wenzelm@26782
   267
  variables.  Likewise, schematic variables refer to term
wenzelm@26782
   268
  abbreviations, if present in the static context.  Otherwise the
wenzelm@26782
   269
  schematic variable is interpreted as a schematic variable and left
wenzelm@26782
   270
  to be solved by unification with certain parts of the subgoal.
wenzelm@26782
   271
wenzelm@26782
   272
  Note that the tactic emulation proof methods in Isabelle/Isar are
wenzelm@26782
   273
  consistently named @{text foo_tac}.  Note also that variable names
wenzelm@26782
   274
  occurring on left hand sides of instantiations must be preceded by a
wenzelm@26782
   275
  question mark if they coincide with a keyword or contain dots.  This
wenzelm@26782
   276
  is consistent with the attribute @{attribute "where"} (see
wenzelm@26782
   277
  \secref{sec:pure-meth-att}).
wenzelm@26782
   278
wenzelm@26782
   279
  \begin{matharray}{rcl}
wenzelm@28761
   280
    @{method_def rule_tac}@{text "\<^sup>*"} & : & @{text method} \\
wenzelm@28761
   281
    @{method_def erule_tac}@{text "\<^sup>*"} & : & @{text method} \\
wenzelm@28761
   282
    @{method_def drule_tac}@{text "\<^sup>*"} & : & @{text method} \\
wenzelm@28761
   283
    @{method_def frule_tac}@{text "\<^sup>*"} & : & @{text method} \\
wenzelm@28761
   284
    @{method_def cut_tac}@{text "\<^sup>*"} & : & @{text method} \\
wenzelm@28761
   285
    @{method_def thin_tac}@{text "\<^sup>*"} & : & @{text method} \\
wenzelm@28761
   286
    @{method_def subgoal_tac}@{text "\<^sup>*"} & : & @{text method} \\
wenzelm@28761
   287
    @{method_def rename_tac}@{text "\<^sup>*"} & : & @{text method} \\
wenzelm@28761
   288
    @{method_def rotate_tac}@{text "\<^sup>*"} & : & @{text method} \\
wenzelm@28761
   289
    @{method_def tactic}@{text "\<^sup>*"} & : & @{text method} \\
wenzelm@28761
   290
    @{method_def raw_tactic}@{text "\<^sup>*"} & : & @{text method} \\
wenzelm@26782
   291
  \end{matharray}
wenzelm@26782
   292
wenzelm@42596
   293
  @{rail "
wenzelm@42596
   294
    (@@{method rule_tac} | @@{method erule_tac} | @@{method drule_tac} |
wenzelm@42705
   295
      @@{method frule_tac} | @@{method cut_tac} | @@{method thin_tac}) @{syntax goal_spec}? \\
wenzelm@42617
   296
    ( dynamic_insts @'in' @{syntax thmref} | @{syntax thmrefs} )
wenzelm@26782
   297
    ;
wenzelm@42705
   298
    @@{method subgoal_tac} @{syntax goal_spec}? (@{syntax prop} +)
wenzelm@42596
   299
    ;
wenzelm@42705
   300
    @@{method rename_tac} @{syntax goal_spec}? (@{syntax name} +)
wenzelm@26782
   301
    ;
wenzelm@42705
   302
    @@{method rotate_tac} @{syntax goal_spec}? @{syntax int}?
wenzelm@26782
   303
    ;
wenzelm@42596
   304
    (@@{method tactic} | @@{method raw_tactic}) @{syntax text}
wenzelm@26782
   305
    ;
wenzelm@26782
   306
wenzelm@42617
   307
    dynamic_insts: ((@{syntax name} '=' @{syntax term}) + @'and')
wenzelm@42617
   308
  "}
wenzelm@26782
   309
wenzelm@28760
   310
\begin{description}
wenzelm@26782
   311
wenzelm@28760
   312
  \item @{method rule_tac} etc. do resolution of rules with explicit
wenzelm@26782
   313
  instantiation.  This works the same way as the ML tactics @{ML
wenzelm@30397
   314
  res_inst_tac} etc. (see \cite{isabelle-implementation})
wenzelm@26782
   315
wenzelm@26782
   316
  Multiple rules may be only given if there is no instantiation; then
wenzelm@26782
   317
  @{method rule_tac} is the same as @{ML resolve_tac} in ML (see
wenzelm@30397
   318
  \cite{isabelle-implementation}).
wenzelm@26782
   319
wenzelm@28760
   320
  \item @{method cut_tac} inserts facts into the proof state as
wenzelm@27209
   321
  assumption of a subgoal, see also @{ML Tactic.cut_facts_tac} in
wenzelm@30397
   322
  \cite{isabelle-implementation}.  Note that the scope of schematic
wenzelm@26782
   323
  variables is spread over the main goal statement.  Instantiations
wenzelm@28760
   324
  may be given as well, see also ML tactic @{ML cut_inst_tac} in
wenzelm@30397
   325
  \cite{isabelle-implementation}.
wenzelm@26782
   326
wenzelm@28760
   327
  \item @{method thin_tac}~@{text \<phi>} deletes the specified assumption
wenzelm@28760
   328
  from a subgoal; note that @{text \<phi>} may contain schematic variables.
wenzelm@30397
   329
  See also @{ML thin_tac} in \cite{isabelle-implementation}.
wenzelm@28760
   330
wenzelm@28760
   331
  \item @{method subgoal_tac}~@{text \<phi>} adds @{text \<phi>} as an
wenzelm@27239
   332
  assumption to a subgoal.  See also @{ML subgoal_tac} and @{ML
wenzelm@30397
   333
  subgoals_tac} in \cite{isabelle-implementation}.
wenzelm@26782
   334
wenzelm@28760
   335
  \item @{method rename_tac}~@{text "x\<^sub>1 \<dots> x\<^sub>n"} renames parameters of a
wenzelm@28760
   336
  goal according to the list @{text "x\<^sub>1, \<dots>, x\<^sub>n"}, which refers to the
wenzelm@28760
   337
  \emph{suffix} of variables.
wenzelm@26782
   338
wenzelm@28760
   339
  \item @{method rotate_tac}~@{text n} rotates the assumptions of a
wenzelm@26782
   340
  goal by @{text n} positions: from right to left if @{text n} is
wenzelm@26782
   341
  positive, and from left to right if @{text n} is negative; the
wenzelm@26782
   342
  default value is 1.  See also @{ML rotate_tac} in
wenzelm@30397
   343
  \cite{isabelle-implementation}.
wenzelm@26782
   344
wenzelm@28760
   345
  \item @{method tactic}~@{text "text"} produces a proof method from
wenzelm@26782
   346
  any ML text of type @{ML_type tactic}.  Apart from the usual ML
wenzelm@27223
   347
  environment and the current proof context, the ML code may refer to
wenzelm@27223
   348
  the locally bound values @{ML_text facts}, which indicates any
wenzelm@27223
   349
  current facts used for forward-chaining.
wenzelm@26782
   350
wenzelm@28760
   351
  \item @{method raw_tactic} is similar to @{method tactic}, but
wenzelm@27223
   352
  presents the goal state in its raw internal form, where simultaneous
wenzelm@27223
   353
  subgoals appear as conjunction of the logical framework instead of
wenzelm@27223
   354
  the usual split into several subgoals.  While feature this is useful
wenzelm@27223
   355
  for debugging of complex method definitions, it should not never
wenzelm@27223
   356
  appear in production theories.
wenzelm@26782
   357
wenzelm@28760
   358
  \end{description}
wenzelm@26782
   359
*}
wenzelm@26782
   360
wenzelm@26782
   361
wenzelm@27040
   362
section {* The Simplifier \label{sec:simplifier} *}
wenzelm@26782
   363
wenzelm@27040
   364
subsection {* Simplification methods *}
wenzelm@26782
   365
wenzelm@26782
   366
text {*
wenzelm@26782
   367
  \begin{matharray}{rcl}
wenzelm@28761
   368
    @{method_def simp} & : & @{text method} \\
wenzelm@28761
   369
    @{method_def simp_all} & : & @{text method} \\
wenzelm@26782
   370
  \end{matharray}
wenzelm@26782
   371
wenzelm@42596
   372
  @{rail "
wenzelm@42596
   373
    (@@{method simp} | @@{method simp_all}) opt? (@{syntax simpmod} * )
wenzelm@26782
   374
    ;
wenzelm@26782
   375
wenzelm@40255
   376
    opt: '(' ('no_asm' | 'no_asm_simp' | 'no_asm_use' | 'asm_lr' ) ')'
wenzelm@26782
   377
    ;
wenzelm@42596
   378
    @{syntax_def simpmod}: ('add' | 'del' | 'only' | 'cong' (() | 'add' | 'del') |
wenzelm@42596
   379
      'split' (() | 'add' | 'del')) ':' @{syntax thmrefs}
wenzelm@42596
   380
  "}
wenzelm@26782
   381
wenzelm@28760
   382
  \begin{description}
wenzelm@26782
   383
wenzelm@28760
   384
  \item @{method simp} invokes the Simplifier, after declaring
wenzelm@26782
   385
  additional rules according to the arguments given.  Note that the
wenzelm@42596
   386
  @{text only} modifier first removes all other rewrite rules,
wenzelm@26782
   387
  congruences, and looper tactics (including splits), and then behaves
wenzelm@42596
   388
  like @{text add}.
