|
1 theory Tactic |
|
2 imports Base |
|
3 begin |
|
4 |
|
5 chapter {* Tactical reasoning *} |
|
6 |
|
7 text {* |
|
8 Tactical reasoning works by refining the initial claim in a |
|
9 backwards fashion, until a solved form is reached. A @{text "goal"} |
|
10 consists of several subgoals that need to be solved in order to |
|
11 achieve the main statement; zero subgoals means that the proof may |
|
12 be finished. A @{text "tactic"} is a refinement operation that maps |
|
13 a goal to a lazy sequence of potential successors. A @{text |
|
14 "tactical"} is a combinator for composing tactics. |
|
15 *} |
|
16 |
|
17 |
|
18 section {* Goals \label{sec:tactical-goals} *} |
|
19 |
|
20 text {* |
|
21 Isabelle/Pure represents a goal\glossary{Tactical goal}{A theorem of |
|
22 \seeglossary{Horn Clause} form stating that a number of subgoals |
|
23 imply the main conclusion, which is marked as a protected |
|
24 proposition.} as a theorem stating that the subgoals imply the main |
|
25 goal: @{text "A\<^sub>1 \<Longrightarrow> \<dots> \<Longrightarrow> A\<^sub>n \<Longrightarrow> C"}. The outermost goal |
|
26 structure is that of a Horn Clause\glossary{Horn Clause}{An iterated |
|
27 implication @{text "A\<^sub>1 \<Longrightarrow> \<dots> \<Longrightarrow> A\<^sub>n \<Longrightarrow> C"}, without any |
|
28 outermost quantifiers. Strictly speaking, propositions @{text |
|
29 "A\<^sub>i"} need to be atomic in Horn Clauses, but Isabelle admits |
|
30 arbitrary substructure here (nested @{text "\<Longrightarrow>"} and @{text "\<And>"} |
|
31 connectives).}: i.e.\ an iterated implication without any |
|
32 quantifiers\footnote{Recall that outermost @{text "\<And>x. \<phi>[x]"} is |
|
33 always represented via schematic variables in the body: @{text |
|
34 "\<phi>[?x]"}. These variables may get instantiated during the course of |
|
35 reasoning.}. For @{text "n = 0"} a goal is called ``solved''. |
|
36 |
|
37 The structure of each subgoal @{text "A\<^sub>i"} is that of a general |
|
38 Hereditary Harrop Formula @{text "\<And>x\<^sub>1 \<dots> \<And>x\<^sub>k. H\<^sub>1 \<Longrightarrow> \<dots> \<Longrightarrow> H\<^sub>m \<Longrightarrow> B"} in |
|
39 normal form. Here @{text "x\<^sub>1, \<dots>, x\<^sub>k"} are goal parameters, i.e.\ |
|
40 arbitrary-but-fixed entities of certain types, and @{text "H\<^sub>1, \<dots>, |
|
41 H\<^sub>m"} are goal hypotheses, i.e.\ facts that may be assumed locally. |
|
42 Together, this forms the goal context of the conclusion @{text B} to |
|
43 be established. The goal hypotheses may be again arbitrary |
|
44 Hereditary Harrop Formulas, although the level of nesting rarely |
|
45 exceeds 1--2 in practice. |
|
46 |
|
47 The main conclusion @{text C} is internally marked as a protected |
|
48 proposition\glossary{Protected proposition}{An arbitrarily |
|
49 structured proposition @{text "C"} which is forced to appear as |
|
50 atomic by wrapping it into a propositional identity operator; |
|
51 notation @{text "#C"}. Protecting a proposition prevents basic |
|
52 inferences from entering into that structure for the time being.}, |
|
53 which is represented explicitly by the notation @{text "#C"}. This |
|
54 ensures that the decomposition into subgoals and main conclusion is |
|
55 well-defined for arbitrarily structured claims. |
|
56 |
|
57 \medskip Basic goal management is performed via the following |
|
58 Isabelle/Pure rules: |
|
59 |
|
60 \[ |
|
61 \infer[@{text "(init)"}]{@{text "C \<Longrightarrow> #C"}}{} \qquad |
|
62 \infer[@{text "(finish)"}]{@{text "C"}}{@{text "#C"}} |
|
63 \] |
|
64 |
|
65 \medskip The following low-level variants admit general reasoning |
|
66 with protected propositions: |
|
67 |
|
68 \[ |
|
69 \infer[@{text "(protect)"}]{@{text "#C"}}{@{text "C"}} \qquad |
|
70 \infer[@{text "(conclude)"}]{@{text "A\<^sub>1 \<Longrightarrow> \<dots> \<Longrightarrow> A\<^sub>n \<Longrightarrow> C"}}{@{text "A\<^sub>1 \<Longrightarrow> \<dots> \<Longrightarrow> A\<^sub>n \<Longrightarrow> #C"}} |
|
71 \] |
|
72 *} |
|
73 |
|
74 text %mlref {* |
