author | paulson |
Tue, 28 Nov 2000 16:21:51 +0100 | |
changeset 10534 | f3a17e35d976 |
parent 10513 | 6be063dec835 |
child 10857 | 47b1f34ddd09 |
permissions | -rw-r--r-- |
10303 | 1 |
\chapter{Sets, Functions and Relations} |
2 |
||
3 |
Mathematics relies heavily on set theory: not just unions and intersections |
|
4 |
but least fixed points and other concepts. In computer science, sets are |
|
5 |
used to formalize grammars, state transition systems, etc. The set theory |
|
6 |
of Isabelle/HOL should not be confused with traditional, untyped set |
|
7 |
theory, in which everything is a set. There the slogan is `set theory is |
|
8 |
the foundation of mathematics.' Our sets are typed. In a given set, all |
|
9 |
elements have the same type, say |
|
10 |
\isa{T}, and the set itself has type \isa{T set}. Sets are typed in the |
|
11 |
same way as lists. |
|
12 |
||
13 |
Relations are simply sets of pairs. This chapter describes |
|
14 |
the main operations on relations, such as converse, composition and |
|
15 |
transitive closure. Functions are also covered below. They are not sets in |
|
16 |
Isabelle/HOL, but (for example) the range of a function is a set, |
|
17 |
and the inverse image of a function maps sets to sets. |
|
18 |
||
19 |
This chapter ends with a case study concerning model checking for the |
|
20 |
temporal logic CTL\@. Most of the other examples are simple. The |
|
21 |
chapter presents a small selection of built-in theorems in order to point |
|
22 |
out some key properties of the various constants and to introduce you to |
|
23 |
the notation. |
|
24 |
||
25 |
Natural deduction rules are provided for the set theory constants, but they |
|
26 |
are seldom used directly, so only a few are presented here. Many formulas |
|
27 |
involving sets can be proved automatically or simplified to a great extent. |
|
28 |
Expressing your concepts in terms of sets will probably make your proofs |
|
29 |
easier. |
|
30 |
||
31 |
||
32 |
\section{Sets} |
|
33 |
||
34 |
We begin with \textbf{intersection}, \textbf{union} and \textbf{complement} (denoted |
|
35 |
by a minus sign). In addition to the \textbf{membership} relation, there |
|
36 |
is a symbol for its negation. These points can be seen below. |
|
37 |
||
38 |
Here are the natural deduction rules for intersection. Note the |
|
39 |
resemblance to those for conjunction. |
|
40 |
\begin{isabelle} |
|
41 |
\isasymlbrakk c\ \isasymin\ |
|
42 |
A;\ c\ \isasymin\ |
|
43 |
B\isasymrbrakk\ \isasymLongrightarrow\ c\ |
|
44 |
\isasymin\ A\ \isasyminter\ B% |
|
45 |
\rulename{IntI}\isanewline |
|
46 |
c\ \isasymin\ A\ \isasyminter\ |
|
47 |
B\ \isasymLongrightarrow\ c\ \isasymin\ |
|
48 |
A% |
|
49 |
\rulename{IntD1}\isanewline |
|
50 |
c\ \isasymin\ A\ \isasyminter\ |
|
51 |
B\ \isasymLongrightarrow\ c\ \isasymin\ |
|
52 |
B% |
|
53 |
\rulename{IntD2}% |
|
54 |
\end{isabelle} |
|
55 |
||
56 |
Here are two of the many installed theorems concerning set complement: |
|
57 |
\begin{isabelle} |
|
58 |
(c\ \isasymin\ \isacharminus\ A)\ =\ (c\ \isasymnotin\ A) |
|
59 |
\rulename{Compl_iff}\isanewline |
|
60 |
\isacharminus\ (A\ \isasymunion\ |
|
61 |
B)\ =\ \isacharminus\ |
|
62 |
A\ \isasyminter\ \isacharminus\ B |
|
63 |
\rulename{Compl_Un} |
|
64 |
\end{isabelle} |
|
65 |
||
66 |
Set \textbf{difference} means the same thing as intersection with the |
|
67 |
complement of another set. Here we also see the syntax for the |
|
68 |
empty set and for the universal set. |
|
69 |
\begin{isabelle} |
|
70 |
A\ \isasyminter\ (B\ |
|
71 |
\isacharminus\ A)\ =\ |
|
72 |
\isacharbraceleft{\isacharbraceright} |
|
73 |
\rulename{Diff_disjoint}% |
|
74 |
\isanewline |
|
75 |
A\ \isasymunion\ \isacharminus\ A\ |
|
76 |
=\ UNIV% |
|
77 |
\rulename{Compl_partition} |
|
78 |
\end{isabelle} |
|
79 |
||
80 |
The \textbf{subset} relation holds between two sets just if every element |
|
81 |
of one is also an element of the other. This relation is reflexive. These |
|
82 |
are its natural deduction rules: |
|
83 |
\begin{isabelle} |
|
84 |
({\isasymAnd}x.\ x\ \isasymin\ A\ \isasymLongrightarrow\ x\ \isasymin\ B)\ \isasymLongrightarrow\ A\ \isasymsubseteq\ B% |
|
85 |
\rulename{subsetI}% |
|
86 |
\par\smallskip% \isanewline didn't leave enough space |
|
87 |
\isasymlbrakk A\ \isasymsubseteq\ B;\ c\ \isasymin\ |
|
88 |
A\isasymrbrakk\ \isasymLongrightarrow\ c\ |
|
89 |
\isasymin\ B% |
|
90 |
\rulename{subsetD} |
|
91 |
\end{isabelle} |
|
92 |
In harder proofs, you may need to apply \isa{subsetD} giving a specific term |
|
93 |
for~\isa{c}. However, \isa{blast} can instantly prove facts such as this |
|
94 |
one: |
|
95 |
\begin{isabelle} |
|
96 |
(A\ \isasymunion\ B\ |
|
97 |
\isasymsubseteq\ C)\ =\ |
|
98 |
(A\ \isasymsubseteq\ C\ |
|
99 |
\isasymand\ B\ \isasymsubseteq\ |
|
100 |
C) |
|
101 |
\rulename{Un_subset_iff} |
|
102 |
\end{isabelle} |
|
103 |
Here is another example, also proved automatically: |
|
104 |
\begin{isabelle} |
|
105 |
\isacommand{lemma}\ "(A\ |
|
106 |
\isasymsubseteq\ -B)\ =\ |
|
107 |
(B\ \isasymsubseteq\ |
|
108 |
-A)"\isanewline |
|
109 |
\isacommand{apply}\ (blast)\isanewline |
|
110 |
\isacommand{done} |
|
111 |
\end{isabelle} |
|
112 |
% |
|
113 |
This is the same example using ASCII syntax, illustrating a pitfall: |
|
114 |
\begin{isabelle} |
|
115 |
\isacommand{lemma}\ "(A\ \isacharless=\ -B)\ =\ (B\ \isacharless=\ |
|
116 |
-A)" |
|
117 |
\end{isabelle} |
|
118 |
% |
|
119 |
The proof fails. It is not a statement about sets, due to overloading; |
|
120 |
the relation symbol~\isa{<=} can be any relation, not just |
|
121 |
subset. |
|
122 |
In this general form, the statement is not valid. Putting |
|
123 |
in a type constraint forces the variables to denote sets, allowing the |
|
124 |
proof to succeed: |
|
125 |
||
126 |
\begin{isabelle} |
|
127 |
\isacommand{lemma}\ "((A::\ {\isacharprime}a\ set)\ \isacharless=\ -B)\ =\ (B\ \isacharless=\ |
|
128 |
-A)" |
|
129 |
\end{isabelle} |
|
130 |
Incidentally, \isa{A\ \isasymsubseteq\ -B} asserts that |
|
131 |
the sets \isa{A} and \isa{B} are disjoint. |
|
132 |
||
133 |
\medskip |
|
134 |
