src/HOL/SPARK/Tools/spark_vcs.ML
author wenzelm
Mon Nov 19 20:23:47 2012 +0100 (2012-11-19 ago)
changeset 50126 3dec88149176
parent 48453 2421ff8c57a5
child 51717 9e7d1c139569
permissions -rw-r--r--
theorem status about oracles/futures is no longer printed by default;
renamed Proofterm/Thm.status_of to Proofterm/Thm.peek_status to emphasize its semantics;
     1 (*  Title:      HOL/SPARK/Tools/spark_vcs.ML
     2     Author:     Stefan Berghofer
     3     Copyright:  secunet Security Networks AG
     4 
     5 Store for verification conditions generated by SPARK/Ada.
     6 *)
     7 
     8 signature SPARK_VCS =
     9 sig
    10   val set_vcs: Fdl_Parser.decls -> Fdl_Parser.rules ->
    11     (string * string) * Fdl_Parser.vcs -> Path.T -> string -> theory -> theory
    12   val add_proof_fun: (typ option -> 'a -> term) ->
    13     string * ((string list * string) option * 'a) ->
    14     theory -> theory
    15   val add_type: string * (typ * (string * string) list) -> theory -> theory
    16   val lookup_vc: theory -> bool -> string -> (Element.context_i list *
    17     (string * thm list option * Element.context_i * Element.statement_i)) option
    18   val get_vcs: theory -> bool ->
    19     Element.context_i list * (binding * thm) list * (string *
    20     (string * thm list option * Element.context_i * Element.statement_i)) list
    21   val mark_proved: string -> thm list -> theory -> theory
    22   val close: bool -> theory -> theory
    23   val is_closed: theory -> bool
    24 end;
    25 
    26 structure SPARK_VCs: SPARK_VCS =
    27 struct
    28 
    29 open Fdl_Parser;
    30 
    31 
    32 (** theory data **)
    33 
    34 fun err_unfinished () = error "An unfinished SPARK environment is still open."
    35 
    36 val strip_number = pairself implode o take_suffix Fdl_Lexer.is_digit o raw_explode;
    37 
    38 val name_ord = prod_ord string_ord (option_ord int_ord) o
    39   pairself (strip_number ##> Int.fromString);
    40 
    41 structure VCtab = Table(type key = string val ord = name_ord);
    42 
    43 structure VCs = Theory_Data
    44 (
    45   type T =
    46     {pfuns: ((string list * string) option * term) Symtab.table,
    47      type_map: (typ * (string * string) list) Symtab.table,
    48      env:
    49        {ctxt: Element.context_i list,
    50         defs: (binding * thm) list,
    51         types: fdl_type tab,
    52         funs: (string list * string) tab,
    53         pfuns: ((string list * string) option * term) Symtab.table,
    54         ids: (term * string) Symtab.table * Name.context,
    55         proving: bool,
    56         vcs: (string * thm list option *
    57           (string * expr) list * (string * expr) list) VCtab.table,
    58         path: Path.T,
    59         prefix: string} option}
    60   val empty : T = {pfuns = Symtab.empty, type_map = Symtab.empty, env = NONE}
    61   val extend = I
    62   fun merge ({pfuns = pfuns1, type_map = type_map1, env = NONE},
    63         {pfuns = pfuns2, type_map = type_map2, env = NONE}) =
    64         {pfuns = Symtab.merge (eq_pair (op =) (op aconv)) (pfuns1, pfuns2),
    65          type_map = Symtab.merge (op =) (type_map1, type_map2),
    66          env = NONE}
    67     | merge _ = err_unfinished ()
    68 )
    69 
    70 
    71 (** utilities **)
    72 
    73 val to_lower = raw_explode #> map Symbol.to_ascii_lower #> implode;
    74 
    75 val lcase_eq = (op =) o pairself (to_lower o Long_Name.base_name);
    76 
    77 fun lookup_prfx "" tab s = Symtab.lookup tab s
    78   | lookup_prfx prfx tab s = (case Symtab.lookup tab s of
    79         NONE => Symtab.lookup tab (prfx ^ "__" ^ s)
    80       | x => x);
    81 
    82 fun strip_prfx s =
    83   let
    84     fun strip ys [] = ("", implode ys)
    85       | strip ys ("_" :: "_" :: xs) = (implode (rev xs), implode ys)
    86       | strip ys (x :: xs) = strip (x :: ys) xs
    87   in strip [] (rev (raw_explode s)) end;
    88 
    89 fun unprefix_pfun "" s = s
    90   | unprefix_pfun prfx s =
    91       let val (prfx', s') = strip_prfx s
    92       in if prfx = prfx' then s' else s end;
    93 
    94 fun mk_unop s t =
    95   let val T = fastype_of t
    96   in Const (s, T --> T) $ t end;
    97 
    98 fun mk_times (t, u) =
    99   let
   100     val setT = fastype_of t;
   101     val T = HOLogic.dest_setT setT;
   102     val U = HOLogic.dest_setT (fastype_of u)
   103   in
   104     Const (@{const_name Sigma}, setT --> (T --> HOLogic.mk_setT U) -->
   105       HOLogic.mk_setT (HOLogic.mk_prodT (T, U))) $ t $ Abs ("", T, u)
   106   end;
   107 
   108 fun get_type thy prfx ty =
   109   let val {type_map, ...} = VCs.get thy
   110   in lookup_prfx prfx type_map ty end;
   111 
   112 fun mk_type' _ _ "integer" = (HOLogic.intT, [])
   113   | mk_type' _ _ "boolean" = (HOLogic.boolT, [])
   114   | mk_type' thy prfx ty =
   115       (case get_type thy prfx ty of
   116          NONE =>
   117            (Syntax.check_typ (Proof_Context.init_global thy)
   118               (Type (Sign.full_name thy (Binding.name ty), [])),
   119             [])
   120        | SOME p => p);
   121 
   122 fun mk_type thy prfx ty = fst (mk_type' thy prfx ty);
   123 
   124 val booleanN = "boolean";
   125 val integerN = "integer";
   126 
   127 fun define_overloaded (def_name, eq) lthy =
   128   let
   129     val ((c, _), rhs) = eq |> Syntax.check_term lthy |>
   130       Logic.dest_equals |>> dest_Free;
   131     val ((_, (_, thm)), lthy') = Local_Theory.define
   132       ((Binding.name c, NoSyn), ((Binding.name def_name, []), rhs)) lthy
   133     val ctxt_thy = Proof_Context.init_global (Proof_Context.theory_of lthy');
   134     val thm' = singleton (Proof_Context.export lthy' ctxt_thy) thm
   135   in (thm', lthy') end;
   136 
   137 fun strip_underscores s =
   138   strip_underscores (unsuffix "_" s) handle Fail _ => s;
   139 
   140 fun strip_tilde s =
   141   unsuffix "~" s ^ "_init" handle Fail _ => s;
   142 
   143 val mangle_name = strip_underscores #> strip_tilde;
   144 
   145 fun mk_variables thy prfx xs ty (tab, ctxt) =
   146   let
   147     val T = mk_type thy prfx ty;
   148     val (ys, ctxt') = fold_map Name.variant (map mangle_name xs) ctxt;
   149     val zs = map (Free o rpair T) ys;
   150   in (zs, (fold (Symtab.update o apsnd (rpair ty)) (xs ~~ zs) tab, ctxt')) end;
   151 
   152 fun get_record_info thy T = (case Record.dest_recTs T of
