7046
|
1 |
|
7167
|
2 |
\chapter{Isabelle/HOL Tools and Packages}\label{ch:hol-tools}
|
7135
|
3 |
|
7990
|
4 |
\section{Miscellaneous attributes}
|
|
5 |
|
|
6 |
\indexisaratt{rulify}\indexisaratt{rulify-prems}
|
|
7 |
\begin{matharray}{rcl}
|
|
8 |
rulify & : & \isaratt \\
|
|
9 |
rulify_prems & : & \isaratt \\
|
|
10 |
\end{matharray}
|
|
11 |
|
|
12 |
\begin{descr}
|
|
13 |
|
|
14 |
\item [$rulify$] puts a theorem into object-rule form, replacing implication
|
|
15 |
and universal quantification of HOL by the corresponding meta-logical
|
|
16 |
connectives. This is the same operation as performed by the
|
|
17 |
\texttt{qed_spec_mp} ML function.
|
|
18 |
|
|
19 |
\item [$rulify_prems$] is similar to $rulify$, but acts on the premises of a
|
|
20 |
rule.
|
|
21 |
|
|
22 |
\end{descr}
|
|
23 |
|
|
24 |
|
7135
|
25 |
\section{Primitive types}
|
|
26 |
|
7141
|
27 |
\indexisarcmd{typedecl}\indexisarcmd{typedef}
|
|
28 |
\begin{matharray}{rcl}
|
|
29 |
\isarcmd{typedecl} & : & \isartrans{theory}{theory} \\
|
|
30 |
\isarcmd{typedef} & : & \isartrans{theory}{proof(prove)} \\
|
|
31 |
\end{matharray}
|
|
32 |
|
|
33 |
\begin{rail}
|
|
34 |
'typedecl' typespec infix? comment?
|
|
35 |
;
|
|
36 |
'typedef' parname? typespec infix? \\ '=' term comment?
|
|
37 |
;
|
|
38 |
\end{rail}
|
|
39 |
|
7167
|
40 |
\begin{descr}
|
7141
|
41 |
\item [$\isarkeyword{typedecl}~(\vec\alpha)t$] is similar to the original
|
|
42 |
$\isarkeyword{typedecl}$ of Isabelle/Pure (see \S\ref{sec:types-pure}), but
|
|
43 |
also declares type arity $t :: (term, \dots, term) term$, making $t$ an
|
|
44 |
actual HOL type constructor.
|
|
45 |
\item [$\isarkeyword{typedef}~(\vec\alpha)t = A$] sets up a goal stating
|
|
46 |
non-emptiness of the set $A$. After finishing the proof, the theory will be
|
7175
|
47 |
augmented by a Gordon/HOL-style type definition. See \cite{isabelle-HOL}
|
7335
|
48 |
for more information. Note that user-level theories usually do not directly
|
|
49 |
refer to the HOL $\isarkeyword{typedef}$ primitive, but use more advanced
|
|
50 |
packages such as $\isarkeyword{record}$ (see \S\ref{sec:record}) and
|
7175
|
51 |
$\isarkeyword{datatype}$ (see \S\ref{sec:datatype}).
|
7167
|
52 |
\end{descr}
|
7141
|
53 |
|
|
54 |
|
|
55 |
\section{Records}\label{sec:record}
|
|
56 |
|
|
57 |
%FIXME record_split method
|
|
58 |
\indexisarcmd{record}
|
|
59 |
\begin{matharray}{rcl}
|
|
60 |
\isarcmd{record} & : & \isartrans{theory}{theory} \\
|
|
61 |
\end{matharray}
|
|
62 |
|
|
63 |
\begin{rail}
|
|
64 |
'record' typespec '=' (type '+')? (field +)
|
|
65 |
;
|
7135
|
66 |
|
7141
|
67 |
field: name '::' type comment?
