author | wenzelm |
Mon, 16 Mar 2009 17:51:24 +0100 | |
changeset 30548 | 2eef5e71edd6 |
parent 30510 | 4120fc59dd85 |
child 36321 | 58d4dc6000fc |
permissions | -rw-r--r-- |
26869 | 1 |
% |
2 |
\begin{isabellebody}% |
|
3 |
\def\isabellecontext{Proof}% |
|
4 |
% |
|
5 |
\isadelimtheory |
|
6 |
% |
|
7 |
\endisadelimtheory |
|
8 |
% |
|
9 |
\isatagtheory |
|
10 |
\isacommand{theory}\isamarkupfalse% |
|
11 |
\ Proof\isanewline |
|
12 |
\isakeyword{imports}\ Main\isanewline |
|
13 |
\isakeyword{begin}% |
|
14 |
\endisatagtheory |
|
15 |
{\isafoldtheory}% |
|
16 |
% |
|
17 |
\isadelimtheory |
|
18 |
% |
|
19 |
\endisadelimtheory |
|
20 |
% |
|
29746 | 21 |
\isamarkupchapter{Proofs \label{ch:proofs}% |
26869 | 22 |
} |
23 |
\isamarkuptrue% |
|
24 |
% |
|
26870 | 25 |
\begin{isamarkuptext}% |
26 |
Proof commands perform transitions of Isar/VM machine |
|
27 |
configurations, which are block-structured, consisting of a stack of |
|
28 |
nodes with three main components: logical proof context, current |
|
29746 | 29 |
facts, and open goals. Isar/VM transitions are typed according to |
30 |
the following three different modes of operation: |
|
26870 | 31 |
|
28788 | 32 |
\begin{description} |
26870 | 33 |
|
28788 | 34 |
\item \isa{{\isachardoublequote}proof{\isacharparenleft}prove{\isacharparenright}{\isachardoublequote}} means that a new goal has just been |
26870 | 35 |
stated that is now to be \emph{proven}; the next command may refine |
36 |
it by some proof method, and enter a sub-proof to establish the |
|
37 |
actual result. |
|
38 |
||
28788 | 39 |
\item \isa{{\isachardoublequote}proof{\isacharparenleft}state{\isacharparenright}{\isachardoublequote}} is like a nested theory mode: the |
26870 | 40 |
context may be augmented by \emph{stating} additional assumptions, |
41 |
intermediate results etc. |
|
42 |
||
28788 | 43 |
\item \isa{{\isachardoublequote}proof{\isacharparenleft}chain{\isacharparenright}{\isachardoublequote}} is intermediate between \isa{{\isachardoublequote}proof{\isacharparenleft}state{\isacharparenright}{\isachardoublequote}} and \isa{{\isachardoublequote}proof{\isacharparenleft}prove{\isacharparenright}{\isachardoublequote}}: existing facts (i.e.\ |
26902 | 44 |
the contents of the special ``\indexref{}{fact}{this}\hyperlink{fact.this}{\mbox{\isa{this}}}'' register) have been |
26870 | 45 |
just picked up in order to be used when refining the goal claimed |
46 |
next. |
|
47 |
||
28788 | 48 |
\end{description} |
26870 | 49 |
|
29746 | 50 |
The proof mode indicator may be understood as an instruction to the |
51 |
writer, telling what kind of operation may be performed next. The |
|
52 |
corresponding typings of proof commands restricts the shape of |
|
53 |
well-formed proof texts to particular command sequences. So dynamic |
|
54 |
arrangements of commands eventually turn out as static texts of a |
|
55 |
certain structure. |
|
56 |
||
57 |
\Appref{ap:refcard} gives a simplified grammar of the (extensible) |
|
58 |
language emerging that way from the different types of proof |
|
59 |
commands. The main ideas of the overall Isar framework are |
|
60 |
explained in \chref{ch:isar-framework}.% |
|
26870 | 61 |
\end{isamarkuptext}% |
62 |
\isamarkuptrue% |
|
63 |
% |
|
28788 | 64 |
\isamarkupsection{Proof structure% |
65 |
} |
|
66 |
\isamarkuptrue% |
|
67 |
% |
|
68 |
\isamarkupsubsection{Blocks% |
|
26870 | 69 |
} |
70 |
\isamarkuptrue% |
|
71 |
% |
|
72 |
\begin{isamarkuptext}% |
|
73 |
\begin{matharray}{rcl} |
|
28788 | 74 |
\indexdef{}{command}{next}\hypertarget{command.next}{\hyperlink{command.next}{\mbox{\isa{\isacommand{next}}}}} & : & \isa{{\isachardoublequote}proof{\isacharparenleft}state{\isacharparenright}\ {\isasymrightarrow}\ proof{\isacharparenleft}state{\isacharparenright}{\isachardoublequote}} \\ |
75 |
\indexdef{}{command}{\{}\hypertarget{command.braceleft}{\hyperlink{command.braceleft}{\mbox{\isa{\isacommand{{\isacharbraceleft}}}}}} & : & \isa{{\isachardoublequote}proof{\isacharparenleft}state{\isacharparenright}\ {\isasymrightarrow}\ proof{\isacharparenleft}state{\isacharparenright}{\isachardoublequote}} \\ |
|
76 |
\indexdef{}{command}{\}}\hypertarget{command.braceright}{\hyperlink{command.braceright}{\mbox{\isa{\isacommand{{\isacharbraceright}}}}}} & : & \isa{{\isachardoublequote}proof{\isacharparenleft}state{\isacharparenright}\ {\isasymrightarrow}\ proof{\isacharparenleft}state{\isacharparenright}{\isachardoublequote}} \\ |
|
77 |
\end{matharray} |
|
78 |
||
79 |
While Isar is inherently block-structured, opening and closing |
|
80 |
blocks is mostly handled rather casually, with little explicit |
|
81 |
user-intervention. Any local goal statement automatically opens |
|
82 |
\emph{two} internal blocks, which are closed again when concluding |
|
83 |
the sub-proof (by \hyperlink{command.qed}{\mbox{\isa{\isacommand{qed}}}} etc.). Sections of different |
|
84 |
context within a sub-proof may be switched via \hyperlink{command.next}{\mbox{\isa{\isacommand{next}}}}, |
|
85 |
which is just a single block-close followed by block-open again. |
|
86 |
The effect of \hyperlink{command.next}{\mbox{\isa{\isacommand{next}}}} is to reset the local proof context; |
|
87 |
there is no goal focus involved here! |
|
88 |
||
89 |
For slightly more advanced applications, there are explicit block |
|
90 |
parentheses as well. These typically achieve a stronger forward |
|
91 |
style of reasoning. |
|
92 |
||
93 |
\begin{description} |
|
94 |
||
95 |
\item \hyperlink{command.next}{\mbox{\isa{\isacommand{next}}}} switches to a fresh block within a |
|
96 |
sub-proof, resetting the local context to the initial one. |
|
97 |
||
98 |
\item \hyperlink{command.braceleft}{\mbox{\isa{\isacommand{{\isacharbraceleft}}}}} and \hyperlink{command.braceright}{\mbox{\isa{\isacommand{{\isacharbraceright}}}}} explicitly open and close |
|
99 |
blocks. Any current facts pass through ``\hyperlink{command.braceleft}{\mbox{\isa{\isacommand{{\isacharbraceleft}}}}}'' |
|
100 |
unchanged, while ``\hyperlink{command.braceright}{\mbox{\isa{\isacommand{{\isacharbraceright}}}}}'' causes any result to be |
|
101 |
\emph{exported} into the enclosing context. Thus fixed variables |
|
102 |
are generalized, assumptions discharged, and local definitions |
|
103 |
unfolded (cf.\ \secref{sec:proof-context}). There is no difference |
|
104 |
of \hyperlink{command.assume}{\mbox{\isa{\isacommand{assume}}}} and \hyperlink{command.presume}{\mbox{\isa{\isacommand{presume}}}} in this mode of |
|
105 |
forward reasoning --- in contrast to plain backward reasoning with |
|
106 |
the result exported at \hyperlink{command.show}{\mbox{\isa{\isacommand{show}}}} time. |
|
107 |
||
108 |
\end{description}% |
|
109 |
\end{isamarkuptext}% |
|
110 |
\isamarkuptrue% |
|
111 |
% |
|
112 |
\isamarkupsubsection{Omitting proofs% |
|
113 |
} |
|
114 |
\isamarkuptrue% |
|
115 |
% |
|
116 |
\begin{isamarkuptext}% |
|
117 |
\begin{matharray}{rcl} |
|
118 |
\indexdef{}{command}{oops}\hypertarget{command.oops}{\hyperlink{command.oops}{\mbox{\isa{\isacommand{oops}}}}} & : & \isa{{\isachardoublequote}proof\ {\isasymrightarrow}\ local{\isacharunderscore}theory\ {\isacharbar}\ theory{\isachardoublequote}} \\ |
|
119 |
\end{matharray} |
|
120 |
||
121 |
The \hyperlink{command.oops}{\mbox{\isa{\isacommand{oops}}}} command discontinues the current proof |
|
122 |
attempt, while considering the partial proof text as properly |
|
123 |
processed. This is conceptually quite different from ``faking'' |
|
124 |
actual proofs via \indexref{}{command}{sorry}\hyperlink{command.sorry}{\mbox{\isa{\isacommand{sorry}}}} (see |
|
125 |
\secref{sec:proof-steps}): \hyperlink{command.oops}{\mbox{\isa{\isacommand{oops}}}} does not observe the |
|
126 |
proof structure at all, but goes back right to the theory level. |
|
127 |
Furthermore, \hyperlink{command.oops}{\mbox{\isa{\isacommand{oops}}}} does not produce any result theorem |
|
128 |
--- there is no intended claim to be able to complete the proof |
|
129 |
anyhow. |
|
130 |
||
131 |
A typical application of \hyperlink{command.oops}{\mbox{\isa{\isacommand{oops}}}} is to explain Isar proofs |
|
132 |
\emph{within} the system itself, in conjunction with the document |
|
28838
d5db6dfcb34a
moved table of standard Isabelle symbols to isar-ref manual;
wenzelm
parents:
28788
diff
changeset
|
133 |
preparation tools of Isabelle described in \chref{ch:document-prep}. |
28788 | 134 |
Thus partial or even wrong proof attempts can be discussed in a |
135 |
logically sound manner. Note that the Isabelle {\LaTeX} macros can |
|
136 |
be easily adapted to print something like ``\isa{{\isachardoublequote}{\isasymdots}{\isachardoublequote}}'' instead of |
|
137 |
the keyword ``\hyperlink{command.oops}{\mbox{\isa{\isacommand{oops}}}}''. |
|
138 |
||
139 |
\medskip The \hyperlink{command.oops}{\mbox{\isa{\isacommand{oops}}}} command is undo-able, unlike |
|
140 |
\indexref{}{command}{kill}\hyperlink{command.kill}{\mbox{\isa{\isacommand{kill}}}} (see \secref{sec:history}). The effect is to |
|
141 |
get back to the theory just before the opening of the proof.% |
|
142 |
\end{isamarkuptext}% |
|
143 |
\isamarkuptrue% |
|
144 |
% |
|
145 |
\isamarkupsection{Statements% |
|
146 |
} |
|
147 |
\isamarkuptrue% |
|
148 |
% |
|
149 |
\isamarkupsubsection{Context elements \label{sec:proof-context}% |
|
150 |
} |
|
151 |
\isamarkuptrue% |
|
152 |
% |
|
153 |
\begin{isamarkuptext}% |
|
154 |
\begin{matharray}{rcl} |
|
155 |
\indexdef{}{command}{fix}\hypertarget{command.fix}{\hyperlink{command.fix}{\mbox{\isa{\isacommand{fix}}}}} & : & \isa{{\isachardoublequote}proof{\isacharparenleft}state{\isacharparenright}\ {\isasymrightarrow}\ proof{\isacharparenleft}state{\isacharparenright}{\isachardoublequote}} \\ |
|
156 |
\indexdef{}{command}{assume}\hypertarget{command.assume}{\hyperlink{command.assume}{\mbox{\isa{\isacommand{assume}}}}} & : & \isa{{\isachardoublequote}proof{\isacharparenleft}state{\isacharparenright}\ {\isasymrightarrow}\ proof{\isacharparenleft}state{\isacharparenright}{\isachardoublequote}} \\ |
|
157 |
\indexdef{}{command}{presume}\hypertarget{command.presume}{\hyperlink{command.presume}{\mbox{\isa{\isacommand{presume}}}}} & : & \isa{{\isachardoublequote}proof{\isacharparenleft}state{\isacharparenright}\ {\isasymrightarrow}\ proof{\isacharparenleft}state{\isacharparenright}{\isachardoublequote}} \\ |
|
158 |
\indexdef{}{command}{def}\hypertarget{command.def}{\hyperlink{command.def}{\mbox{\isa{\isacommand{def}}}}} & : & \isa{{\isachardoublequote}proof{\isacharparenleft}state{\isacharparenright}\ {\isasymrightarrow}\ proof{\isacharparenleft}state{\isacharparenright}{\isachardoublequote}} \\ |
|
26870 | 159 |
\end{matharray} |
160 |
||
161 |
The logical proof context consists of fixed variables and |
|
162 |
assumptions. The former closely correspond to Skolem constants, or |
|
163 |
meta-level universal quantification as provided by the Isabelle/Pure |
|
164 |
logical framework. Introducing some \emph{arbitrary, but fixed} |
|
26902 | 165 |
variable via ``\hyperlink{command.fix}{\mbox{\isa{\isacommand{fix}}}}~\isa{x}'' results in a local value |
26870 | 166 |
that may be used in the subsequent proof as any other variable or |
167 |
constant. Furthermore, any result \isa{{\isachardoublequote}{\isasymturnstile}\ {\isasymphi}{\isacharbrackleft}x{\isacharbrackright}{\isachardoublequote}} exported from |
|
168 |
the context will be universally closed wrt.\ \isa{x} at the |
|
169 |
outermost level: \isa{{\isachardoublequote}{\isasymturnstile}\ {\isasymAnd}x{\isachardot}\ {\isasymphi}{\isacharbrackleft}x{\isacharbrackright}{\isachardoublequote}} (this is expressed in normal |
|
170 |
form using Isabelle's meta-variables). |
|
171 |
||
172 |
Similarly, introducing some assumption \isa{{\isasymchi}} has two effects. |
|
173 |
On the one hand, a local theorem is created that may be used as a |
|
174 |
fact in subsequent proof steps. On the other hand, any result |
|
175 |
\isa{{\isachardoublequote}{\isasymchi}\ {\isasymturnstile}\ {\isasymphi}{\isachardoublequote}} exported from the context becomes conditional wrt.\ |
|
176 |
the assumption: \isa{{\isachardoublequote}{\isasymturnstile}\ {\isasymchi}\ {\isasymLongrightarrow}\ {\isasymphi}{\isachardoublequote}}. Thus, solving an enclosing goal |
|
177 |
using such a result would basically introduce a new subgoal stemming |
|
178 |
from the assumption. How this situation is handled depends on the |
|
26902 | 179 |
version of assumption command used: while \hyperlink{command.assume}{\mbox{\isa{\isacommand{assume}}}} |
26870 | 180 |
insists on solving the subgoal by unification with some premise of |
26902 | 181 |
the goal, \hyperlink{command.presume}{\mbox{\isa{\isacommand{presume}}}} leaves the subgoal unchanged in order |
26870 | 182 |
to be proved later by the user. |
183 |
||
26902 | 184 |
Local definitions, introduced by ``\hyperlink{command.def}{\mbox{\isa{\isacommand{def}}}}~\isa{{\isachardoublequote}x\ {\isasymequiv}\ t{\isachardoublequote}}'', are achieved by combining ``\hyperlink{command.fix}{\mbox{\isa{\isacommand{fix}}}}~\isa{x}'' with |
26870 | 185 |
another version of assumption that causes any hypothetical equation |
186 |
\isa{{\isachardoublequote}x\ {\isasymequiv}\ t{\isachardoublequote}} to be eliminated by the reflexivity rule. Thus, |
|
187 |
exporting some result \isa{{\isachardoublequote}x\ {\isasymequiv}\ t\ {\isasymturnstile}\ {\isasymphi}{\isacharbrackleft}x{\isacharbrackright}{\isachardoublequote}} yields \isa{{\isachardoublequote}{\isasymturnstile}\ {\isasymphi}{\isacharbrackleft}t{\isacharbrackright}{\isachardoublequote}}. |
|
188 |
||
189 |
\begin{rail} |
|
190 |
'fix' (vars + 'and') |
|
191 |
; |
|
192 |
('assume' | 'presume') (props + 'and') |
|
193 |
; |
|
194 |
'def' (def + 'and') |
|
195 |
; |
|
196 |
def: thmdecl? \\ name ('==' | equiv) term termpat? |
|
197 |
; |
|
198 |
\end{rail} |
|
199 |
||
28788 | 200 |
\begin{description} |
26870 | 201 |
|
28788 | 202 |
\item \hyperlink{command.fix}{\mbox{\isa{\isacommand{fix}}}}~\isa{x} introduces a local variable \isa{x} that is \emph{arbitrary, but fixed.} |
26870 | 203 |
|
28788 | 204 |
\item \hyperlink{command.assume}{\mbox{\isa{\isacommand{assume}}}}~\isa{{\isachardoublequote}a{\isacharcolon}\ {\isasymphi}{\isachardoublequote}} and \hyperlink{command.presume}{\mbox{\isa{\isacommand{presume}}}}~\isa{{\isachardoublequote}a{\isacharcolon}\ {\isasymphi}{\isachardoublequote}} introduce a local fact \isa{{\isachardoublequote}{\isasymphi}\ {\isasymturnstile}\ {\isasymphi}{\isachardoublequote}} by |
26870 | 205 |
assumption. Subsequent results applied to an enclosing goal (e.g.\ |
26902 | 206 |
by \indexref{}{command}{show}\hyperlink{command.show}{\mbox{\isa{\isacommand{show}}}}) are handled as follows: \hyperlink{command.assume}{\mbox{\isa{\isacommand{assume}}}} expects to be able to unify with existing premises in the |
207 |
goal, while \hyperlink{command.presume}{\mbox{\isa{\isacommand{presume}}}} leaves \isa{{\isasymphi}} as new subgoals. |
|
26870 | 208 |
|
209 |
Several lists of assumptions may be given (separated by |
|
26902 | 210 |
\indexref{}{keyword}{and}\hyperlink{keyword.and}{\mbox{\isa{\isakeyword{and}}}}; the resulting list of current facts consists |
26870 | 211 |
of all of these concatenated. |
212 |
||
28788 | 213 |
\item \hyperlink{command.def}{\mbox{\isa{\isacommand{def}}}}~\isa{{\isachardoublequote}x\ {\isasymequiv}\ t{\isachardoublequote}} introduces a local |
26870 | 214 |
(non-polymorphic) definition. In results exported from the context, |
