src/Doc/IsarImplementation/Logic.thy
 changeset 48985 5386df44a037 parent 48938 d468d72a458f child 50126 3dec88149176
     1.1 --- /dev/null	Thu Jan 01 00:00:00 1970 +0000
1.2 +++ b/src/Doc/IsarImplementation/Logic.thy	Tue Aug 28 18:57:32 2012 +0200
1.3 @@ -0,0 +1,1137 @@
1.4 +theory Logic
1.5 +imports Base
1.6 +begin
1.7 +
1.8 +chapter {* Primitive logic \label{ch:logic} *}
1.9 +
1.10 +text {*
1.11 +  The logical foundations of Isabelle/Isar are that of the Pure logic,
1.12 +  which has been introduced as a Natural Deduction framework in
1.13 +  \cite{paulson700}.  This is essentially the same logic as @{text
1.14 +  "\<lambda>HOL"}'' in the more abstract setting of Pure Type Systems (PTS)
1.15 +  \cite{Barendregt-Geuvers:2001}, although there are some key
1.16 +  differences in the specific treatment of simple types in
1.17 +  Isabelle/Pure.
1.18 +
1.19 +  Following type-theoretic parlance, the Pure logic consists of three
1.20 +  levels of @{text "\<lambda>"}-calculus with corresponding arrows, @{text
1.21 +  "\<Rightarrow>"} for syntactic function space (terms depending on terms), @{text
1.22 +  "\<And>"} for universal quantification (proofs depending on terms), and
1.23 +  @{text "\<Longrightarrow>"} for implication (proofs depending on proofs).
1.24 +
1.25 +  Derivations are relative to a logical theory, which declares type
1.26 +  constructors, constants, and axioms.  Theory declarations support
1.27 +  schematic polymorphism, which is strictly speaking outside the
1.28 +  logic.\footnote{This is the deeper logical reason, why the theory
1.29 +  context @{text "\<Theta>"} is separate from the proof context @{text "\<Gamma>"}
1.30 +  of the core calculus: type constructors, term constants, and facts
1.31 +  (proof constants) may involve arbitrary type schemes, but the type
1.32 +  of a locally fixed term parameter is also fixed!}
1.33 +*}
1.34 +
1.35 +
1.36 +section {* Types \label{sec:types} *}
1.37 +
1.38 +text {*
1.39 +  The language of types is an uninterpreted order-sorted first-order
1.40 +  algebra; types are qualified by ordered type classes.
1.41 +
1.42 +  \medskip A \emph{type class} is an abstract syntactic entity
1.43 +  declared in the theory context.  The \emph{subclass relation} @{text
1.44 +  "c\<^isub>1 \<subseteq> c\<^isub>2"} is specified by stating an acyclic
1.45 +  generating relation; the transitive closure is maintained
1.46 +  internally.  The resulting relation is an ordering: reflexive,
1.47 +  transitive, and antisymmetric.
1.48 +
1.49 +  A \emph{sort} is a list of type classes written as @{text "s = {c\<^isub>1,
1.50 +  \<dots>, c\<^isub>m}"}, it represents symbolic intersection.  Notationally, the
1.51 +  curly braces are omitted for singleton intersections, i.e.\ any
1.52 +  class @{text "c"} may be read as a sort @{text "{c}"}.  The ordering
1.53 +  on type classes is extended to sorts according to the meaning of
1.54 +  intersections: @{text "{c\<^isub>1, \<dots> c\<^isub>m} \<subseteq> {d\<^isub>1, \<dots>, d\<^isub>n}"} iff @{text
1.55 +  "\<forall>j. \<exists>i. c\<^isub>i \<subseteq> d\<^isub>j"}.  The empty intersection @{text "{}"} refers to
1.56 +  the universal sort, which is the largest element wrt.\ the sort
1.57 +  order.  Thus @{text "{}"} represents the full sort'', not the
1.58 +  empty one!  The intersection of all (finitely many) classes declared
1.59 +  in the current theory is the least element wrt.\ the sort ordering.
1.60 +
1.61 +  \medskip A \emph{fixed type variable} is a pair of a basic name
1.62 +  (starting with a @{text "'"} character) and a sort constraint, e.g.\
1.63 +  @{text "('a, s)"} which is usually printed as @{text "\<alpha>\<^isub>s"}.
1.64 +  A \emph{schematic type variable} is a pair of an indexname and a
1.65 +  sort constraint, e.g.\ @{text "(('a, 0), s)"} which is usually
1.66 +  printed as @{text "?\<alpha>\<^isub>s"}.
1.67 +
1.68 +  Note that \emph{all} syntactic components contribute to the identity
1.69 +  of type variables: basic name, index, and sort constraint.  The core
1.70 +  logic handles type variables with the same name but different sorts
1.71 +  as different, although the type-inference layer (which is outside
1.72 +  the core) rejects anything like that.
1.73 +
1.74 +  A \emph{type constructor} @{text "\<kappa>"} is a @{text "k"}-ary operator
1.75 +  on types declared in the theory.  Type constructor application is
1.76 +  written postfix as @{text "(\<alpha>\<^isub>1, \<dots>, \<alpha>\<^isub>k)\<kappa>"}.  For
1.77 +  @{text "k = 0"} the argument tuple is omitted, e.g.\ @{text "prop"}
1.78 +  instead of @{text "()prop"}.  For @{text "k = 1"} the parentheses
1.79 +  are omitted, e.g.\ @{text "\<alpha> list"} instead of @{text "(\<alpha>)list"}.
1.80 +  Further notation is provided for specific constructors, notably the
1.81 +  right-associative infix @{text "\<alpha> \<Rightarrow> \<beta>"} instead of @{text "(\<alpha>,
1.82 +  \<beta>)fun"}.
1.83 +
1.84 +  The logical category \emph{type} is defined inductively over type
1.85 +  variables and type constructors as follows: @{text "\<tau> = \<alpha>\<^isub>s | ?\<alpha>\<^isub>s |
1.86 +  (\<tau>\<^sub>1, \<dots>, \<tau>\<^sub>k)\<kappa>"}.
1.87 +
1.88 +  A \emph{type abbreviation} is a syntactic definition @{text
1.89 +  "(\<^vec>\<alpha>)\<kappa> = \<tau>"} of an arbitrary type expression @{text "\<tau>"} over
1.90 +  variables @{text "\<^vec>\<alpha>"}.  Type abbreviations appear as type
1.91 +  constructors in the syntax, but are expanded before entering the
1.92 +  logical core.
1.93 +
1.94 +  A \emph{type arity} declares the image behavior of a type
1.95 +  constructor wrt.\ the algebra of sorts: @{text "\<kappa> :: (s\<^isub>1, \<dots>,
1.96 +  s\<^isub>k)s"} means that @{text "(\<tau>\<^isub>1, \<dots>, \<tau>\<^isub>k)\<kappa>"} is
1.97 +  of sort @{text "s"} if every argument type @{text "\<tau>\<^isub>i"} is
1.98 +  of sort @{text "s\<^isub>i"}.  Arity declarations are implicitly
1.99 +  completed, i.e.\ @{text "\<kappa> :: (\<^vec>s)c"} entails @{text "\<kappa> ::
1.100 +  (\<^vec>s)c'"} for any @{text "c' \<supseteq> c"}.
1.101 +
1.102 +  \medskip The sort algebra is always maintained as \emph{coregular},
1.103 +  which means that type arities are consistent with the subclass
1.104 +  relation: for any type constructor @{text "\<kappa>"}, and classes @{text
1.105 +  "c\<^isub>1 \<subseteq> c\<^isub>2"}, and arities @{text "\<kappa> ::
1.106 +  (\<^vec>s\<^isub>1)c\<^isub>1"} and @{text "\<kappa> ::
1.107 +  (\<^vec>s\<^isub>2)c\<^isub>2"} holds @{text "\<^vec>s\<^isub>1 \<subseteq>
1.108 +  \<^vec>s\<^isub>2"} component-wise.
1.109 +
1.110 +  The key property of a coregular order-sorted algebra is that sort
1.111 +  constraints can be solved in a most general fashion: for each type
1.112 +  constructor @{text "\<kappa>"} and sort @{text "s"} there is a most general
1.113 +  vector of argument sorts @{text "(s\<^isub>1, \<dots>, s\<^isub>k)"} such
1.114 +  that a type scheme @{text "(\<alpha>\<^bsub>s\<^isub>1\<^esub>, \<dots>,
1.115 +  \<alpha>\<^bsub>s\<^isub>k\<^esub>)\<kappa>"} is of sort @{text "s"}.
1.116 +  Consequently, type unification has most general solutions (modulo
1.117 +  equivalence of sorts), so type-inference produces primary types as
1.118 +  expected \cite{nipkow-prehofer}.