|
|
68 |
;
|
|
69 |
\end{rail}
|
|
70 |
|
7167
|
71 |
\begin{descr}
|
7141
|
72 |
\item [$\isarkeyword{record}~(\vec\alpha)t = \tau + \vec c :: \vec\sigma$]
|
|
73 |
defines extensible record type $(\vec\alpha)t$, derived from the optional
|
|
74 |
parent record $\tau$ by adding new field components $\vec c :: \vec\sigma$.
|
7335
|
75 |
See \cite{isabelle-HOL,NaraschewskiW-TPHOLs98} for more information only
|
|
76 |
simply-typed extensible records.
|
7167
|
77 |
\end{descr}
|
7141
|
78 |
|
|
79 |
|
|
80 |
\section{Datatypes}\label{sec:datatype}
|
|
81 |
|
7167
|
82 |
\indexisarcmd{datatype}\indexisarcmd{rep-datatype}
|
7141
|
83 |
\begin{matharray}{rcl}
|
|
84 |
\isarcmd{datatype} & : & \isartrans{theory}{theory} \\
|
|
85 |
\isarcmd{rep_datatype} & : & \isartrans{theory}{theory} \\
|
|
86 |
\end{matharray}
|
|
87 |
|
|
88 |
\railalias{repdatatype}{rep\_datatype}
|
|
89 |
\railterm{repdatatype}
|
|
90 |
|
|
91 |
\begin{rail}
|
7175
|
92 |
'datatype' (parname? typespec infix? \\ '=' (constructor + '|') + 'and')
|
7141
|
93 |
;
|
|
94 |
repdatatype (name * ) \\ 'distinct' thmrefs 'inject' thmrefs 'induction' thmrefs
|
|
95 |
;
|
|
96 |
|
7175
|
97 |
constructor: name (type * ) mixfix? comment?
|
7141
|
98 |
;
|
|
99 |
\end{rail}
|
|
100 |
|
7167
|
101 |
\begin{descr}
|
7319
|
102 |
\item [$\isarkeyword{datatype}$] defines inductive datatypes in HOL.
|
|
103 |
\item [$\isarkeyword{rep_datatype}$] represents existing types as inductive
|
|
104 |
ones, generating the standard infrastructure of derived concepts (primitive
|
|
105 |
recursion etc.).
|
7167
|
106 |
\end{descr}
|
7141
|
107 |
|
8449
|
108 |
The induction and exhaustion theorems generated provide case names according
|
|
109 |
to the constructors involved, while parameters are named after the types (see
|
|
110 |
also \S\ref{sec:induct-method}).
|
|
111 |
|
7319
|
112 |
See \cite{isabelle-HOL} for more details on datatypes. Note that the theory
|
7335
|
113 |
syntax above has been slightly simplified over the old version, usually
|
|
114 |
requiring more quotes and less parentheses.
|
7319
|
115 |
|
7135
|
116 |
|
|
117 |
\section{Recursive functions}
|
|
118 |
|
7141
|
119 |
\indexisarcmd{primrec}\indexisarcmd{recdef}
|
|
120 |
\begin{matharray}{rcl}
|
|
121 |
\isarcmd{primrec} & : & \isartrans{theory}{theory} \\
|
|
122 |
\isarcmd{recdef} & : & \isartrans{theory}{theory} \\
|
|
123 |
%FIXME
|
|
124 |
% \isarcmd{defer_recdef} & : & \isartrans{theory}{theory} \\
|
|
125 |
\end{matharray}
|
|
126 |
|
|
127 |
\begin{rail}
|
|
128 |
'primrec' parname? (thmdecl? prop comment? + )
|
|
129 |
;
|
|
130 |
'recdef' name term (term comment? +) \\ ('congs' thmrefs)? ('simpset' name)?
|
|
131 |
;
|
|
132 |
\end{rail}
|
|
133 |
|
7167
|
134 |
\begin{descr}
|
7319
|
135 |
\item [$\isarkeyword{primrec}$] defines primitive recursive functions over
|
|
136 |
datatypes.