   153     [(tyname, [@{typ unit}])] =>
   154       Record.get_info thy (Long_Name.qualifier tyname)
   155   | _ => NONE);
   156 
   157 fun find_field [] fname fields =
   158       find_first (curry lcase_eq fname o fst) fields
   159   | find_field cmap fname fields =
   160       (case AList.lookup (op =) cmap fname of
   161          NONE => NONE
   162        | SOME fname' => SOME (fname', the (AList.lookup (op =) fields fname')));
   163 
   164 fun find_field' fname = get_first (fn (flds, fldty) =>
   165   if member (op =) flds fname then SOME fldty else NONE);
   166 
   167 fun assoc_ty_err thy T s msg =
   168   error ("Type " ^ Syntax.string_of_typ_global thy T ^
   169     " associated with SPARK type " ^ s ^ "\n" ^ msg);
   170 
   171 
   172 (** generate properties of enumeration types **)
   173 
   174 fun add_enum_type tyname tyname' thy =
   175   let
   176     val {case_name, ...} = the (Datatype.get_info thy tyname');
   177     val cs = map Const (the (Datatype.get_constrs thy tyname'));
   178     val k = length cs;
   179     val T = Type (tyname', []);
   180     val p = Const (@{const_name pos}, T --> HOLogic.intT);
   181     val v = Const (@{const_name val}, HOLogic.intT --> T);
   182     val card = Const (@{const_name card},
   183       HOLogic.mk_setT T --> HOLogic.natT) $ HOLogic.mk_UNIV T;
   184 
   185     fun mk_binrel_def s f = Logic.mk_equals
   186       (Const (s, T --> T --> HOLogic.boolT),
   187        Abs ("x", T, Abs ("y", T,
   188          Const (s, HOLogic.intT --> HOLogic.intT --> HOLogic.boolT) $
   189            (f $ Bound 1) $ (f $ Bound 0))));
   190 
   191     val (((def1, def2), def3), lthy) = thy |>
   192 
   193       Class.instantiation ([tyname'], [], @{sort spark_enum}) |>
   194 
   195       define_overloaded ("pos_" ^ tyname ^ "_def", Logic.mk_equals
   196         (p,
   197          list_comb (Const (case_name, replicate k HOLogic.intT @
   198              [T] ---> HOLogic.intT),
   199            map (HOLogic.mk_number HOLogic.intT) (0 upto k - 1)))) ||>>
   200 
   201       define_overloaded ("less_eq_" ^ tyname ^ "_def",
   202         mk_binrel_def @{const_name less_eq} p) ||>>
   203       define_overloaded ("less_" ^ tyname ^ "_def",
   204         mk_binrel_def @{const_name less} p);
   205 
   206     val UNIV_eq = Goal.prove lthy [] []
   207       (HOLogic.mk_Trueprop (HOLogic.mk_eq
   208          (HOLogic.mk_UNIV T, HOLogic.mk_set T cs)))
   209       (fn _ =>
   210          rtac @{thm subset_antisym} 1 THEN
   211          rtac @{thm subsetI} 1 THEN
   212          Datatype_Aux.exh_tac (K (#exhaust (Datatype.the_info
   213            (Proof_Context.theory_of lthy) tyname'))) 1 THEN
   214          ALLGOALS (asm_full_simp_tac (simpset_of lthy)));
   215 
   216     val finite_UNIV = Goal.prove lthy [] []
   217       (HOLogic.mk_Trueprop (Const (@{const_name finite},
   218          HOLogic.mk_setT T --> HOLogic.boolT) $ HOLogic.mk_UNIV T))
   219       (fn _ => simp_tac (simpset_of lthy addsimps [UNIV_eq]) 1);
   220 
   221     val card_UNIV = Goal.prove lthy [] []
   222       (HOLogic.mk_Trueprop (HOLogic.mk_eq
   223          (card, HOLogic.mk_number HOLogic.natT k)))
   224       (fn _ => simp_tac (simpset_of lthy addsimps [UNIV_eq]) 1);
   225 
   226     val range_pos = Goal.prove lthy [] []
   227       (HOLogic.mk_Trueprop (HOLogic.mk_eq
   228          (Const (@{const_name image}, (T --> HOLogic.intT) -->
   229             HOLogic.mk_setT T --> HOLogic.mk_setT HOLogic.intT) $
   230               p $ HOLogic.mk_UNIV T,
   231           Const (@{const_name atLeastLessThan}, HOLogic.intT -->
   232             HOLogic.intT --> HOLogic.mk_setT HOLogic.intT) $
   233               HOLogic.mk_number HOLogic.intT 0 $
   234               (@{term int} $ card))))
   235       (fn _ =>
   236          simp_tac (simpset_of lthy addsimps [card_UNIV]) 1 THEN
   237          simp_tac (simpset_of lthy addsimps [UNIV_eq, def1]) 1 THEN
   238          rtac @{thm subset_antisym} 1 THEN
   239          simp_tac (simpset_of lthy) 1 THEN
   240          rtac @{thm subsetI} 1 THEN
   241          asm_full_simp_tac (simpset_of lthy addsimps @{thms interval_expand}
   242            delsimps @{thms atLeastLessThan_iff}) 1);
   243 
   244     val lthy' =
   245       Class.prove_instantiation_instance (fn _ =>
   246         Class.intro_classes_tac [] THEN
   247         rtac finite_UNIV 1 THEN
   248         rtac range_pos 1 THEN
   249         simp_tac (HOL_basic_ss addsimps [def3]) 1 THEN
   250         simp_tac (HOL_basic_ss addsimps [def2]) 1) lthy;
   251 
   252     val (pos_eqs, val_eqs) = split_list (map_index (fn (i, c) =>
   253       let
   254         val n = HOLogic.mk_number HOLogic.intT i;
   255         val th = Goal.prove lthy' [] []
   256           (HOLogic.mk_Trueprop (HOLogic.mk_eq (p $ c, n)))
   257           (fn _ => simp_tac (simpset_of lthy' addsimps [def1]) 1);
   258         val th' = Goal.prove lthy' [] []
   259           (HOLogic.mk_Trueprop (HOLogic.mk_eq (v $ n, c)))
   260           (fn _ =>
   261              rtac (@{thm inj_pos} RS @{thm injD}) 1 THEN
   262              simp_tac (simpset_of lthy' addsimps
   263                [@{thm pos_val}, range_pos, card_UNIV, th]) 1)
   264       in (th, th') end) cs);
   265 
   266     val first_el = Goal.prove lthy' [] []
   267       (HOLogic.mk_Trueprop (HOLogic.mk_eq
   268          (Const (@{const_name first_el}, T), hd cs)))
   269       (fn _ => simp_tac (simpset_of lthy' addsimps
   270          [@{thm first_el_def}, hd val_eqs]) 1);
   271 
   272     val last_el = Goal.prove lthy' [] []
   273       (HOLogic.mk_Trueprop (HOLogic.mk_eq
   274          (Const (@{const_name last_el}, T), List.last cs)))
   275       (fn _ => simp_tac (simpset_of lthy' addsimps
   276          [@{thm last_el_def}, List.last val_eqs, card_UNIV]) 1);
   277   in
   278     lthy' |>
   279     Local_Theory.note
   280       ((Binding.name (tyname ^ "_card"), @{attributes [simp]}), [card_UNIV]) ||>>
   281     Local_Theory.note
   282       ((Binding.name (tyname ^ "_pos"), @{attributes [simp]}), pos_eqs) ||>>
   283     Local_Theory.note
   284       ((Binding.name (tyname ^ "_val"), @{attributes [simp]}), val_eqs) ||>>
   285     Local_Theory.note
   286       ((Binding.name (tyname ^ "_first_el"), @{attributes [simp]}), [first_el]) ||>>
   287     Local_Theory.note
   288       ((Binding.name (tyname ^ "_last_el"), @{attributes [simp]}), [last_el]) |> snd |>
