src/HOL/Induct/LList.ML
author berghofe
Fri Jul 24 13:19:38 1998 +0200 (1998-07-24)
changeset 5184 9b8547a9496a
parent 5148 74919e8f221c
child 5278 a903b66822e2
permissions -rw-r--r--
Adapted to new datatype package.
     1 (*  Title:      HOL/Induct/LList
     2     ID:         $Id$
     3     Author:     Lawrence C Paulson, Cambridge University Computer Laboratory
     4     Copyright   1993  University of Cambridge
     5 
     6 SHOULD LListD_Fun_CONS_I, etc., be equations (for rewriting)?
     7 *)
     8 
     9 bind_thm ("UN1_I", UNIV_I RS UN_I);
    10 
    11 (** Simplification **)
    12 
    13 Addsplits [split_split, split_sum_case];
    14 
    15 (*This justifies using llist in other recursive type definitions*)
    16 Goalw llist.defs "A<=B ==> llist(A) <= llist(B)";
    17 by (rtac gfp_mono 1);
    18 by (REPEAT (ares_tac basic_monos 1));
    19 qed "llist_mono";
    20 
    21 
    22 Goal "llist(A) = {Numb(0)} <+> (A <*> llist(A))";
    23 let val rew = rewrite_rule [NIL_def, CONS_def] in  
    24 by (fast_tac (claset() addSIs (map rew llist.intrs)
    25                       addEs [rew llist.elim]) 1)
    26 end;
    27 qed "llist_unfold";
    28 
    29 
    30 (*** Type checking by coinduction, using list_Fun 
    31      THE COINDUCTIVE DEFINITION PACKAGE COULD DO THIS!
    32 ***)
    33 
    34 Goalw [list_Fun_def]
    35     "[| M : X;  X <= list_Fun A (X Un llist(A)) |] ==>  M : llist(A)";
    36 by (etac llist.coinduct 1);
    37 by (etac (subsetD RS CollectD) 1);
    38 by (assume_tac 1);
    39 qed "llist_coinduct";
    40 
    41 Goalw [list_Fun_def, NIL_def] "NIL: list_Fun A X";
    42 by (Fast_tac 1);
    43 qed "list_Fun_NIL_I";
    44 AddIffs [list_Fun_NIL_I];
    45 
    46 Goalw [list_Fun_def,CONS_def]
    47     "[| M: A;  N: X |] ==> CONS M N : list_Fun A X";
    48 by (Fast_tac 1);
    49 qed "list_Fun_CONS_I";
    50 Addsimps [list_Fun_CONS_I];
    51 AddSIs   [list_Fun_CONS_I];
    52 
    53 (*Utilise the "strong" part, i.e. gfp(f)*)
    54 Goalw (llist.defs @ [list_Fun_def])
    55     "M: llist(A) ==> M : list_Fun A (X Un llist(A))";
    56 by (etac (llist.mono RS gfp_fun_UnI2) 1);
    57 qed "list_Fun_llist_I";
    58 
    59 (*** LList_corec satisfies the desired recurion equation ***)
    60 
    61 (*A continuity result?*)
    62 Goalw [CONS_def] "CONS M (UN x. f(x)) = (UN x. CONS M (f x))";
    63 by (simp_tac (simpset() addsimps [In1_UN1, Scons_UN1_y]) 1);
    64 qed "CONS_UN1";
    65 
    66 (*UNUSED; obsolete?
    67 goal Prod.thy "split p (%x y. UN z. f x y z) = (UN z. split p (%x y. f x y z))";
    68 by (Simp_tac 1);
    69 qed "split_UN1";
    70 
    71 goal Sum.thy "sum_case s f (%y. UN z. g y z) = (UN z. sum_case s f (%y. g y z))";
    72 by (Simp_tac 1);
    73 qed "sum_case2_UN1";
    74 *)
    75 
    76 val prems = goalw LList.thy [CONS_def]
    77     "[| M<=M';  N<=N' |] ==> CONS M N <= CONS M' N'";
    78 by (REPEAT (resolve_tac ([In1_mono,Scons_mono]@prems) 1));
    79 qed "CONS_mono";
    80 
    81 Addsimps [LList_corec_fun_def RS def_nat_rec_0,
    82           LList_corec_fun_def RS def_nat_rec_Suc];
    83 
    84 (** The directions of the equality are proved separately **)
    85 
    86 Goalw [LList_corec_def]
    87     "LList_corec a f <= sum_case (%u. NIL) \
    88 \                          (split(%z w. CONS z (LList_corec w f))) (f a)";
    89 by (rtac UN_least 1);
    90 by (exhaust_tac "k" 1);
    91 by (ALLGOALS Asm_simp_tac);
    92 by (REPEAT (resolve_tac [allI, impI, subset_refl RS CONS_mono, 
    93 			 UNIV_I RS UN_upper] 1));
    94 qed "LList_corec_subset1";
    95 
    96 Goalw [LList_corec_def]
    97     "sum_case (%u. NIL) (split(%z w. CONS z (LList_corec w f))) (f a) <= \
    98 \    LList_corec a f";
    99 by (simp_tac (simpset() addsimps [CONS_UN1]) 1);
   100 by Safe_tac;
   101 by (ALLGOALS (res_inst_tac [("a","Suc(?k)")] UN_I));
   102 by (ALLGOALS Asm_simp_tac);
   103 qed "LList_corec_subset2";
   104 
   105 (*the recursion equation for LList_corec -- NOT SUITABLE FOR REWRITING!*)
   106 Goal
   107     "LList_corec a f = sum_case (%u. NIL) \
   108 \                           (split(%z w. CONS z (LList_corec w f))) (f a)";
   109 by (REPEAT (resolve_tac [equalityI, LList_corec_subset1, 
   110                          LList_corec_subset2] 1));
   111 qed "LList_corec";
   112 
   113 (*definitional version of same*)
   114 val [rew] = goal LList.thy
   115     "[| !!x. h(x) == LList_corec x f |] ==>     \
   116 \    h(a) = sum_case (%u. NIL) (split(%z w. CONS z (h w))) (f a)";
   117 by (rewtac rew);
   118 by (rtac LList_corec 1);
   119 qed "def_LList_corec";
   120 
   121 (*A typical use of co-induction to show membership in the gfp. 