26902 | 215 |
\isa{x} is replaced by \isa{t}. Basically, ``\hyperlink{command.def}{\mbox{\isa{\isacommand{def}}}}~\isa{{\isachardoublequote}x\ {\isasymequiv}\ t{\isachardoublequote}}'' abbreviates ``\hyperlink{command.fix}{\mbox{\isa{\isacommand{fix}}}}~\isa{x}~\hyperlink{command.assume}{\mbox{\isa{\isacommand{assume}}}}~\isa{{\isachardoublequote}x\ {\isasymequiv}\ t{\isachardoublequote}}'', with the resulting |
26870 | 216 |
hypothetical equation solved by reflexivity. |
217 |
||
218 |
The default name for the definitional equation is \isa{x{\isacharunderscore}def}. |
|
219 |
Several simultaneous definitions may be given at the same time. |
|
220 |
||
28788 | 221 |
\end{description} |
26870 | 222 |
|
26902 | 223 |
The special name \indexref{}{fact}{prems}\hyperlink{fact.prems}{\mbox{\isa{prems}}} refers to all assumptions of the |
26870 | 224 |
current context as a list of theorems. This feature should be used |
225 |
with great care! It is better avoided in final proof texts.% |
|
226 |
\end{isamarkuptext}% |
|
227 |
\isamarkuptrue% |
|
228 |
% |
|
28788 | 229 |
\isamarkupsubsection{Term abbreviations \label{sec:term-abbrev}% |
26870 | 230 |
} |
231 |
\isamarkuptrue% |
|
232 |
% |
|
233 |
\begin{isamarkuptext}% |
|
234 |
\begin{matharray}{rcl} |
|
28788 | 235 |
\indexdef{}{command}{let}\hypertarget{command.let}{\hyperlink{command.let}{\mbox{\isa{\isacommand{let}}}}} & : & \isa{{\isachardoublequote}proof{\isacharparenleft}state{\isacharparenright}\ {\isasymrightarrow}\ proof{\isacharparenleft}state{\isacharparenright}{\isachardoublequote}} \\ |
236 |
\indexdef{}{keyword}{is}\hypertarget{keyword.is}{\hyperlink{keyword.is}{\mbox{\isa{\isakeyword{is}}}}} & : & syntax \\ |
|
237 |
\end{matharray} |
|
238 |
||
239 |
Abbreviations may be either bound by explicit \hyperlink{command.let}{\mbox{\isa{\isacommand{let}}}}~\isa{{\isachardoublequote}p\ {\isasymequiv}\ t{\isachardoublequote}} statements, or by annotating assumptions or |
|
240 |
goal statements with a list of patterns ``\isa{{\isachardoublequote}{\isacharparenleft}{\isasymIS}\ p\isactrlsub {\isadigit{1}}\ {\isasymdots}\ p\isactrlsub n{\isacharparenright}{\isachardoublequote}}''. In both cases, higher-order matching is invoked to |
|
241 |
bind extra-logical term variables, which may be either named |
|
242 |
schematic variables of the form \isa{{\isacharquery}x}, or nameless dummies |
|
243 |
``\hyperlink{variable.underscore}{\mbox{\isa{{\isacharunderscore}}}}'' (underscore). Note that in the \hyperlink{command.let}{\mbox{\isa{\isacommand{let}}}} |
|
244 |
form the patterns occur on the left-hand side, while the \hyperlink{keyword.is}{\mbox{\isa{\isakeyword{is}}}} patterns are in postfix position. |
|
245 |
||
246 |
Polymorphism of term bindings is handled in Hindley-Milner style, |
|
247 |
similar to ML. Type variables referring to local assumptions or |
|
248 |
open goal statements are \emph{fixed}, while those of finished |
|
249 |
results or bound by \hyperlink{command.let}{\mbox{\isa{\isacommand{let}}}} may occur in \emph{arbitrary} |
|
250 |
instances later. Even though actual polymorphism should be rarely |
|
251 |
used in practice, this mechanism is essential to achieve proper |
|
252 |
incremental type-inference, as the user proceeds to build up the |
|
253 |
Isar proof text from left to right. |
|
254 |
||
255 |
\medskip Term abbreviations are quite different from local |
|
256 |
definitions as introduced via \hyperlink{command.def}{\mbox{\isa{\isacommand{def}}}} (see |
|
257 |
\secref{sec:proof-context}). The latter are visible within the |
|
258 |
logic as actual equations, while abbreviations disappear during the |
|
259 |
input process just after type checking. Also note that \hyperlink{command.def}{\mbox{\isa{\isacommand{def}}}} does not support polymorphism. |
|
260 |
||
261 |
\begin{rail} |
|
262 |
'let' ((term + 'and') '=' term + 'and') |
|
263 |
; |
|
264 |
\end{rail} |
|
265 |
||
266 |
The syntax of \hyperlink{keyword.is}{\mbox{\isa{\isakeyword{is}}}} patterns follows \railnonterm{termpat} |
|
267 |
or \railnonterm{proppat} (see \secref{sec:term-decls}). |
|
268 |
||
269 |
\begin{description} |
|
270 |
||
271 |
\item \hyperlink{command.let}{\mbox{\isa{\isacommand{let}}}}~\isa{{\isachardoublequote}p\isactrlsub {\isadigit{1}}\ {\isacharequal}\ t\isactrlsub {\isadigit{1}}\ {\isasymAND}\ {\isasymdots}\ p\isactrlsub n\ {\isacharequal}\ t\isactrlsub n{\isachardoublequote}} binds any |
|
272 |
text variables in patterns \isa{{\isachardoublequote}p\isactrlsub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ p\isactrlsub n{\isachardoublequote}} by simultaneous |
|
273 |
higher-order matching against terms \isa{{\isachardoublequote}t\isactrlsub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ t\isactrlsub n{\isachardoublequote}}. |
|
274 |
||
275 |
\item \isa{{\isachardoublequote}{\isacharparenleft}{\isasymIS}\ p\isactrlsub {\isadigit{1}}\ {\isasymdots}\ p\isactrlsub n{\isacharparenright}{\isachardoublequote}} resembles \hyperlink{command.let}{\mbox{\isa{\isacommand{let}}}}, but |
|
276 |
matches \isa{{\isachardoublequote}p\isactrlsub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ p\isactrlsub n{\isachardoublequote}} against the preceding statement. Also |
|
277 |
note that \hyperlink{keyword.is}{\mbox{\isa{\isakeyword{is}}}} is not a separate command, but part of |
|
278 |
others (such as \hyperlink{command.assume}{\mbox{\isa{\isacommand{assume}}}}, \hyperlink{command.have}{\mbox{\isa{\isacommand{have}}}} etc.). |
|
279 |
||
280 |
\end{description} |
|
281 |
||
282 |
Some \emph{implicit} term abbreviations\index{term abbreviations} |
|
283 |
for goals and facts are available as well. For any open goal, |
|
284 |
\indexref{}{variable}{thesis}\hyperlink{variable.thesis}{\mbox{\isa{thesis}}} refers to its object-level statement, |
|
285 |
abstracted over any meta-level parameters (if present). Likewise, |
|
286 |
\indexref{}{variable}{this}\hyperlink{variable.this}{\mbox{\isa{this}}} is bound for fact statements resulting from |
|
287 |
assumptions or finished goals. In case \hyperlink{variable.this}{\mbox{\isa{this}}} refers to |
|
288 |
an object-logic statement that is an application \isa{{\isachardoublequote}f\ t{\isachardoublequote}}, then |
|
289 |
\isa{t} is bound to the special text variable ``\hyperlink{variable.dots}{\mbox{\isa{{\isasymdots}}}}'' |
|
290 |
(three dots). The canonical application of this convenience are |
|
291 |
calculational proofs (see \secref{sec:calculation}).% |
|
292 |
\end{isamarkuptext}% |
|
293 |
\isamarkuptrue% |
|
294 |
% |
|
295 |
\isamarkupsubsection{Facts and forward chaining% |
|
296 |
} |
|
297 |
\isamarkuptrue% |
|
298 |
% |
|
299 |
\begin{isamarkuptext}% |
|
300 |
\begin{matharray}{rcl} |
|
301 |
\indexdef{}{command}{note}\hypertarget{command.note}{\hyperlink{command.note}{\mbox{\isa{\isacommand{note}}}}} & : & \isa{{\isachardoublequote}proof{\isacharparenleft}state{\isacharparenright}\ {\isasymrightarrow}\ proof{\isacharparenleft}state{\isacharparenright}{\isachardoublequote}} \\ |
|
302 |
\indexdef{}{command}{then}\hypertarget{command.then}{\hyperlink{command.then}{\mbox{\isa{\isacommand{then}}}}} & : & \isa{{\isachardoublequote}proof{\isacharparenleft}state{\isacharparenright}\ {\isasymrightarrow}\ proof{\isacharparenleft}chain{\isacharparenright}{\isachardoublequote}} \\ |
|
303 |
\indexdef{}{command}{from}\hypertarget{command.from}{\hyperlink{command.from}{\mbox{\isa{\isacommand{from}}}}} & : & \isa{{\isachardoublequote}proof{\isacharparenleft}state{\isacharparenright}\ {\isasymrightarrow}\ proof{\isacharparenleft}chain{\isacharparenright}{\isachardoublequote}} \\ |
|
304 |
\indexdef{}{command}{with}\hypertarget{command.with}{\hyperlink{command.with}{\mbox{\isa{\isacommand{with}}}}} & : & \isa{{\isachardoublequote}proof{\isacharparenleft}state{\isacharparenright}\ {\isasymrightarrow}\ proof{\isacharparenleft}chain{\isacharparenright}{\isachardoublequote}} \\ |
|
305 |
\indexdef{}{command}{using}\hypertarget{command.using}{\hyperlink{command.using}{\mbox{\isa{\isacommand{using}}}}} & : & \isa{{\isachardoublequote}proof{\isacharparenleft}prove{\isacharparenright}\ {\isasymrightarrow}\ proof{\isacharparenleft}prove{\isacharparenright}{\isachardoublequote}} \\ |
|
306 |
\indexdef{}{command}{unfolding}\hypertarget{command.unfolding}{\hyperlink{command.unfolding}{\mbox{\isa{\isacommand{unfolding}}}}} & : & \isa{{\isachardoublequote}proof{\isacharparenleft}prove{\isacharparenright}\ {\isasymrightarrow}\ proof{\isacharparenleft}prove{\isacharparenright}{\isachardoublequote}} \\ |
|
26870 | 307 |
\end{matharray} |
308 |
||
309 |
New facts are established either by assumption or proof of local |
|
310 |
statements. Any fact will usually be involved in further proofs, |
|
311 |
either as explicit arguments of proof methods, or when forward |
|
26902 | 312 |
chaining towards the next goal via \hyperlink{command.then}{\mbox{\isa{\isacommand{then}}}} (and variants); |
313 |
\hyperlink{command.from}{\mbox{\isa{\isacommand{from}}}} and \hyperlink{command.with}{\mbox{\isa{\isacommand{with}}}} are composite forms |
|
314 |
involving \hyperlink{command.note}{\mbox{\isa{\isacommand{note}}}}. The \hyperlink{command.using}{\mbox{\isa{\isacommand{using}}}} elements |
|
26870 | 315 |
augments the collection of used facts \emph{after} a goal has been |
26902 | 316 |
stated. Note that the special theorem name \indexref{}{fact}{this}\hyperlink{fact.this}{\mbox{\isa{this}}} refers |
26870 | 317 |
to the most recently established facts, but only \emph{before} |
318 |
issuing a follow-up claim. |
|
319 |
||
320 |
\begin{rail} |
|
321 |
'note' (thmdef? thmrefs + 'and') |
|
322 |
; |
|
323 |
('from' | 'with' | 'using' | 'unfolding') (thmrefs + 'and') |
|
324 |
; |
|
325 |
\end{rail} |
|
326 |
||
28788 | 327 |
\begin{description} |
26870 | 328 |
|
28788 | 329 |
\item \hyperlink{command.note}{\mbox{\isa{\isacommand{note}}}}~\isa{{\isachardoublequote}a\ {\isacharequal}\ b\isactrlsub {\isadigit{1}}\ {\isasymdots}\ b\isactrlsub n{\isachardoublequote}} recalls existing facts |
330 |
\isa{{\isachardoublequote}b\isactrlsub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ b\isactrlsub n{\isachardoublequote}}, binding the result as \isa{a}. Note that |
|
331 |
attributes may be involved as well, both on the left and right hand |
|
332 |
sides. |
|
26870 | 333 |
|
28788 | 334 |
\item \hyperlink{command.then}{\mbox{\isa{\isacommand{then}}}} indicates forward chaining by the current |
26870 | 335 |
facts in order to establish the goal to be claimed next. The |
336 |
initial proof method invoked to refine that will be offered the |
|
337 |
facts to do ``anything appropriate'' (see also |
|
26902 | 338 |
\secref{sec:proof-steps}). For example, method \indexref{}{method}{rule}\hyperlink{method.rule}{\mbox{\isa{rule}}} |
26870 | 339 |
(see \secref{sec:pure-meth-att}) would typically do an elimination |
340 |
rather than an introduction. Automatic methods usually insert the |
|
341 |
facts into the goal state before operation. This provides a simple |
|
342 |
scheme to control relevance of facts in automated proof search. |
|
343 |
||
28788 | 344 |
\item \hyperlink{command.from}{\mbox{\isa{\isacommand{from}}}}~\isa{b} abbreviates ``\hyperlink{command.note}{\mbox{\isa{\isacommand{note}}}}~\isa{b}~\hyperlink{command.then}{\mbox{\isa{\isacommand{then}}}}''; thus \hyperlink{command.then}{\mbox{\isa{\isacommand{then}}}} is |
26902 | 345 |
equivalent to ``\hyperlink{command.from}{\mbox{\isa{\isacommand{from}}}}~\isa{this}''. |
26870 | 346 |
|
28788 | 347 |
\item \hyperlink{command.with}{\mbox{\isa{\isacommand{with}}}}~\isa{{\isachardoublequote}b\isactrlsub {\isadigit{1}}\ {\isasymdots}\ b\isactrlsub n{\isachardoublequote}} abbreviates ``\hyperlink{command.from}{\mbox{\isa{\isacommand{from}}}}~\isa{{\isachardoublequote}b\isactrlsub {\isadigit{1}}\ {\isasymdots}\ b\isactrlsub n\ {\isasymAND}\ this{\isachardoublequote}}''; thus the forward chaining |
348 |
is from earlier facts together with the current ones. |
|
26870 | 349 |
|
28788 | 350 |
\item \hyperlink{command.using}{\mbox{\isa{\isacommand{using}}}}~\isa{{\isachardoublequote}b\isactrlsub {\isadigit{1}}\ {\isasymdots}\ b\isactrlsub n{\isachardoublequote}} augments the facts being |
351 |
currently indicated for use by a subsequent refinement step (such as |
|
352 |
\indexref{}{command}{apply}\hyperlink{command.apply}{\mbox{\isa{\isacommand{apply}}}} or \indexref{}{command}{proof}\hyperlink{command.proof}{\mbox{\isa{\isacommand{proof}}}}). |
|
26870 | 353 |
|
28788 | 354 |
\item \hyperlink{command.unfolding}{\mbox{\isa{\isacommand{unfolding}}}}~\isa{{\isachardoublequote}b\isactrlsub {\isadigit{1}}\ {\isasymdots}\ b\isactrlsub n{\isachardoublequote}} is structurally |
355 |
similar to \hyperlink{command.using}{\mbox{\isa{\isacommand{using}}}}, but unfolds definitional equations |
|
356 |
\isa{{\isachardoublequote}b\isactrlsub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}\ b\isactrlsub n{\isachardoublequote}} throughout the goal state and facts. |
|
26870 | 357 |
|
28788 | 358 |
\end{description} |
26870 | 359 |
|
360 |
Forward chaining with an empty list of theorems is the same as not |
|
26902 | 361 |
chaining at all. Thus ``\hyperlink{command.from}{\mbox{\isa{\isacommand{from}}}}~\isa{nothing}'' has no |
26870 | 362 |
effect apart from entering \isa{{\isachardoublequote}prove{\isacharparenleft}chain{\isacharparenright}{\isachardoublequote}} mode, since |
26902 | 363 |
\indexref{}{fact}{nothing}\hyperlink{fact.nothing}{\mbox{\isa{nothing}}} is bound to the empty list of theorems. |
26870 | 364 |
|
26902 | 365 |
Basic proof methods (such as \indexref{}{method}{rule}\hyperlink{method.rule}{\mbox{\isa{rule}}}) expect multiple |
26870 | 366 |
facts to be given in their proper order, corresponding to a prefix |
367 |
of the premises of the rule involved. Note that positions may be |
|
26902 | 368 |
easily skipped using something like \hyperlink{command.from}{\mbox{\isa{\isacommand{from}}}}~\isa{{\isachardoublequote}{\isacharunderscore}\ {\isasymAND}\ a\ {\isasymAND}\ b{\isachardoublequote}}, for example. This involves the trivial rule |
26870 | 369 |
\isa{{\isachardoublequote}PROP\ {\isasympsi}\ {\isasymLongrightarrow}\ PROP\ {\isasympsi}{\isachardoublequote}}, which is bound in Isabelle/Pure as |
26912 | 370 |
``\indexref{}{fact}{\_}\hyperlink{fact.underscore}{\mbox{\isa{{\isacharunderscore}}}}'' (underscore). |
26870 | 371 |
|
26902 | 372 |
Automated methods (such as \hyperlink{method.simp}{\mbox{\isa{simp}}} or \hyperlink{method.auto}{\mbox{\isa{auto}}}) just |
26870 | 373 |
insert any given facts before their usual operation. Depending on |
374 |
the kind of procedure involved, the order of facts is less |
|
375 |
significant here.% |
|
376 |
\end{isamarkuptext}% |
|
377 |
\isamarkuptrue% |
|
378 |
% |
|
28788 | 379 |
\isamarkupsubsection{Goals \label{sec:goals}% |
26870 | 380 |
} |
381 |
\isamarkuptrue% |
|
382 |
% |
|
383 |
\begin{isamarkuptext}% |
|
384 |
\begin{matharray}{rcl} |
|
28788 | 385 |
\indexdef{}{command}{lemma}\hypertarget{command.lemma}{\hyperlink{command.lemma}{\mbox{\isa{\isacommand{lemma}}}}} & : & \isa{{\isachardoublequote}local{\isacharunderscore}theory\ {\isasymrightarrow}\ proof{\isacharparenleft}prove{\isacharparenright}{\isachardoublequote}} \\ |
386 |
\indexdef{}{command}{theorem}\hypertarget{command.theorem}{\hyperlink{command.theorem}{\mbox{\isa{\isacommand{theorem}}}}} & : & \isa{{\isachardoublequote}local{\isacharunderscore}theory\ {\isasymrightarrow}\ proof{\isacharparenleft}prove{\isacharparenright}{\isachardoublequote}} \\ |