wenzelm@26782
   389
wenzelm@42596
   390
  \medskip The @{text cong} modifiers add or delete Simplifier
wenzelm@26782
   391
  congruence rules (see also \cite{isabelle-ref}), the default is to
wenzelm@26782
   392
  add.
wenzelm@26782
   393
wenzelm@42596
   394
  \medskip The @{text split} modifiers add or delete rules for the
wenzelm@26782
   395
  Splitter (see also \cite{isabelle-ref}), the default is to add.
wenzelm@26782
   396
  This works only if the Simplifier method has been properly setup to
wenzelm@26782
   397
  include the Splitter (all major object logics such HOL, HOLCF, FOL,
wenzelm@26782
   398
  ZF do this already).
wenzelm@26782
   399
wenzelm@28760
   400
  \item @{method simp_all} is similar to @{method simp}, but acts on
wenzelm@26782
   401
  all goals (backwards from the last to the first one).
wenzelm@26782
   402
wenzelm@28760
   403
  \end{description}
wenzelm@26782
   404
wenzelm@26782
   405
  By default the Simplifier methods take local assumptions fully into
wenzelm@26782
   406
  account, using equational assumptions in the subsequent
wenzelm@26782
   407
  normalization process, or simplifying assumptions themselves (cf.\
wenzelm@30397
   408
  @{ML asm_full_simp_tac} in \cite{isabelle-ref}).  In structured
wenzelm@30397
   409
  proofs this is usually quite well behaved in practice: just the
wenzelm@30397
   410
  local premises of the actual goal are involved, additional facts may
wenzelm@30397
   411
  be inserted via explicit forward-chaining (via @{command "then"},
wenzelm@35613
   412
  @{command "from"}, @{command "using"} etc.).
wenzelm@26782
   413
wenzelm@26782
   414
  Additional Simplifier options may be specified to tune the behavior
wenzelm@26782
   415
  further (mostly for unstructured scripts with many accidental local
wenzelm@26782
   416
  facts): ``@{text "(no_asm)"}'' means assumptions are ignored
wenzelm@26782
   417
  completely (cf.\ @{ML simp_tac}), ``@{text "(no_asm_simp)"}'' means
wenzelm@26782
   418
  assumptions are used in the simplification of the conclusion but are
wenzelm@26782
   419
  not themselves simplified (cf.\ @{ML asm_simp_tac}), and ``@{text
wenzelm@26782
   420
  "(no_asm_use)"}'' means assumptions are simplified but are not used
wenzelm@26782
   421
  in the simplification of each other or the conclusion (cf.\ @{ML
wenzelm@26782
   422
  full_simp_tac}).  For compatibility reasons, there is also an option
wenzelm@26782
   423
  ``@{text "(asm_lr)"}'', which means that an assumption is only used
wenzelm@26782
   424
  for simplifying assumptions which are to the right of it (cf.\ @{ML
wenzelm@26782
   425
  asm_lr_simp_tac}).
wenzelm@26782
   426
wenzelm@27092
   427
  The configuration option @{text "depth_limit"} limits the number of
wenzelm@26782
   428
  recursive invocations of the simplifier during conditional
wenzelm@26782
   429
  rewriting.
wenzelm@26782
   430
wenzelm@26782
   431
  \medskip The Splitter package is usually configured to work as part
wenzelm@26782
   432
  of the Simplifier.  The effect of repeatedly applying @{ML
wenzelm@26782
   433
  split_tac} can be simulated by ``@{text "(simp only: split:
wenzelm@26782
   434
  a\<^sub>1 \<dots> a\<^sub>n)"}''.  There is also a separate @{text split}
wenzelm@26782
   435
  method available for single-step case splitting.
wenzelm@26782
   436
*}
wenzelm@26782
   437
wenzelm@26782
   438
wenzelm@27040
   439
subsection {* Declaring rules *}
wenzelm@26782
   440
wenzelm@26782
   441
text {*
wenzelm@26782
   442
  \begin{matharray}{rcl}
wenzelm@28761
   443
    @{command_def "print_simpset"}@{text "\<^sup>*"} & : & @{text "context \<rightarrow>"} \\
wenzelm@28761
   444
    @{attribute_def simp} & : & @{text attribute} \\
wenzelm@28761
   445
    @{attribute_def cong} & : & @{text attribute} \\
wenzelm@28761
   446
    @{attribute_def split} & : & @{text attribute} \\
wenzelm@26782
   447
  \end{matharray}
wenzelm@26782
   448
wenzelm@42596
   449
  @{rail "
wenzelm@42596
   450
    (@@{attribute simp} | @@{attribute cong} | @@{attribute split}) (() | 'add' | 'del')
wenzelm@42596
   451
  "}
wenzelm@26782
   452
wenzelm@28760
   453
  \begin{description}
wenzelm@26782
   454
wenzelm@28760
   455
  \item @{command "print_simpset"} prints the collection of rules
wenzelm@26782
   456
  declared to the Simplifier, which is also known as ``simpset''
wenzelm@26782
   457
  internally \cite{isabelle-ref}.
wenzelm@26782
   458
wenzelm@28760
   459
  \item @{attribute simp} declares simplification rules.
wenzelm@26782
   460
wenzelm@28760
   461
  \item @{attribute cong} declares congruence rules.
wenzelm@26782
   462
wenzelm@28760
   463
  \item @{attribute split} declares case split rules.
wenzelm@26782
   464
wenzelm@28760
   465
  \end{description}
wenzelm@26782
   466
*}
wenzelm@26782
   467
wenzelm@26782
   468
wenzelm@27040
   469
subsection {* Simplification procedures *}
wenzelm@26782
   470
wenzelm@42925
   471
text {* Simplification procedures are ML functions that produce proven
wenzelm@42925
   472
  rewrite rules on demand.  They are associated with higher-order
wenzelm@42925
   473
  patterns that approximate the left-hand sides of equations.  The
wenzelm@42925
   474
  Simplifier first matches the current redex against one of the LHS
wenzelm@42925
   475
  patterns; if this succeeds, the corresponding ML function is
wenzelm@42925
   476
  invoked, passing the Simplifier context and redex term.  Thus rules
wenzelm@42925
   477
  may be specifically fashioned for particular situations, resulting
wenzelm@42925
   478
  in a more powerful mechanism than term rewriting by a fixed set of
wenzelm@42925
   479
  rules.
wenzelm@42925
   480
wenzelm@42925
   481
  Any successful result needs to be a (possibly conditional) rewrite
wenzelm@42925
   482
  rule @{text "t \<equiv> u"} that is applicable to the current redex.  The
wenzelm@42925
   483
  rule will be applied just as any ordinary rewrite rule.  It is
wenzelm@42925
   484
  expected to be already in \emph{internal form}, bypassing the
wenzelm@42925
   485
  automatic preprocessing of object-level equivalences.
wenzelm@42925
   486
wenzelm@26782
   487
  \begin{matharray}{rcl}
wenzelm@28761
   488
    @{command_def "simproc_setup"} & : & @{text "local_theory \<rightarrow> local_theory"} \\
wenzelm@28761
   489
    simproc & : & @{text attribute} \\
wenzelm@26782
   490
  \end{matharray}
wenzelm@26782
   491
wenzelm@42596
   492
  @{rail "
wenzelm@42596
   493
    @@{command simproc_setup} @{syntax name} '(' (@{syntax term} + '|') ')' '='
wenzelm@42596
   494
      @{syntax text} \\ (@'identifier' (@{syntax nameref}+))?
