src/HOL/TLA/Intensional.thy
author wenzelm
Fri Jun 26 18:51:19 2015 +0200 (2015-06-26)
changeset 60592 c9bd1d902f04
parent 60591 e0b77517f9a9
child 61853 fb7756087101
permissions -rw-r--r--
isabelle update_cartouches;
wenzelm@35108
     1
(*  Title:      HOL/TLA/Intensional.thy
wenzelm@35108
     2
    Author:     Stephan Merz
wenzelm@35108
     3
    Copyright:  1998 University of Munich
wenzelm@21624
     4
*)
wenzelm@3807
     5
wenzelm@60592
     6
section \<open>A framework for "intensional" (possible-world based) logics
wenzelm@60592
     7
  on top of HOL, with lifting of constants and functions\<close>
wenzelm@3807
     8
wenzelm@17309
     9
theory Intensional
wenzelm@17309
    10
imports Main
wenzelm@17309
    11
begin
wenzelm@3807
    12
wenzelm@55382
    13
class world
wenzelm@6255
    14
wenzelm@6255
    15
(** abstract syntax **)
wenzelm@3807
    16
wenzelm@60588
    17
type_synonym ('w,'a) expr = "'w \<Rightarrow> 'a"   (* intention: 'w::world, 'a::type *)
wenzelm@42018
    18
type_synonym 'w form = "('w, bool) expr"
wenzelm@3807
    19
wenzelm@3807
    20
consts
wenzelm@60588
    21
  Valid    :: "('w::world) form \<Rightarrow> bool"
wenzelm@60588
    22
  const    :: "'a \<Rightarrow> ('w::world, 'a) expr"
wenzelm@60588
    23
  lift     :: "['a \<Rightarrow> 'b, ('w::world, 'a) expr] \<Rightarrow> ('w,'b) expr"
wenzelm@60588
    24
  lift2    :: "['a \<Rightarrow> 'b \<Rightarrow> 'c, ('w::world,'a) expr, ('w,'b) expr] \<Rightarrow> ('w,'c) expr"
wenzelm@60588
    25
  lift3    :: "['a \<Rightarrow> 'b \<Rightarrow> 'c \<Rightarrow> 'd, ('w::world,'a) expr, ('w,'b) expr, ('w,'c) expr] \<Rightarrow> ('w,'d) expr"
wenzelm@3807
    26
wenzelm@6255
    27
  (* "Rigid" quantification (logic level) *)
wenzelm@60588
    28
  RAll     :: "('a \<Rightarrow> ('w::world) form) \<Rightarrow> 'w form"       (binder "Rall " 10)
wenzelm@60588
    29
  REx      :: "('a \<Rightarrow> ('w::world) form) \<Rightarrow> 'w form"       (binder "Rex " 10)
wenzelm@60588
    30
  REx1     :: "('a \<Rightarrow> ('w::world) form) \<Rightarrow> 'w form"       (binder "Rex! " 10)
wenzelm@3807
    31
wenzelm@6255
    32
(** concrete syntax **)
wenzelm@3807
    33
wenzelm@41229
    34
nonterminal lift and liftargs
wenzelm@3807
    35
wenzelm@3807
    36
syntax
wenzelm@60588
    37
  ""            :: "id \<Rightarrow> lift"                          ("_")
wenzelm@60588
    38
  ""            :: "longid \<Rightarrow> lift"                      ("_")
wenzelm@60588
    39
  ""            :: "var \<Rightarrow> lift"                         ("_")
wenzelm@60588
    40
  "_applC"      :: "[lift, cargs] \<Rightarrow> lift"               ("(1_/ _)" [1000, 1000] 999)
wenzelm@60588
    41
  ""            :: "lift \<Rightarrow> lift"                        ("'(_')")
wenzelm@60588
    42
  "_lambda"     :: "[idts, 'a] \<Rightarrow> lift"                  ("(3\<lambda>_./ _)" [0, 3] 3)
wenzelm@60588
    43
  "_constrain"  :: "[lift, type] \<Rightarrow> lift"                ("(_::_)" [4, 0] 3)
wenzelm@60588
    44
  ""            :: "lift \<Rightarrow> liftargs"                    ("_")
wenzelm@60588
    45
  "_liftargs"   :: "[lift, liftargs] \<Rightarrow> liftargs"        ("_,/ _")