Two sets are \textbf{equal} if they contain the same elements. |
|
135 |
This is |
|
136 |
the principle of \textbf{extensionality} for sets. |
|
137 |
\begin{isabelle} |
|
138 |
({\isasymAnd}x.\ (x\ {\isasymin}\ A)\ =\ (x\ {\isasymin}\ B))\ |
|
139 |
{\isasymLongrightarrow}\ A\ =\ B |
|
140 |
\rulename{set_ext} |
|
141 |
\end{isabelle} |
|
142 |
Extensionality is often expressed as |
|
143 |
$A=B\iff A\subseteq B\conj B\subseteq A$. |
|
144 |
The following rules express both |
|
145 |
directions of this equivalence. Proving a set equation using |
|
146 |
\isa{equalityI} allows the two inclusions to be proved independently. |
|
147 |
\begin{isabelle} |
|
148 |
\isasymlbrakk A\ \isasymsubseteq\ B;\ B\ \isasymsubseteq\ |
|
149 |
A\isasymrbrakk\ \isasymLongrightarrow\ A\ =\ B% |
|
150 |
\rulename{equalityI} |
|
151 |
\par\smallskip% \isanewline didn't leave enough space |
|
152 |
\isasymlbrakk A\ =\ B;\ \isasymlbrakk A\ \isasymsubseteq\ B;\ B\ |
|
153 |
\isasymsubseteq\ A\isasymrbrakk\ \isasymLongrightarrow\ P\isasymrbrakk\ |
|
154 |
\isasymLongrightarrow\ P% |
|
155 |
\rulename{equalityE} |
|
156 |
\end{isabelle} |
|
157 |
||
158 |
||
159 |
\subsection{Finite set notation} |
|
160 |
||
161 |
Finite sets are expressed using the constant {\isa{insert}}, which is |
|
162 |
closely related to union: |
|
163 |
\begin{isabelle} |
|
164 |
insert\ a\ A\ =\ |
|
165 |
\isacharbraceleft a\isacharbraceright\ \isasymunion\ |
|
166 |
A% |
|
167 |
\rulename{insert_is_Un} |
|
168 |
\end{isabelle} |
|
169 |
% |
|
170 |
The finite set expression \isa{\isacharbraceleft |
|
171 |
a,b\isacharbraceright} abbreviates |
|
172 |
\isa{insert\ a\ (insert\ b\ \isacharbraceleft\isacharbraceright)}. |
|
173 |
Many simple facts can be proved automatically: |
|
174 |
\begin{isabelle} |
|
175 |
\isacommand{lemma}\ |
|
176 |
"{\isacharbraceleft}a,b\isacharbraceright\ |
|
177 |
\isasymunion\ {\isacharbraceleft}c,d\isacharbraceright\ |
|
178 |
=\ |
|
179 |
{\isacharbraceleft}a,b,c,d\isacharbraceright"\isanewline |
|
180 |
\isacommand{apply}\ |
|
181 |
(blast)\isanewline |
|
182 |
\isacommand{done} |
|
183 |
\end{isabelle} |
|
184 |
||
185 |
||
186 |
Not everything that we would like to prove is valid. |
|
187 |
Consider this try: |
|
188 |
\begin{isabelle} |
|
189 |
\isacommand{lemma}\ "{\isacharbraceleft}a,b\isacharbraceright\ \isasyminter\ {\isacharbraceleft}b,c\isacharbraceright\ =\ |
|
190 |
{\isacharbraceleft}b\isacharbraceright"\isanewline |
|
191 |
\isacommand{apply}\ |
|
192 |
(auto) |
|
193 |
\end{isabelle} |
|
194 |
% |
|
195 |
The proof fails, leaving the subgoal \isa{b=c}. To see why it |
|
196 |
fails, consider a correct version: |
|
197 |
\begin{isabelle} |
|
198 |
\isacommand{lemma}\ "{\isacharbraceleft}a,b\isacharbraceright\ \isasyminter\ {\isacharbraceleft}b,c\isacharbraceright\ =\ (if\ a=c\ then\ {\isacharbraceleft}a,b\isacharbraceright\ else\ {\isacharbraceleft}b\isacharbraceright)"\isanewline |
|
199 |
\isacommand{apply}\ (simp)\isanewline |
|
200 |
\isacommand{apply}\ (blast)\isanewline |
|
201 |
\isacommand{done}% |
|
202 |
\end{isabelle} |
|
203 |
||
204 |
Our mistake was to suppose that the various items were distinct. Another |
|
205 |
remark: this proof uses two methods, namely {\isa{simp}} and |
|
206 |
{\isa{blast}}. Calling {\isa{simp}} eliminates the |
|
207 |
\isa{if}-\isa{then}-\isa{else} expression, which {\isa{blast}} |
|
208 |
cannot break down. The combined methods (namely {\isa{force}} and |
|
209 |
{\isa{auto}}) can prove this fact in one step. |
|
210 |
||
211 |
||
212 |
\subsection{Set comprehension} |
|
213 |
||
214 |
A set comprehension expresses the set of all elements that satisfy |
|
215 |
a given predicate. Formally, we do not need sets at all. We are |
|
216 |
working in higher-order logic, where variables can range over |
|
217 |
predicates. The main benefit of using sets is their notation; |
|
218 |
we can write \isa{x{\isasymin}A} and \isa{{\isacharbraceleft}z.\ |
|
219 |
P\isacharbraceright} where predicates would require writing |
|
220 |
\isa{A(x)} and |
|
221 |
\isa{{\isasymlambda}z.\ P}. |
|
222 |
||
223 |
These two laws describe the relationship between set |
|
224 |
comprehension and the membership relation. |
|
225 |
\begin{isabelle} |
|
226 |
(a\ \isasymin\ |
|
227 |
{\isacharbraceleft}x.\ P\ |
|
228 |
x\isacharbraceright)\ =\ |
|
229 |
P\ a% |
|
230 |
\rulename{mem_Collect_eq}% |
|
231 |
\isanewline |
|
232 |
{\isacharbraceleft}x.\ x\ \isasymin\ |
|
233 |
A\isacharbraceright\ =\ A% |
|
234 |
\rulename{Collect_mem_eq} |
|
235 |
\end{isabelle} |
|
236 |
||
237 |
Facts such as these have trivial proofs: |
|
238 |
\begin{isabelle} |
|
239 |
\isacommand{lemma}\ |
|
240 |
"{\isacharbraceleft}x.\ P\ x\ \isasymor\ |
|
241 |
x\ \isasymin\ A\isacharbraceright\ =\ |
|
242 |
{\isacharbraceleft}x.\ P\ x\isacharbraceright\ |
|
243 |
\isasymunion\ A" |
|
244 |
\par\smallskip |
|
245 |
\isacommand{lemma}\ |
|
246 |
"{\isacharbraceleft}x.\ P\ x\ |
|
247 |
\isasymlongrightarrow\ Q\ x\isacharbraceright\ =\ |
|
248 |
\isacharminus{\isacharbraceleft}x.\ P\ x\isacharbraceright\ |
|
249 |
\isasymunion\ {\isacharbraceleft}x.\ Q\ |
|
250 |
x\isacharbraceright" |
|
251 |
\end{isabelle} |
|
252 |
||
253 |
Isabelle has a general syntax for comprehension, which is best |
|
254 |
described through an example: |
|
255 |
\begin{isabelle} |
|
256 |
\isacommand{lemma}\ "{\isacharbraceleft}p*q\ \isacharbar\ p\ q.\ |
|
257 |
p{\isasymin}prime\ \isasymand\ q{\isasymin}prime\isacharbraceright\ =\ |
|
258 |
\isanewline |
|
259 |
\ \ \ \ \ \ \ \ {\isacharbraceleft}z.\ {\isasymexists}p\ q.\ z\ =\ p*q\ |
|
260 |
\isasymand\ p{\isasymin}prime\ \isasymand\ |
|
261 |
q{\isasymin}prime\isacharbraceright" |
|
262 |
\end{isabelle} |
|
263 |
The proof is trivial because the left and right hand side |
|
264 |
of the expression are synonymous. The syntax appearing on the |
|
265 |
left-hand side abbreviates the right-hand side: in this case, all numbers |
|
266 |
that are the product of two primes. In general, the syntax provides a neat |
|
267 |
way of expressing any set given by an expression built up from variables |
|
268 |
under specific constraints. |