|
387 |
\indexdef{}{command}{corollary}\hypertarget{command.corollary}{\hyperlink{command.corollary}{\mbox{\isa{\isacommand{corollary}}}}} & : & \isa{{\isachardoublequote}local{\isacharunderscore}theory\ {\isasymrightarrow}\ proof{\isacharparenleft}prove{\isacharparenright}{\isachardoublequote}} \\ |
|
388 |
\indexdef{}{command}{have}\hypertarget{command.have}{\hyperlink{command.have}{\mbox{\isa{\isacommand{have}}}}} & : & \isa{{\isachardoublequote}proof{\isacharparenleft}state{\isacharparenright}\ {\isacharbar}\ proof{\isacharparenleft}chain{\isacharparenright}\ {\isasymrightarrow}\ proof{\isacharparenleft}prove{\isacharparenright}{\isachardoublequote}} \\ |
|
389 |
\indexdef{}{command}{show}\hypertarget{command.show}{\hyperlink{command.show}{\mbox{\isa{\isacommand{show}}}}} & : & \isa{{\isachardoublequote}proof{\isacharparenleft}state{\isacharparenright}\ {\isacharbar}\ proof{\isacharparenleft}chain{\isacharparenright}\ {\isasymrightarrow}\ proof{\isacharparenleft}prove{\isacharparenright}{\isachardoublequote}} \\ |
|
390 |
\indexdef{}{command}{hence}\hypertarget{command.hence}{\hyperlink{command.hence}{\mbox{\isa{\isacommand{hence}}}}} & : & \isa{{\isachardoublequote}proof{\isacharparenleft}state{\isacharparenright}\ {\isasymrightarrow}\ proof{\isacharparenleft}prove{\isacharparenright}{\isachardoublequote}} \\ |
|
391 |
\indexdef{}{command}{thus}\hypertarget{command.thus}{\hyperlink{command.thus}{\mbox{\isa{\isacommand{thus}}}}} & : & \isa{{\isachardoublequote}proof{\isacharparenleft}state{\isacharparenright}\ {\isasymrightarrow}\ proof{\isacharparenleft}prove{\isacharparenright}{\isachardoublequote}} \\ |
|
392 |
\indexdef{}{command}{print\_statement}\hypertarget{command.print-statement}{\hyperlink{command.print-statement}{\mbox{\isa{\isacommand{print{\isacharunderscore}statement}}}}}\isa{{\isachardoublequote}\isactrlsup {\isacharasterisk}{\isachardoublequote}} & : & \isa{{\isachardoublequote}context\ {\isasymrightarrow}{\isachardoublequote}} \\ |
|
26870 | 393 |
\end{matharray} |
394 |
||
395 |
From a theory context, proof mode is entered by an initial goal |
|
26902 | 396 |
command such as \hyperlink{command.lemma}{\mbox{\isa{\isacommand{lemma}}}}, \hyperlink{command.theorem}{\mbox{\isa{\isacommand{theorem}}}}, or |
397 |
\hyperlink{command.corollary}{\mbox{\isa{\isacommand{corollary}}}}. Within a proof, new claims may be |
|
26870 | 398 |
introduced locally as well; four variants are available here to |
399 |
indicate whether forward chaining of facts should be performed |
|
26902 | 400 |
initially (via \indexref{}{command}{then}\hyperlink{command.then}{\mbox{\isa{\isacommand{then}}}}), and whether the final result |
26870 | 401 |
is meant to solve some pending goal. |
402 |
||
403 |
Goals may consist of multiple statements, resulting in a list of |
|
404 |
facts eventually. A pending multi-goal is internally represented as |
|
28857 | 405 |
a meta-level conjunction (\isa{{\isachardoublequote}{\isacharampersand}{\isacharampersand}{\isacharampersand}{\isachardoublequote}}), which is usually |
26870 | 406 |
split into the corresponding number of sub-goals prior to an initial |
26902 | 407 |
method application, via \indexref{}{command}{proof}\hyperlink{command.proof}{\mbox{\isa{\isacommand{proof}}}} |
408 |
(\secref{sec:proof-steps}) or \indexref{}{command}{apply}\hyperlink{command.apply}{\mbox{\isa{\isacommand{apply}}}} |
|
409 |
(\secref{sec:tactic-commands}). The \indexref{}{method}{induct}\hyperlink{method.induct}{\mbox{\isa{induct}}} method |
|
26870 | 410 |
covered in \secref{sec:cases-induct} acts on multiple claims |
411 |
simultaneously. |
|
412 |
||
413 |
Claims at the theory level may be either in short or long form. A |
|
414 |
short goal merely consists of several simultaneous propositions |
|
415 |
(often just one). A long goal includes an explicit context |
|
416 |
specification for the subsequent conclusion, involving local |
|
417 |
parameters and assumptions. Here the role of each part of the |
|
418 |
statement is explicitly marked by separate keywords (see also |
|
419 |
\secref{sec:locale}); the local assumptions being introduced here |
|
26902 | 420 |
are available as \indexref{}{fact}{assms}\hyperlink{fact.assms}{\mbox{\isa{assms}}} in the proof. Moreover, there |
421 |
are two kinds of conclusions: \indexdef{}{element}{shows}\hypertarget{element.shows}{\hyperlink{element.shows}{\mbox{\isa{\isakeyword{shows}}}}} states several |
|
26870 | 422 |
simultaneous propositions (essentially a big conjunction), while |
26902 | 423 |
\indexdef{}{element}{obtains}\hypertarget{element.obtains}{\hyperlink{element.obtains}{\mbox{\isa{\isakeyword{obtains}}}}} claims several simultaneous simultaneous |
26870 | 424 |
contexts of (essentially a big disjunction of eliminated parameters |
425 |
and assumptions, cf.\ \secref{sec:obtain}). |
|
426 |
||
427 |
\begin{rail} |
|
428 |
('lemma' | 'theorem' | 'corollary') target? (goal | longgoal) |
|
429 |
; |
|
430 |
('have' | 'show' | 'hence' | 'thus') goal |
|
431 |
; |
|
432 |
'print\_statement' modes? thmrefs |
|
433 |
; |
|
434 |
||
435 |
goal: (props + 'and') |
|
436 |
; |
|
437 |
longgoal: thmdecl? (contextelem *) conclusion |
|
438 |
; |
|
439 |
conclusion: 'shows' goal | 'obtains' (parname? case + '|') |
|
440 |
; |
|
441 |
case: (vars + 'and') 'where' (props + 'and') |
|
442 |
; |
|
443 |
\end{rail} |
|
444 |
||
28788 | 445 |
\begin{description} |
26870 | 446 |
|
28788 | 447 |
\item \hyperlink{command.lemma}{\mbox{\isa{\isacommand{lemma}}}}~\isa{{\isachardoublequote}a{\isacharcolon}\ {\isasymphi}{\isachardoublequote}} enters proof mode with |
26870 | 448 |
\isa{{\isasymphi}} as main goal, eventually resulting in some fact \isa{{\isachardoublequote}{\isasymturnstile}\ {\isasymphi}{\isachardoublequote}} to be put back into the target context. An additional |
449 |
\railnonterm{context} specification may build up an initial proof |
|
450 |
context for the subsequent claim; this includes local definitions |
|
26902 | 451 |
and syntax as well, see the definition of \hyperlink{syntax.contextelem}{\mbox{\isa{contextelem}}} in |
26870 | 452 |
\secref{sec:locale}. |
453 |
||
28788 | 454 |
\item \hyperlink{command.theorem}{\mbox{\isa{\isacommand{theorem}}}}~\isa{{\isachardoublequote}a{\isacharcolon}\ {\isasymphi}{\isachardoublequote}} and \hyperlink{command.corollary}{\mbox{\isa{\isacommand{corollary}}}}~\isa{{\isachardoublequote}a{\isacharcolon}\ {\isasymphi}{\isachardoublequote}} are essentially the same as \hyperlink{command.lemma}{\mbox{\isa{\isacommand{lemma}}}}~\isa{{\isachardoublequote}a{\isacharcolon}\ {\isasymphi}{\isachardoublequote}}, but the facts are internally marked as |
26870 | 455 |
being of a different kind. This discrimination acts like a formal |
456 |
comment. |
|
457 |
||
28788 | 458 |
\item \hyperlink{command.have}{\mbox{\isa{\isacommand{have}}}}~\isa{{\isachardoublequote}a{\isacharcolon}\ {\isasymphi}{\isachardoublequote}} claims a local goal, |
26870 | 459 |
eventually resulting in a fact within the current logical context. |
460 |
This operation is completely independent of any pending sub-goals of |
|
26902 | 461 |
an enclosing goal statements, so \hyperlink{command.have}{\mbox{\isa{\isacommand{have}}}} may be freely |
26870 | 462 |
used for experimental exploration of potential results within a |
463 |
proof body. |
|
464 |
||
28788 | 465 |
\item \hyperlink{command.show}{\mbox{\isa{\isacommand{show}}}}~\isa{{\isachardoublequote}a{\isacharcolon}\ {\isasymphi}{\isachardoublequote}} is like \hyperlink{command.have}{\mbox{\isa{\isacommand{have}}}}~\isa{{\isachardoublequote}a{\isacharcolon}\ {\isasymphi}{\isachardoublequote}} plus a second stage to refine some pending |
26870 | 466 |
sub-goal for each one of the finished result, after having been |
467 |
exported into the corresponding context (at the head of the |
|
26902 | 468 |
sub-proof of this \hyperlink{command.show}{\mbox{\isa{\isacommand{show}}}} command). |
26870 | 469 |
|
470 |
To accommodate interactive debugging, resulting rules are printed |
|
471 |
before being applied internally. Even more, interactive execution |
|
26902 | 472 |
of \hyperlink{command.show}{\mbox{\isa{\isacommand{show}}}} predicts potential failure and displays the |
26870 | 473 |
resulting error as a warning beforehand. Watch out for the |
474 |
following message: |
|
475 |
||
476 |
%FIXME proper antiquitation |
|
477 |
\begin{ttbox} |
|
478 |
Problem! Local statement will fail to solve any pending goal |
|
479 |
\end{ttbox} |
|
480 |
||
28788 | 481 |
\item \hyperlink{command.hence}{\mbox{\isa{\isacommand{hence}}}} abbreviates ``\hyperlink{command.then}{\mbox{\isa{\isacommand{then}}}}~\hyperlink{command.have}{\mbox{\isa{\isacommand{have}}}}'', i.e.\ claims a local goal to be proven by forward |
26902 | 482 |
chaining the current facts. Note that \hyperlink{command.hence}{\mbox{\isa{\isacommand{hence}}}} is also |
483 |
equivalent to ``\hyperlink{command.from}{\mbox{\isa{\isacommand{from}}}}~\isa{this}~\hyperlink{command.have}{\mbox{\isa{\isacommand{have}}}}''. |
|
26870 | 484 |
|
28788 | 485 |
\item \hyperlink{command.thus}{\mbox{\isa{\isacommand{thus}}}} abbreviates ``\hyperlink{command.then}{\mbox{\isa{\isacommand{then}}}}~\hyperlink{command.show}{\mbox{\isa{\isacommand{show}}}}''. Note that \hyperlink{command.thus}{\mbox{\isa{\isacommand{thus}}}} is also equivalent to |
26902 | 486 |
``\hyperlink{command.from}{\mbox{\isa{\isacommand{from}}}}~\isa{this}~\hyperlink{command.show}{\mbox{\isa{\isacommand{show}}}}''. |
26870 | 487 |
|
28788 | 488 |
\item \hyperlink{command.print-statement}{\mbox{\isa{\isacommand{print{\isacharunderscore}statement}}}}~\isa{a} prints facts from the |
26870 | 489 |
current theory or proof context in long statement form, according to |
26902 | 490 |
the syntax for \hyperlink{command.lemma}{\mbox{\isa{\isacommand{lemma}}}} given above. |
26870 | 491 |
|
28788 | 492 |
\end{description} |
26870 | 493 |
|
494 |
Any goal statement causes some term abbreviations (such as |
|
26902 | 495 |
\indexref{}{variable}{?thesis}\hyperlink{variable.?thesis}{\mbox{\isa{{\isacharquery}thesis}}}) to be bound automatically, see also |
26961 | 496 |
\secref{sec:term-abbrev}. |
26870 | 497 |
|
26902 | 498 |
The optional case names of \indexref{}{element}{obtains}\hyperlink{element.obtains}{\mbox{\isa{\isakeyword{obtains}}}} have a twofold |
26870 | 499 |
meaning: (1) during the of this claim they refer to the the local |
500 |
context introductions, (2) the resulting rule is annotated |
|
501 |
accordingly to support symbolic case splits when used with the |
|
27124 | 502 |
\indexref{}{method}{cases}\hyperlink{method.cases}{\mbox{\isa{cases}}} method (cf.\ \secref{sec:cases-induct}). |
26870 | 503 |
|
504 |
\medskip |
|
505 |
||
506 |
\begin{warn} |
|
507 |
Isabelle/Isar suffers theory-level goal statements to contain |
|
508 |
\emph{unbound schematic variables}, although this does not conform |
|
509 |
to the aim of human-readable proof documents! The main problem |
|
510 |
with schematic goals is that the actual outcome is usually hard to |
|
511 |
predict, depending on the behavior of the proof methods applied |
|
512 |
during the course of reasoning. Note that most semi-automated |
|
513 |
methods heavily depend on several kinds of implicit rule |
|
514 |
declarations within the current theory context. As this would |
|
515 |
also result in non-compositional checking of sub-proofs, |
|
516 |
\emph{local goals} are not allowed to be schematic at all. |
|
517 |
Nevertheless, schematic goals do have their use in Prolog-style |
|
518 |
interactive synthesis of proven results, usually by stepwise |
|
519 |
refinement via emulation of traditional Isabelle tactic scripts |
|
520 |
(see also \secref{sec:tactic-commands}). In any case, users |
|
521 |
should know what they are doing. |
|
522 |
\end{warn}% |
|
523 |
\end{isamarkuptext}% |
|
524 |
\isamarkuptrue% |
|
525 |
% |
|
28788 | 526 |
\isamarkupsection{Refinement steps% |
527 |
} |
|
528 |
\isamarkuptrue% |
|
529 |
% |
|
530 |
\isamarkupsubsection{Proof method expressions \label{sec:proof-meth}% |
|
531 |
} |
|
532 |
\isamarkuptrue% |
|
533 |
% |
|
534 |
\begin{isamarkuptext}% |
|
535 |
Proof methods are either basic ones, or expressions composed of |
|
536 |
methods via ``\verb|,|'' (sequential composition), |
|
537 |
``\verb||\verb,|,\verb||'' (alternative choices), ``\verb|?|'' |
|
538 |
(try), ``\verb|+|'' (repeat at least once), ``\verb|[|\isa{n}\verb|]|'' (restriction to first \isa{n} |
|
539 |
sub-goals, with default \isa{{\isachardoublequote}n\ {\isacharequal}\ {\isadigit{1}}{\isachardoublequote}}). In practice, proof |
|
540 |
methods are usually just a comma separated list of |
|
541 |
\railqtok{nameref}~\railnonterm{args} specifications. Note that |
|
542 |
parentheses may be dropped for single method specifications (with no |
|
543 |
arguments). |
|
544 |
||
545 |
\indexouternonterm{method} |
|
546 |
\begin{rail} |
|
547 |
method: (nameref | '(' methods ')') (() | '?' | '+' | '[' nat? ']') |
|
548 |
; |
|
549 |
methods: (nameref args | method) + (',' | '|') |
|
550 |
; |
|
551 |
\end{rail} |
|
552 |
||
553 |
Proper Isar proof methods do \emph{not} admit arbitrary goal |
|
554 |
addressing, but refer either to the first sub-goal or all sub-goals |
|
555 |
uniformly. The goal restriction operator ``\isa{{\isachardoublequote}{\isacharbrackleft}n{\isacharbrackright}{\isachardoublequote}}'' |
|
556 |
evaluates a method expression within a sandbox consisting of the |
|
557 |
first \isa{n} sub-goals (which need to exist). For example, the |
|
558 |
method ``\isa{{\isachardoublequote}simp{\isacharunderscore}all{\isacharbrackleft}{\isadigit{3}}{\isacharbrackright}{\isachardoublequote}}'' simplifies the first three |
|
559 |
sub-goals, while ``\isa{{\isachardoublequote}{\isacharparenleft}rule\ foo{\isacharcomma}\ simp{\isacharunderscore}all{\isacharparenright}{\isacharbrackleft}{\isacharbrackright}{\isachardoublequote}}'' simplifies all |
|
560 |
new goals that emerge from applying rule \isa{{\isachardoublequote}foo{\isachardoublequote}} to the |
|
561 |
originally first one. |
|
562 |
||
563 |
Improper methods, notably tactic emulations, offer a separate |
|
564 |
low-level goal addressing scheme as explicit argument to the |
|
565 |
individual tactic being involved. Here ``\isa{{\isachardoublequote}{\isacharbrackleft}{\isacharbang}{\isacharbrackright}{\isachardoublequote}}'' refers to |
|
566 |
all goals, and ``\isa{{\isachardoublequote}{\isacharbrackleft}n{\isacharminus}{\isacharbrackright}{\isachardoublequote}}'' to all goals starting from \isa{{\isachardoublequote}n{\isachardoublequote}}. |
|
567 |
||
568 |
\indexouternonterm{goalspec} |
|
569 |
\begin{rail} |
|
570 |
goalspec: '[' (nat '-' nat | nat '-' | nat | '!' ) ']' |
|
571 |
; |
|
572 |
\end{rail}% |
|
573 |
\end{isamarkuptext}% |
|
574 |
\isamarkuptrue% |
|
575 |
% |
|
576 |
\isamarkupsubsection{Initial and terminal proof steps \label{sec:proof-steps}% |
|
26870 | 577 |
} |
578 |
\isamarkuptrue% |
|
579 |
% |
|
580 |
\begin{isamarkuptext}% |
|
581 |
\begin{matharray}{rcl} |
|
28788 | 582 |
\indexdef{}{command}{proof}\hypertarget{command.proof}{\hyperlink{command.proof}{\mbox{\isa{\isacommand{proof}}}}} & : & \isa{{\isachardoublequote}proof{\isacharparenleft}prove{\isacharparenright}\ {\isasymrightarrow}\ proof{\isacharparenleft}state{\isacharparenright}{\isachardoublequote}} \\ |
583 |