wenzelm@60591
    46
  "_Valid"      :: "lift \<Rightarrow> bool"                        ("(\<turnstile> _)" 5)
wenzelm@60591
    47
  "_holdsAt"    :: "['a, lift] \<Rightarrow> bool"                  ("(_ \<Turnstile> _)" [100,10] 10)
wenzelm@6255
    48
wenzelm@60588
    49
  (* Syntax for lifted expressions outside the scope of \<turnstile> or |= *)
wenzelm@60588
    50
  "_LIFT"       :: "lift \<Rightarrow> 'a"                          ("LIFT _")
wenzelm@6255
    51
wenzelm@6255
    52
  (* generic syntax for lifted constants and functions *)
wenzelm@60588
    53
  "_const"      :: "'a \<Rightarrow> lift"                          ("(#_)" [1000] 999)
wenzelm@60588
    54
  "_lift"       :: "['a, lift] \<Rightarrow> lift"                  ("(_<_>)" [1000] 999)
wenzelm@60588
    55
  "_lift2"      :: "['a, lift, lift] \<Rightarrow> lift"            ("(_<_,/ _>)" [1000] 999)
wenzelm@60588
    56
  "_lift3"      :: "['a, lift, lift, lift] \<Rightarrow> lift"      ("(_<_,/ _,/ _>)" [1000] 999)
wenzelm@6255
    57
wenzelm@6255
    58
  (* concrete syntax for common infix functions: reuse same symbol *)
wenzelm@60588
    59
  "_liftEqu"    :: "[lift, lift] \<Rightarrow> lift"                ("(_ =/ _)" [50,51] 50)
wenzelm@60591
    60
  "_liftNeq"    :: "[lift, lift] \<Rightarrow> lift"                ("(_ \<noteq>/ _)" [50,51] 50)
wenzelm@60591
    61
  "_liftNot"    :: "lift \<Rightarrow> lift"                        ("(\<not> _)" [40] 40)
wenzelm@60591
    62
  "_liftAnd"    :: "[lift, lift] \<Rightarrow> lift"                ("(_ \<and>/ _)" [36,35] 35)
wenzelm@60591
    63
  "_liftOr"     :: "[lift, lift] \<Rightarrow> lift"                ("(_ \<or>/ _)" [31,30] 30)
wenzelm@60591
    64
  "_liftImp"    :: "[lift, lift] \<Rightarrow> lift"                ("(_ \<longrightarrow>/ _)" [26,25] 25)
wenzelm@60588
    65
  "_liftIf"     :: "[lift, lift, lift] \<Rightarrow> lift"          ("(if (_)/ then (_)/ else (_))" 10)
wenzelm@60588
    66
  "_liftPlus"   :: "[lift, lift] \<Rightarrow> lift"                ("(_ +/ _)" [66,65] 65)
wenzelm@60588
    67
  "_liftMinus"  :: "[lift, lift] \<Rightarrow> lift"                ("(_ -/ _)" [66,65] 65)
wenzelm@60588
    68
  "_liftTimes"  :: "[lift, lift] \<Rightarrow> lift"                ("(_ */ _)" [71,70] 70)
wenzelm@60588
    69
  "_liftDiv"    :: "[lift, lift] \<Rightarrow> lift"                ("(_ div _)" [71,70] 70)
wenzelm@60588
    70
  "_liftMod"    :: "[lift, lift] \<Rightarrow> lift"                ("(_ mod _)" [71,70] 70)
wenzelm@60588
    71
  "_liftLess"   :: "[lift, lift] \<Rightarrow> lift"                ("(_/ < _)"  [50, 51] 50)
wenzelm@60591
    72
  "_liftLeq"    :: "[lift, lift] \<Rightarrow> lift"                ("(_/ \<le> _)" [50, 51] 50)
wenzelm@60591
    73
  "_liftMem"    :: "[lift, lift] \<Rightarrow> lift"                ("(_/ \<in> _)" [50, 51] 50)
wenzelm@60591
    74
  "_liftNotMem" :: "[lift, lift] \<Rightarrow> lift"                ("(_/ \<notin> _)" [50, 51] 50)
wenzelm@60588
    75
  "_liftFinset" :: "liftargs \<Rightarrow> lift"                    ("{(_)}")
wenzelm@6255
    76
  (** TODO: syntax for lifted collection / comprehension **)