|
269 |
||
270 |
||
271 |
||
272 |
\subsection{Binding operators} |
|
273 |
||
274 |
Universal and existential quantifications may range over sets, |
|
275 |
with the obvious meaning. Here are the natural deduction rules for the |
|
276 |
bounded universal quantifier. Occasionally you will need to apply |
|
277 |
\isa{bspec} with an explicit instantiation of the variable~\isa{x}: |
|
278 |
% |
|
279 |
\begin{isabelle} |
|
280 |
({\isasymAnd}x.\ x\ \isasymin\ A\ \isasymLongrightarrow\ P\ x)\ \isasymLongrightarrow\ {\isasymforall}x\isasymin |
|
281 |
A.\ P\ x% |
|
282 |
\rulename{ballI}% |
|
283 |
\isanewline |
|
284 |
\isasymlbrakk{\isasymforall}x\isasymin A.\ |
|
285 |
P\ x;\ x\ \isasymin\ |
|
286 |
A\isasymrbrakk\ \isasymLongrightarrow\ P\ |
|
287 |
x% |
|
288 |
\rulename{bspec} |
|
289 |
\end{isabelle} |
|
290 |
% |
|
291 |
Dually, here are the natural deduction rules for the |
|
292 |
bounded existential quantifier. You may need to apply |
|
293 |
\isa{bexI} with an explicit instantiation: |
|
294 |
\begin{isabelle} |
|
295 |
\isasymlbrakk P\ x;\ |
|
296 |
x\ \isasymin\ A\isasymrbrakk\ |
|
297 |
\isasymLongrightarrow\ |
|
298 |
{\isasymexists}x\isasymin A.\ P\ |
|
299 |
x% |
|
300 |
\rulename{bexI}% |
|
301 |
\isanewline |
|
302 |
\isasymlbrakk{\isasymexists}x\isasymin A.\ |
|
303 |
P\ x;\ {\isasymAnd}x.\ |
|
304 |
{\isasymlbrakk}x\ \isasymin\ A;\ |
|
305 |
P\ x\isasymrbrakk\ \isasymLongrightarrow\ |
|
306 |
Q\isasymrbrakk\ \isasymLongrightarrow\ Q% |
|
307 |
\rulename{bexE} |
|
308 |
\end{isabelle} |
|
309 |
||
310 |
Unions can be formed over the values of a given set. The syntax is |
|
311 |
\isa{\isasymUnion x\isasymin A.\ B} or \isa{UN |
|
312 |
x:\ A.\ B} in \textsc{ascii}. Indexed union satisfies this basic law: |
|
313 |
\begin{isabelle} |
|
314 |
(b\ \isasymin\ |
|
315 |
(\isasymUnion x\isasymin A.\ B\ x))\ =\ ({\isasymexists}x\isasymin A.\ |
|
316 |
b\ \isasymin\ B\ x) |
|
317 |
\rulename{UN_iff} |
|
318 |
\end{isabelle} |
|
319 |
It has two natural deduction rules similar to those for the existential |
|
320 |
quantifier. Sometimes \isa{UN_I} must be applied explicitly: |
|
321 |
\begin{isabelle} |
|
322 |
\isasymlbrakk a\ \isasymin\ |
|
323 |
A;\ b\ \isasymin\ |
|
324 |
B\ a\isasymrbrakk\ \isasymLongrightarrow\ |
|
325 |
b\ \isasymin\ |
|
326 |
({\isasymUnion}x\isasymin A.\ |
|
327 |
B\ x) |
|
328 |
\rulename{UN_I}% |
|
329 |
\isanewline |
|
330 |
\isasymlbrakk b\ \isasymin\ |
|
331 |
({\isasymUnion}x\isasymin A.\ |
|
332 |
B\ x);\ |
|
333 |
{\isasymAnd}x.\ {\isasymlbrakk}x\ \isasymin\ |
|
334 |
A;\ b\ \isasymin\ |
|
335 |
B\ x\isasymrbrakk\ \isasymLongrightarrow\ |
|
336 |
R\isasymrbrakk\ \isasymLongrightarrow\ R% |
|
337 |
\rulename{UN_E} |
|
338 |
\end{isabelle} |
|
339 |
% |
|
340 |
The following built-in abbreviation lets us express the union |
|
341 |
over a \emph{type}: |
|
342 |
\begin{isabelle} |
|
343 |
\ \ \ \ \ |
|
344 |
({\isasymUnion}x.\ B\ x)\ {==}\ |
|
345 |
({\isasymUnion}x{\isasymin}UNIV.\ B\ x) |
|
346 |
\end{isabelle} |
|
347 |
Abbreviations work as you might expect. The term on the left-hand side of |
|
348 |
the |
|
349 |
\isa{==} symbol is automatically translated to the right-hand side when the |
|
350 |
term is parsed, the reverse translation being done when the term is |
|
351 |
displayed. |
|
352 |
||
353 |
We may also express the union of a set of sets, written \isa{Union\ C} in |
|
354 |
\textsc{ascii}: |
|
355 |
\begin{isabelle} |
|
356 |
(A\ \isasymin\ \isasymUnion C)\ =\ ({\isasymexists}X\isasymin C.\ A\ |
|
357 |
\isasymin\ X) |
|
358 |
\rulename{Union_iff} |
|
359 |
\end{isabelle} |
|
360 |
||
361 |
Intersections are treated dually, although they seem to be used less often |
|
362 |
than unions. The syntax below would be \isa{INT |
|
363 |
x:\ A.\ B} and \isa{Inter\ C} in \textsc{ascii}. Among others, these |
|
364 |
theorems are available: |
|
365 |
\begin{isabelle} |
|
366 |
(b\ \isasymin\ |
|
367 |
({\isasymInter}x\isasymin A.\ |
|
368 |
B\ x))\ |
|
369 |
=\ |
|
370 |
({\isasymforall}x\isasymin A.\ |
|
371 |
b\ \isasymin\ B\ x) |
|
372 |
\rulename{INT_iff}% |
|
373 |
\isanewline |
|
374 |
(A\ \isasymin\ |
|
375 |
\isasymInter C)\ =\ |
|
376 |
({\isasymforall}X\isasymin C.\ |
|
377 |
A\ \isasymin\ X) |
|
378 |
\rulename{Inter_iff} |
|
379 |
\end{isabelle} |
|
380 |
||
381 |
Isabelle uses logical equivalences such as those above in automatic proof. |
|
382 |
Unions, intersections and so forth are not simply replaced by their |
|
383 |
definitions. Instead, membership tests are simplified. For example, $x\in |
|
384 |
A\cup B$ is replaced by $x\in A\vee x\in B$. |
|
385 |
||
386 |
The internal form of a comprehension involves the constant |
|
387 |
\isa{Collect}, which occasionally appears when a goal or theorem |
|
388 |
is displayed. For example, \isa{Collect\ P} is the same term as |
|
389 |
\isa{{\isacharbraceleft}z.\ P\ x\isacharbraceright}. The same thing can |
|
390 |
happen with quantifiers: for example, \isa{Ball\ A\ P} is |
|
391 |
\isa{{\isasymforall}z\isasymin A.\ P\ x} and \isa{Bex\ A\ P} is |
|
392 |
\isa{{\isasymexists}z\isasymin A.\ P\ x}. For indexed unions and |
|
393 |
intersections, you may see the constants \isa{UNION} and \isa{INTER}\@. |
|
394 |
||
395 |
We have only scratched the surface of Isabelle/HOL's set theory. |
|
396 |
One primitive not mentioned here is the powerset operator |
|
397 |
{\isa{Pow}}. Hundreds of theorems are proved in theory \isa{Set} and its |
|
398 |
descendants. |
|
399 |
||
400 |
||
401 |
\subsection{Finiteness and cardinality} |
|
402 |
||
403 |
The predicate \isa{finite} holds of all finite sets. Isabelle/HOL includes |
|
404 |
many familiar theorems about finiteness and cardinality |
|
405 |
(\isa{card}). For example, we have theorems concerning the cardinalities |
|
406 |
of unions, intersections and the powerset: |
|
407 |
% |
|
408 |
\begin{isabelle} |
|
409 |
{\isasymlbrakk}finite\ A;\ finite\ B\isasymrbrakk\isanewline |
|
410 |
\isasymLongrightarrow\ card\ A\ \isacharplus\ card\ B\ =\ card\ (A\ \isasymunion\ B)\ \isacharplus\ card\ (A\ \isasyminter\ B) |
|
411 |
\rulename{card_Un_Int}% |
|
412 |