1.119 +*}
1.120 +
1.121 +text %mlref {*
1.122 +  \begin{mldecls}
1.123 +  @{index_ML_type class: string} \\
1.124 +  @{index_ML_type sort: "class list"} \\
1.125 +  @{index_ML_type arity: "string * sort list * sort"} \\
1.126 +  @{index_ML_type typ} \\
1.127 +  @{index_ML Term.map_atyps: "(typ -> typ) -> typ -> typ"} \\
1.128 +  @{index_ML Term.fold_atyps: "(typ -> 'a -> 'a) -> typ -> 'a -> 'a"} \\
1.129 +  \end{mldecls}
1.130 +  \begin{mldecls}
1.131 +  @{index_ML Sign.subsort: "theory -> sort * sort -> bool"} \\
1.132 +  @{index_ML Sign.of_sort: "theory -> typ * sort -> bool"} \\
1.133 +  @{index_ML Sign.add_type: "Proof.context -> binding * int * mixfix -> theory -> theory"} \\
1.134 +  @{index_ML Sign.add_type_abbrev: "Proof.context ->
1.135 +  binding * string list * typ -> theory -> theory"} \\
1.136 +  @{index_ML Sign.primitive_class: "binding * class list -> theory -> theory"} \\
1.137 +  @{index_ML Sign.primitive_classrel: "class * class -> theory -> theory"} \\
1.138 +  @{index_ML Sign.primitive_arity: "arity -> theory -> theory"} \\
1.139 +  \end{mldecls}
1.140 +
1.141 +  \begin{description}
1.142 +
1.143 +  \item Type @{ML_type class} represents type classes.
1.144 +
1.145 +  \item Type @{ML_type sort} represents sorts, i.e.\ finite
1.146 +  intersections of classes.  The empty list @{ML "[]: sort"} refers to
1.147 +  the empty class intersection, i.e.\ the full sort''.
1.148 +
1.149 +  \item Type @{ML_type arity} represents type arities.  A triple
1.150 +  @{text "(\<kappa>, \<^vec>s, s) : arity"} represents @{text "\<kappa> ::
1.151 +  (\<^vec>s)s"} as described above.
1.152 +
1.153 +  \item Type @{ML_type typ} represents types; this is a datatype with
1.154 +  constructors @{ML TFree}, @{ML TVar}, @{ML Type}.
1.155 +
1.156 +  \item @{ML Term.map_atyps}~@{text "f \<tau>"} applies the mapping @{text
1.157 +  "f"} to all atomic types (@{ML TFree}, @{ML TVar}) occurring in
1.158 +  @{text "\<tau>"}.
1.159 +
1.160 +  \item @{ML Term.fold_atyps}~@{text "f \<tau>"} iterates the operation
1.161 +  @{text "f"} over all occurrences of atomic types (@{ML TFree}, @{ML
1.162 +  TVar}) in @{text "\<tau>"}; the type structure is traversed from left to
1.163 +  right.
1.164 +
1.165 +  \item @{ML Sign.subsort}~@{text "thy (s\<^isub>1, s\<^isub>2)"}
1.166 +  tests the subsort relation @{text "s\<^isub>1 \<subseteq> s\<^isub>2"}.
1.167 +
1.168 +  \item @{ML Sign.of_sort}~@{text "thy (\<tau>, s)"} tests whether type
1.169 +  @{text "\<tau>"} is of sort @{text "s"}.
1.170 +
1.171 +  \item @{ML Sign.add_type}~@{text "ctxt (\<kappa>, k, mx)"} declares a
1.172 +  new type constructors @{text "\<kappa>"} with @{text "k"} arguments and
1.173 +  optional mixfix syntax.
1.174 +
1.175 +  \item @{ML Sign.add_type_abbrev}~@{text "ctxt (\<kappa>, \<^vec>\<alpha>, \<tau>)"}
1.176 +  defines a new type abbreviation @{text "(\<^vec>\<alpha>)\<kappa> = \<tau>"}.
1.177 +
1.178 +  \item @{ML Sign.primitive_class}~@{text "(c, [c\<^isub>1, \<dots>,
1.179 +  c\<^isub>n])"} declares a new class @{text "c"}, together with class
1.180 +  relations @{text "c \<subseteq> c\<^isub>i"}, for @{text "i = 1, \<dots>, n"}.
1.181 +
1.182 +  \item @{ML Sign.primitive_classrel}~@{text "(c\<^isub>1,
1.183 +  c\<^isub>2)"} declares the class relation @{text "c\<^isub>1 \<subseteq>
1.184 +  c\<^isub>2"}.
1.185 +
1.186 +  \item @{ML Sign.primitive_arity}~@{text "(\<kappa>, \<^vec>s, s)"} declares
1.187 +  the arity @{text "\<kappa> :: (\<^vec>s)s"}.
1.188 +
1.189 +  \end{description}
1.190 +*}
1.191 +
1.192 +text %mlantiq {*
1.193 +  \begin{matharray}{rcl}
1.194 +  @{ML_antiquotation_def "class"} & : & @{text ML_antiquotation} \\
1.195 +  @{ML_antiquotation_def "sort"} & : & @{text ML_antiquotation} \\
1.196 +  @{ML_antiquotation_def "type_name"} & : & @{text ML_antiquotation} \\
1.197 +  @{ML_antiquotation_def "type_abbrev"} & : & @{text ML_antiquotation} \\
1.198 +  @{ML_antiquotation_def "nonterminal"} & : & @{text ML_antiquotation} \\
1.199 +  @{ML_antiquotation_def "typ"} & : & @{text ML_antiquotation} \\
1.200 +  \end{matharray}
1.201 +
1.202 +  @{rail "
1.203 +  @@{ML_antiquotation class} nameref
1.204 +  ;
1.205 +  @@{ML_antiquotation sort} sort
1.206 +  ;
1.207 +  (@@{ML_antiquotation type_name} |
1.208 +   @@{ML_antiquotation type_abbrev} |
1.209 +   @@{ML_antiquotation nonterminal}) nameref
1.210 +  ;
1.211 +  @@{ML_antiquotation typ} type
1.212 +  "}
1.213 +
1.214 +  \begin{description}
1.215 +
1.216 +  \item @{text "@{class c}"} inlines the internalized class @{text
1.217 +  "c"} --- as @{ML_type string} literal.
1.218 +
1.219 +  \item @{text "@{sort s}"} inlines the internalized sort @{text "s"}
1.220 +  --- as @{ML_type "string list"} literal.
1.221 +
1.222 +  \item @{text "@{type_name c}"} inlines the internalized type
1.223 +  constructor @{text "c"} --- as @{ML_type string} literal.
1.224 +
1.225 +  \item @{text "@{type_abbrev c}"} inlines the internalized type
1.226 +  abbreviation @{text "c"} --- as @{ML_type string} literal.
1.227 +
1.228 +  \item @{text "@{nonterminal c}"} inlines the internalized syntactic
1.229 +  type~/ grammar nonterminal @{text "c"} --- as @{ML_type string}
1.230 +  literal.
1.231 +
1.232 +  \item @{text "@{typ \<tau>}"} inlines the internalized type @{text "\<tau>"}
1.233 +  --- as constructor term for datatype @{ML_type typ}.
1.234 +
1.235 +  \end{description}
1.236 +*}
1.237 +
1.238 +
1.239 +section {* Terms \label{sec:terms} *}
1.240 +
1.241 +text {*
1.242 +  The language of terms is that of simply-typed @{text "\<lambda>"}-calculus
1.243 +  with de-Bruijn indices for bound variables (cf.\ \cite{debruijn72}
1.244 +  or \cite{paulson-ml2}), with the types being determined by the
1.245 +  corresponding binders.  In contrast, free variables and constants
1.246 +  have an explicit name and type in each occurrence.
1.247 +
1.248 +  \medskip A \emph{bound variable} is a natural number @{text "b"},
1.249 +  which accounts for the number of intermediate binders between the
1.250 +  variable occurrence in the body and its binding position.  For
1.251 +  example, the de-Bruijn term @{text "\<lambda>\<^bsub>bool\<^esub>. \<lambda>\<^bsub>bool\<^esub>. 1 \<and> 0"} would
1.252 +  correspond to @{text "\<lambda>x\<^bsub>bool\<^esub>. \<lambda>y\<^bsub>bool\<^esub>. x \<and> y"} in a named
1.253 +  representation.  Note that a bound variable may be represented by
1.254 +  different de-Bruijn indices at different occurrences, depending on
1.255 +  the nesting of abstractions.
1.256 +
1.257 +  A \emph{loose variable} is a bound variable that is outside the
1.258 +  scope of local binders.  The types (and names) for loose variables
1.259 +  can be managed as a separate context, that is maintained as a stack
1.260 +  of hypothetical binders.  The core logic operates on closed terms,
1.261 +  without any loose variables.
1.262 +
1.263 +  A \emph{fixed variable} is a pair of a basic name and a type, e.g.\
1.264 +  @{text "(x, \<tau>)"} which is usually printed @{text "x\<^isub>\<tau>"} here.  A
1.265 +  \emph{schematic variable} is a pair of an indexname and a type,
1.266 +  e.g.\ @{text "((x, 0), \<tau>)"} which is likewise printed as @{text
1.267 +  "?x\<^isub>\<tau>"}.
1.268 +
1.269 +  \medskip A \emph{constant} is a pair of a basic name and a type,
1.270 +  e.g.\ @{text "(c, \<tau>)"} which is usually printed as @{text "c\<^isub>\<tau>"}
1.271 +  here.  Constants are declared in the context as polymorphic families
1.272 +  @{text "c :: \<sigma>"}, meaning that all substitution instances @{text
1.273 +  "c\<^isub>\<tau>"} for @{text "\<tau> = \<sigma>\<vartheta>"} are valid.
1.274 +
1.275 +  The vector of \emph{type arguments} of constant @{text "c\<^isub>\<tau>"} wrt.\
1.276 +  the declaration @{text "c :: \<sigma>"} is defined as the codomain of the
1.277 +  matcher @{text "\<vartheta> = {?\<alpha>\<^isub>1 \<mapsto> \<tau>\<^isub>1, \<dots>, ?\<alpha>\<^isub>n \<mapsto> \<tau>\<^isub>n}"} presented in
1.278 +  canonical order @{text "(\<tau>\<^isub>1, \<dots>, \<tau>\<^isub>n)"}, corresponding to the
1.279 +  left-to-right occurrences of the @{text "\<alpha>\<^isub>i"} in @{text "\<sigma>"}.
