doc-src/IsarRef/Thy/document/HOL_Specific.tex
changeset 26849 df50bc1249d7
parent 26840 ec46381f149d
child 26852 a31203f58b20
     1.1 --- a/doc-src/IsarRef/Thy/document/HOL_Specific.tex	Thu May 08 12:27:19 2008 +0200
     1.2 +++ b/doc-src/IsarRef/Thy/document/HOL_Specific.tex	Thu May 08 12:29:18 2008 +0200
     1.3 @@ -11,18 +11,1153 @@
     1.4  \isatagtheory
     1.5  \isacommand{theory}\isamarkupfalse%
     1.6  \ HOL{\isacharunderscore}Specific\isanewline
     1.7 -\isakeyword{imports}\ HOL\isanewline
     1.8 -\isakeyword{begin}\isanewline
     1.9 -\isanewline
    1.10 +\isakeyword{imports}\ Main\isanewline
    1.11 +\isakeyword{begin}%
    1.12 +\endisatagtheory
    1.13 +{\isafoldtheory}%
    1.14 +%
    1.15 +\isadelimtheory
    1.16 +%
    1.17 +\endisadelimtheory
    1.18 +%
    1.19 +\isamarkupchapter{HOL specific elements \label{ch:logics}%
    1.20 +}
    1.21 +\isamarkuptrue%
    1.22 +%
    1.23 +\isamarkupsection{Primitive types \label{sec:hol-typedef}%
    1.24 +}
    1.25 +\isamarkuptrue%
    1.26 +%
    1.27 +\begin{isamarkuptext}%
    1.28 +\begin{matharray}{rcl}
    1.29 +    \indexdef{HOL}{command}{typedecl}\mbox{\isa{\isacommand{typedecl}}} & : & \isartrans{theory}{theory} \\
    1.30 +    \indexdef{HOL}{command}{typedef}\mbox{\isa{\isacommand{typedef}}} & : & \isartrans{theory}{proof(prove)} \\
    1.31 +  \end{matharray}
    1.32 +
    1.33 +  \begin{rail}
    1.34 +    'typedecl' typespec infix?
    1.35 +    ;
    1.36 +    'typedef' altname? abstype '=' repset
    1.37 +    ;
    1.38 +
    1.39 +    altname: '(' (name | 'open' | 'open' name) ')'
    1.40 +    ;
    1.41 +    abstype: typespec infix?
    1.42 +    ;
    1.43 +    repset: term ('morphisms' name name)?
    1.44 +    ;
    1.45 +  \end{rail}
    1.46 +
    1.47 +  \begin{descr}
    1.48 +  
    1.49 +  \item [\mbox{\isa{\isacommand{typedecl}}}~\isa{{\isachardoublequote}{\isacharparenleft}{\isasymalpha}\isactrlsub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ {\isasymalpha}\isactrlsub n{\isacharparenright}\ t{\isachardoublequote}}] is similar to the original \mbox{\isa{\isacommand{typedecl}}} of
    1.50 +  Isabelle/Pure (see \secref{sec:types-pure}), but also declares type
    1.51 +  arity \isa{{\isachardoublequote}t\ {\isacharcolon}{\isacharcolon}\ {\isacharparenleft}type{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ type{\isacharparenright}\ type{\isachardoublequote}}, making \isa{t} an
    1.52 +  actual HOL type constructor.   %FIXME check, update
    1.53 +  
    1.54 +  \item [\mbox{\isa{\isacommand{typedef}}}~\isa{{\isachardoublequote}{\isacharparenleft}{\isasymalpha}\isactrlsub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ {\isasymalpha}\isactrlsub n{\isacharparenright}\ t\ {\isacharequal}\ A{\isachardoublequote}}] sets up a goal stating non-emptiness of the set \isa{A}.
    1.55 +  After finishing the proof, the theory will be augmented by a
    1.56 +  Gordon/HOL-style type definition, which establishes a bijection
    1.57 +  between the representing set \isa{A} and the new type \isa{t}.
    1.58 +  
    1.59 +  Technically, \mbox{\isa{\isacommand{typedef}}} defines both a type \isa{t} and a set (term constant) of the same name (an alternative base
    1.60 +  name may be given in parentheses).  The injection from type to set
    1.61 +  is called \isa{Rep{\isacharunderscore}t}, its inverse \isa{Abs{\isacharunderscore}t} (this may be
    1.62 +  changed via an explicit \mbox{\isa{\isakeyword{morphisms}}} declaration).
    1.63 +  
    1.64 +  Theorems \isa{Rep{\isacharunderscore}t}, \isa{Rep{\isacharunderscore}t{\isacharunderscore}inverse}, and \isa{Abs{\isacharunderscore}t{\isacharunderscore}inverse} provide the most basic characterization as a
    1.65 +  corresponding injection/surjection pair (in both directions).  Rules
    1.66 +  \isa{Rep{\isacharunderscore}t{\isacharunderscore}inject} and \isa{Abs{\isacharunderscore}t{\isacharunderscore}inject} provide a slightly
    1.67 +  more convenient view on the injectivity part, suitable for automated
    1.68 +  proof tools (e.g.\ in \mbox{\isa{simp}} or \mbox{\isa{iff}} declarations).
    1.69 +  Rules \isa{Rep{\isacharunderscore}t{\isacharunderscore}cases}/\isa{Rep{\isacharunderscore}t{\isacharunderscore}induct}, and \isa{Abs{\isacharunderscore}t{\isacharunderscore}cases}/\isa{Abs{\isacharunderscore}t{\isacharunderscore}induct} provide alternative views on
    1.70 +  surjectivity; these are already declared as set or type rules for
    1.71 +  the generic \mbox{\isa{cases}} and \mbox{\isa{induct}} methods.
    1.72 +  
    1.73 +  An alternative name may be specified in parentheses; the default is
    1.74 +  to use \isa{t} as indicated before.  The ``\isa{{\isachardoublequote}{\isacharparenleft}open{\isacharparenright}{\isachardoublequote}}''
    1.75 +  declaration suppresses a separate constant definition for the
    1.76 +  representing set.
    1.77 +
    1.78 +  \end{descr}
    1.79 +
    1.80 +  Note that raw type declarations are rarely used in practice; the
    1.81 +  main application is with experimental (or even axiomatic!) theory
    1.82 +  fragments.  Instead of primitive HOL type definitions, user-level
    1.83 +  theories usually refer to higher-level packages such as \mbox{\isa{\isacommand{record}}} (see \secref{sec:hol-record}) or \mbox{\isa{\isacommand{datatype}}} (see \secref{sec:hol-datatype}).%
    1.84 +\end{isamarkuptext}%
    1.85 +\isamarkuptrue%
    1.86 +%
    1.87 +\isamarkupsection{Adhoc tuples%
    1.88 +}
    1.89 +\isamarkuptrue%
    1.90 +%
    1.91 +\begin{isamarkuptext}%
    1.92 +\begin{matharray}{rcl}
    1.93 +    \mbox{\isa{split{\isacharunderscore}format}}\isa{{\isachardoublequote}\isactrlsup {\isacharasterisk}{\isachardoublequote}} & : & \isaratt \\
    1.94 +  \end{matharray}
    1.95 +
    1.96 +  \begin{rail}
    1.97 +    'split\_format' (((name *) + 'and') | ('(' 'complete' ')'))
    1.98 +    ;
    1.99 +  \end{rail}
   1.100 +
   1.101 +  \begin{descr}
   1.102 +  
   1.103 +  \item [\mbox{\isa{split{\isacharunderscore}format}}~\isa{{\isachardoublequote}p\isactrlsub {\isadigit{1}}\ {\isasymdots}\ p\isactrlsub m\ {\isasymAND}\ {\isasymdots}\ {\isasymAND}\ q\isactrlsub {\isadigit{1}}\ {\isasymdots}\ q\isactrlsub n{\isachardoublequote}}] puts expressions of
   1.104 +  low-level tuple types into canonical form as specified by the
   1.105 +  arguments given; the \isa{i}-th collection of arguments refers to
   1.106 +  occurrences in premise \isa{i} of the rule.  The ``\isa{{\isachardoublequote}{\isacharparenleft}complete{\isacharparenright}{\isachardoublequote}}'' option causes \emph{all} arguments in function
   1.107 +  applications to be represented canonically according to their tuple
   1.108 +  type structure.
   1.109 +
   1.110 +  Note that these operations tend to invent funny names for new local
   1.111 +  parameters to be introduced.