   122   Bisimulation is  range(%x. LList_corec x f) *)
   123 Goal "LList_corec a f : llist({u. True})";
   124 by (res_inst_tac [("X", "range(%x. LList_corec x ?g)")] llist_coinduct 1);
   125 by (rtac rangeI 1);
   126 by Safe_tac;
   127 by (stac LList_corec 1);
   128 by (Simp_tac 1);
   129 qed "LList_corec_type";
   130 
   131 (*Lemma for the proof of llist_corec*)
   132 Goal
   133    "LList_corec a (%z. sum_case Inl (split(%v w. Inr((Leaf(v),w)))) (f z)) : \
   134 \   llist(range Leaf)";
   135 by (res_inst_tac [("X", "range(%x. LList_corec x ?g)")] llist_coinduct 1);
   136 by (rtac rangeI 1);
   137 by Safe_tac;
   138 by (stac LList_corec 1);
   139 by (Asm_simp_tac 1);
   140 qed "LList_corec_type2";
   141 
   142 
   143 (**** llist equality as a gfp; the bisimulation principle ****)
   144 
   145 (*This theorem is actually used, unlike the many similar ones in ZF*)
   146 Goal "LListD(r) = diag({Numb(0)}) <++> (r <**> LListD(r))";
   147 let val rew = rewrite_rule [NIL_def, CONS_def] in  
   148 by (fast_tac (claset() addSIs (map rew LListD.intrs)
   149                       addEs [rew LListD.elim]) 1)
   150 end;
   151 qed "LListD_unfold";
   152 
   153 Goal "!M N. (M,N) : LListD(diag(A)) --> ntrunc k M = ntrunc k N";
   154 by (res_inst_tac [("n", "k")] less_induct 1);
   155 by (safe_tac ((claset_of Fun.thy) delrules [equalityI]));
   156 by (etac LListD.elim 1);
   157 by (safe_tac (claset_of Prod.thy delrules [equalityI] addSEs [diagE]));
   158 by (exhaust_tac "n" 1);
   159 by (Asm_simp_tac 1);
   160 by (rename_tac "n'" 1);
   161 by (exhaust_tac "n'" 1);
   162 by (asm_simp_tac (simpset() addsimps [CONS_def]) 1);
   163 by (asm_simp_tac (simpset() addsimps [CONS_def, less_Suc_eq]) 1);
   164 qed "LListD_implies_ntrunc_equality";
   165 
   166 (*The domain of the LListD relation*)
   167 Goalw (llist.defs @ [NIL_def, CONS_def])
   168     "fst``LListD(diag(A)) <= llist(A)";
   169 by (rtac gfp_upperbound 1);
   170 (*avoids unfolding LListD on the rhs*)
   171 by (res_inst_tac [("P", "%x. fst``x <= ?B")] (LListD_unfold RS ssubst) 1);
   172 by (Simp_tac 1);
   173 by (Fast_tac 1);
   174 qed "fst_image_LListD";
   175 
   176 (*This inclusion justifies the use of coinduction to show M=N*)
   177 Goal "LListD(diag(A)) <= diag(llist(A))";
   178 by (rtac subsetI 1);
   179 by (res_inst_tac [("p","x")] PairE 1);
   180 by Safe_tac;
   181 by (rtac diag_eqI 1);
   182 by (rtac (LListD_implies_ntrunc_equality RS spec RS spec RS mp RS 
   183           ntrunc_equality) 1);
   184 by (assume_tac 1);
   185 by (etac (fst_imageI RS (fst_image_LListD RS subsetD)) 1);
   186 qed "LListD_subset_diag";
   187 
   188 
   189 (** Coinduction, using LListD_Fun
   190     THE COINDUCTIVE DEFINITION PACKAGE COULD DO THIS!
   191  **)
   192 
   193 Goalw [LListD_Fun_def] "A<=B ==> LListD_Fun r A <= LListD_Fun r B";
   194 by (REPEAT (ares_tac basic_monos 1));
   195 qed "LListD_Fun_mono";
   196 
   197 Goalw [LListD_Fun_def]
   198     "[| M : X;  X <= LListD_Fun r (X Un LListD(r)) |] ==>  M : LListD(r)";
   199 by (etac LListD.coinduct 1);
   200 by (etac (subsetD RS CollectD) 1);
   201 by (assume_tac 1);
   202 qed "LListD_coinduct";
   203 
   204 Goalw [LListD_Fun_def,NIL_def] "(NIL,NIL) : LListD_Fun r s";
   205 by (Fast_tac 1);
   206 qed "LListD_Fun_NIL_I";
   207 
   208 Goalw [LListD_Fun_def,CONS_def]
   209  "[| x:A;  (M,N):s |] ==> (CONS x M, CONS x N) : LListD_Fun (diag A) s";
   210 by (Fast_tac 1);
   211 qed "LListD_Fun_CONS_I";
   212 
   213 (*Utilise the "strong" part, i.e. gfp(f)*)
   214 Goalw (LListD.defs @ [LListD_Fun_def])
   215     "M: LListD(r) ==> M : LListD_Fun r (X Un LListD(r))";
   216 by (etac (LListD.mono RS gfp_fun_UnI2) 1);
   217 qed "LListD_Fun_LListD_I";
   218 
   219 
   220 (*This converse inclusion helps to strengthen LList_equalityI*)
   221 Goal "diag(llist(A)) <= LListD(diag(A))";
   222 by (rtac subsetI 1);
   223 by (etac LListD_coinduct 1);
   224 by (rtac subsetI 1);
   225 by (etac diagE 1);
   226 by (etac ssubst 1);
   227 by (eresolve_tac [llist.elim] 1);
   228 by (ALLGOALS
   229     (asm_simp_tac (simpset() addsimps [diagI, LListD_Fun_NIL_I,
   230 				       LListD_Fun_CONS_I])));
   231 qed "diag_subset_LListD";
   232 
   233 Goal "LListD(diag(A)) = diag(llist(A))";
   234 by (REPEAT (resolve_tac [equalityI, LListD_subset_diag, 
   235                          diag_subset_LListD] 1));
   236 qed "LListD_eq_diag";
   237 
   238 Goal 
   239     "M: llist(A) ==> (M,M) : LListD_Fun (diag A) (X Un diag(llist(A)))";
   240 by (rtac (LListD_eq_diag RS subst) 1);
   241 by (rtac LListD_Fun_LListD_I 1);
   242 by (asm_simp_tac (simpset() addsimps [LListD_eq_diag, diagI]) 1);
   243 qed "LListD_Fun_diag_I";
   244 
   245 
   246 (** To show two LLists are equal, exhibit a bisimulation! 