wenzelm@26782
   495
    ;
wenzelm@26782
   496
wenzelm@42596
   497
    @@{attribute simproc} (('add' ':')? | 'del' ':') (@{syntax name}+)
wenzelm@42596
   498
  "}
wenzelm@26782
   499
wenzelm@28760
   500
  \begin{description}
wenzelm@26782
   501
wenzelm@28760
   502
  \item @{command "simproc_setup"} defines a named simplification
wenzelm@26782
   503
  procedure that is invoked by the Simplifier whenever any of the
wenzelm@26782
   504
  given term patterns match the current redex.  The implementation,
wenzelm@26782
   505
  which is provided as ML source text, needs to be of type @{ML_type
wenzelm@26782
   506
  "morphism -> simpset -> cterm -> thm option"}, where the @{ML_type
wenzelm@26782
   507
  cterm} represents the current redex @{text r} and the result is
wenzelm@26782
   508
  supposed to be some proven rewrite rule @{text "r \<equiv> r'"} (or a
wenzelm@26782
   509
  generalized version), or @{ML NONE} to indicate failure.  The
wenzelm@26782
   510
  @{ML_type simpset} argument holds the full context of the current
wenzelm@26782
   511
  Simplifier invocation, including the actual Isar proof context.  The
wenzelm@26782
   512
  @{ML_type morphism} informs about the difference of the original
wenzelm@26782
   513
  compilation context wrt.\ the one of the actual application later
wenzelm@26782
   514
  on.  The optional @{keyword "identifier"} specifies theorems that
wenzelm@26782
   515
  represent the logical content of the abstract theory of this
wenzelm@26782
   516
  simproc.
wenzelm@26782
   517
wenzelm@26782
   518
  Morphisms and identifiers are only relevant for simprocs that are
wenzelm@26782
   519
  defined within a local target context, e.g.\ in a locale.
wenzelm@26782
   520
wenzelm@28760
   521
  \item @{text "simproc add: name"} and @{text "simproc del: name"}
wenzelm@26782
   522
  add or delete named simprocs to the current Simplifier context.  The
wenzelm@26782
   523
  default is to add a simproc.  Note that @{command "simproc_setup"}
wenzelm@26782
   524
  already adds the new simproc to the subsequent context.
wenzelm@26782
   525
wenzelm@28760
   526
  \end{description}
wenzelm@26782
   527
*}
wenzelm@26782
   528
wenzelm@26782
   529
wenzelm@42925
   530
subsubsection {* Example *}
wenzelm@42925
   531
wenzelm@42925
   532
text {* The following simplification procedure for @{thm
wenzelm@42925
   533
  [source=false, show_types] unit_eq} in HOL performs fine-grained
wenzelm@42925
   534
  control over rule application, beyond higher-order pattern matching.
wenzelm@42925
   535
  Declaring @{thm unit_eq} as @{attribute simp} directly would make
wenzelm@42925
   536
  the simplifier loop!  Note that a version of this simplification
wenzelm@42925
   537
  procedure is already active in Isabelle/HOL.  *}
wenzelm@42925
   538
wenzelm@42925
   539
simproc_setup unit ("x::unit") = {*
wenzelm@42925
   540
  fn _ => fn _ => fn ct =>
wenzelm@42925
   541
    if HOLogic.is_unit (term_of ct) then NONE
wenzelm@42925
   542
    else SOME (mk_meta_eq @{thm unit_eq})
wenzelm@42925
   543
*}
wenzelm@42925
   544
wenzelm@42925
   545
text {* Since the Simplifier applies simplification procedures
wenzelm@42925
   546
  frequently, it is important to make the failure check in ML
wenzelm@42925
   547
  reasonably fast. *}
wenzelm@42925
   548
wenzelm@42925
   549
wenzelm@27040
   550
subsection {* Forward simplification *}
wenzelm@26782
   551
wenzelm@26782
   552
text {*
wenzelm@26782
   553
  \begin{matharray}{rcl}
wenzelm@28761
   554
    @{attribute_def simplified} & : & @{text attribute} \\
wenzelm@26782
   555
  \end{matharray}
wenzelm@26782
   556
wenzelm@42596
   557
  @{rail "
wenzelm@42596
   558
    @@{attribute simplified} opt? @{syntax thmrefs}?
wenzelm@26782
   559
    ;
wenzelm@26782
   560
wenzelm@40255
   561
    opt: '(' ('no_asm' | 'no_asm_simp' | 'no_asm_use') ')'
wenzelm@42596
   562
  "}
wenzelm@26782
   563
wenzelm@28760
   564
  \begin{description}
wenzelm@26782
   565
  
wenzelm@28760
   566
  \item @{attribute simplified}~@{text "a\<^sub>1 \<dots> a\<^sub>n"} causes a theorem to
wenzelm@28760
   567
  be simplified, either by exactly the specified rules @{text "a\<^sub>1, \<dots>,
wenzelm@28760
   568
  a\<^sub>n"}, or the implicit Simplifier context if no arguments are given.
wenzelm@28760
   569
  The result is fully simplified by default, including assumptions and
wenzelm@28760
   570
  conclusion; the options @{text no_asm} etc.\ tune the Simplifier in
wenzelm@28760
   571
  the same way as the for the @{text simp} method.
wenzelm@26782
   572
wenzelm@26782
   573
  Note that forward simplification restricts the simplifier to its
wenzelm@26782
   574
  most basic operation of term rewriting; solver and looper tactics
wenzelm@26782
   575
  \cite{isabelle-ref} are \emph{not} involved here.  The @{text
wenzelm@26782
   576
  simplified} attribute should be only rarely required under normal
wenzelm@26782
   577
  circumstances.
wenzelm@26782
   578
wenzelm@28760
   579
  \end{description}
wenzelm@26782
   580
*}
wenzelm@26782
   581
wenzelm@26782
   582
wenzelm@27040
   583
section {* The Classical Reasoner \label{sec:classical} *}
wenzelm@26782
   584
wenzelm@42930
   585
subsection {* Basic concepts *}
wenzelm@42927
   586
wenzelm@42927
   587
text {* Although Isabelle is generic, many users will be working in
wenzelm@42927
   588
  some extension of classical first-order logic.  Isabelle/ZF is built
wenzelm@42927
   589
  upon theory FOL, while Isabelle/HOL conceptually contains
wenzelm@42927
   590
  first-order logic as a fragment.  Theorem-proving in predicate logic
wenzelm@42927
   591
  is undecidable, but many automated strategies have been developed to
wenzelm@42927
   592
  assist in this task.
wenzelm@42927
   593
wenzelm@42927
   594
  Isabelle's classical reasoner is a generic package that accepts
wenzelm@42927
   595
  certain information about a logic and delivers a suite of automatic
wenzelm@42927
   596
  proof tools, based on rules that are classified and declared in the
wenzelm@42927
   597
  context.  These proof procedures are slow and simplistic compared
wenzelm@42927
   598
  with high-end automated theorem provers, but they can save
wenzelm@42927
   599
  considerable time and effort in practice.  They can prove theorems
wenzelm@42927
   600
  such as Pelletier's \cite{pelletier86} problems 40 and 41 in a few
wenzelm@42927
   601
  milliseconds (including full proof reconstruction): *}
wenzelm@42927
   602
wenzelm@42927
   603
lemma "(\<exists>y. \<forall>x. F x y \<longleftrightarrow> F x x) \<longrightarrow> \<not> (\<forall>x. \<exists>y. \<forall>z. F z y \<longleftrightarrow> \<not> F z x)"
wenzelm@42927
   604
  by blast
wenzelm@42927
   605
wenzelm@42927
   606
lemma "(\<forall>z. \<exists>y. \<forall>x. f x y \<longleftrightarrow> f x z \<and> \<not> f x x) \<longrightarrow> \<not> (\<exists>z. \<forall>x. f x z)"
wenzelm@42927
   607
  by blast
wenzelm@42927
   608
wenzelm@42927
   609
text {* The proof tools are generic.  They are not restricted to
wenzelm@42927
   610
  first-order logic, and have been heavily used in the development of
wenzelm@42927
   611
  the Isabelle/HOL library and applications.  The tactics can be
wenzelm@42927
   612
  traced, and their components can be called directly; in this manner,
wenzelm@42927
   613
  any proof can be viewed interactively.  *}
wenzelm@42927
   614
wenzelm@42927
   615
wenzelm@42927
   616
subsubsection {* The sequent calculus *}
wenzelm@42927
   617
wenzelm@42927
   618
text {* Isabelle supports natural deduction, which is easy to use for
wenzelm@42927
   619
  interactive proof.  But natural deduction does not easily lend
wenzelm@42927
   620
  itself to automation, and has a bias towards intuitionism.  For
wenzelm@42927
   621
  certain proofs in classical logic, it can not be called natural.
wenzelm@42927
   622
  The \emph{sequent calculus}, a generalization of natural deduction,
wenzelm@42927
   623
  is easier to automate.