1.280 +  Within a given theory context, there is a one-to-one correspondence
1.281 +  between any constant @{text "c\<^isub>\<tau>"} and the application @{text "c(\<tau>\<^isub>1,
1.282 +  \<dots>, \<tau>\<^isub>n)"} of its type arguments.  For example, with @{text "plus :: \<alpha>
1.283 +  \<Rightarrow> \<alpha> \<Rightarrow> \<alpha>"}, the instance @{text "plus\<^bsub>nat \<Rightarrow> nat \<Rightarrow> nat\<^esub>"} corresponds to
1.284 +  @{text "plus(nat)"}.
1.285 +
1.286 +  Constant declarations @{text "c :: \<sigma>"} may contain sort constraints
1.287 +  for type variables in @{text "\<sigma>"}.  These are observed by
1.288 +  type-inference as expected, but \emph{ignored} by the core logic.
1.289 +  This means the primitive logic is able to reason with instances of
1.290 +  polymorphic constants that the user-level type-checker would reject
1.291 +  due to violation of type class restrictions.
1.292 +
1.293 +  \medskip An \emph{atomic term} is either a variable or constant.
1.294 +  The logical category \emph{term} is defined inductively over atomic
1.295 +  terms, with abstraction and application as follows: @{text "t = b |
1.296 +  x\<^isub>\<tau> | ?x\<^isub>\<tau> | c\<^isub>\<tau> | \<lambda>\<^isub>\<tau>. t | t\<^isub>1 t\<^isub>2"}.  Parsing and printing takes care of
1.297 +  converting between an external representation with named bound
1.298 +  variables.  Subsequently, we shall use the latter notation instead
1.299 +  of internal de-Bruijn representation.
1.300 +
1.301 +  The inductive relation @{text "t :: \<tau>"} assigns a (unique) type to a
1.302 +  term according to the structure of atomic terms, abstractions, and
1.303 +  applicatins:
1.304 +  $1.305 + \infer{@{text "a\<^isub>\<tau> :: \<tau>"}}{} 1.306 + \qquad 1.307 + \infer{@{text "(\<lambda>x\<^sub>\<tau>. t) :: \<tau> \<Rightarrow> \<sigma>"}}{@{text "t :: \<sigma>"}} 1.308 + \qquad 1.309 + \infer{@{text "t u :: \<sigma>"}}{@{text "t :: \<tau> \<Rightarrow> \<sigma>"} & @{text "u :: \<tau>"}} 1.310 +$
1.311 +  A \emph{well-typed term} is a term that can be typed according to these rules.
1.312 +
1.313 +  Typing information can be omitted: type-inference is able to
1.314 +  reconstruct the most general type of a raw term, while assigning
1.315 +  most general types to all of its variables and constants.
1.316 +  Type-inference depends on a context of type constraints for fixed
1.317 +  variables, and declarations for polymorphic constants.
1.318 +
1.319 +  The identity of atomic terms consists both of the name and the type
1.320 +  component.  This means that different variables @{text
1.321 +  "x\<^bsub>\<tau>\<^isub>1\<^esub>"} and @{text "x\<^bsub>\<tau>\<^isub>2\<^esub>"} may become the same after
1.322 +  type instantiation.  Type-inference rejects variables of the same
1.323 +  name, but different types.  In contrast, mixed instances of
1.324 +  polymorphic constants occur routinely.
1.325 +
1.326 +  \medskip The \emph{hidden polymorphism} of a term @{text "t :: \<sigma>"}
1.327 +  is the set of type variables occurring in @{text "t"}, but not in
1.328 +  its type @{text "\<sigma>"}.  This means that the term implicitly depends
1.329 +  on type arguments that are not accounted in the result type, i.e.\
1.330 +  there are different type instances @{text "t\<vartheta> :: \<sigma>"} and
1.331 +  @{text "t\<vartheta>' :: \<sigma>"} with the same type.  This slightly
1.332 +  pathological situation notoriously demands additional care.
1.333 +
1.334 +  \medskip A \emph{term abbreviation} is a syntactic definition @{text
1.335 +  "c\<^isub>\<sigma> \<equiv> t"} of a closed term @{text "t"} of type @{text "\<sigma>"},
1.336 +  without any hidden polymorphism.  A term abbreviation looks like a
1.337 +  constant in the syntax, but is expanded before entering the logical
1.338 +  core.  Abbreviations are usually reverted when printing terms, using
1.339 +  @{text "t \<rightarrow> c\<^isub>\<sigma>"} as rules for higher-order rewriting.
1.340 +
1.341 +  \medskip Canonical operations on @{text "\<lambda>"}-terms include @{text
1.342 +  "\<alpha>\<beta>\<eta>"}-conversion: @{text "\<alpha>"}-conversion refers to capture-free
1.343 +  renaming of bound variables; @{text "\<beta>"}-conversion contracts an
1.344 +  abstraction applied to an argument term, substituting the argument
1.345 +  in the body: @{text "(\<lambda>x. b)a"} becomes @{text "b[a/x]"}; @{text
1.346 +  "\<eta>"}-conversion contracts vacuous application-abstraction: @{text
1.347 +  "\<lambda>x. f x"} becomes @{text "f"}, provided that the bound variable
1.348 +  does not occur in @{text "f"}.
1.349 +
1.350 +  Terms are normally treated modulo @{text "\<alpha>"}-conversion, which is
1.351 +  implicit in the de-Bruijn representation.  Names for bound variables
1.352 +  in abstractions are maintained separately as (meaningless) comments,
1.353 +  mostly for parsing and printing.  Full @{text "\<alpha>\<beta>\<eta>"}-conversion is
1.354 +  commonplace in various standard operations (\secref{sec:obj-rules})
1.355 +  that are based on higher-order unification and matching.
1.356 +*}
1.357 +
1.358 +text %mlref {*
1.359 +  \begin{mldecls}
1.360 +  @{index_ML_type term} \\
1.361 +  @{index_ML_op "aconv": "term * term -> bool"} \\
1.362 +  @{index_ML Term.map_types: "(typ -> typ) -> term -> term"} \\
1.363 +  @{index_ML Term.fold_types: "(typ -> 'a -> 'a) -> term -> 'a -> 'a"} \\
1.364 +  @{index_ML Term.map_aterms: "(term -> term) -> term -> term"} \\
1.365 +  @{index_ML Term.fold_aterms: "(term -> 'a -> 'a) -> term -> 'a -> 'a"} \\
1.366 +  \end{mldecls}
1.367 +  \begin{mldecls}
1.368 +  @{index_ML fastype_of: "term -> typ"} \\
1.369 +  @{index_ML lambda: "term -> term -> term"} \\
1.370 +  @{index_ML betapply: "term * term -> term"} \\
1.371 +  @{index_ML incr_boundvars: "int -> term -> term"} \\
1.372 +  @{index_ML Sign.declare_const: "Proof.context ->
1.373 +  (binding * typ) * mixfix -> theory -> term * theory"} \\
1.374 +  @{index_ML Sign.add_abbrev: "string -> binding * term ->
1.375 +  theory -> (term * term) * theory"} \\
1.376 +  @{index_ML Sign.const_typargs: "theory -> string * typ -> typ list"} \\
1.377 +  @{index_ML Sign.const_instance: "theory -> string * typ list -> typ"} \\
1.378 +  \end{mldecls}
1.379 +
1.380 +  \begin{description}
1.381 +
1.382 +  \item Type @{ML_type term} represents de-Bruijn terms, with comments
1.383 +  in abstractions, and explicitly named free variables and constants;
1.384 +  this is a datatype with constructors @{ML Bound}, @{ML Free}, @{ML
1.385 +  Var}, @{ML Const}, @{ML Abs}, @{ML_op "$"}. 1.386 + 1.387 + \item @{text "t"}~@{ML_text aconv}~@{text "u"} checks @{text 1.388 + "\<alpha>"}-equivalence of two terms. This is the basic equality relation 1.389 + on type @{ML_type term}; raw datatype equality should only be used 1.390 + for operations related to parsing or printing! 1.391 + 1.392 + \item @{ML Term.map_types}~@{text "f t"} applies the mapping @{text 1.393 + "f"} to all types occurring in @{text "t"}. 1.394 + 1.395 + \item @{ML Term.fold_types}~@{text "f t"} iterates the operation 1.396 + @{text "f"} over all occurrences of types in @{text "t"}; the term 1.397 + structure is traversed from left to right. 1.398 + 1.399 + \item @{ML Term.map_aterms}~@{text "f t"} applies the mapping @{text 1.400 + "f"} to all atomic terms (@{ML Bound}, @{ML Free}, @{ML Var}, @{ML 1.401 + Const}) occurring in @{text "t"}. 1.402 + 1.403 + \item @{ML Term.fold_aterms}~@{text "f t"} iterates the operation 1.404 + @{text "f"} over all occurrences of atomic terms (@{ML Bound}, @{ML 1.405 + Free}, @{ML Var}, @{ML Const}) in @{text "t"}; the term structure is 1.406 + traversed from left to right. 1.407 + 1.408 + \item @{ML fastype_of}~@{text "t"} determines the type of a 1.409 + well-typed term. This operation is relatively slow, despite the 1.410 + omission of any sanity checks. 