   247       [also admits true equality]
   248    Replace "A" by some particular set, like {x.True}??? *)
   249 Goal 
   250     "[| (M,N) : r;  r <= LListD_Fun (diag A) (r Un diag(llist(A))) \
   251 \         |] ==>  M=N";
   252 by (rtac (LListD_subset_diag RS subsetD RS diagE) 1);
   253 by (etac LListD_coinduct 1);
   254 by (asm_simp_tac (simpset() addsimps [LListD_eq_diag]) 1);
   255 by Safe_tac;
   256 qed "LList_equalityI";
   257 
   258 
   259 (*** Finality of llist(A): Uniqueness of functions defined by corecursion ***)
   260 
   261 (*We must remove Pair_eq because it may turn an instance of reflexivity
   262   (h1 b, h2 b) = (h1 ?x17, h2 ?x17) into a conjunction! 
   263   (or strengthen the Solver?) 
   264 *)
   265 Delsimps [Pair_eq];
   266 
   267 (*abstract proof using a bisimulation*)
   268 val [prem1,prem2] = goal LList.thy
   269  "[| !!x. h1(x) = sum_case (%u. NIL) (split(%z w. CONS z (h1 w))) (f x);  \
   270 \    !!x. h2(x) = sum_case (%u. NIL) (split(%z w. CONS z (h2 w))) (f x) |]\
   271 \ ==> h1=h2";
   272 by (rtac ext 1);
   273 (*next step avoids an unknown (and flexflex pair) in simplification*)
   274 by (res_inst_tac [("A", "{u. True}"),
   275                   ("r", "range(%u. (h1(u),h2(u)))")] LList_equalityI 1);
   276 by (rtac rangeI 1);
   277 by Safe_tac;
   278 by (stac prem1 1);
   279 by (stac prem2 1);
   280 by (simp_tac (simpset() addsimps [LListD_Fun_NIL_I,
   281 				  CollectI RS LListD_Fun_CONS_I]) 1);
   282 qed "LList_corec_unique";
   283 
   284 val [prem] = goal LList.thy
   285  "[| !!x. h(x) = sum_case (%u. NIL) (split(%z w. CONS z (h w))) (f x) |] \
   286 \ ==> h = (%x. LList_corec x f)";
   287 by (rtac (LList_corec RS (prem RS LList_corec_unique)) 1);
   288 qed "equals_LList_corec";
   289 
   290 
   291 (** Obsolete LList_corec_unique proof: complete induction, not coinduction **)
   292 
   293 Goalw [CONS_def] "ntrunc (Suc 0) (CONS M N) = {}";
   294 by (rtac ntrunc_one_In1 1);
   295 qed "ntrunc_one_CONS";
   296 
   297 Goalw [CONS_def]
   298     "ntrunc (Suc(Suc(k))) (CONS M N) = CONS (ntrunc k M) (ntrunc k N)";
   299 by (Simp_tac 1);
   300 qed "ntrunc_CONS";
   301 
   302 Addsimps [ntrunc_one_CONS, ntrunc_CONS];
   303 
   304 
   305 val [prem1,prem2] = goal LList.thy
   306  "[| !!x. h1(x) = sum_case (%u. NIL) (split(%z w. CONS z (h1 w))) (f x);  \
   307 \    !!x. h2(x) = sum_case (%u. NIL) (split(%z w. CONS z (h2 w))) (f x) |]\
   308 \ ==> h1=h2";
   309 by (rtac (ntrunc_equality RS ext) 1);
   310 by (rename_tac "x k" 1);
   311 by (res_inst_tac [("x", "x")] spec 1);
   312 by (res_inst_tac [("n", "k")] less_induct 1);
   313 by (rename_tac "n" 1);
   314 by (rtac allI 1);
   315 by (rename_tac "y" 1);
   316 by (stac prem1 1);
   317 by (stac prem2 1);
   318 by (Simp_tac 1);
   319 by (strip_tac 1);
   320 by (exhaust_tac "n" 1);
   321 by (rename_tac "m" 2);
   322 by (exhaust_tac "m" 2);
   323 by (ALLGOALS (asm_simp_tac (simpset() addsimps [less_Suc_eq])));
   324 result();
   325 
   326 
   327 (*** Lconst -- defined directly using lfp, but equivalent to a LList_corec ***)
   328 
   329 Goal "mono(CONS(M))";
   330 by (REPEAT (ares_tac [monoI, subset_refl, CONS_mono] 1));
   331 qed "Lconst_fun_mono";
   332 
   333 (* Lconst(M) = CONS M (Lconst M) *)
   334 bind_thm ("Lconst", (Lconst_fun_mono RS (Lconst_def RS def_lfp_Tarski)));
   335 
   336 (*A typical use of co-induction to show membership in the gfp.