   1.112 +
   1.113 +  \end{descr}%
   1.114 +\end{isamarkuptext}%
   1.115 +\isamarkuptrue%
   1.116 +%
   1.117 +\isamarkupsection{Records \label{sec:hol-record}%
   1.118 +}
   1.119 +\isamarkuptrue%
   1.120 +%
   1.121 +\begin{isamarkuptext}%
   1.122 +In principle, records merely generalize the concept of tuples, where
   1.123 +  components may be addressed by labels instead of just position.  The
   1.124 +  logical infrastructure of records in Isabelle/HOL is slightly more
   1.125 +  advanced, though, supporting truly extensible record schemes.  This
   1.126 +  admits operations that are polymorphic with respect to record
   1.127 +  extension, yielding ``object-oriented'' effects like (single)
   1.128 +  inheritance.  See also \cite{NaraschewskiW-TPHOLs98} for more
   1.129 +  details on object-oriented verification and record subtyping in HOL.%
   1.130 +\end{isamarkuptext}%
   1.131 +\isamarkuptrue%
   1.132 +%
   1.133 +\isamarkupsubsection{Basic concepts%
   1.134 +}
   1.135 +\isamarkuptrue%
   1.136 +%
   1.137 +\begin{isamarkuptext}%
   1.138 +Isabelle/HOL supports both \emph{fixed} and \emph{schematic} records
   1.139 +  at the level of terms and types.  The notation is as follows:
   1.140 +
   1.141 +  \begin{center}
   1.142 +  \begin{tabular}{l|l|l}
   1.143 +    & record terms & record types \\ \hline
   1.144 +    fixed & \isa{{\isachardoublequote}{\isasymlparr}x\ {\isacharequal}\ a{\isacharcomma}\ y\ {\isacharequal}\ b{\isasymrparr}{\isachardoublequote}} & \isa{{\isachardoublequote}{\isasymlparr}x\ {\isacharcolon}{\isacharcolon}\ A{\isacharcomma}\ y\ {\isacharcolon}{\isacharcolon}\ B{\isasymrparr}{\isachardoublequote}} \\
   1.145 +    schematic & \isa{{\isachardoublequote}{\isasymlparr}x\ {\isacharequal}\ a{\isacharcomma}\ y\ {\isacharequal}\ b{\isacharcomma}\ {\isasymdots}\ {\isacharequal}\ m{\isasymrparr}{\isachardoublequote}} &
   1.146 +      \isa{{\isachardoublequote}{\isasymlparr}x\ {\isacharcolon}{\isacharcolon}\ A{\isacharcomma}\ y\ {\isacharcolon}{\isacharcolon}\ B{\isacharcomma}\ {\isasymdots}\ {\isacharcolon}{\isacharcolon}\ M{\isasymrparr}{\isachardoublequote}} \\
   1.147 +  \end{tabular}
   1.148 +  \end{center}
   1.149 +
   1.150 +  \noindent The ASCII representation of \isa{{\isachardoublequote}{\isasymlparr}x\ {\isacharequal}\ a{\isasymrparr}{\isachardoublequote}} is \isa{{\isachardoublequote}{\isacharparenleft}{\isacharbar}\ x\ {\isacharequal}\ a\ {\isacharbar}{\isacharparenright}{\isachardoublequote}}.
   1.151 +
   1.152 +  A fixed record \isa{{\isachardoublequote}{\isasymlparr}x\ {\isacharequal}\ a{\isacharcomma}\ y\ {\isacharequal}\ b{\isasymrparr}{\isachardoublequote}} has field \isa{x} of value
   1.153 +  \isa{a} and field \isa{y} of value \isa{b}.  The corresponding
   1.154 +  type is \isa{{\isachardoublequote}{\isasymlparr}x\ {\isacharcolon}{\isacharcolon}\ A{\isacharcomma}\ y\ {\isacharcolon}{\isacharcolon}\ B{\isasymrparr}{\isachardoublequote}}, assuming that \isa{{\isachardoublequote}a\ {\isacharcolon}{\isacharcolon}\ A{\isachardoublequote}}
   1.155 +  and \isa{{\isachardoublequote}b\ {\isacharcolon}{\isacharcolon}\ B{\isachardoublequote}}.
   1.156 +
   1.157 +  A record scheme like \isa{{\isachardoublequote}{\isasymlparr}x\ {\isacharequal}\ a{\isacharcomma}\ y\ {\isacharequal}\ b{\isacharcomma}\ {\isasymdots}\ {\isacharequal}\ m{\isasymrparr}{\isachardoublequote}} contains fields
   1.158 +  \isa{x} and \isa{y} as before, but also possibly further fields
   1.159 +  as indicated by the ``\isa{{\isachardoublequote}{\isasymdots}{\isachardoublequote}}'' notation (which is actually part
   1.160 +  of the syntax).  The improper field ``\isa{{\isachardoublequote}{\isasymdots}{\isachardoublequote}}'' of a record
   1.161 +  scheme is called the \emph{more part}.  Logically it is just a free
   1.162 +  variable, which is occasionally referred to as ``row variable'' in
   1.163 +  the literature.  The more part of a record scheme may be
   1.164 +  instantiated by zero or more further components.  For example, the
   1.165 +  previous scheme may get instantiated to \isa{{\isachardoublequote}{\isasymlparr}x\ {\isacharequal}\ a{\isacharcomma}\ y\ {\isacharequal}\ b{\isacharcomma}\ z\ {\isacharequal}\ c{\isacharcomma}\ {\isasymdots}\ {\isacharequal}\ m{\isacharprime}{\isachardoublequote}}, where \isa{m{\isacharprime}} refers to a different more part.
   1.166 +  Fixed records are special instances of record schemes, where
   1.167 +  ``\isa{{\isachardoublequote}{\isasymdots}{\isachardoublequote}}'' is properly terminated by the \isa{{\isachardoublequote}{\isacharparenleft}{\isacharparenright}\ {\isacharcolon}{\isacharcolon}\ unit{\isachardoublequote}}
   1.168 +  element.  In fact, \isa{{\isachardoublequote}{\isasymlparr}x\ {\isacharequal}\ a{\isacharcomma}\ y\ {\isacharequal}\ b{\isasymrparr}{\isachardoublequote}} is just an abbreviation
   1.169 +  for \isa{{\isachardoublequote}{\isasymlparr}x\ {\isacharequal}\ a{\isacharcomma}\ y\ {\isacharequal}\ b{\isacharcomma}\ {\isasymdots}\ {\isacharequal}\ {\isacharparenleft}{\isacharparenright}{\isasymrparr}{\isachardoublequote}}.
   1.170 +  
   1.171 +  \medskip Two key observations make extensible records in a simply
   1.172 +  typed language like HOL work out:
   1.173 +
   1.174 +  \begin{enumerate}
   1.175 +
   1.176 +  \item the more part is internalized, as a free term or type
   1.177 +  variable,
   1.178 +
   1.179 +  \item field names are externalized, they cannot be accessed within the logic
   1.180 +  as first-class values.
   1.181 +
   1.182 +  \end{enumerate}
   1.183 +
   1.184 +  \medskip In Isabelle/HOL record types have to be defined explicitly,
   1.185 +  fixing their field names and types, and their (optional) parent
   1.186 +  record.  Afterwards, records may be formed using above syntax, while
   1.187 +  obeying the canonical order of fields as given by their declaration.
   1.188 +  The record package provides several standard operations like
   1.189 +  selectors and updates.  The common setup for various generic proof
   1.190 +  tools enable succinct reasoning patterns.  See also the Isabelle/HOL
   1.191 +  tutorial \cite{isabelle-hol-book} for further instructions on using
   1.192 +  records in practice.%
   1.193 +\end{isamarkuptext}%
   1.194 +\isamarkuptrue%
   1.195 +%
   1.196 +\isamarkupsubsection{Record specifications%
   1.197 +}
   1.198 +\isamarkuptrue%
   1.199 +%
   1.200 +\begin{isamarkuptext}%
   1.201 +\begin{matharray}{rcl}
   1.202 +    \indexdef{HOL}{command}{record}\mbox{\isa{\isacommand{record}}} & : & \isartrans{theory}{theory} \\
   1.203 +  \end{matharray}
   1.204 +
   1.205 +  \begin{rail}
   1.206 +    'record' typespec '=' (type '+')? (constdecl +)
   1.207 +    ;
   1.208 +  \end{rail}
   1.209 +
   1.210 +  \begin{descr}
   1.211 +
   1.212 +  \item [\mbox{\isa{\isacommand{record}}}~\isa{{\isachardoublequote}{\isacharparenleft}{\isasymalpha}\isactrlsub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ {\isasymalpha}\isactrlsub m{\isacharparenright}\ t\ {\isacharequal}\ {\isasymtau}\ {\isacharplus}\ c\isactrlsub {\isadigit{1}}\ {\isacharcolon}{\isacharcolon}\ {\isasymsigma}\isactrlsub {\isadigit{1}}\ {\isasymdots}\ c\isactrlsub n\ {\isacharcolon}{\isacharcolon}\ {\isasymsigma}\isactrlsub n{\isachardoublequote}}] defines
   1.213 +  extensible record type \isa{{\isachardoublequote}{\isacharparenleft}{\isasymalpha}\isactrlsub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ {\isasymalpha}\isactrlsub m{\isacharparenright}\ t{\isachardoublequote}},
   1.214 +  derived from the optional parent record \isa{{\isachardoublequote}{\isasymtau}{\isachardoublequote}} by adding new
   1.215 +  field components \isa{{\isachardoublequote}c\isactrlsub i\ {\isacharcolon}{\isacharcolon}\ {\isasymsigma}\isactrlsub i{\isachardoublequote}} etc.
