src/HOL/WF.ML
author paulson
Thu Sep 23 13:06:31 1999 +0200 (1999-09-23)
changeset 7584 5be4bb8e4e3f
parent 7570 a9391550eea1
child 8265 187cada50e19
permissions -rw-r--r--
tidied; added lemma restrict_to_left
clasohm@1475
     1
(*  Title:      HOL/wf.ML
clasohm@923
     2
    ID:         $Id$
clasohm@1475
     3
    Author:     Tobias Nipkow, with minor changes by Konrad Slind
clasohm@1475
     4
    Copyright   1992  University of Cambridge/1995 TU Munich
clasohm@923
     5
paulson@3198
     6
Wellfoundedness, induction, and  recursion
clasohm@923
     7
*)
clasohm@923
     8
paulson@7249
     9
Goal "x = y ==> H x z = H y z";
paulson@7249
    10
by (Asm_simp_tac 1);
paulson@7249
    11
val H_cong2 = (*freeze H!*)
paulson@7249
    12
	      read_instantiate [("H","H")] (result());
clasohm@923
    13
nipkow@5579
    14
val [prem] = Goalw [wf_def]
nipkow@5579
    15
 "[| !!P x. [| !x. (!y. (y,x) : r --> P(y)) --> P(x) |] ==> P(x) |] ==> wf(r)";
nipkow@5579
    16
by (Clarify_tac 1);
nipkow@5579
    17
by (rtac prem 1);
nipkow@5579
    18
by (assume_tac 1);
nipkow@5579
    19
qed "wfUNIVI";
nipkow@5579
    20
clasohm@923
    21
(*Restriction to domain A.  If r is well-founded over A then wf(r)*)
paulson@5316
    22
val [prem1,prem2] = Goalw [wf_def]
paulson@1642
    23
 "[| r <= A Times A;  \
clasohm@972
    24
\    !!x P. [| ! x. (! y. (y,x) : r --> P(y)) --> P(x);  x:A |] ==> P(x) |]  \
clasohm@923
    25
\ ==>  wf(r)";
paulson@7249
    26
by (blast_tac (claset() addSEs [prem1 RS subsetD RS SigmaE2] addIs [prem2]) 1);
clasohm@923
    27
qed "wfI";
clasohm@923
    28
paulson@5316
    29
val major::prems = Goalw [wf_def]
clasohm@923
    30
    "[| wf(r);          \
clasohm@972
    31
\       !!x.[| ! y. (y,x): r --> P(y) |] ==> P(x) \
clasohm@923
    32
\    |]  ==>  P(a)";
clasohm@923
    33
by (rtac (major RS spec RS mp RS spec) 1);
wenzelm@4089
    34
by (blast_tac (claset() addIs prems) 1);
clasohm@923
    35
qed "wf_induct";
clasohm@923
    36
clasohm@923
    37
(*Perform induction on i, then prove the wf(r) subgoal using prems. *)
clasohm@923
    38
fun wf_ind_tac a prems i = 
clasohm@923
    39
    EVERY [res_inst_tac [("a",a)] wf_induct i,
clasohm@1465
    40
           rename_last_tac a ["1"] (i+1),
clasohm@1465
    41
           ares_tac prems i];
clasohm@923
    42
paulson@5452
    43
Goal "wf(r) ==> ! x. (a,x):r --> (x,a)~:r";
paulson@5316
    44
by (wf_ind_tac "a" [] 1);
paulson@2935
    45
by (Blast_tac 1);
paulson@5452
    46
qed_spec_mp "wf_not_sym";
paulson@5452
    47
paulson@5452
    48
(* [| wf(r);  (a,x):r;  ~P ==> (x,a):r |] ==> P *)
paulson@5452
    49
bind_thm ("wf_asym", wf_not_sym RS swap);
clasohm@923
    50
paulson@5316
    51
Goal "[| wf(r);  (a,a): r |] ==> P";
paulson@5316
    52
by (blast_tac (claset() addEs [wf_asym]) 1);
paulson@1618
    53
qed "wf_irrefl";
clasohm@923
    54
clasohm@1475
    55
(*transitive closure of a wf relation is wf! *)
paulson@5316
    56
Goal "wf(r) ==> wf(r^+)";
paulson@5316
    57
by (stac wf_def 1);
paulson@3708
    58
by (Clarify_tac 1);
clasohm@923
    59
(*must retain the universal formula for later use!*)
clasohm@923
    60
by (rtac allE 1 THEN assume_tac 1);
clasohm@923
    61
by (etac mp 1);
paulson@5316
    62
