src/HOL/Induct/LList.ML
author berghofe
Wed Aug 18 16:19:01 1999 +0200 (1999-08-18)
changeset 7256 0a69baf28961
parent 5996 6b6e0ede3517
child 7825 1be9b63e7d93
permissions -rw-r--r--
Eliminated some infixes.
     1 (*  Title:      HOL/Induct/LList
     2     ID:         $Id$
     3     Author:     Lawrence C Paulson, Cambridge University Computer Laboratory
     4     Copyright   1993  University of Cambridge
     5 
     6 SHOULD LListD_Fun_CONS_I, etc., be equations (for rewriting)?
     7 *)
     8 
     9 bind_thm ("UN1_I", UNIV_I RS UN_I);
    10 
    11 (** Simplification **)
    12 
    13 Addsplits [option.split];
    14 
    15 (*This justifies using llist in other recursive type definitions*)
    16 Goalw llist.defs "A<=B ==> llist(A) <= llist(B)";
    17 by (rtac gfp_mono 1);
    18 by (REPEAT (ares_tac basic_monos 1));
    19 qed "llist_mono";
    20 
    21 
    22 Goal "llist(A) = usum {Numb(0)} (uprod A (llist A))";
    23 let val rew = rewrite_rule [NIL_def, CONS_def] in  
    24 by (fast_tac (claset() addSIs (map rew llist.intrs)
    25                        addEs [rew llist.elim]) 1)
    26 end;
    27 qed "llist_unfold";
    28 
    29 
    30 (*** Type checking by coinduction, using list_Fun 
    31      THE COINDUCTIVE DEFINITION PACKAGE COULD DO THIS!
    32 ***)
    33 
    34 Goalw [list_Fun_def]
    35     "[| M : X;  X <= list_Fun A (X Un llist(A)) |] ==>  M : llist(A)";
    36 by (etac llist.coinduct 1);
    37 by (etac (subsetD RS CollectD) 1);
    38 by (assume_tac 1);
    39 qed "llist_coinduct";
    40 
    41 Goalw [list_Fun_def, NIL_def] "NIL: list_Fun A X";
    42 by (Fast_tac 1);
    43 qed "list_Fun_NIL_I";
    44 AddIffs [list_Fun_NIL_I];
    45 
    46 Goalw [list_Fun_def,CONS_def]
    47     "[| M: A;  N: X |] ==> CONS M N : list_Fun A X";
    48 by (Fast_tac 1);
    49 qed "list_Fun_CONS_I";
    50 Addsimps [list_Fun_CONS_I];
    51 AddSIs   [list_Fun_CONS_I];
    52 
    53 (*Utilise the "strong" part, i.e. gfp(f)*)
    54 Goalw (llist.defs @ [list_Fun_def])
    55     "M: llist(A) ==> M : list_Fun A (X Un llist(A))";
    56 by (etac (llist.mono RS gfp_fun_UnI2) 1);
    57 qed "list_Fun_llist_I";
    58 
    59 (*** LList_corec satisfies the desired recurion equation ***)
    60 
    61 (*A continuity result?*)
    62 Goalw [CONS_def] "CONS M (UN x. f(x)) = (UN x. CONS M (f x))";
    63 by (simp_tac (simpset() addsimps [In1_UN1, Scons_UN1_y]) 1);
    64 qed "CONS_UN1";
    65 
    66 Goalw [CONS_def] "[| M<=M';  N<=N' |] ==> CONS M N <= CONS M' N'";
    67 by (REPEAT (ares_tac [In1_mono,Scons_mono] 1));
    68 qed "CONS_mono";
    69 
    70 Addsimps [LList_corec_fun_def RS def_nat_rec_0,
    71           LList_corec_fun_def RS def_nat_rec_Suc];
    72 
    73 (** The directions of the equality are proved separately **)
    74 
    75 Goalw [LList_corec_def]
    76     "LList_corec a f <= \
    77 \    (case f a of None => NIL | Some(z,w) => CONS z (LList_corec w f))";
    78 by (rtac UN_least 1);
    79 by (exhaust_tac "k" 1);
    80 by (ALLGOALS Asm_simp_tac);
    81 by (REPEAT (resolve_tac [allI, impI, subset_refl RS CONS_mono, 
    82 			 UNIV_I RS UN_upper] 1));
    83 qed "LList_corec_subset1";
    84 
    85 Goalw [LList_corec_def]
    86     "(case f a of None => NIL | Some(z,w) => CONS z (LList_corec w f)) <= \
    87 \    LList_corec a f";
    88 by (simp_tac (simpset() addsimps [CONS_UN1]) 1);
    89 by Safe_tac;
    90 by (ALLGOALS (res_inst_tac [("a","Suc(?k)")] UN_I));
    91 by (ALLGOALS Asm_simp_tac);
    92 qed "LList_corec_subset2";
    93 
    94 (*the recursion equation for LList_corec -- NOT SUITABLE FOR REWRITING!*)
    95 Goal "LList_corec a f =  \
    96 \     (case f a of None => NIL | Some(z,w) => CONS z (LList_corec w f))";
    97 by (REPEAT (resolve_tac [equalityI, LList_corec_subset1, 
    98                          LList_corec_subset2] 1));
    99 qed "LList_corec";
   100 
   101 (*definitional version of same*)
   102 val [rew] = 
   103 Goal "[| !!x. h(x) == LList_corec x f |]     \
   104 \     ==> h(a) = (case f a of None => NIL | Some(z,w) => CONS z (h w))";
   105 by (rewtac rew);
   106 by (rtac LList_corec 1);
   107 qed "def_LList_corec";
   108 
   109 (*A typical use of co-induction to show membership in the gfp. 