   289     Local_Theory.exit_global
   290   end;
   291 
   292 
   293 fun check_no_assoc thy prfx s = case get_type thy prfx s of
   294     NONE => ()
   295   | SOME _ => error ("Cannot associate a type with " ^ s ^
   296       "\nsince it is no record or enumeration type");
   297 
   298 fun check_enum [] [] = NONE 
   299   | check_enum els [] = SOME ("has no element(s) " ^ commas els)
   300   | check_enum [] cs = SOME ("has extra element(s) " ^
   301       commas (map (Long_Name.base_name o fst) cs))
   302   | check_enum (el :: els) ((cname, _) :: cs) =
   303       if lcase_eq (el, cname) then check_enum els cs
   304       else SOME ("either has no element " ^ el ^
   305         " or it is at the wrong position");
   306 
   307 fun invert_map [] = I
   308   | invert_map cmap =
   309       map (apfst (the o AList.lookup (op =) (map swap cmap)));
   310  
   311 fun add_type_def prfx (s, Basic_Type ty) (ids, thy) =
   312       (check_no_assoc thy prfx s;
   313        (ids,
   314         Typedecl.abbrev_global (Binding.name s, [], NoSyn)
   315           (mk_type thy prfx ty) thy |> snd))
   316 
   317   | add_type_def prfx (s, Enum_Type els) ((tab, ctxt), thy) =
   318       let
   319         val (thy', tyname) = (case get_type thy prfx s of
   320             NONE =>
   321               let
   322                 val tyb = Binding.name s;
   323                 val tyname = Sign.full_name thy tyb
   324               in
   325                 (thy |>
   326                  Datatype.add_datatype {strict = true, quiet = true}
   327                    [((tyb, [], NoSyn),
   328                      map (fn s => (Binding.name s, [], NoSyn)) els)] |> snd |>
   329                  add_enum_type s tyname,
   330                  tyname)
   331               end
   332           | SOME (T as Type (tyname, []), cmap) =>
   333               (case Datatype.get_constrs thy tyname of
   334                  NONE => assoc_ty_err thy T s "is not a datatype"
   335                | SOME cs =>
   336                    let val (prfx', _) = strip_prfx s
   337                    in
   338                      case check_enum (map (unprefix_pfun prfx') els)
   339                          (invert_map cmap cs) of
   340                        NONE => (thy, tyname)
   341                      | SOME msg => assoc_ty_err thy T s msg
   342                    end)
   343           | SOME (T, _) => assoc_ty_err thy T s "is not a datatype");
   344         val cs = map Const (the (Datatype.get_constrs thy' tyname));
   345       in
   346         ((fold (Symtab.update_new o apsnd (rpair s)) (els ~~ cs) tab,
   347           fold Name.declare els ctxt),
   348          thy')
   349       end
   350 
   351   | add_type_def prfx (s, Array_Type (argtys, resty)) (ids, thy) =
   352       (check_no_assoc thy prfx s;
   353        (ids,
   354         Typedecl.abbrev_global (Binding.name s, [], NoSyn)
   355           (foldr1 HOLogic.mk_prodT (map (mk_type thy prfx) argtys) -->
   356              mk_type thy prfx resty) thy |> snd))
   357 
   358   | add_type_def prfx (s, Record_Type fldtys) (ids, thy) =
   359       (ids,
   360        let val fldTs = maps (fn (flds, ty) =>
   361          map (rpair (mk_type thy prfx ty)) flds) fldtys
   362        in case get_type thy prfx s of
   363            NONE =>
   364              Record.add_record ([], Binding.name s) NONE
   365                (map (fn (fld, T) => (Binding.name fld, T, NoSyn)) fldTs) thy
   366          | SOME (rT, cmap) =>
   367              (case get_record_info thy rT of
   368                 NONE => assoc_ty_err thy rT s "is not a record type"
   369               | SOME {fields, ...} =>
   370                   let val fields' = invert_map cmap fields
   371                   in
   372                     (case subtract (lcase_eq o pairself fst) fldTs fields' of
   373                        [] => ()
   374                      | flds => assoc_ty_err thy rT s ("has extra field(s) " ^
   375                          commas (map (Long_Name.base_name o fst) flds));
   376                      map (fn (fld, T) =>
   377                        case AList.lookup lcase_eq fields' fld of
   378                          NONE => assoc_ty_err thy rT s ("has no field " ^ fld)
   379                        | SOME U => T = U orelse assoc_ty_err thy rT s
   380                            ("has field " ^
   381                             fld ^ " whose type\n" ^
   382                             Syntax.string_of_typ_global thy U ^
   383                             "\ndoes not match declared type\n" ^
   384                             Syntax.string_of_typ_global thy T)) fldTs;
   385                      thy)
   386                   end)
   387        end)
   388 
   389   | add_type_def prfx (s, Pending_Type) (ids, thy) =
   390       (ids,
   391        case get_type thy prfx s of
   392          SOME _ => thy
   393        | NONE => Typedecl.typedecl_global
   394            (Binding.name s, [], NoSyn) thy |> snd);
   395 
   396 
   397 fun term_of_expr thy prfx types pfuns =
   398   let
   399     fun tm_of vs (Funct ("->", [e, e'])) =
   400           (HOLogic.mk_imp (fst (tm_of vs e), fst (tm_of vs e')), booleanN)
   401 
   402       | tm_of vs (Funct ("<->", [e, e'])) =
   403           (HOLogic.mk_eq (fst (tm_of vs e), fst (tm_of vs e')), booleanN)
   404 
   405       | tm_of vs (Funct ("or", [e, e'])) =
   406           (HOLogic.mk_disj (fst (tm_of vs e), fst (tm_of vs e')), booleanN)
   407 
   408       | tm_of vs (Funct ("and", [e, e'])) =
   409           (HOLogic.mk_conj (fst (tm_of vs e), fst (tm_of vs e')), booleanN)
   410 
   411       | tm_of vs (Funct ("not", [e])) =
   412           (HOLogic.mk_not (fst (tm_of vs e)), booleanN)
   413 
   414       | tm_of vs (Funct ("=", [e, e'])) =
   415           (HOLogic.mk_eq (fst (tm_of vs e), fst (tm_of vs e')), booleanN)
   416 
   417       | tm_of vs (Funct ("<>", [e, e'])) = (HOLogic.mk_not
   418           (HOLogic.mk_eq (fst (tm_of vs e), fst (tm_of vs e'))), booleanN)
   419 
   420       | tm_of vs (Funct ("<", [e, e'])) = (HOLogic.mk_binrel @{const_name less}
   421           (fst (tm_of vs e), fst (tm_of vs e')), booleanN)
   422 
   423       | tm_of vs (Funct (">", [e, e'])) = (HOLogic.mk_binrel @{const_name less}
   424           (fst (tm_of vs e'), fst (tm_of vs e)), booleanN)
   425 