wenzelm@42927
   624
wenzelm@42927
   625
  A \textbf{sequent} has the form @{text "\<Gamma> \<turnstile> \<Delta>"}, where @{text "\<Gamma>"}
wenzelm@42927
   626
  and @{text "\<Delta>"} are sets of formulae.\footnote{For first-order
wenzelm@42927
   627
  logic, sequents can equivalently be made from lists or multisets of
wenzelm@42927
   628
  formulae.} The sequent @{text "P\<^sub>1, \<dots>, P\<^sub>m \<turnstile> Q\<^sub>1, \<dots>, Q\<^sub>n"} is
wenzelm@42927
   629
  \textbf{valid} if @{text "P\<^sub>1 \<and> \<dots> \<and> P\<^sub>m"} implies @{text "Q\<^sub>1 \<or> \<dots> \<or>
wenzelm@42927
   630
  Q\<^sub>n"}.  Thus @{text "P\<^sub>1, \<dots>, P\<^sub>m"} represent assumptions, each of which
wenzelm@42927
   631
  is true, while @{text "Q\<^sub>1, \<dots>, Q\<^sub>n"} represent alternative goals.  A
wenzelm@42927
   632
  sequent is \textbf{basic} if its left and right sides have a common
wenzelm@42927
   633
  formula, as in @{text "P, Q \<turnstile> Q, R"}; basic sequents are trivially
wenzelm@42927
   634
  valid.
wenzelm@42927
   635
wenzelm@42927
   636
  Sequent rules are classified as \textbf{right} or \textbf{left},
wenzelm@42927
   637
  indicating which side of the @{text "\<turnstile>"} symbol they operate on.
wenzelm@42927
   638
  Rules that operate on the right side are analogous to natural
wenzelm@42927
   639
  deduction's introduction rules, and left rules are analogous to
wenzelm@42927
   640
  elimination rules.  The sequent calculus analogue of @{text "(\<longrightarrow>I)"}
wenzelm@42927
   641
  is the rule
wenzelm@42927
   642
  \[
wenzelm@42927
   643
  \infer[@{text "(\<longrightarrow>R)"}]{@{text "\<Gamma> \<turnstile> \<Delta>, P \<longrightarrow> Q"}}{@{text "P, \<Gamma> \<turnstile> \<Delta>, Q"}}
wenzelm@42927
   644
  \]
wenzelm@42927
   645
  Applying the rule backwards, this breaks down some implication on
wenzelm@42927
   646
  the right side of a sequent; @{text "\<Gamma>"} and @{text "\<Delta>"} stand for
wenzelm@42927
   647
  the sets of formulae that are unaffected by the inference.  The
wenzelm@42927
   648
  analogue of the pair @{text "(\<or>I1)"} and @{text "(\<or>I2)"} is the
wenzelm@42927
   649
  single rule
wenzelm@42927
   650
  \[
wenzelm@42927
   651
  \infer[@{text "(\<or>R)"}]{@{text "\<Gamma> \<turnstile> \<Delta>, P \<or> Q"}}{@{text "\<Gamma> \<turnstile> \<Delta>, P, Q"}}
wenzelm@42927
   652
  \]
wenzelm@42927
   653
  This breaks down some disjunction on the right side, replacing it by
wenzelm@42927
   654
  both disjuncts.  Thus, the sequent calculus is a kind of
wenzelm@42927
   655
  multiple-conclusion logic.
wenzelm@42927
   656
wenzelm@42927
   657
  To illustrate the use of multiple formulae on the right, let us
wenzelm@42927
   658
  prove the classical theorem @{text "(P \<longrightarrow> Q) \<or> (Q \<longrightarrow> P)"}.  Working
wenzelm@42927
   659
  backwards, we reduce this formula to a basic sequent:
wenzelm@42927
   660
  \[
wenzelm@42927
   661
  \infer[@{text "(\<or>R)"}]{@{text "\<turnstile> (P \<longrightarrow> Q) \<or> (Q \<longrightarrow> P)"}}
wenzelm@42927
   662
    {\infer[@{text "(\<longrightarrow>R)"}]{@{text "\<turnstile> (P \<longrightarrow> Q), (Q \<longrightarrow> P)"}}
wenzelm@42927
   663
      {\infer[@{text "(\<longrightarrow>R)"}]{@{text "P \<turnstile> Q, (Q \<longrightarrow> P)"}}
wenzelm@42927
   664
        {@{text "P, Q \<turnstile> Q, P"}}}}
wenzelm@42927
   665
  \]
wenzelm@42927
   666
wenzelm@42927
   667
  This example is typical of the sequent calculus: start with the
wenzelm@42927
   668
  desired theorem and apply rules backwards in a fairly arbitrary
wenzelm@42927
   669
  manner.  This yields a surprisingly effective proof procedure.
wenzelm@42927
   670
  Quantifiers add only few complications, since Isabelle handles
wenzelm@42927
   671
  parameters and schematic variables.  See \cite[Chapter
wenzelm@42927
   672
  10]{paulson-ml2} for further discussion.  *}
wenzelm@42927
   673
wenzelm@42927
   674
wenzelm@42927
   675
subsubsection {* Simulating sequents by natural deduction *}
wenzelm@42927
   676
wenzelm@42927
   677
text {* Isabelle can represent sequents directly, as in the
wenzelm@42927
   678
  object-logic LK.  But natural deduction is easier to work with, and
wenzelm@42927
   679
  most object-logics employ it.  Fortunately, we can simulate the
wenzelm@42927
   680
  sequent @{text "P\<^sub>1, \<dots>, P\<^sub>m \<turnstile> Q\<^sub>1, \<dots>, Q\<^sub>n"} by the Isabelle formula
wenzelm@42927
   681
  @{text "P\<^sub>1 \<Longrightarrow> \<dots> \<Longrightarrow> P\<^sub>m \<Longrightarrow> \<not> Q\<^sub>2 \<Longrightarrow> ... \<Longrightarrow> \<not> Q\<^sub>n \<Longrightarrow> Q\<^sub>1"} where the order of
wenzelm@42927
   682
  the assumptions and the choice of @{text "Q\<^sub>1"} are arbitrary.
wenzelm@42927
   683
  Elim-resolution plays a key role in simulating sequent proofs.
wenzelm@42927
   684
wenzelm@42927
   685
  We can easily handle reasoning on the left.  Elim-resolution with
wenzelm@42927
   686
  the rules @{text "(\<or>E)"}, @{text "(\<bottom>E)"} and @{text "(\<exists>E)"} achieves
wenzelm@42927
   687
  a similar effect as the corresponding sequent rules.  For the other
wenzelm@42927
   688
  connectives, we use sequent-style elimination rules instead of
wenzelm@42927
   689
  destruction rules such as @{text "(\<and>E1, 2)"} and @{text "(\<forall>E)"}.
wenzelm@42927
   690
  But note that the rule @{text "(\<not>L)"} has no effect under our
wenzelm@42927
   691
  representation of sequents!
wenzelm@42927
   692
  \[
wenzelm@42927
   693
  \infer[@{text "(\<not>L)"}]{@{text "\<not> P, \<Gamma> \<turnstile> \<Delta>"}}{@{text "\<Gamma> \<turnstile> \<Delta>, P"}}
wenzelm@42927
   694
  \]
wenzelm@42927
   695
wenzelm@42927
   696
  What about reasoning on the right?  Introduction rules can only
wenzelm@42927
   697
  affect the formula in the conclusion, namely @{text "Q\<^sub>1"}.  The
wenzelm@42927
   698
  other right-side formulae are represented as negated assumptions,
wenzelm@42927
   699
  @{text "\<not> Q\<^sub>2, \<dots>, \<not> Q\<^sub>n"}.  In order to operate on one of these, it
wenzelm@42927
   700
  must first be exchanged with @{text "Q\<^sub>1"}.  Elim-resolution with the
wenzelm@42927
   701
  @{text swap} rule has this effect: @{text "\<not> P \<Longrightarrow> (\<not> R \<Longrightarrow> P) \<Longrightarrow> R"}
wenzelm@42927
   702
wenzelm@42927
   703
  To ensure that swaps occur only when necessary, each introduction
wenzelm@42927
   704
  rule is converted into a swapped form: it is resolved with the
wenzelm@42927
   705
  second premise of @{text "(swap)"}.  The swapped form of @{text
wenzelm@42927
   706
  "(\<and>I)"}, which might be called @{text "(\<not>\<and>E)"}, is
wenzelm@42927
   707
  @{text [display] "\<not> (P \<and> Q) \<Longrightarrow> (\<not> R \<Longrightarrow> P) \<Longrightarrow> (\<not> R \<Longrightarrow> Q) \<Longrightarrow> R"}
wenzelm@42927
   708
wenzelm@42927
   709
  Similarly, the swapped form of @{text "(\<longrightarrow>I)"} is
wenzelm@42927
   710
  @{text [display] "\<not> (P \<longrightarrow> Q) \<Longrightarrow> (\<not> R \<Longrightarrow> P \<Longrightarrow> Q) \<Longrightarrow> R"}
wenzelm@42927
   711
wenzelm@42927
   712
  Swapped introduction rules are applied using elim-resolution, which
wenzelm@42927
   713
  deletes the negated formula.  Our representation of sequents also
wenzelm@42927
   714
  requires the use of ordinary introduction rules.  If we had no
wenzelm@42927
   715
  regard for readability of intermediate goal states, we could treat
wenzelm@42927
   716
  the right side more uniformly by representing sequents as @{text
wenzelm@42927
   717
  [display] "P\<^sub>1 \<Longrightarrow> \<dots> \<Longrightarrow> P\<^sub>m \<Longrightarrow> \<not> Q\<^sub>1 \<Longrightarrow> \<dots> \<Longrightarrow> \<not> Q\<^sub>n \<Longrightarrow> \<bottom>"}
wenzelm@42927
   718
*}
wenzelm@42927
   719
wenzelm@42927
   720
wenzelm@42927
   721
subsubsection {* Extra rules for the sequent calculus *}
wenzelm@42927
   722
wenzelm@42927
   723
text {* As mentioned, destruction rules such as @{text "(\<and>E1, 2)"} and
wenzelm@42927
   724
  @{text "(\<forall>E)"} must be replaced by sequent-style elimination rules.