   110   Bisimulation is  range(%x. LList_corec x f) *)
   111 Goal "LList_corec a f : llist({u. True})";
   112 by (res_inst_tac [("X", "range(%x. LList_corec x ?g)")] llist_coinduct 1);
   113 by (rtac rangeI 1);
   114 by Safe_tac;
   115 by (stac LList_corec 1);
   116 by (Simp_tac 1);
   117 qed "LList_corec_type";
   118 
   119 
   120 (**** llist equality as a gfp; the bisimulation principle ****)
   121 
   122 (*This theorem is actually used, unlike the many similar ones in ZF*)
   123 Goal "LListD r = dsum (diag {Numb 0}) (dprod r (LListD r))";
   124 let val rew = rewrite_rule [NIL_def, CONS_def] in  
   125 by (fast_tac (claset() addSIs (map rew LListD.intrs)
   126                       addEs [rew LListD.elim]) 1)
   127 end;
   128 qed "LListD_unfold";
   129 
   130 Goal "!M N. (M,N) : LListD(diag A) --> ntrunc k M = ntrunc k N";
   131 by (res_inst_tac [("n", "k")] less_induct 1);
   132 by (safe_tac (claset() delrules [equalityI]));
   133 by (etac LListD.elim 1);
   134 by (safe_tac (claset() delrules [equalityI]));
   135 by (exhaust_tac "n" 1);
   136 by (Asm_simp_tac 1);
   137 by (rename_tac "n'" 1);
   138 by (exhaust_tac "n'" 1);
   139 by (asm_simp_tac (simpset() addsimps [CONS_def]) 1);
   140 by (asm_simp_tac (simpset() addsimps [CONS_def, less_Suc_eq]) 1);
   141 qed "LListD_implies_ntrunc_equality";
   142 
   143 (*The domain of the LListD relation*)
   144 Goalw (llist.defs @ [NIL_def, CONS_def])
   145     "Domain (LListD(diag A)) <= llist(A)";
   146 by (rtac gfp_upperbound 1);
   147 (*avoids unfolding LListD on the rhs*)
   148 by (res_inst_tac [("P", "%x. Domain x <= ?B")] (LListD_unfold RS ssubst) 1);
   149 by (Simp_tac 1);
   150 by (Fast_tac 1);
   151 qed "Domain_LListD";
   152 
   153 (*This inclusion justifies the use of coinduction to show M=N*)
   154 Goal "LListD(diag A) <= diag(llist(A))";
   155 by (rtac subsetI 1);
   156 by (res_inst_tac [("p","x")] PairE 1);
   157 by Safe_tac;
   158 by (rtac diag_eqI 1);
   159 by (rtac (LListD_implies_ntrunc_equality RS spec RS spec RS mp RS 
   160           ntrunc_equality) 1);
   161 by (assume_tac 1);
   162 by (etac (DomainI RS (Domain_LListD RS subsetD)) 1);
   163 qed "LListD_subset_diag";
   164 
   165 
   166 (** Coinduction, using LListD_Fun
   167     THE COINDUCTIVE DEFINITION PACKAGE COULD DO THIS!
   168  **)
   169 
   170 Goalw [LListD_Fun_def] "A<=B ==> LListD_Fun r A <= LListD_Fun r B";
   171 by (REPEAT (ares_tac basic_monos 1));
   172 qed "LListD_Fun_mono";
   173 
   174 Goalw [LListD_Fun_def]
   175     "[| M : X;  X <= LListD_Fun r (X Un LListD(r)) |] ==>  M : LListD(r)";
   176 by (etac LListD.coinduct 1);
   177 by (etac (subsetD RS CollectD) 1);
   178 by (assume_tac 1);
   179 qed "LListD_coinduct";
   180 
   181 Goalw [LListD_Fun_def,NIL_def] "(NIL,NIL) : LListD_Fun r s";
   182 by (Fast_tac 1);
   183 qed "LListD_Fun_NIL_I";
   184 
   185 Goalw [LListD_Fun_def,CONS_def]
   186  "[| x:A;  (M,N):s |] ==> (CONS x M, CONS x N) : LListD_Fun (diag A) s";
   187 by (Fast_tac 1);
   188 qed "LListD_Fun_CONS_I";
   189 
   190 (*Utilise the "strong" part, i.e. gfp(f)*)
   191 Goalw (LListD.defs @ [LListD_Fun_def])
   192     "M: LListD(r) ==> M : LListD_Fun r (X Un LListD(r))";
   193 by (etac (LListD.mono RS gfp_fun_UnI2) 1);
   194 qed "LListD_Fun_LListD_I";
   195 
   196 
   197 (*This converse inclusion helps to strengthen LList_equalityI*)
   198 Goal "diag(llist(A)) <= LListD(diag A)";
   199 by (rtac subsetI 1);
   200 by (etac LListD_coinduct 1);
   201 by (rtac subsetI 1);
   202 by (etac diagE 1);
   203 by (etac ssubst 1);
   204 by (eresolve_tac [llist.elim] 1);
   205 by (ALLGOALS
   206     (asm_simp_tac (simpset() addsimps [diagI, LListD_Fun_NIL_I,
   207 				       LListD_Fun_CONS_I])));
   208 qed "diag_subset_LListD";
   209 
   210 Goal "LListD(diag A) = diag(llist(A))";
   211 by (REPEAT (resolve_tac [equalityI, LListD_subset_diag, 
   212                          diag_subset_LListD] 1));
   213 qed "LListD_eq_diag";
   214 
   215 Goal "M: llist(A) ==> (M,M) : LListD_Fun (diag A) (X Un diag(llist(A)))";
   216 by (rtac (LListD_eq_diag RS subst) 1);
   217 by (rtac LListD_Fun_LListD_I 1);
   218 by (asm_simp_tac (simpset() addsimps [LListD_eq_diag, diagI]) 1);
   219 qed "LListD_Fun_diag_I";
   220 
   221 
   222 (** To show two LLists are equal, exhibit a bisimulation! 