\isanewline |
|
413 |
\isanewline |
|
414 |
finite\ A\ \isasymLongrightarrow\ card\ |
|
415 |
(Pow\ A)\ =\ 2\ \isacharcircum\ card\ A% |
|
416 |
\rulename{card_Pow}% |
|
417 |
\isanewline |
|
418 |
\isanewline |
|
419 |
finite\ A\ \isasymLongrightarrow\isanewline |
|
420 |
card\ {\isacharbraceleft}B.\ B\ \isasymsubseteq\ |
|
421 |
A\ \isasymand\ card\ B\ =\ |
|
422 |
k\isacharbraceright\ =\ card\ A\ choose\ k% |
|
423 |
\rulename{n_subsets} |
|
424 |
\end{isabelle} |
|
425 |
Writing $|A|$ as $n$, the last of these theorems says that the number of |
|
426 |
$k$-element subsets of~$A$ is $n \choose k$. |
|
427 |
||
428 |
\emph{Note}: the term \isa{Finite\ A} is an abbreviation for |
|
429 |
\isa{A\ \isasymin\ Finites}, where the constant \isa{Finites} denotes the |
|
430 |
set of all finite sets of a given type. So there is no constant |
|
431 |
\isa{Finite}. |
|
432 |
||
433 |
||
434 |
\section{Functions} |
|
435 |
||
436 |
This section describes a few concepts that involve functions. |
|
437 |
Some of the more important theorems are given along with the |
|
438 |
names. A few sample proofs appear. Unlike with set theory, however, |
|
439 |
we cannot simply state lemmas and expect them to be proved using {\isa{blast}}. |
|
440 |
||
441 |
Two functions are \textbf{equal} if they yield equal results given equal arguments. |
|
442 |
This is the principle of \textbf{extensionality} for functions: |
|
443 |
\begin{isabelle} |
|
444 |
({\isasymAnd}x.\ f\ x\ =\ g\ x)\ {\isasymLongrightarrow}\ f\ =\ g |
|
445 |
\rulename{ext} |
|
446 |
\end{isabelle} |
|
447 |
||
448 |
||
449 |
Function \textbf{update} is useful for modelling machine states. It has |
|
450 |
the obvious definition and many useful facts are proved about |
|
451 |
it. In particular, the following equation is installed as a simplification |
|
452 |
rule: |
|
453 |
\begin{isabelle} |
|
454 |
(f(x:=y))\ z\ =\ (if\ z\ =\ x\ then\ y\ else\ f\ z) |
|
455 |
\rulename{fun_upd_apply} |
|
456 |
\end{isabelle} |
|
457 |
Two syntactic points must be noted. In |
|
458 |
\isa{(f(x:=y))\ z} we are applying an updated function to an |
|
459 |
argument; the outer parentheses are essential. A series of two or more |
|
460 |
updates can be abbreviated as shown on the left-hand side of this theorem: |
|
461 |
\begin{isabelle} |
|
462 |
f(x:=y,\ x:=z)\ =\ f(x:=z) |
|
463 |
\rulename{fun_upd_upd} |
|
464 |
\end{isabelle} |
|
465 |
Note also that we can write \isa{f(x:=z)} with only one pair of parentheses |
|
466 |
when it is not being applied to an argument. |
|
467 |
||
468 |
\medskip |
|
469 |
The \textbf{identity} function and function \textbf{composition} are defined as |
|
470 |
follows: |
|
471 |
\begin{isabelle}% |
|
472 |
id\ \isasymequiv\ {\isasymlambda}x.\ x% |
|
473 |
\rulename{id_def}\isanewline |
|
474 |
f\ \isasymcirc\ g\ \isasymequiv\ |
|
475 |
{\isasymlambda}x.\ f\ |
|
476 |
(g\ x)% |
|
477 |
\rulename{o_def} |
|
478 |
\end{isabelle} |
|
479 |
% |
|
480 |
Many familiar theorems concerning the identity and composition |
|
481 |
are proved. For example, we have the associativity of composition: |
|
482 |
\begin{isabelle} |
|
483 |
f\ \isasymcirc\ (g\ \isasymcirc\ h)\ =\ f\ \isasymcirc\ g\ \isasymcirc\ h |
|
484 |
\rulename{o_assoc} |
|
485 |
\end{isabelle} |
|
486 |
||
487 |
\medskip |
|
488 |
||
489 |
A function may be \textbf{injective}, \textbf{surjective} or \textbf{bijective}: |
|
490 |
\begin{isabelle} |
|
491 |
inj_on\ f\ A\ \isasymequiv\ {\isasymforall}x\isasymin A.\ |
|
492 |
{\isasymforall}y\isasymin A.\ f\ x\ =\ f\ y\ \isasymlongrightarrow\ x\ |
|
493 |
=\ y% |
|
494 |
\rulename{inj_on_def}\isanewline |
|
495 |
surj\ f\ \isasymequiv\ {\isasymforall}y.\ |
|
496 |
{\isasymexists}x.\ y\ =\ f\ x% |
|
497 |
\rulename{surj_def}\isanewline |
|
498 |
bij\ f\ \isasymequiv\ inj\ f\ \isasymand\ surj\ f |
|
499 |
\rulename{bij_def} |
|
500 |
\end{isabelle} |
|
501 |
The second argument |
|
502 |
of \isa{inj_on} lets us express that a function is injective over a |
|
503 |
given set. This refinement is useful in higher-order logic, where |
|
504 |
functions are total; in some cases, a function's natural domain is a subset |
|
505 |
of its domain type. Writing \isa{inj\ f} abbreviates \isa{inj_on\ f\ |
|
506 |
UNIV}, for when \isa{f} is injective everywhere. |
|
507 |
||
508 |
The operator {\isa{inv}} expresses the \textbf{inverse} of a function. In |
|
509 |
general the inverse may not be well behaved. We have the usual laws, |
|
510 |
such as these: |
|
511 |
\begin{isabelle} |
|
512 |
inj\ f\ \ \isasymLongrightarrow\ inv\ f\ (f\ x)\ =\ x% |
|
513 |
\rulename{inv_f_f}\isanewline |
|
514 |
surj\ f\ \isasymLongrightarrow\ f\ (inv\ f\ y)\ =\ y |
|
515 |
\rulename{surj_f_inv_f}\isanewline |
|
516 |
bij\ f\ \ \isasymLongrightarrow\ inv\ (inv\ f)\ =\ f |
|
517 |
\rulename{inv_inv_eq} |
|
518 |
\end{isabelle} |
|
519 |
% |
|
520 |
%Other useful facts are that the inverse of an injection |
|
521 |
%is a surjection and vice versa; the inverse of a bijection is |
|
522 |
%a bijection. |
|
523 |
%\begin{isabelle} |
|
524 |
%inj\ f\ \isasymLongrightarrow\ surj\ |
|
525 |
%(inv\ f) |
|
526 |
%\rulename{inj_imp_surj_inv}\isanewline |
|
527 |
%surj\ f\ \isasymLongrightarrow\ inj\ (inv\ f) |
|
528 |
%\rulename{surj_imp_inj_inv}\isanewline |
|
529 |
%bij\ f\ \isasymLongrightarrow\ bij\ (inv\ f) |
|
530 |
%\rulename{bij_imp_bij_inv} |
|
531 |
%\end{isabelle} |
|
532 |
% |
|
533 |
%The converses of these results fail. Unless a function is |
|
534 |
%well behaved, little can be said about its inverse. Here is another |
|
535 |
%law: |
|
536 |
%\begin{isabelle} |
|
537 |
%{\isasymlbrakk}bij\ f;\ bij\ g\isasymrbrakk\ \isasymLongrightarrow\ inv\ (f\ \isasymcirc\ g)\ =\ inv\ g\ \isasymcirc\ inv\ f% |
|
538 |
%\rulename{o_inv_distrib} |
|
539 |
%\end{isabelle} |
|
540 |
||
541 |
Theorems involving these concepts can be hard to prove. The following |
|
542 |
example is easy, but it cannot be proved automatically. To begin |
|
543 |
with, we need a law that relates the quality of functions to |
|
544 |
equality over all arguments: |
|
545 |
\begin{isabelle} |
|
546 |