   337   The containing set is simply the singleton {Lconst(M)}. *)
   338 Goal "M:A ==> Lconst(M): llist(A)";
   339 by (rtac (singletonI RS llist_coinduct) 1);
   340 by Safe_tac;
   341 by (res_inst_tac [("P", "%u. u: ?A")] (Lconst RS ssubst) 1);
   342 by (REPEAT (ares_tac [list_Fun_CONS_I, singletonI, UnI1] 1));
   343 qed "Lconst_type";
   344 
   345 Goal "Lconst(M) = LList_corec M (%x. Inr((x,x)))";
   346 by (rtac (equals_LList_corec RS fun_cong) 1);
   347 by (Simp_tac 1);
   348 by (rtac Lconst 1);
   349 qed "Lconst_eq_LList_corec";
   350 
   351 (*Thus we could have used gfp in the definition of Lconst*)
   352 Goal "gfp(%N. CONS M N) = LList_corec M (%x. Inr((x,x)))";
   353 by (rtac (equals_LList_corec RS fun_cong) 1);
   354 by (Simp_tac 1);
   355 by (rtac (Lconst_fun_mono RS gfp_Tarski) 1);
   356 qed "gfp_Lconst_eq_LList_corec";
   357 
   358 
   359 (*** Isomorphisms ***)
   360 
   361 Goal "inj(Rep_llist)";
   362 by (rtac inj_inverseI 1);
   363 by (rtac Rep_llist_inverse 1);
   364 qed "inj_Rep_llist";
   365 
   366 Goal "inj_on Abs_llist (llist(range Leaf))";
   367 by (rtac inj_on_inverseI 1);
   368 by (etac Abs_llist_inverse 1);
   369 qed "inj_on_Abs_llist";
   370 
   371 (** Distinctness of constructors **)
   372 
   373 Goalw [LNil_def,LCons_def] "~ LCons x xs = LNil";
   374 by (rtac (CONS_not_NIL RS (inj_on_Abs_llist RS inj_on_contraD)) 1);
   375 by (REPEAT (resolve_tac (llist.intrs @ [rangeI, Rep_llist]) 1));
   376 qed "LCons_not_LNil";
   377 
   378 bind_thm ("LNil_not_LCons", LCons_not_LNil RS not_sym);
   379 
   380 AddIffs [LCons_not_LNil, LNil_not_LCons];
   381 
   382 
   383 (** llist constructors **)
   384 
   385 Goalw [LNil_def]
   386     "Rep_llist(LNil) = NIL";
   387 by (rtac (llist.NIL_I RS Abs_llist_inverse) 1);
   388 qed "Rep_llist_LNil";
   389 
   390 Goalw [LCons_def]
   391     "Rep_llist(LCons x l) = CONS (Leaf x) (Rep_llist l)";
   392 by (REPEAT (resolve_tac [llist.CONS_I RS Abs_llist_inverse,
   393                          rangeI, Rep_llist] 1));
   394 qed "Rep_llist_LCons";
   395 
   396 (** Injectiveness of CONS and LCons **)
   397 
   398 Goalw [CONS_def] "(CONS M N=CONS M' N') = (M=M' & N=N')";
   399 by (fast_tac (claset() addSEs [Scons_inject]) 1);
   400 qed "CONS_CONS_eq2";
   401 
   402 bind_thm ("CONS_inject", (CONS_CONS_eq RS iffD1 RS conjE));
   403 
   404 
   405 (*For reasoning about abstract llist constructors*)
   406 
   407 AddIs ([Rep_llist]@llist.intrs);
   408 AddSDs [inj_on_Abs_llist RS inj_onD,
   409         inj_Rep_llist RS injD, Leaf_inject];
   410 
   411 Goalw [LCons_def] "(LCons x xs=LCons y ys) = (x=y & xs=ys)";
   412 by (Fast_tac 1);
   413 qed "LCons_LCons_eq";
   414 
   415 AddIffs [LCons_LCons_eq];
   416 
   417 val [major] = goal LList.thy "CONS M N: llist(A) ==> M: A & N: llist(A)";
   418 by (rtac (major RS llist.elim) 1);
   419 by (etac CONS_neq_NIL 1);
   420 by (Fast_tac 1);
   421 qed "CONS_D2";
   422 
   423 
   424 (****** Reasoning about llist(A) ******)
   425 
   426 Addsimps [List_case_NIL, List_case_CONS];
   427 
   428 (*A special case of list_equality for functions over lazy lists*)
   429 val [Mlist,gMlist,NILcase,CONScase] = goal LList.thy
   430  "[| M: llist(A); g(NIL): llist(A);                             \
   431 \    f(NIL)=g(NIL);                                             \
   432 \    !!x l. [| x:A;  l: llist(A) |] ==>                         \
   433 \           (f(CONS x l),g(CONS x l)) :                         \
   434 \               LListD_Fun (diag A) ((%u.(f(u),g(u)))``llist(A) Un  \
   435 \                                   diag(llist(A)))             \
   436 \ |] ==> f(M) = g(M)";
   437 by (rtac LList_equalityI 1);
   438 by (rtac (Mlist RS imageI) 1);
   439 by (rtac image_subsetI 1);
   440 by (etac llist.elim 1);
   441 by (etac ssubst 1);
   442 by (stac NILcase 1);
   443 by (rtac (gMlist RS LListD_Fun_diag_I) 1);
   444 by (etac ssubst 1);
   445 by (REPEAT (ares_tac [CONScase] 1));
   446 qed "LList_fun_equalityI";
   447 
   448 
   449 (*** The functional "Lmap" ***)
   450 
   451 Goal "Lmap f NIL = NIL";