   223       [also admits true equality]
   224    Replace "A" by some particular set, like {x.True}??? *)
   225 Goal "[| (M,N) : r;  r <= LListD_Fun (diag A) (r Un diag(llist(A))) \
   226 \         |] ==>  M=N";
   227 by (rtac (LListD_subset_diag RS subsetD RS diagE) 1);
   228 by (etac LListD_coinduct 1);
   229 by (asm_simp_tac (simpset() addsimps [LListD_eq_diag]) 1);
   230 by Safe_tac;
   231 qed "LList_equalityI";
   232 
   233 
   234 (*** Finality of llist(A): Uniqueness of functions defined by corecursion ***)
   235 
   236 (*We must remove Pair_eq because it may turn an instance of reflexivity
   237   (h1 b, h2 b) = (h1 ?x17, h2 ?x17) into a conjunction! 
   238   (or strengthen the Solver?) 
   239 *)
   240 Delsimps [Pair_eq];
   241 
   242 (*abstract proof using a bisimulation*)
   243 val [prem1,prem2] = 
   244 Goal
   245  "[| !!x. h1(x) = (case f x of None => NIL | Some(z,w) => CONS z (h1 w));  \
   246 \    !!x. h2(x) = (case f x of None => NIL | Some(z,w) => CONS z (h2 w)) |]\
   247 \ ==> h1=h2";
   248 by (rtac ext 1);
   249 (*next step avoids an unknown (and flexflex pair) in simplification*)
   250 by (res_inst_tac [("A", "{u. True}"),
   251                   ("r", "range(%u. (h1(u),h2(u)))")] LList_equalityI 1);
   252 by (rtac rangeI 1);
   253 by Safe_tac;
   254 by (stac prem1 1);
   255 by (stac prem2 1);
   256 by (simp_tac (simpset() addsimps [LListD_Fun_NIL_I,
   257 				  CollectI RS LListD_Fun_CONS_I]) 1);
   258 qed "LList_corec_unique";
   259 
   260 val [prem] = 
   261 Goal 
   262  "[| !!x. h(x) = (case f x of None => NIL | Some(z,w) => CONS z (h w)) |] \
   263 \ ==> h = (%x. LList_corec x f)";
   264 by (rtac (LList_corec RS (prem RS LList_corec_unique)) 1);
   265 qed "equals_LList_corec";
   266 
   267 
   268 (** Obsolete LList_corec_unique proof: complete induction, not coinduction **)
   269 
   270 Goalw [CONS_def] "ntrunc (Suc 0) (CONS M N) = {}";
   271 by (rtac ntrunc_one_In1 1);
   272 qed "ntrunc_one_CONS";
   273 
   274 Goalw [CONS_def]
   275     "ntrunc (Suc(Suc(k))) (CONS M N) = CONS (ntrunc k M) (ntrunc k N)";
   276 by (Simp_tac 1);
   277 qed "ntrunc_CONS";
   278 
   279 Addsimps [ntrunc_one_CONS, ntrunc_CONS];
   280 
   281 
   282 val [prem1,prem2] = 
   283 Goal 
   284  "[| !!x. h1(x) = (case f x of None => NIL | Some(z,w) => CONS z (h1 w));  \
   285 \    !!x. h2(x) = (case f x of None => NIL | Some(z,w) => CONS z (h2 w)) |]\
   286 \ ==> h1=h2";
   287 by (rtac (ntrunc_equality RS ext) 1);
   288 by (rename_tac "x k" 1);
   289 by (res_inst_tac [("x", "x")] spec 1);
   290 by (res_inst_tac [("n", "k")] less_induct 1);
   291 by (rename_tac "n" 1);
   292 by (rtac allI 1);
   293 by (rename_tac "y" 1);
   294 by (stac prem1 1);
   295 by (stac prem2 1);
   296 by (Simp_tac 1);
   297 by (strip_tac 1);
   298 by (exhaust_tac "n" 1);
   299 by (rename_tac "m" 2);
   300 by (exhaust_tac "m" 2);
   301 by (ALLGOALS (asm_simp_tac (simpset() addsimps [less_Suc_eq])));
   302 result();
   303 
   304 
   305 (*** Lconst -- defined directly using lfp, but equivalent to a LList_corec ***)
   306 
   307 Goal "mono(CONS(M))";
   308 by (REPEAT (ares_tac [monoI, subset_refl, CONS_mono] 1));
   309 qed "Lconst_fun_mono";
   310 
   311 (* Lconst(M) = CONS M (Lconst M) *)
   312 bind_thm ("Lconst", (Lconst_fun_mono RS (Lconst_def RS def_lfp_Tarski)));
   313 
   314 (*A typical use of co-induction to show membership in the gfp.