   426       | tm_of vs (Funct ("<=", [e, e'])) = (HOLogic.mk_binrel @{const_name less_eq}
   427           (fst (tm_of vs e), fst (tm_of vs e')), booleanN)
   428 
   429       | tm_of vs (Funct (">=", [e, e'])) = (HOLogic.mk_binrel @{const_name less_eq}
   430           (fst (tm_of vs e'), fst (tm_of vs e)), booleanN)
   431 
   432       | tm_of vs (Funct ("+", [e, e'])) = (HOLogic.mk_binop @{const_name plus}
   433           (fst (tm_of vs e), fst (tm_of vs e')), integerN)
   434 
   435       | tm_of vs (Funct ("-", [e, e'])) = (HOLogic.mk_binop @{const_name minus}
   436           (fst (tm_of vs e), fst (tm_of vs e')), integerN)
   437 
   438       | tm_of vs (Funct ("*", [e, e'])) = (HOLogic.mk_binop @{const_name times}
   439           (fst (tm_of vs e), fst (tm_of vs e')), integerN)
   440 
   441       | tm_of vs (Funct ("/", [e, e'])) = (HOLogic.mk_binop @{const_name divide}
   442           (fst (tm_of vs e), fst (tm_of vs e')), integerN)
   443 
   444       | tm_of vs (Funct ("div", [e, e'])) = (HOLogic.mk_binop @{const_name sdiv}
   445           (fst (tm_of vs e), fst (tm_of vs e')), integerN)
   446 
   447       | tm_of vs (Funct ("mod", [e, e'])) = (HOLogic.mk_binop @{const_name mod}
   448           (fst (tm_of vs e), fst (tm_of vs e')), integerN)
   449 
   450       | tm_of vs (Funct ("-", [e])) =
   451           (mk_unop @{const_name uminus} (fst (tm_of vs e)), integerN)
   452 
   453       | tm_of vs (Funct ("**", [e, e'])) =
   454           (Const (@{const_name power}, HOLogic.intT --> HOLogic.natT -->
   455              HOLogic.intT) $ fst (tm_of vs e) $
   456                (@{const nat} $ fst (tm_of vs e')), integerN)
   457 
   458       | tm_of (tab, _) (Ident s) =
   459           (case Symtab.lookup tab s of
   460              SOME t_ty => t_ty
   461            | NONE => (case lookup_prfx prfx pfuns s of
   462                SOME (SOME ([], resty), t) => (t, resty)
   463              | _ => error ("Undeclared identifier " ^ s)))
   464 
   465       | tm_of _ (Number i) = (HOLogic.mk_number HOLogic.intT i, integerN)
   466 
   467       | tm_of vs (Quantifier (s, xs, ty, e)) =
   468           let
   469             val (ys, vs') = mk_variables thy prfx xs ty vs;
   470             val q = (case s of
   471                 "for_all" => HOLogic.mk_all
   472               | "for_some" => HOLogic.mk_exists)
   473           in
   474             (fold_rev (fn Free (x, T) => fn t => q (x, T, t))
   475                ys (fst (tm_of vs' e)),
   476              booleanN)
   477           end
   478 
   479       | tm_of vs (Funct (s, es)) =
   480 
   481           (* record field selection *)
   482           (case try (unprefix "fld_") s of
   483              SOME fname => (case es of
   484                [e] =>
   485                  let
   486                    val (t, rcdty) = tm_of vs e;
   487                    val (rT, cmap) = mk_type' thy prfx rcdty
   488                  in case (get_record_info thy rT, lookup types rcdty) of
   489                      (SOME {fields, ...}, SOME (Record_Type fldtys)) =>
   490                        (case (find_field cmap fname fields,
   491                             find_field' fname fldtys) of
   492                           (SOME (fname', fT), SOME fldty) =>
   493                             (Const (fname', rT --> fT) $ t, fldty)
   494                         | _ => error ("Record " ^ rcdty ^
   495                             " has no field named " ^ fname))
   496                    | _ => error (rcdty ^ " is not a record type")
   497                  end
   498              | _ => error ("Function " ^ s ^ " expects one argument"))
   499            | NONE =>
   500 
   501           (* record field update *)
   502           (case try (unprefix "upf_") s of
   503              SOME fname => (case es of
   504                [e, e'] =>
   505                  let
   506                    val (t, rcdty) = tm_of vs e;
   507                    val (rT, cmap) = mk_type' thy prfx rcdty;
   508                    val (u, fldty) = tm_of vs e';
   509                    val fT = mk_type thy prfx fldty
   510                  in case get_record_info thy rT of
   511                      SOME {fields, ...} =>
   512                        (case find_field cmap fname fields of
   513                           SOME (fname', fU) =>
   514                             if fT = fU then
   515                               (Const (fname' ^ "_update",
   516                                  (fT --> fT) --> rT --> rT) $
   517                                    Abs ("x", fT, u) $ t,
   518                                rcdty)
   519                             else error ("Type\n" ^
   520                               Syntax.string_of_typ_global thy fT ^
   521                               "\ndoes not match type\n" ^
   522                               Syntax.string_of_typ_global thy fU ^
   523                               "\nof field " ^ fname)
   524                         | NONE => error ("Record " ^ rcdty ^
   525                             " has no field named " ^ fname))
   526                    | _ => error (rcdty ^ " is not a record type")
   527                  end
   528              | _ => error ("Function " ^ s ^ " expects two arguments"))
   529            | NONE =>
   530 
   531           (* enumeration type to integer *)
   532           (case try (unsuffix "__pos") s of
   533              SOME tyname => (case es of
   534                [e] => (Const (@{const_name pos},
   535                    mk_type thy prfx tyname --> HOLogic.intT) $ fst (tm_of vs e),
   536                  integerN)
   537              | _ => error ("Function " ^ s ^ " expects one argument"))
   538            | NONE =>
   539 
   540           (* integer to enumeration type *)
   541           (case try (unsuffix "__val") s of
   542              SOME tyname => (case es of
   543                [e] => (Const (@{const_name val},
   544                    HOLogic.intT --> mk_type thy prfx tyname) $ fst (tm_of vs e),
   545                  tyname)
   546              | _ => error ("Function " ^ s ^ " expects one argument"))
   547            | NONE =>
   548 
   549           (* successor / predecessor of enumeration type element *)
   550           if s = "succ" orelse s = "pred" then (case es of
   551               [e] =>
   552                 let
   553                   val (t, tyname) = tm_of vs e;
   554                   val T = mk_type thy prfx tyname