   1.216 +
   1.217 +  The type variables of \isa{{\isachardoublequote}{\isasymtau}{\isachardoublequote}} and \isa{{\isachardoublequote}{\isasymsigma}\isactrlsub i{\isachardoublequote}} need to be
   1.218 +  covered by the (distinct) parameters \isa{{\isachardoublequote}{\isasymalpha}\isactrlsub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ {\isasymalpha}\isactrlsub m{\isachardoublequote}}.  Type constructor \isa{t} has to be new, while \isa{{\isasymtau}} needs to specify an instance of an existing record type.  At
   1.219 +  least one new field \isa{{\isachardoublequote}c\isactrlsub i{\isachardoublequote}} has to be specified.
   1.220 +  Basically, field names need to belong to a unique record.  This is
   1.221 +  not a real restriction in practice, since fields are qualified by
   1.222 +  the record name internally.
   1.223 +
   1.224 +  The parent record specification \isa{{\isasymtau}} is optional; if omitted
   1.225 +  \isa{t} becomes a root record.  The hierarchy of all records
   1.226 +  declared within a theory context forms a forest structure, i.e.\ a
   1.227 +  set of trees starting with a root record each.  There is no way to
   1.228 +  merge multiple parent records!
   1.229 +
   1.230 +  For convenience, \isa{{\isachardoublequote}{\isacharparenleft}{\isasymalpha}\isactrlsub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ {\isasymalpha}\isactrlsub m{\isacharparenright}\ t{\isachardoublequote}} is made a
   1.231 +  type abbreviation for the fixed record type \isa{{\isachardoublequote}{\isasymlparr}c\isactrlsub {\isadigit{1}}\ {\isacharcolon}{\isacharcolon}\ {\isasymsigma}\isactrlsub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ c\isactrlsub n\ {\isacharcolon}{\isacharcolon}\ {\isasymsigma}\isactrlsub n{\isasymrparr}{\isachardoublequote}}, likewise is \isa{{\isachardoublequote}{\isacharparenleft}{\isasymalpha}\isactrlsub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ {\isasymalpha}\isactrlsub m{\isacharcomma}\ {\isasymzeta}{\isacharparenright}\ t{\isacharunderscore}scheme{\isachardoublequote}} made an abbreviation for
   1.232 +  \isa{{\isachardoublequote}{\isasymlparr}c\isactrlsub {\isadigit{1}}\ {\isacharcolon}{\isacharcolon}\ {\isasymsigma}\isactrlsub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ c\isactrlsub n\ {\isacharcolon}{\isacharcolon}\ {\isasymsigma}\isactrlsub n{\isacharcomma}\ {\isasymdots}\ {\isacharcolon}{\isacharcolon}\ {\isasymzeta}{\isasymrparr}{\isachardoublequote}}.
   1.233 +
   1.234 +  \end{descr}%
   1.235 +\end{isamarkuptext}%
   1.236 +\isamarkuptrue%
   1.237 +%
   1.238 +\isamarkupsubsection{Record operations%
   1.239 +}
   1.240 +\isamarkuptrue%
   1.241 +%
   1.242 +\begin{isamarkuptext}%
   1.243 +Any record definition of the form presented above produces certain
   1.244 +  standard operations.  Selectors and updates are provided for any
   1.245 +  field, including the improper one ``\isa{more}''.  There are also
   1.246 +  cumulative record constructor functions.  To simplify the
   1.247 +  presentation below, we assume for now that \isa{{\isachardoublequote}{\isacharparenleft}{\isasymalpha}\isactrlsub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ {\isasymalpha}\isactrlsub m{\isacharparenright}\ t{\isachardoublequote}} is a root record with fields \isa{{\isachardoublequote}c\isactrlsub {\isadigit{1}}\ {\isacharcolon}{\isacharcolon}\ {\isasymsigma}\isactrlsub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ c\isactrlsub n\ {\isacharcolon}{\isacharcolon}\ {\isasymsigma}\isactrlsub n{\isachardoublequote}}.
   1.248 +
   1.249 +  \medskip \textbf{Selectors} and \textbf{updates} are available for
   1.250 +  any field (including ``\isa{more}''):
   1.251 +
   1.252 +  \begin{matharray}{lll}
   1.253 +    \isa{{\isachardoublequote}c\isactrlsub i{\isachardoublequote}} & \isa{{\isachardoublequote}{\isacharcolon}{\isacharcolon}{\isachardoublequote}} & \isa{{\isachardoublequote}{\isasymlparr}c\isactrlsub {\isadigit{1}}\ {\isacharcolon}{\isacharcolon}\ {\isasymsigma}\isactrlsub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ c\isactrlsub n\ {\isacharcolon}{\isacharcolon}\ {\isasymsigma}\isactrlsub n{\isacharcomma}\ {\isasymdots}\ {\isacharcolon}{\isacharcolon}\ {\isasymzeta}{\isasymrparr}\ {\isasymRightarrow}\ {\isasymsigma}\isactrlsub i{\isachardoublequote}} \\
   1.254 +    \isa{{\isachardoublequote}c\isactrlsub i{\isacharunderscore}update{\isachardoublequote}} & \isa{{\isachardoublequote}{\isacharcolon}{\isacharcolon}{\isachardoublequote}} & \isa{{\isachardoublequote}{\isasymsigma}\isactrlsub i\ {\isasymRightarrow}\ {\isasymlparr}c\isactrlsub {\isadigit{1}}\ {\isacharcolon}{\isacharcolon}\ {\isasymsigma}\isactrlsub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ c\isactrlsub n\ {\isacharcolon}{\isacharcolon}\ {\isasymsigma}\isactrlsub n{\isacharcomma}\ {\isasymdots}\ {\isacharcolon}{\isacharcolon}\ {\isasymzeta}{\isasymrparr}\ {\isasymRightarrow}\ {\isasymlparr}c\isactrlsub {\isadigit{1}}\ {\isacharcolon}{\isacharcolon}\ {\isasymsigma}\isactrlsub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ c\isactrlsub n\ {\isacharcolon}{\isacharcolon}\ {\isasymsigma}\isactrlsub n{\isacharcomma}\ {\isasymdots}\ {\isacharcolon}{\isacharcolon}\ {\isasymzeta}{\isasymrparr}{\isachardoublequote}} \\
   1.255 +  \end{matharray}
   1.256 +
   1.257 +  There is special syntax for application of updates: \isa{{\isachardoublequote}r{\isasymlparr}x\ {\isacharcolon}{\isacharequal}\ a{\isasymrparr}{\isachardoublequote}} abbreviates term \isa{{\isachardoublequote}x{\isacharunderscore}update\ a\ r{\isachardoublequote}}.  Further notation for
   1.258 +  repeated updates is also available: \isa{{\isachardoublequote}r{\isasymlparr}x\ {\isacharcolon}{\isacharequal}\ a{\isasymrparr}{\isasymlparr}y\ {\isacharcolon}{\isacharequal}\ b{\isasymrparr}{\isasymlparr}z\ {\isacharcolon}{\isacharequal}\ c{\isasymrparr}{\isachardoublequote}} may be written \isa{{\isachardoublequote}r{\isasymlparr}x\ {\isacharcolon}{\isacharequal}\ a{\isacharcomma}\ y\ {\isacharcolon}{\isacharequal}\ b{\isacharcomma}\ z\ {\isacharcolon}{\isacharequal}\ c{\isasymrparr}{\isachardoublequote}}.  Note that
   1.259 +  because of postfix notation the order of fields shown here is
   1.260 +  reverse than in the actual term.  Since repeated updates are just
   1.261 +  function applications, fields may be freely permuted in \isa{{\isachardoublequote}{\isasymlparr}x\ {\isacharcolon}{\isacharequal}\ a{\isacharcomma}\ y\ {\isacharcolon}{\isacharequal}\ b{\isacharcomma}\ z\ {\isacharcolon}{\isacharequal}\ c{\isasymrparr}{\isachardoublequote}}, as far as logical equality is concerned.
   1.262 +  Thus commutativity of independent updates can be proven within the
   1.263 +  logic for any two fields, but not as a general theorem.
   1.264 +
   1.265 +  \medskip The \textbf{make} operation provides a cumulative record
   1.266 +  constructor function:
   1.267 +
   1.268 +  \begin{matharray}{lll}
   1.269 +    \isa{{\isachardoublequote}t{\isachardot}make{\isachardoublequote}} & \isa{{\isachardoublequote}{\isacharcolon}{\isacharcolon}{\isachardoublequote}} & \isa{{\isachardoublequote}{\isasymsigma}\isactrlsub {\isadigit{1}}\ {\isasymRightarrow}\ {\isasymdots}\ {\isasymsigma}\isactrlsub n\ {\isasymRightarrow}\ {\isasymlparr}c\isactrlsub {\isadigit{1}}\ {\isacharcolon}{\isacharcolon}\ {\isasymsigma}\isactrlsub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ c\isactrlsub n\ {\isacharcolon}{\isacharcolon}\ {\isasymsigma}\isactrlsub n{\isasymrparr}{\isachardoublequote}} \\
   1.270 +  \end{matharray}
   1.271 +
   1.272 +  \medskip We now reconsider the case of non-root records, which are
   1.273 +  derived of some parent.  In general, the latter may depend on
   1.274 +  another parent as well, resulting in a list of \emph{ancestor
   1.275 +  records}.  Appending the lists of fields of all ancestors results in
   1.276 +  a certain field prefix.  The record package automatically takes care
   1.277 +  of this by lifting operations over this context of ancestor fields.