|
75 \begin{mldecls} |
|
76 @{index_ML Goal.init: "cterm -> thm"} \\ |
|
77 @{index_ML Goal.finish: "thm -> thm"} \\ |
|
78 @{index_ML Goal.protect: "thm -> thm"} \\ |
|
79 @{index_ML Goal.conclude: "thm -> thm"} \\ |
|
80 \end{mldecls} |
|
81 |
|
82 \begin{description} |
|
83 |
|
84 \item @{ML "Goal.init"}~@{text C} initializes a tactical goal from |
|
85 the well-formed proposition @{text C}. |
|
86 |
|
87 \item @{ML "Goal.finish"}~@{text "thm"} checks whether theorem |
|
88 @{text "thm"} is a solved goal (no subgoals), and concludes the |
|
89 result by removing the goal protection. |
|
90 |
|
91 \item @{ML "Goal.protect"}~@{text "thm"} protects the full statement |
|
92 of theorem @{text "thm"}. |
|
93 |
|
94 \item @{ML "Goal.conclude"}~@{text "thm"} removes the goal |
|
95 protection, even if there are pending subgoals. |
|
96 |
|
97 \end{description} |
|
98 *} |
|
99 |
|
100 |
|
101 section {* Tactics *} |
|
102 |
|
103 text {* A @{text "tactic"} is a function @{text "goal \<rightarrow> goal\<^sup>*\<^sup>*"} that |
|
104 maps a given goal state (represented as a theorem, cf.\ |
|
105 \secref{sec:tactical-goals}) to a lazy sequence of potential |
|
106 successor states. The underlying sequence implementation is lazy |
|
107 both in head and tail, and is purely functional in \emph{not} |
|
108 supporting memoing.\footnote{The lack of memoing and the strict |
|
109 nature of SML requires some care when working with low-level |
|
110 sequence operations, to avoid duplicate or premature evaluation of |
|
111 results.} |
|
112 |
|
113 An \emph{empty result sequence} means that the tactic has failed: in |
|
114 a compound tactic expressions other tactics might be tried instead, |
|
115 or the whole refinement step might fail outright, producing a |
|
116 toplevel error message. When implementing tactics from scratch, one |
|
117 should take care to observe the basic protocol of mapping regular |
|
118 error conditions to an empty result; only serious faults should |
|
119 emerge as exceptions. |
|
120 |
|
121 By enumerating \emph{multiple results}, a tactic can easily express |
|
122 the potential outcome of an internal search process. There are also |
|
123 combinators for building proof tools that involve search |
|
124 systematically, see also \secref{sec:tacticals}. |
|
125 |
|
126 \medskip As explained in \secref{sec:tactical-goals}, a goal state |
|
127 essentially consists of a list of subgoals that imply the main goal |
|
128 (conclusion). Tactics may operate on all subgoals or on a |
|
129 particularly specified subgoal, but must not change the main |
|
130 conclusion (apart from instantiating schematic goal variables). |
|
131 |
|
132 Tactics with explicit \emph{subgoal addressing} are of the form |
|
133 @{text "int \<rightarrow> tactic"} and may be applied to a particular subgoal |
|
134 (counting from 1). If the subgoal number is out of range, the |
|
135 tactic should fail with an empty result sequence, but must not raise |
|
136 an exception! |
|
137 |
|
138 Operating on a particular subgoal means to replace it by an interval |
|
139 of zero or more subgoals in the same place; other subgoals must not |
|
140 be affected, apart from instantiating schematic variables ranging |
|
141 over the whole goal state. |
|
142 |
|
143 A common pattern of composing tactics with subgoal addressing is to |
|
144 try the first one, and then the second one only if the subgoal has |
|
145 not been solved yet. Special care is required here to avoid bumping |
|
146 into unrelated subgoals that happen to come after the original |
|
147 subgoal. Assuming that there is only a single initial subgoal is a |
|
148 very common error when implementing tactics! |
|
149 |
|
150 Tactics with internal subgoal addressing should expose the subgoal |
|
151 index as @{text "int"} argument in full generality; a hardwired |
|
152 subgoal 1 inappropriate. |
|
153 |
|
154 \medskip The main well-formedness conditions for proper tactics are |
|
155 summarized as follows. |
|
156 |
|
157 \begin{itemize} |