1.411 + 1.412 + \item @{ML lambda}~@{text "a b"} produces an abstraction @{text 1.413 + "\<lambda>a. b"}, where occurrences of the atomic term @{text "a"} in the 1.414 + body @{text "b"} are replaced by bound variables. 1.415 + 1.416 + \item @{ML betapply}~@{text "(t, u)"} produces an application @{text 1.417 + "t u"}, with topmost @{text "\<beta>"}-conversion if @{text "t"} is an 1.418 + abstraction. 1.419 + 1.420 + \item @{ML incr_boundvars}~@{text "j"} increments a term's dangling 1.421 + bound variables by the offset @{text "j"}. This is required when 1.422 + moving a subterm into a context where it is enclosed by a different 1.423 + number of abstractions. Bound variables with a matching abstraction 1.424 + are unaffected. 1.425 + 1.426 + \item @{ML Sign.declare_const}~@{text "ctxt ((c, \<sigma>), mx)"} declares 1.427 + a new constant @{text "c :: \<sigma>"} with optional mixfix syntax. 1.428 + 1.429 + \item @{ML Sign.add_abbrev}~@{text "print_mode (c, t)"} 1.430 + introduces a new term abbreviation @{text "c \<equiv> t"}. 1.431 + 1.432 + \item @{ML Sign.const_typargs}~@{text "thy (c, \<tau>)"} and @{ML 1.433 + Sign.const_instance}~@{text "thy (c, [\<tau>\<^isub>1, \<dots>, \<tau>\<^isub>n])"} 1.434 + convert between two representations of polymorphic constants: full 1.435 + type instance vs.\ compact type arguments form. 1.436 + 1.437 + \end{description} 1.438 +*} 1.439 + 1.440 +text %mlantiq {* 1.441 + \begin{matharray}{rcl} 1.442 + @{ML_antiquotation_def "const_name"} & : & @{text ML_antiquotation} \\ 1.443 + @{ML_antiquotation_def "const_abbrev"} & : & @{text ML_antiquotation} \\ 1.444 + @{ML_antiquotation_def "const"} & : & @{text ML_antiquotation} \\ 1.445 + @{ML_antiquotation_def "term"} & : & @{text ML_antiquotation} \\ 1.446 + @{ML_antiquotation_def "prop"} & : & @{text ML_antiquotation} \\ 1.447 + \end{matharray} 1.448 + 1.449 + @{rail " 1.450 + (@@{ML_antiquotation const_name} | 1.451 + @@{ML_antiquotation const_abbrev}) nameref 1.452 + ; 1.453 + @@{ML_antiquotation const} ('(' (type + ',') ')')? 1.454 + ; 1.455 + @@{ML_antiquotation term} term 1.456 + ; 1.457 + @@{ML_antiquotation prop} prop 1.458 + "} 1.459 + 1.460 + \begin{description} 1.461 + 1.462 + \item @{text "@{const_name c}"} inlines the internalized logical 1.463 + constant name @{text "c"} --- as @{ML_type string} literal. 1.464 + 1.465 + \item @{text "@{const_abbrev c}"} inlines the internalized 1.466 + abbreviated constant name @{text "c"} --- as @{ML_type string} 1.467 + literal. 1.468 + 1.469 + \item @{text "@{const c(\<^vec>\<tau>)}"} inlines the internalized 1.470 + constant @{text "c"} with precise type instantiation in the sense of 1.471 + @{ML Sign.const_instance} --- as @{ML Const} constructor term for 1.472 + datatype @{ML_type term}. 1.473 + 1.474 + \item @{text "@{term t}"} inlines the internalized term @{text "t"} 1.475 + --- as constructor term for datatype @{ML_type term}. 1.476 + 1.477 + \item @{text "@{prop \<phi>}"} inlines the internalized proposition 1.478 + @{text "\<phi>"} --- as constructor term for datatype @{ML_type term}. 1.479 + 1.480 + \end{description} 1.481 +*} 1.482 + 1.483 + 1.484 +section {* Theorems \label{sec:thms} *} 1.485 + 1.486 +text {* 1.487 + A \emph{proposition} is a well-typed term of type @{text "prop"}, a 1.488 + \emph{theorem} is a proven proposition (depending on a context of 1.489 + hypotheses and the background theory). Primitive inferences include 1.490 + plain Natural Deduction rules for the primary connectives @{text 1.491 + "\<And>"} and @{text "\<Longrightarrow>"} of the framework. There is also a builtin 1.492 + notion of equality/equivalence @{text "\<equiv>"}. 1.493 +*} 1.494 + 1.495 + 1.496 +subsection {* Primitive connectives and rules \label{sec:prim-rules} *} 1.497 + 1.498 +text {* 1.499 + The theory @{text "Pure"} contains constant declarations for the 1.500 + primitive connectives @{text "\<And>"}, @{text "\<Longrightarrow>"}, and @{text "\<equiv>"} of 1.501 + the logical framework, see \figref{fig:pure-connectives}. The 1.502 + derivability judgment @{text "A\<^isub>1, \<dots>, A\<^isub>n \<turnstile> B"} is 1.503 + defined inductively by the primitive inferences given in 1.504 + \figref{fig:prim-rules}, with the global restriction that the 1.505 + hypotheses must \emph{not} contain any schematic variables. The 1.506 + builtin equality is conceptually axiomatized as shown in 1.507 + \figref{fig:pure-equality}, although the implementation works 1.508 + directly with derived inferences. 1.509 + 1.510 + \begin{figure}[htb] 1.511 + \begin{center} 1.512 + \begin{tabular}{ll} 1.513 + @{text "all :: (\<alpha> \<Rightarrow> prop) \<Rightarrow> prop"} & universal quantification (binder @{text "\<And>"}) \\ 1.514 + @{text "\<Longrightarrow> :: prop \<Rightarrow> prop \<Rightarrow> prop"} & implication (right associative infix) \\ 1.515 + @{text "\<equiv> :: \<alpha> \<Rightarrow> \<alpha> \<Rightarrow> prop"} & equality relation (infix) \\ 1.516 + \end{tabular} 1.517 + \caption{Primitive connectives of Pure}\label{fig:pure-connectives} 1.518 + \end{center} 1.519 + \end{figure} 1.520 + 1.521 + \begin{figure}[htb] 1.522 + \begin{center} 1.523 + $1.524 + \infer[@{text "(axiom)"}]{@{text "\<turnstile> A"}}{@{text "A \<in> \<Theta>"}} 1.525 + \qquad 1.526 + \infer[@{text "(assume)"}]{@{text "A \<turnstile> A"}}{} 1.527 +$ 1.528 + $1.529 + \infer[@{text "(\<And>\<hyphen>intro)"}]{@{text "\<Gamma> \<turnstile> \<And>x. b[x]"}}{@{text "\<Gamma> \<turnstile> b[x]"} & @{text "x \<notin> \<Gamma>"}} 1.530 + \qquad 1.531 + \infer[@{text "(\<And>\<hyphen>elim)"}]{@{text "\<Gamma> \<turnstile> b[a]"}}{@{text "\<Gamma> \<turnstile> \<And>x. b[x]"}} 1.532 +$ 1.533 + $1.534 + \infer[@{text "(\<Longrightarrow>\<hyphen>intro)"}]{@{text "\<Gamma> - A \<turnstile> A \<Longrightarrow> B"}}{@{text "\<Gamma> \<turnstile> B"}} 1.535 + \qquad 1.536 + \infer[@{text "(\<Longrightarrow>\<hyphen>elim)"}]{@{text "\<Gamma>\<^sub>1 \<union> \<Gamma>\<^sub>2 \<turnstile> B"}}{@{text "\<Gamma>\<^sub>1 \<turnstile> A \<Longrightarrow> B"} & @{text "\<Gamma>\<^sub>2 \<turnstile> A"}} 1.537 +$ 1.538 + \caption{Primitive inferences of Pure}\label{fig:prim-rules} 1.539 + \end{center} 1.540 + \end{figure} 1.541 + 1.542 + \begin{figure}[htb] 1.543 + \begin{center} 1.544 + \begin{tabular}{ll} 1.545 + @{text "\<turnstile> (\<lambda>x. b[x]) a \<equiv> b[a]"} & @{text "\<beta>"}-conversion \\ 1.546 + @{text "\<turnstile> x \<equiv> x"} & reflexivity \\ 1.547 + @{text "\<turnstile> x \<equiv> y \<Longrightarrow> P x \<Longrightarrow> P y"} & substitution \\ 1.548 + @{text "\<turnstile> (\<And>x. f x \<equiv> g x) \<Longrightarrow> f \<equiv> g"} & extensionality \\ 1.549 + @{text "\<turnstile> (A \<Longrightarrow> B) \<Longrightarrow> (B \<Longrightarrow> A) \<Longrightarrow> A \<equiv> B"} & logical equivalence \\ 1.550 + \end{tabular} 1.551 + \caption{Conceptual axiomatization of Pure equality}\label{fig:pure-equality} 1.552 + \end{center} 1.553 + \end{figure} 1.554 + 1.555 + The introduction and elimination rules for @{text "\<And>"} and @{text 1.556 + "\<Longrightarrow>"} are analogous to formation of dependently typed @{text 1.557 + "\<lambda>"}-terms representing the underlying proof objects. Proof terms 1.558 + are irrelevant in the Pure logic, though; they cannot occur within 1.559 + propositions. The system provides a runtime option to record 1.560 + explicit proof terms for primitive inferences. Thus all three 1.561 + levels of @{text "\<lambda>"}-calculus become explicit: @{text "\<Rightarrow>"} for 1.562 + terms, and @{text "\<And>/\<Longrightarrow>"} for proofs (cf.\ 1.563 + \cite{Berghofer-Nipkow:2000:TPHOL}). 1.564 + 1.565 + Observe that locally fixed parameters (as in @{text 1.566 + "\<And>\<hyphen>intro"}) need not be recorded in the hypotheses, because 1.567 + the simple syntactic types of Pure are always inhabitable. 1.568 + Assumptions'' @{text "x :: \<tau>"} for type-membership are only 1.569 + present as long as some @{text "x\<^isub>\<tau>"} occurs in the statement 1.570 + body.