   315   The containing set is simply the singleton {Lconst(M)}. *)
   316 Goal "M:A ==> Lconst(M): llist(A)";
   317 by (rtac (singletonI RS llist_coinduct) 1);
   318 by Safe_tac;
   319 by (res_inst_tac [("P", "%u. u: ?A")] (Lconst RS ssubst) 1);
   320 by (REPEAT (ares_tac [list_Fun_CONS_I, singletonI, UnI1] 1));
   321 qed "Lconst_type";
   322 
   323 Goal "Lconst(M) = LList_corec M (%x. Some((x,x)))";
   324 by (rtac (equals_LList_corec RS fun_cong) 1);
   325 by (Simp_tac 1);
   326 by (rtac Lconst 1);
   327 qed "Lconst_eq_LList_corec";
   328 
   329 (*Thus we could have used gfp in the definition of Lconst*)
   330 Goal "gfp(%N. CONS M N) = LList_corec M (%x. Some((x,x)))";
   331 by (rtac (equals_LList_corec RS fun_cong) 1);
   332 by (Simp_tac 1);
   333 by (rtac (Lconst_fun_mono RS gfp_Tarski) 1);
   334 qed "gfp_Lconst_eq_LList_corec";
   335 
   336 
   337 (*** Isomorphisms ***)
   338 
   339 Goal "inj Rep_LList";
   340 by (rtac inj_inverseI 1);
   341 by (rtac Rep_LList_inverse 1);
   342 qed "inj_Rep_LList";
   343 
   344 Goal "inj_on Abs_LList LList";
   345 by (rtac inj_on_inverseI 1);
   346 by (etac Abs_LList_inverse 1);
   347 qed "inj_on_Abs_LList";
   348 
   349 Goalw [LList_def] "x : llist (range Leaf) ==> x : LList";
   350 by (Asm_simp_tac 1);
   351 qed "LListI";
   352 
   353 Goalw [LList_def] "x : LList ==> x : llist (range Leaf)";
   354 by (Asm_simp_tac 1);
   355 qed "LListD";
   356 
   357 
   358 (** Distinctness of constructors **)
   359 
   360 Goalw [LNil_def,LCons_def] "~ LCons x xs = LNil";
   361 by (rtac (CONS_not_NIL RS (inj_on_Abs_LList RS inj_on_contraD)) 1);
   362 by (REPEAT (resolve_tac (llist.intrs @
   363 			 [rangeI, LListI, Rep_LList RS LListD]) 1));
   364 qed "LCons_not_LNil";
   365 
   366 bind_thm ("LNil_not_LCons", LCons_not_LNil RS not_sym);
   367 
   368 AddIffs [LCons_not_LNil, LNil_not_LCons];
   369 
   370 
   371 (** llist constructors **)
   372 
   373 Goalw [LNil_def] "Rep_LList LNil = NIL";
   374 by (rtac (llist.NIL_I RS LListI RS Abs_LList_inverse) 1);
   375 qed "Rep_LList_LNil";
   376 
   377 Goalw [LCons_def] "Rep_LList(LCons x l) = CONS (Leaf x) (Rep_LList l)";
   378 by (REPEAT (resolve_tac [llist.CONS_I RS LListI RS Abs_LList_inverse,
   379                          rangeI, Rep_LList RS LListD] 1));
   380 qed "Rep_LList_LCons";
   381 
   382 (** Injectiveness of CONS and LCons **)
   383 
   384 Goalw [CONS_def] "(CONS M N=CONS M' N') = (M=M' & N=N')";
   385 by (fast_tac (claset() addSEs [Scons_inject]) 1);
   386 qed "CONS_CONS_eq2";
   387 
   388 bind_thm ("CONS_inject", CONS_CONS_eq RS iffD1 RS conjE);
   389 
   390 
   391 (*For reasoning about abstract llist constructors*)
   392 
   393 AddIs [Rep_LList RS LListD, LListI];
   394 AddIs llist.intrs;
   395 
   396 AddSDs [inj_on_Abs_LList RS inj_onD,
   397         inj_Rep_LList RS injD];
   398 
   399 Goalw [LCons_def] "(LCons x xs=LCons y ys) = (x=y & xs=ys)";
   400 by (Fast_tac 1);
   401 qed "LCons_LCons_eq";
   402 
   403 AddIffs [LCons_LCons_eq];
   404 
   405 Goal "CONS M N: llist(A) ==> M: A & N: llist(A)";
   406 by (etac llist.elim 1);
   407 by (etac CONS_neq_NIL 1);
   408 by (Fast_tac 1);
   409 qed "CONS_D2";
   410 
   411 
   412 (****** Reasoning about llist(A) ******)
   413 
   414 Addsimps [List_case_NIL, List_case_CONS];
   415 
   416 (*A special case of list_equality for functions over lazy lists*)
   417 val [Mlist,gMlist,NILcase,CONScase] = 
   418 Goal
   419  "[| M: llist(A); g(NIL): llist(A);                             \
   420 \    f(NIL)=g(NIL);                                             \
   421 \    !!x l. [| x:A;  l: llist(A) |] ==>                         \
   422 \           (f(CONS x l),g(CONS x l)) :                         \
   423 \               LListD_Fun (diag A) ((%u.(f(u),g(u)))``llist(A) Un  \
   424 \                                   diag(llist(A)))             \
   425 \ |] ==> f(M) = g(M)";
   426 by (rtac LList_equalityI 1);
   427 by (rtac (Mlist RS imageI) 1);
   428 by (rtac image_subsetI 1);
   429 by (etac llist.elim 1);
   430 by (etac ssubst 1);
   431 by (stac NILcase 1);
   432 by (rtac (gMlist RS LListD_Fun_diag_I) 1);