wenzelm@42927
   725
  In addition, we need rules to embody the classical equivalence
wenzelm@42927
   726
  between @{text "P \<longrightarrow> Q"} and @{text "\<not> P \<or> Q"}.  The introduction
wenzelm@42927
   727
  rules @{text "(\<or>I1, 2)"} are replaced by a rule that simulates
wenzelm@42927
   728
  @{text "(\<or>R)"}: @{text [display] "(\<not> Q \<Longrightarrow> P) \<Longrightarrow> P \<or> Q"}
wenzelm@42927
   729
wenzelm@42927
   730
  The destruction rule @{text "(\<longrightarrow>E)"} is replaced by @{text [display]
wenzelm@42927
   731
  "(P \<longrightarrow> Q) \<Longrightarrow> (\<not> P \<Longrightarrow> R) \<Longrightarrow> (Q \<Longrightarrow> R) \<Longrightarrow> R"}
wenzelm@42927
   732
wenzelm@42927
   733
  Quantifier replication also requires special rules.  In classical
wenzelm@42927
   734
  logic, @{text "\<exists>x. P x"} is equivalent to @{text "\<not> (\<forall>x. \<not> P x)"};
wenzelm@42927
   735
  the rules @{text "(\<exists>R)"} and @{text "(\<forall>L)"} are dual:
wenzelm@42927
   736
  \[
wenzelm@42927
   737
  \infer[@{text "(\<exists>R)"}]{@{text "\<Gamma> \<turnstile> \<Delta>, \<exists>x. P x"}}{@{text "\<Gamma> \<turnstile> \<Delta>, \<exists>x. P x, P t"}}
wenzelm@42927
   738
  \qquad
wenzelm@42927
   739
  \infer[@{text "(\<forall>L)"}]{@{text "\<forall>x. P x, \<Gamma> \<turnstile> \<Delta>"}}{@{text "P t, \<forall>x. P x, \<Gamma> \<turnstile> \<Delta>"}}
wenzelm@42927
   740
  \]
wenzelm@42927
   741
  Thus both kinds of quantifier may be replicated.  Theorems requiring
wenzelm@42927
   742
  multiple uses of a universal formula are easy to invent; consider
wenzelm@42927
   743
  @{text [display] "(\<forall>x. P x \<longrightarrow> P (f x)) \<and> P a \<longrightarrow> P (f\<^sup>n a)"} for any
wenzelm@42927
   744
  @{text "n > 1"}.  Natural examples of the multiple use of an
wenzelm@42927
   745
  existential formula are rare; a standard one is @{text "\<exists>x. \<forall>y. P x
wenzelm@42927
   746
  \<longrightarrow> P y"}.
wenzelm@42927
   747
wenzelm@42927
   748
  Forgoing quantifier replication loses completeness, but gains
wenzelm@42927
   749
  decidability, since the search space becomes finite.  Many useful
wenzelm@42927
   750
  theorems can be proved without replication, and the search generally
wenzelm@42927
   751
  delivers its verdict in a reasonable time.  To adopt this approach,
wenzelm@42927
   752
  represent the sequent rules @{text "(\<exists>R)"}, @{text "(\<exists>L)"} and
wenzelm@42927
   753
  @{text "(\<forall>R)"} by @{text "(\<exists>I)"}, @{text "(\<exists>E)"} and @{text "(\<forall>I)"},
wenzelm@42927
   754
  respectively, and put @{text "(\<forall>E)"} into elimination form: @{text
wenzelm@42927
   755
  [display] "\<forall>x. P x \<Longrightarrow> (P t \<Longrightarrow> Q) \<Longrightarrow> Q"}
wenzelm@42927
   756
wenzelm@42927
   757
  Elim-resolution with this rule will delete the universal formula
wenzelm@42927
   758
  after a single use.  To replicate universal quantifiers, replace the
wenzelm@42927
   759
  rule by @{text [display] "\<forall>x. P x \<Longrightarrow> (P t \<Longrightarrow> \<forall>x. P x \<Longrightarrow> Q) \<Longrightarrow> Q"}
wenzelm@42927
   760
wenzelm@42927
   761
  To replicate existential quantifiers, replace @{text "(\<exists>I)"} by
wenzelm@42927
   762
  @{text [display] "(\<not> (\<exists>x. P x) \<Longrightarrow> P t) \<Longrightarrow> \<exists>x. P x"}
wenzelm@42927
   763
wenzelm@42927
   764
  All introduction rules mentioned above are also useful in swapped
wenzelm@42927
   765
  form.
wenzelm@42927
   766
wenzelm@42927
   767
  Replication makes the search space infinite; we must apply the rules
wenzelm@42927
   768
  with care.  The classical reasoner distinguishes between safe and
wenzelm@42927
   769
  unsafe rules, applying the latter only when there is no alternative.
wenzelm@42927
   770
  Depth-first search may well go down a blind alley; best-first search
wenzelm@42927
   771
  is better behaved in an infinite search space.  However, quantifier
wenzelm@42927
   772
  replication is too expensive to prove any but the simplest theorems.
wenzelm@42927
   773
*}
wenzelm@42927
   774
wenzelm@42927
   775
wenzelm@42928
   776
subsection {* Rule declarations *}
wenzelm@42928
   777
wenzelm@42928
   778
text {* The proof tools of the Classical Reasoner depend on
wenzelm@42928
   779
  collections of rules declared in the context, which are classified
wenzelm@42928
   780
  as introduction, elimination or destruction and as \emph{safe} or
wenzelm@42928
   781
  \emph{unsafe}.  In general, safe rules can be attempted blindly,
wenzelm@42928
   782
  while unsafe rules must be used with care.  A safe rule must never
wenzelm@42928
   783
  reduce a provable goal to an unprovable set of subgoals.
wenzelm@42928
   784
wenzelm@42928
   785
  The rule @{text "P \<Longrightarrow> P \<or> Q"} is unsafe because it reduces @{text "P
wenzelm@42928
   786
  \<or> Q"} to @{text "P"}, which might turn out as premature choice of an
wenzelm@42928
   787
  unprovable subgoal.  Any rule is unsafe whose premises contain new
wenzelm@42928
   788
  unknowns.  The elimination rule @{text "\<forall>x. P x \<Longrightarrow> (P t \<Longrightarrow> Q) \<Longrightarrow> Q"} is
wenzelm@42928
   789
  unsafe, since it is applied via elim-resolution, which discards the
wenzelm@42928
   790
  assumption @{text "\<forall>x. P x"} and replaces it by the weaker
wenzelm@42928
   791
  assumption @{text "P t"}.  The rule @{text "P t \<Longrightarrow> \<exists>x. P x"} is
wenzelm@42928
   792
  unsafe for similar reasons.  The quantifier duplication rule @{text
wenzelm@42928
   793
  "\<forall>x. P x \<Longrightarrow> (P t \<Longrightarrow> \<forall>x. P x \<Longrightarrow> Q) \<Longrightarrow> Q"} is unsafe in a different sense:
wenzelm@42928
   794
  since it keeps the assumption @{text "\<forall>x. P x"}, it is prone to
wenzelm@42928
   795
  looping.  In classical first-order logic, all rules are safe except
wenzelm@42928
   796
  those mentioned above.