(f\ =\ g)\ =\ ({\isasymforall}x.\ f\ x\ =\ g\ x) |
|
547 |
\rulename{expand_fun_eq} |
|
548 |
\end{isabelle} |
|
549 |
||
550 |
This is just a restatement of extensionality. Our lemma states |
|
551 |
that an injection can be cancelled from the left |
|
552 |
side of function composition: |
|
553 |
\begin{isabelle} |
|
554 |
\isacommand{lemma}\ "inj\ f\ \isasymLongrightarrow\ (f\ o\ g\ =\ f\ o\ h)\ =\ (g\ =\ h)"\isanewline |
|
555 |
\isacommand{apply}\ (simp\ add:\ expand_fun_eq\ inj_on_def\ o_def)\isanewline |
|
556 |
\isacommand{apply}\ (auto)\isanewline |
|
557 |
\isacommand{done} |
|
558 |
\end{isabelle} |
|
559 |
||
560 |
The first step of the proof invokes extensionality and the definitions |
|
561 |
of injectiveness and composition. It leaves one subgoal: |
|
562 |
\begin{isabelle} |
|
563 |
%inj\ f\ \isasymLongrightarrow\ (f\ \isasymcirc\ g\ =\ f\ \isasymcirc\ h)\ |
|
564 |
%=\ (g\ =\ h)\isanewline |
|
565 |
\ 1.\ {\isasymforall}x\ y.\ f\ x\ =\ f\ y\ \isasymlongrightarrow\ x\ =\ y\ \isasymLongrightarrow\isanewline |
|
566 |
\ \ \ \ ({\isasymforall}x.\ f\ (g\ x)\ =\ f\ (h\ x))\ =\ ({\isasymforall}x.\ g\ x\ =\ h\ x) |
|
567 |
\end{isabelle} |
|
568 |
This can be proved using the {\isa{auto}} method. |
|
569 |
||
570 |
\medskip |
|
571 |
||
572 |
The \textbf{image} of a set under a function is a most useful notion. It |
|
573 |
has the obvious definition: |
|
574 |
\begin{isabelle} |
|
575 |
f\ ``\ A\ \isasymequiv\ {\isacharbraceleft}y.\ {\isasymexists}x\isasymin |
|
576 |
A.\ y\ =\ f\ x\isacharbraceright |
|
577 |
\rulename{image_def} |
|
578 |
\end{isabelle} |
|
579 |
% |
|
580 |
Here are some of the many facts proved about image: |
|
581 |
\begin{isabelle} |
|
582 |
(f\ \isasymcirc\ g)\ ``\ r\ =\ f\ ``\ g\ ``\ r |
|
583 |
\rulename{image_compose}\isanewline |
|
584 |
f``(A\ \isasymunion\ B)\ =\ f``A\ \isasymunion\ f``B |
|
585 |
\rulename{image_Un}\isanewline |
|
586 |
inj\ f\ \isasymLongrightarrow\ f``(A\ \isasyminter\ |
|
587 |
B)\ =\ f``A\ \isasyminter\ f``B |
|
588 |
\rulename{image_Int} |
|
589 |
%\isanewline |
|
590 |
%bij\ f\ \isasymLongrightarrow\ f\ ``\ (-\ A)\ =\ \isacharminus\ f\ ``\ A% |
|
591 |
%\rulename{bij_image_Compl_eq} |
|
592 |
\end{isabelle} |
|
593 |
||
594 |
||
595 |
Laws involving image can often be proved automatically. Here |
|
596 |
are two examples, illustrating connections with indexed union and with the |
|
597 |
general syntax for comprehension: |
|
598 |
\begin{isabelle} |
|
599 |
\isacommand{lemma}\ "f``A\ \isasymunion\ g``A\ =\ ({\isasymUnion}x{\isasymin}A.\ {\isacharbraceleft}f\ x,\ g\ |
|
600 |
x\isacharbraceright) |
|
601 |
\par\smallskip |
|
602 |
\isacommand{lemma}\ "f\ ``\ \isacharbraceleft(x,y){.}\ P\ x\ y\isacharbraceright\ =\ {\isacharbraceleft}f(x,y)\ \isacharbar\ x\ y.\ P\ x\ |
|
603 |
y\isacharbraceright" |
|
604 |
\end{isabelle} |
|
605 |
||
606 |
\medskip |
|
607 |
A function's \textbf{range} is the set of values that the function can |
|
608 |
take on. It is, in fact, the image of the universal set under |
|
609 |
that function. There is no constant {\isa{range}}. Instead, {\isa{range}} |
|
610 |
abbreviates an application of image to {\isa{UNIV}}: |
|
611 |
\begin{isabelle} |
|
612 |
\ \ \ \ \ range\ f\ |
|
613 |
{==}\ f``UNIV |
|
614 |
\end{isabelle} |
|
615 |
% |
|
616 |
Few theorems are proved specifically |
|
617 |
for {\isa{range}}; in most cases, you should look for a more general |
|
618 |
theorem concerning images. |
|
619 |
||
620 |
\medskip |
|
621 |
\textbf{Inverse image} is also useful. It is defined as follows: |
|
622 |
\begin{isabelle} |
|
623 |
f\ \isacharminus``\ B\ \isasymequiv\ {\isacharbraceleft}x.\ f\ x\ \isasymin\ B\isacharbraceright |
|
624 |
\rulename{vimage_def} |
|
625 |
\end{isabelle} |
|
626 |
% |
|
627 |
This is one of the facts proved about it: |
|
628 |
\begin{isabelle} |
|
629 |
f\ \isacharminus``\ (-\ A)\ =\ \isacharminus\ f\ \isacharminus``\ A% |
|
630 |
\rulename{vimage_Compl} |
|
631 |
\end{isabelle} |
|
632 |
||
633 |
||
634 |
\section{Relations} |
|
10513 | 635 |
\label{sec:Relations} |
10303 | 636 |
|
637 |
A \textbf{relation} is a set of pairs. As such, the set operations apply |
|
638 |
to them. For instance, we may form the union of two relations. Other |
|
639 |
primitives are defined specifically for relations. |
|
640 |
||
641 |
The \textbf{identity} relation, also known as equality, has the obvious |
|
642 |
definition: |
|
643 |
\begin{isabelle} |
|
644 |
Id\ \isasymequiv\ {\isacharbraceleft}p.\ {\isasymexists}x.\ p\ =\ (x,x){\isacharbraceright}% |
|
645 |
\rulename{Id_def} |
|
646 |
\end{isabelle} |
|
647 |
||
648 |
\textbf{Composition} of relations (the infix \isa{O}) is also available: |
|
649 |
\begin{isabelle} |
|
650 |
r\ O\ s\ \isasymequiv\ \isacharbraceleft(x,z){.}\ {\isasymexists}y.\ (x,y)\ \isasymin\ s\ \isasymand\ (y,z)\ \isasymin\ r\isacharbraceright |
|
651 |
\rulename{comp_def} |
|
652 |
\end{isabelle} |
|
653 |
||
654 |
This is one of the many lemmas proved about these concepts: |
|
655 |
\begin{isabelle} |
|
656 |
R\ O\ Id\ =\ R |
|
657 |
\rulename{R_O_Id} |
|
658 |
\end{isabelle} |
|
659 |
% |
|
660 |
Composition is monotonic, as are most of the primitives appearing |
|
661 |
in this chapter. We have many theorems similar to the following |
|
662 |
one: |
|
663 |
\begin{isabelle} |
|
664 |
\isasymlbrakk r\isacharprime\ \isasymsubseteq\ r;\ s\isacharprime\ |
|
665 |
\isasymsubseteq\ s\isasymrbrakk\ \isasymLongrightarrow\ r\isacharprime\ O\ |
|
666 |
s\isacharprime\ \isasymsubseteq\ r\ O\ s% |
|
667 |
\rulename{comp_mono} |
|
668 |
\end{isabelle} |
|
669 |
||
670 |
The \textbf{converse} or inverse of a relation exchanges the roles |
|
671 |
of the two operands. Note that \isa{\isacharcircum-1} is a postfix |
|
672 |
operator. |
|
673 |
\begin{isabelle} |
|
674 |
((a,b)\ \isasymin\ r\isacharcircum-1)\ =\ |
|
675 |
((b,a)\ \isasymin\ r) |
|
676 |
\rulename{converse_iff} |
|
677 |
\end{isabelle} |
|
678 |
% |
|
679 |
Here is a typical law proved about converse and composition: |
|
680 |
\begin{isabelle} |
|
681 |
(r\ O\ s){\isacharcircum}\isacharminus1\ =\ s\isacharcircum-1\ O\ r\isacharcircum-1 |
|
682 |