\indexdef{}{command}{qed}\hypertarget{command.qed}{\hyperlink{command.qed}{\mbox{\isa{\isacommand{qed}}}}} & : & \isa{{\isachardoublequote}proof{\isacharparenleft}state{\isacharparenright}\ {\isasymrightarrow}\ proof{\isacharparenleft}state{\isacharparenright}\ {\isacharbar}\ local{\isacharunderscore}theory\ {\isacharbar}\ theory{\isachardoublequote}} \\ |
|
584 |
\indexdef{}{command}{by}\hypertarget{command.by}{\hyperlink{command.by}{\mbox{\isa{\isacommand{by}}}}} & : & \isa{{\isachardoublequote}proof{\isacharparenleft}prove{\isacharparenright}\ {\isasymrightarrow}\ proof{\isacharparenleft}state{\isacharparenright}\ {\isacharbar}\ local{\isacharunderscore}theory\ {\isacharbar}\ theory{\isachardoublequote}} \\ |
|
585 |
\indexdef{}{command}{..}\hypertarget{command.ddot}{\hyperlink{command.ddot}{\mbox{\isa{\isacommand{{\isachardot}{\isachardot}}}}}} & : & \isa{{\isachardoublequote}proof{\isacharparenleft}prove{\isacharparenright}\ {\isasymrightarrow}\ proof{\isacharparenleft}state{\isacharparenright}\ {\isacharbar}\ local{\isacharunderscore}theory\ {\isacharbar}\ theory{\isachardoublequote}} \\ |
|
586 |
\indexdef{}{command}{.}\hypertarget{command.dot}{\hyperlink{command.dot}{\mbox{\isa{\isacommand{{\isachardot}}}}}} & : & \isa{{\isachardoublequote}proof{\isacharparenleft}prove{\isacharparenright}\ {\isasymrightarrow}\ proof{\isacharparenleft}state{\isacharparenright}\ {\isacharbar}\ local{\isacharunderscore}theory\ {\isacharbar}\ theory{\isachardoublequote}} \\ |
|
587 |
\indexdef{}{command}{sorry}\hypertarget{command.sorry}{\hyperlink{command.sorry}{\mbox{\isa{\isacommand{sorry}}}}} & : & \isa{{\isachardoublequote}proof{\isacharparenleft}prove{\isacharparenright}\ {\isasymrightarrow}\ proof{\isacharparenleft}state{\isacharparenright}\ {\isacharbar}\ local{\isacharunderscore}theory\ {\isacharbar}\ theory{\isachardoublequote}} \\ |
|
26870 | 588 |
\end{matharray} |
589 |
||
590 |
Arbitrary goal refinement via tactics is considered harmful. |
|
591 |
Structured proof composition in Isar admits proof methods to be |
|
592 |
invoked in two places only. |
|
593 |
||
594 |
\begin{enumerate} |
|
595 |
||
26902 | 596 |
\item An \emph{initial} refinement step \indexref{}{command}{proof}\hyperlink{command.proof}{\mbox{\isa{\isacommand{proof}}}}~\isa{{\isachardoublequote}m\isactrlsub {\isadigit{1}}{\isachardoublequote}} reduces a newly stated goal to a number |
26870 | 597 |
of sub-goals that are to be solved later. Facts are passed to |
598 |
\isa{{\isachardoublequote}m\isactrlsub {\isadigit{1}}{\isachardoublequote}} for forward chaining, if so indicated by \isa{{\isachardoublequote}proof{\isacharparenleft}chain{\isacharparenright}{\isachardoublequote}} mode. |
|
599 |
||
26902 | 600 |
\item A \emph{terminal} conclusion step \indexref{}{command}{qed}\hyperlink{command.qed}{\mbox{\isa{\isacommand{qed}}}}~\isa{{\isachardoublequote}m\isactrlsub {\isadigit{2}}{\isachardoublequote}} is intended to solve remaining goals. No facts are |
26870 | 601 |
passed to \isa{{\isachardoublequote}m\isactrlsub {\isadigit{2}}{\isachardoublequote}}. |
602 |
||
603 |
\end{enumerate} |
|
604 |
||
605 |
The only other (proper) way to affect pending goals in a proof body |
|
26902 | 606 |
is by \indexref{}{command}{show}\hyperlink{command.show}{\mbox{\isa{\isacommand{show}}}}, which involves an explicit statement of |
26870 | 607 |
what is to be solved eventually. Thus we avoid the fundamental |
608 |
problem of unstructured tactic scripts that consist of numerous |
|
609 |
consecutive goal transformations, with invisible effects. |
|
610 |
||
611 |
\medskip As a general rule of thumb for good proof style, initial |
|
612 |
proof methods should either solve the goal completely, or constitute |
|
613 |
some well-understood reduction to new sub-goals. Arbitrary |
|
614 |
automatic proof tools that are prone leave a large number of badly |
|
615 |
structured sub-goals are no help in continuing the proof document in |
|
616 |
an intelligible manner. |
|
617 |
||
618 |
Unless given explicitly by the user, the default initial method is |
|
26902 | 619 |
``\indexref{}{method}{rule}\hyperlink{method.rule}{\mbox{\isa{rule}}}'', which applies a single standard elimination |
26870 | 620 |
or introduction rule according to the topmost symbol involved. |
621 |
There is no separate default terminal method. Any remaining goals |
|
622 |
are always solved by assumption in the very last step. |
|
623 |
||
624 |
\begin{rail} |
|
625 |
'proof' method? |
|
626 |
; |
|
627 |
'qed' method? |
|
628 |
; |
|
629 |
'by' method method? |
|
630 |
; |
|
631 |
('.' | '..' | 'sorry') |
|
632 |
; |
|
633 |
\end{rail} |
|
634 |
||
28788 | 635 |
\begin{description} |
26870 | 636 |
|
28788 | 637 |
\item \hyperlink{command.proof}{\mbox{\isa{\isacommand{proof}}}}~\isa{{\isachardoublequote}m\isactrlsub {\isadigit{1}}{\isachardoublequote}} refines the goal by proof |
638 |
method \isa{{\isachardoublequote}m\isactrlsub {\isadigit{1}}{\isachardoublequote}}; facts for forward chaining are passed if so |
|
639 |
indicated by \isa{{\isachardoublequote}proof{\isacharparenleft}chain{\isacharparenright}{\isachardoublequote}} mode. |
|
26870 | 640 |
|
28788 | 641 |
\item \hyperlink{command.qed}{\mbox{\isa{\isacommand{qed}}}}~\isa{{\isachardoublequote}m\isactrlsub {\isadigit{2}}{\isachardoublequote}} refines any remaining goals by |
642 |
proof method \isa{{\isachardoublequote}m\isactrlsub {\isadigit{2}}{\isachardoublequote}} and concludes the sub-proof by assumption. |
|
643 |
If the goal had been \isa{{\isachardoublequote}show{\isachardoublequote}} (or \isa{{\isachardoublequote}thus{\isachardoublequote}}), some |
|
644 |
pending sub-goal is solved as well by the rule resulting from the |
|
645 |
result \emph{exported} into the enclosing goal context. Thus \isa{{\isachardoublequote}qed{\isachardoublequote}} may fail for two reasons: either \isa{{\isachardoublequote}m\isactrlsub {\isadigit{2}}{\isachardoublequote}} fails, or the |
|
646 |
resulting rule does not fit to any pending goal\footnote{This |
|
647 |
includes any additional ``strong'' assumptions as introduced by |
|
648 |
\hyperlink{command.assume}{\mbox{\isa{\isacommand{assume}}}}.} of the enclosing context. Debugging such a |
|
649 |
situation might involve temporarily changing \hyperlink{command.show}{\mbox{\isa{\isacommand{show}}}} into |
|
650 |
\hyperlink{command.have}{\mbox{\isa{\isacommand{have}}}}, or weakening the local context by replacing |
|
651 |
occurrences of \hyperlink{command.assume}{\mbox{\isa{\isacommand{assume}}}} by \hyperlink{command.presume}{\mbox{\isa{\isacommand{presume}}}}. |
|
26870 | 652 |
|
28788 | 653 |
\item \hyperlink{command.by}{\mbox{\isa{\isacommand{by}}}}~\isa{{\isachardoublequote}m\isactrlsub {\isadigit{1}}\ m\isactrlsub {\isadigit{2}}{\isachardoublequote}} is a \emph{terminal |
654 |
proof}\index{proof!terminal}; it abbreviates \hyperlink{command.proof}{\mbox{\isa{\isacommand{proof}}}}~\isa{{\isachardoublequote}m\isactrlsub {\isadigit{1}}{\isachardoublequote}}~\isa{{\isachardoublequote}qed{\isachardoublequote}}~\isa{{\isachardoublequote}m\isactrlsub {\isadigit{2}}{\isachardoublequote}}, but with |
|
655 |
backtracking across both methods. Debugging an unsuccessful |
|
656 |
\hyperlink{command.by}{\mbox{\isa{\isacommand{by}}}}~\isa{{\isachardoublequote}m\isactrlsub {\isadigit{1}}\ m\isactrlsub {\isadigit{2}}{\isachardoublequote}} command can be done by expanding its |
|
657 |
definition; in many cases \hyperlink{command.proof}{\mbox{\isa{\isacommand{proof}}}}~\isa{{\isachardoublequote}m\isactrlsub {\isadigit{1}}{\isachardoublequote}} (or even |
|
658 |
\isa{{\isachardoublequote}apply{\isachardoublequote}}~\isa{{\isachardoublequote}m\isactrlsub {\isadigit{1}}{\isachardoublequote}}) is already sufficient to see the |
|
26870 | 659 |
problem. |
660 |
||
28788 | 661 |
\item ``\hyperlink{command.ddot}{\mbox{\isa{\isacommand{{\isachardot}{\isachardot}}}}}'' is a \emph{default |
26902 | 662 |
proof}\index{proof!default}; it abbreviates \hyperlink{command.by}{\mbox{\isa{\isacommand{by}}}}~\isa{{\isachardoublequote}rule{\isachardoublequote}}. |
26870 | 663 |
|
28788 | 664 |
\item ``\hyperlink{command.dot}{\mbox{\isa{\isacommand{{\isachardot}}}}}'' is a \emph{trivial |
26902 | 665 |
proof}\index{proof!trivial}; it abbreviates \hyperlink{command.by}{\mbox{\isa{\isacommand{by}}}}~\isa{{\isachardoublequote}this{\isachardoublequote}}. |
26870 | 666 |
|
28788 | 667 |
\item \hyperlink{command.sorry}{\mbox{\isa{\isacommand{sorry}}}} is a \emph{fake proof}\index{proof!fake} |
26870 | 668 |
pretending to solve the pending claim without further ado. This |
669 |
only works in interactive development, or if the \verb|quick_and_dirty| flag is enabled (in ML). Facts emerging from fake |
|
670 |
proofs are not the real thing. Internally, each theorem container |
|
671 |
is tainted by an oracle invocation, which is indicated as ``\isa{{\isachardoublequote}{\isacharbrackleft}{\isacharbang}{\isacharbrackright}{\isachardoublequote}}'' in the printed result. |
|
672 |
||
26902 | 673 |
The most important application of \hyperlink{command.sorry}{\mbox{\isa{\isacommand{sorry}}}} is to support |
26870 | 674 |
experimentation and top-down proof development. |
675 |
||
28788 | 676 |
\end{description}% |
26870 | 677 |
\end{isamarkuptext}% |
678 |
\isamarkuptrue% |
|
679 |
% |
|
28788 | 680 |
\isamarkupsubsection{Fundamental methods and attributes \label{sec:pure-meth-att}% |
26870 | 681 |
} |
682 |
\isamarkuptrue% |
|
683 |
% |
|
684 |
\begin{isamarkuptext}% |
|
685 |
The following proof methods and attributes refer to basic logical |
|
686 |
operations of Isar. Further methods and attributes are provided by |
|
687 |
several generic and object-logic specific tools and packages (see |
|
688 |
\chref{ch:gen-tools} and \chref{ch:hol}). |
|
689 |
||
690 |
\begin{matharray}{rcl} |
|
28788 | 691 |
\indexdef{}{method}{-}\hypertarget{method.-}{\hyperlink{method.-}{\mbox{\isa{{\isacharminus}}}}} & : & \isa{method} \\ |
692 |
\indexdef{}{method}{fact}\hypertarget{method.fact}{\hyperlink{method.fact}{\mbox{\isa{fact}}}} & : & \isa{method} \\ |
|
693 |
\indexdef{}{method}{assumption}\hypertarget{method.assumption}{\hyperlink{method.assumption}{\mbox{\isa{assumption}}}} & : & \isa{method} \\ |
|
694 |
\indexdef{}{method}{this}\hypertarget{method.this}{\hyperlink{method.this}{\mbox{\isa{this}}}} & : & \isa{method} \\ |
|
695 |
\indexdef{}{method}{rule}\hypertarget{method.rule}{\hyperlink{method.rule}{\mbox{\isa{rule}}}} & : & \isa{method} \\ |
|
696 |
\indexdef{Pure}{attribute}{intro}\hypertarget{attribute.Pure.intro}{\hyperlink{attribute.Pure.intro}{\mbox{\isa{intro}}}} & : & \isa{attribute} \\ |
|
697 |
\indexdef{Pure}{attribute}{elim}\hypertarget{attribute.Pure.elim}{\hyperlink{attribute.Pure.elim}{\mbox{\isa{elim}}}} & : & \isa{attribute} \\ |
|
698 |
\indexdef{Pure}{attribute}{dest}\hypertarget{attribute.Pure.dest}{\hyperlink{attribute.Pure.dest}{\mbox{\isa{dest}}}} & : & \isa{attribute} \\ |
|
699 |
\indexdef{}{attribute}{rule}\hypertarget{attribute.rule}{\hyperlink{attribute.rule}{\mbox{\isa{rule}}}} & : & \isa{attribute} \\[0.5ex] |
|
700 |
\indexdef{}{attribute}{OF}\hypertarget{attribute.OF}{\hyperlink{attribute.OF}{\mbox{\isa{OF}}}} & : & \isa{attribute} \\ |
|
701 |
\indexdef{}{attribute}{of}\hypertarget{attribute.of}{\hyperlink{attribute.of}{\mbox{\isa{of}}}} & : & \isa{attribute} \\ |
|
702 |
\indexdef{}{attribute}{where}\hypertarget{attribute.where}{\hyperlink{attribute.where}{\mbox{\isa{where}}}} & : & \isa{attribute} \\ |
|
26870 | 703 |
\end{matharray} |
704 |
||
705 |
\begin{rail} |
|
706 |
'fact' thmrefs? |
|
707 |
; |
|
708 |
'rule' thmrefs? |
|
709 |
; |
|
710 |
rulemod: ('intro' | 'elim' | 'dest') ((('!' | () | '?') nat?) | 'del') ':' thmrefs |
|
711 |
; |
|
712 |
('intro' | 'elim' | 'dest') ('!' | () | '?') nat? |
|
713 |
; |
|
714 |
'rule' 'del' |
|
715 |
; |
|
716 |
'OF' thmrefs |
|
717 |
; |
|
718 |
'of' insts ('concl' ':' insts)? |
|
719 |
; |
|
720 |
'where' ((name | var | typefree | typevar) '=' (type | term) * 'and') |
|
721 |
; |
|
722 |
\end{rail} |
|
723 |
||
28788 | 724 |
\begin{description} |
26870 | 725 |
|
28788 | 726 |
\item ``\hyperlink{method.-}{\mbox{\isa{{\isacharminus}}}}'' (minus) does nothing but insert the forward |
727 |
chaining facts as premises into the goal. Note that command |
|
26902 | 728 |
\indexref{}{command}{proof}\hyperlink{command.proof}{\mbox{\isa{\isacommand{proof}}}} without any method actually performs a single |
729 |
reduction step using the \indexref{}{method}{rule}\hyperlink{method.rule}{\mbox{\isa{rule}}} method; thus a plain |
|
730 |
\emph{do-nothing} proof step would be ``\hyperlink{command.proof}{\mbox{\isa{\isacommand{proof}}}}~\isa{{\isachardoublequote}{\isacharminus}{\isachardoublequote}}'' rather than \hyperlink{command.proof}{\mbox{\isa{\isacommand{proof}}}} alone. |
|
26870 | 731 |
|
28788 | 732 |
\item \hyperlink{method.fact}{\mbox{\isa{fact}}}~\isa{{\isachardoublequote}a\isactrlsub {\isadigit{1}}\ {\isasymdots}\ a\isactrlsub n{\isachardoublequote}} composes some fact from |
733 |
\isa{{\isachardoublequote}a\isactrlsub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ a\isactrlsub n{\isachardoublequote}} (or implicitly from the current proof context) |
|
734 |
modulo unification of schematic type and term variables. The rule |
|
735 |
structure is not taken into account, i.e.\ meta-level implication is |
|
736 |
considered atomic. This is the same principle underlying literal |
|
737 |
facts (cf.\ \secref{sec:syn-att}): ``\hyperlink{command.have}{\mbox{\isa{\isacommand{have}}}}~\isa{{\isachardoublequote}{\isasymphi}{\isachardoublequote}}~\hyperlink{command.by}{\mbox{\isa{\isacommand{by}}}}~\isa{fact}'' is equivalent to ``\hyperlink{command.note}{\mbox{\isa{\isacommand{note}}}}~\verb|`|\isa{{\isasymphi}}\verb|`|'' provided that |
|
738 |
\isa{{\isachardoublequote}{\isasymturnstile}\ {\isasymphi}{\isachardoublequote}} is an instance of some known \isa{{\isachardoublequote}{\isasymturnstile}\ {\isasymphi}{\isachardoublequote}} in the |
|
739 |
proof context. |
|
26870 | 740 |
|
28788 | 741 |
\item \hyperlink{method.assumption}{\mbox{\isa{assumption}}} solves some goal by a single assumption |
26870 | 742 |
step. All given facts are guaranteed to participate in the |
743 |
refinement; this means there may be only 0 or 1 in the first place. |
|
26902 | 744 |
Recall that \hyperlink{command.qed}{\mbox{\isa{\isacommand{qed}}}} (\secref{sec:proof-steps}) already |
26870 | 745 |
concludes any remaining sub-goals by assumption, so structured |
26902 | 746 |
proofs usually need not quote the \hyperlink{method.assumption}{\mbox{\isa{assumption}}} method at |
26870 | 747 |
all. |
748 |
||
28788 | 749 |
\item \hyperlink{method.this}{\mbox{\isa{this}}} applies all of the current facts directly as |
26902 | 750 |
rules. Recall that ``\hyperlink{command.dot}{\mbox{\isa{\isacommand{{\isachardot}}}}}'' (dot) abbreviates ``\hyperlink{command.by}{\mbox{\isa{\isacommand{by}}}}~\isa{this}''. |
26870 | 751 |
|
28788 | 752 |
\item \hyperlink{method.rule}{\mbox{\isa{rule}}}~\isa{{\isachardoublequote}a\isactrlsub {\isadigit{1}}\ {\isasymdots}\ a\isactrlsub n{\isachardoublequote}} applies some rule given as |
753 |
argument in backward manner; facts are used to reduce the rule |
|
754 |
before applying it to the goal. Thus \hyperlink{method.rule}{\mbox{\isa{rule}}} without facts |
|
755 |
is plain introduction, while with facts it becomes elimination. |
|
26870 | 756 |
|
26902 | 757 |
When no arguments are given, the \hyperlink{method.rule}{\mbox{\isa{rule}}} method tries to pick |
26870 | 758 |