wenzelm@42928
   797
wenzelm@42928
   798
  The safe~/ unsafe distinction is vague, and may be regarded merely
wenzelm@42928
   799
  as a way of giving some rules priority over others.  One could argue
wenzelm@42928
   800
  that @{text "(\<or>E)"} is unsafe, because repeated application of it
wenzelm@42928
   801
  could generate exponentially many subgoals.  Induction rules are
wenzelm@42928
   802
  unsafe because inductive proofs are difficult to set up
wenzelm@42928
   803
  automatically.  Any inference is unsafe that instantiates an unknown
wenzelm@42928
   804
  in the proof state --- thus matching must be used, rather than
wenzelm@42928
   805
  unification.  Even proof by assumption is unsafe if it instantiates
wenzelm@42928
   806
  unknowns shared with other subgoals.
wenzelm@42928
   807
wenzelm@42928
   808
  \begin{matharray}{rcl}
wenzelm@42928
   809
    @{command_def "print_claset"}@{text "\<^sup>*"} & : & @{text "context \<rightarrow>"} \\
wenzelm@42928
   810
    @{attribute_def intro} & : & @{text attribute} \\
wenzelm@42928
   811
    @{attribute_def elim} & : & @{text attribute} \\
wenzelm@42928
   812
    @{attribute_def dest} & : & @{text attribute} \\
wenzelm@42928
   813
    @{attribute_def rule} & : & @{text attribute} \\
wenzelm@42928
   814
    @{attribute_def iff} & : & @{text attribute} \\
wenzelm@42928
   815
    @{attribute_def swapped} & : & @{text attribute} \\
wenzelm@42928
   816
  \end{matharray}
wenzelm@42928
   817
wenzelm@42928
   818
  @{rail "
wenzelm@42928
   819
    (@@{attribute intro} | @@{attribute elim} | @@{attribute dest}) ('!' | () | '?') @{syntax nat}?
wenzelm@42928
   820
    ;
wenzelm@42928
   821
    @@{attribute rule} 'del'
wenzelm@42928
   822
    ;
wenzelm@42928
   823
    @@{attribute iff} (((() | 'add') '?'?) | 'del')
wenzelm@42928
   824
  "}
wenzelm@42928
   825
wenzelm@42928
   826
  \begin{description}
wenzelm@42928
   827
wenzelm@42928
   828
  \item @{command "print_claset"} prints the collection of rules
wenzelm@42928
   829
  declared to the Classical Reasoner, i.e.\ the @{ML_type claset}
wenzelm@42928
   830
  within the context.
wenzelm@42928
   831
wenzelm@42928
   832
  \item @{attribute intro}, @{attribute elim}, and @{attribute dest}
wenzelm@42928
   833
  declare introduction, elimination, and destruction rules,
wenzelm@42928
   834
  respectively.  By default, rules are considered as \emph{unsafe}
wenzelm@42928
   835
  (i.e.\ not applied blindly without backtracking), while ``@{text
wenzelm@42928
   836
  "!"}'' classifies as \emph{safe}.  Rule declarations marked by
wenzelm@42928
   837
  ``@{text "?"}'' coincide with those of Isabelle/Pure, cf.\
wenzelm@42928
   838
  \secref{sec:pure-meth-att} (i.e.\ are only applied in single steps
wenzelm@42928
   839
  of the @{method rule} method).  The optional natural number
wenzelm@42928
   840
  specifies an explicit weight argument, which is ignored by the
wenzelm@42928
   841
  automated reasoning tools, but determines the search order of single
wenzelm@42928
   842
  rule steps.
wenzelm@42928
   843
wenzelm@42928
   844
  Introduction rules are those that can be applied using ordinary
wenzelm@42928
   845
  resolution.  Their swapped forms are generated internally, which
wenzelm@42928
   846
  will be applied using elim-resolution.  Elimination rules are
wenzelm@42928
   847
  applied using elim-resolution.  Rules are sorted by the number of
wenzelm@42928
   848
  new subgoals they will yield; rules that generate the fewest
wenzelm@42928
   849
  subgoals will be tried first.  Otherwise, later declarations take
wenzelm@42928
   850
  precedence over earlier ones.
wenzelm@42928
   851
wenzelm@42928
   852
  Rules already present in the context with the same classification
wenzelm@42928
   853
  are ignored.  A warning is printed if the rule has already been
wenzelm@42928
   854
  added with some other classification, but the rule is added anyway
wenzelm@42928
   855
  as requested.
wenzelm@42928
   856
wenzelm@42928
   857
  \item @{attribute rule}~@{text del} deletes all occurrences of a
wenzelm@42928
   858
  rule from the classical context, regardless of its classification as
wenzelm@42928
   859
  introduction~/ elimination~/ destruction and safe~/ unsafe.
wenzelm@42928
   860
wenzelm@42928
   861
  \item @{attribute iff} declares logical equivalences to the
wenzelm@42928
   862
  Simplifier and the Classical reasoner at the same time.
wenzelm@42928
   863
  Non-conditional rules result in a safe introduction and elimination
wenzelm@42928
   864
  pair; conditional ones are considered unsafe.  Rules with negative
wenzelm@42928
   865
  conclusion are automatically inverted (using @{text "\<not>"}-elimination
wenzelm@42928
   866
  internally).
wenzelm@42928
   867
wenzelm@42928
   868
  The ``@{text "?"}'' version of @{attribute iff} declares rules to
wenzelm@42928
   869
  the Isabelle/Pure context only, and omits the Simplifier
wenzelm@42928
   870
  declaration.
wenzelm@42928
   871
wenzelm@42928
   872
  \item @{attribute swapped} turns an introduction rule into an
wenzelm@42928
   873
  elimination, by resolving with the classical swap principle @{text
wenzelm@42928
   874
  "\<not> P \<Longrightarrow> (\<not> R \<Longrightarrow> P) \<Longrightarrow> R"} in the second position.  This is mainly for
wenzelm@42928
   875
  illustrative purposes: the Classical Reasoner already swaps rules
wenzelm@42928
   876
  internally as explained above.
wenzelm@42928
   877
wenzelm@28760
   878
  \end{description}
wenzelm@26782
   879
*}
wenzelm@26782
   880
wenzelm@26782
   881
wenzelm@27040
   882
subsection {* Automated methods *}
wenzelm@26782
   883
wenzelm@26782
   884
text {*
wenzelm@26782
   885
  \begin{matharray}{rcl}
wenzelm@28761
   886
    @{method_def blast} & : & @{text method} \\
wenzelm@42930
   887
    @{method_def auto} & : & @{text method} \\
wenzelm@42930
   888
    @{method_def force} & : & @{text method} \\
wenzelm@28761
   889
    @{method_def fast} & : & @{text method} \\
wenzelm@28761
   890
    @{method_def slow} & : & @{text method} \\
wenzelm@28761
   891
    @{method_def best} & : & @{text method} \\
wenzelm@28761
   892
    @{method_def fastsimp} & : & @{text method} \\
wenzelm@28761
   893
    @{method_def slowsimp} & : & @{text method} \\
wenzelm@28761
   894
    @{method_def bestsimp} & : & @{text method} \\
wenzelm@26782
   895
  \end{matharray}
wenzelm@26782
   896
wenzelm@42596
   897
  @{rail "
wenzelm@42930
   898
    @@{method blast} @{syntax nat}? (@{syntax clamod} * )
wenzelm@42930
   899
    ;
wenzelm@42596
   900
    @@{method auto} (@{syntax nat} @{syntax nat})? (@{syntax clasimpmod} * )
wenzelm@26782
   901
    ;
wenzelm@42930
   902
    @@{method force} (@{syntax clasimpmod} * )
wenzelm@42930
   903
    ;
wenzelm@42930
   904
    (@@{method fast} | @@{method slow} | @@{method best}) (@{syntax clamod} * )
wenzelm@26782
   905
    ;
wenzelm@42930
   906
    (@@{method fastsimp} | @@{method slowsimp} | @@{method bestsimp})
wenzelm@42930
   907
      (@{syntax clasimpmod} * )
wenzelm@42930
   908
    ;
wenzelm@42930
   909
    @{syntax_def clamod}:
wenzelm@42930
   910
      (('intro' | 'elim' | 'dest') ('!' | () | '?') | 'del') ':' @{syntax thmrefs}
wenzelm@42930
   911
    ;
wenzelm@42596
   912
    @{syntax_def clasimpmod}: ('simp' (() | 'add' | 'del' | 'only') |
wenzelm@26782
   913
      ('cong' | 'split') (() | 'add' | 'del') |
wenzelm@26782
   914
      'iff' (((() | 'add') '?'?) | 'del') |
wenzelm@42596
   915
      (('intro' | 'elim' | 'dest') ('!' | () | '?') | 'del')) ':' @{syntax thmrefs}
wenzelm@42596
   916
  "}
wenzelm@26782
   917
wenzelm@28760
   918
  \begin{description}
wenzelm@26782
   919
wenzelm@42930
   920
  \item @{method blast} is a separate classical tableau prover that
wenzelm@42930
   921
  uses the same classical rule declarations as explained before.