   433 by (etac ssubst 1);
   434 by (REPEAT (ares_tac [CONScase] 1));
   435 qed "LList_fun_equalityI";
   436 
   437 
   438 (*** The functional "Lmap" ***)
   439 
   440 Goal "Lmap f NIL = NIL";
   441 by (rtac (Lmap_def RS def_LList_corec RS trans) 1);
   442 by (Simp_tac 1);
   443 qed "Lmap_NIL";
   444 
   445 Goal "Lmap f (CONS M N) = CONS (f M) (Lmap f N)";
   446 by (rtac (Lmap_def RS def_LList_corec RS trans) 1);
   447 by (Simp_tac 1);
   448 qed "Lmap_CONS";
   449 
   450 Addsimps [Lmap_NIL, Lmap_CONS];
   451 
   452 (*Another type-checking proof by coinduction*)
   453 val [major,minor] = 
   454 Goal "[| M: llist(A);  !!x. x:A ==> f(x):B |] ==> Lmap f M: llist(B)";
   455 by (rtac (major RS imageI RS llist_coinduct) 1);
   456 by Safe_tac;
   457 by (etac llist.elim 1);
   458 by (ALLGOALS Asm_simp_tac);
   459 by (REPEAT (ares_tac [list_Fun_NIL_I, list_Fun_CONS_I, 
   460                       minor, imageI, UnI1] 1));
   461 qed "Lmap_type";
   462 
   463 (*This type checking rule synthesises a sufficiently large set for f*)
   464 Goal "M: llist(A) ==> Lmap f M: llist(f``A)";
   465 by (etac Lmap_type 1);
   466 by (etac imageI 1);
   467 qed "Lmap_type2";
   468 
   469 (** Two easy results about Lmap **)
   470 
   471 Goalw [o_def] "M: llist(A) ==> Lmap (f o g) M = Lmap f (Lmap g M)";
   472 by (dtac imageI 1);
   473 by (etac LList_equalityI 1);
   474 by Safe_tac;
   475 by (etac llist.elim 1);
   476 by (ALLGOALS Asm_simp_tac);
   477 by (REPEAT (ares_tac [LListD_Fun_NIL_I, imageI, UnI1,
   478                       rangeI RS LListD_Fun_CONS_I] 1));
   479 qed "Lmap_compose";
   480 
   481 Goal "M: llist(A) ==> Lmap (%x. x) M = M";
   482 by (dtac imageI 1);
   483 by (etac LList_equalityI 1);
   484 by Safe_tac;
   485 by (etac llist.elim 1);
   486 by (ALLGOALS Asm_simp_tac);
   487 by (REPEAT (ares_tac [LListD_Fun_NIL_I, imageI RS UnI1,
   488                       rangeI RS LListD_Fun_CONS_I] 1));
   489 qed "Lmap_ident";
   490 
   491 
   492 (*** Lappend -- its two arguments cause some complications! ***)
   493 
   494 Goalw [Lappend_def] "Lappend NIL NIL = NIL";
   495 by (rtac (LList_corec RS trans) 1);
   496 by (Simp_tac 1);
   497 qed "Lappend_NIL_NIL";
   498 
   499 Goalw [Lappend_def]
   500     "Lappend NIL (CONS N N') = CONS N (Lappend NIL N')";
   501 by (rtac (LList_corec RS trans) 1);
   502 by (Simp_tac 1);
   503 qed "Lappend_NIL_CONS";
   504 
   505 Goalw [Lappend_def]
   506     "Lappend (CONS M M') N = CONS M (Lappend M' N)";
   507 by (rtac (LList_corec RS trans) 1);
   508 by (Simp_tac 1);
   509 qed "Lappend_CONS";
   510 
   511 Addsimps [llist.NIL_I, Lappend_NIL_NIL, Lappend_NIL_CONS,
   512           Lappend_CONS, LListD_Fun_CONS_I, range_eqI, image_eqI];
   513 
   514 
   515 Goal "M: llist(A) ==> Lappend NIL M = M";
   516 by (etac LList_fun_equalityI 1);
   517 by (ALLGOALS Asm_simp_tac);
   518 qed "Lappend_NIL";
   519 
   520 Goal "M: llist(A) ==> Lappend M NIL = M";
   521 by (etac LList_fun_equalityI 1);
   522 by (ALLGOALS Asm_simp_tac);
   523 qed "Lappend_NIL2";
   524 
   525 Addsimps [Lappend_NIL, Lappend_NIL2];
   526 
   527 
   528 (** Alternative type-checking proofs for Lappend **)
   529 
   530 (*weak co-induction: bisimulation and case analysis on both variables*)
   531 Goal "[| M: llist(A); N: llist(A) |] ==> Lappend M N: llist(A)";
   532 by (res_inst_tac
   533     [("X", "UN u:llist(A). UN v: llist(A). {Lappend u v}")] llist_coinduct 1);
   534 by (Fast_tac 1);
   535 by Safe_tac;
   536 by (eres_inst_tac [("aa", "u")] llist.elim 1);
   537 by (eres_inst_tac [("aa", "v")] llist.elim 1);
   538 by (ALLGOALS Asm_simp_tac);
   539 by (Blast_tac 1);
   540 qed "Lappend_type";
   541 
   542 (*strong co-induction: bisimulation and case analysis on one variable*)
   543 Goal "[| M: llist(A); N: llist(A) |] ==> Lappend M N: llist(A)";
   544 by (res_inst_tac [("X", "(%u. Lappend u N)``llist(A)")] llist_coinduct 1);
   545 by (etac imageI 1);
   546 by (rtac image_subsetI 1);
   547 by (eres_inst_tac [("aa", "x")] llist.elim 1);
   548 by (asm_simp_tac (simpset() addsimps [list_Fun_llist_I]) 1);
   549 by (Asm_simp_tac 1);
   550 qed "Lappend_type";
   551 