appropriate rules automatically, as declared in the current context |
26902 | 759 |
using the \hyperlink{attribute.Pure.intro}{\mbox{\isa{intro}}}, \hyperlink{attribute.Pure.elim}{\mbox{\isa{elim}}}, |
760 |
\hyperlink{attribute.Pure.dest}{\mbox{\isa{dest}}} attributes (see below). This is the |
|
761 |
default behavior of \hyperlink{command.proof}{\mbox{\isa{\isacommand{proof}}}} and ``\hyperlink{command.ddot}{\mbox{\isa{\isacommand{{\isachardot}{\isachardot}}}}}'' |
|
762 |
(double-dot) steps (see \secref{sec:proof-steps}). |
|
26870 | 763 |
|
28788 | 764 |
\item \hyperlink{attribute.Pure.intro}{\mbox{\isa{intro}}}, \hyperlink{attribute.Pure.elim}{\mbox{\isa{elim}}}, and |
765 |
\hyperlink{attribute.Pure.dest}{\mbox{\isa{dest}}} declare introduction, elimination, and |
|
30172 | 766 |
destruct rules, to be used with method \hyperlink{method.rule}{\mbox{\isa{rule}}}, and similar |
767 |
tools. Note that the latter will ignore rules declared with |
|
768 |
``\isa{{\isachardoublequote}{\isacharquery}{\isachardoublequote}}'', while ``\isa{{\isachardoublequote}{\isacharbang}{\isachardoublequote}}'' are used most aggressively. |
|
26870 | 769 |
|
770 |
The classical reasoner (see \secref{sec:classical}) introduces its |
|
771 |
own variants of these attributes; use qualified names to access the |
|
26902 | 772 |
present versions of Isabelle/Pure, i.e.\ \hyperlink{attribute.Pure.Pure.intro}{\mbox{\isa{Pure{\isachardot}intro}}}. |
26870 | 773 |
|
28788 | 774 |
\item \hyperlink{attribute.rule}{\mbox{\isa{rule}}}~\isa{del} undeclares introduction, |
26870 | 775 |
elimination, or destruct rules. |
776 |
||
30463 | 777 |
\item \hyperlink{attribute.OF}{\mbox{\isa{OF}}}~\isa{{\isachardoublequote}a\isactrlsub {\isadigit{1}}\ {\isasymdots}\ a\isactrlsub n{\isachardoublequote}} applies some |
778 |
theorem to all of the given rules \isa{{\isachardoublequote}a\isactrlsub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ a\isactrlsub n{\isachardoublequote}} |
|
779 |
(in parallel). This corresponds to the \verb|op MRS| operation in |
|
780 |
ML, but note the reversed order. Positions may be effectively |
|
781 |
skipped by including ``\isa{{\isacharunderscore}}'' (underscore) as argument. |
|
26870 | 782 |
|
28788 | 783 |
\item \hyperlink{attribute.of}{\mbox{\isa{of}}}~\isa{{\isachardoublequote}t\isactrlsub {\isadigit{1}}\ {\isasymdots}\ t\isactrlsub n{\isachardoublequote}} performs positional |
784 |
instantiation of term variables. The terms \isa{{\isachardoublequote}t\isactrlsub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ t\isactrlsub n{\isachardoublequote}} are |
|
785 |
substituted for any schematic variables occurring in a theorem from |
|
786 |
left to right; ``\isa{{\isacharunderscore}}'' (underscore) indicates to skip a |
|
787 |
position. Arguments following a ``\isa{{\isachardoublequote}concl{\isacharcolon}{\isachardoublequote}}'' specification |
|
788 |
refer to positions of the conclusion of a rule. |
|
26870 | 789 |
|
28788 | 790 |
\item \hyperlink{attribute.where}{\mbox{\isa{where}}}~\isa{{\isachardoublequote}x\isactrlsub {\isadigit{1}}\ {\isacharequal}\ t\isactrlsub {\isadigit{1}}\ {\isasymAND}\ {\isasymdots}\ x\isactrlsub n\ {\isacharequal}\ t\isactrlsub n{\isachardoublequote}} |
791 |
performs named instantiation of schematic type and term variables |
|
792 |
occurring in a theorem. Schematic variables have to be specified on |
|
793 |
the left-hand side (e.g.\ \isa{{\isachardoublequote}{\isacharquery}x{\isadigit{1}}{\isachardot}{\isadigit{3}}{\isachardoublequote}}). The question mark may |
|
794 |
be omitted if the variable name is a plain identifier without index. |
|
795 |
As type instantiations are inferred from term instantiations, |
|
796 |
explicit type instantiations are seldom necessary. |
|
26870 | 797 |
|
28788 | 798 |
\end{description}% |
26870 | 799 |
\end{isamarkuptext}% |
800 |
\isamarkuptrue% |
|
801 |
% |
|
28788 | 802 |
\isamarkupsubsection{Emulating tactic scripts \label{sec:tactic-commands}% |
26870 | 803 |
} |
804 |
\isamarkuptrue% |
|
805 |
% |
|
806 |
\begin{isamarkuptext}% |
|
807 |
The Isar provides separate commands to accommodate tactic-style |
|
808 |
proof scripts within the same system. While being outside the |
|
809 |
orthodox Isar proof language, these might come in handy for |
|
810 |
interactive exploration and debugging, or even actual tactical proof |
|
811 |
within new-style theories (to benefit from document preparation, for |
|
812 |
example). See also \secref{sec:tactics} for actual tactics, that |
|
813 |
have been encapsulated as proof methods. Proper proof methods may |
|
814 |
be used in scripts, too. |
|
815 |
||
816 |
\begin{matharray}{rcl} |
|
28788 | 817 |
\indexdef{}{command}{apply}\hypertarget{command.apply}{\hyperlink{command.apply}{\mbox{\isa{\isacommand{apply}}}}}\isa{{\isachardoublequote}\isactrlsup {\isacharasterisk}{\isachardoublequote}} & : & \isa{{\isachardoublequote}proof{\isacharparenleft}prove{\isacharparenright}\ {\isasymrightarrow}\ proof{\isacharparenleft}prove{\isacharparenright}{\isachardoublequote}} \\ |
818 |
\indexdef{}{command}{apply\_end}\hypertarget{command.apply-end}{\hyperlink{command.apply-end}{\mbox{\isa{\isacommand{apply{\isacharunderscore}end}}}}}\isa{{\isachardoublequote}\isactrlsup {\isacharasterisk}{\isachardoublequote}} & : & \isa{{\isachardoublequote}proof{\isacharparenleft}state{\isacharparenright}\ {\isasymrightarrow}\ proof{\isacharparenleft}state{\isacharparenright}{\isachardoublequote}} \\ |
|
819 |
\indexdef{}{command}{done}\hypertarget{command.done}{\hyperlink{command.done}{\mbox{\isa{\isacommand{done}}}}}\isa{{\isachardoublequote}\isactrlsup {\isacharasterisk}{\isachardoublequote}} & : & \isa{{\isachardoublequote}proof{\isacharparenleft}prove{\isacharparenright}\ {\isasymrightarrow}\ proof{\isacharparenleft}state{\isacharparenright}\ {\isacharbar}\ local{\isacharunderscore}theory\ {\isacharbar}\ theory{\isachardoublequote}} \\ |
|
820 |
\indexdef{}{command}{defer}\hypertarget{command.defer}{\hyperlink{command.defer}{\mbox{\isa{\isacommand{defer}}}}}\isa{{\isachardoublequote}\isactrlsup {\isacharasterisk}{\isachardoublequote}} & : & \isa{{\isachardoublequote}proof\ {\isasymrightarrow}\ proof{\isachardoublequote}} \\ |
|
821 |
\indexdef{}{command}{prefer}\hypertarget{command.prefer}{\hyperlink{command.prefer}{\mbox{\isa{\isacommand{prefer}}}}}\isa{{\isachardoublequote}\isactrlsup {\isacharasterisk}{\isachardoublequote}} & : & \isa{{\isachardoublequote}proof\ {\isasymrightarrow}\ proof{\isachardoublequote}} \\ |
|
822 |
\indexdef{}{command}{back}\hypertarget{command.back}{\hyperlink{command.back}{\mbox{\isa{\isacommand{back}}}}}\isa{{\isachardoublequote}\isactrlsup {\isacharasterisk}{\isachardoublequote}} & : & \isa{{\isachardoublequote}proof\ {\isasymrightarrow}\ proof{\isachardoublequote}} \\ |
|
26870 | 823 |
\end{matharray} |
824 |
||
825 |
\begin{rail} |
|
826 |
( 'apply' | 'apply\_end' ) method |
|
827 |
; |
|
828 |
'defer' nat? |
|
829 |
; |
|
830 |
'prefer' nat |
|
831 |
; |
|
832 |
\end{rail} |
|
833 |
||
28788 | 834 |
\begin{description} |
26870 | 835 |
|
28788 | 836 |
\item \hyperlink{command.apply}{\mbox{\isa{\isacommand{apply}}}}~\isa{m} applies proof method \isa{m} in |
837 |
initial position, but unlike \hyperlink{command.proof}{\mbox{\isa{\isacommand{proof}}}} it retains ``\isa{{\isachardoublequote}proof{\isacharparenleft}prove{\isacharparenright}{\isachardoublequote}}'' mode. Thus consecutive method applications may be |
|
838 |
given just as in tactic scripts. |
|
26870 | 839 |
|
840 |
Facts are passed to \isa{m} as indicated by the goal's |
|
841 |
forward-chain mode, and are \emph{consumed} afterwards. Thus any |
|
26902 | 842 |
further \hyperlink{command.apply}{\mbox{\isa{\isacommand{apply}}}} command would always work in a purely |
26870 | 843 |
backward manner. |
844 |
||
28788 | 845 |
\item \hyperlink{command.apply-end}{\mbox{\isa{\isacommand{apply{\isacharunderscore}end}}}}~\isa{{\isachardoublequote}m{\isachardoublequote}} applies proof method \isa{m} as if in terminal position. Basically, this simulates a |
26902 | 846 |
multi-step tactic script for \hyperlink{command.qed}{\mbox{\isa{\isacommand{qed}}}}, but may be given |
26870 | 847 |
anywhere within the proof body. |
848 |
||
26895 | 849 |
No facts are passed to \isa{m} here. Furthermore, the static |
26902 | 850 |
context is that of the enclosing goal (as for actual \hyperlink{command.qed}{\mbox{\isa{\isacommand{qed}}}}). Thus the proof method may not refer to any assumptions |
26870 | 851 |
introduced in the current body, for example. |
852 |
||
28788 | 853 |
\item \hyperlink{command.done}{\mbox{\isa{\isacommand{done}}}} completes a proof script, provided that the |
854 |
current goal state is solved completely. Note that actual |
|
26902 | 855 |
structured proof commands (e.g.\ ``\hyperlink{command.dot}{\mbox{\isa{\isacommand{{\isachardot}}}}}'' or \hyperlink{command.sorry}{\mbox{\isa{\isacommand{sorry}}}}) may be used to conclude proof scripts as well. |
26870 | 856 |
|
28788 | 857 |
\item \hyperlink{command.defer}{\mbox{\isa{\isacommand{defer}}}}~\isa{n} and \hyperlink{command.prefer}{\mbox{\isa{\isacommand{prefer}}}}~\isa{n} |
858 |
shuffle the list of pending goals: \hyperlink{command.defer}{\mbox{\isa{\isacommand{defer}}}} puts off |
|
26870 | 859 |
sub-goal \isa{n} to the end of the list (\isa{{\isachardoublequote}n\ {\isacharequal}\ {\isadigit{1}}{\isachardoublequote}} by |
26902 | 860 |
default), while \hyperlink{command.prefer}{\mbox{\isa{\isacommand{prefer}}}} brings sub-goal \isa{n} to the |
26870 | 861 |
front. |
862 |
||
28788 | 863 |
\item \hyperlink{command.back}{\mbox{\isa{\isacommand{back}}}} does back-tracking over the result sequence |
864 |
of the latest proof command. Basically, any proof command may |
|
865 |
return multiple results. |
|
26870 | 866 |
|
28788 | 867 |
\end{description} |
26870 | 868 |
|
869 |
Any proper Isar proof method may be used with tactic script commands |
|
26902 | 870 |
such as \hyperlink{command.apply}{\mbox{\isa{\isacommand{apply}}}}. A few additional emulations of actual |
26870 | 871 |
tactics are provided as well; these would be never used in actual |
872 |
structured proofs, of course.% |
|
873 |
\end{isamarkuptext}% |
|
874 |
\isamarkuptrue% |
|
875 |
% |
|
28788 | 876 |
\isamarkupsubsection{Defining proof methods% |
26870 | 877 |
} |
878 |
\isamarkuptrue% |
|
879 |
% |
|
880 |
\begin{isamarkuptext}% |
|
881 |
\begin{matharray}{rcl} |
|
28788 | 882 |
\indexdef{}{command}{method\_setup}\hypertarget{command.method-setup}{\hyperlink{command.method-setup}{\mbox{\isa{\isacommand{method{\isacharunderscore}setup}}}}} & : & \isa{{\isachardoublequote}theory\ {\isasymrightarrow}\ theory{\isachardoublequote}} \\ |
26870 | 883 |
\end{matharray} |
884 |
||
28788 | 885 |
\begin{rail} |
886 |
'method\_setup' name '=' text text |
|
887 |
; |
|
888 |
\end{rail} |
|
889 |
||
890 |
\begin{description} |
|
891 |
||
892 |
\item \hyperlink{command.method-setup}{\mbox{\isa{\isacommand{method{\isacharunderscore}setup}}}}~\isa{{\isachardoublequote}name\ {\isacharequal}\ text\ description{\isachardoublequote}} |
|
30548 | 893 |
defines a proof method in the current theory. The given \isa{{\isachardoublequote}text{\isachardoublequote}} has to be an ML expression of type |
894 |
\verb|(Proof.context -> Proof.method) context_parser|, cf.\ |
|
895 |
basic parsers defined in structure \verb|Args| and \verb|Attrib|. There are also combinators like \verb|METHOD| and \verb|SIMPLE_METHOD| to turn certain tactic forms into official proof |
|
896 |
methods; the primed versions refer to tactics with explicit goal |
|
897 |
addressing. |
|
26870 | 898 |
|
30548 | 899 |
Here are some example method definitions: |
28788 | 900 |
|
901 |
\end{description}% |
|
26870 | 902 |
\end{isamarkuptext}% |
903 |
\isamarkuptrue% |
|
904 |
% |
|
30548 | 905 |
\isadelimML |
906 |
\ \ \ \ % |
|
907 |
\endisadelimML |
|
908 |
% |
|
909 |
\isatagML |
|
910 |
\isacommand{method{\isacharunderscore}setup}\isamarkupfalse% |
|
911 |
\ my{\isacharunderscore}method{\isadigit{1}}\ {\isacharequal}\ {\isacharverbatimopen}\isanewline |
|
912 |
\ \ \ \ \ \ Scan{\isachardot}succeed\ {\isacharparenleft}K\ {\isacharparenleft}SIMPLE{\isacharunderscore}METHOD{\isacharprime}\ {\isacharparenleft}fn\ i{\isacharcolon}\ int\ {\isacharequal}{\isachargreater}\ no{\isacharunderscore}tac{\isacharparenright}{\isacharparenright}{\isacharparenright}\isanewline |
|
913 |
\ \ \ \ {\isacharverbatimclose}\ \ {\isachardoublequoteopen}my\ first\ method\ {\isacharparenleft}without\ any\ arguments{\isacharparenright}{\isachardoublequoteclose}\isanewline |
|
914 |
\isanewline |
|
915 |
\ \ \ \ \isacommand{method{\isacharunderscore}setup}\isamarkupfalse% |
|
916 |
\ my{\isacharunderscore}method{\isadigit{2}}\ {\isacharequal}\ {\isacharverbatimopen}\isanewline |
|
917 |
\ \ \ \ \ \ Scan{\isachardot}succeed\ {\isacharparenleft}fn\ ctxt{\isacharcolon}\ Proof{\isachardot}context\ {\isacharequal}{\isachargreater}\isanewline |
|
918 |
\ \ \ \ \ \ \ \ SIMPLE{\isacharunderscore}METHOD{\isacharprime}\ {\isacharparenleft}fn\ i{\isacharcolon}\ int\ {\isacharequal}{\isachargreater}\ no{\isacharunderscore}tac{\isacharparenright}{\isacharparenright}\isanewline |
|
919 |
\ \ \ \ {\isacharverbatimclose}\ \ {\isachardoublequoteopen}my\ second\ method\ {\isacharparenleft}with\ context{\isacharparenright}{\isachardoublequoteclose}\isanewline |
|
920 |
\isanewline |
|
921 |
\ \ \ \ \isacommand{method{\isacharunderscore}setup}\isamarkupfalse% |
|
922 |
\ my{\isacharunderscore}method{\isadigit{3}}\ {\isacharequal}\ {\isacharverbatimopen}\isanewline |
|
923 |
\ \ \ \ \ \ Attrib{\isachardot}thms\ {\isachargreater}{\isachargreater}\ {\isacharparenleft}fn\ thms{\isacharcolon}\ thm\ list\ {\isacharequal}{\isachargreater}\ fn\ ctxt{\isacharcolon}\ Proof{\isachardot}context\ {\isacharequal}{\isachargreater}\isanewline |
|
924 |
\ \ \ \ \ \ \ \ SIMPLE{\isacharunderscore}METHOD{\isacharprime}\ {\isacharparenleft}fn\ i{\isacharcolon}\ int\ {\isacharequal}{\isachargreater}\ no{\isacharunderscore}tac{\isacharparenright}{\isacharparenright}\isanewline |
|
925 |
\ \ \ \ {\isacharverbatimclose}\ \ {\isachardoublequoteopen}my\ third\ method\ {\isacharparenleft}with\ theorem\ arguments\ and\ context{\isacharparenright}{\isachardoublequoteclose}% |
|
926 |
\endisatagML |
|
927 |
{\isafoldML}% |
|
928 |
% |
|
929 |
\isadelimML |
|
930 |
% |
|
931 |
\endisadelimML |
|
932 |
% |
|
26870 | 933 |
\isamarkupsection{Generalized elimination \label{sec:obtain}% |
934 |
} |
|
935 |
\isamarkuptrue% |
|
936 |
% |
|
937 |
\begin{isamarkuptext}% |
|
938 |
\begin{matharray}{rcl} |
|
28788 | 939 |
\indexdef{}{command}{obtain}\hypertarget{command.obtain}{\hyperlink{command.obtain}{\mbox{\isa{\isacommand{obtain}}}}} & : & \isa{{\isachardoublequote}proof{\isacharparenleft}state{\isacharparenright}\ {\isacharbar}\ proof{\isacharparenleft}chain{\isacharparenright}\ {\isasymrightarrow}\ proof{\isacharparenleft}prove{\isacharparenright}{\isachardoublequote}} \\ |
940 |
\indexdef{}{command}{guess}\hypertarget{command.guess}{\hyperlink{command.guess}{\mbox{\isa{\isacommand{guess}}}}}\isa{{\isachardoublequote}\isactrlsup {\isacharasterisk}{\isachardoublequote}} & : & \isa{{\isachardoublequote}proof{\isacharparenleft}state{\isacharparenright}\ {\isacharbar}\ proof{\isacharparenleft}chain{\isacharparenright}\ {\isasymrightarrow}\ proof{\isacharparenleft}prove{\isacharparenright}{\isachardoublequote}} \\ |
|
26870 | 941 |
\end{matharray} |
942 |
||
943 |