   1.278 +  Assuming that \isa{{\isachardoublequote}{\isacharparenleft}{\isasymalpha}\isactrlsub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ {\isasymalpha}\isactrlsub m{\isacharparenright}\ t{\isachardoublequote}} has ancestor
   1.279 +  fields \isa{{\isachardoublequote}b\isactrlsub {\isadigit{1}}\ {\isacharcolon}{\isacharcolon}\ {\isasymrho}\isactrlsub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ b\isactrlsub k\ {\isacharcolon}{\isacharcolon}\ {\isasymrho}\isactrlsub k{\isachardoublequote}},
   1.280 +  the above record operations will get the following types:
   1.281 +
   1.282 +  \begin{matharray}{lll}
   1.283 +    \isa{{\isachardoublequote}c\isactrlsub i{\isachardoublequote}} & \isa{{\isachardoublequote}{\isacharcolon}{\isacharcolon}{\isachardoublequote}} & \isa{{\isachardoublequote}{\isasymlparr}b\isactrlsub {\isadigit{1}}\ {\isacharcolon}{\isacharcolon}\ {\isasymrho}\isactrlsub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ b\isactrlsub k\ {\isacharcolon}{\isacharcolon}\ {\isasymrho}\isactrlsub k{\isacharcomma}\ c\isactrlsub {\isadigit{1}}\ {\isacharcolon}{\isacharcolon}\ {\isasymsigma}\isactrlsub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ c\isactrlsub n\ {\isacharcolon}{\isacharcolon}\ {\isasymsigma}\isactrlsub n{\isacharcomma}\ {\isasymdots}\ {\isacharcolon}{\isacharcolon}\ {\isasymzeta}{\isasymrparr}\ {\isasymRightarrow}\ {\isasymsigma}\isactrlsub i{\isachardoublequote}} \\
   1.284 +    \isa{{\isachardoublequote}c\isactrlsub i{\isacharunderscore}update{\isachardoublequote}} & \isa{{\isachardoublequote}{\isacharcolon}{\isacharcolon}{\isachardoublequote}} & \isa{{\isachardoublequote}{\isasymsigma}\isactrlsub i\ {\isasymRightarrow}\ {\isasymlparr}b\isactrlsub {\isadigit{1}}\ {\isacharcolon}{\isacharcolon}\ {\isasymrho}\isactrlsub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ b\isactrlsub k\ {\isacharcolon}{\isacharcolon}\ {\isasymrho}\isactrlsub k{\isacharcomma}\ c\isactrlsub {\isadigit{1}}\ {\isacharcolon}{\isacharcolon}\ {\isasymsigma}\isactrlsub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ c\isactrlsub n\ {\isacharcolon}{\isacharcolon}\ {\isasymsigma}\isactrlsub n{\isacharcomma}\ {\isasymdots}\ {\isacharcolon}{\isacharcolon}\ {\isasymzeta}{\isasymrparr}\ {\isasymRightarrow}\ {\isasymlparr}b\isactrlsub {\isadigit{1}}\ {\isacharcolon}{\isacharcolon}\ {\isasymrho}\isactrlsub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ b\isactrlsub k\ {\isacharcolon}{\isacharcolon}\ {\isasymrho}\isactrlsub k{\isacharcomma}\ c\isactrlsub {\isadigit{1}}\ {\isacharcolon}{\isacharcolon}\ {\isasymsigma}\isactrlsub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ c\isactrlsub n\ {\isacharcolon}{\isacharcolon}\ {\isasymsigma}\isactrlsub n{\isacharcomma}\ {\isasymdots}\ {\isacharcolon}{\isacharcolon}\ {\isasymzeta}{\isasymrparr}{\isachardoublequote}} \\
   1.285 +    \isa{{\isachardoublequote}t{\isachardot}make{\isachardoublequote}} & \isa{{\isachardoublequote}{\isacharcolon}{\isacharcolon}{\isachardoublequote}} & \isa{{\isachardoublequote}{\isasymrho}\isactrlsub {\isadigit{1}}\ {\isasymRightarrow}\ {\isasymdots}\ {\isasymrho}\isactrlsub k\ {\isasymRightarrow}\ {\isasymsigma}\isactrlsub {\isadigit{1}}\ {\isasymRightarrow}\ {\isasymdots}\ {\isasymsigma}\isactrlsub n\ {\isasymRightarrow}\ {\isasymlparr}b\isactrlsub {\isadigit{1}}\ {\isacharcolon}{\isacharcolon}\ {\isasymrho}\isactrlsub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ b\isactrlsub k\ {\isacharcolon}{\isacharcolon}\ {\isasymrho}\isactrlsub k{\isacharcomma}\ c\isactrlsub {\isadigit{1}}\ {\isacharcolon}{\isacharcolon}\ {\isasymsigma}\isactrlsub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ c\isactrlsub n\ {\isacharcolon}{\isacharcolon}\ {\isasymsigma}\isactrlsub n{\isachardoublequote}} \\
   1.286 +  \end{matharray}
   1.287 +  \noindent
   1.288 +
   1.289 +  \medskip Some further operations address the extension aspect of a
   1.290 +  derived record scheme specifically: \isa{{\isachardoublequote}t{\isachardot}fields{\isachardoublequote}} produces a
   1.291 +  record fragment consisting of exactly the new fields introduced here
   1.292 +  (the result may serve as a more part elsewhere); \isa{{\isachardoublequote}t{\isachardot}extend{\isachardoublequote}}
   1.293 +  takes a fixed record and adds a given more part; \isa{{\isachardoublequote}t{\isachardot}truncate{\isachardoublequote}} restricts a record scheme to a fixed record.
   1.294 +
   1.295 +  \begin{matharray}{lll}
   1.296 +    \isa{{\isachardoublequote}t{\isachardot}fields{\isachardoublequote}} & \isa{{\isachardoublequote}{\isacharcolon}{\isacharcolon}{\isachardoublequote}} & \isa{{\isachardoublequote}{\isasymsigma}\isactrlsub {\isadigit{1}}\ {\isasymRightarrow}\ {\isasymdots}\ {\isasymsigma}\isactrlsub n\ {\isasymRightarrow}\ {\isasymlparr}c\isactrlsub {\isadigit{1}}\ {\isacharcolon}{\isacharcolon}\ {\isasymsigma}\isactrlsub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ c\isactrlsub n\ {\isacharcolon}{\isacharcolon}\ {\isasymsigma}\isactrlsub n{\isachardoublequote}} \\
   1.297 +    \isa{{\isachardoublequote}t{\isachardot}extend{\isachardoublequote}} & \isa{{\isachardoublequote}{\isacharcolon}{\isacharcolon}{\isachardoublequote}} & \isa{{\isachardoublequote}{\isasymlparr}b\isactrlsub {\isadigit{1}}\ {\isacharcolon}{\isacharcolon}\ {\isasymrho}\isactrlsub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ b\isactrlsub k\ {\isacharcolon}{\isacharcolon}\ {\isasymrho}\isactrlsub k{\isacharcomma}\ c\isactrlsub {\isadigit{1}}\ {\isacharcolon}{\isacharcolon}\ {\isasymsigma}\isactrlsub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ c\isactrlsub n\ {\isacharcolon}{\isacharcolon}\ {\isasymsigma}\isactrlsub n{\isasymrparr}\ {\isasymRightarrow}\ {\isasymzeta}\ {\isasymRightarrow}\ {\isasymlparr}b\isactrlsub {\isadigit{1}}\ {\isacharcolon}{\isacharcolon}\ {\isasymrho}\isactrlsub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ b\isactrlsub k\ {\isacharcolon}{\isacharcolon}\ {\isasymrho}\isactrlsub k{\isacharcomma}\ c\isactrlsub {\isadigit{1}}\ {\isacharcolon}{\isacharcolon}\ {\isasymsigma}\isactrlsub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ c\isactrlsub n\ {\isacharcolon}{\isacharcolon}\ {\isasymsigma}\isactrlsub n{\isacharcomma}\ {\isasymdots}\ {\isacharcolon}{\isacharcolon}\ {\isasymzeta}{\isasymrparr}{\isachardoublequote}} \\
   1.298 +    \isa{{\isachardoublequote}t{\isachardot}truncate{\isachardoublequote}} & \isa{{\isachardoublequote}{\isacharcolon}{\isacharcolon}{\isachardoublequote}} & \isa{{\isachardoublequote}{\isasymlparr}b\isactrlsub {\isadigit{1}}\ {\isacharcolon}{\isacharcolon}\ {\isasymrho}\isactrlsub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ b\isactrlsub k\ {\isacharcolon}{\isacharcolon}\ {\isasymrho}\isactrlsub k{\isacharcomma}\ c\isactrlsub {\isadigit{1}}\ {\isacharcolon}{\isacharcolon}\ {\isasymsigma}\isactrlsub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ c\isactrlsub n\ {\isacharcolon}{\isacharcolon}\ {\isasymsigma}\isactrlsub n{\isacharcomma}\ {\isasymdots}\ {\isacharcolon}{\isacharcolon}\ {\isasymzeta}{\isasymrparr}\ {\isasymRightarrow}\ {\isasymlparr}b\isactrlsub {\isadigit{1}}\ {\isacharcolon}{\isacharcolon}\ {\isasymrho}\isactrlsub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ b\isactrlsub k\ {\isacharcolon}{\isacharcolon}\ {\isasymrho}\isactrlsub k{\isacharcomma}\ c\isactrlsub {\isadigit{1}}\ {\isacharcolon}{\isacharcolon}\ {\isasymsigma}\isactrlsub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ c\isactrlsub n\ {\isacharcolon}{\isacharcolon}\ {\isasymsigma}\isactrlsub n{\isasymrparr}{\isachardoublequote}} \\
   1.299 +  \end{matharray}
   1.300 +
   1.301 +  \noindent Note that \isa{{\isachardoublequote}t{\isachardot}make{\isachardoublequote}} and \isa{{\isachardoublequote}t{\isachardot}fields{\isachardoublequote}} coincide
   1.302 +  for root records.%
   1.303 +\end{isamarkuptext}%
   1.304 +\isamarkuptrue%
   1.305 +%
   1.306 +\isamarkupsubsection{Derived rules and proof tools%
   1.307 +}
   1.308 +\isamarkuptrue%
   1.309 +%
   1.310 +\begin{isamarkuptext}%
   1.311 +The record package proves several results internally, declaring
   1.312 +  these facts to appropriate proof tools.  This enables users to
   1.313 +  reason about record structures quite conveniently.  Assume that
   1.314 +  \isa{t} is a record type as specified above.