\footnote{This is the key difference to @{text "\<lambda>HOL"}'' in 1.571 + the PTS framework \cite{Barendregt-Geuvers:2001}, where hypotheses 1.572 + @{text "x : A"} are treated uniformly for propositions and types.} 1.573 + 1.574 + \medskip The axiomatization of a theory is implicitly closed by 1.575 + forming all instances of type and term variables: @{text "\<turnstile> 1.576 + A\<vartheta>"} holds for any substitution instance of an axiom 1.577 + @{text "\<turnstile> A"}. By pushing substitutions through derivations 1.578 + inductively, we also get admissible @{text "generalize"} and @{text 1.579 + "instantiate"} rules as shown in \figref{fig:subst-rules}. 1.580 + 1.581 + \begin{figure}[htb] 1.582 + \begin{center} 1.583 + $1.584 + \infer{@{text "\<Gamma> \<turnstile> B[?\<alpha>]"}}{@{text "\<Gamma> \<turnstile> B[\<alpha>]"} & @{text "\<alpha> \<notin> \<Gamma>"}} 1.585 + \quad 1.586 + \infer[\quad@{text "(generalize)"}]{@{text "\<Gamma> \<turnstile> B[?x]"}}{@{text "\<Gamma> \<turnstile> B[x]"} & @{text "x \<notin> \<Gamma>"}} 1.587 +$ 1.588 + $1.589 + \infer{@{text "\<Gamma> \<turnstile> B[\<tau>]"}}{@{text "\<Gamma> \<turnstile> B[?\<alpha>]"}} 1.590 + \quad 1.591 + \infer[\quad@{text "(instantiate)"}]{@{text "\<Gamma> \<turnstile> B[t]"}}{@{text "\<Gamma> \<turnstile> B[?x]"}} 1.592 +$ 1.593 + \caption{Admissible substitution rules}\label{fig:subst-rules} 1.594 + \end{center} 1.595 + \end{figure} 1.596 + 1.597 + Note that @{text "instantiate"} does not require an explicit 1.598 + side-condition, because @{text "\<Gamma>"} may never contain schematic 1.599 + variables. 1.600 + 1.601 + In principle, variables could be substituted in hypotheses as well, 1.602 + but this would disrupt the monotonicity of reasoning: deriving 1.603 + @{text "\<Gamma>\<vartheta> \<turnstile> B\<vartheta>"} from @{text "\<Gamma> \<turnstile> B"} is 1.604 + correct, but @{text "\<Gamma>\<vartheta> \<supseteq> \<Gamma>"} does not necessarily hold: 1.605 + the result belongs to a different proof context. 1.606 + 1.607 + \medskip An \emph{oracle} is a function that produces axioms on the 1.608 + fly. Logically, this is an instance of the @{text "axiom"} rule 1.609 + (\figref{fig:prim-rules}), but there is an operational difference. 1.610 + The system always records oracle invocations within derivations of 1.611 + theorems by a unique tag. 1.612 + 1.613 + Axiomatizations should be limited to the bare minimum, typically as 1.614 + part of the initial logical basis of an object-logic formalization. 1.615 + Later on, theories are usually developed in a strictly definitional 1.616 + fashion, by stating only certain equalities over new constants. 1.617 + 1.618 + A \emph{simple definition} consists of a constant declaration @{text 1.619 + "c :: \<sigma>"} together with an axiom @{text "\<turnstile> c \<equiv> t"}, where @{text "t 1.620 + :: \<sigma>"} is a closed term without any hidden polymorphism. The RHS 1.621 + may depend on further defined constants, but not @{text "c"} itself. 1.622 + Definitions of functions may be presented as @{text "c \<^vec>x \<equiv> 1.623 + t"} instead of the puristic @{text "c \<equiv> \<lambda>\<^vec>x. t"}. 1.624 + 1.625 + An \emph{overloaded definition} consists of a collection of axioms 1.626 + for the same constant, with zero or one equations @{text 1.627 + "c((\<^vec>\<alpha>)\<kappa>) \<equiv> t"} for each type constructor @{text "\<kappa>"} (for 1.628 + distinct variables @{text "\<^vec>\<alpha>"}). The RHS may mention 1.629 + previously defined constants as above, or arbitrary constants @{text 1.630 + "d(\<alpha>\<^isub>i)"} for some @{text "\<alpha>\<^isub>i"} projected from @{text 1.631 + "\<^vec>\<alpha>"}. Thus overloaded definitions essentially work by 1.632 + primitive recursion over the syntactic structure of a single type 1.633 + argument. See also \cite[\S4.3]{Haftmann-Wenzel:2006:classes}. 1.634 +*} 1.635 + 1.636 +text %mlref {* 1.637 + \begin{mldecls} 1.638 + @{index_ML Logic.all: "term -> term -> term"} \\ 1.639 + @{index_ML Logic.mk_implies: "term * term -> term"} \\ 1.640 + \end{mldecls} 1.641 + \begin{mldecls} 1.642 + @{index_ML_type ctyp} \\ 1.643 + @{index_ML_type cterm} \\ 1.644 + @{index_ML Thm.ctyp_of: "theory -> typ -> ctyp"} \\ 1.645 + @{index_ML Thm.cterm_of: "theory -> term -> cterm"} \\ 1.646 + @{index_ML Thm.apply: "cterm -> cterm -> cterm"} \\ 1.647 + @{index_ML Thm.lambda: "cterm -> cterm -> cterm"} \\ 1.648 + @{index_ML Thm.all: "cterm -> cterm -> cterm"} \\ 1.649 + @{index_ML Drule.mk_implies: "cterm * cterm -> cterm"} \\ 1.650 + \end{mldecls} 1.651 + \begin{mldecls} 1.652 + @{index_ML_type thm} \\ 1.653 + @{index_ML proofs: "int Unsynchronized.ref"} \\ 1.654 + @{index_ML Thm.transfer: "theory -> thm -> thm"} \\ 1.655 + @{index_ML Thm.assume: "cterm -> thm"} \\ 1.656 + @{index_ML Thm.forall_intr: "cterm -> thm -> thm"} \\ 1.657 + @{index_ML Thm.forall_elim: "cterm -> thm -> thm"} \\ 1.658 + @{index_ML Thm.implies_intr: "cterm -> thm -> thm"} \\ 1.659 + @{index_ML Thm.implies_elim: "thm -> thm -> thm"} \\ 1.660 + @{index_ML Thm.generalize: "string list * string list -> int -> thm -> thm"} \\ 1.661 + @{index_ML Thm.instantiate: "(ctyp * ctyp) list * (cterm * cterm) list -> thm -> thm"} \\ 1.662 + @{index_ML Thm.add_axiom: "Proof.context -> 1.663 + binding * term -> theory -> (string * thm) * theory"} \\ 1.664 + @{index_ML Thm.add_oracle: "binding * ('a -> cterm) -> theory -> 1.665 + (string * ('a -> thm)) * theory"} \\ 1.666 + @{index_ML Thm.add_def: "Proof.context -> bool -> bool -> 1.667 + binding * term -> theory -> (string * thm) * theory"} \\ 1.668 + \end{mldecls} 1.669 + \begin{mldecls} 1.670 + @{index_ML Theory.add_deps: "Proof.context -> string -> 1.671 + string * typ -> (string * typ) list -> theory -> theory"} \\ 1.672 + \end{mldecls} 1.673 + 1.674 + \begin{description} 1.675 + 1.676 + \item @{ML Logic.all}~@{text "a B"} produces a Pure quantification 1.677 + @{text "\<And>a. B"}, where occurrences of the atomic term @{text "a"} in 1.678 + the body proposition @{text "B"} are replaced by bound variables. 1.679 + (See also @{ML lambda} on terms.) 1.680 + 1.681 + \item @{ML Logic.mk_implies}~@{text "(A, B)"} produces a Pure 1.682 + implication @{text "A \<Longrightarrow> B"}. 1.683 + 1.684 + \item Types @{ML_type ctyp} and @{ML_type cterm} represent certified 1.685 + types and terms, respectively. These are abstract datatypes that 1.686 + guarantee that its values have passed the full well-formedness (and 1.687 + well-typedness) checks, relative to the declarations of type 1.688 + constructors, constants etc.\ in the background theory. The 1.689 + abstract types @{ML_type ctyp} and @{ML_type cterm} are part of the 1.690 + same inference kernel that is mainly responsible for @{ML_type thm}. 1.691 + Thus syntactic operations on @{ML_type ctyp} and @{ML_type cterm} 1.692 + are located in the @{ML_struct Thm} module, even though theorems are 1.693 + not yet involved at that stage. 1.694 + 1.695 + \item @{ML Thm.ctyp_of}~@{text "thy \<tau>"} and @{ML 1.696 + Thm.cterm_of}~@{text "thy t"} explicitly checks types and terms, 1.697 + respectively. This also involves some basic normalizations, such 1.698 + expansion of type and term abbreviations from the theory context. 1.699 + Full re-certification is relatively slow and should be avoided in 1.700 + tight reasoning loops. 1.701 + 1.702 + \item @{ML Thm.apply}, @{ML Thm.lambda}, @{ML Thm.all}, @{ML 1.703 + Drule.mk_implies} etc.\ compose certified terms (or propositions) 1.704 + incrementally. This is equivalent to @{ML Thm.cterm_of} after 1.705 + unchecked @{ML_op "$"}, @{ML lambda}, @{ML Logic.all}, @{ML
1.706 +  Logic.mk_implies} etc., but there can be a big difference in
1.707 +  performance when large existing entities are composed by a few extra
1.708 +  constructions on top.  There are separate operations to decompose
1.709 +  certified terms and theorems to produce certified terms again.