   452 by (rtac (Lmap_def RS def_LList_corec RS trans) 1);
   453 by (Simp_tac 1);
   454 qed "Lmap_NIL";
   455 
   456 Goal "Lmap f (CONS M N) = CONS (f M) (Lmap f N)";
   457 by (rtac (Lmap_def RS def_LList_corec RS trans) 1);
   458 by (Simp_tac 1);
   459 qed "Lmap_CONS";
   460 
   461 Addsimps [Lmap_NIL, Lmap_CONS];
   462 
   463 (*Another type-checking proof by coinduction*)
   464 val [major,minor] = goal LList.thy
   465     "[| M: llist(A);  !!x. x:A ==> f(x):B |] ==> Lmap f M: llist(B)";
   466 by (rtac (major RS imageI RS llist_coinduct) 1);
   467 by Safe_tac;
   468 by (etac llist.elim 1);
   469 by (ALLGOALS Asm_simp_tac);
   470 by (REPEAT (ares_tac [list_Fun_NIL_I, list_Fun_CONS_I, 
   471                       minor, imageI, UnI1] 1));
   472 qed "Lmap_type";
   473 
   474 (*This type checking rule synthesises a sufficiently large set for f*)
   475 val [major] = goal LList.thy  "M: llist(A) ==> Lmap f M: llist(f``A)";
   476 by (rtac (major RS Lmap_type) 1);
   477 by (etac imageI 1);
   478 qed "Lmap_type2";
   479 
   480 (** Two easy results about Lmap **)
   481 
   482 val [prem] = goalw LList.thy [o_def]
   483     "M: llist(A) ==> Lmap (f o g) M = Lmap f (Lmap g M)";
   484 by (rtac (prem RS imageI RS LList_equalityI) 1);
   485 by Safe_tac;
   486 by (etac llist.elim 1);
   487 by (ALLGOALS Asm_simp_tac);
   488 by (REPEAT (ares_tac [LListD_Fun_NIL_I, imageI, UnI1,
   489                       rangeI RS LListD_Fun_CONS_I] 1));
   490 qed "Lmap_compose";
   491 
   492 val [prem] = goal LList.thy "M: llist(A) ==> Lmap (%x. x) M = M";
   493 by (rtac (prem RS imageI RS LList_equalityI) 1);
   494 by Safe_tac;
   495 by (etac llist.elim 1);
   496 by (ALLGOALS Asm_simp_tac);
   497 by (REPEAT (ares_tac [LListD_Fun_NIL_I, imageI RS UnI1,
   498                       rangeI RS LListD_Fun_CONS_I] 1));
   499 qed "Lmap_ident";
   500 
   501 
   502 (*** Lappend -- its two arguments cause some complications! ***)
   503 
   504 Goalw [Lappend_def] "Lappend NIL NIL = NIL";
   505 by (rtac (LList_corec RS trans) 1);
   506 by (Simp_tac 1);
   507 qed "Lappend_NIL_NIL";
   508 
   509 Goalw [Lappend_def]
   510     "Lappend NIL (CONS N N') = CONS N (Lappend NIL N')";
   511 by (rtac (LList_corec RS trans) 1);
   512 by (Simp_tac 1);
   513 qed "Lappend_NIL_CONS";
   514 
   515 Goalw [Lappend_def]
   516     "Lappend (CONS M M') N = CONS M (Lappend M' N)";
   517 by (rtac (LList_corec RS trans) 1);
   518 by (Simp_tac 1);
   519 qed "Lappend_CONS";
   520 
   521 Addsimps [llist.NIL_I, Lappend_NIL_NIL, Lappend_NIL_CONS,
   522           Lappend_CONS, LListD_Fun_CONS_I, range_eqI, image_eqI];
   523 
   524 
   525 Goal "M: llist(A) ==> Lappend NIL M = M";
   526 by (etac LList_fun_equalityI 1);
   527 by (ALLGOALS Asm_simp_tac);
   528 qed "Lappend_NIL";
   529 
   530 Goal "M: llist(A) ==> Lappend M NIL = M";
   531 by (etac LList_fun_equalityI 1);
   532 by (ALLGOALS Asm_simp_tac);
   533 qed "Lappend_NIL2";
   534 
   535 Addsimps [Lappend_NIL, Lappend_NIL2];
   536 
   537 
   538 (** Alternative type-checking proofs for Lappend **)
   539 
   540 (*weak co-induction: bisimulation and case analysis on both variables*)
   541 Goal
   542     "[| M: llist(A); N: llist(A) |] ==> Lappend M N: llist(A)";
   543 by (res_inst_tac
   544     [("X", "UN u:llist(A). UN v: llist(A). {Lappend u v}")] llist_coinduct 1);
   545 by (Fast_tac 1);
   546 by Safe_tac;
   547 by (eres_inst_tac [("aa", "u")] llist.elim 1);
   548 by (eres_inst_tac [("aa", "v")] llist.elim 1);
   549 by (ALLGOALS Asm_simp_tac);
   550 by (Blast_tac 1);
   551 qed "Lappend_type";
   552 
   553 (*strong co-induction: bisimulation and case analysis on one variable*)
   554 Goal
   555     "[| M: llist(A); N: llist(A) |] ==> Lappend M N: llist(A)";
   556 by (res_inst_tac [("X", "(%u. Lappend u N)``llist(A)")] llist_coinduct 1);
   557 by (etac imageI 1);
   558 by (rtac image_subsetI 1);
   559 by (eres_inst_tac [("aa", "x")] llist.elim 1);
   560 by (asm_simp_tac (simpset() addsimps [list_Fun_llist_I]) 1);
   561 by (Asm_simp_tac 1);
   562 qed "Lappend_type";