   1.315 +
   1.316 +  \begin{enumerate}
   1.317 +  
   1.318 +  \item Standard conversions for selectors or updates applied to
   1.319 +  record constructor terms are made part of the default Simplifier
   1.320 +  context; thus proofs by reduction of basic operations merely require
   1.321 +  the \mbox{\isa{simp}} method without further arguments.  These rules
   1.322 +  are available as \isa{{\isachardoublequote}t{\isachardot}simps{\isachardoublequote}}, too.
   1.323 +  
   1.324 +  \item Selectors applied to updated records are automatically reduced
   1.325 +  by an internal simplification procedure, which is also part of the
   1.326 +  standard Simplifier setup.
   1.327 +
   1.328 +  \item Inject equations of a form analogous to \isa{{\isachardoublequote}{\isacharparenleft}x{\isacharcomma}\ y{\isacharparenright}\ {\isacharequal}\ {\isacharparenleft}x{\isacharprime}{\isacharcomma}\ y{\isacharprime}{\isacharparenright}\ {\isasymequiv}\ x\ {\isacharequal}\ x{\isacharprime}\ {\isasymand}\ y\ {\isacharequal}\ y{\isacharprime}{\isachardoublequote}} are declared to the Simplifier and Classical
   1.329 +  Reasoner as \mbox{\isa{iff}} rules.  These rules are available as
   1.330 +  \isa{{\isachardoublequote}t{\isachardot}iffs{\isachardoublequote}}.
   1.331 +
   1.332 +  \item The introduction rule for record equality analogous to \isa{{\isachardoublequote}x\ r\ {\isacharequal}\ x\ r{\isacharprime}\ {\isasymLongrightarrow}\ y\ r\ {\isacharequal}\ y\ r{\isacharprime}\ {\isasymdots}\ {\isasymLongrightarrow}\ r\ {\isacharequal}\ r{\isacharprime}{\isachardoublequote}} is declared to the Simplifier,
   1.333 +  and as the basic rule context as ``\mbox{\isa{intro}}\isa{{\isachardoublequote}{\isacharquery}{\isachardoublequote}}''.
   1.334 +  The rule is called \isa{{\isachardoublequote}t{\isachardot}equality{\isachardoublequote}}.
   1.335 +
   1.336 +  \item Representations of arbitrary record expressions as canonical
   1.337 +  constructor terms are provided both in \mbox{\isa{cases}} and \mbox{\isa{induct}} format (cf.\ the generic proof methods of the same name,
   1.338 +  \secref{sec:cases-induct}).  Several variations are available, for
   1.339 +  fixed records, record schemes, more parts etc.
   1.340 +  
   1.341 +  The generic proof methods are sufficiently smart to pick the most
   1.342 +  sensible rule according to the type of the indicated record
   1.343 +  expression: users just need to apply something like ``\isa{{\isachardoublequote}{\isacharparenleft}cases\ r{\isacharparenright}{\isachardoublequote}}'' to a certain proof problem.
   1.344 +
   1.345 +  \item The derived record operations \isa{{\isachardoublequote}t{\isachardot}make{\isachardoublequote}}, \isa{{\isachardoublequote}t{\isachardot}fields{\isachardoublequote}}, \isa{{\isachardoublequote}t{\isachardot}extend{\isachardoublequote}}, \isa{{\isachardoublequote}t{\isachardot}truncate{\isachardoublequote}} are \emph{not}
   1.346 +  treated automatically, but usually need to be expanded by hand,
   1.347 +  using the collective fact \isa{{\isachardoublequote}t{\isachardot}defs{\isachardoublequote}}.
   1.348 +
   1.349 +  \end{enumerate}%
   1.350 +\end{isamarkuptext}%
   1.351 +\isamarkuptrue%
   1.352 +%
   1.353 +\isamarkupsection{Datatypes \label{sec:hol-datatype}%
   1.354 +}
   1.355 +\isamarkuptrue%
   1.356 +%
   1.357 +\begin{isamarkuptext}%
   1.358 +\begin{matharray}{rcl}
   1.359 +    \indexdef{HOL}{command}{datatype}\mbox{\isa{\isacommand{datatype}}} & : & \isartrans{theory}{theory} \\
   1.360 +    \indexdef{HOL}{command}{rep-datatype}\mbox{\isa{\isacommand{rep{\isacharunderscore}datatype}}} & : & \isartrans{theory}{theory} \\
   1.361 +  \end{matharray}
   1.362 +
   1.363 +  \begin{rail}
   1.364 +    'datatype' (dtspec + 'and')
   1.365 +    ;
   1.366 +    'rep\_datatype' (name *) dtrules
   1.367 +    ;
   1.368 +
   1.369 +    dtspec: parname? typespec infix? '=' (cons + '|')
   1.370 +    ;
   1.371 +    cons: name (type *) mixfix?
   1.372 +    ;
   1.373 +    dtrules: 'distinct' thmrefs 'inject' thmrefs 'induction' thmrefs
   1.374 +  \end{rail}
   1.375 +
   1.376 +  \begin{descr}
   1.377 +
   1.378 +  \item [\mbox{\isa{\isacommand{datatype}}}] defines inductive datatypes in
   1.379 +  HOL.
   1.380 +
   1.381 +  \item [\mbox{\isa{\isacommand{rep{\isacharunderscore}datatype}}}] represents existing types as
   1.382 +  inductive ones, generating the standard infrastructure of derived
   1.383 +  concepts (primitive recursion etc.).
   1.384 +
   1.385 +  \end{descr}
   1.386 +
   1.387 +  The induction and exhaustion theorems generated provide case names
   1.388 +  according to the constructors involved, while parameters are named
   1.389 +  after the types (see also \secref{sec:cases-induct}).
   1.390 +
   1.391 +  See \cite{isabelle-HOL} for more details on datatypes, but beware of
   1.392 +  the old-style theory syntax being used there!  Apart from proper
   1.393 +  proof methods for case-analysis and induction, there are also
   1.394 +  emulations of ML tactics \mbox{\isa{case{\isacharunderscore}tac}} and \mbox{\isa{induct{\isacharunderscore}tac}} available, see \secref{sec:hol-induct-tac}; these admit
   1.395 +  to refer directly to the internal structure of subgoals (including
   1.396 +  internally bound parameters).%
   1.397 +\end{isamarkuptext}%
   1.398 +\isamarkuptrue%
   1.399 +%
   1.400 +\isamarkupsection{Recursive functions \label{sec:recursion}%
   1.401 +}
   1.402 +\isamarkuptrue%
   1.403 +%
   1.404 +\begin{isamarkuptext}%
   1.405 +\begin{matharray}{rcl}
   1.406 +    \indexdef{HOL}{command}{primrec}\mbox{\isa{\isacommand{primrec}}} & : & \isarkeep{local{\dsh}theory} \\
   1.407 +    \indexdef{HOL}{command}{fun}\mbox{\isa{\isacommand{fun}}} & : & \isarkeep{local{\dsh}theory} \\
   1.408 +    \indexdef{HOL}{command}{function}\mbox{\isa{\isacommand{function}}} & : & \isartrans{local{\dsh}theory}{proof(prove)} \\
   1.409 +    \indexdef{HOL}{command}{termination}\mbox{\isa{\isacommand{termination}}} & : & \isartrans{local{\dsh}theory}{proof(prove)} \\
   1.410 +  \end{matharray}
   1.411 +
   1.412 +  \railalias{funopts}{function\_opts}  %FIXME ??
   1.413 +
   1.414 +  \begin{rail}
   1.415 +    'primrec' target? fixes 'where' equations
   1.416 +    ;
   1.417 +    equations: (thmdecl? prop + '|')
   1.418 +    ;
   1.419 +    ('fun' | 'function') (funopts)? fixes 'where' clauses
   1.420 +    ;
   1.421 +    clauses: (thmdecl? prop ('(' 'otherwise' ')')? + '|')
   1.422 +    ;
   1.423 +    funopts: '(' (('sequential' | 'in' name | 'domintros' | 'tailrec' |
   1.424 +    'default' term) + ',') ')'
   1.425 +    ;
   1.426 +    'termination' ( term )?