|
|
137 |
\item [$\isarkeyword{recdef}$] defines general well-founded recursive
|
|
138 |
functions (using the TFL package).
|
7167
|
139 |
\end{descr}
|
7141
|
140 |
|
8449
|
141 |
Both definitions accommodate reasoning proof by induction (cf.\
|
|
142 |
\S\ref{sec:induct-method}): rule $c\mathord{.}induct$ (where $c$ is the name
|
|
143 |
of the function definition) refers to a specific induction rule, with
|
|
144 |
parameters named according to the user-specified equations. Case names of
|
|
145 |
$\isarkeyword{primrec}$ are that of the datatypes involved, while those of
|
|
146 |
$\isarkeyword{recdef}$ are numbered (starting from $1$).
|
|
147 |
|
|
148 |
See \cite{isabelle-HOL} for further information on recursive function
|
|
149 |
definitions in HOL.
|
7319
|
150 |
|
7141
|
151 |
|
7135
|
152 |
\section{(Co)Inductive sets}
|
|
153 |
|
7167
|
154 |
\indexisarcmd{inductive}\indexisarcmd{coinductive}\indexisarcmd{inductive-cases}
|
7990
|
155 |
\indexisaratt{mono}
|
7141
|
156 |
\begin{matharray}{rcl}
|
|
157 |
\isarcmd{inductive} & : & \isartrans{theory}{theory} \\
|
|
158 |
\isarcmd{coinductive} & : & \isartrans{theory}{theory} \\
|
7990
|
159 |
mono & : & \isaratt \\
|
7141
|
160 |
\isarcmd{inductive_cases} & : & \isartrans{theory}{theory} \\
|
|
161 |
\end{matharray}
|
|
162 |
|
|
163 |
\railalias{condefs}{con\_defs}
|
|
164 |
\railalias{indcases}{inductive\_cases}
|
|
165 |
\railterm{condefs,indcases}
|
|
166 |
|
|
167 |
\begin{rail}
|
|
168 |
('inductive' | 'coinductive') (term comment? +) \\
|
|
169 |
'intrs' attributes? (thmdecl? prop comment? +) \\
|
|
170 |
'monos' thmrefs comment? \\ condefs thmrefs comment?
|
|
171 |
;
|
|
172 |
indcases thmdef? nameref ':' \\ (prop +) comment?
|
|
173 |
;
|
7990
|
174 |
'mono' (() | 'add' | 'del')
|
|
175 |
;
|
7141
|
176 |
\end{rail}
|
|
177 |
|
7167
|
178 |
\begin{descr}
|
7319
|
179 |
\item [$\isarkeyword{inductive}$ and $\isarkeyword{coinductive}$] define
|
|
180 |
(co)inductive sets from the given introduction rules.
|
7990
|
181 |
\item [$mono$] adds or deletes monotonicity rules from the theory or proof
|
|
182 |
context (the default is to add). These rule are involved in the automated
|
|
183 |
monotonicity proof of $\isarkeyword{inductive}$.
|
8449
|
184 |
\item [$\isarkeyword{inductive_cases}$] creates instances of elimination rules
|
|
185 |
of (co)inductive sets, solving obvious cases by simplification.
|
|
186 |
|
|
187 |
The $cases$ proof method (see \S\ref{sec:induct-method}) provides a more
|
|
188 |
direct way for reasoning by cases (including optional simplification).
|
|
189 |
|
|
190 |
Unlike the \texttt{mk_cases} ML function exported with any inductive
|
|
191 |
definition \cite{isabelle-HOL}, $\isarkeyword{inductive_cases}$ it does
|
|
192 |
\emph{not} modify cases by simplification, apart from trying to solve
|
|
193 |
completely (e.g.\ due to contradictory assumptions. Thus
|
|
194 |
$\isarkeyword{inductive_cases}$ conforms to way Isar proofs are conducted,
|
|
195 |
rather than old-style tactic scripts.