wenzelm@60588
    77
  "_liftPair"   :: "[lift,liftargs] \<Rightarrow> lift"                   ("(1'(_,/ _'))")
wenzelm@6255
    78
  (* infix syntax for list operations *)
wenzelm@60588
    79
  "_liftCons" :: "[lift, lift] \<Rightarrow> lift"                  ("(_ #/ _)" [65,66] 65)
wenzelm@60588
    80
  "_liftApp"  :: "[lift, lift] \<Rightarrow> lift"                  ("(_ @/ _)" [65,66] 65)
wenzelm@60588
    81
  "_liftList" :: "liftargs \<Rightarrow> lift"                      ("[(_)]")
wenzelm@6255
    82
wenzelm@6255
    83
  (* Rigid quantification (syntax level) *)
wenzelm@60591
    84
  "_RAll" :: "[idts, lift] \<Rightarrow> lift"                      ("(3\<forall>_./ _)" [0, 10] 10)
wenzelm@60591
    85
  "_REx"  :: "[idts, lift] \<Rightarrow> lift"                      ("(3\<exists>_./ _)" [0, 10] 10)
wenzelm@60591
    86
  "_REx1" :: "[idts, lift] \<Rightarrow> lift"                      ("(3\<exists>!_./ _)" [0, 10] 10)
wenzelm@3807
    87
wenzelm@3807
    88
translations
wenzelm@35108
    89
  "_const"        == "CONST const"
wenzelm@35108
    90
  "_lift"         == "CONST lift"
wenzelm@35108
    91
  "_lift2"        == "CONST lift2"
wenzelm@35108
    92
  "_lift3"        == "CONST lift3"
wenzelm@35108
    93
  "_Valid"        == "CONST Valid"
wenzelm@6255
    94
  "_RAll x A"     == "Rall x. A"
wenzelm@6255
    95
  "_REx x  A"     == "Rex x. A"
wenzelm@6255
    96
  "_REx1 x  A"    == "Rex! x. A"
wenzelm@3807
    97
wenzelm@60591
    98
  "w \<Turnstile> A"        => "A w"
wenzelm@60591
    99
  "LIFT A"        => "A::_\<Rightarrow>_"
wenzelm@3807
   100
wenzelm@6255
   101
  "_liftEqu"      == "_lift2 (op =)"
wenzelm@6255
   102
  "_liftNeq u v"  == "_liftNot (_liftEqu u v)"
wenzelm@35108
   103
  "_liftNot"      == "_lift (CONST Not)"
wenzelm@60591
   104
  "_liftAnd"      == "_lift2 (op \<and>)"
wenzelm@60591
   105
  "_liftOr"       == "_lift2 (op \<or>)"
wenzelm@60591
   106
  "_liftImp"      == "_lift2 (op \<longrightarrow>)"
wenzelm@35108
   107
  "_liftIf"       == "_lift3 (CONST If)"
wenzelm@6255
   108
  "_liftPlus"     == "_lift2 (op +)"
wenzelm@6255
   109
  "_liftMinus"    == "_lift2 (op -)"
wenzelm@6255
   110
  "_liftTimes"    == "_lift2 (op *)"
wenzelm@6255
   111
  "_liftDiv"      == "_lift2 (op div)"
wenzelm@6255
   112
  "_liftMod"      == "_lift2 (op mod)"
wenzelm@6255
   113
  "_liftLess"     == "_lift2 (op <)"
wenzelm@60591
   114
  "_liftLeq"      == "_lift2 (op \<le>)"
wenzelm@60591
   115
  "_liftMem"      == "_lift2 (op \<in>)"
wenzelm@6255
   116
  "_liftNotMem x xs"   == "_liftNot (_liftMem x xs)"
wenzelm@35108
   117
  "_liftFinset (_liftargs x xs)"  == "_lift2 (CONST insert) x (_liftFinset xs)"
wenzelm@35108
   118
  "_liftFinset x" == "_lift2 (CONST insert) x (_const {})"
wenzelm@6255
   119
  "_liftPair x (_liftargs y z)"       == "_liftPair x (_liftPair y z)"
wenzelm@35108
   120
  "_liftPair"     == "_lift2 (CONST Pair)"
wenzelm@35108
   121
  "_liftCons"     == "CONST lift2 (CONST Cons)"
wenzelm@35108
   122
  "_liftApp"      == "CONST lift2 (op @)"
wenzelm@6255
   123
  "_liftList (_liftargs x xs)"  == "_liftCons x (_liftList xs)"
wenzelm@6255
   124