   563 
   564 (**** Lazy lists as the type 'a llist -- strongly typed versions of above ****)
   565 
   566 (** llist_case: case analysis for 'a llist **)
   567 
   568 Addsimps ([Abs_llist_inverse, Rep_llist_inverse,
   569            Rep_llist, rangeI, inj_Leaf, inv_f_f] @ llist.intrs);
   570 
   571 Goalw [llist_case_def,LNil_def]  "llist_case c d LNil = c";
   572 by (Simp_tac 1);
   573 qed "llist_case_LNil";
   574 
   575 Goalw [llist_case_def,LCons_def]
   576     "llist_case c d (LCons M N) = d M N";
   577 by (Simp_tac 1);
   578 qed "llist_case_LCons";
   579 
   580 (*Elimination is case analysis, not induction.*)
   581 val [prem1,prem2] = goalw LList.thy [NIL_def,CONS_def]
   582     "[| l=LNil ==> P;  !!x l'. l=LCons x l' ==> P \
   583 \    |] ==> P";
   584 by (rtac (Rep_llist RS llist.elim) 1);
   585 by (rtac (inj_Rep_llist RS injD RS prem1) 1);
   586 by (stac Rep_llist_LNil 1);
   587 by (assume_tac 1);
   588 by (etac rangeE 1);
   589 by (rtac (inj_Rep_llist RS injD RS prem2) 1);
   590 by (asm_simp_tac (simpset() delsimps [CONS_CONS_eq] 
   591 		            addsimps [Rep_llist_LCons]) 1);
   592 by (etac (Abs_llist_inverse RS ssubst) 1);
   593 by (rtac refl 1);
   594 qed "llistE";
   595 
   596 (** llist_corec: corecursion for 'a llist **)
   597 
   598 Goalw [llist_corec_def,LNil_def,LCons_def]
   599     "llist_corec a f = sum_case (%u. LNil) \
   600 \                           (split(%z w. LCons z (llist_corec w f))) (f a)";
   601 by (stac LList_corec 1);
   602 by (res_inst_tac [("s","f(a)")] sumE 1);
   603 by (asm_simp_tac (simpset() addsimps [LList_corec_type2]) 1);
   604 by (res_inst_tac [("p","y")] PairE 1);
   605 by (asm_simp_tac (simpset() addsimps [LList_corec_type2]) 1);
   606 (*FIXME: correct case splits usd to be found automatically:
   607 by (ASM_SIMP_TAC(simpset() addsimps [LList_corec_type2]) 1);*)
   608 qed "llist_corec";
   609 
   610 (*definitional version of same*)
   611 val [rew] = goal LList.thy
   612     "[| !!x. h(x) == llist_corec x f |] ==>     \
   613 \    h(a) = sum_case (%u. LNil) (split(%z w. LCons z (h w))) (f a)";
   614 by (rewtac rew);
   615 by (rtac llist_corec 1);
   616 qed "def_llist_corec";
   617 
   618 (**** Proofs about type 'a llist functions ****)
   619 
   620 (*** Deriving llist_equalityI -- llist equality is a bisimulation ***)
   621 
   622 Goalw [LListD_Fun_def]
   623     "r <= (llist A) Times (llist A) ==> \
   624 \           LListD_Fun (diag A) r <= (llist A) Times (llist A)";
   625 by (stac llist_unfold 1);
   626 by (simp_tac (simpset() addsimps [NIL_def, CONS_def]) 1);
   627 by (Fast_tac 1);
   628 qed "LListD_Fun_subset_Sigma_llist";
   629 
   630 Goal
   631     "prod_fun Rep_llist Rep_llist `` r <= \
   632 \    (llist(range Leaf)) Times (llist(range Leaf))";
   633 by (fast_tac (claset() delrules [image_subsetI]
   634 		       addIs [Rep_llist]) 1);
   635 qed "subset_Sigma_llist";
   636 
   637 val [prem] = goal LList.thy
   638     "r <= (llist(range Leaf)) Times (llist(range Leaf)) ==> \
   639 \    prod_fun (Rep_llist o Abs_llist) (Rep_llist o Abs_llist) `` r <= r";
   640 by Safe_tac;
   641 by (rtac (prem RS subsetD RS SigmaE2) 1);
   642 by (assume_tac 1);
   643 by (asm_simp_tac (simpset() addsimps [Abs_llist_inverse]) 1);
   644 qed "prod_fun_lemma";
   645 
   646 Goal
   647     "prod_fun Rep_llist  Rep_llist `` range(%x. (x, x)) = \
   648 \    diag(llist(range Leaf))";
   649 by (rtac equalityI 1);
   650 by (fast_tac (claset() addIs [Rep_llist]) 1);
   651 by (fast_tac (claset() delSWrapper "split_all_tac"
   652 		       addSEs [Abs_llist_inverse RS subst]) 1);
   653 qed "prod_fun_range_eq_diag";
   654 
   655 (*Surprisingly hard to prove.  Used with lfilter*)
   656 Goalw [llistD_Fun_def, prod_fun_def]
   657     "A<=B ==> llistD_Fun A <= llistD_Fun B";
   658 by Auto_tac;
   659 by (rtac image_eqI 1);
   660 by (fast_tac (claset() addss (simpset())) 1);
   661 by (blast_tac (claset() addIs [impOfSubs LListD_Fun_mono]) 1);
   662 qed "llistD_Fun_mono";
   663 
   664 (** To show two llists are equal, exhibit a bisimulation! 