   552 (**** Lazy lists as the type 'a llist -- strongly typed versions of above ****)
   553 
   554 (** llist_case: case analysis for 'a llist **)
   555 
   556 Addsimps ([LListI RS Abs_LList_inverse, Rep_LList_inverse,
   557            Rep_LList RS LListD, rangeI, inj_Leaf, inv_f_f] @ llist.intrs);
   558 
   559 Goalw [llist_case_def,LNil_def]  "llist_case c d LNil = c";
   560 by (Simp_tac 1);
   561 qed "llist_case_LNil";
   562 
   563 Goalw [llist_case_def,LCons_def]
   564     "llist_case c d (LCons M N) = d M N";
   565 by (Simp_tac 1);
   566 qed "llist_case_LCons";
   567 
   568 (*Elimination is case analysis, not induction.*)
   569 val [prem1,prem2] = 
   570 Goalw [NIL_def,CONS_def]
   571      "[| l=LNil ==> P;  !!x l'. l=LCons x l' ==> P |] ==> P";
   572 by (rtac (Rep_LList RS LListD RS llist.elim) 1);
   573 by (rtac (inj_Rep_LList RS injD RS prem1) 1);
   574 by (stac Rep_LList_LNil 1);
   575 by (assume_tac 1);
   576 by (etac rangeE 1);
   577 by (rtac (inj_Rep_LList RS injD RS prem2) 1);
   578 by (asm_simp_tac (simpset() delsimps [CONS_CONS_eq] 
   579 		            addsimps [Rep_LList_LCons]) 1);
   580 by (etac (LListI RS Abs_LList_inverse RS ssubst) 1);
   581 by (rtac refl 1);
   582 qed "llistE";
   583 
   584 (** llist_corec: corecursion for 'a llist **)
   585 
   586 (*Lemma for the proof of llist_corec*)
   587 Goal "LList_corec a \
   588 \          (%z. case f z of None => None | Some(v,w) => Some(Leaf(v),w)) : \
   589 \       llist(range Leaf)";
   590 by (res_inst_tac [("X", "range(%x. LList_corec x ?g)")] llist_coinduct 1);
   591 by (rtac rangeI 1);
   592 by Safe_tac;
   593 by (stac LList_corec 1);
   594 by (Force_tac 1);
   595 qed "LList_corec_type2";
   596 
   597 Goalw [llist_corec_def,LNil_def,LCons_def]
   598     "llist_corec a f =  \
   599 \    (case f a of None => LNil | Some(z,w) => LCons z (llist_corec w f))";
   600 by (stac LList_corec 1);
   601 by (exhaust_tac "f a" 1);
   602 by (asm_simp_tac (simpset() addsimps [LList_corec_type2]) 1);
   603 by (force_tac (claset(), simpset() addsimps [LList_corec_type2]) 1);
   604 qed "llist_corec";
   605 
   606 (*definitional version of same*)
   607 val [rew] = 
   608 Goal "[| !!x. h(x) == llist_corec x f |] ==>     \
   609 \     h(a) = (case f a of None => LNil | Some(z,w) => LCons z (h w))";
   610 by (rewtac rew);
   611 by (rtac llist_corec 1);
   612 qed "def_llist_corec";
   613 
   614 (**** Proofs about type 'a llist functions ****)
   615 
   616 (*** Deriving llist_equalityI -- llist equality is a bisimulation ***)
   617 
   618 Goalw [LListD_Fun_def]
   619     "r <= (llist A) Times (llist A) ==> \
   620 \           LListD_Fun (diag A) r <= (llist A) Times (llist A)";
   621 by (stac llist_unfold 1);
   622 by (simp_tac (simpset() addsimps [NIL_def, CONS_def]) 1);
   623 by (Fast_tac 1);
   624 qed "LListD_Fun_subset_Times_llist";
   625 
   626 Goal "prod_fun Rep_LList Rep_LList `` r <= \
   627 \    (llist(range Leaf)) Times (llist(range Leaf))";
   628 by (fast_tac (claset() delrules [image_subsetI]
   629 		       addIs [Rep_LList RS LListD]) 1);
   630 qed "subset_Times_llist";
   631 
   632 Goal "r <= (llist(range Leaf)) Times (llist(range Leaf)) ==> \
   633 \    prod_fun (Rep_LList o Abs_LList) (Rep_LList o Abs_LList) `` r <= r";
   634 by Safe_tac;
   635 by (etac (subsetD RS SigmaE2) 1);
   636 by (assume_tac 1);
   637 by (asm_simp_tac (simpset() addsimps [LListI RS Abs_LList_inverse]) 1);
   638 qed "prod_fun_lemma";
   639 
   640 Goal "prod_fun Rep_LList  Rep_LList `` range(%x. (x, x)) = \
   641 \    diag(llist(range Leaf))";
   642 by (rtac equalityI 1);
   643 by (Blast_tac 1);
   644 by (fast_tac (claset() delSWrapper "split_all_tac"
   645 		       addSEs [LListI RS Abs_LList_inverse RS subst]) 1);
   646 qed "prod_fun_range_eq_diag";
   647 
   648 (*Used with lfilter*)
   649 Goalw [llistD_Fun_def, prod_fun_def]
   650     "A<=B ==> llistD_Fun A <= llistD_Fun B";
   651 by Auto_tac;
   652 by (rtac image_eqI 1);
   653 by (blast_tac (claset() addIs [impOfSubs LListD_Fun_mono]) 2);
   654 by (Force_tac 1);
   655 qed "llistD_Fun_mono";
   656 
   657 (** To show two llists are equal, exhibit a bisimulation! 