   1.427 +  \end{rail}
   1.428 +
   1.429 +  \begin{descr}
   1.430 +
   1.431 +  \item [\mbox{\isa{\isacommand{primrec}}}] defines primitive recursive
   1.432 +  functions over datatypes, see also \cite{isabelle-HOL}.
   1.433 +
   1.434 +  \item [\mbox{\isa{\isacommand{function}}}] defines functions by general
   1.435 +  wellfounded recursion. A detailed description with examples can be
   1.436 +  found in \cite{isabelle-function}. The function is specified by a
   1.437 +  set of (possibly conditional) recursive equations with arbitrary
   1.438 +  pattern matching. The command generates proof obligations for the
   1.439 +  completeness and the compatibility of patterns.
   1.440 +
   1.441 +  The defined function is considered partial, and the resulting
   1.442 +  simplification rules (named \isa{{\isachardoublequote}f{\isachardot}psimps{\isachardoublequote}}) and induction rule
   1.443 +  (named \isa{{\isachardoublequote}f{\isachardot}pinduct{\isachardoublequote}}) are guarded by a generated domain
   1.444 +  predicate \isa{{\isachardoublequote}f{\isacharunderscore}dom{\isachardoublequote}}. The \mbox{\isa{\isacommand{termination}}}
   1.445 +  command can then be used to establish that the function is total.
   1.446 +
   1.447 +  \item [\mbox{\isa{\isacommand{fun}}}] is a shorthand notation for
   1.448 +  ``\mbox{\isa{\isacommand{function}}}~\isa{{\isachardoublequote}{\isacharparenleft}sequential{\isacharparenright}{\isachardoublequote}}, followed by
   1.449 +  automated proof attempts regarding pattern matching and termination.
   1.450 +  See \cite{isabelle-function} for further details.
   1.451 +
   1.452 +  \item [\mbox{\isa{\isacommand{termination}}}~\isa{f}] commences a
   1.453 +  termination proof for the previously defined function \isa{f}.  If
   1.454 +  this is omitted, the command refers to the most recent function
   1.455 +  definition.  After the proof is closed, the recursive equations and
   1.456 +  the induction principle is established.
   1.457 +
   1.458 +  \end{descr}
   1.459 +
   1.460 +  %FIXME check
   1.461 +
   1.462 +  Recursive definitions introduced by both the \mbox{\isa{\isacommand{primrec}}} and the \mbox{\isa{\isacommand{function}}} command accommodate
   1.463 +  reasoning by induction (cf.\ \secref{sec:cases-induct}): rule \isa{{\isachardoublequote}c{\isachardot}induct{\isachardoublequote}} (where \isa{c} is the name of the function definition)
   1.464 +  refers to a specific induction rule, with parameters named according
   1.465 +  to the user-specified equations.  Case names of \mbox{\isa{\isacommand{primrec}}} are that of the datatypes involved, while those of
   1.466 +  \mbox{\isa{\isacommand{function}}} are numbered (starting from 1).
   1.467 +
   1.468 +  The equations provided by these packages may be referred later as
   1.469 +  theorem list \isa{{\isachardoublequote}f{\isachardot}simps{\isachardoublequote}}, where \isa{f} is the (collective)
   1.470 +  name of the functions defined.  Individual equations may be named
   1.471 +  explicitly as well.
   1.472 +
   1.473 +  The \mbox{\isa{\isacommand{function}}} command accepts the following
   1.474 +  options.
   1.475 +
   1.476 +  \begin{descr}
   1.477 +
   1.478 +  \item [\isa{sequential}] enables a preprocessor which
   1.479 +  disambiguates overlapping patterns by making them mutually disjoint.
   1.480 +  Earlier equations take precedence over later ones.  This allows to
   1.481 +  give the specification in a format very similar to functional
   1.482 +  programming.  Note that the resulting simplification and induction
   1.483 +  rules correspond to the transformed specification, not the one given
   1.484 +  originally. This usually means that each equation given by the user
   1.485 +  may result in several theroems.  Also note that this automatic
   1.486 +  transformation only works for ML-style datatype patterns.
   1.487 +
   1.488 +  \item [\isa{{\isachardoublequote}{\isasymIN}\ name{\isachardoublequote}}] gives the target for the definition.
   1.489 +  %FIXME ?!?
   1.490 +
   1.491 +  \item [\isa{domintros}] enables the automated generation of
   1.492 +  introduction rules for the domain predicate. While mostly not
   1.493 +  needed, they can be helpful in some proofs about partial functions.
   1.494 +
   1.495 +  \item [\isa{tailrec}] generates the unconstrained recursive
   1.496 +  equations even without a termination proof, provided that the
   1.497 +  function is tail-recursive. This currently only works
   1.498 +
   1.499 +  \item [\isa{{\isachardoublequote}default\ d{\isachardoublequote}}] allows to specify a default value for a
   1.500 +  (partial) function, which will ensure that \isa{{\isachardoublequote}f\ x\ {\isacharequal}\ d\ x{\isachardoublequote}}
   1.501 +  whenever \isa{{\isachardoublequote}x\ {\isasymnotin}\ f{\isacharunderscore}dom{\isachardoublequote}}.
   1.502 +
   1.503 +  \end{descr}%
   1.504 +\end{isamarkuptext}%
   1.505 +\isamarkuptrue%
   1.506 +%
   1.507 +\isamarkupsubsection{Proof methods related to recursive definitions%
   1.508 +}
   1.509 +\isamarkuptrue%
   1.510 +%
   1.511 +\begin{isamarkuptext}%
   1.512 +\begin{matharray}{rcl}
   1.513 +    \indexdef{HOL}{method}{pat-completeness}\mbox{\isa{pat{\isacharunderscore}completeness}} & : & \isarmeth \\
   1.514 +    \indexdef{HOL}{method}{relation}\mbox{\isa{relation}} & : & \isarmeth \\
   1.515 +    \indexdef{HOL}{method}{lexicographic-order}\mbox{\isa{lexicographic{\isacharunderscore}order}} & : & \isarmeth \\
   1.516 +  \end{matharray}
   1.517 +
   1.518 +  \begin{rail}
   1.519 +    'relation' term
   1.520 +    ;
   1.521 +    'lexicographic\_order' (clasimpmod *)
   1.522 +    ;
   1.523 +  \end{rail}
   1.524 +
   1.525 +  \begin{descr}
   1.526 +
   1.527 +  \item [\mbox{\isa{pat{\isacharunderscore}completeness}}] is a specialized method to
   1.528 +  solve goals regarding the completeness of pattern matching, as
   1.529 +  required by the \mbox{\isa{\isacommand{function}}} package (cf.\
   1.530 +  \cite{isabelle-function}).
   1.531 +
   1.532 +  \item [\mbox{\isa{relation}}~\isa{R}] introduces a termination
   1.533 +  proof using the relation \isa{R}.  The resulting proof state will
   1.534 +  contain goals expressing that \isa{R} is wellfounded, and that the
   1.535 +  arguments of recursive calls decrease with respect to \isa{R}.
   1.536 +  Usually, this method is used as the initial proof step of manual
   1.537 +  termination proofs.
   1.538 +
   1.539 +  \item [\mbox{\isa{lexicographic{\isacharunderscore}order}}] attempts a fully
   1.540 +  automated termination proof by searching for a lexicographic
   1.541 +  combination of size measures on the arguments of the function. The
   1.542 +  method accepts the same arguments as the \mbox{\isa{auto}} method,
   1.543 +  which it uses internally to prove local descents.  The same context
   1.544 +  modifiers as for \mbox{\isa{auto}} are accepted, see
   1.545 +  \secref{sec:clasimp}.
   1.546 +
   1.547 +  In case of failure, extensive information is printed, which can help
   1.548 +  to analyse the situation (cf.\ \cite{isabelle-function}).
   1.549 +
   1.550 +  \end{descr}%
   1.551 +\end{isamarkuptext}%
   1.552 +\isamarkuptrue%
   1.553 +%
   1.554 +\isamarkupsubsection{Old-style recursive function definitions (TFL)%
   1.555 +}
   1.556 +\isamarkuptrue%
   1.557 +%
   1.558 +\begin{isamarkuptext}%
   1.559 +The old TFL commands \mbox{\isa{\isacommand{recdef}}} and \mbox{\isa{\isacommand{recdef{\isacharunderscore}tc}}} for defining recursive are mostly obsolete; \mbox{\isa{\isacommand{function}}} or \mbox{\isa{\isacommand{fun}}} should be used instead.
   1.560 +
   1.561 +  \begin{matharray}{rcl}
   1.562 +    \indexdef{HOL}{command}{recdef}\mbox{\isa{\isacommand{recdef}}} & : & \isartrans{theory}{theory} \\
   1.563 +    \indexdef{HOL}{command}{recdef-tc}\mbox{\isa{\isacommand{recdef{\isacharunderscore}tc}}}\isa{{\isachardoublequote}\isactrlsup {\isacharasterisk}{\isachardoublequote}} & : & \isartrans{theory}{proof(prove)} \\
   1.564 +  \end{matharray}
   1.565 +
   1.566 +  \begin{rail}
   1.567 +    'recdef' ('(' 'permissive' ')')? \\ name term (prop +) hints?