   665       [also admits true equality] **)
   666 val [prem1,prem2] = goalw LList.thy [llistD_Fun_def]
   667     "[| (l1,l2) : r;  r <= llistD_Fun(r Un range(%x.(x,x))) |] ==> l1=l2";
   668 by (rtac (inj_Rep_llist RS injD) 1);
   669 by (res_inst_tac [("r", "prod_fun Rep_llist Rep_llist ``r"),
   670                   ("A", "range(Leaf)")] 
   671         LList_equalityI 1);
   672 by (rtac (prem1 RS prod_fun_imageI) 1);
   673 by (rtac (prem2 RS image_mono RS subset_trans) 1);
   674 by (rtac (image_compose RS subst) 1);
   675 by (rtac (prod_fun_compose RS subst) 1);
   676 by (stac image_Un 1);
   677 by (stac prod_fun_range_eq_diag 1);
   678 by (rtac (LListD_Fun_subset_Sigma_llist RS prod_fun_lemma) 1);
   679 by (rtac (subset_Sigma_llist RS Un_least) 1);
   680 by (rtac diag_subset_Sigma 1);
   681 qed "llist_equalityI";
   682 
   683 (** Rules to prove the 2nd premise of llist_equalityI **)
   684 Goalw [llistD_Fun_def,LNil_def] "(LNil,LNil) : llistD_Fun(r)";
   685 by (rtac (LListD_Fun_NIL_I RS prod_fun_imageI) 1);
   686 qed "llistD_Fun_LNil_I";
   687 
   688 val [prem] = goalw LList.thy [llistD_Fun_def,LCons_def]
   689     "(l1,l2):r ==> (LCons x l1, LCons x l2) : llistD_Fun(r)";
   690 by (rtac (rangeI RS LListD_Fun_CONS_I RS prod_fun_imageI) 1);
   691 by (rtac (prem RS prod_fun_imageI) 1);
   692 qed "llistD_Fun_LCons_I";
   693 
   694 (*Utilise the "strong" part, i.e. gfp(f)*)
   695 Goalw [llistD_Fun_def]
   696      "(l,l) : llistD_Fun(r Un range(%x.(x,x)))";
   697 by (rtac (Rep_llist_inverse RS subst) 1);
   698 by (rtac prod_fun_imageI 1);
   699 by (stac image_Un 1);
   700 by (stac prod_fun_range_eq_diag 1);
   701 by (rtac (Rep_llist RS LListD_Fun_diag_I) 1);
   702 qed "llistD_Fun_range_I";
   703 
   704 (*A special case of list_equality for functions over lazy lists*)
   705 val [prem1,prem2] = goal LList.thy
   706     "[| f(LNil)=g(LNil);                                                \
   707 \       !!x l. (f(LCons x l),g(LCons x l)) :                            \
   708 \              llistD_Fun(range(%u. (f(u),g(u))) Un range(%v. (v,v)))   \
   709 \    |] ==> f(l) = (g(l :: 'a llist) :: 'b llist)";
   710 by (res_inst_tac [("r", "range(%u. (f(u),g(u)))")] llist_equalityI 1);
   711 by (rtac rangeI 1);
   712 by (rtac subsetI 1);
   713 by (etac rangeE 1);
   714 by (etac ssubst 1);
   715 by (res_inst_tac [("l", "u")] llistE 1);
   716 by (etac ssubst 1);
   717 by (stac prem1 1);
   718 by (rtac llistD_Fun_range_I 1);
   719 by (etac ssubst 1);
   720 by (rtac prem2 1);
   721 qed "llist_fun_equalityI";
   722 
   723 (*simpset for llist bisimulations*)
   724 Addsimps [llist_case_LNil, llist_case_LCons, 
   725           llistD_Fun_LNil_I, llistD_Fun_LCons_I];
   726 
   727 
   728 (*** The functional "lmap" ***)
   729 
   730 Goal "lmap f LNil = LNil";
   731 by (rtac (lmap_def RS def_llist_corec RS trans) 1);
   732 by (Simp_tac 1);
   733 qed "lmap_LNil";
   734 
   735 Goal "lmap f (LCons M N) = LCons (f M) (lmap f N)";
   736 by (rtac (lmap_def RS def_llist_corec RS trans) 1);
   737 by (Simp_tac 1);
   738 qed "lmap_LCons";
   739 
   740 Addsimps [lmap_LNil, lmap_LCons];
   741 
   742 
   743 (** Two easy results about lmap **)
   744 
   745 Goal "lmap (f o g) l = lmap f (lmap g l)";
   746 by (res_inst_tac [("l","l")] llist_fun_equalityI 1);
   747 by (ALLGOALS Simp_tac);
   748 qed "lmap_compose";
   749 
   750 Goal "lmap (%x. x) l = l";
   751 by (res_inst_tac [("l","l")] llist_fun_equalityI 1);
   752 by (ALLGOALS Simp_tac);
   753 qed "lmap_ident";
   754 
   755 
   756 (*** iterates -- llist_fun_equalityI cannot be used! ***)
   757 
   758 Goal "iterates f x = LCons x (iterates f (f x))";
   759 by (rtac (iterates_def RS def_llist_corec RS trans) 1);
   760 by (Simp_tac 1);
   761 qed "iterates";
   762 
   763 Goal "lmap f (iterates f x) = iterates f (f x)";
   764 by (res_inst_tac [("r", "range(%u.(lmap f (iterates f u),iterates f (f u)))")] 
   765     llist_equalityI 1);
   766 by (rtac rangeI 1);
   767 by Safe_tac;
   768 by (res_inst_tac [("x1", "f(u)")] (iterates RS ssubst) 1);
   769 by (res_inst_tac [("x1", "u")] (iterates RS ssubst) 1);
   770 by (Simp_tac 1);
   771 qed "lmap_iterates";
   772 
   773 Goal "iterates f x = LCons x (lmap f (iterates f x))";
   774 by (stac lmap_iterates 1);
   775 by (rtac iterates 1);
   776 qed "iterates_lmap";
   777 