   658       [also admits true equality] **)
   659 Goalw [llistD_Fun_def]
   660     "[| (l1,l2) : r;  r <= llistD_Fun(r Un range(%x.(x,x))) |] ==> l1=l2";
   661 by (rtac (inj_Rep_LList RS injD) 1);
   662 by (res_inst_tac [("r", "prod_fun Rep_LList Rep_LList ``r"),
   663                   ("A", "range(Leaf)")] 
   664         LList_equalityI 1);
   665 by (etac prod_fun_imageI 1);
   666 by (etac (image_mono RS subset_trans) 1);
   667 by (rtac (image_compose RS subst) 1);
   668 by (rtac (prod_fun_compose RS subst) 1);
   669 by (stac image_Un 1);
   670 by (stac prod_fun_range_eq_diag 1);
   671 by (rtac (LListD_Fun_subset_Times_llist RS prod_fun_lemma) 1);
   672 by (rtac (subset_Times_llist RS Un_least) 1);
   673 by (rtac diag_subset_Times 1);
   674 qed "llist_equalityI";
   675 
   676 (** Rules to prove the 2nd premise of llist_equalityI **)
   677 Goalw [llistD_Fun_def,LNil_def] "(LNil,LNil) : llistD_Fun(r)";
   678 by (rtac (LListD_Fun_NIL_I RS prod_fun_imageI) 1);
   679 qed "llistD_Fun_LNil_I";
   680 
   681 Goalw [llistD_Fun_def,LCons_def]
   682     "(l1,l2):r ==> (LCons x l1, LCons x l2) : llistD_Fun(r)";
   683 by (rtac (rangeI RS LListD_Fun_CONS_I RS prod_fun_imageI) 1);
   684 by (etac prod_fun_imageI 1);
   685 qed "llistD_Fun_LCons_I";
   686 
   687 (*Utilise the "strong" part, i.e. gfp(f)*)
   688 Goalw [llistD_Fun_def] "(l,l) : llistD_Fun(r Un range(%x.(x,x)))";
   689 by (rtac (Rep_LList_inverse RS subst) 1);
   690 by (rtac prod_fun_imageI 1);
   691 by (stac image_Un 1);
   692 by (stac prod_fun_range_eq_diag 1);
   693 by (rtac (Rep_LList RS LListD RS LListD_Fun_diag_I) 1);
   694 qed "llistD_Fun_range_I";
   695 
   696 (*A special case of list_equality for functions over lazy lists*)
   697 val [prem1,prem2] =
   698 Goal "[| f(LNil)=g(LNil);                                                \
   699 \        !!x l. (f(LCons x l),g(LCons x l)) :                            \
   700 \               llistD_Fun(range(%u. (f(u),g(u))) Un range(%v. (v,v)))   \
   701 \     |] ==> f(l) = (g(l :: 'a llist) :: 'b llist)";
   702 by (res_inst_tac [("r", "range(%u. (f(u),g(u)))")] llist_equalityI 1);
   703 by (rtac rangeI 1);
   704 by (rtac subsetI 1);
   705 by (etac rangeE 1);
   706 by (etac ssubst 1);
   707 by (res_inst_tac [("l", "u")] llistE 1);
   708 by (etac ssubst 1);
   709 by (stac prem1 1);
   710 by (rtac llistD_Fun_range_I 1);
   711 by (etac ssubst 1);
   712 by (rtac prem2 1);
   713 qed "llist_fun_equalityI";
   714 
   715 (*simpset for llist bisimulations*)
   716 Addsimps [llist_case_LNil, llist_case_LCons, 
   717           llistD_Fun_LNil_I, llistD_Fun_LCons_I];
   718 
   719 
   720 (*** The functional "lmap" ***)
   721 
   722 Goal "lmap f LNil = LNil";
   723 by (rtac (lmap_def RS def_llist_corec RS trans) 1);
   724 by (Simp_tac 1);
   725 qed "lmap_LNil";
   726 
   727 Goal "lmap f (LCons M N) = LCons (f M) (lmap f N)";
   728 by (rtac (lmap_def RS def_llist_corec RS trans) 1);
   729 by (Simp_tac 1);
   730 qed "lmap_LCons";
   731 
   732 Addsimps [lmap_LNil, lmap_LCons];
   733 
   734 
   735 (** Two easy results about lmap **)
   736 
   737 Goal "lmap (f o g) l = lmap f (lmap g l)";
   738 by (res_inst_tac [("l","l")] llist_fun_equalityI 1);
   739 by (ALLGOALS Simp_tac);
   740 qed "lmap_compose";
   741 
   742 Goal "lmap (%x. x) l = l";
   743 by (res_inst_tac [("l","l")] llist_fun_equalityI 1);
   744 by (ALLGOALS Simp_tac);
   745 qed "lmap_ident";
   746 
   747 
   748 (*** iterates -- llist_fun_equalityI cannot be used! ***)
   749 
   750 Goal "iterates f x = LCons x (iterates f (f x))";
   751 by (rtac (iterates_def RS def_llist_corec RS trans) 1);
   752 by (Simp_tac 1);
   753 qed "iterates";
   754 
   755 Goal "lmap f (iterates f x) = iterates f (f x)";
   756 by (res_inst_tac [("r", "range(%u.(lmap f (iterates f u),iterates f (f u)))")] 
   757     llist_equalityI 1);
   758 by (rtac rangeI 1);
   759 by Safe_tac;
   760 by (res_inst_tac [("x1", "f(u)")] (iterates RS ssubst) 1);
   761 by (res_inst_tac [("x1", "u")] (iterates RS ssubst) 1);
   762 by (Simp_tac 1);
   763 qed "lmap_iterates";
   764 
   765 Goal "iterates f x = LCons x (lmap f (iterates f x))";
   766 by (stac lmap_iterates 1);
   767 by (rtac iterates 1);
   768 qed "iterates_lmap";
   769 