Generalized elimination means that additional elements with certain |
|
944 |
properties may be introduced in the current context, by virtue of a |
|
945 |
locally proven ``soundness statement''. Technically speaking, the |
|
26902 | 946 |
\hyperlink{command.obtain}{\mbox{\isa{\isacommand{obtain}}}} language element is like a declaration of |
947 |
\hyperlink{command.fix}{\mbox{\isa{\isacommand{fix}}}} and \hyperlink{command.assume}{\mbox{\isa{\isacommand{assume}}}} (see also see |
|
26870 | 948 |
\secref{sec:proof-context}), together with a soundness proof of its |
949 |
additional claim. According to the nature of existential reasoning, |
|
950 |
assumptions get eliminated from any result exported from the context |
|
951 |
later, provided that the corresponding parameters do \emph{not} |
|
952 |
occur in the conclusion. |
|
953 |
||
954 |
\begin{rail} |
|
955 |
'obtain' parname? (vars + 'and') 'where' (props + 'and') |
|
956 |
; |
|
957 |
'guess' (vars + 'and') |
|
958 |
; |
|
959 |
\end{rail} |
|
960 |
||
26902 | 961 |
The derived Isar command \hyperlink{command.obtain}{\mbox{\isa{\isacommand{obtain}}}} is defined as follows |
26870 | 962 |
(where \isa{{\isachardoublequote}b\isactrlsub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ b\isactrlsub k{\isachardoublequote}} shall refer to (optional) |
963 |
facts indicated for forward chaining). |
|
964 |
\begin{matharray}{l} |
|
26902 | 965 |
\isa{{\isachardoublequote}{\isasymlangle}using\ b\isactrlsub {\isadigit{1}}\ {\isasymdots}\ b\isactrlsub k{\isasymrangle}{\isachardoublequote}}~~\hyperlink{command.obtain}{\mbox{\isa{\isacommand{obtain}}}}~\isa{{\isachardoublequote}x\isactrlsub {\isadigit{1}}\ {\isasymdots}\ x\isactrlsub m\ {\isasymWHERE}\ a{\isacharcolon}\ {\isasymphi}\isactrlsub {\isadigit{1}}\ {\isasymdots}\ {\isasymphi}\isactrlsub n\ \ {\isasymlangle}proof{\isasymrangle}\ {\isasymequiv}{\isachardoublequote}} \\[1ex] |
966 |
\quad \hyperlink{command.have}{\mbox{\isa{\isacommand{have}}}}~\isa{{\isachardoublequote}{\isasymAnd}thesis{\isachardot}\ {\isacharparenleft}{\isasymAnd}x\isactrlsub {\isadigit{1}}\ {\isasymdots}\ x\isactrlsub m{\isachardot}\ {\isasymphi}\isactrlsub {\isadigit{1}}\ {\isasymLongrightarrow}\ {\isasymdots}\ {\isasymphi}\isactrlsub n\ {\isasymLongrightarrow}\ thesis{\isacharparenright}\ {\isasymLongrightarrow}\ thesis{\isachardoublequote}} \\ |
|
29731 | 967 |
\quad \hyperlink{command.proof}{\mbox{\isa{\isacommand{proof}}}}~\hyperlink{method.succeed}{\mbox{\isa{succeed}}} \\ |
26902 | 968 |
\qquad \hyperlink{command.fix}{\mbox{\isa{\isacommand{fix}}}}~\isa{thesis} \\ |
969 |
\qquad \hyperlink{command.assume}{\mbox{\isa{\isacommand{assume}}}}~\isa{{\isachardoublequote}that\ {\isacharbrackleft}Pure{\isachardot}intro{\isacharquery}{\isacharbrackright}{\isacharcolon}\ {\isasymAnd}x\isactrlsub {\isadigit{1}}\ {\isasymdots}\ x\isactrlsub m{\isachardot}\ {\isasymphi}\isactrlsub {\isadigit{1}}\ {\isasymLongrightarrow}\ {\isasymdots}\ {\isasymphi}\isactrlsub n\ {\isasymLongrightarrow}\ thesis{\isachardoublequote}} \\ |
|
970 |
\qquad \hyperlink{command.then}{\mbox{\isa{\isacommand{then}}}}~\hyperlink{command.show}{\mbox{\isa{\isacommand{show}}}}~\isa{thesis} \\ |
|
971 |
\quad\qquad \hyperlink{command.apply}{\mbox{\isa{\isacommand{apply}}}}~\isa{{\isacharminus}} \\ |
|
972 |
\quad\qquad \hyperlink{command.using}{\mbox{\isa{\isacommand{using}}}}~\isa{{\isachardoublequote}b\isactrlsub {\isadigit{1}}\ {\isasymdots}\ b\isactrlsub k\ \ {\isasymlangle}proof{\isasymrangle}{\isachardoublequote}} \\ |
|
973 |
\quad \hyperlink{command.qed}{\mbox{\isa{\isacommand{qed}}}} \\ |
|
974 |
\quad \hyperlink{command.fix}{\mbox{\isa{\isacommand{fix}}}}~\isa{{\isachardoublequote}x\isactrlsub {\isadigit{1}}\ {\isasymdots}\ x\isactrlsub m{\isachardoublequote}}~\hyperlink{command.assume}{\mbox{\isa{\isacommand{assume}}}}\isa{{\isachardoublequote}\isactrlsup {\isacharasterisk}\ a{\isacharcolon}\ {\isasymphi}\isactrlsub {\isadigit{1}}\ {\isasymdots}\ {\isasymphi}\isactrlsub n{\isachardoublequote}} \\ |
|
26870 | 975 |
\end{matharray} |
976 |
||
977 |
Typically, the soundness proof is relatively straight-forward, often |
|
26902 | 978 |
just by canonical automated tools such as ``\hyperlink{command.by}{\mbox{\isa{\isacommand{by}}}}~\isa{simp}'' or ``\hyperlink{command.by}{\mbox{\isa{\isacommand{by}}}}~\isa{blast}''. Accordingly, the |
26870 | 979 |
``\isa{that}'' reduction above is declared as simplification and |
980 |
introduction rule. |
|
981 |
||
26902 | 982 |
In a sense, \hyperlink{command.obtain}{\mbox{\isa{\isacommand{obtain}}}} represents at the level of Isar |
26870 | 983 |
proofs what would be meta-logical existential quantifiers and |
984 |
conjunctions. This concept has a broad range of useful |
|
985 |
applications, ranging from plain elimination (or introduction) of |
|
986 |
object-level existential and conjunctions, to elimination over |
|
987 |
results of symbolic evaluation of recursive definitions, for |
|
26902 | 988 |
example. Also note that \hyperlink{command.obtain}{\mbox{\isa{\isacommand{obtain}}}} without parameters acts |
989 |
much like \hyperlink{command.have}{\mbox{\isa{\isacommand{have}}}}, where the result is treated as a |
|
26870 | 990 |
genuine assumption. |
991 |
||
992 |
An alternative name to be used instead of ``\isa{that}'' above may |
|
993 |
be given in parentheses. |
|
994 |
||
26902 | 995 |
\medskip The improper variant \hyperlink{command.guess}{\mbox{\isa{\isacommand{guess}}}} is similar to |
996 |
\hyperlink{command.obtain}{\mbox{\isa{\isacommand{obtain}}}}, but derives the obtained statement from the |
|
26870 | 997 |
course of reasoning! The proof starts with a fixed goal \isa{thesis}. The subsequent proof may refine this to anything of the |
998 |
form like \isa{{\isachardoublequote}{\isasymAnd}x\isactrlsub {\isadigit{1}}\ {\isasymdots}\ x\isactrlsub m{\isachardot}\ {\isasymphi}\isactrlsub {\isadigit{1}}\ {\isasymLongrightarrow}\ {\isasymdots}\ {\isasymphi}\isactrlsub n\ {\isasymLongrightarrow}\ thesis{\isachardoublequote}}, but must not introduce new subgoals. The |
|
999 |
final goal state is then used as reduction rule for the obtain |
|
1000 |
scheme described above. Obtained parameters \isa{{\isachardoublequote}x\isactrlsub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ x\isactrlsub m{\isachardoublequote}} are marked as internal by default, which prevents the |
|
1001 |
proof context from being polluted by ad-hoc variables. The variable |
|
26902 | 1002 |
names and type constraints given as arguments for \hyperlink{command.guess}{\mbox{\isa{\isacommand{guess}}}} |
26870 | 1003 |
specify a prefix of obtained parameters explicitly in the text. |
1004 |
||
26902 | 1005 |
It is important to note that the facts introduced by \hyperlink{command.obtain}{\mbox{\isa{\isacommand{obtain}}}} and \hyperlink{command.guess}{\mbox{\isa{\isacommand{guess}}}} may not be polymorphic: any |
26870 | 1006 |
type-variables occurring here are fixed in the present context!% |
1007 |
\end{isamarkuptext}% |
|
1008 |
\isamarkuptrue% |
|
1009 |
% |
|
1010 |
\isamarkupsection{Calculational reasoning \label{sec:calculation}% |
|
1011 |
} |
|
1012 |
\isamarkuptrue% |
|
1013 |
% |
|
1014 |
\begin{isamarkuptext}% |
|
1015 |
\begin{matharray}{rcl} |
|
28788 | 1016 |
\indexdef{}{command}{also}\hypertarget{command.also}{\hyperlink{command.also}{\mbox{\isa{\isacommand{also}}}}} & : & \isa{{\isachardoublequote}proof{\isacharparenleft}state{\isacharparenright}\ {\isasymrightarrow}\ proof{\isacharparenleft}state{\isacharparenright}{\isachardoublequote}} \\ |
1017 |
\indexdef{}{command}{finally}\hypertarget{command.finally}{\hyperlink{command.finally}{\mbox{\isa{\isacommand{finally}}}}} & : & \isa{{\isachardoublequote}proof{\isacharparenleft}state{\isacharparenright}\ {\isasymrightarrow}\ proof{\isacharparenleft}chain{\isacharparenright}{\isachardoublequote}} \\ |
|
1018 |
\indexdef{}{command}{moreover}\hypertarget{command.moreover}{\hyperlink{command.moreover}{\mbox{\isa{\isacommand{moreover}}}}} & : & \isa{{\isachardoublequote}proof{\isacharparenleft}state{\isacharparenright}\ {\isasymrightarrow}\ proof{\isacharparenleft}state{\isacharparenright}{\isachardoublequote}} \\ |
|
1019 |
\indexdef{}{command}{ultimately}\hypertarget{command.ultimately}{\hyperlink{command.ultimately}{\mbox{\isa{\isacommand{ultimately}}}}} & : & \isa{{\isachardoublequote}proof{\isacharparenleft}state{\isacharparenright}\ {\isasymrightarrow}\ proof{\isacharparenleft}chain{\isacharparenright}{\isachardoublequote}} \\ |
|
1020 |
\indexdef{}{command}{print\_trans\_rules}\hypertarget{command.print-trans-rules}{\hyperlink{command.print-trans-rules}{\mbox{\isa{\isacommand{print{\isacharunderscore}trans{\isacharunderscore}rules}}}}}\isa{{\isachardoublequote}\isactrlsup {\isacharasterisk}{\isachardoublequote}} & : & \isa{{\isachardoublequote}context\ {\isasymrightarrow}{\isachardoublequote}} \\ |
|
1021 |
\hyperlink{attribute.trans}{\mbox{\isa{trans}}} & : & \isa{attribute} \\ |
|
1022 |
\hyperlink{attribute.sym}{\mbox{\isa{sym}}} & : & \isa{attribute} \\ |
|
1023 |
\hyperlink{attribute.symmetric}{\mbox{\isa{symmetric}}} & : & \isa{attribute} \\ |
|
26870 | 1024 |
\end{matharray} |
1025 |
||
1026 |
Calculational proof is forward reasoning with implicit application |
|
1027 |
of transitivity rules (such those of \isa{{\isachardoublequote}{\isacharequal}{\isachardoublequote}}, \isa{{\isachardoublequote}{\isasymle}{\isachardoublequote}}, |
|
1028 |
\isa{{\isachardoublequote}{\isacharless}{\isachardoublequote}}). Isabelle/Isar maintains an auxiliary fact register |
|
26902 | 1029 |
\indexref{}{fact}{calculation}\hyperlink{fact.calculation}{\mbox{\isa{calculation}}} for accumulating results obtained by |
1030 |
transitivity composed with the current result. Command \hyperlink{command.also}{\mbox{\isa{\isacommand{also}}}} updates \hyperlink{fact.calculation}{\mbox{\isa{calculation}}} involving \hyperlink{fact.this}{\mbox{\isa{this}}}, while |
|
1031 |
\hyperlink{command.finally}{\mbox{\isa{\isacommand{finally}}}} exhibits the final \hyperlink{fact.calculation}{\mbox{\isa{calculation}}} by |
|
26870 | 1032 |
forward chaining towards the next goal statement. Both commands |
1033 |
require valid current facts, i.e.\ may occur only after commands |
|
26902 | 1034 |
that produce theorems such as \hyperlink{command.assume}{\mbox{\isa{\isacommand{assume}}}}, \hyperlink{command.note}{\mbox{\isa{\isacommand{note}}}}, or some finished proof of \hyperlink{command.have}{\mbox{\isa{\isacommand{have}}}}, \hyperlink{command.show}{\mbox{\isa{\isacommand{show}}}} etc. The \hyperlink{command.moreover}{\mbox{\isa{\isacommand{moreover}}}} and \hyperlink{command.ultimately}{\mbox{\isa{\isacommand{ultimately}}}} |
1035 |
commands are similar to \hyperlink{command.also}{\mbox{\isa{\isacommand{also}}}} and \hyperlink{command.finally}{\mbox{\isa{\isacommand{finally}}}}, |
|
1036 |
but only collect further results in \hyperlink{fact.calculation}{\mbox{\isa{calculation}}} without |
|
26870 | 1037 |
applying any rules yet. |
1038 |
||
1039 |
Also note that the implicit term abbreviation ``\isa{{\isachardoublequote}{\isasymdots}{\isachardoublequote}}'' has |
|
1040 |
its canonical application with calculational proofs. It refers to |
|
1041 |
the argument of the preceding statement. (The argument of a curried |
|
1042 |
infix expression happens to be its right-hand side.) |
|
1043 |
||
1044 |
Isabelle/Isar calculations are implicitly subject to block structure |
|
1045 |
in the sense that new threads of calculational reasoning are |
|
1046 |
commenced for any new block (as opened by a local goal, for |
|
1047 |
example). This means that, apart from being able to nest |
|
1048 |
calculations, there is no separate \emph{begin-calculation} command |
|
1049 |
required. |
|
1050 |
||
1051 |
\medskip The Isar calculation proof commands may be defined as |
|
1052 |
follows:\footnote{We suppress internal bookkeeping such as proper |
|
1053 |
handling of block-structure.} |
|
1054 |
||
1055 |
\begin{matharray}{rcl} |
|
26902 | 1056 |
\hyperlink{command.also}{\mbox{\isa{\isacommand{also}}}}\isa{{\isachardoublequote}\isactrlsub {\isadigit{0}}{\isachardoublequote}} & \equiv & \hyperlink{command.note}{\mbox{\isa{\isacommand{note}}}}~\isa{{\isachardoublequote}calculation\ {\isacharequal}\ this{\isachardoublequote}} \\ |
30548 | 1057 |
\hyperlink{command.also}{\mbox{\isa{\isacommand{also}}}}\isa{{\isachardoublequote}\isactrlsub n{\isacharplus}{\isadigit{1}}{\isachardoublequote}} & \equiv & \hyperlink{command.note}{\mbox{\isa{\isacommand{note}}}}~\isa{{\isachardoublequote}calculation\ {\isacharequal}\ trans\ {\isacharbrackleft}OF\ calculation\ this{\isacharbrackright}{\isachardoublequote}} \\[0.5ex] |
26902 | 1058 |
\hyperlink{command.finally}{\mbox{\isa{\isacommand{finally}}}} & \equiv & \hyperlink{command.also}{\mbox{\isa{\isacommand{also}}}}~\hyperlink{command.from}{\mbox{\isa{\isacommand{from}}}}~\isa{calculation} \\[0.5ex] |
1059 |
\hyperlink{command.moreover}{\mbox{\isa{\isacommand{moreover}}}} & \equiv & \hyperlink{command.note}{\mbox{\isa{\isacommand{note}}}}~\isa{{\isachardoublequote}calculation\ {\isacharequal}\ calculation\ this{\isachardoublequote}} \\ |
|
1060 |
\hyperlink{command.ultimately}{\mbox{\isa{\isacommand{ultimately}}}} & \equiv & \hyperlink{command.moreover}{\mbox{\isa{\isacommand{moreover}}}}~\hyperlink{command.from}{\mbox{\isa{\isacommand{from}}}}~\isa{calculation} \\ |
|
26870 | 1061 |
\end{matharray} |
1062 |
||
1063 |
\begin{rail} |
|
1064 |
('also' | 'finally') ('(' thmrefs ')')? |
|
1065 |
; |
|
1066 |
'trans' (() | 'add' | 'del') |
|
1067 |
; |
|
1068 |
\end{rail} |
|
1069 |
||
28788 | 1070 |
\begin{description} |
26870 | 1071 |
|
28788 | 1072 |
\item \hyperlink{command.also}{\mbox{\isa{\isacommand{also}}}}~\isa{{\isachardoublequote}{\isacharparenleft}a\isactrlsub {\isadigit{1}}\ {\isasymdots}\ a\isactrlsub n{\isacharparenright}{\isachardoublequote}} maintains the auxiliary |
1073 |
\hyperlink{fact.calculation}{\mbox{\isa{calculation}}} register as follows. The first occurrence of |
|
1074 |
\hyperlink{command.also}{\mbox{\isa{\isacommand{also}}}} in some calculational thread initializes \hyperlink{fact.calculation}{\mbox{\isa{calculation}}} by \hyperlink{fact.this}{\mbox{\isa{this}}}. Any subsequent \hyperlink{command.also}{\mbox{\isa{\isacommand{also}}}} on |
|
1075 |
the same level of block-structure updates \hyperlink{fact.calculation}{\mbox{\isa{calculation}}} by |
|
1076 |
some transitivity rule applied to \hyperlink{fact.calculation}{\mbox{\isa{calculation}}} and \hyperlink{fact.this}{\mbox{\isa{this}}} (in that order). Transitivity rules are picked from the |
|
1077 |
current context, unless alternative rules are given as explicit |
|
1078 |
arguments. |
|
26870 | 1079 |
|
28788 | 1080 |
\item \hyperlink{command.finally}{\mbox{\isa{\isacommand{finally}}}}~\isa{{\isachardoublequote}{\isacharparenleft}a\isactrlsub {\isadigit{1}}\ {\isasymdots}\ a\isactrlsub n{\isacharparenright}{\isachardoublequote}} maintaining \hyperlink{fact.calculation}{\mbox{\isa{calculation}}} in the same way as \hyperlink{command.also}{\mbox{\isa{\isacommand{also}}}}, and concludes the |
1081 |
current calculational thread. The final result is exhibited as fact |
|
1082 |
for forward chaining towards the next goal. Basically, \hyperlink{command.finally}{\mbox{\isa{\isacommand{finally}}}} just abbreviates \hyperlink{command.also}{\mbox{\isa{\isacommand{also}}}}~\hyperlink{command.from}{\mbox{\isa{\isacommand{from}}}}~\hyperlink{fact.calculation}{\mbox{\isa{calculation}}}. Typical idioms for concluding |