1.710 +
1.711 +  \item Type @{ML_type thm} represents proven propositions.  This is
1.712 +  an abstract datatype that guarantees that its values have been
1.713 +  constructed by basic principles of the @{ML_struct Thm} module.
1.714 +  Every @{ML_type thm} value contains a sliding back-reference to the
1.715 +  enclosing theory, cf.\ \secref{sec:context-theory}.
1.716 +
1.717 +  \item @{ML proofs} specifies the detail of proof recording within
1.718 +  @{ML_type thm} values: @{ML 0} records only the names of oracles,
1.719 +  @{ML 1} records oracle names and propositions, @{ML 2} additionally
1.720 +  records full proof terms.  Officially named theorems that contribute
1.721 +  to a result are recorded in any case.
1.722 +
1.723 +  \item @{ML Thm.transfer}~@{text "thy thm"} transfers the given
1.724 +  theorem to a \emph{larger} theory, see also \secref{sec:context}.
1.725 +  This formal adjustment of the background context has no logical
1.726 +  significance, but is occasionally required for formal reasons, e.g.\
1.727 +  when theorems that are imported from more basic theories are used in
1.728 +  the current situation.
1.729 +
1.730 +  \item @{ML Thm.assume}, @{ML Thm.forall_intr}, @{ML
1.731 +  Thm.forall_elim}, @{ML Thm.implies_intr}, and @{ML Thm.implies_elim}
1.732 +  correspond to the primitive inferences of \figref{fig:prim-rules}.
1.733 +
1.734 +  \item @{ML Thm.generalize}~@{text "(\<^vec>\<alpha>, \<^vec>x)"}
1.735 +  corresponds to the @{text "generalize"} rules of
1.736 +  \figref{fig:subst-rules}.  Here collections of type and term
1.737 +  variables are generalized simultaneously, specified by the given
1.738 +  basic names.
1.739 +
1.740 +  \item @{ML Thm.instantiate}~@{text "(\<^vec>\<alpha>\<^isub>s,
1.741 +  \<^vec>x\<^isub>\<tau>)"} corresponds to the @{text "instantiate"} rules
1.742 +  of \figref{fig:subst-rules}.  Type variables are substituted before
1.743 +  term variables.  Note that the types in @{text "\<^vec>x\<^isub>\<tau>"}
1.744 +  refer to the instantiated versions.
1.745 +
1.746 +  \item @{ML Thm.add_axiom}~@{text "ctxt (name, A)"} declares an
1.747 +  arbitrary proposition as axiom, and retrieves it as a theorem from
1.748 +  the resulting theory, cf.\ @{text "axiom"} in
1.749 +  \figref{fig:prim-rules}.  Note that the low-level representation in
1.750 +  the axiom table may differ slightly from the returned theorem.
1.751 +
1.752 +  \item @{ML Thm.add_oracle}~@{text "(binding, oracle)"} produces a named
1.753 +  oracle rule, essentially generating arbitrary axioms on the fly,
1.754 +  cf.\ @{text "axiom"} in \figref{fig:prim-rules}.
1.755 +
1.756 +  \item @{ML Thm.add_def}~@{text "ctxt unchecked overloaded (name, c
1.757 +  \<^vec>x \<equiv> t)"} states a definitional axiom for an existing constant
1.758 +  @{text "c"}.  Dependencies are recorded via @{ML Theory.add_deps},
1.759 +  unless the @{text "unchecked"} option is set.  Note that the
1.760 +  low-level representation in the axiom table may differ slightly from
1.761 +  the returned theorem.
1.762 +
1.763 +  \item @{ML Theory.add_deps}~@{text "ctxt name c\<^isub>\<tau> \<^vec>d\<^isub>\<sigma>"}
1.764 +  declares dependencies of a named specification for constant @{text
1.765 +  "c\<^isub>\<tau>"}, relative to existing specifications for constants @{text
1.766 +  "\<^vec>d\<^isub>\<sigma>"}.
1.767 +
1.768 +  \end{description}
1.769 +*}
1.770 +
1.771 +
1.772 +text %mlantiq {*
1.773 +  \begin{matharray}{rcl}
1.774 +  @{ML_antiquotation_def "ctyp"} & : & @{text ML_antiquotation} \\
1.775 +  @{ML_antiquotation_def "cterm"} & : & @{text ML_antiquotation} \\
1.776 +  @{ML_antiquotation_def "cprop"} & : & @{text ML_antiquotation} \\
1.777 +  @{ML_antiquotation_def "thm"} & : & @{text ML_antiquotation} \\
1.778 +  @{ML_antiquotation_def "thms"} & : & @{text ML_antiquotation} \\
1.779 +  @{ML_antiquotation_def "lemma"} & : & @{text ML_antiquotation} \\
1.780 +  \end{matharray}
1.781 +
1.782 +  @{rail "
1.783 +  @@{ML_antiquotation ctyp} typ
1.784 +  ;
1.785 +  @@{ML_antiquotation cterm} term
1.786 +  ;
1.787 +  @@{ML_antiquotation cprop} prop
1.788 +  ;
1.789 +  @@{ML_antiquotation thm} thmref
1.790 +  ;
1.791 +  @@{ML_antiquotation thms} thmrefs
1.792 +  ;
1.793 +  @@{ML_antiquotation lemma} ('(' @'open' ')')? ((prop +) + @'and') \\
1.794 +    @'by' method method?
1.795 +  "}
1.796 +
1.797 +  \begin{description}
1.798 +
1.799 +  \item @{text "@{ctyp \<tau>}"} produces a certified type wrt.\ the
1.800 +  current background theory --- as abstract value of type @{ML_type
1.801 +  ctyp}.
1.802 +
1.803 +  \item @{text "@{cterm t}"} and @{text "@{cprop \<phi>}"} produce a
1.804 +  certified term wrt.\ the current background theory --- as abstract
1.805 +  value of type @{ML_type cterm}.
1.806 +
1.807 +  \item @{text "@{thm a}"} produces a singleton fact --- as abstract
1.808 +  value of type @{ML_type thm}.
1.809 +
1.810 +  \item @{text "@{thms a}"} produces a general fact --- as abstract
1.811 +  value of type @{ML_type "thm list"}.
1.812 +
1.813 +  \item @{text "@{lemma \<phi> by meth}"} produces a fact that is proven on
1.814 +  the spot according to the minimal proof, which imitates a terminal
1.815 +  Isar proof.  The result is an abstract value of type @{ML_type thm}
1.816 +  or @{ML_type "thm list"}, depending on the number of propositions
1.817 +  given here.
1.818 +
1.819 +  The internal derivation object lacks a proper theorem name, but it
1.820 +  is formally closed, unless the @{text "(open)"} option is specified
1.821 +  (this may impact performance of applications with proof terms).
1.822 +
1.823 +  Since ML antiquotations are always evaluated at compile-time, there
1.824 +  is no run-time overhead even for non-trivial proofs.  Nonetheless,
1.825 +  the justification is syntactically limited to a single @{command
1.826 +  "by"} step.  More complex Isar proofs should be done in regular
1.827 +  theory source, before compiling the corresponding ML text that uses
1.828 +  the result.
1.829 +
1.830 +  \end{description}
1.831 +
1.832 +*}
1.833 +
1.834 +
1.835 +subsection {* Auxiliary connectives \label{sec:logic-aux} *}
1.836 +
1.837 +text {* Theory @{text "Pure"} provides a few auxiliary connectives
1.838 +  that are defined on top of the primitive ones, see
1.839 +  \figref{fig:pure-aux}.  These special constants are useful in
1.840 +  certain internal encodings, and are normally not directly exposed to
1.841 +  the user.