|
158 |
|
159 \item General tactic failure is indicated by an empty result, only |
|
160 serious faults may produce an exception. |
|
161 |
|
162 \item The main conclusion must not be changed, apart from |
|
163 instantiating schematic variables. |
|
164 |
|
165 \item A tactic operates either uniformly on all subgoals, or |
|
166 specifically on a selected subgoal (without bumping into unrelated |
|
167 subgoals). |
|
168 |
|
169 \item Range errors in subgoal addressing produce an empty result. |
|
170 |
|
171 \end{itemize} |
|
172 |
|
173 Some of these conditions are checked by higher-level goal |
|
174 infrastructure (\secref{sec:results}); others are not checked |
|
175 explicitly, and violating them merely results in ill-behaved tactics |
|
176 experienced by the user (e.g.\ tactics that insist in being |
|
177 applicable only to singleton goals, or disallow composition with |
|
178 basic tacticals). |
|
179 *} |
|
180 |
|
181 text %mlref {* |
|
182 \begin{mldecls} |
|
183 @{index_ML_type tactic: "thm -> thm Seq.seq"} \\ |
|
184 @{index_ML no_tac: tactic} \\ |
|
185 @{index_ML all_tac: tactic} \\ |
|
186 @{index_ML print_tac: "string -> tactic"} \\[1ex] |
|
187 @{index_ML PRIMITIVE: "(thm -> thm) -> tactic"} \\[1ex] |
|
188 @{index_ML SUBGOAL: "(term * int -> tactic) -> int -> tactic"} \\ |
|
189 @{index_ML CSUBGOAL: "(cterm * int -> tactic) -> int -> tactic"} \\ |
|
190 \end{mldecls} |
|
191 |
|
192 \begin{description} |
|
193 |
|
194 \item @{ML_type tactic} represents tactics. The well-formedness |
|
195 conditions described above need to be observed. See also @{"file" |
|
196 "~~/src/Pure/General/seq.ML"} for the underlying implementation of |
|
197 lazy sequences. |
|
198 |
|
199 \item @{ML_type "int -> tactic"} represents tactics with explicit |
|
200 subgoal addressing, with well-formedness conditions as described |
|
201 above. |
|
202 |
|
203 \item @{ML no_tac} is a tactic that always fails, returning the |
|
204 empty sequence. |
|
205 |
|
206 \item @{ML all_tac} is a tactic that always succeeds, returning a |
|
207 singleton sequence with unchanged goal state. |
|
208 |
|
209 \item @{ML print_tac}~@{text "message"} is like @{ML all_tac}, but |
|
210 prints a message together with the goal state on the tracing |
|
211 channel. |
|
212 |
|
213 \item @{ML PRIMITIVE}~@{text rule} turns a primitive inference rule |
|
214 into a tactic with unique result. Exception @{ML THM} is considered |
|
215 a regular tactic failure and produces an empty result; other |
|
216 exceptions are passed through. |
|
217 |
|
218 \item @{ML SUBGOAL}~@{text "(fn (subgoal, i) => tactic)"} is the |
|
219 most basic form to produce a tactic with subgoal addressing. The |
|
220 given abstraction over the subgoal term and subgoal number allows to |
|
221 peek at the relevant information of the full goal state. The |
|
222 subgoal range is checked as required above. |
|
223 |
|
224 \item @{ML CSUBGOAL} is similar to @{ML SUBGOAL}, but passes the |
|
225 subgoal as @{ML_type cterm} instead of raw @{ML_type term}. This |
|
226 avoids expensive re-certification in situations where the subgoal is |
|
227 used directly for primitive inferences. |
|
228 |
|
229 \end{description} |
|
230 *} |
|
231 |
|
232 |
|
233 subsection {* Resolution and assumption tactics \label{sec:resolve-assume-tac} *} |
|
234 |
|
235 text {* \emph{Resolution} is the most basic mechanism for refining a |
|
236 subgoal using a theorem as object-level rule. |
|
237 \emph{Elim-resolution} is particularly suited for elimination rules: |
|
238 it resolves with a rule, proves its first premise by assumption, and |
|
239 finally deletes that assumption from any new subgoals. |
|
240 \emph{Destruct-resolution} is like elim-resolution, but the given |
|
241 destruction rules are first turned into canonical elimination |
|
242 format. \emph{Forward-resolution} is like destruct-resolution, but |
|
243 without deleting the selected assumption. The @{text "r/e/d/f"} |
|
244 naming convention is maintained for several different kinds of |
|