\rulename{converse_comp} |
|
683 |
\end{isabelle} |
|
684 |
||
685 |
||
686 |
The \textbf{image} of a set under a relation is defined analogously |
|
687 |
to image under a function: |
|
688 |
\begin{isabelle} |
|
689 |
(b\ \isasymin\ r\ \isacharcircum{\isacharcircum}\ A)\ =\ ({\isasymexists}x\isasymin |
|
690 |
A.\ (x,b)\ \isasymin\ r) |
|
691 |
\rulename{Image_iff} |
|
692 |
\end{isabelle} |
|
693 |
It satisfies many similar laws. |
|
694 |
||
695 |
%Image under relations, like image under functions, distributes over unions: |
|
696 |
%\begin{isabelle} |
|
697 |
%r\ \isacharcircum{\isacharcircum}\ |
|
698 |
%({\isasymUnion}x\isasyminA.\ |
|
699 |
%B\ |
|
700 |
%x)\ =\ |
|
701 |
%({\isasymUnion}x\isasyminA.\ |
|
702 |
%r\ \isacharcircum{\isacharcircum}\ B\ |
|
703 |
%x) |
|
704 |
%\rulename{Image_UN} |
|
705 |
%\end{isabelle} |
|
706 |
||
707 |
||
708 |
The \textbf{domain} and \textbf{range} of a relation are defined in the |
|
709 |
standard way: |
|
710 |
\begin{isabelle} |
|
711 |
(a\ \isasymin\ Domain\ r)\ =\ ({\isasymexists}y.\ (a,y)\ \isasymin\ |
|
712 |
r) |
|
713 |
\rulename{Domain_iff}% |
|
714 |
\isanewline |
|
715 |
(a\ \isasymin\ Range\ r)\ |
|
716 |
\ =\ ({\isasymexists}y.\ |
|
717 |
(y,a)\ |
|
718 |
\isasymin\ r) |
|
719 |
\rulename{Range_iff} |
|
720 |
\end{isabelle} |
|
721 |
||
722 |
Iterated composition of a relation is available. The notation overloads |
|
723 |
that of exponentiation: |
|
724 |
\begin{isabelle} |
|
725 |
R\ \isacharcircum\ \isadigit{0}\ =\ Id\isanewline |
|
726 |
R\ \isacharcircum\ Suc\ n\ =\ R\ O\ R\isacharcircum n |
|
727 |
\rulename{RelPow.relpow.simps} |
|
728 |
\end{isabelle} |
|
729 |
||
10398 | 730 |
The \textbf{reflexive transitive closure} of the |
731 |
relation~\isa{r} is written with the |
|
732 |
postfix syntax \isa{r\isacharcircum{*}}. It is the least solution of the |
|
733 |
equation |
|
10303 | 734 |
\begin{isabelle} |
735 |
r\isacharcircum{*}\ =\ Id\ \isasymunion\ (r\ O\ r\isacharcircum{*}) |
|
736 |
\rulename{rtrancl_unfold} |
|
737 |
\end{isabelle} |
|
738 |
% |
|
739 |
Among its basic properties are three that serve as introduction |
|
740 |
rules: |
|
741 |
\begin{isabelle} |
|
742 |
(a,a)\ \isasymin\ |
|
743 |
r\isacharcircum{*} |
|
744 |
\rulename{rtrancl_refl}% |
|
745 |
\isanewline |
|
746 |
p\ \isasymin\ r\ \isasymLongrightarrow\ |
|
747 |
p\ \isasymin\ |
|
748 |
r\isacharcircum{*} |
|
749 |
\rulename{r_into_rtrancl}% |
|
750 |
\isanewline |
|
751 |
\isasymlbrakk(a,b)\ \isasymin\ |
|
752 |
r\isacharcircum{*};\ |
|
753 |
(b,c)\ \isasymin\ r\isacharcircum{*}\isasymrbrakk\ |
|
754 |
\isasymLongrightarrow\ |
|
755 |
(a,c)\ \isasymin\ r\isacharcircum{*} |
|
756 |
\rulename{rtrancl_trans} |
|
757 |
\end{isabelle} |
|
758 |
% |
|
759 |
Induction over the reflexive transitive closure is available: |
|
760 |
\begin{isabelle} |
|
761 |
\isasymlbrakk(a,b)\ \isasymin\ r\isacharcircum{*};\ P\ a;\isanewline |
|
762 |
\ \ {\isasymAnd}y\ z.\ |
|
763 |
\isasymlbrakk(a,y)\ \isasymin\ r\isacharcircum{*};\ |
|
764 |
(y,z)\ \isasymin\ r;\ P\ y\isasymrbrakk\ |
|
765 |
\isasymLongrightarrow\ P\ z\isasymrbrakk\isanewline |
|
766 |
\isasymLongrightarrow\ P\ b% |
|
767 |
\rulename{rtrancl_induct} |
|
768 |
\end{isabelle} |
|
769 |
% |
|
770 |
Here is one of the many laws proved about the reflexive transitive |
|
771 |
closure: |
|
772 |
\begin{isabelle} |
|
773 |
(r\isacharcircum{*}){\isacharcircum}*\ =\ r\isacharcircum{*} |
|
774 |
\rulename{rtrancl_idemp} |
|
775 |
\end{isabelle} |
|
776 |
||
777 |
The transitive closure is similar. It has two |
|
778 |
introduction rules: |
|
779 |
\begin{isabelle} |
|
780 |
p\ \isasymin\ r\ \isasymLongrightarrow\ p\ \isasymin\ r\isacharcircum{\isacharplus} |
|
781 |
\rulename{r_into_trancl}\isanewline |
|
782 |
\isasymlbrakk(a,b)\ \isasymin\ |
|
783 |
r\isacharcircum{\isacharplus};\ (b,c)\ |
|
784 |
\isasymin\ r\isacharcircum{\isacharplus}\isasymrbrakk\ |
|
785 |
\isasymLongrightarrow\ (a,c)\ \isasymin\ |
|
786 |
r\isacharcircum{\isacharplus} |
|
787 |
\rulename{trancl_trans} |
|
788 |
\end{isabelle} |
|
789 |
% |
|
790 |
The induction rule is similar to the one shown above. |
|
791 |
A typical lemma states that transitive closure commutes with the converse |
|
792 |
operator: |
|
793 |
\begin{isabelle} |
|
794 |
(r\isacharcircum-1){\isacharcircum}\isacharplus\ =\ (r\isacharcircum{\isacharplus}){\isacharcircum}\isacharminus1 |
|
795 |
\rulename{trancl_converse} |
|
796 |
\end{isabelle} |
|
797 |
||
798 |
||
799 |
The reflexive transitive closure also commutes with the converse. |
|
800 |
Let us examine the proof. Each direction of the equivalence is |
|
801 |
proved separately. The two proofs are almost identical. Here |
|
802 |
is the first one: |
|
803 |
\begin{isabelle} |
|
804 |
\isacommand{lemma}\ rtrancl_converseD:\ "(x,y)\ \isasymin\ (r\isacharcircum-1){\isacharcircum}*\ \isasymLongrightarrow\ (x,y)\ \isasymin\ (r\isacharcircum{*}){\isacharcircum}\isacharminus1"\isanewline |
|
805 |
\isacommand{apply}\ (erule\ |
|
806 |
rtrancl_induct)\isanewline |
|
807 |
\ \isacommand{apply}\ (rule\ rtrancl_refl)\isanewline |
|
808 |
\isacommand{apply}\ (blast\ intro:\ r_into_rtrancl\ rtrancl_trans)\isanewline |
|
809 |
\isacommand{done} |
|
810 |
\end{isabelle} |
|
811 |
||
812 |
The first step of the proof applies induction, leaving these subgoals: |
|
813 |
\begin{isabelle} |
|
814 |
\ 1.\ (x,x)\ \isasymin\ r\isacharcircum{*}\isanewline |
|
815 |
\ 2.\ {\isasymAnd}y\ z.\ \isasymlbrakk(x,y)\ \isasymin\ (r\isacharcircum-1){\isacharcircum}*;\ (y,z)\ \isasymin\ r\isacharcircum-1;\ (y,x)\ \isasymin\ r\isacharcircum{*}\isasymrbrakk\isanewline |
|
816 |
\ \ \ \ \ \ \ \ \ \ \isasymLongrightarrow\ (z,x)\ \isasymin\ r\isacharcircum{*} |
|
817 |
\end{isabelle} |
|
818 |
||
819 |
The first subgoal is trivial by reflexivity. The second follows |
|
820 |
by first eliminating the converse operator, yielding the |
|
821 |
assumption \isa{(z,y)\ |
|
822 |
\isasymin\ r}, and then |
|
823 |
applying the introduction rules shown above. The same proof script handles |
|
824 |
the other direction: |
|
825 |
\begin{isabelle} |
|
826 |