wenzelm@42930
   922
wenzelm@42930
   923
  Proof search is coded directly in ML using special data structures.
wenzelm@42930
   924
  A successful proof is then reconstructed using regular Isabelle
wenzelm@42930
   925
  inferences.  It is faster and more powerful than the other classical
wenzelm@42930
   926
  reasoning tools, but has major limitations too.
wenzelm@42930
   927
wenzelm@42930
   928
  \begin{itemize}
wenzelm@42930
   929
wenzelm@42930
   930
  \item It does not use the classical wrapper tacticals, such as the
wenzelm@42930
   931
  integration with the Simplifier of @{method fastsimp}.
wenzelm@42930
   932
wenzelm@42930
   933
  \item It does not perform higher-order unification, as needed by the
wenzelm@42930
   934
  rule @{thm [source=false] rangeI} in HOL.  There are often
wenzelm@42930
   935
  alternatives to such rules, for example @{thm [source=false]
wenzelm@42930
   936
  range_eqI}.
wenzelm@42930
   937
wenzelm@42930
   938
  \item Function variables may only be applied to parameters of the
wenzelm@42930
   939
  subgoal.  (This restriction arises because the prover does not use
wenzelm@42930
   940
  higher-order unification.)  If other function variables are present
wenzelm@42930
   941
  then the prover will fail with the message \texttt{Function Var's
wenzelm@42930
   942
  argument not a bound variable}.
wenzelm@42930
   943
wenzelm@42930
   944
  \item Its proof strategy is more general than @{method fast} but can
wenzelm@42930
   945
  be slower.  If @{method blast} fails or seems to be running forever,
wenzelm@42930
   946
  try @{method fast} and the other proof tools described below.
wenzelm@42930
   947
wenzelm@42930
   948
  \end{itemize}
wenzelm@42930
   949
wenzelm@42930
   950
  The optional integer argument specifies a bound for the number of
wenzelm@42930
   951
  unsafe steps used in a proof.  By default, @{method blast} starts
wenzelm@42930
   952
  with a bound of 0 and increases it successively to 20.  In contrast,
wenzelm@42930
   953
  @{text "(blast lim)"} tries to prove the goal using a search bound
wenzelm@42930
   954
  of @{text "lim"}.  Sometimes a slow proof using @{method blast} can
wenzelm@42930
   955
  be made much faster by supplying the successful search bound to this
wenzelm@42930
   956
  proof method instead.
wenzelm@42930
   957
wenzelm@42930
   958
  \item @{method auto} combines classical reasoning with
wenzelm@42930
   959
  simplification.  It is intended for situations where there are a lot
wenzelm@42930
   960
  of mostly trivial subgoals; it proves all the easy ones, leaving the
wenzelm@42930
   961
  ones it cannot prove.  Occasionally, attempting to prove the hard
wenzelm@42930
   962
  ones may take a long time.
wenzelm@42930
   963
wenzelm@42930
   964
  %FIXME auto nat arguments
wenzelm@42930
   965
wenzelm@42930
   966
  \item @{method force} is intended to prove the first subgoal
wenzelm@42930
   967
  completely, using many fancy proof tools and performing a rather
wenzelm@42930
   968
  exhaustive search.  As a result, proof attempts may take rather long
wenzelm@42930
   969
  or diverge easily.
wenzelm@42930
   970
wenzelm@42930
   971
  \item @{method fast}, @{method best}, @{method slow} attempt to
wenzelm@42930
   972
  prove the first subgoal using sequent-style reasoning as explained
wenzelm@42930
   973
  before.  Unlike @{method blast}, they construct proofs directly in
wenzelm@42930
   974
  Isabelle.
wenzelm@26782
   975
wenzelm@42930
   976
  There is a difference in search strategy and back-tracking: @{method
wenzelm@42930
   977
  fast} uses depth-first search and @{method best} uses best-first
wenzelm@42930
   978
  search (guided by a heuristic function: normally the total size of
wenzelm@42930
   979
  the proof state).
wenzelm@42930
   980
wenzelm@42930
   981
  Method @{method slow} is like @{method fast}, but conducts a broader
wenzelm@42930
   982
  search: it may, when backtracking from a failed proof attempt, undo
wenzelm@42930
   983
  even the step of proving a subgoal by assumption.
wenzelm@42930
   984
wenzelm@42930
   985
  \item @{method fastsimp}, @{method slowsimp}, @{method bestsimp} are
wenzelm@42930
   986
  like @{method fast}, @{method slow}, @{method best}, respectively,
wenzelm@42930
   987
  but use the Simplifier as additional wrapper.
wenzelm@42930
   988
wenzelm@42930
   989
  \end{description}
wenzelm@42930
   990
wenzelm@42930
   991
  Any of the above methods support additional modifiers of the context
wenzelm@42930
   992
  of classical (and simplifier) rules, but the ones related to the
wenzelm@42930
   993
  Simplifier are explicitly prefixed by @{text simp} here.  The
wenzelm@42930
   994
  semantics of these ad-hoc rule declarations is analogous to the
wenzelm@42930
   995
  attributes given before.  Facts provided by forward chaining are
wenzelm@42930
   996
  inserted into the goal before commencing proof search.
wenzelm@42930
   997
*}
wenzelm@42930
   998
wenzelm@42930
   999
wenzelm@42930
  1000
subsection {* Semi-automated methods *}
wenzelm@42930
  1001
wenzelm@42930
  1002
text {* These proof methods may help in situations when the
wenzelm@42930
  1003
  fully-automated tools fail.  The result is a simpler subgoal that
wenzelm@42930
  1004
  can be tackled by other means, such as by manual instantiation of
wenzelm@42930
  1005
  quantifiers.
wenzelm@42930
  1006
wenzelm@42930
  1007
  \begin{matharray}{rcl}
wenzelm@42930
  1008
    @{method_def safe} & : & @{text method} \\
wenzelm@42930
  1009
    @{method_def clarify} & : & @{text method} \\
wenzelm@42930
  1010
    @{method_def clarsimp} & : & @{text method} \\
wenzelm@42930
  1011
  \end{matharray}
wenzelm@42930
  1012
wenzelm@42930
  1013
  @{rail "
wenzelm@42930
  1014
    (@@{method safe} | @@{method clarify}) (@{syntax clamod} * )
wenzelm@42930
  1015
    ;
wenzelm@42930
  1016
    @@{method clarsimp} (@{syntax clasimpmod} * )
wenzelm@42930
  1017
  "}
wenzelm@42930
  1018
wenzelm@42930
  1019
  \begin{description}
wenzelm@42930
  1020
wenzelm@42930
  1021
  \item @{method safe} repeatedly performs safe steps on all subgoals.
wenzelm@42930
  1022
  It is deterministic, with at most one outcome.
wenzelm@42930
  1023
wenzelm@42930
  1024
  \item @{method clarify} performs a series of safe steps as follows.
wenzelm@42930
  1025
wenzelm@42930
  1026
  No splitting step is applied; for example, the subgoal @{text "A \<and>
wenzelm@42930
  1027
  B"} is left as a conjunction.  Proof by assumption, Modus Ponens,
wenzelm@42930
  1028
  etc., may be performed provided they do not instantiate unknowns.
wenzelm@42930
  1029
  Assumptions of the form @{text "x = t"} may be eliminated.  The safe
wenzelm@42930
  1030
  wrapper tactical is applied.
wenzelm@42930
  1031
wenzelm@42930
  1032
  \item @{method clarsimp} acts like @{method clarify}, but also does
wenzelm@42930
  1033
  simplification.  Note that if the Simplifier context includes a
wenzelm@42930
  1034
  splitter for the premises, the subgoal may still be split.