245 resolution rules and tactics. |
|
246 |
|
247 Assumption tactics close a subgoal by unifying some of its premises |
|
248 against its conclusion. |
|
249 |
|
250 \medskip All the tactics in this section operate on a subgoal |
|
251 designated by a positive integer. Other subgoals might be affected |
|
252 indirectly, due to instantiation of schematic variables. |
|
253 |
|
254 There are various sources of non-determinism, the tactic result |
|
255 sequence enumerates all possibilities of the following choices (if |
|
256 applicable): |
|
257 |
|
258 \begin{enumerate} |
|
259 |
|
260 \item selecting one of the rules given as argument to the tactic; |
|
261 |
|
262 \item selecting a subgoal premise to eliminate, unifying it against |
|
263 the first premise of the rule; |
|
264 |
|
265 \item unifying the conclusion of the subgoal to the conclusion of |
|
266 the rule. |
|
267 |
|
268 \end{enumerate} |
|
269 |
|
270 Recall that higher-order unification may produce multiple results |
|
271 that are enumerated here. |
|
272 *} |
|
273 |
|
274 text %mlref {* |
|
275 \begin{mldecls} |
|
276 @{index_ML resolve_tac: "thm list -> int -> tactic"} \\ |
|
277 @{index_ML eresolve_tac: "thm list -> int -> tactic"} \\ |
|
278 @{index_ML dresolve_tac: "thm list -> int -> tactic"} \\ |
|
279 @{index_ML forward_tac: "thm list -> int -> tactic"} \\[1ex] |
|
280 @{index_ML assume_tac: "int -> tactic"} \\ |
|
281 @{index_ML eq_assume_tac: "int -> tactic"} \\[1ex] |
|
282 @{index_ML match_tac: "thm list -> int -> tactic"} \\ |
|
283 @{index_ML ematch_tac: "thm list -> int -> tactic"} \\ |
|
284 @{index_ML dmatch_tac: "thm list -> int -> tactic"} \\ |
|
285 \end{mldecls} |
|
286 |
|
287 \begin{description} |
|
288 |
|
289 \item @{ML resolve_tac}~@{text "thms i"} refines the goal state |
|
290 using the given theorems, which should normally be introduction |
|
291 rules. The tactic resolves a rule's conclusion with subgoal @{text |
|
292 i}, replacing it by the corresponding versions of the rule's |
|
293 premises. |
|
294 |
|
295 \item @{ML eresolve_tac}~@{text "thms i"} performs elim-resolution |
|
296 with the given theorems, which should normally be elimination rules. |
|
297 |
|
298 \item @{ML dresolve_tac}~@{text "thms i"} performs |
|
299 destruct-resolution with the given theorems, which should normally |
|
300 be destruction rules. This replaces an assumption by the result of |
|
301 applying one of the rules. |
|
302 |
|
303 \item @{ML forward_tac} is like @{ML dresolve_tac} except that the |
|
304 selected assumption is not deleted. It applies a rule to an |
|
305 assumption, adding the result as a new assumption. |
|
306 |
|
307 \item @{ML assume_tac}~@{text i} attempts to solve subgoal @{text i} |
|
308 by assumption (modulo higher-order unification). |
|
309 |
|
310 \item @{ML eq_assume_tac} is similar to @{ML assume_tac}, but checks |
|
311 only for immediate @{text "\<alpha>"}-convertibility instead of using |
|
312 unification. It succeeds (with a unique next state) if one of the |
|
313 assumptions is equal to the subgoal's conclusion. Since it does not |
|
314 instantiate variables, it cannot make other subgoals unprovable. |
|
315 |
|
316 \item @{ML match_tac}, @{ML ematch_tac}, and @{ML dmatch_tac} are |
|
317 similar to @{ML resolve_tac}, @{ML eresolve_tac}, and @{ML |
|
318 dresolve_tac}, respectively, but do not instantiate schematic |
|
319 variables in the goal state. |
|
320 |
|
321 Flexible subgoals are not updated at will, but are left alone. |
|
322 Strictly speaking, matching means to treat the unknowns in the goal |
|
323 state as constants; these tactics merely discard unifiers that would |
|
324 update the goal state. |
|
325 |
|
326 \end{description} |
|
327 *} |
|
328 |
|
329 |
|
330 subsection {* Explicit instantiation within a subgoal context *} |
|
331 |
|
332 text {* The main resolution tactics (\secref{sec:resolve-assume-tac}) |
|
333 use higher-order unification, which works well in many practical |
|
334 situations despite its daunting theoretical properties. |