\isacommand{lemma}\ rtrancl_converseI:\ "(x,y)\ \isasymin\ (r\isacharcircum{*}){\isacharcircum}\isacharminus1\ \isasymLongrightarrow\ (x,y)\ \isasymin\ (r\isacharcircum-1){\isacharcircum}*"\isanewline |
|
827 |
\isacommand{apply}\ (drule\ converseD)\isanewline |
|
828 |
\isacommand{apply}\ (erule\ rtrancl_induct)\isanewline |
|
829 |
\ \isacommand{apply}\ (rule\ rtrancl_refl)\isanewline |
|
830 |
\isacommand{apply}\ (blast\ intro:\ r_into_rtrancl\ rtrancl_trans)\isanewline |
|
831 |
\isacommand{done} |
|
832 |
\end{isabelle} |
|
833 |
||
834 |
||
835 |
Finally, we combine the two lemmas to prove the desired equation: |
|
836 |
\begin{isabelle} |
|
837 |
\isacommand{lemma}\ rtrancl_converse:\ "(r\isacharcircum-1){\isacharcircum}*\ =\ (r\isacharcircum{*}){\isacharcircum}\isacharminus1"\isanewline |
|
838 |
\isacommand{apply}\ (auto\ intro:\ |
|
839 |
rtrancl_converseI\ dest:\ |
|
840 |
rtrancl_converseD)\isanewline |
|
841 |
\isacommand{done} |
|
842 |
\end{isabelle} |
|
843 |
||
10534
f3a17e35d976
added a reference to {sec:products} for ordered pair reasoning
paulson
parents:
10513
diff
changeset
|
844 |
Note one detail. The {\isa{auto}} method can prove this theorem, but |
f3a17e35d976
added a reference to {sec:products} for ordered pair reasoning
paulson
parents:
10513
diff
changeset
|
845 |
{\isa{blast}} cannot. |
f3a17e35d976
added a reference to {sec:products} for ordered pair reasoning
paulson
parents:
10513
diff
changeset
|
846 |
The lemmas we have proved apply only to ordered pairs, but {\isa{Auto}} |
f3a17e35d976
added a reference to {sec:products} for ordered pair reasoning
paulson
parents:
10513
diff
changeset
|
847 |
replaces a bound variable of product type by a pair of bound variables, |
f3a17e35d976
added a reference to {sec:products} for ordered pair reasoning
paulson
parents:
10513
diff
changeset
|
848 |
allowing the lemmas to be applied. A toy example demonstrates this point: |
10303 | 849 |
\begin{isabelle} |
850 |
\isacommand{lemma}\ "A\ \isasymsubseteq\ Id"\isanewline |
|
851 |
\isacommand{apply}\ (rule\ subsetI)\isanewline |
|
852 |
\isacommand{apply}\ (auto) |
|
853 |
\end{isabelle} |
|
854 |
Applying the introduction rule \isa{subsetI} leaves the goal of showing |
|
855 |
that an arbitrary element of~\isa{A} belongs to~\isa{Id}. |
|
856 |
\begin{isabelle} |
|
857 |
A\ \isasymsubseteq\ Id\isanewline |
|
858 |
\ 1.\ {\isasymAnd}x.\ x\ \isasymin\ A\ \isasymLongrightarrow\ x\ \isasymin\ Id |
|
859 |
\end{isabelle} |
|
860 |
The \isa{simp} and \isa{blast} methods can do nothing here. However, |
|
861 |
\isa{x} is of product type and therefore denotes an ordered pair. The |
|
10534
f3a17e35d976
added a reference to {sec:products} for ordered pair reasoning
paulson
parents:
10513
diff
changeset
|
862 |
\isa{auto} method (and some others, including \isa{clarify}) replace |
10303 | 863 |
\isa{x} by a pair, which then allows the further simplification from |
864 |
\isa{(a,b)\ \isasymin\ A} to \isa{a\ =\ b}. |
|
865 |
\begin{isabelle} |
|
866 |
A\ \isasymsubseteq\ Id\isanewline |
|
867 |
\ 1.\ {\isasymAnd}a\ b.\ (a,b)\ \isasymin\ A\ \isasymLongrightarrow\ a\ =\ b |
|
868 |
\end{isabelle} |
|
10534
f3a17e35d976
added a reference to {sec:products} for ordered pair reasoning
paulson
parents:
10513
diff
changeset
|
869 |
Section~\ref{sec:products} will discuss proof techniques for ordered pairs |
f3a17e35d976
added a reference to {sec:products} for ordered pair reasoning
paulson
parents:
10513
diff
changeset
|
870 |
in more detail. |
10303 | 871 |
|
872 |
||
873 |
\section{Well-founded relations and induction} |
|
10513 | 874 |
\label{sec:Well-founded} |
10303 | 875 |
|
876 |
Induction comes in many forms, including traditional mathematical |
|
877 |
induction, structural induction on lists and induction on size. |
|
878 |
More general than these is induction over a well-founded relation. |
|
879 |
Such A relation expresses the notion of a terminating process. |
|
880 |
Intuitively, the relation~$\prec$ is \textbf{well-founded} if it admits no |
|
881 |
infinite descending chains |
|
882 |
\[ \cdots \prec a@2 \prec a@1 \prec a@0. \] |
|
10398 | 883 |
If $\prec$ is well-founded then it can be used with the well-founded |
884 |
induction rule: |
|
10303 | 885 |
\[ \infer{P(a)}{\infer*{P(x)}{[\forall y.\, y\prec x \imp P(y)]}} \] |
886 |
To show $P(a)$ for a particular term~$a$, it suffices to show $P(x)$ for |
|
887 |
arbitrary~$x$ under the assumption that $P(y)$ holds for $y\prec x$. |
|
888 |
Intuitively, the well-foundedness of $\prec$ ensures that the chains of |
|
10398 | 889 |
reasoning are finite. |
10303 | 890 |
|
891 |
In Isabelle, the induction rule is expressed like this: |
|
892 |
\begin{isabelle} |
|
893 |
{\isasymlbrakk}wf\ r;\ |
|
894 |
{\isasymAnd}x.\ {\isasymforall}y.\ (y,x)\ \isasymin\ r\ |
|
895 |
\isasymlongrightarrow\ P\ y\ \isasymLongrightarrow\ P\ x\isasymrbrakk\ |
|
896 |
\isasymLongrightarrow\ P\ a |
|
897 |
\rulename{wf_induct} |
|
898 |
\end{isabelle} |
|
899 |
Here \isa{wf\ r} expresses that relation~\isa{r} is well-founded. |
|
900 |
||
901 |
Many familiar induction principles are instances of this rule. |
|
902 |
For example, the predecessor relation on the natural numbers |
|
903 |
is well-founded; induction over it is mathematical induction. |
|
904 |
The `tail of' relation on lists is well-founded; induction over |
|
905 |
it is structural induction. |
|
906 |
||
907 |
Well-foundedness can be difficult to show. The various equivalent |
|
908 |
formulations are all hard to use formally. However, often a relation |
|
909 |
is obviously well-founded by construction. The HOL library provides |
|
910 |
several theorems concerning ways of constructing a well-founded relation. |
|
911 |
For example, a relation can be defined by means of a measure function |
|
912 |
involving an existing relation, or two relations can be |
|
913 |
combined lexicographically. |
|
914 |
||
915 |
The library declares \isa{less_than} as a relation object, |
|
916 |
that is, a set of pairs of natural numbers. Two theorems tell us that this |
|
917 |
relation behaves as expected and that it is well-founded: |
|
918 |
\begin{isabelle} |
|