  "_liftList x"   == "_liftCons x (_const [])"
wenzelm@3807
   125
wenzelm@17309
   126
wenzelm@3807
   127
wenzelm@60591
   128
  "w \<Turnstile> \<not>A"       <= "_liftNot A w"
wenzelm@60591
   129
  "w \<Turnstile> A \<and> B"    <= "_liftAnd A B w"
wenzelm@60591
   130
  "w \<Turnstile> A \<or> B"    <= "_liftOr A B w"
wenzelm@60591
   131
  "w \<Turnstile> A \<longrightarrow> B"  <= "_liftImp A B w"
wenzelm@60591
   132
  "w \<Turnstile> u = v"    <= "_liftEqu u v w"
wenzelm@60591
   133
  "w \<Turnstile> \<forall>x. A"   <= "_RAll x A w"
wenzelm@60591
   134
  "w \<Turnstile> \<exists>x. A"   <= "_REx x A w"
wenzelm@60591
   135
  "w \<Turnstile> \<exists>!x. A"  <= "_REx1 x A w"
wenzelm@3808
   136
haftmann@35318
   137
defs
wenzelm@60588
   138
  Valid_def:   "\<turnstile> A    ==  \<forall>w. w \<Turnstile> A"
wenzelm@17309
   139
wenzelm@17309
   140
  unl_con:     "LIFT #c w  ==  c"
berghofe@21020
   141
  unl_lift:    "lift f x w == f (x w)"
wenzelm@17309
   142
  unl_lift2:   "LIFT f<x, y> w == f (x w) (y w)"
wenzelm@17309
   143
  unl_lift3:   "LIFT f<x, y, z> w == f (x w) (y w) (z w)"
wenzelm@3807
   144
wenzelm@60588
   145
  unl_Rall:    "w \<Turnstile> \<forall>x. A x  ==  \<forall>x. (w \<Turnstile> A x)"
wenzelm@60591
   146
  unl_Rex:     "w \<Turnstile> \<exists>x. A x   ==  \<exists>x. (w \<Turnstile> A x)"
wenzelm@60588
   147
  unl_Rex1:    "w \<Turnstile> \<exists>!x. A x  ==  \<exists>!x. (w \<Turnstile> A x)"
wenzelm@3807
   148
wenzelm@21624
   149
wenzelm@60592
   150
subsection \<open>Lemmas and tactics for "intensional" logics.\<close>
wenzelm@21624
   151
wenzelm@21624
   152
lemmas intensional_rews [simp] =
wenzelm@21624
   153
  unl_con unl_lift unl_lift2 unl_lift3 unl_Rall unl_Rex unl_Rex1
wenzelm@21624
   154
wenzelm@60588
   155
lemma inteq_reflection: "\<turnstile> x=y  \<Longrightarrow>  (x==y)"
wenzelm@21624
   156
  apply (unfold Valid_def unl_lift2)
wenzelm@21624
   157
  apply (rule eq_reflection)
wenzelm@21624
   158
  apply (rule ext)
wenzelm@21624
   159
  apply (erule spec)
wenzelm@21624
   160
  done
wenzelm@21624
   161
wenzelm@60588
   162
lemma intI [intro!]: "(\<And>w. w \<Turnstile> A) \<Longrightarrow> \<turnstile> A"
wenzelm@21624
   163
  apply (unfold Valid_def)
wenzelm@21624
   164
  apply (rule allI)
wenzelm@21624
   165
  apply (erule meta_spec)
wenzelm@21624
   166
  done
wenzelm@21624
   167
wenzelm@60588
   168
lemma intD [dest]: "\<turnstile> A \<Longrightarrow> w \<Turnstile> A"
wenzelm@21624
   169
  apply (unfold Valid_def)
wenzelm@21624
   170
  apply (erule spec)
wenzelm@21624
   171
  done
wenzelm@21624
   172
wenzelm@21624
   173
(** Lift usual HOL simplifications to "intensional" level. **)
wenzelm@21624
   174
wenzelm@21624
   175
lemma int_simps:
wenzelm@60588
   176
  "\<turnstile> (x=x) = #True"
wenzelm@60588
   177
  "\<turnstile> (\<not>#True) = #False"  "\<turnstile> (\<not>#False) = #True"  "\<turnstile> (\<not>\<not> P) = P"
wenzelm@60588
   178
  "\<turnstile> ((\<not>P) = P) = #False"  "\<turnstile> (P = (\<not>P)) = #False"
wenzelm@60588
   179
  "\<turnstile> (P \<noteq> Q) = (P = (\<not>Q))"
wenzelm@60588
   180
  "\<turnstile> (#True=P) = P"  "\<turnstile> (P=#True) = P"