|
335 Nonetheless, there are important problem classes where unguided |
|
336 higher-order unification is not so useful. This typically involves |
|
337 rules like universal elimination, existential introduction, or |
|
338 equational substitution. Here the unification problem involves |
|
339 fully flexible @{text "?P ?x"} schemes, which are hard to manage |
|
340 without further hints. |
|
341 |
|
342 By providing a (small) rigid term for @{text "?x"} explicitly, the |
|
343 remaining unification problem is to assign a (large) term to @{text |
|
344 "?P"}, according to the shape of the given subgoal. This is |
|
345 sufficiently well-behaved in most practical situations. |
|
346 |
|
347 \medskip Isabelle provides separate versions of the standard @{text |
|
348 "r/e/d/f"} resolution tactics that allow to provide explicit |
|
349 instantiations of unknowns of the given rule, wrt.\ terms that refer |
|
350 to the implicit context of the selected subgoal. |
|
351 |
|
352 An instantiation consists of a list of pairs of the form @{text |
|
353 "(?x, t)"}, where @{text ?x} is a schematic variable occurring in |
|
354 the given rule, and @{text t} is a term from the current proof |
|
355 context, augmented by the local goal parameters of the selected |
|
356 subgoal; cf.\ the @{text "focus"} operation described in |
|
357 \secref{sec:variables}. |
|
358 |
|
359 Entering the syntactic context of a subgoal is a brittle operation, |
|
360 because its exact form is somewhat accidental, and the choice of |
|
361 bound variable names depends on the presence of other local and |
|
362 global names. Explicit renaming of subgoal parameters prior to |
|
363 explicit instantiation might help to achieve a bit more robustness. |
|
364 |
|
365 Type instantiations may be given as well, via pairs like @{text |
|
366 "(?'a, \<tau>)"}. Type instantiations are distinguished from term |
|
367 instantiations by the syntactic form of the schematic variable. |
|
368 Types are instantiated before terms are. Since term instantiation |
|
369 already performs type-inference as expected, explicit type |
|
370 instantiations are seldom necessary. |
|
371 *} |
|
372 |
|
373 text %mlref {* |
|
374 \begin{mldecls} |
|
375 @{index_ML res_inst_tac: "Proof.context -> (indexname * string) list -> thm -> int -> tactic"} \\ |
|
376 @{index_ML eres_inst_tac: "Proof.context -> (indexname * string) list -> thm -> int -> tactic"} \\ |
|
377 @{index_ML dres_inst_tac: "Proof.context -> (indexname * string) list -> thm -> int -> tactic"} \\ |
|
378 @{index_ML forw_inst_tac: "Proof.context -> (indexname * string) list -> thm -> int -> tactic"} \\[1ex] |
|
379 @{index_ML rename_tac: "string list -> int -> tactic"} \\ |
|
380 \end{mldecls} |
|
381 |
|
382 \begin{description} |
|
383 |
|
384 \item @{ML res_inst_tac}~@{text "ctxt insts thm i"} instantiates the |
|
385 rule @{text thm} with the instantiations @{text insts}, as described |
|
386 above, and then performs resolution on subgoal @{text i}. |
|
387 |
|
388 \item @{ML eres_inst_tac} is like @{ML res_inst_tac}, but performs |
|
389 elim-resolution. |
|
390 |
|
391 \item @{ML dres_inst_tac} is like @{ML res_inst_tac}, but performs |
|
392 destruct-resolution. |
|
393 |
|
394 \item @{ML forw_inst_tac} is like @{ML dres_inst_tac} except that |
|
395 the selected assumption is not deleted. |
|
396 |
|
397 \item @{ML rename_tac}~@{text "names i"} renames the innermost |
|
398 parameters of subgoal @{text i} according to the provided @{text |
|
399 names} (which need to be distinct indentifiers). |
|
400 |
|
401 \end{description} |
|
402 *} |
|
403 |
|
404 |
|
405 section {* Tacticals \label{sec:tacticals} *} |
|
406 |
|
407 text {* |
|
408 |
|
409 FIXME |
|
410 |
|
411 \glossary{Tactical}{A functional combinator for building up complex |
|
412 tactics from simpler ones. Typical tactical perform sequential |
|
413 composition, disjunction (choice), iteration, or goal addressing. |
|
414 Various search strategies may be expressed via tacticals.} |
|
415 |
|
416 *} |
|
417 |
|
418 end |