   555                 in (Const
   556                   (if s = "succ" then @{const_name succ}
   557                    else @{const_name pred}, T --> T) $ t, tyname)
   558                 end
   559             | _ => error ("Function " ^ s ^ " expects one argument"))
   560 
   561           (* user-defined proof function *)
   562           else
   563             (case lookup_prfx prfx pfuns s of
   564                SOME (SOME (_, resty), t) =>
   565                  (list_comb (t, map (fst o tm_of vs) es), resty)
   566              | _ => error ("Undeclared proof function " ^ s))))))
   567 
   568       | tm_of vs (Element (e, es)) =
   569           let val (t, ty) = tm_of vs e
   570           in case lookup types ty of
   571               SOME (Array_Type (_, elty)) =>
   572                 (t $ foldr1 HOLogic.mk_prod (map (fst o tm_of vs) es), elty)
   573             | _ => error (ty ^ " is not an array type")
   574           end
   575 
   576       | tm_of vs (Update (e, es, e')) =
   577           let val (t, ty) = tm_of vs e
   578           in case lookup types ty of
   579               SOME (Array_Type (idxtys, elty)) =>
   580                 let
   581                   val T = foldr1 HOLogic.mk_prodT
   582                     (map (mk_type thy prfx) idxtys);
   583                   val U = mk_type thy prfx elty;
   584                   val fT = T --> U
   585                 in
   586                   (Const (@{const_name fun_upd}, fT --> T --> U --> fT) $
   587                      t $ foldr1 HOLogic.mk_prod (map (fst o tm_of vs) es) $
   588                        fst (tm_of vs e'),
   589                    ty)
   590                 end
   591             | _ => error (ty ^ " is not an array type")
   592           end
   593 
   594       | tm_of vs (Record (s, flds)) =
   595           let
   596             val (T, cmap) = mk_type' thy prfx s;
   597             val {extension = (ext_name, _), fields, ...} =
   598               (case get_record_info thy T of
   599                  NONE => error (s ^ " is not a record type")
   600                | SOME info => info);
   601             val flds' = map (apsnd (tm_of vs)) flds;
   602             val fnames = fields |> invert_map cmap |>
   603               map (Long_Name.base_name o fst);
   604             val fnames' = map fst flds;
   605             val (fvals, ftys) = split_list (map (fn s' =>
   606               case AList.lookup lcase_eq flds' s' of
   607                 SOME fval_ty => fval_ty
   608               | NONE => error ("Field " ^ s' ^ " missing in record " ^ s))
   609                   fnames);
   610             val _ = (case subtract lcase_eq fnames fnames' of
   611                 [] => ()
   612               | xs => error ("Extra field(s) " ^ commas xs ^
   613                   " in record " ^ s));
   614             val _ = (case duplicates (op =) fnames' of
   615                 [] => ()
   616               | xs => error ("Duplicate field(s) " ^ commas xs ^
   617                   " in record " ^ s))
   618           in
   619             (list_comb
   620                (Const (ext_name,
   621                   map (mk_type thy prfx) ftys @ [HOLogic.unitT] ---> T),
   622                 fvals @ [HOLogic.unit]),
   623              s)
   624           end
   625 
   626       | tm_of vs (Array (s, default, assocs)) =
   627           (case lookup types s of
   628              SOME (Array_Type (idxtys, elty)) =>
   629                let
   630                  val Ts = map (mk_type thy prfx) idxtys;
   631                  val T = foldr1 HOLogic.mk_prodT Ts;
   632                  val U = mk_type thy prfx elty;
   633                  fun mk_idx' T (e, NONE) = HOLogic.mk_set T [fst (tm_of vs e)]
   634                    | mk_idx' T (e, SOME e') = Const (@{const_name atLeastAtMost},
   635                        T --> T --> HOLogic.mk_setT T) $
   636                          fst (tm_of vs e) $ fst (tm_of vs e');
   637                  fun mk_idx idx =
   638                    if length Ts <> length idx then
   639                      error ("Arity mismatch in construction of array " ^ s)
   640                    else foldr1 mk_times (map2 mk_idx' Ts idx);
   641                  fun mk_upd (idxs, e) t =
   642                    if length idxs = 1 andalso forall (is_none o snd) (hd idxs)
   643                    then
   644                      Const (@{const_name fun_upd}, (T --> U) -->
   645                          T --> U --> T --> U) $ t $
   646                        foldl1 HOLogic.mk_prod
   647                          (map (fst o tm_of vs o fst) (hd idxs)) $
   648                        fst (tm_of vs e)
   649                    else
   650                      Const (@{const_name fun_upds}, (T --> U) -->
   651                          HOLogic.mk_setT T --> U --> T --> U) $ t $
   652                        foldl1 (HOLogic.mk_binop @{const_name sup})
   653                          (map mk_idx idxs) $
   654                        fst (tm_of vs e)
   655                in
   656                  (fold mk_upd assocs
   657                     (case default of
   658                        SOME e => Abs ("x", T, fst (tm_of vs e))
   659                      | NONE => Const (@{const_name undefined}, T --> U)),
   660                   s)
   661                end
   662            | _ => error (s ^ " is not an array type"))
   663 
   664   in tm_of end;
   665 
   666 
   667 fun term_of_rule thy prfx types pfuns ids rule =
   668   let val tm_of = fst o term_of_expr thy prfx types pfuns ids
   669   in case rule of
   670       Inference_Rule (es, e) => Logic.list_implies
   671         (map (HOLogic.mk_Trueprop o tm_of) es, HOLogic.mk_Trueprop (tm_of e))
   672     | Substitution_Rule (es, e, e') => Logic.list_implies
   673         (map (HOLogic.mk_Trueprop o tm_of) es,
   674          HOLogic.mk_Trueprop (HOLogic.mk_eq (tm_of e, tm_of e')))
   675   end;
   676 
   677 
   678 val builtin = Symtab.make (map (rpair ())
   679   ["->", "<->", "or", "and", "not", "=", "<>", "<", ">", "<=", ">=",
   680    "+", "-", "*", "/", "div", "mod", "**"]);
   681 
   682 fun complex_expr (Number _) = false
   683   | complex_expr (Ident _) = false 
   684   | complex_expr (Funct (s, es)) =
   685       not (Symtab.defined builtin s) orelse exists complex_expr es
   686   | complex_expr (Quantifier (_, _, _, e)) = complex_expr e