1.842 +
1.843 +  \begin{figure}[htb]
1.844 +  \begin{center}
1.845 +  \begin{tabular}{ll}
1.846 +  @{text "conjunction :: prop \<Rightarrow> prop \<Rightarrow> prop"} & (infix @{text "&&&"}) \\
1.847 +  @{text "\<turnstile> A &&& B \<equiv> (\<And>C. (A \<Longrightarrow> B \<Longrightarrow> C) \<Longrightarrow> C)"} \$1ex] 1.848 + @{text "prop :: prop \<Rightarrow> prop"} & (prefix @{text "#"}, suppressed) \\ 1.849 + @{text "#A \<equiv> A"} \\[1ex] 1.850 + @{text "term :: \<alpha> \<Rightarrow> prop"} & (prefix @{text "TERM"}) \\ 1.851 + @{text "term x \<equiv> (\<And>A. A \<Longrightarrow> A)"} \\[1ex] 1.852 + @{text "TYPE :: \<alpha> itself"} & (prefix @{text "TYPE"}) \\ 1.853 + @{text "(unspecified)"} \\ 1.854 + \end{tabular} 1.855 + \caption{Definitions of auxiliary connectives}\label{fig:pure-aux} 1.856 + \end{center} 1.857 + \end{figure} 1.858 + 1.859 + The introduction @{text "A \<Longrightarrow> B \<Longrightarrow> A &&& B"}, and eliminations 1.860 + (projections) @{text "A &&& B \<Longrightarrow> A"} and @{text "A &&& B \<Longrightarrow> B"} are 1.861 + available as derived rules. Conjunction allows to treat 1.862 + simultaneous assumptions and conclusions uniformly, e.g.\ consider 1.863 + @{text "A \<Longrightarrow> B \<Longrightarrow> C &&& D"}. In particular, the goal mechanism 1.864 + represents multiple claims as explicit conjunction internally, but 1.865 + this is refined (via backwards introduction) into separate sub-goals 1.866 + before the user commences the proof; the final result is projected 1.867 + into a list of theorems using eliminations (cf.\ 1.868 + \secref{sec:tactical-goals}). 1.869 + 1.870 + The @{text "prop"} marker (@{text "#"}) makes arbitrarily complex 1.871 + propositions appear as atomic, without changing the meaning: @{text 1.872 + "\<Gamma> \<turnstile> A"} and @{text "\<Gamma> \<turnstile> #A"} are interchangeable. See 1.873 + \secref{sec:tactical-goals} for specific operations. 1.874 + 1.875 + The @{text "term"} marker turns any well-typed term into a derivable 1.876 + proposition: @{text "\<turnstile> TERM t"} holds unconditionally. Although 1.877 + this is logically vacuous, it allows to treat terms and proofs 1.878 + uniformly, similar to a type-theoretic framework. 1.879 + 1.880 + The @{text "TYPE"} constructor is the canonical representative of 1.881 + the unspecified type @{text "\<alpha> itself"}; it essentially injects the 1.882 + language of types into that of terms. There is specific notation 1.883 + @{text "TYPE(\<tau>)"} for @{text "TYPE\<^bsub>\<tau> 1.884 + itself\<^esub>"}. 1.885 + Although being devoid of any particular meaning, the term @{text 1.886 + "TYPE(\<tau>)"} accounts for the type @{text "\<tau>"} within the term 1.887 + language. In particular, @{text "TYPE(\<alpha>)"} may be used as formal 1.888 + argument in primitive definitions, in order to circumvent hidden 1.889 + polymorphism (cf.\ \secref{sec:terms}). For example, @{text "c 1.890 + TYPE(\<alpha>) \<equiv> A[\<alpha>]"} defines @{text "c :: \<alpha> itself \<Rightarrow> prop"} in terms of 1.891 + a proposition @{text "A"} that depends on an additional type 1.892 + argument, which is essentially a predicate on types. 1.893 +*} 1.894 + 1.895 +text %mlref {* 1.896 + \begin{mldecls} 1.897 + @{index_ML Conjunction.intr: "thm -> thm -> thm"} \\ 1.898 + @{index_ML Conjunction.elim: "thm -> thm * thm"} \\ 1.899 + @{index_ML Drule.mk_term: "cterm -> thm"} \\ 1.900 + @{index_ML Drule.dest_term: "thm -> cterm"} \\ 1.901 + @{index_ML Logic.mk_type: "typ -> term"} \\ 1.902 + @{index_ML Logic.dest_type: "term -> typ"} \\ 1.903 + \end{mldecls} 1.904 + 1.905 + \begin{description} 1.906 + 1.907 + \item @{ML Conjunction.intr} derives @{text "A &&& B"} from @{text 1.908 + "A"} and @{text "B"}. 1.909 + 1.910 + \item @{ML Conjunction.elim} derives @{text "A"} and @{text "B"} 1.911 + from @{text "A &&& B"}. 1.912 + 1.913 + \item @{ML Drule.mk_term} derives @{text "TERM t"}. 1.914 + 1.915 + \item @{ML Drule.dest_term} recovers term @{text "t"} from @{text 1.916 + "TERM t"}. 1.917 + 1.918 + \item @{ML Logic.mk_type}~@{text "\<tau>"} produces the term @{text 1.919 + "TYPE(\<tau>)"}. 1.920 + 1.921 + \item @{ML Logic.dest_type}~@{text "TYPE(\<tau>)"} recovers the type 1.922 + @{text "\<tau>"}. 1.923 + 1.924 + \end{description} 1.925 +*} 1.926 + 1.927 + 1.928 +section {* Object-level rules \label{sec:obj-rules} *} 1.929 + 1.930 +text {* 1.931 + The primitive inferences covered so far mostly serve foundational 1.932 + purposes. User-level reasoning usually works via object-level rules 1.933 + that are represented as theorems of Pure. Composition of rules 1.934 + involves \emph{backchaining}, \emph{higher-order unification} modulo 1.935 + @{text "\<alpha>\<beta>\<eta>"}-conversion of @{text "\<lambda>"}-terms, and so-called 1.936 + \emph{lifting} of rules into a context of @{text "\<And>"} and @{text 1.937 + "\<Longrightarrow>"} connectives. Thus the full power of higher-order Natural 1.938 + Deduction in Isabelle/Pure becomes readily available. 1.939 +*} 1.940 + 1.941 + 1.942 +subsection {* Hereditary Harrop Formulae *} 1.943 + 1.944 +text {* 1.945 + The idea of object-level rules is to model Natural Deduction 1.946 + inferences in the style of Gentzen \cite{Gentzen:1935}, but we allow 1.947 + arbitrary nesting similar to \cite{extensions91}. The most basic 1.948 + rule format is that of a \emph{Horn Clause}: 1.949 + \[ 1.950 + \infer{@{text "A"}}{@{text "A\<^sub>1"} & @{text "\<dots>"} & @{text "A\<^sub>n"}} 1.951 +$
1.952 +  where @{text "A, A\<^sub>1, \<dots>, A\<^sub>n"} are atomic propositions
1.953 +  of the framework, usually of the form @{text "Trueprop B"}, where
1.954 +  @{text "B"} is a (compound) object-level statement.  This
1.955 +  object-level inference corresponds to an iterated implication in
1.956 +  Pure like this:
1.957 +  $1.958 + @{text "A\<^sub>1 \<Longrightarrow> \<dots> A\<^sub>n \<Longrightarrow> A"} 1.959 +$
1.960 +  As an example consider conjunction introduction: @{text "A \<Longrightarrow> B \<Longrightarrow> A \<and>
1.961 +  B"}.  Any parameters occurring in such rule statements are
1.962 +  conceptionally treated as arbitrary:
1.963 +  $1.964 + @{text "\<And>x\<^sub>1 \<dots> x\<^sub>m. A\<^sub>1 x\<^sub>1 \<dots> x\<^sub>m \<Longrightarrow> \<dots> A\<^sub>n x\<^sub>1 \<dots> x\<^sub>m \<Longrightarrow> A x\<^sub>1 \<dots> x\<^sub>m"} 1.965 +$
1.966 +
1.967 +  Nesting of rules means that the positions of @{text "A\<^sub>i"} may
1.968 +  again hold compound rules, not just atomic propositions.
1.969 +  Propositions of this format are called \emph{Hereditary Harrop
1.970 +  Formulae} in the literature \cite{Miller:1991}.  Here we give an
1.971 +  inductive characterization as follows:
1.972 +
1.973 +  \medskip
1.974 +  \begin{tabular}{ll}
1.975 +  @{text "\<^bold>x"} & set of variables \\
1.976 +  @{text "\<^bold>A"} & set of atomic propositions \\
1.977 +  @{text "\<^bold>H  =  \<And>\<^bold>x\<^sup>*. \<^bold>H\<^sup>* \<Longrightarrow> \<^bold>A"} & set of Hereditary Harrop Formulas \\
1.978 +  \end{tabular}
1.979 +  \medskip
1.980 +
1.981 +  Thus we essentially impose nesting levels on propositions formed
1.982 +  from @{text "\<And>"} and @{text "\<Longrightarrow>"}.  At each level there is a prefix
1.983 +  of parameters and compound premises, concluding an atomic
1.984 +  proposition.  Typical examples are @{text "\<longrightarrow>"}-introduction @{text
1.985 +  "(A \<Longrightarrow> B) \<Longrightarrow> A \<longrightarrow> B"} or mathematical induction @{text "P 0 \<Longrightarrow> (\<And>n. P n
1.986 +  \<Longrightarrow> P (Suc n)) \<Longrightarrow> P n"}.  Even deeper nesting occurs in well-founded
1.987 +  induction @{text "(\<And>x. (\<And>y. y \<prec> x \<Longrightarrow> P y) \<Longrightarrow> P x) \<Longrightarrow> P x"}, but this
1.988 +  already marks the limit of rule complexity that is usually seen in
1.989 +  practice.
1.990 +
1.991 +  \medskip Regular user-level inferences in Isabelle/Pure always
1.992 +  maintain the following canonical form of results:
1.993 +
1.994 +  \begin{itemize}
1.995 +
1.996 +  \item Normalization by @{text "(A \<Longrightarrow> (\<And>x. B x)) \<equiv> (\<And>x. A \<Longrightarrow> B x)"},
1.997 +  which is a theorem of Pure, means that quantifiers are pushed in
1.998 +  front of implication at each level of nesting.  The normal form is a
1.999 +  Hereditary Harrop Formula.