|
1083 |
calculational proofs are ``\hyperlink{command.finally}{\mbox{\isa{\isacommand{finally}}}}~\hyperlink{command.show}{\mbox{\isa{\isacommand{show}}}}~\isa{{\isacharquery}thesis}~\hyperlink{command.dot}{\mbox{\isa{\isacommand{{\isachardot}}}}}'' and ``\hyperlink{command.finally}{\mbox{\isa{\isacommand{finally}}}}~\hyperlink{command.have}{\mbox{\isa{\isacommand{have}}}}~\isa{{\isasymphi}}~\hyperlink{command.dot}{\mbox{\isa{\isacommand{{\isachardot}}}}}''. |
|
26870 | 1084 |
|
28788 | 1085 |
\item \hyperlink{command.moreover}{\mbox{\isa{\isacommand{moreover}}}} and \hyperlink{command.ultimately}{\mbox{\isa{\isacommand{ultimately}}}} are |
26902 | 1086 |
analogous to \hyperlink{command.also}{\mbox{\isa{\isacommand{also}}}} and \hyperlink{command.finally}{\mbox{\isa{\isacommand{finally}}}}, but collect |
26870 | 1087 |
results only, without applying rules. |
1088 |
||
28788 | 1089 |
\item \hyperlink{command.print-trans-rules}{\mbox{\isa{\isacommand{print{\isacharunderscore}trans{\isacharunderscore}rules}}}} prints the list of transitivity |
1090 |
rules (for calculational commands \hyperlink{command.also}{\mbox{\isa{\isacommand{also}}}} and \hyperlink{command.finally}{\mbox{\isa{\isacommand{finally}}}}) and symmetry rules (for the \hyperlink{attribute.symmetric}{\mbox{\isa{symmetric}}} |
|
1091 |
operation and single step elimination patters) of the current |
|
1092 |
context. |
|
26870 | 1093 |
|
28788 | 1094 |
\item \hyperlink{attribute.trans}{\mbox{\isa{trans}}} declares theorems as transitivity rules. |
26870 | 1095 |
|
28788 | 1096 |
\item \hyperlink{attribute.sym}{\mbox{\isa{sym}}} declares symmetry rules, as well as |
26902 | 1097 |
\hyperlink{attribute.Pure.elim}{\mbox{\isa{Pure{\isachardot}elim}}}\isa{{\isachardoublequote}{\isacharquery}{\isachardoublequote}} rules. |
26870 | 1098 |
|
28788 | 1099 |
\item \hyperlink{attribute.symmetric}{\mbox{\isa{symmetric}}} resolves a theorem with some rule |
26902 | 1100 |
declared as \hyperlink{attribute.sym}{\mbox{\isa{sym}}} in the current context. For example, |
1101 |
``\hyperlink{command.assume}{\mbox{\isa{\isacommand{assume}}}}~\isa{{\isachardoublequote}{\isacharbrackleft}symmetric{\isacharbrackright}{\isacharcolon}\ x\ {\isacharequal}\ y{\isachardoublequote}}'' produces a |
|
26870 | 1102 |
swapped fact derived from that assumption. |
1103 |
||
1104 |
In structured proof texts it is often more appropriate to use an |
|
26902 | 1105 |
explicit single-step elimination proof, such as ``\hyperlink{command.assume}{\mbox{\isa{\isacommand{assume}}}}~\isa{{\isachardoublequote}x\ {\isacharequal}\ y{\isachardoublequote}}~\hyperlink{command.then}{\mbox{\isa{\isacommand{then}}}}~\hyperlink{command.have}{\mbox{\isa{\isacommand{have}}}}~\isa{{\isachardoublequote}y\ {\isacharequal}\ x{\isachardoublequote}}~\hyperlink{command.ddot}{\mbox{\isa{\isacommand{{\isachardot}{\isachardot}}}}}''. |
26870 | 1106 |
|
28788 | 1107 |
\end{description}% |
26870 | 1108 |
\end{isamarkuptext}% |
1109 |
\isamarkuptrue% |
|
1110 |
% |
|
27042 | 1111 |
\isamarkupsection{Proof by cases and induction \label{sec:cases-induct}% |
1112 |
} |
|
1113 |
\isamarkuptrue% |
|
1114 |
% |
|
1115 |
\isamarkupsubsection{Rule contexts% |
|
1116 |
} |
|
1117 |
\isamarkuptrue% |
|
1118 |
% |
|
1119 |
\begin{isamarkuptext}% |
|
1120 |
\begin{matharray}{rcl} |
|
28788 | 1121 |
\indexdef{}{command}{case}\hypertarget{command.case}{\hyperlink{command.case}{\mbox{\isa{\isacommand{case}}}}} & : & \isa{{\isachardoublequote}proof{\isacharparenleft}state{\isacharparenright}\ {\isasymrightarrow}\ proof{\isacharparenleft}state{\isacharparenright}{\isachardoublequote}} \\ |
1122 |
\indexdef{}{command}{print\_cases}\hypertarget{command.print-cases}{\hyperlink{command.print-cases}{\mbox{\isa{\isacommand{print{\isacharunderscore}cases}}}}}\isa{{\isachardoublequote}\isactrlsup {\isacharasterisk}{\isachardoublequote}} & : & \isa{{\isachardoublequote}context\ {\isasymrightarrow}{\isachardoublequote}} \\ |
|
1123 |
\indexdef{}{attribute}{case\_names}\hypertarget{attribute.case-names}{\hyperlink{attribute.case-names}{\mbox{\isa{case{\isacharunderscore}names}}}} & : & \isa{attribute} \\ |
|
1124 |
\indexdef{}{attribute}{case\_conclusion}\hypertarget{attribute.case-conclusion}{\hyperlink{attribute.case-conclusion}{\mbox{\isa{case{\isacharunderscore}conclusion}}}} & : & \isa{attribute} \\ |
|
1125 |
\indexdef{}{attribute}{params}\hypertarget{attribute.params}{\hyperlink{attribute.params}{\mbox{\isa{params}}}} & : & \isa{attribute} \\ |
|
1126 |
\indexdef{}{attribute}{consumes}\hypertarget{attribute.consumes}{\hyperlink{attribute.consumes}{\mbox{\isa{consumes}}}} & : & \isa{attribute} \\ |
|
27042 | 1127 |
\end{matharray} |
1128 |
||
1129 |
The puristic way to build up Isar proof contexts is by explicit |
|
1130 |
language elements like \hyperlink{command.fix}{\mbox{\isa{\isacommand{fix}}}}, \hyperlink{command.assume}{\mbox{\isa{\isacommand{assume}}}}, |
|
1131 |
\hyperlink{command.let}{\mbox{\isa{\isacommand{let}}}} (see \secref{sec:proof-context}). This is adequate |
|
1132 |
for plain natural deduction, but easily becomes unwieldy in concrete |
|
1133 |
verification tasks, which typically involve big induction rules with |
|
1134 |
several cases. |
|
1135 |
||
1136 |
The \hyperlink{command.case}{\mbox{\isa{\isacommand{case}}}} command provides a shorthand to refer to a |
|
1137 |
local context symbolically: certain proof methods provide an |
|
1138 |
environment of named ``cases'' of the form \isa{{\isachardoublequote}c{\isacharcolon}\ x\isactrlsub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ x\isactrlsub m{\isacharcomma}\ {\isasymphi}\isactrlsub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ {\isasymphi}\isactrlsub n{\isachardoublequote}}; the effect of ``\hyperlink{command.case}{\mbox{\isa{\isacommand{case}}}}~\isa{c}'' is then equivalent to ``\hyperlink{command.fix}{\mbox{\isa{\isacommand{fix}}}}~\isa{{\isachardoublequote}x\isactrlsub {\isadigit{1}}\ {\isasymdots}\ x\isactrlsub m{\isachardoublequote}}~\hyperlink{command.assume}{\mbox{\isa{\isacommand{assume}}}}~\isa{{\isachardoublequote}c{\isacharcolon}\ {\isasymphi}\isactrlsub {\isadigit{1}}\ {\isasymdots}\ {\isasymphi}\isactrlsub n{\isachardoublequote}}''. Term bindings may be covered as well, notably |
|
1139 |
\hyperlink{variable.?case}{\mbox{\isa{{\isacharquery}case}}} for the main conclusion. |
|
1140 |
||
1141 |
By default, the ``terminology'' \isa{{\isachardoublequote}x\isactrlsub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ x\isactrlsub m{\isachardoublequote}} of |
|
1142 |
a case value is marked as hidden, i.e.\ there is no way to refer to |
|
1143 |
such parameters in the subsequent proof text. After all, original |
|
1144 |
rule parameters stem from somewhere outside of the current proof |
|
1145 |
text. By using the explicit form ``\hyperlink{command.case}{\mbox{\isa{\isacommand{case}}}}~\isa{{\isachardoublequote}{\isacharparenleft}c\ y\isactrlsub {\isadigit{1}}\ {\isasymdots}\ y\isactrlsub m{\isacharparenright}{\isachardoublequote}}'' instead, the proof author is able to |
|
1146 |
chose local names that fit nicely into the current context. |
|
1147 |
||
1148 |
\medskip It is important to note that proper use of \hyperlink{command.case}{\mbox{\isa{\isacommand{case}}}} does not provide means to peek at the current goal state, |
|
1149 |
which is not directly observable in Isar! Nonetheless, goal |
|
1150 |
refinement commands do provide named cases \isa{{\isachardoublequote}goal\isactrlsub i{\isachardoublequote}} |
|
1151 |
for each subgoal \isa{{\isachardoublequote}i\ {\isacharequal}\ {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ n{\isachardoublequote}} of the resulting goal state. |
|
1152 |
Using this extra feature requires great care, because some bits of |
|
1153 |
the internal tactical machinery intrude the proof text. In |
|
1154 |
particular, parameter names stemming from the left-over of automated |
|
1155 |
reasoning tools are usually quite unpredictable. |
|
1156 |
||
1157 |
Under normal circumstances, the text of cases emerge from standard |
|
1158 |
elimination or induction rules, which in turn are derived from |
|
1159 |
previous theory specifications in a canonical way (say from |
|
1160 |
\hyperlink{command.inductive}{\mbox{\isa{\isacommand{inductive}}}} definitions). |
|
1161 |
||
1162 |
\medskip Proper cases are only available if both the proof method |
|
1163 |
and the rules involved support this. By using appropriate |
|
1164 |
attributes, case names, conclusions, and parameters may be also |
|
1165 |
declared by hand. Thus variant versions of rules that have been |
|
1166 |
derived manually become ready to use in advanced case analysis |
|
1167 |
later. |
|
1168 |
||
1169 |
\begin{rail} |
|
1170 |
'case' (caseref | '(' caseref ((name | underscore) +) ')') |
|
1171 |
; |
|
1172 |
caseref: nameref attributes? |
|
1173 |
; |
|
1174 |
||
1175 |
'case\_names' (name +) |
|
1176 |
; |
|
1177 |
'case\_conclusion' name (name *) |
|
1178 |
; |
|
1179 |
'params' ((name *) + 'and') |
|
1180 |
; |
|
1181 |
'consumes' nat? |
|
1182 |
; |
|
1183 |
\end{rail} |
|
1184 |
||
28788 | 1185 |
\begin{description} |
27042 | 1186 |
|
28788 | 1187 |
\item \hyperlink{command.case}{\mbox{\isa{\isacommand{case}}}}~\isa{{\isachardoublequote}{\isacharparenleft}c\ x\isactrlsub {\isadigit{1}}\ {\isasymdots}\ x\isactrlsub m{\isacharparenright}{\isachardoublequote}} invokes a named local |
1188 |
context \isa{{\isachardoublequote}c{\isacharcolon}\ x\isactrlsub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ x\isactrlsub m{\isacharcomma}\ {\isasymphi}\isactrlsub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ {\isasymphi}\isactrlsub m{\isachardoublequote}}, as provided by an |
|
1189 |
appropriate proof method (such as \indexref{}{method}{cases}\hyperlink{method.cases}{\mbox{\isa{cases}}} and |
|
1190 |
\indexref{}{method}{induct}\hyperlink{method.induct}{\mbox{\isa{induct}}}). The command ``\hyperlink{command.case}{\mbox{\isa{\isacommand{case}}}}~\isa{{\isachardoublequote}{\isacharparenleft}c\ x\isactrlsub {\isadigit{1}}\ {\isasymdots}\ x\isactrlsub m{\isacharparenright}{\isachardoublequote}}'' abbreviates ``\hyperlink{command.fix}{\mbox{\isa{\isacommand{fix}}}}~\isa{{\isachardoublequote}x\isactrlsub {\isadigit{1}}\ {\isasymdots}\ x\isactrlsub m{\isachardoublequote}}~\hyperlink{command.assume}{\mbox{\isa{\isacommand{assume}}}}~\isa{{\isachardoublequote}c{\isacharcolon}\ {\isasymphi}\isactrlsub {\isadigit{1}}\ {\isasymdots}\ {\isasymphi}\isactrlsub n{\isachardoublequote}}''. |
|
27042 | 1191 |
|
28788 | 1192 |
\item \hyperlink{command.print-cases}{\mbox{\isa{\isacommand{print{\isacharunderscore}cases}}}} prints all local contexts of the |
27042 | 1193 |
current state, using Isar proof language notation. |
1194 |
||
28788 | 1195 |
\item \hyperlink{attribute.case-names}{\mbox{\isa{case{\isacharunderscore}names}}}~\isa{{\isachardoublequote}c\isactrlsub {\isadigit{1}}\ {\isasymdots}\ c\isactrlsub k{\isachardoublequote}} declares names for |
1196 |
the local contexts of premises of a theorem; \isa{{\isachardoublequote}c\isactrlsub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ c\isactrlsub k{\isachardoublequote}} |
|
1197 |
refers to the \emph{suffix} of the list of premises. |
|
27042 | 1198 |
|
28788 | 1199 |
\item \hyperlink{attribute.case-conclusion}{\mbox{\isa{case{\isacharunderscore}conclusion}}}~\isa{{\isachardoublequote}c\ d\isactrlsub {\isadigit{1}}\ {\isasymdots}\ d\isactrlsub k{\isachardoublequote}} declares |
1200 |
names for the conclusions of a named premise \isa{c}; here \isa{{\isachardoublequote}d\isactrlsub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ d\isactrlsub k{\isachardoublequote}} refers to the prefix of arguments of a logical formula |
|
1201 |
built by nesting a binary connective (e.g.\ \isa{{\isachardoublequote}{\isasymor}{\isachardoublequote}}). |
|
27042 | 1202 |
|
1203 |
Note that proof methods such as \hyperlink{method.induct}{\mbox{\isa{induct}}} and \hyperlink{method.coinduct}{\mbox{\isa{coinduct}}} already provide a default name for the conclusion as a |
|
1204 |
whole. The need to name subformulas only arises with cases that |
|
1205 |
split into several sub-cases, as in common co-induction rules. |
|
1206 |
||
28788 | 1207 |
\item \hyperlink{attribute.params}{\mbox{\isa{params}}}~\isa{{\isachardoublequote}p\isactrlsub {\isadigit{1}}\ {\isasymdots}\ p\isactrlsub m\ {\isasymAND}\ {\isasymdots}\ q\isactrlsub {\isadigit{1}}\ {\isasymdots}\ q\isactrlsub n{\isachardoublequote}} renames |
1208 |
the innermost parameters of premises \isa{{\isachardoublequote}{\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ n{\isachardoublequote}} of some |
|
1209 |
theorem. An empty list of names may be given to skip positions, |
|
1210 |
leaving the present parameters unchanged. |
|
27042 | 1211 |
|
1212 |
Note that the default usage of case rules does \emph{not} directly |
|
1213 |
expose parameters to the proof context. |
|
1214 |
||
28788 | 1215 |
\item \hyperlink{attribute.consumes}{\mbox{\isa{consumes}}}~\isa{n} declares the number of ``major |
1216 |
premises'' of a rule, i.e.\ the number of facts to be consumed when |
|
1217 |
it is applied by an appropriate proof method. The default value of |
|
1218 |
\hyperlink{attribute.consumes}{\mbox{\isa{consumes}}} is \isa{{\isachardoublequote}n\ {\isacharequal}\ {\isadigit{1}}{\isachardoublequote}}, which is appropriate for |
|
1219 |
the usual kind of cases and induction rules for inductive sets (cf.\ |
|
1220 |
\secref{sec:hol-inductive}). Rules without any \hyperlink{attribute.consumes}{\mbox{\isa{consumes}}} declaration given are treated as if \hyperlink{attribute.consumes}{\mbox{\isa{consumes}}}~\isa{{\isadigit{0}}} had been specified. |
|
27042 | 1221 |
|
1222 |
Note that explicit \hyperlink{attribute.consumes}{\mbox{\isa{consumes}}} declarations are only |
|
1223 |
rarely needed; this is already taken care of automatically by the |
|
1224 |
higher-level \hyperlink{attribute.cases}{\mbox{\isa{cases}}}, \hyperlink{attribute.induct}{\mbox{\isa{induct}}}, and |
|
1225 |
\hyperlink{attribute.coinduct}{\mbox{\isa{coinduct}}} declarations. |
|
1226 |
||
28788 | 1227 |
\end{description}% |
27042 | 1228 |
\end{isamarkuptext}% |
1229 |
\isamarkuptrue% |
|
1230 |
% |
|
1231 |
\isamarkupsubsection{Proof methods% |
|
1232 |
} |
|
1233 |
\isamarkuptrue% |
|
1234 |
% |
|
1235 |
\begin{isamarkuptext}% |
|
1236 |
\begin{matharray}{rcl} |
|
28788 | 1237 |
\indexdef{}{method}{cases}\hypertarget{method.cases}{\hyperlink{method.cases}{\mbox{\isa{cases}}}} & : & \isa{method} \\ |
1238 |
\indexdef{}{method}{induct}\hypertarget{method.induct}{\hyperlink{method.induct}{\mbox{\isa{induct}}}} & : & \isa{method} \\ |
|
1239 |
\indexdef{}{method}{coinduct}\hypertarget{method.coinduct}{\hyperlink{method.coinduct}{\mbox{\isa{coinduct}}}} & : & \isa{method} \\ |
|
27042 | 1240 |
\end{matharray} |
1241 |
||
1242 |
The \hyperlink{method.cases}{\mbox{\isa{cases}}}, \hyperlink{method.induct}{\mbox{\isa{induct}}}, and \hyperlink{method.coinduct}{\mbox{\isa{coinduct}}} |
|
1243 |
methods provide a uniform interface to common proof techniques over |
|
1244 |
datatypes, inductive predicates (or sets), recursive functions etc. |
|
1245 |
The corresponding rules may be specified and instantiated in a |
|
1246 |
casual manner. Furthermore, these methods provide named local |
|
1247 |
contexts that may be invoked via the \hyperlink{command.case}{\mbox{\isa{\isacommand{case}}}} proof command |
|