by (eres_inst_tac [("a","x")] wf_induct 1);
paulson@7249
    63
by (blast_tac (claset() addEs [tranclE]) 1);
clasohm@923
    64
qed "wf_trancl";
clasohm@923
    65
clasohm@923
    66
oheimb@4762
    67
val wf_converse_trancl = prove_goal thy 
oheimb@4762
    68
"!!X. wf (r^-1) ==> wf ((r^+)^-1)" (K [
oheimb@4762
    69
	stac (trancl_converse RS sym) 1,
oheimb@4762
    70
	etac wf_trancl 1]);
oheimb@4762
    71
paulson@3198
    72
(*----------------------------------------------------------------------------
paulson@3198
    73
 * Minimal-element characterization of well-foundedness
paulson@3198
    74
 *---------------------------------------------------------------------------*)
paulson@3198
    75
paulson@5316
    76
Goalw [wf_def] "wf r ==> x:Q --> (? z:Q. ! y. (y,z):r --> y~:Q)";
paulson@5318
    77
by (dtac spec 1);
paulson@5316
    78
by (etac (mp RS spec) 1);
paulson@3198
    79
by (Blast_tac 1);
paulson@3198
    80
val lemma1 = result();
paulson@3198
    81
paulson@5316
    82
Goalw [wf_def] "(! Q x. x:Q --> (? z:Q. ! y. (y,z):r --> y~:Q)) ==> wf r";
paulson@3708
    83
by (Clarify_tac 1);
paulson@3198
    84
by (dres_inst_tac [("x", "{x. ~ P x}")] spec 1);
paulson@3198
    85
by (Blast_tac 1);
paulson@3198
    86
val lemma2 = result();
paulson@3198
    87
wenzelm@5069
    88
Goal "wf r = (! Q x. x:Q --> (? z:Q. ! y. (y,z):r --> y~:Q))";
wenzelm@4089
    89
by (blast_tac (claset() addSIs [lemma1, lemma2]) 1);
paulson@3198
    90
qed "wf_eq_minimal";
paulson@3198
    91
nipkow@3413
    92
(*---------------------------------------------------------------------------
nipkow@3413
    93
 * Wellfoundedness of subsets
nipkow@3413
    94
 *---------------------------------------------------------------------------*)
nipkow@3413
    95
paulson@5143
    96
Goal "[| wf(r);  p<=r |] ==> wf(p)";
wenzelm@4089
    97
by (full_simp_tac (simpset() addsimps [wf_eq_minimal]) 1);
nipkow@3413
    98
by (Fast_tac 1);
nipkow@3413
    99
qed "wf_subset";
nipkow@3413
   100
nipkow@3413
   101
(*---------------------------------------------------------------------------
nipkow@3413
   102
 * Wellfoundedness of the empty relation.
nipkow@3413
   103
 *---------------------------------------------------------------------------*)
nipkow@3413
   104
wenzelm@5069
   105
Goal "wf({})";
wenzelm@4089
   106
by (simp_tac (simpset() addsimps [wf_def]) 1);
nipkow@3413
   107
qed "wf_empty";
nipkow@5281
   108
AddIffs [wf_empty];
nipkow@3413
   109
nipkow@3413
   110
(*---------------------------------------------------------------------------
nipkow@3413
   111
 * Wellfoundedness of `insert'
nipkow@3413
   112
 *---------------------------------------------------------------------------*)
nipkow@3413
   113
wenzelm@5069
   114
Goal "wf(insert (y,x) r) = (wf(r) & (x,y) ~: r^*)";
paulson@3457
   115
by (rtac iffI 1);
paulson@4350
   116
 by (blast_tac (claset() addEs [wf_trancl RS wf_irrefl] 
paulson@4350
   117
	addIs [rtrancl_into_trancl1,wf_subset,impOfSubs rtrancl_mono]) 1);
wenzelm@4089
   118
by (asm_full_simp_tac (simpset() addsimps [wf_eq_minimal]) 1);
paulson@4153
   119
by Safe_tac;
paulson@7249
   120
by (EVERY1[rtac allE, assume_tac, etac impE, Blast_tac]);
paulson@3457
   121
by (etac bexE 1);
paulson@3457