   687   | complex_expr _ = true;
   688 
   689 fun complex_rule (Inference_Rule (es, e)) =
   690       complex_expr e orelse exists complex_expr es
   691   | complex_rule (Substitution_Rule (es, e, e')) =
   692       complex_expr e orelse complex_expr e' orelse
   693       exists complex_expr es;
   694 
   695 val is_pfun =
   696   Symtab.defined builtin orf
   697   can (unprefix "fld_") orf can (unprefix "upf_") orf
   698   can (unsuffix "__pos") orf can (unsuffix "__val") orf
   699   equal "succ" orf equal "pred";
   700 
   701 fun fold_opt f = the_default I o Option.map f;
   702 fun fold_pair f g (x, y) = f x #> g y;
   703 
   704 fun fold_expr f g (Funct (s, es)) = f s #> fold (fold_expr f g) es
   705   | fold_expr f g (Ident s) = g s
   706   | fold_expr f g (Number _) = I
   707   | fold_expr f g (Quantifier (_, _, _, e)) = fold_expr f g e
   708   | fold_expr f g (Element (e, es)) =
   709       fold_expr f g e #> fold (fold_expr f g) es
   710   | fold_expr f g (Update (e, es, e')) =
   711       fold_expr f g e #> fold (fold_expr f g) es #> fold_expr f g e'
   712   | fold_expr f g (Record (_, flds)) = fold (fold_expr f g o snd) flds
   713   | fold_expr f g (Array (_, default, assocs)) =
   714       fold_opt (fold_expr f g) default #>
   715       fold (fold_pair
   716         (fold (fold (fold_pair
   717           (fold_expr f g) (fold_opt (fold_expr f g)))))
   718         (fold_expr f g)) assocs;
   719 
   720 fun add_expr_pfuns funs = fold_expr
   721   (fn s => if is_pfun s then I else insert (op =) s)
   722   (fn s => if is_none (lookup funs s) then I else insert (op =) s);
   723 
   724 val add_expr_idents = fold_expr (K I) (insert (op =));
   725 
   726 fun pfun_type thy prfx (argtys, resty) =
   727   map (mk_type thy prfx) argtys ---> mk_type thy prfx resty;
   728 
   729 fun check_pfun_type thy prfx s t optty1 optty2 =
   730   let
   731     val T = fastype_of t;
   732     fun check ty =
   733       let val U = pfun_type thy prfx ty
   734       in
   735         T = U orelse
   736         error ("Type\n" ^
   737           Syntax.string_of_typ_global thy T ^
   738           "\nof function " ^
   739           Syntax.string_of_term_global thy t ^
   740           " associated with proof function " ^ s ^
   741           "\ndoes not match declared type\n" ^
   742           Syntax.string_of_typ_global thy U)
   743       end
   744   in (Option.map check optty1; Option.map check optty2; ()) end;
   745 
   746 fun upd_option x y = if is_some x then x else y;
   747 
   748 fun check_pfuns_types thy prfx funs =
   749   Symtab.map (fn s => fn (optty, t) =>
   750    let val optty' = lookup funs (unprefix_pfun prfx s)
   751    in
   752      (check_pfun_type thy prfx s t optty optty';
   753       (NONE |> upd_option optty |> upd_option optty', t))
   754    end);
   755 
   756 
   757 (** the VC store **)
   758 
   759 fun pp_vcs msg vcs = Pretty.big_list msg (map (Pretty.str o fst) vcs);
   760 
   761 fun pp_open_vcs [] = Pretty.str "All verification conditions have been proved."
   762   | pp_open_vcs vcs = pp_vcs
   763       "The following verification conditions remain to be proved:" vcs;
   764 
   765 fun partition_vcs vcs = VCtab.fold_rev
   766   (fn (name, (trace, SOME thms, ps, cs)) =>
   767         apfst (cons (name, (trace, thms, ps, cs)))
   768     | (name, (trace, NONE, ps, cs)) =>
   769         apsnd (cons (name, (trace, ps, cs))))
   770   vcs ([], []);
   771 
   772 fun insert_break prt = Pretty.blk (0, [Pretty.fbrk, prt]);
   773 
   774 fun print_open_vcs f vcs =
   775   (Pretty.writeln (f (pp_open_vcs (snd (partition_vcs vcs)))); vcs);
   776 
   777 fun set_env ctxt defs types funs ids vcs path prefix thy = VCs.map (fn
   778     {pfuns, type_map, env = NONE} =>
   779       {pfuns = pfuns,
   780        type_map = type_map,
   781        env = SOME
   782          {ctxt = ctxt, defs = defs, types = types, funs = funs,
   783           pfuns = check_pfuns_types thy prefix funs pfuns,
   784           ids = ids, proving = false, vcs = print_open_vcs I vcs, path = path,
   785           prefix = prefix}}
   786   | _ => err_unfinished ()) thy;
   787 
   788 fun mk_pat s = (case Int.fromString s of
   789     SOME i => [HOLogic.mk_Trueprop (Var (("C", i), HOLogic.boolT))]
   790   | NONE => error ("Bad conclusion identifier: C" ^ s));
   791 
   792 fun mk_vc thy prfx types pfuns ids name_concl (tr, proved, ps, cs) =
   793   let val prop_of =
   794     HOLogic.mk_Trueprop o fst o term_of_expr thy prfx types pfuns ids
   795   in
   796     (tr, proved,
   797      Element.Assumes (map (fn (s', e) =>
   798        ((Binding.name ("H" ^ s'), []), [(prop_of e, [])])) ps),
   799      Element.Shows (map (fn (s', e) =>
   800        (if name_concl then (Binding.name ("C" ^ s'), [])
   801         else Attrib.empty_binding,
   802         [(prop_of e, mk_pat s')])) cs))
   803   end;
   804 
   805 fun fold_vcs f vcs =
   806   VCtab.fold (fn (_, (_, _, ps, cs)) => fold f ps #> fold f cs) vcs;
   807 
   808 fun pfuns_of_vcs prfx funs pfuns vcs =
   809   fold_vcs (add_expr_pfuns funs o snd) vcs [] |>
   810   filter (is_none o lookup_prfx prfx pfuns);
   811 
   812 fun declare_missing_pfuns thy prfx funs pfuns vcs (tab, ctxt) =
   813   let
   814     val (fs, (tys, Ts)) =
   815       pfuns_of_vcs prfx funs pfuns vcs |>
   816       map_filter (fn s => lookup funs s |>
   817         Option.map (fn ty => (s, (SOME ty, pfun_type thy prfx ty)))) |>
   818       split_list ||> split_list;
   819     val (fs', ctxt') = fold_map Name.variant fs ctxt
   820   in
   821     (fold Symtab.update_new (fs ~~ (tys ~~ map Free (fs' ~~ Ts))) pfuns,
   822      Element.Fixes (map2 (fn s => fn T =>
   823        (Binding.name s, SOME T, NoSyn)) fs' Ts),
   824      (tab, ctxt'))
   825   end;
   826 
   827 fun map_pfuns f {pfuns, type_map, env} =
   828   {pfuns = f pfuns, type_map = type_map, env = env}
   829 
   830 fun map_pfuns_env f {pfuns, type_map,
   831       env = SOME {ctxt, defs, types, funs, pfuns = pfuns_env,
   832         ids, proving, vcs, path, prefix}} =
   833   if proving then err_unfinished ()
   834   else
   835     {pfuns = pfuns, type_map = type_map,
   836      env = SOME {ctxt = ctxt, defs = defs, types = types, funs = funs,
   837        pfuns = f pfuns_env, ids = ids, proving = false, vcs = vcs,
   838        path = path, prefix = prefix}};
   839 
   840 fun add_proof_fun prep (s, (optty, raw_t)) thy =