1248 |
within the subsequent proof text. This accommodates compact proof |
|
1249 |
texts even when reasoning about large specifications. |
|
1250 |
||
1251 |
The \hyperlink{method.induct}{\mbox{\isa{induct}}} method also provides some additional |
|
1252 |
infrastructure in order to be applicable to structure statements |
|
1253 |
(either using explicit meta-level connectives, or including facts |
|
1254 |
and parameters separately). This avoids cumbersome encoding of |
|
1255 |
``strengthened'' inductive statements within the object-logic. |
|
1256 |
||
1257 |
\begin{rail} |
|
1258 |
'cases' (insts * 'and') rule? |
|
1259 |
; |
|
1260 |
'induct' (definsts * 'and') \\ arbitrary? taking? rule? |
|
1261 |
; |
|
1262 |
'coinduct' insts taking rule? |
|
1263 |
; |
|
1264 |
||
1265 |
rule: ('type' | 'pred' | 'set') ':' (nameref +) | 'rule' ':' (thmref +) |
|
1266 |
; |
|
1267 |
definst: name ('==' | equiv) term | inst |
|
1268 |
; |
|
1269 |
definsts: ( definst *) |
|
1270 |
; |
|
1271 |
arbitrary: 'arbitrary' ':' ((term *) 'and' +) |
|
1272 |
; |
|
1273 |
taking: 'taking' ':' insts |
|
1274 |
; |
|
1275 |
\end{rail} |
|
1276 |
||
28788 | 1277 |
\begin{description} |
27042 | 1278 |
|
28788 | 1279 |
\item \hyperlink{method.cases}{\mbox{\isa{cases}}}~\isa{{\isachardoublequote}insts\ R{\isachardoublequote}} applies method \hyperlink{method.rule}{\mbox{\isa{rule}}} with an appropriate case distinction theorem, instantiated to |
27042 | 1280 |
the subjects \isa{insts}. Symbolic case names are bound according |
1281 |
to the rule's local contexts. |
|
1282 |
||
1283 |
The rule is determined as follows, according to the facts and |
|
1284 |
arguments passed to the \hyperlink{method.cases}{\mbox{\isa{cases}}} method: |
|
1285 |
||
1286 |
\medskip |
|
1287 |
\begin{tabular}{llll} |
|
1288 |
facts & & arguments & rule \\\hline |
|
1289 |
& \hyperlink{method.cases}{\mbox{\isa{cases}}} & & classical case split \\ |
|
1290 |
& \hyperlink{method.cases}{\mbox{\isa{cases}}} & \isa{t} & datatype exhaustion (type of \isa{t}) \\ |
|
1291 |
\isa{{\isachardoublequote}{\isasymturnstile}\ A\ t{\isachardoublequote}} & \hyperlink{method.cases}{\mbox{\isa{cases}}} & \isa{{\isachardoublequote}{\isasymdots}{\isachardoublequote}} & inductive predicate/set elimination (of \isa{A}) \\ |
|
1292 |
\isa{{\isachardoublequote}{\isasymdots}{\isachardoublequote}} & \hyperlink{method.cases}{\mbox{\isa{cases}}} & \isa{{\isachardoublequote}{\isasymdots}\ rule{\isacharcolon}\ R{\isachardoublequote}} & explicit rule \isa{R} \\ |
|
1293 |
\end{tabular} |
|
1294 |
\medskip |
|
1295 |
||
1296 |
Several instantiations may be given, referring to the \emph{suffix} |
|
1297 |
of premises of the case rule; within each premise, the \emph{prefix} |
|
1298 |
of variables is instantiated. In most situations, only a single |
|
1299 |
term needs to be specified; this refers to the first variable of the |
|
1300 |
last premise (it is usually the same for all cases). |
|
1301 |
||
28788 | 1302 |
\item \hyperlink{method.induct}{\mbox{\isa{induct}}}~\isa{{\isachardoublequote}insts\ R{\isachardoublequote}} is analogous to the |
27042 | 1303 |
\hyperlink{method.cases}{\mbox{\isa{cases}}} method, but refers to induction rules, which are |
1304 |
determined as follows: |
|
1305 |
||
1306 |
\medskip |
|
1307 |
\begin{tabular}{llll} |
|
1308 |
facts & & arguments & rule \\\hline |
|
1309 |
& \hyperlink{method.induct}{\mbox{\isa{induct}}} & \isa{{\isachardoublequote}P\ x{\isachardoublequote}} & datatype induction (type of \isa{x}) \\ |
|
1310 |
\isa{{\isachardoublequote}{\isasymturnstile}\ A\ x{\isachardoublequote}} & \hyperlink{method.induct}{\mbox{\isa{induct}}} & \isa{{\isachardoublequote}{\isasymdots}{\isachardoublequote}} & predicate/set induction (of \isa{A}) \\ |
|
1311 |
\isa{{\isachardoublequote}{\isasymdots}{\isachardoublequote}} & \hyperlink{method.induct}{\mbox{\isa{induct}}} & \isa{{\isachardoublequote}{\isasymdots}\ rule{\isacharcolon}\ R{\isachardoublequote}} & explicit rule \isa{R} \\ |
|
1312 |
\end{tabular} |
|
1313 |
\medskip |
|
1314 |
||
1315 |
Several instantiations may be given, each referring to some part of |
|
1316 |
a mutual inductive definition or datatype --- only related partial |
|
1317 |
induction rules may be used together, though. Any of the lists of |
|
1318 |
terms \isa{{\isachardoublequote}P{\isacharcomma}\ x{\isacharcomma}\ {\isasymdots}{\isachardoublequote}} refers to the \emph{suffix} of variables |
|
1319 |
present in the induction rule. This enables the writer to specify |
|
1320 |
only induction variables, or both predicates and variables, for |
|
1321 |
example. |
|
1322 |
||
1323 |
Instantiations may be definitional: equations \isa{{\isachardoublequote}x\ {\isasymequiv}\ t{\isachardoublequote}} |
|
1324 |
introduce local definitions, which are inserted into the claim and |
|
1325 |
discharged after applying the induction rule. Equalities reappear |
|
1326 |
in the inductive cases, but have been transformed according to the |
|
1327 |
induction principle being involved here. In order to achieve |
|
1328 |
practically useful induction hypotheses, some variables occurring in |
|
1329 |
\isa{t} need to be fixed (see below). |
|
1330 |
||
1331 |
The optional ``\isa{{\isachardoublequote}arbitrary{\isacharcolon}\ x\isactrlsub {\isadigit{1}}\ {\isasymdots}\ x\isactrlsub m{\isachardoublequote}}'' |
|
1332 |
specification generalizes variables \isa{{\isachardoublequote}x\isactrlsub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ x\isactrlsub m{\isachardoublequote}} of the original goal before applying induction. Thus |
|
1333 |
induction hypotheses may become sufficiently general to get the |
|
1334 |
proof through. Together with definitional instantiations, one may |
|
1335 |
effectively perform induction over expressions of a certain |
|
1336 |
structure. |
|
1337 |
||
1338 |
The optional ``\isa{{\isachardoublequote}taking{\isacharcolon}\ t\isactrlsub {\isadigit{1}}\ {\isasymdots}\ t\isactrlsub n{\isachardoublequote}}'' |
|
1339 |
specification provides additional instantiations of a prefix of |
|
1340 |
pending variables in the rule. Such schematic induction rules |
|
1341 |
rarely occur in practice, though. |
|
1342 |
||
28788 | 1343 |
\item \hyperlink{method.coinduct}{\mbox{\isa{coinduct}}}~\isa{{\isachardoublequote}inst\ R{\isachardoublequote}} is analogous to the |
27042 | 1344 |
\hyperlink{method.induct}{\mbox{\isa{induct}}} method, but refers to coinduction rules, which are |
1345 |
determined as follows: |
|
1346 |
||
1347 |
\medskip |
|
1348 |
\begin{tabular}{llll} |
|
1349 |
goal & & arguments & rule \\\hline |
|
1350 |
& \hyperlink{method.coinduct}{\mbox{\isa{coinduct}}} & \isa{x} & type coinduction (type of \isa{x}) \\ |
|
1351 |
\isa{{\isachardoublequote}A\ x{\isachardoublequote}} & \hyperlink{method.coinduct}{\mbox{\isa{coinduct}}} & \isa{{\isachardoublequote}{\isasymdots}{\isachardoublequote}} & predicate/set coinduction (of \isa{A}) \\ |
|
1352 |
\isa{{\isachardoublequote}{\isasymdots}{\isachardoublequote}} & \hyperlink{method.coinduct}{\mbox{\isa{coinduct}}} & \isa{{\isachardoublequote}{\isasymdots}\ rule{\isacharcolon}\ R{\isachardoublequote}} & explicit rule \isa{R} \\ |
|
1353 |
\end{tabular} |
|
1354 |
||
1355 |
Coinduction is the dual of induction. Induction essentially |
|
1356 |
eliminates \isa{{\isachardoublequote}A\ x{\isachardoublequote}} towards a generic result \isa{{\isachardoublequote}P\ x{\isachardoublequote}}, |
|
1357 |
while coinduction introduces \isa{{\isachardoublequote}A\ x{\isachardoublequote}} starting with \isa{{\isachardoublequote}B\ x{\isachardoublequote}}, for a suitable ``bisimulation'' \isa{B}. The cases of a |
|
1358 |
coinduct rule are typically named after the predicates or sets being |
|
1359 |
covered, while the conclusions consist of several alternatives being |
|
1360 |
named after the individual destructor patterns. |
|
1361 |
||
1362 |
The given instantiation refers to the \emph{suffix} of variables |
|
1363 |
occurring in the rule's major premise, or conclusion if unavailable. |
|
1364 |
An additional ``\isa{{\isachardoublequote}taking{\isacharcolon}\ t\isactrlsub {\isadigit{1}}\ {\isasymdots}\ t\isactrlsub n{\isachardoublequote}}'' |
|
1365 |
specification may be required in order to specify the bisimulation |
|
1366 |
to be used in the coinduction step. |
|
1367 |
||
28788 | 1368 |
\end{description} |
27042 | 1369 |
|
1370 |
Above methods produce named local contexts, as determined by the |
|
1371 |
instantiated rule as given in the text. Beyond that, the \hyperlink{method.induct}{\mbox{\isa{induct}}} and \hyperlink{method.coinduct}{\mbox{\isa{coinduct}}} methods guess further instantiations |
|
1372 |
from the goal specification itself. Any persisting unresolved |
|
1373 |
schematic variables of the resulting rule will render the the |
|
1374 |
corresponding case invalid. The term binding \hyperlink{variable.?case}{\mbox{\isa{{\isacharquery}case}}} for |
|
1375 |
the conclusion will be provided with each case, provided that term |
|
1376 |
is fully specified. |
|
1377 |
||
1378 |
The \hyperlink{command.print-cases}{\mbox{\isa{\isacommand{print{\isacharunderscore}cases}}}} command prints all named cases present |
|
1379 |
in the current proof state. |
|
1380 |
||
1381 |
\medskip Despite the additional infrastructure, both \hyperlink{method.cases}{\mbox{\isa{cases}}} |
|
1382 |
and \hyperlink{method.coinduct}{\mbox{\isa{coinduct}}} merely apply a certain rule, after |
|
1383 |
instantiation, while conforming due to the usual way of monotonic |
|
1384 |
natural deduction: the context of a structured statement \isa{{\isachardoublequote}{\isasymAnd}x\isactrlsub {\isadigit{1}}\ {\isasymdots}\ x\isactrlsub m{\isachardot}\ {\isasymphi}\isactrlsub {\isadigit{1}}\ {\isasymLongrightarrow}\ {\isasymdots}\ {\isasymphi}\isactrlsub n\ {\isasymLongrightarrow}\ {\isasymdots}{\isachardoublequote}} |
|
1385 |
reappears unchanged after the case split. |
|
1386 |
||
1387 |
The \hyperlink{method.induct}{\mbox{\isa{induct}}} method is fundamentally different in this |
|
1388 |
respect: the meta-level structure is passed through the |
|
1389 |
``recursive'' course involved in the induction. Thus the original |
|
1390 |
statement is basically replaced by separate copies, corresponding to |
|
1391 |
the induction hypotheses and conclusion; the original goal context |
|
1392 |
is no longer available. Thus local assumptions, fixed parameters |
|
1393 |
and definitions effectively participate in the inductive rephrasing |
|
1394 |
of the original statement. |
|
1395 |
||
1396 |
In induction proofs, local assumptions introduced by cases are split |
|
1397 |
into two different kinds: \isa{hyps} stemming from the rule and |
|
1398 |
\isa{prems} from the goal statement. This is reflected in the |
|
1399 |
extracted cases accordingly, so invoking ``\hyperlink{command.case}{\mbox{\isa{\isacommand{case}}}}~\isa{c}'' will provide separate facts \isa{c{\isachardot}hyps} and \isa{c{\isachardot}prems}, |
|
1400 |
as well as fact \isa{c} to hold the all-inclusive list. |
|
1401 |
||
1402 |
\medskip Facts presented to either method are consumed according to |
|
1403 |
the number of ``major premises'' of the rule involved, which is |
|
1404 |
usually 0 for plain cases and induction rules of datatypes etc.\ and |
|
1405 |
1 for rules of inductive predicates or sets and the like. The |
|
1406 |
remaining facts are inserted into the goal verbatim before the |
|
1407 |
actual \isa{cases}, \isa{induct}, or \isa{coinduct} rule is |
|
1408 |
applied.% |
|
1409 |
\end{isamarkuptext}% |
|
1410 |
\isamarkuptrue% |
|
1411 |
% |
|
1412 |
\isamarkupsubsection{Declaring rules% |
|
1413 |
} |
|
1414 |
\isamarkuptrue% |
|
1415 |
% |
|
1416 |
\begin{isamarkuptext}% |
|
1417 |
\begin{matharray}{rcl} |
|
28788 | 1418 |
\indexdef{}{command}{print\_induct\_rules}\hypertarget{command.print-induct-rules}{\hyperlink{command.print-induct-rules}{\mbox{\isa{\isacommand{print{\isacharunderscore}induct{\isacharunderscore}rules}}}}}\isa{{\isachardoublequote}\isactrlsup {\isacharasterisk}{\isachardoublequote}} & : & \isa{{\isachardoublequote}context\ {\isasymrightarrow}{\isachardoublequote}} \\ |
1419 |
\indexdef{}{attribute}{cases}\hypertarget{attribute.cases}{\hyperlink{attribute.cases}{\mbox{\isa{cases}}}} & : & \isa{attribute} \\ |
|
1420 |
\indexdef{}{attribute}{induct}\hypertarget{attribute.induct}{\hyperlink{attribute.induct}{\mbox{\isa{induct}}}} & : & \isa{attribute} \\ |
|
1421 |
\indexdef{}{attribute}{coinduct}\hypertarget{attribute.coinduct}{\hyperlink{attribute.coinduct}{\mbox{\isa{coinduct}}}} & : & \isa{attribute} \\ |
|
27042 | 1422 |
\end{matharray} |
1423 |
||
1424 |
\begin{rail} |
|
1425 |
'cases' spec |
|
1426 |
; |
|
1427 |
'induct' spec |
|
1428 |
; |
|
1429 |
'coinduct' spec |
|
1430 |
; |
|
1431 |
||
27142 | 1432 |
spec: (('type' | 'pred' | 'set') ':' nameref) | 'del' |
27042 | 1433 |
; |
1434 |
\end{rail} |
|
1435 |
||
28788 | 1436 |
\begin{description} |
27042 | 1437 |
|
28788 | 1438 |
\item \hyperlink{command.print-induct-rules}{\mbox{\isa{\isacommand{print{\isacharunderscore}induct{\isacharunderscore}rules}}}} prints cases and induct rules |
1439 |
for predicates (or sets) and types of the current context. |
|
27042 | 1440 |
|
28788 | 1441 |
\item \hyperlink{attribute.cases}{\mbox{\isa{cases}}}, \hyperlink{attribute.induct}{\mbox{\isa{induct}}}, and \hyperlink{attribute.coinduct}{\mbox{\isa{coinduct}}} (as attributes) declare rules for reasoning about |
27142 | 1442 |
(co)inductive predicates (or sets) and types, using the |
1443 |
corresponding methods of the same name. Certain definitional |
|
1444 |
packages of object-logics usually declare emerging cases and |
|
1445 |
induction rules as expected, so users rarely need to intervene. |
|
1446 |
||
1447 |
Rules may be deleted via the \isa{{\isachardoublequote}del{\isachardoublequote}} specification, which |
|
1448 |
covers all of the \isa{{\isachardoublequote}type{\isachardoublequote}}/\isa{{\isachardoublequote}pred{\isachardoublequote}}/\isa{{\isachardoublequote}set{\isachardoublequote}} |
|
1449 |
sub-categories simultaneously. For example, \hyperlink{attribute.cases}{\mbox{\isa{cases}}}~\isa{del} removes any \hyperlink{attribute.cases}{\mbox{\isa{cases}}} rules declared for |
|
1450 |
some type, predicate, or set. |
|
27042 | 1451 |
|
1452 |
Manual rule declarations usually refer to the \hyperlink{attribute.case-names}{\mbox{\isa{case{\isacharunderscore}names}}} and \hyperlink{attribute.params}{\mbox{\isa{params}}} attributes to adjust names of |
|
1453 |
cases and parameters of a rule; the \hyperlink{attribute.consumes}{\mbox{\isa{consumes}}} |
|
1454 |
declaration is taken care of automatically: \hyperlink{attribute.consumes}{\mbox{\isa{consumes}}}~\isa{{\isadigit{0}}} is specified for ``type'' rules and \hyperlink{attribute.consumes}{\mbox{\isa{consumes}}}~\isa{{\isadigit{1}}} for ``predicate'' / ``set'' rules. |
|
1455 |
||
28788 | 1456 |
\end{description}% |
27042 | 1457 |
\end{isamarkuptext}% |
1458 |
\isamarkuptrue% |
|
1459 |
% |
|
26869 | 1460 |
\isadelimtheory |
1461 |
% |
|
1462 |
\endisadelimtheory |
|
1463 |
% |
|
1464 |
\isatagtheory |
|
1465 |
\isacommand{end}\isamarkupfalse% |
|
1466 |
% |
|
1467 |
\endisatagtheory |
|
1468 |
{\isafoldtheory}% |
|
1469 |
% |
|
1470 |
\isadelimtheory |
|
1471 |
% |
|
1472 |
\endisadelimtheory |
|
1473 |
\isanewline |
|
1474 |
\end{isabellebody}% |
|
1475 |
%%% Local Variables: |
|
1476 |
%%% mode: latex |
|
1477 |
%%% TeX-master: "root" |
|
1478 |
%%% End: |