|
7167
|
196 |
\end{descr}
|
7141
|
197 |
|
8449
|
198 |
See \cite{isabelle-HOL} for further information on inductive definitions in
|
|
199 |
HOL.
|
7319
|
200 |
|
7141
|
201 |
|
8449
|
202 |
\section{Proof by cases and induction}\label{sec:induct-method}
|
|
203 |
|
|
204 |
\subsection{Proof methods}
|
7141
|
205 |
|
8449
|
206 |
\indexisarmeth{cases}\indexisarmeth{induct}
|
7319
|
207 |
\begin{matharray}{rcl}
|
8449
|
208 |
cases & : & \isarmeth \\
|
7319
|
209 |
induct & : & \isarmeth \\
|
|
210 |
\end{matharray}
|
|
211 |
|
8449
|
212 |
The $cases$ and $induct$ methods provide a uniform interface to case analysis
|
|
213 |
and induction over datatypes, inductive sets, and recursive functions. The
|
|
214 |
corresponding rules may be specified and instantiated in a casual manner.
|
|
215 |
Furthermore, these methods provide named local contexts that may be invoked
|
|
216 |
via the $\CASENAME$ proof command within the subsequent proof text (cf.\
|
8484
|
217 |
\S\ref{sec:cases}). This accommodates compact proof texts even when reasoning
|
|
218 |
about large specifications.
|
7319
|
219 |
|
|
220 |
\begin{rail}
|
8449
|
221 |
'cases' ('simplified' ':')? term? rule? ;
|
|
222 |
|
|
223 |
'induct' ('stripped' ':')? (inst * 'and') rule?
|
7319
|
224 |
;
|
|
225 |
|
8449
|
226 |
inst: (term +)
|
7319
|
227 |
;
|
8449
|
228 |
rule: ('type' | 'set') ':' nameref | 'rule' ':' thmref
|
7319
|
229 |
;
|
|
230 |
\end{rail}
|
|
231 |
|
|
232 |
\begin{descr}
|
8449
|
233 |
\item [$cases~t~R$] applies method $rule$ with an appropriate case distinction
|
|
234 |
theorem, instantiated to the subject $t$. Symbolic case names are bound
|
|
235 |
according to the rule's local contexts.
|
|
236 |
|
|
237 |
The rule is determined as follows, according to the facts and arguments
|
|
238 |
passed to the $cases$ method:
|
|
239 |
\begin{matharray}{llll}
|
|
240 |
\text{facts} & & \text{arguments} & \text{rule} \\\hline
|
|
241 |
& cases & & \text{classical case split} \\
|
|
242 |
& cases & t & \text{datatype exhaustion (type of $t$)} \\
|
|
243 |
\edrv a \in A & cases & \dots & \text{inductive set elimination (of $A$)} \\
|
|
244 |
\dots & cases & \dots ~ R & \text{explicit rule $R$} \\
|
|
245 |
\end{matharray}
|
|
246 |
|
|
247 |
The $simplified$ option causes ``obvious cases'' of the rule to be solved
|
|
248 |
beforehand, while the others are left unscathed.
|
|
249 |
|
|
250 |
\item [$induct~insts~R$] is analogous to the $cases$ method, but refers to
|
|
251 |
induction rules, which are determined as follows:
|
|
252 |
\begin{matharray}{llll}
|
|
253 |
\text{facts} & & \text{arguments} & \text{rule} \\\hline
|
|
254 |
& induct & P ~ x ~ \dots & \text{datatype induction (type of $x$)} \\
|
|
255 |
\edrv x \in A & induct & \dots & \text{set induction (of $A$)} \\
|
|
256 |
\dots & induct & \dots ~ R & \text{explicit rule $R$} \\
|
|
257 |
\end{matharray}
|
|
258 |
|
|
259 |
Several instantiations may be given, each referring to some part of a mutual
|
|
260 |
inductive definition or datatype --- only related partial induction rules
|
|
261 |
may be used together, though. Any of the lists of terms $P, x, \dots$
|
|
262 |
refers to the \emph{suffix} of variables present in the induction rule.