   122
by (rename_tac "a" 1);
paulson@3457
   123
by (case_tac "a = x" 1);
paulson@3457
   124
 by (res_inst_tac [("x","a")]bexI 2);
paulson@3457
   125
  by (assume_tac 3);
paulson@3457
   126
 by (Blast_tac 2);
paulson@3457
   127
by (case_tac "y:Q" 1);
paulson@3457
   128
 by (Blast_tac 2);
paulson@4059
   129
by (res_inst_tac [("x","{z. z:Q & (z,y) : r^*}")] allE 1);
paulson@3457
   130
 by (assume_tac 1);
paulson@4059
   131
by (thin_tac "! Q. (? x. x : Q) --> ?P Q" 1);	(*essential for speed*)
paulson@4350
   132
(*Blast_tac with new substOccur fails*)
paulson@4350
   133
by (best_tac (claset() addIs [rtrancl_into_rtrancl2]) 1);
nipkow@3413
   134
qed "wf_insert";
nipkow@3413
   135
AddIffs [wf_insert];
nipkow@3413
   136
nipkow@5281
   137
(*---------------------------------------------------------------------------
nipkow@5281
   138
 * Wellfoundedness of `disjoint union'
nipkow@5281
   139
 *---------------------------------------------------------------------------*)
nipkow@5281
   140
paulson@5330
   141
(*Intuition behind this proof for the case of binary union:
paulson@5330
   142
paulson@5330
   143
  Goal: find an (R u S)-min element of a nonempty subset A.
paulson@5330
   144
  by case distinction:
paulson@5330
   145
  1. There is a step a -R-> b with a,b : A.
paulson@5330
   146
     Pick an R-min element z of the (nonempty) set {a:A | EX b:A. a -R-> b}.
paulson@5330
   147
     By definition, there is z':A s.t. z -R-> z'. Because z is R-min in the
paulson@5330
   148
     subset, z' must be R-min in A. Because z' has an R-predecessor, it cannot
paulson@5330
   149
     have an S-successor and is thus S-min in A as well.
paulson@5330
   150
  2. There is no such step.
paulson@5330
   151
     Pick an S-min element of A. In this case it must be an R-min
paulson@5330
   152
     element of A as well.
paulson@5330
   153
paulson@5330
   154
*)
paulson@5330
   155
paulson@5316
   156
Goal "[| !i:I. wf(r i); \
paulson@5316
   157
\        !i:I.!j:I. r i ~= r j --> Domain(r i) Int Range(r j) = {} & \
paulson@5316
   158
\                                  Domain(r j) Int Range(r i) = {} \
paulson@5316
   159
\     |] ==> wf(UN i:I. r i)";
paulson@5318
   160
by (asm_full_simp_tac (HOL_basic_ss addsimps [wf_eq_minimal]) 1);
paulson@5318
   161
by (Clarify_tac 1);
paulson@5318
   162
by (rename_tac "A a" 1);
paulson@5318
   163
by (case_tac "? i:I. ? a:A. ? b:A. (b,a) : r i" 1);
paulson@5318
   164
 by (Clarify_tac 1);
paulson@7249
   165
 by (EVERY1[dtac bspec, assume_tac,
nipkow@5281
   166
           eres_inst_tac[("x","{a. a:A & (? b:A. (b,a) : r i)}")]allE]);
paulson@5318
   167
 by (EVERY1[etac allE,etac impE]);
paulson@5318
   168
  by (Blast_tac 1);
paulson@5318
   169
 by (Clarify_tac 1);
paulson@5318
   170
 by (rename_tac "z'" 1);
paulson@5318
   171
 by (res_inst_tac [("x","z'")] bexI 1);
paulson@5318
   172
  by (assume_tac 2);
paulson@5318
   173
 by (Clarify_tac 1);
paulson@5318
   174
 by (rename_tac "j" 1);
paulson@5318
   175
 by (case_tac "r j = r i" 1);
paulson@7249
   176
  by (EVERY1[etac allE,etac impE,assume_tac]);
paulson@5318
   177
  by (Asm_full_simp_tac 1);
paulson@5318
   178
  by (Blast_tac 1);
paulson@5318
   179
 by (blast_tac (claset() addEs [equalityE]) 1);