wenzelm@60588
   181
  "\<turnstile> (#True \<longrightarrow> P) = P"  "\<turnstile> (#False \<longrightarrow> P) = #True"
wenzelm@60588
   182
  "\<turnstile> (P \<longrightarrow> #True) = #True"  "\<turnstile> (P \<longrightarrow> P) = #True"
wenzelm@60588
   183
  "\<turnstile> (P \<longrightarrow> #False) = (\<not>P)"  "\<turnstile> (P \<longrightarrow> \<not>P) = (\<not>P)"
wenzelm@60591
   184
  "\<turnstile> (P \<and> #True) = P"  "\<turnstile> (#True \<and> P) = P"
wenzelm@60591
   185
  "\<turnstile> (P \<and> #False) = #False"  "\<turnstile> (#False \<and> P) = #False"
wenzelm@60591
   186
  "\<turnstile> (P \<and> P) = P"  "\<turnstile> (P \<and> \<not>P) = #False"  "\<turnstile> (\<not>P \<and> P) = #False"
wenzelm@60591
   187
  "\<turnstile> (P \<or> #True) = #True"  "\<turnstile> (#True \<or> P) = #True"
wenzelm@60591
   188
  "\<turnstile> (P \<or> #False) = P"  "\<turnstile> (#False \<or> P) = P"
wenzelm@60591
   189
  "\<turnstile> (P \<or> P) = P"  "\<turnstile> (P \<or> \<not>P) = #True"  "\<turnstile> (\<not>P \<or> P) = #True"
wenzelm@60588
   190
  "\<turnstile> (\<forall>x. P) = P"  "\<turnstile> (\<exists>x. P) = P"
wenzelm@60588
   191
  "\<turnstile> (\<not>Q \<longrightarrow> \<not>P) = (P \<longrightarrow> Q)"
wenzelm@60591
   192
  "\<turnstile> (P\<or>Q \<longrightarrow> R) = ((P\<longrightarrow>R)\<and>(Q\<longrightarrow>R))"
wenzelm@21624
   193
  apply (unfold Valid_def intensional_rews)
wenzelm@21624
   194
  apply blast+
wenzelm@21624
   195
  done
wenzelm@21624
   196
wenzelm@21624
   197
declare int_simps [THEN inteq_reflection, simp]
wenzelm@21624
   198
wenzelm@60588
   199
lemma TrueW [simp]: "\<turnstile> #True"
wenzelm@21624
   200
  by (simp add: Valid_def unl_con)
wenzelm@21624
   201
wenzelm@21624
   202
wenzelm@21624
   203
wenzelm@21624
   204
(* ======== Functions to "unlift" intensional implications into HOL rules ====== *)
wenzelm@21624
   205
wenzelm@60592
   206
ML \<open>
wenzelm@21624
   207
(* Basic unlifting introduces a parameter "w" and applies basic rewrites, e.g.
wenzelm@60588
   208
   \<turnstile> F = G    becomes   F w = G w
wenzelm@60588
   209
   \<turnstile> F \<longrightarrow> G  becomes   F w \<longrightarrow> G w
wenzelm@21624
   210
*)
wenzelm@21624
   211
wenzelm@54742
   212
fun int_unlift ctxt th =
wenzelm@54742
   213
  rewrite_rule ctxt @{thms intensional_rews} (th RS @{thm intD} handle THM _ => th);
wenzelm@21624
   214
wenzelm@60588
   215
(* Turn  \<turnstile> F = G  into meta-level rewrite rule  F == G *)
wenzelm@54742
   216
fun int_rewrite ctxt th =
wenzelm@54742
   217
  zero_var_indexes (rewrite_rule ctxt @{thms intensional_rews} (th RS @{thm inteq_reflection}))
wenzelm@21624
   218
wenzelm@60588
   219
(* flattening turns "\<longrightarrow>" into "\<Longrightarrow>" and eliminates conjunctions in the
wenzelm@21624
   220
   antecedent. For example,
wenzelm@21624
   221
wenzelm@60588
   222
         P & Q \<longrightarrow> (R | S \<longrightarrow> T)    becomes   \<lbrakk> P; Q; R | S \<rbrakk> \<Longrightarrow> T
wenzelm@21624
   223
wenzelm@21624
   224
   Flattening can be useful with "intensional" lemmas (after unlifting).