   841   VCs.map (fn data as {env, ...} =>
   842     let
   843       val (optty', prfx, map_pf) = (case env of
   844           SOME {funs, prefix, ...} =>
   845             (lookup funs (unprefix_pfun prefix s),
   846              prefix, map_pfuns_env)
   847         | NONE => (NONE, "", map_pfuns));
   848       val optty'' = NONE |> upd_option optty |> upd_option optty';
   849       val t = prep (Option.map (pfun_type thy prfx) optty'') raw_t;
   850       val _ = (case fold_aterms (fn u =>
   851           if is_Var u orelse is_Free u then insert (op =) u else I) t [] of
   852           [] => ()
   853         | ts => error ("Term\n" ^ Syntax.string_of_term_global thy t ^
   854             "\nto be associated with proof function " ^ s ^
   855             " contains free variable(s) " ^
   856             commas (map (Syntax.string_of_term_global thy) ts)));
   857     in
   858       (check_pfun_type thy prfx s t optty optty';
   859        if is_some optty'' orelse is_none env then
   860          map_pf (Symtab.update_new (s, (optty'', t))) data
   861            handle Symtab.DUP _ => error ("Proof function " ^ s ^
   862              " already associated with function")
   863        else error ("Undeclared proof function " ^ s))
   864     end) thy;
   865 
   866 fun check_mapping _ _ [] _ = ()
   867   | check_mapping err s cmap cs =
   868       (case duplicates (op = o pairself fst) cmap of
   869          [] => (case duplicates (op = o pairself snd) cmap of
   870              [] => (case subtract (op = o apsnd snd) cs cmap of
   871                  [] => (case subtract (op = o apfst snd) cmap cs of
   872                      [] => ()
   873                    | zs => err ("has extra " ^ s ^ "(s) " ^ commas zs))
   874                | zs => err ("does not have " ^ s ^ "(s) " ^
   875                    commas (map snd zs)))
   876            | zs => error ("Several SPARK names are mapped to " ^
   877                commas (map snd zs)))
   878        | zs => error ("The SPARK names " ^ commas (map fst zs) ^
   879            " are mapped to more than one name"));
   880 
   881 fun add_type (s, (T as Type (tyname, Ts), cmap)) thy =
   882       let val cmap' = map (apsnd (Sign.intern_const thy)) cmap
   883       in
   884         thy |>
   885         VCs.map (fn
   886             {env = SOME _, ...} => err_unfinished ()
   887           | {pfuns, type_map, env} =>
   888               {pfuns = pfuns,
   889                type_map = Symtab.update_new (s, (T, cmap')) type_map,
   890                env = env}
   891                 handle Symtab.DUP _ => error ("SPARK type " ^ s ^
   892                   " already associated with type")) |>
   893         (fn thy' =>
   894            case Datatype.get_constrs thy' tyname of
   895              NONE => (case get_record_info thy' T of
   896                NONE => thy'
   897              | SOME {fields, ...} =>
   898                  (check_mapping (assoc_ty_err thy' T s) "field"
   899                     cmap' (map fst fields);
   900                   thy'))
   901            | SOME cs =>
   902                if null Ts then
   903                  (map
   904                     (fn (_, Type (_, [])) => ()
   905                       | (cname, _) => assoc_ty_err thy' T s
   906                           ("has illegal constructor " ^
   907                            Long_Name.base_name cname)) cs;
   908                   check_mapping (assoc_ty_err thy' T s) "constructor"
   909                     cmap' (map fst cs);
   910                   add_enum_type s tyname thy')
   911                else assoc_ty_err thy' T s "is illegal")
   912       end
   913   | add_type (s, (T, _)) thy = assoc_ty_err thy T s "is illegal";
   914 
   915 val is_closed = is_none o #env o VCs.get;
   916 
   917 fun lookup_vc thy name_concl name =
   918   (case VCs.get thy of
   919     {env = SOME {vcs, types, funs, pfuns, ids, ctxt, prefix, ...}, ...} =>
   920       (case VCtab.lookup vcs name of
   921          SOME vc =>
   922            let val (pfuns', ctxt', ids') =
   923              declare_missing_pfuns thy prefix funs pfuns vcs ids
   924            in
   925              SOME (ctxt @ [ctxt'],
   926                mk_vc thy prefix types pfuns' ids' name_concl vc)
   927            end
   928        | NONE => NONE)
   929   | _ => NONE);
   930 
   931 fun get_vcs thy name_concl = (case VCs.get thy of
   932     {env = SOME {vcs, types, funs, pfuns, ids, ctxt, defs, prefix, ...}, ...} =>
   933       let val (pfuns', ctxt', ids') =
   934         declare_missing_pfuns thy prefix funs pfuns vcs ids
   935       in
   936         (ctxt @ [ctxt'], defs,
   937          VCtab.dest vcs |>
   938          map (apsnd (mk_vc thy prefix types pfuns' ids' name_concl)))
   939       end
   940   | _ => ([], [], []));
   941 
   942 fun mark_proved name thms = VCs.map (fn
   943     {pfuns, type_map,
   944      env = SOME {ctxt, defs, types, funs, pfuns = pfuns_env,
   945         ids, vcs, path, prefix, ...}} =>
   946       {pfuns = pfuns,
   947        type_map = type_map,
   948        env = SOME {ctxt = ctxt, defs = defs,
   949          types = types, funs = funs, pfuns = pfuns_env,
   950          ids = ids,
   951          proving = true,
   952          vcs = print_open_vcs insert_break (VCtab.map_entry name
   953            (fn (trace, _, ps, cs) => (trace, SOME thms, ps, cs)) vcs),
   954          path = path,
   955          prefix = prefix}}
   956   | x => x);
   957 
   958 fun close incomplete thy =
   959   thy |>
   960   VCs.map (fn
   961       {pfuns, type_map, env = SOME {vcs, path, ...}} =>
   962         let
   963           val (proved, unproved) = partition_vcs vcs;
   964           val _ = Thm.join_proofs (maps (#2 o snd) proved);
   965           val (proved', proved'') = List.partition (fn (_, (_, thms, _, _)) =>
   966             exists (#oracle o Thm.peek_status) thms) proved
   967         in
   968           (if null unproved then ()
   969            else (if incomplete then warning else error)
   970              (Pretty.string_of (pp_open_vcs unproved));
   971            if null proved' then ()
   972            else warning (Pretty.string_of (pp_vcs
   973              "The following VCs are not marked as proved \
   974              \because their proofs contain oracles:" proved'));
   975            File.write (Path.ext "prv" path)