paulson@5318
   180
by (Asm_full_simp_tac 1);
oheimb@5521
   181
by (fast_tac (claset() delWrapper "bspec") 1); (*faster than Blast_tac*)
nipkow@5281
   182
qed "wf_UN";
nipkow@5281
   183
nipkow@5281
   184
Goalw [Union_def]
nipkow@5281
   185
 "[| !r:R. wf r; \
nipkow@5281
   186
\    !r:R.!s:R. r ~= s --> Domain r Int Range s = {} & \
nipkow@5281
   187
\                          Domain s Int Range r = {} \
nipkow@5281
   188
\ |] ==> wf(Union R)";
paulson@5318
   189
by (rtac wf_UN 1);
paulson@5318
   190
by (Blast_tac 1);
paulson@5318
   191
by (Blast_tac 1);
nipkow@5281
   192
qed "wf_Union";
nipkow@5281
   193
paulson@5316
   194
Goal "[| wf r; wf s; Domain r Int Range s = {}; Domain s Int Range r = {} \
paulson@5316
   195
\     |] ==> wf(r Un s)";
paulson@5318
   196
by (rtac (simplify (simpset()) (read_instantiate[("R","{r,s}")]wf_Union)) 1);
paulson@5318
   197
by (Blast_tac 1);
paulson@5318
   198
by (Blast_tac 1);
nipkow@5281
   199
qed "wf_Un";
nipkow@5281
   200
nipkow@5281
   201
(*---------------------------------------------------------------------------
nipkow@5281
   202
 * Wellfoundedness of `image'
nipkow@5281
   203
 *---------------------------------------------------------------------------*)
nipkow@5281
   204
nipkow@5281
   205
Goal "[| wf r; inj f |] ==> wf(prod_fun f f `` r)";
paulson@5318
   206
by (asm_full_simp_tac (HOL_basic_ss addsimps [wf_eq_minimal]) 1);
paulson@5318
   207
by (Clarify_tac 1);
paulson@5318
   208
by (case_tac "? p. f p : Q" 1);
paulson@5318
   209
by (eres_inst_tac [("x","{p. f p : Q}")]allE 1);
paulson@5318
   210
by (fast_tac (claset() addDs [injD]) 1);
paulson@5318
   211
by (Blast_tac 1);
nipkow@5281
   212
qed "wf_prod_fun_image";
nipkow@5281
   213
nipkow@3413
   214
(*** acyclic ***)
nipkow@3413
   215
paulson@7249
   216
Goalw [acyclic_def] "!x. (x, x) ~: r^+ ==> acyclic r";
paulson@7249
   217
by (assume_tac 1);
paulson@7249
   218
qed "acyclicI";
oheimb@4750
   219
paulson@7249
   220
Goalw [acyclic_def] "wf r ==> acyclic r";
wenzelm@4089
   221
by (blast_tac (claset() addEs [wf_trancl RS wf_irrefl]) 1);
nipkow@3413
   222
qed "wf_acyclic";
nipkow@3413
   223
paulson@5452
   224
Goalw [acyclic_def] "acyclic(insert (y,x) r) = (acyclic r & (x,y) ~: r^*)";
wenzelm@4089
   225
by (simp_tac (simpset() addsimps [trancl_insert]) 1);
paulson@5452
   226
by (blast_tac (claset() addIs [rtrancl_trans]) 1);
nipkow@3413
   227
qed "acyclic_insert";
nipkow@3413
   228
AddIffs [acyclic_insert];
nipkow@3413
   229
wenzelm@5069
   230
Goalw [acyclic_def] "acyclic(r^-1) = acyclic r";
paulson@4746
   231
by (simp_tac (simpset() addsimps [trancl_converse]) 1);
paulson@4746
   232
qed "acyclic_converse";
paulson@3198
   233
nipkow@6433
   234
Goalw [acyclic_def] "[| acyclic s; r <= s |] ==> acyclic r";
paulson@6814
   235
by (blast_tac (claset() addIs [trancl_mono]) 1);
nipkow@6433
   236
qed "acyclic_subset";
nipkow@6433
   237
clasohm@923
   238
(** cut **)
clasohm@923
   239
clasohm@923
   240
(*This rewrite rule works upon formulae; thus it requires explicit use of
clasohm@923
   241
  H_cong to expose the equality*)
paulson@7249
   242
Goalw [cut_def] "(cut f r x = cut g r x) = (!y. (y,x):r --> f(y)=g(y))";
nipkow@4686