wenzelm@21624
   225
   Naive resolution with mp and conjI may run away because of higher-order
wenzelm@21624
   226
   unification, therefore the code is a little awkward.
wenzelm@21624
   227
*)
wenzelm@21624
   228
fun flatten t =
wenzelm@21624
   229
  let
wenzelm@21624
   230
    (* analogous to RS, but using matching instead of resolution *)
wenzelm@21624
   231
    fun matchres tha i thb =
wenzelm@58950
   232
      case Seq.chop 2 (Thm.biresolution NONE true [(false,tha)] i thb) of
wenzelm@21624
   233
          ([th],_) => th
wenzelm@21624
   234
        | ([],_)   => raise THM("matchres: no match", i, [tha,thb])
wenzelm@21624
   235
        |      _   => raise THM("matchres: multiple unifiers", i, [tha,thb])
wenzelm@21624
   236
wenzelm@21624
   237
    (* match tha with some premise of thb *)
wenzelm@21624
   238
    fun matchsome tha thb =
wenzelm@21624
   239
      let fun hmatch 0 = raise THM("matchsome: no match", 0, [tha,thb])
wenzelm@21624
   240
            | hmatch n = matchres tha n thb handle THM _ => hmatch (n-1)
wenzelm@59582
   241
      in hmatch (Thm.nprems_of thb) end
wenzelm@21624
   242
wenzelm@21624
   243
    fun hflatten t =
wenzelm@59582
   244
      case Thm.concl_of t of
wenzelm@59582
   245
        Const _ $ (Const (@{const_name HOL.implies}, _) $ _ $ _) => hflatten (t RS mp)
wenzelm@59582
   246
      | _ => (hflatten (matchsome conjI t)) handle THM _ => zero_var_indexes t
wenzelm@21624
   247
  in
wenzelm@21624
   248
    hflatten t
wenzelm@21624
   249
  end
wenzelm@21624
   250
wenzelm@54742
   251
fun int_use ctxt th =
wenzelm@59582
   252
    case Thm.concl_of th of
wenzelm@56256
   253
      Const _ $ (Const (@{const_name Valid}, _) $ _) =>
wenzelm@54742
   254
              (flatten (int_unlift ctxt th) handle THM _ => th)
wenzelm@21624
   255
    | _ => th
wenzelm@60592
   256
\<close>
wenzelm@21624
   257
wenzelm@54742
   258
attribute_setup int_unlift =
wenzelm@60592
   259
  \<open>Scan.succeed (Thm.rule_attribute (int_unlift o Context.proof_of))\<close>
wenzelm@54742
   260
attribute_setup int_rewrite =
wenzelm@60592
   261
  \<open>Scan.succeed (Thm.rule_attribute (int_rewrite o Context.proof_of))\<close>
wenzelm@60592
   262
attribute_setup flatten = \<open>Scan.succeed (Thm.rule_attribute (K flatten))\<close>
wenzelm@54742
   263
attribute_setup int_use =
wenzelm@60592
   264
  \<open>Scan.succeed (Thm.rule_attribute (int_use o Context.proof_of))\<close>
wenzelm@21624
   265
wenzelm@60588
   266
lemma Not_Rall: "\<turnstile> (\<not>(\<forall>x. F x)) = (\<exists>x. \<not>F x)"
wenzelm@21624
   267
  by (simp add: Valid_def)
wenzelm@21624
   268
wenzelm@60588
   269
lemma Not_Rex: "\<turnstile> (\<not> (\<exists>x. F x)) = (\<forall>x. \<not> F x)"
wenzelm@21624
   270
  by (simp add: Valid_def)
wenzelm@21624
   271
wenzelm@21624
   272
end