   976              (implode (map (fn (s, _) => snd (strip_number s) ^
   977                 " -- proved by " ^ Distribution.version ^ "\n") proved''));
   978            {pfuns = pfuns, type_map = type_map, env = NONE})
   979         end
   980     | _ => error "No SPARK environment is currently open") |>
   981   Sign.parent_path;
   982 
   983 
   984 (** set up verification conditions **)
   985 
   986 fun partition_opt f =
   987   let
   988     fun part ys zs [] = (rev ys, rev zs)
   989       | part ys zs (x :: xs) = (case f x of
   990             SOME y => part (y :: ys) zs xs
   991           | NONE => part ys (x :: zs) xs)
   992   in part [] [] end;
   993 
   994 fun dest_def (id, (Substitution_Rule ([], Ident s, rhs))) = SOME (id, (s, rhs))
   995   | dest_def _ = NONE;
   996 
   997 fun mk_rulename (s, i) = Binding.name (s ^ string_of_int i);
   998 
   999 fun add_const prfx (s, ty) ((tab, ctxt), thy) =
  1000   let
  1001     val T = mk_type thy prfx ty;
  1002     val b = Binding.name s;
  1003     val c = Const (Sign.full_name thy b, T)
  1004   in
  1005     (c,
  1006      ((Symtab.update (s, (c, ty)) tab, Name.declare s ctxt),
  1007       Sign.add_consts_i [(b, T, NoSyn)] thy))
  1008   end;
  1009 
  1010 fun add_def prfx types pfuns consts (id, (s, e)) (ids as (tab, ctxt), thy) =
  1011   (case lookup consts s of
  1012      SOME ty =>
  1013        let
  1014          val (t, ty') = term_of_expr thy prfx types pfuns ids e;
  1015          val T = mk_type thy prfx ty;
  1016          val T' = mk_type thy prfx ty';
  1017          val _ = T = T' orelse
  1018            error ("Declared type " ^ ty ^ " of " ^ s ^
  1019              "\ndoes not match type " ^ ty' ^ " in definition");
  1020          val id' = mk_rulename id;
  1021          val lthy = Named_Target.theory_init thy;
  1022          val ((t', (_, th)), lthy') = Specification.definition
  1023            (NONE, ((id', []), HOLogic.mk_Trueprop (HOLogic.mk_eq
  1024              (Free (s, T), t)))) lthy;
  1025          val phi = Proof_Context.export_morphism lthy' lthy
  1026        in
  1027          ((id', Morphism.thm phi th),
  1028           ((Symtab.update (s, (Morphism.term phi t', ty)) tab,
  1029             Name.declare s ctxt),
  1030            Local_Theory.exit_global lthy'))
  1031        end
  1032    | NONE => error ("Undeclared constant " ^ s));
  1033 
  1034 fun add_var prfx (s, ty) (ids, thy) =
  1035   let val ([Free p], ids') = mk_variables thy prfx [s] ty ids
  1036   in (p, (ids', thy)) end;
  1037 
  1038 fun add_init_vars prfx vcs (ids_thy as ((tab, _), _)) =
  1039   fold_map (add_var prfx)
  1040     (map_filter
  1041        (fn s => case try (unsuffix "~") s of
  1042           SOME s' => (case Symtab.lookup tab s' of
  1043             SOME (_, ty) => SOME (s, ty)
  1044           | NONE => error ("Undeclared identifier " ^ s'))
  1045         | NONE => NONE)
  1046        (fold_vcs (add_expr_idents o snd) vcs []))
  1047     ids_thy;
  1048 
  1049 fun is_trivial_vc ([], [(_, Ident "true")]) = true
  1050   | is_trivial_vc _ = false;
  1051 
  1052 fun rulenames rules = commas
  1053   (map (fn ((s, i), _) => s ^ "(" ^ string_of_int i ^ ")") rules);
  1054 
  1055 (* sort definitions according to their dependency *)
  1056 fun sort_defs _ _ _ _ [] sdefs = rev sdefs
  1057   | sort_defs prfx funs pfuns consts defs sdefs =
  1058       (case find_first (fn (_, (_, e)) =>
  1059          forall (is_some o lookup_prfx prfx pfuns)
  1060            (add_expr_pfuns funs e []) andalso
  1061          forall (fn id =>
  1062            member (fn (s, (_, (s', _))) => s = s') sdefs id orelse
  1063            consts id)
  1064              (add_expr_idents e [])) defs of
  1065          SOME d => sort_defs prfx funs pfuns consts
  1066            (remove (op =) d defs) (d :: sdefs)
  1067        | NONE => error ("Bad definitions: " ^ rulenames defs));
  1068 
  1069 fun set_vcs ({types, vars, consts, funs} : decls)
  1070       (rules, _) ((_, ident), vcs) path opt_prfx thy =
  1071   let
  1072     val prfx' =
  1073       if opt_prfx = "" then
  1074         space_implode "__" (Long_Name.explode (Long_Name.qualifier ident))
  1075       else opt_prfx;
  1076     val prfx = to_lower prfx';
  1077     val {pfuns, ...} = VCs.get thy;
  1078     val (defs, rules') = partition_opt dest_def rules;
  1079     val consts' =
  1080       subtract (fn ((_, (s, _)), (s', _)) => s = s') defs (items consts);
  1081     (* ignore all complex rules in rls files *)
  1082     val (rules'', other_rules) =
  1083       List.partition (complex_rule o snd) rules';
  1084     val _ = if null rules'' then ()
  1085       else warning ("Ignoring rules: " ^ rulenames rules'');
  1086 
  1087     val vcs' = VCtab.make (maps (fn (tr, vcs) =>
  1088       map (fn (s, (ps, cs)) => (s, (tr, NONE, ps, cs)))
  1089         (filter_out (is_trivial_vc o snd) vcs)) vcs);
  1090 
  1091     val _ = (case filter_out (is_some o lookup funs)
  1092         (pfuns_of_vcs prfx funs pfuns vcs') of
  1093         [] => ()
  1094       | fs => error ("Undeclared proof function(s) " ^ commas fs));
  1095 
  1096     val (((defs', vars''), ivars), (ids, thy')) =
  1097       ((Symtab.empty |>
  1098         Symtab.update ("false", (@{term False}, booleanN)) |>
  1099         Symtab.update ("true", (@{term True}, booleanN)),
  1100         Name.context),
  1101        thy |> Sign.add_path
  1102          ((if prfx' = "" then "" else prfx' ^ "__") ^ Long_Name.base_name ident)) |>
  1103       fold (add_type_def prfx) (items types) |>
  1104       fold (snd oo add_const prfx) consts' |> (fn ids_thy as ((tab, _), _) =>
  1105         ids_thy |>
  1106         fold_map (add_def prfx types pfuns consts)
  1107           (sort_defs prfx funs pfuns (Symtab.defined tab) defs []) ||>>
  1108         fold_map (add_var prfx) (items vars) ||>>
  1109         add_init_vars prfx vcs');
  1110 
  1111     val ctxt =
  1112       [Element.Fixes (map (fn (s, T) =>
  1113          (Binding.name s, SOME T, NoSyn)) (vars'' @ ivars)),
  1114        Element.Assumes (map (fn (id, rl) =>
  1115          ((mk_rulename id, []),
  1116           [(term_of_rule thy' prfx types pfuns ids rl, [])]))
  1117            other_rules),
  1118        Element.Notes ("", [((Binding.name "defns", []), map (rpair [] o single o snd) defs')])]
  1119           
  1120   in
  1121     set_env ctxt defs' types funs ids vcs' path prfx thy'
  1122   end;
  1123 
  1124 end;