   1.568 +    ;
   1.569 +    recdeftc thmdecl? tc
   1.570 +    ;
   1.571 +    hints: '(' 'hints' (recdefmod *) ')'
   1.572 +    ;
   1.573 +    recdefmod: (('recdef\_simp' | 'recdef\_cong' | 'recdef\_wf') (() | 'add' | 'del') ':' thmrefs) | clasimpmod
   1.574 +    ;
   1.575 +    tc: nameref ('(' nat ')')?
   1.576 +    ;
   1.577 +  \end{rail}
   1.578 +
   1.579 +  \begin{descr}
   1.580 +  
   1.581 +  \item [\mbox{\isa{\isacommand{recdef}}}] defines general well-founded
   1.582 +  recursive functions (using the TFL package), see also
   1.583 +  \cite{isabelle-HOL}.  The ``\isa{{\isachardoublequote}{\isacharparenleft}permissive{\isacharparenright}{\isachardoublequote}}'' option tells
   1.584 +  TFL to recover from failed proof attempts, returning unfinished
   1.585 +  results.  The \isa{recdef{\isacharunderscore}simp}, \isa{recdef{\isacharunderscore}cong}, and \isa{recdef{\isacharunderscore}wf} hints refer to auxiliary rules to be used in the internal
   1.586 +  automated proof process of TFL.  Additional \mbox{\isa{clasimpmod}}
   1.587 +  declarations (cf.\ \secref{sec:clasimp}) may be given to tune the
   1.588 +  context of the Simplifier (cf.\ \secref{sec:simplifier}) and
   1.589 +  Classical reasoner (cf.\ \secref{sec:classical}).
   1.590 +  
   1.591 +  \item [\mbox{\isa{\isacommand{recdef{\isacharunderscore}tc}}}~\isa{{\isachardoublequote}c\ {\isacharparenleft}i{\isacharparenright}{\isachardoublequote}}] recommences the
   1.592 +  proof for leftover termination condition number \isa{i} (default
   1.593 +  1) as generated by a \mbox{\isa{\isacommand{recdef}}} definition of
   1.594 +  constant \isa{c}.
   1.595 +  
   1.596 +  Note that in most cases, \mbox{\isa{\isacommand{recdef}}} is able to finish
   1.597 +  its internal proofs without manual intervention.
   1.598 +
   1.599 +  \end{descr}
   1.600 +
   1.601 +  \medskip Hints for \mbox{\isa{\isacommand{recdef}}} may be also declared
   1.602 +  globally, using the following attributes.
   1.603 +
   1.604 +  \begin{matharray}{rcl}
   1.605 +    \indexdef{HOL}{attribute}{recdef-simp}\mbox{\isa{recdef{\isacharunderscore}simp}} & : & \isaratt \\
   1.606 +    \indexdef{HOL}{attribute}{recdef-cong}\mbox{\isa{recdef{\isacharunderscore}cong}} & : & \isaratt \\
   1.607 +    \indexdef{HOL}{attribute}{recdef-wf}\mbox{\isa{recdef{\isacharunderscore}wf}} & : & \isaratt \\
   1.608 +  \end{matharray}
   1.609 +
   1.610 +  \begin{rail}
   1.611 +    ('recdef\_simp' | 'recdef\_cong' | 'recdef\_wf') (() | 'add' | 'del')
   1.612 +    ;
   1.613 +  \end{rail}%
   1.614 +\end{isamarkuptext}%
   1.615 +\isamarkuptrue%
   1.616 +%
   1.617 +\isamarkupsection{Definition by specification \label{sec:hol-specification}%
   1.618 +}
   1.619 +\isamarkuptrue%
   1.620 +%
   1.621 +\begin{isamarkuptext}%
   1.622 +\begin{matharray}{rcl}
   1.623 +    \indexdef{HOL}{command}{specification}\mbox{\isa{\isacommand{specification}}} & : & \isartrans{theory}{proof(prove)} \\
   1.624 +    \indexdef{HOL}{command}{ax-specification}\mbox{\isa{\isacommand{ax{\isacharunderscore}specification}}} & : & \isartrans{theory}{proof(prove)} \\
   1.625 +  \end{matharray}
   1.626 +
   1.627 +  \begin{rail}
   1.628 +  ('specification' | 'ax\_specification') '(' (decl +) ')' \\ (thmdecl? prop +)
   1.629 +  ;
   1.630 +  decl: ((name ':')? term '(' 'overloaded' ')'?)
   1.631 +  \end{rail}
   1.632 +
   1.633 +  \begin{descr}
   1.634 +
   1.635 +  \item [\mbox{\isa{\isacommand{specification}}}~\isa{{\isachardoublequote}decls\ {\isasymphi}{\isachardoublequote}}] sets up a
   1.636 +  goal stating the existence of terms with the properties specified to
   1.637 +  hold for the constants given in \isa{decls}.  After finishing the
   1.638 +  proof, the theory will be augmented with definitions for the given
   1.639 +  constants, as well as with theorems stating the properties for these
   1.640 +  constants.
   1.641 +
   1.642 +  \item [\mbox{\isa{\isacommand{ax{\isacharunderscore}specification}}}~\isa{{\isachardoublequote}decls\ {\isasymphi}{\isachardoublequote}}] sets
   1.643 +  up a goal stating the existence of terms with the properties
   1.644 +  specified to hold for the constants given in \isa{decls}.  After
   1.645 +  finishing the proof, the theory will be augmented with axioms
   1.646 +  expressing the properties given in the first place.
   1.647 +
   1.648 +  \item [\isa{decl}] declares a constant to be defined by the
   1.649 +  specification given.  The definition for the constant \isa{c} is
   1.650 +  bound to the name \isa{c{\isacharunderscore}def} unless a theorem name is given in
   1.651 +  the declaration.  Overloaded constants should be declared as such.
   1.652 +
   1.653 +  \end{descr}
   1.654 +
   1.655 +  Whether to use \mbox{\isa{\isacommand{specification}}} or \mbox{\isa{\isacommand{ax{\isacharunderscore}specification}}} is to some extent a matter of style.  \mbox{\isa{\isacommand{specification}}} introduces no new axioms, and so by
   1.656 +  construction cannot introduce inconsistencies, whereas \mbox{\isa{\isacommand{ax{\isacharunderscore}specification}}} does introduce axioms, but only after the
   1.657 +  user has explicitly proven it to be safe.  A practical issue must be
   1.658 +  considered, though: After introducing two constants with the same
   1.659 +  properties using \mbox{\isa{\isacommand{specification}}}, one can prove
   1.660 +  that the two constants are, in fact, equal.  If this might be a
   1.661 +  problem, one should use \mbox{\isa{\isacommand{ax{\isacharunderscore}specification}}}.%
   1.662 +\end{isamarkuptext}%
   1.663 +\isamarkuptrue%
   1.664 +%
   1.665 +\isamarkupsection{Inductive and coinductive definitions \label{sec:hol-inductive}%
   1.666 +}
   1.667 +\isamarkuptrue%
   1.668 +%
   1.669 +\begin{isamarkuptext}%
   1.670 +An \textbf{inductive definition} specifies the least predicate (or
   1.671 +  set) \isa{R} closed under given rules: applying a rule to elements
   1.672 +  of \isa{R} yields a result within \isa{R}.  For example, a
   1.673 +  structural operational semantics is an inductive definition of an
   1.674 +  evaluation relation.
   1.675 +
   1.676 +  Dually, a \textbf{coinductive definition} specifies the greatest
   1.677 +  predicate~/ set \isa{R} that is consistent with given rules: every
   1.678 +  element of \isa{R} can be seen as arising by applying a rule to
   1.679 +  elements of \isa{R}.  An important example is using bisimulation
   1.680 +  relations to formalise equivalence of processes and infinite data
   1.681 +  structures.
   1.682 +
   1.683 +  \medskip The HOL package is related to the ZF one, which is
   1.684 +  described in a separate paper,\footnote{It appeared in CADE
   1.685 +  \cite{paulson-CADE}; a longer version is distributed with Isabelle.}
   1.686 +  which you should refer to in case of difficulties.  The package is
   1.687 +  simpler than that of ZF thanks to implicit type-checking in HOL.
   1.688 +  The types of the (co)inductive predicates (or sets) determine the
   1.689 +  domain of the fixedpoint definition, and the package does not have
   1.690 +  to use inference rules for type-checking.