   243
by (simp_tac (HOL_ss addsimps [expand_fun_eq]) 1);
clasohm@1475
   244
qed "cuts_eq";
clasohm@923
   245
paulson@5143
   246
Goalw [cut_def] "(x,a):r ==> (cut f r a)(x) = f(x)";
paulson@1552
   247
by (asm_simp_tac HOL_ss 1);
clasohm@923
   248
qed "cut_apply";
clasohm@923
   249
clasohm@923
   250
(*** is_recfun ***)
clasohm@923
   251
wenzelm@5069
   252
Goalw [is_recfun_def,cut_def]
paulson@5148
   253
    "[| is_recfun r H a f;  ~(b,a):r |] ==> f(b) = arbitrary";
clasohm@923
   254
by (etac ssubst 1);
paulson@1552
   255
by (asm_simp_tac HOL_ss 1);
clasohm@923
   256
qed "is_recfun_undef";
clasohm@923
   257
paulson@7249
   258
(*** NOTE! some simplifications need a different Solver!! ***)
clasohm@923
   259
fun indhyp_tac hyps =
clasohm@923
   260
    (cut_facts_tac hyps THEN'
clasohm@923
   261
       DEPTH_SOLVE_1 o (ares_tac [TrueI] ORELSE'
clasohm@1465
   262
                        eresolve_tac [transD, mp, allE]));
nipkow@7570
   263
val wf_super_ss = HOL_ss addSolver (mk_solver "WF" indhyp_tac);
clasohm@923
   264
paulson@5316
   265
Goalw [is_recfun_def,cut_def]
clasohm@1475
   266
    "[| wf(r);  trans(r);  is_recfun r H a f;  is_recfun r H b g |] ==> \
clasohm@972
   267
    \ (x,a):r --> (x,b):r --> f(x)=g(x)";
clasohm@923
   268
by (etac wf_induct 1);
clasohm@923
   269
by (REPEAT (rtac impI 1 ORELSE etac ssubst 1));
clasohm@923
   270
by (asm_simp_tac (wf_super_ss addcongs [if_cong]) 1);
nipkow@1485
   271
qed_spec_mp "is_recfun_equal";
clasohm@923
   272
clasohm@923
   273
clasohm@923
   274
val prems as [wfr,transr,recfa,recgb,_] = goalw WF.thy [cut_def]
clasohm@923
   275
    "[| wf(r);  trans(r); \
clasohm@1475
   276
\       is_recfun r H a f;  is_recfun r H b g;  (b,a):r |] ==> \
clasohm@923
   277
\    cut f r b = g";
clasohm@923
   278
val gundef = recgb RS is_recfun_undef
clasohm@923
   279
and fisg   = recgb RS (recfa RS (transr RS (wfr RS is_recfun_equal)));
clasohm@923
   280
by (cut_facts_tac prems 1);
clasohm@923
   281
by (rtac ext 1);
nipkow@4686
   282
by (asm_simp_tac (wf_super_ss addsimps [gundef,fisg]) 1);
clasohm@923
   283
qed "is_recfun_cut";
clasohm@923
   284
clasohm@923
   285
(*** Main Existence Lemma -- Basic Properties of the_recfun ***)
clasohm@923
   286
paulson@5316
   287
Goalw [the_recfun_def]
clasohm@1475
   288
    "is_recfun r H a f ==> is_recfun r H a (the_recfun r H a)";
paulson@5316
   289
by (eres_inst_tac [("P", "is_recfun r H a")] selectI 1);
clasohm@923
   290
qed "is_the_recfun";
clasohm@923
   291
paulson@5316
   292
Goal "[| wf(r);  trans(r) |] ==> is_recfun r H a (the_recfun r H a)";
paulson@5316
   293
by (wf_ind_tac "a" [] 1);
nipkow@4821
   294
by (res_inst_tac [("f","cut (%y. H (the_recfun r H y) y) r a1")]
nipkow@4821
   295
                 is_the_recfun 1);
nipkow@4821
   296
by (rewtac is_recfun_def);
nipkow@4821
   297
by (stac cuts_eq 1);
nipkow@4821
   298
by (Clarify_tac 1);
paulson@7249
   299
by (rtac H_cong2 1);
nipkow@4821
   300
by (subgoal_tac
clasohm@1475
   301
         "the_recfun r H y = cut(%x. H(cut(the_recfun r H y) r x) x) r y" 1);
paulson@7249
   302
 by (Blast_tac 2);
nipkow@4821
   303
by (etac ssubst 1);
nipkow@4821
   304
by (simp_tac (HOL_ss addsimps [cuts_eq]) 1);
nipkow@4821
   305