   778 (*** A rather complex proof about iterates -- cf Andy Pitts ***)
   779 
   780 (** Two lemmas about natrec n x (%m.g), which is essentially (g^n)(x) **)
   781 
   782 Goal
   783     "nat_rec (LCons b l) (%m. lmap(f)) n =      \
   784 \    LCons (nat_rec b (%m. f) n) (nat_rec l (%m. lmap(f)) n)";
   785 by (induct_tac "n" 1);
   786 by (ALLGOALS Asm_simp_tac);
   787 qed "fun_power_lmap";
   788 
   789 goal Nat.thy "nat_rec (g x) (%m. g) n = nat_rec x (%m. g) (Suc n)";
   790 by (induct_tac "n" 1);
   791 by (ALLGOALS Asm_simp_tac);
   792 qed "fun_power_Suc";
   793 
   794 val Pair_cong = read_instantiate_sg (sign_of Prod.thy)
   795  [("f","Pair")] (standard(refl RS cong RS cong));
   796 
   797 (*The bisimulation consists of {(lmap(f)^n (h(u)), lmap(f)^n (iterates(f,u)))}
   798   for all u and all n::nat.*)
   799 val [prem] = goal LList.thy
   800     "(!!x. h(x) = LCons x (lmap f (h x))) ==> h = iterates(f)";
   801 by (rtac ext 1);
   802 by (res_inst_tac [("r", 
   803    "UN u. range(%n. (nat_rec (h u) (%m y. lmap f y) n, \
   804 \                    nat_rec (iterates f u) (%m y. lmap f y) n))")] 
   805     llist_equalityI 1);
   806 by (REPEAT (resolve_tac [UN1_I, range_eqI, Pair_cong, nat_rec_0 RS sym] 1));
   807 by (Clarify_tac 1);
   808 by (stac iterates 1);
   809 by (stac prem 1);
   810 by (stac fun_power_lmap 1);
   811 by (stac fun_power_lmap 1);
   812 by (rtac llistD_Fun_LCons_I 1);
   813 by (rtac (lmap_iterates RS subst) 1);
   814 by (stac fun_power_Suc 1);
   815 by (stac fun_power_Suc 1);
   816 by (rtac (UN1_I RS UnI1) 1);
   817 by (rtac rangeI 1);
   818 qed "iterates_equality";
   819 
   820 
   821 (*** lappend -- its two arguments cause some complications! ***)
   822 
   823 Goalw [lappend_def] "lappend LNil LNil = LNil";
   824 by (rtac (llist_corec RS trans) 1);
   825 by (Simp_tac 1);
   826 qed "lappend_LNil_LNil";
   827 
   828 Goalw [lappend_def]
   829     "lappend LNil (LCons l l') = LCons l (lappend LNil l')";
   830 by (rtac (llist_corec RS trans) 1);
   831 by (Simp_tac 1);
   832 qed "lappend_LNil_LCons";
   833 
   834 Goalw [lappend_def]
   835     "lappend (LCons l l') N = LCons l (lappend l' N)";
   836 by (rtac (llist_corec RS trans) 1);
   837 by (Simp_tac 1);
   838 qed "lappend_LCons";
   839 
   840 Addsimps [lappend_LNil_LNil, lappend_LNil_LCons, lappend_LCons];
   841 
   842 Goal "lappend LNil l = l";
   843 by (res_inst_tac [("l","l")] llist_fun_equalityI 1);
   844 by (ALLGOALS Simp_tac);
   845 qed "lappend_LNil";
   846 
   847 Goal "lappend l LNil = l";
   848 by (res_inst_tac [("l","l")] llist_fun_equalityI 1);
   849 by (ALLGOALS Simp_tac);
   850 qed "lappend_LNil2";
   851 
   852 Addsimps [lappend_LNil, lappend_LNil2];
   853 
   854 (*The infinite first argument blocks the second*)
   855 Goal "lappend (iterates f x) N = iterates f x";
   856 by (res_inst_tac [("r", "range(%u.(lappend (iterates f u) N,iterates f u))")] 
   857     llist_equalityI 1);
   858 by (rtac rangeI 1);
   859 by Safe_tac;
   860 by (stac iterates 1);
   861 by (Simp_tac 1);
   862 qed "lappend_iterates";
   863 
   864 (** Two proofs that lmap distributes over lappend **)
   865 
   866 (*Long proof requiring case analysis on both both arguments*)
   867 Goal "lmap f (lappend l n) = lappend (lmap f l) (lmap f n)";
   868 by (res_inst_tac 
   869     [("r",  
   870       "UN n. range(%l.(lmap f (lappend l n),lappend (lmap f l) (lmap f n)))")] 
   871     llist_equalityI 1);
   872 by (rtac UN1_I 1);
   873 by (rtac rangeI 1);
   874 by Safe_tac;
   875 by (res_inst_tac [("l", "l")] llistE 1);
   876 by (res_inst_tac [("l", "n")] llistE 1);
   877 by (ALLGOALS Asm_simp_tac);
   878 by (REPEAT_SOME (ares_tac [llistD_Fun_LCons_I, UN1_I RS UnI1, rangeI]));
   879 qed "lmap_lappend_distrib";
   880 
   881 (*Shorter proof of theorem above using llist_equalityI as strong coinduction*)
   882 Goal "lmap f (lappend l n) = lappend (lmap f l) (lmap f n)";
   883 by (res_inst_tac [("l","l")] llist_fun_equalityI 1);
   884 by (Simp_tac 1);
   885 by (Simp_tac 1);
   886 qed "lmap_lappend_distrib";
   887 
   888 (*Without strong coinduction, three case analyses might be needed*)
   889 Goal "lappend (lappend l1 l2) l3 = lappend l1 (lappend l2 l3)";
   890 by (res_inst_tac [("l","l1")] llist_fun_equalityI 1);
   891 by (Simp_tac 1);
   892 by (Simp_tac 1);
   893 qed "lappend_assoc";