1.1000 +
1.1001 +  \item The outermost prefix of parameters is represented via
1.1002 +  schematic variables: instead of @{text "\<And>\<^vec>x. \<^vec>H \<^vec>x
1.1003 +  \<Longrightarrow> A \<^vec>x"} we have @{text "\<^vec>H ?\<^vec>x \<Longrightarrow> A ?\<^vec>x"}.
1.1004 +  Note that this representation looses information about the order of
1.1005 +  parameters, and vacuous quantifiers vanish automatically.
1.1006 +
1.1007 +  \end{itemize}
1.1008 +*}
1.1009 +
1.1010 +text %mlref {*
1.1011 +  \begin{mldecls}
1.1012 +  @{index_ML Simplifier.norm_hhf: "thm -> thm"} \\
1.1013 +  \end{mldecls}
1.1014 +
1.1015 +  \begin{description}
1.1016 +
1.1017 +  \item @{ML Simplifier.norm_hhf}~@{text thm} normalizes the given
1.1018 +  theorem according to the canonical form specified above.  This is
1.1019 +  occasionally helpful to repair some low-level tools that do not
1.1020 +  handle Hereditary Harrop Formulae properly.
1.1021 +
1.1022 +  \end{description}
1.1023 +*}
1.1024 +
1.1025 +
1.1026 +subsection {* Rule composition *}
1.1027 +
1.1028 +text {*
1.1029 +  The rule calculus of Isabelle/Pure provides two main inferences:
1.1030 +  @{inference resolution} (i.e.\ back-chaining of rules) and
1.1031 +  @{inference assumption} (i.e.\ closing a branch), both modulo
1.1032 +  higher-order unification.  There are also combined variants, notably
1.1033 +  @{inference elim_resolution} and @{inference dest_resolution}.
1.1034 +
1.1035 +  To understand the all-important @{inference resolution} principle,
1.1036 +  we first consider raw @{inference_def composition} (modulo
1.1037 +  higher-order unification with substitution @{text "\<vartheta>"}):
1.1038 +  $1.1039 + \infer[(@{inference_def composition})]{@{text "\<^vec>A\<vartheta> \<Longrightarrow> C\<vartheta>"}} 1.1040 + {@{text "\<^vec>A \<Longrightarrow> B"} & @{text "B' \<Longrightarrow> C"} & @{text "B\<vartheta> = B'\<vartheta>"}} 1.1041 +$
1.1042 +  Here the conclusion of the first rule is unified with the premise of
1.1043 +  the second; the resulting rule instance inherits the premises of the
1.1044 +  first and conclusion of the second.  Note that @{text "C"} can again
1.1045 +  consist of iterated implications.  We can also permute the premises
1.1046 +  of the second rule back-and-forth in order to compose with @{text
1.1047 +  "B'"} in any position (subsequently we shall always refer to
1.1048 +  position 1 w.l.o.g.).
1.1049 +
1.1050 +  In @{inference composition} the internal structure of the common
1.1051 +  part @{text "B"} and @{text "B'"} is not taken into account.  For
1.1052 +  proper @{inference resolution} we require @{text "B"} to be atomic,
1.1053 +  and explicitly observe the structure @{text "\<And>\<^vec>x. \<^vec>H
1.1054 +  \<^vec>x \<Longrightarrow> B' \<^vec>x"} of the premise of the second rule.  The
1.1055 +  idea is to adapt the first rule by lifting'' it into this context,
1.1056 +  by means of iterated application of the following inferences:
1.1057 +  $1.1058 + \infer[(@{inference_def imp_lift})]{@{text "(\<^vec>H \<Longrightarrow> \<^vec>A) \<Longrightarrow> (\<^vec>H \<Longrightarrow> B)"}}{@{text "\<^vec>A \<Longrightarrow> B"}} 1.1059 +$
1.1060 +  $1.1061 + \infer[(@{inference_def all_lift})]{@{text "(\<And>\<^vec>x. \<^vec>A (?\<^vec>a \<^vec>x)) \<Longrightarrow> (\<And>\<^vec>x. B (?\<^vec>a \<^vec>x))"}}{@{text "\<^vec>A ?\<^vec>a \<Longrightarrow> B ?\<^vec>a"}} 1.1062 +$
1.1063 +  By combining raw composition with lifting, we get full @{inference
1.1064 +  resolution} as follows:
1.1065 +  $1.1066 + \infer[(@{inference_def resolution})] 1.1067 + {@{text "(\<And>\<^vec>x. \<^vec>H \<^vec>x \<Longrightarrow> \<^vec>A (?\<^vec>a \<^vec>x))\<vartheta> \<Longrightarrow> C\<vartheta>"}} 1.1068 + {\begin{tabular}{l} 1.1069 + @{text "\<^vec>A ?\<^vec>a \<Longrightarrow> B ?\<^vec>a"} \\ 1.1070 + @{text "(\<And>\<^vec>x. \<^vec>H \<^vec>x \<Longrightarrow> B' \<^vec>x) \<Longrightarrow> C"} \\ 1.1071 + @{text "(\<lambda>\<^vec>x. B (?\<^vec>a \<^vec>x))\<vartheta> = B'\<vartheta>"} \\ 1.1072 + \end{tabular}} 1.1073 +$
1.1074 +
1.1075 +  Continued resolution of rules allows to back-chain a problem towards
1.1076 +  more and sub-problems.  Branches are closed either by resolving with
1.1077 +  a rule of 0 premises, or by producing a short-circuit'' within a
1.1078 +  solved situation (again modulo unification):
1.1079 +  $1.1080 + \infer[(@{inference_def assumption})]{@{text "C\<vartheta>"}} 1.1081 + {@{text "(\<And>\<^vec>x. \<^vec>H \<^vec>x \<Longrightarrow> A \<^vec>x) \<Longrightarrow> C"} & @{text "A\<vartheta> = H\<^sub>i\<vartheta>"}~~\text{(for some~@{text i})}} 1.1082 +$
1.1083 +
1.1084 +  FIXME @{inference_def elim_resolution}, @{inference_def dest_resolution}
1.1085 +*}
1.1086 +
1.1087 +text %mlref {*
1.1088 +  \begin{mldecls}
1.1089 +  @{index_ML_op "RSN": "thm * (int * thm) -> thm"} \\
1.1090 +  @{index_ML_op "RS": "thm * thm -> thm"} \\
1.1091 +
1.1092 +  @{index_ML_op "RLN": "thm list * (int * thm list) -> thm list"} \\
1.1093 +  @{index_ML_op "RL": "thm list * thm list -> thm list"} \\
1.1094 +
1.1095 +  @{index_ML_op "MRS": "thm list * thm -> thm"} \\
1.1096 +  @{index_ML_op "OF": "thm * thm list -> thm"} \\
1.1097 +  \end{mldecls}
1.1098 +
1.1099 +  \begin{description}
1.1100 +
1.1101 +  \item @{text "rule\<^sub>1 RSN (i, rule\<^sub>2)"} resolves the conclusion of
1.1102 +  @{text "rule\<^sub>1"} with the @{text i}-th premise of @{text "rule\<^sub>2"},
1.1103 +  according to the @{inference resolution} principle explained above.
1.1104 +  Unless there is precisely one resolvent it raises exception @{ML
1.1105 +  THM}.
1.1106 +
1.1107 +  This corresponds to the rule attribute @{attribute THEN} in Isar
1.1108 +  source language.
1.1109 +
1.1110 +  \item @{text "rule\<^sub>1 RS rule\<^sub>2"} abbreviates @{text "rule\<^sub>1 RS (1,
1.1111 +  rule\<^sub>2)"}.
1.1112 +
1.1113 +  \item @{text "rules\<^sub>1 RLN (i, rules\<^sub>2)"} joins lists of rules.  For
1.1114 +  every @{text "rule\<^sub>1"} in @{text "rules\<^sub>1"} and @{text "rule\<^sub>2"} in
1.1115 +  @{text "rules\<^sub>2"}, it resolves the conclusion of @{text "rule\<^sub>1"} with
1.1116 +  the @{text "i"}-th premise of @{text "rule\<^sub>2"}, accumulating multiple
1.1117 +  results in one big list.  Note that such strict enumerations of
1.1118 +  higher-order unifications can be inefficient compared to the lazy
1.1119 +  variant seen in elementary tactics like @{ML resolve_tac}.
1.1120 +
1.1121 +  \item @{text "rules\<^sub>1 RL rules\<^sub>2"} abbreviates @{text "rules\<^sub>1 RLN (1,
1.1122 +  rules\<^sub>2)"}.
1.1123 +
1.1124 +  \item @{text "[rule\<^sub>1, \<dots>, rule\<^sub>n] MRS rule"} resolves @{text "rule\<^isub>i"}
1.1125 +  against premise @{text "i"} of @{text "rule"}, for @{text "i = n, \<dots>,
1.1126 +  1"}.  By working from right to left, newly emerging premises are
1.1127 +  concatenated in the result, without interfering.
1.1128 +
1.1129 +  \item @{text "rule OF rules"} is an alternative notation for @{text
1.1130 +  "rules MRS rule"}, which makes rule composition look more like
1.1131 +  function application.  Note that the argument @{text "rules"} need
1.1132 +  not be atomic.
1.1133 +
1.1134 +  This corresponds to the rule attribute @{attribute OF} in Isar
1.1135 +  source language.
1.1136 +
1.1137 +  \end{description}
1.1138 +*}
1.1139 +
1.1140 +end