   770 (*** A rather complex proof about iterates -- cf Andy Pitts ***)
   771 
   772 (** Two lemmas about natrec n x (%m.g), which is essentially (g^n)(x) **)
   773 
   774 Goal "nat_rec (LCons b l) (%m. lmap(f)) n =      \
   775 \    LCons (nat_rec b (%m. f) n) (nat_rec l (%m. lmap(f)) n)";
   776 by (induct_tac "n" 1);
   777 by (ALLGOALS Asm_simp_tac);
   778 qed "fun_power_lmap";
   779 
   780 goal Nat.thy "nat_rec (g x) (%m. g) n = nat_rec x (%m. g) (Suc n)";
   781 by (induct_tac "n" 1);
   782 by (ALLGOALS Asm_simp_tac);
   783 qed "fun_power_Suc";
   784 
   785 val Pair_cong = read_instantiate_sg (sign_of Prod.thy)
   786  [("f","Pair")] (standard(refl RS cong RS cong));
   787 
   788 (*The bisimulation consists of {(lmap(f)^n (h(u)), lmap(f)^n (iterates(f,u)))}
   789   for all u and all n::nat.*)
   790 val [prem] = Goal "(!!x. h(x) = LCons x (lmap f (h x))) ==> h = iterates(f)";
   791 by (rtac ext 1);
   792 by (res_inst_tac [("r", 
   793    "UN u. range(%n. (nat_rec (h u) (%m y. lmap f y) n, \
   794 \                    nat_rec (iterates f u) (%m y. lmap f y) n))")] 
   795     llist_equalityI 1);
   796 by (REPEAT (resolve_tac [UN1_I, range_eqI, Pair_cong, nat_rec_0 RS sym] 1));
   797 by (Clarify_tac 1);
   798 by (stac iterates 1);
   799 by (stac prem 1);
   800 by (stac fun_power_lmap 1);
   801 by (stac fun_power_lmap 1);
   802 by (rtac llistD_Fun_LCons_I 1);
   803 by (rtac (lmap_iterates RS subst) 1);
   804 by (stac fun_power_Suc 1);
   805 by (stac fun_power_Suc 1);
   806 by (rtac (UN1_I RS UnI1) 1);
   807 by (rtac rangeI 1);
   808 qed "iterates_equality";
   809 
   810 
   811 (*** lappend -- its two arguments cause some complications! ***)
   812 
   813 Goalw [lappend_def] "lappend LNil LNil = LNil";
   814 by (rtac (llist_corec RS trans) 1);
   815 by (Simp_tac 1);
   816 qed "lappend_LNil_LNil";
   817 
   818 Goalw [lappend_def]
   819     "lappend LNil (LCons l l') = LCons l (lappend LNil l')";
   820 by (rtac (llist_corec RS trans) 1);
   821 by (Simp_tac 1);
   822 qed "lappend_LNil_LCons";
   823 
   824 Goalw [lappend_def]
   825     "lappend (LCons l l') N = LCons l (lappend l' N)";
   826 by (rtac (llist_corec RS trans) 1);
   827 by (Simp_tac 1);
   828 qed "lappend_LCons";
   829 
   830 Addsimps [lappend_LNil_LNil, lappend_LNil_LCons, lappend_LCons];
   831 
   832 Goal "lappend LNil l = l";
   833 by (res_inst_tac [("l","l")] llist_fun_equalityI 1);
   834 by (ALLGOALS Simp_tac);
   835 qed "lappend_LNil";
   836 
   837 Goal "lappend l LNil = l";
   838 by (res_inst_tac [("l","l")] llist_fun_equalityI 1);
   839 by (ALLGOALS Simp_tac);
   840 qed "lappend_LNil2";
   841 
   842 Addsimps [lappend_LNil, lappend_LNil2];
   843 
   844 (*The infinite first argument blocks the second*)
   845 Goal "lappend (iterates f x) N = iterates f x";
   846 by (res_inst_tac [("r", "range(%u.(lappend (iterates f u) N,iterates f u))")] 
   847     llist_equalityI 1);
   848 by (rtac rangeI 1);
   849 by Safe_tac;
   850 by (stac iterates 1);
   851 by (Simp_tac 1);
   852 qed "lappend_iterates";
   853 
   854 (** Two proofs that lmap distributes over lappend **)
   855 
   856 (*Long proof requiring case analysis on both both arguments*)
   857 Goal "lmap f (lappend l n) = lappend (lmap f l) (lmap f n)";
   858 by (res_inst_tac 
   859     [("r",  
   860       "UN n. range(%l.(lmap f (lappend l n),lappend (lmap f l) (lmap f n)))")] 
   861     llist_equalityI 1);
   862 by (rtac UN1_I 1);
   863 by (rtac rangeI 1);
   864 by Safe_tac;
   865 by (res_inst_tac [("l", "l")] llistE 1);
   866 by (res_inst_tac [("l", "n")] llistE 1);
   867 by (ALLGOALS Asm_simp_tac);
   868 by (REPEAT_SOME (ares_tac [llistD_Fun_LCons_I, UN1_I RS UnI1, rangeI]));
   869 qed "lmap_lappend_distrib";
   870 
   871 (*Shorter proof of theorem above using llist_equalityI as strong coinduction*)
   872 Goal "lmap f (lappend l n) = lappend (lmap f l) (lmap f n)";
   873 by (res_inst_tac [("l","l")] llist_fun_equalityI 1);
   874 by (Simp_tac 1);
   875 by (Simp_tac 1);
   876 qed "lmap_lappend_distrib";
   877 
   878 (*Without strong coinduction, three case analyses might be needed*)
   879 Goal "lappend (lappend l1 l2) l3 = lappend l1 (lappend l2 l3)";
   880 by (res_inst_tac [("l","l1")] llist_fun_equalityI 1);
   881 by (Simp_tac 1);
   882 by (Simp_tac 1);
   883 qed "lappend_assoc";