by (Clarify_tac 1);
nipkow@4821
   306
by (stac cut_apply 1);
wenzelm@5132
   307
 by (fast_tac (claset() addDs [transD]) 1);
nipkow@4821
   308
by (fold_tac [is_recfun_def]);
nipkow@4821
   309
by (asm_simp_tac (wf_super_ss addsimps[is_recfun_cut]) 1);
clasohm@923
   310
qed "unfold_the_recfun";
clasohm@923
   311
paulson@7249
   312
Goal "[| wf r; trans r; (x,a) : r; (x,b) : r |] \
paulson@7249
   313
\     ==> the_recfun r H a x = the_recfun r H b x";
paulson@7249
   314
by (best_tac (claset() addIs [is_recfun_equal, unfold_the_recfun]) 1);
paulson@7249
   315
qed "the_recfun_equal";
clasohm@923
   316
clasohm@923
   317
(** Removal of the premise trans(r) **)
clasohm@1475
   318
val th = rewrite_rule[is_recfun_def]
clasohm@1475
   319
                     (trans_trancl RSN (2,(wf_trancl RS unfold_the_recfun)));
clasohm@923
   320
wenzelm@5069
   321
Goalw [wfrec_def]
paulson@5148
   322
    "wf(r) ==> wfrec r H a = H (cut (wfrec r H) r a) a";
paulson@7249
   323
by (rtac H_cong2 1);
clasohm@1475
   324
by (simp_tac (HOL_ss addsimps [cuts_eq]) 1);
clasohm@1475
   325
by (rtac allI 1);
clasohm@1475
   326
by (rtac impI 1);
clasohm@1475
   327
by (res_inst_tac [("a1","a")] (th RS ssubst) 1);
paulson@7249
   328
by (assume_tac 1);
wenzelm@7499
   329
by (ftac wf_trancl 1);
wenzelm@7499
   330
by (ftac r_into_trancl 1);
clasohm@1475
   331
by (asm_simp_tac (HOL_ss addsimps [cut_apply]) 1);
paulson@7249
   332
by (rtac H_cong2 1);    (*expose the equality of cuts*)
clasohm@1475
   333
by (simp_tac (HOL_ss addsimps [cuts_eq, cut_apply, r_into_trancl]) 1);
paulson@7249
   334
by (blast_tac (claset() addIs [the_recfun_equal, transD, trans_trancl, 
paulson@7249
   335
			       r_into_trancl]) 1);
clasohm@1475
   336
qed "wfrec";
clasohm@1475
   337
clasohm@1475
   338
(*---------------------------------------------------------------------------
clasohm@1475
   339
 * This form avoids giant explosions in proofs.  NOTE USE OF == 
clasohm@1475
   340
 *---------------------------------------------------------------------------*)
paulson@5316
   341
val rew::prems = goal thy
clasohm@1475
   342
    "[| f==wfrec r H;  wf(r) |] ==> f(a) = H (cut f r a) a";
clasohm@923
   343
by (rewtac rew);
clasohm@923
   344
by (REPEAT (resolve_tac (prems@[wfrec]) 1));
clasohm@923
   345
qed "def_wfrec";
clasohm@1475
   346
paulson@3198
   347
paulson@3198
   348
(**** TFL variants ****)
paulson@3198
   349
paulson@5278
   350
Goal "!R. wf R --> (!P. (!x. (!y. (y,x):R --> P y) --> P x) --> (!x. P x))";
paulson@3708
   351
by (Clarify_tac 1);
paulson@3198
   352
by (res_inst_tac [("r","R"),("P","P"), ("a","x")] wf_induct 1);
paulson@3198
   353
by (assume_tac 1);
paulson@3198
   354
by (Blast_tac 1);
paulson@3198
   355
qed"tfl_wf_induct";
paulson@3198
   356
wenzelm@5069
   357
Goal "!f R. (x,a):R --> (cut f R a)(x) = f(x)";
paulson@3708
   358
by (Clarify_tac 1);
paulson@3198
   359
by (rtac cut_apply 1);
paulson@3198
   360
by (assume_tac 1);
paulson@3198
   361
qed"tfl_cut_apply";
paulson@3198
   362
wenzelm@5069
   363
Goal "!M R f. (f=wfrec R M) --> wf R --> (!x. f x = M (cut f R x) x)";
paulson@3708
   364
by (Clarify_tac 1);
paulson@4153
   365
by (etac wfrec 1);
paulson@3198
   366
qed "tfl_wfrec";