919 |
((x,y)\ \isasymin\ less_than)\ =\ (x\ <\ y) |
|
920 |
\rulename{less_than_iff}\isanewline |
|
921 |
wf\ less_than |
|
922 |
\rulename{wf_less_than} |
|
923 |
\end{isabelle} |
|
924 |
||
925 |
The notion of measure generalizes to the \textbf{inverse image} of |
|
926 |
relation. Given a relation~\isa{r} and a function~\isa{f}, we express a new |
|
927 |
relation using \isa{f} as a measure. An infinite descending chain on this |
|
928 |
new relation would give rise to an infinite descending chain on~\isa{r}. |
|
929 |
The library holds the definition of this concept and a theorem stating |
|
930 |
that it preserves well-foundedness: |
|
931 |
\begin{isabelle} |
|
932 |
inv_image\ r\ f\ \isasymequiv\ \isacharbraceleft(x,y).\ (f\ x,\ f\ y)\ |
|
933 |
\isasymin\ r\isacharbraceright |
|
934 |
\rulename{inv_image_def}\isanewline |
|
935 |
wf\ r\ \isasymLongrightarrow\ wf\ (inv_image\ r\ f) |
|
936 |
\rulename{wf_inv_image} |
|
937 |
\end{isabelle} |
|
938 |
||
939 |
The most familiar notion of measure involves the natural numbers. This yields, |
|
940 |
for example, induction on the length of the list or the size |
|
941 |
of a tree. The library defines \isa{measure} specifically: |
|
942 |
\begin{isabelle} |
|
943 |
measure\ \isasymequiv\ inv_image\ less_than% |
|
944 |
\rulename{measure_def}\isanewline |
|
945 |
wf\ (measure\ f) |
|
946 |
\rulename{wf_measure} |
|
947 |
\end{isabelle} |
|
948 |
||
949 |
Of the other constructions, the most important is the \textbf{lexicographic |
|
950 |
product} of two relations. It expresses the standard dictionary |
|
951 |
ordering over pairs. We write \isa{ra\ <*lex*>\ rb}, where \isa{ra} |
|
952 |
and \isa{rb} are the two operands. The lexicographic product satisfies the |
|
953 |
usual definition and it preserves well-foundedness: |
|
954 |
\begin{isabelle} |
|
955 |
ra\ <*lex*>\ rb\ \isasymequiv \isanewline |
|
956 |
\ \ \isacharbraceleft ((a,b),(a',b')).\ (a,a')\ \isasymin \ ra\ |
|
957 |
\isasymor\isanewline |
|
958 |
\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \,a=a'\ \isasymand \ (b,b')\ |
|
959 |
\isasymin \ rb\isacharbraceright |
|
960 |
\rulename{lex_prod_def}% |
|
961 |
\par\smallskip |
|
962 |
\isasymlbrakk wf\ ra;\ wf\ rb\isasymrbrakk \ \isasymLongrightarrow \ wf\ (ra\ <*lex*>\ rb) |
|
963 |
\rulename{wf_lex_prod} |
|
964 |
\end{isabelle} |
|
965 |
||
966 |
These constructions can be used in a |
|
967 |
\textbf{recdef} declaration (\S\ref{sec:recdef-simplification}) to define |
|
968 |
the well-founded relation used to prove termination. |
|
969 |
||
970 |
||
971 |
||
972 |
||
973 |
||
974 |
\section{Fixed point operators} |
|
975 |
||
976 |
Fixed point operators define sets recursively. Most users invoke |
|
977 |
them through Isabelle's inductive definition facility, which |
|
978 |
is discussed later. However, they can be invoked directly. The \textbf{least} |
|
979 |
or \textbf{strongest} fixed point yields an inductive definition; |
|
980 |
the \textbf{greatest} or \textbf{weakest} fixed point yields a coinductive |
|
981 |
definition. Mathematicians may wish to note that the existence |
|
982 |
of these fixed points is guaranteed by the Knaster-Tarski theorem. |
|
983 |
||
984 |
||
985 |
The theory works applies only to monotonic functions. Isabelle's |
|
986 |
definition of monotone is overloaded over all orderings: |
|
987 |
\begin{isabelle} |
|
988 |
mono\ f\ \isasymequiv\ {\isasymforall}A\ B.\ A\ \isasymle\ B\ \isasymlongrightarrow\ f\ A\ \isasymle\ f\ B% |
|
989 |
\rulename{mono_def} |
|
990 |
\end{isabelle} |
|
991 |
% |
|
992 |
For fixed point operators, the ordering will be the subset relation: if |
|
993 |
$A\subseteq B$ then we expect $f(A)\subseteq f(B)$. In addition to its |
|
994 |
definition, monotonicity has the obvious introduction and destruction |
|
995 |
rules: |
|
996 |
\begin{isabelle} |
|
997 |
({\isasymAnd}A\ B.\ A\ \isasymle\ B\ \isasymLongrightarrow\ f\ A\ \isasymle\ f\ B)\ \isasymLongrightarrow\ mono\ f% |
|
998 |
\rulename{monoI}% |
|
999 |
\par\smallskip% \isanewline didn't leave enough space |
|
1000 |
{\isasymlbrakk}mono\ f;\ A\ \isasymle\ B\isasymrbrakk\ |
|
1001 |
\isasymLongrightarrow\ f\ A\ \isasymle\ f\ B% |
|
1002 |
\rulename{monoD} |
|
1003 |
\end{isabelle} |
|
1004 |
||
1005 |
The most important properties of the least fixed point are that |
|
1006 |
it is a fixed point and that it enjoys an induction rule: |
|
1007 |
\begin{isabelle} |
|
1008 |
mono\ f\ \isasymLongrightarrow\ lfp\ f\ =\ f\ (lfp\ f) |
|
1009 |
\rulename{lfp_unfold}% |
|
1010 |
\par\smallskip% \isanewline didn't leave enough space |
|
1011 |
{\isasymlbrakk}a\ \isasymin\ lfp\ f;\ mono\ f;\isanewline |
|
1012 |
\ {\isasymAnd}x.\ x\ |
|
1013 |
\isasymin\ f\ (lfp\ f\ \isasyminter\ {\isacharbraceleft}x.\ P\ |
|
1014 |
x\isacharbraceright)\ \isasymLongrightarrow\ P\ x\isasymrbrakk\ |
|
1015 |
\isasymLongrightarrow\ P\ a% |
|
1016 |
\rulename{lfp_induct} |
|
1017 |
\end{isabelle} |
|
1018 |
% |
|
1019 |
The induction rule shown above is more convenient than the basic |
|
1020 |
one derived from the minimality of {\isa{lfp}}. Observe that both theorems |
|
1021 |
demand \isa{mono\ f} as a premise. |
|
1022 |
||
1023 |
The greatest fixed point is similar, but it has a \textbf{coinduction} rule: |
|
1024 |
\begin{isabelle} |
|
1025 |
mono\ f\ \isasymLongrightarrow\ gfp\ f\ =\ f\ (gfp\ f) |
|
1026 |
\rulename{gfp_unfold}% |
|
1027 |
\isanewline |
|
1028 |
{\isasymlbrakk}mono\ f;\ a\ \isasymin\ X;\ X\ \isasymsubseteq\ f\ (X\ |
|
1029 |
\isasymunion\ gfp\ f)\isasymrbrakk\ \isasymLongrightarrow\ a\ \isasymin\ |
|
1030 |
gfp\ f% |
|
1031 |
\rulename{coinduct} |
|
1032 |
\end{isabelle} |
|
1033 |
A \textbf{bisimulation} is perhaps the best-known concept defined as a |
|
1034 |
greatest fixed point. Exhibiting a bisimulation to prove the equality of |
|
1035 |
two agents in a process algebra is an example of coinduction. |
|
1036 |
The coinduction rule can be strengthened in various ways; see |
|
1037 |
theory {\isa{Gfp}} for details. |
|
10398 | 1038 |
This chapter ends with a case study concerning model checking for the |
1039 |
temporal logic CTL\@. |