wenzelm@26782
  1035
wenzelm@28760
  1036
  \end{description}
wenzelm@26782
  1037
*}
wenzelm@26782
  1038
wenzelm@26782
  1039
wenzelm@42929
  1040
subsection {* Structured proof methods *}
wenzelm@42929
  1041
wenzelm@42929
  1042
text {*
wenzelm@42929
  1043
  \begin{matharray}{rcl}
wenzelm@42929
  1044
    @{method_def rule} & : & @{text method} \\
wenzelm@42929
  1045
    @{method_def contradiction} & : & @{text method} \\
wenzelm@42929
  1046
    @{method_def intro} & : & @{text method} \\
wenzelm@42929
  1047
    @{method_def elim} & : & @{text method} \\
wenzelm@42929
  1048
  \end{matharray}
wenzelm@42929
  1049
wenzelm@42929
  1050
  @{rail "
wenzelm@42929
  1051
    (@@{method rule} | @@{method intro} | @@{method elim}) @{syntax thmrefs}?
wenzelm@42929
  1052
  "}
wenzelm@42929
  1053
wenzelm@42929
  1054
  \begin{description}
wenzelm@42929
  1055
wenzelm@42929
  1056
  \item @{method rule} as offered by the Classical Reasoner is a
wenzelm@42929
  1057
  refinement over the Pure one (see \secref{sec:pure-meth-att}).  Both
wenzelm@42929
  1058
  versions work the same, but the classical version observes the
wenzelm@42929
  1059
  classical rule context in addition to that of Isabelle/Pure.
wenzelm@42929
  1060
wenzelm@42929
  1061
  Common object logics (HOL, ZF, etc.) declare a rich collection of
wenzelm@42929
  1062
  classical rules (even if these would qualify as intuitionistic
wenzelm@42929
  1063
  ones), but only few declarations to the rule context of
wenzelm@42929
  1064
  Isabelle/Pure (\secref{sec:pure-meth-att}).
wenzelm@42929
  1065
wenzelm@42929
  1066
  \item @{method contradiction} solves some goal by contradiction,
wenzelm@42929
  1067
  deriving any result from both @{text "\<not> A"} and @{text A}.  Chained
wenzelm@42929
  1068
  facts, which are guaranteed to participate, may appear in either
wenzelm@42929
  1069
  order.
wenzelm@42929
  1070
wenzelm@42929
  1071
  \item @{method intro} and @{method elim} repeatedly refine some goal
wenzelm@42929
  1072
  by intro- or elim-resolution, after having inserted any chained
wenzelm@42929
  1073
  facts.  Exactly the rules given as arguments are taken into account;
wenzelm@42929
  1074
  this allows fine-tuned decomposition of a proof problem, in contrast
wenzelm@42929
  1075
  to common automated tools.
wenzelm@42929
  1076
wenzelm@42929
  1077
  \end{description}
wenzelm@42929
  1078
*}
wenzelm@42929
  1079
wenzelm@42929
  1080
wenzelm@27044
  1081
section {* Object-logic setup \label{sec:object-logic} *}
wenzelm@26790
  1082
wenzelm@26790
  1083
text {*
wenzelm@26790
  1084
  \begin{matharray}{rcl}
wenzelm@28761
  1085
    @{command_def "judgment"} & : & @{text "theory \<rightarrow> theory"} \\
wenzelm@28761
  1086
    @{method_def atomize} & : & @{text method} \\
wenzelm@28761
  1087
    @{attribute_def atomize} & : & @{text attribute} \\
wenzelm@28761
  1088
    @{attribute_def rule_format} & : & @{text attribute} \\
wenzelm@28761
  1089
    @{attribute_def rulify} & : & @{text attribute} \\
wenzelm@26790
  1090
  \end{matharray}
wenzelm@26790
  1091
wenzelm@26790
  1092
  The very starting point for any Isabelle object-logic is a ``truth
wenzelm@26790
  1093
  judgment'' that links object-level statements to the meta-logic
wenzelm@26790
  1094
  (with its minimal language of @{text prop} that covers universal
wenzelm@26790
  1095
  quantification @{text "\<And>"} and implication @{text "\<Longrightarrow>"}).
wenzelm@26790
  1096
wenzelm@26790
  1097
  Common object-logics are sufficiently expressive to internalize rule
wenzelm@26790
  1098
  statements over @{text "\<And>"} and @{text "\<Longrightarrow>"} within their own
wenzelm@26790
  1099
  language.  This is useful in certain situations where a rule needs
wenzelm@26790
  1100
  to be viewed as an atomic statement from the meta-level perspective,
wenzelm@26790
  1101
  e.g.\ @{text "\<And>x. x \<in> A \<Longrightarrow> P x"} versus @{text "\<forall>x \<in> A. P x"}.
wenzelm@26790
  1102
wenzelm@26790
  1103
  From the following language elements, only the @{method atomize}
wenzelm@26790
  1104
  method and @{attribute rule_format} attribute are occasionally
wenzelm@26790
  1105
  required by end-users, the rest is for those who need to setup their
wenzelm@26790
  1106
  own object-logic.  In the latter case existing formulations of
wenzelm@26790
  1107
  Isabelle/FOL or Isabelle/HOL may be taken as realistic examples.
wenzelm@26790
  1108
wenzelm@26790
  1109
  Generic tools may refer to the information provided by object-logic
wenzelm@26790
  1110
  declarations internally.
wenzelm@26790
  1111
wenzelm@42596
  1112
  @{rail "
wenzelm@42596
  1113
    @@{command judgment} @{syntax constdecl}
wenzelm@26790
  1114
    ;
wenzelm@42596
  1115
    @@{attribute atomize} ('(' 'full' ')')?
wenzelm@26790
  1116
    ;
wenzelm@42596
  1117
    @@{attribute rule_format} ('(' 'noasm' ')')?
wenzelm@42596
  1118
  "}
wenzelm@26790
  1119
wenzelm@28760
  1120
  \begin{description}
wenzelm@26790
  1121
  
wenzelm@28760
  1122
  \item @{command "judgment"}~@{text "c :: \<sigma> (mx)"} declares constant
wenzelm@28760
  1123
  @{text c} as the truth judgment of the current object-logic.  Its
wenzelm@28760
  1124
  type @{text \<sigma>} should specify a coercion of the category of
wenzelm@28760
  1125
  object-level propositions to @{text prop} of the Pure meta-logic;
wenzelm@28760
  1126
  the mixfix annotation @{text "(mx)"} would typically just link the
wenzelm@28760
  1127
  object language (internally of syntactic category @{text logic})
wenzelm@28760
  1128
  with that of @{text prop}.  Only one @{command "judgment"}
wenzelm@28760
  1129
  declaration may be given in any theory development.
wenzelm@26790
  1130
  
wenzelm@28760
  1131
  \item @{method atomize} (as a method) rewrites any non-atomic
wenzelm@26790
  1132
  premises of a sub-goal, using the meta-level equations declared via
wenzelm@26790
  1133
  @{attribute atomize} (as an attribute) beforehand.  As a result,
wenzelm@26790
  1134
  heavily nested goals become amenable to fundamental operations such
wenzelm@42626
  1135
  as resolution (cf.\ the @{method (Pure) rule} method).  Giving the ``@{text
wenzelm@26790
  1136
  "(full)"}'' option here means to turn the whole subgoal into an
wenzelm@26790
  1137
  object-statement (if possible), including the outermost parameters
wenzelm@26790
  1138
  and assumptions as well.
wenzelm@26790
  1139
wenzelm@26790
  1140
  A typical collection of @{attribute atomize} rules for a particular
wenzelm@26790
  1141
  object-logic would provide an internalization for each of the
wenzelm@26790
  1142
  connectives of @{text "\<And>"}, @{text "\<Longrightarrow>"}, and @{text "\<equiv>"}.
wenzelm@26790
  1143
  Meta-level conjunction should be covered as well (this is
wenzelm@26790
  1144
  particularly important for locales, see \secref{sec:locale}).
wenzelm@26790
  1145
wenzelm@28760
  1146
  \item @{attribute rule_format} rewrites a theorem by the equalities
wenzelm@28760
  1147
  declared as @{attribute rulify} rules in the current object-logic.
wenzelm@28760
  1148
  By default, the result is fully normalized, including assumptions
wenzelm@28760
  1149
  and conclusions at any depth.  The @{text "(no_asm)"} option
wenzelm@28760
  1150
  restricts the transformation to the conclusion of a rule.
wenzelm@26790
  1151
wenzelm@26790
  1152
  In common object-logics (HOL, FOL, ZF), the effect of @{attribute
wenzelm@26790
  1153
  rule_format} is to replace (bounded) universal quantification
wenzelm@26790
  1154
  (@{text "\<forall>"}) and implication (@{text "\<longrightarrow>"}) by the corresponding
wenzelm@26790
  1155
  rule statements over @{text "\<And>"} and @{text "\<Longrightarrow>"}.
wenzelm@26790
  1156
wenzelm@28760
  1157
  \end{description}
wenzelm@26790
  1158
*}
wenzelm@26790
  1159
wenzelm@26782
  1160
end