|
|
263 |
This enables the writer to specify only induction variables, or both
|
|
264 |
predicates and variables, for example.
|
7507
|
265 |
|
8449
|
266 |
The $stripped$ option causes implications and (bounded) universal
|
|
267 |
quantifiers to be removed from each new subgoal emerging from the
|
|
268 |
application of the induction rule.
|
7319
|
269 |
\end{descr}
|
7141
|
270 |
|
8484
|
271 |
Above methods produce named local contexts (cf.\ \S\ref{sec:cases}), as
|
|
272 |
determined by the instantiated rule \emph{before} it has been applied to the
|
|
273 |
internal proof state.\footnote{As a general principle, Isar proof text may
|
8449
|
274 |
never refer to parts of proof states directly.} Thus proper use of symbolic
|
|
275 |
cases usually require the rule to be instantiated fully, as far as the
|
|
276 |
emerging local contexts and subgoals are concerned. In particular, for
|
|
277 |
induction both the predicates and variables have to be specified. Otherwise
|
|
278 |
the $\CASENAME$ command would refuse to invoke cases that contain schematic
|
|
279 |
variables.
|
|
280 |
|
|
281 |
The $\isarkeyword{print_cases}$ command (\S\ref{sec:diag}) prints all named
|
|
282 |
cases present in the current proof context.
|
|
283 |
|
|
284 |
|
8484
|
285 |
\subsection{Declaring rules}
|
8449
|
286 |
|
|
287 |
\indexisaratt{cases}\indexisaratt{induct}
|
|
288 |
\begin{matharray}{rcl}
|
|
289 |
cases & : & \isaratt \\
|
|
290 |
induct & : & \isaratt \\
|
|
291 |
\end{matharray}
|
|
292 |
|
|
293 |
\begin{rail}
|
|
294 |
'cases' spec
|
|
295 |
;
|
|
296 |
'induct' spec
|
|
297 |
;
|
|
298 |
|
|
299 |
spec: ('type' | 'set') ':' nameref
|
|
300 |
;
|
|
301 |
\end{rail}
|
|
302 |
|
|
303 |
The $cases$ and $induct$ attributes augment the corresponding context of rules
|
|
304 |
for reasoning about inductive sets and types. The standard rules are already
|
|
305 |
declared by HOL definitional packages. For special applications, these may be
|
|
306 |
replaced manually by variant versions.
|
|
307 |
|
8484
|
308 |
Refer to the $case_names$ and $params$ attributes (see \S\ref{sec:cases}) to
|
|
309 |
adjust names of cases and parameters of a rule.
|
|
310 |
|
7046
|
311 |
|
7390
|
312 |
\section{Arithmetic}
|
|
313 |
|
|
314 |
\indexisarmeth{arith}
|
|
315 |
\begin{matharray}{rcl}
|
|
316 |
arith & : & \isarmeth \\
|
|
317 |
\end{matharray}
|
|
318 |
|
8506
|
319 |
\begin{rail}
|
|
320 |
'arith' '!'?
|
|
321 |
;
|
|
322 |
\end{rail}
|
|
323 |
|
7390
|
324 |
The $arith$ method decides linear arithmetic problems (on types $nat$, $int$,
|
8506
|
325 |
$real$). Any current facts are inserted into the goal before running the
|
|
326 |
procedure. The ``!''~argument causes the full context of assumptions to be
|
|
327 |
included as well.
|
|
328 |
|
|
329 |
Note that a simpler (but faster) version of arithmetic reasoning is already
|
|
330 |
performed by the Simplifier.
|
7390
|
331 |
|
|
332 |
|
7046
|
333 |
%%% Local Variables:
|
|
334 |
%%% mode: latex
|
|
335 |
%%% TeX-master: "isar-ref"
|
|
336 |
%%% End:
|