   1.691 +
   1.692 +  \begin{matharray}{rcl}
   1.693 +    \indexdef{HOL}{command}{inductive}\mbox{\isa{\isacommand{inductive}}} & : & \isarkeep{local{\dsh}theory} \\
   1.694 +    \indexdef{HOL}{command}{inductive-set}\mbox{\isa{\isacommand{inductive{\isacharunderscore}set}}} & : & \isarkeep{local{\dsh}theory} \\
   1.695 +    \indexdef{HOL}{command}{coinductive}\mbox{\isa{\isacommand{coinductive}}} & : & \isarkeep{local{\dsh}theory} \\
   1.696 +    \indexdef{HOL}{command}{coinductive-set}\mbox{\isa{\isacommand{coinductive{\isacharunderscore}set}}} & : & \isarkeep{local{\dsh}theory} \\
   1.697 +    \indexdef{HOL}{attribute}{mono}\mbox{\isa{mono}} & : & \isaratt \\
   1.698 +  \end{matharray}
   1.699 +
   1.700 +  \begin{rail}
   1.701 +    ('inductive' | 'inductive\_set' | 'coinductive' | 'coinductive\_set') target? fixes ('for' fixes)? \\
   1.702 +    ('where' clauses)? ('monos' thmrefs)?
   1.703 +    ;
   1.704 +    clauses: (thmdecl? prop + '|')
   1.705 +    ;
   1.706 +    'mono' (() | 'add' | 'del')
   1.707 +    ;
   1.708 +  \end{rail}
   1.709 +
   1.710 +  \begin{descr}
   1.711 +
   1.712 +  \item [\mbox{\isa{\isacommand{inductive}}} and \mbox{\isa{\isacommand{coinductive}}}] define (co)inductive predicates from the
   1.713 +  introduction rules given in the \mbox{\isa{\isakeyword{where}}} part.  The
   1.714 +  optional \mbox{\isa{\isakeyword{for}}} part contains a list of parameters of the
   1.715 +  (co)inductive predicates that remain fixed throughout the
   1.716 +  definition.  The optional \mbox{\isa{\isakeyword{monos}}} section contains
   1.717 +  \emph{monotonicity theorems}, which are required for each operator
   1.718 +  applied to a recursive set in the introduction rules.  There
   1.719 +  \emph{must} be a theorem of the form \isa{{\isachardoublequote}A\ {\isasymle}\ B\ {\isasymLongrightarrow}\ M\ A\ {\isasymle}\ M\ B{\isachardoublequote}},
   1.720 +  for each premise \isa{{\isachardoublequote}M\ R\isactrlsub i\ t{\isachardoublequote}} in an introduction rule!
   1.721 +
   1.722 +  \item [\mbox{\isa{\isacommand{inductive{\isacharunderscore}set}}} and \mbox{\isa{\isacommand{coinductive{\isacharunderscore}set}}}] are wrappers for to the previous commands,
   1.723 +  allowing the definition of (co)inductive sets.
   1.724 +
   1.725 +  \item [\mbox{\isa{mono}}] declares monotonicity rules.  These
   1.726 +  rule are involved in the automated monotonicity proof of \mbox{\isa{\isacommand{inductive}}}.
   1.727 +
   1.728 +  \end{descr}%
   1.729 +\end{isamarkuptext}%
   1.730 +\isamarkuptrue%
   1.731 +%
   1.732 +\isamarkupsubsection{Derived rules%
   1.733 +}
   1.734 +\isamarkuptrue%
   1.735 +%
   1.736 +\begin{isamarkuptext}%
   1.737 +Each (co)inductive definition \isa{R} adds definitions to the
   1.738 +  theory and also proves some theorems:
   1.739 +
   1.740 +  \begin{description}
   1.741 +
   1.742 +  \item [\isa{R{\isachardot}intros}] is the list of introduction rules as proven
   1.743 +  theorems, for the recursive predicates (or sets).  The rules are
   1.744 +  also available individually, using the names given them in the
   1.745 +  theory file;
   1.746 +
   1.747 +  \item [\isa{R{\isachardot}cases}] is the case analysis (or elimination) rule;
   1.748 +
   1.749 +  \item [\isa{R{\isachardot}induct} or \isa{R{\isachardot}coinduct}] is the (co)induction
   1.750 +  rule.
   1.751 +
   1.752 +  \end{description}
   1.753 +
   1.754 +  When several predicates \isa{{\isachardoublequote}R\isactrlsub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ R\isactrlsub n{\isachardoublequote}} are
   1.755 +  defined simultaneously, the list of introduction rules is called
   1.756 +  \isa{{\isachardoublequote}R\isactrlsub {\isadigit{1}}{\isacharunderscore}{\isasymdots}{\isacharunderscore}R\isactrlsub n{\isachardot}intros{\isachardoublequote}}, the case analysis rules are
   1.757 +  called \isa{{\isachardoublequote}R\isactrlsub {\isadigit{1}}{\isachardot}cases{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ R\isactrlsub n{\isachardot}cases{\isachardoublequote}}, and the list
   1.758 +  of mutual induction rules is called \isa{{\isachardoublequote}R\isactrlsub {\isadigit{1}}{\isacharunderscore}{\isasymdots}{\isacharunderscore}R\isactrlsub n{\isachardot}inducts{\isachardoublequote}}.%
   1.759 +\end{isamarkuptext}%
   1.760 +\isamarkuptrue%
   1.761 +%
   1.762 +\isamarkupsubsection{Monotonicity theorems%
   1.763 +}
   1.764 +\isamarkuptrue%
   1.765 +%
   1.766 +\begin{isamarkuptext}%
   1.767 +Each theory contains a default set of theorems that are used in
   1.768 +  monotonicity proofs.  New rules can be added to this set via the
   1.769 +  \mbox{\isa{mono}} attribute.  The HOL theory \isa{Inductive}
   1.770 +  shows how this is done.  In general, the following monotonicity
   1.771 +  theorems may be added:
   1.772 +
   1.773 +  \begin{itemize}
   1.774 +
   1.775 +  \item Theorems of the form \isa{{\isachardoublequote}A\ {\isasymle}\ B\ {\isasymLongrightarrow}\ M\ A\ {\isasymle}\ M\ B{\isachardoublequote}}, for proving
   1.776 +  monotonicity of inductive definitions whose introduction rules have
   1.777 +  premises involving terms such as \isa{{\isachardoublequote}M\ R\isactrlsub i\ t{\isachardoublequote}}.
   1.778 +
   1.779 +  \item Monotonicity theorems for logical operators, which are of the
   1.780 +  general form \isa{{\isachardoublequote}{\isacharparenleft}{\isasymdots}\ {\isasymlongrightarrow}\ {\isasymdots}{\isacharparenright}\ {\isasymLongrightarrow}\ {\isasymdots}\ {\isacharparenleft}{\isasymdots}\ {\isasymlongrightarrow}\ {\isasymdots}{\isacharparenright}\ {\isasymLongrightarrow}\ {\isasymdots}\ {\isasymlongrightarrow}\ {\isasymdots}{\isachardoublequote}}.  For example, in
   1.781 +  the case of the operator \isa{{\isachardoublequote}{\isasymor}{\isachardoublequote}}, the corresponding theorem is
   1.782 +  \[
   1.783 +  \infer{\isa{{\isachardoublequote}P\isactrlsub {\isadigit{1}}\ {\isasymor}\ P\isactrlsub {\isadigit{2}}\ {\isasymlongrightarrow}\ Q\isactrlsub {\isadigit{1}}\ {\isasymor}\ Q\isactrlsub {\isadigit{2}}{\isachardoublequote}}}{\isa{{\isachardoublequote}P\isactrlsub {\isadigit{1}}\ {\isasymlongrightarrow}\ Q\isactrlsub {\isadigit{1}}{\isachardoublequote}} & \isa{{\isachardoublequote}P\isactrlsub {\isadigit{2}}\ {\isasymlongrightarrow}\ Q\isactrlsub {\isadigit{2}}{\isachardoublequote}}}
   1.784 +  \]
   1.785 +
   1.786 +  \item De Morgan style equations for reasoning about the ``polarity''
   1.787 +  of expressions, e.g.
   1.788 +  \[
   1.789 +  \isa{{\isachardoublequote}{\isasymnot}\ {\isasymnot}\ P\ {\isasymlongleftrightarrow}\ P{\isachardoublequote}} \qquad\qquad
   1.790 +  \isa{{\isachardoublequote}{\isasymnot}\ {\isacharparenleft}P\ {\isasymand}\ Q{\isacharparenright}\ {\isasymlongleftrightarrow}\ {\isasymnot}\ P\ {\isasymor}\ {\isasymnot}\ Q{\isachardoublequote}}
   1.791 +  \]
   1.792 +
   1.793 +  \item Equations for reducing complex operators to more primitive
   1.794 +  ones whose monotonicity can easily be proved, e.g.
   1.795 +  \[
   1.796 +  \isa{{\isachardoublequote}{\isacharparenleft}P\ {\isasymlongrightarrow}\ Q{\isacharparenright}\ {\isasymlongleftrightarrow}\ {\isasymnot}\ P\ {\isasymor}\ Q{\isachardoublequote}} \qquad\qquad
   1.797 +  \isa{{\isachardoublequote}Ball\ A\ P\ {\isasymequiv}\ {\isasymforall}x{\isachardot}\ x\ {\isasymin}\ A\ {\isasymlongrightarrow}\ P\ x{\isachardoublequote}}
   1.798 +  \]
   1.799 +
   1.800 +  \end{itemize}
   1.801 +
   1.802 +  %FIXME: Example of an inductive definition%
   1.803 +\end{isamarkuptext}%
   1.804 +\isamarkuptrue%
   1.805 +%
   1.806 +\isamarkupsection{Arithmetic proof support%
   1.807 +}
   1.808 +\isamarkuptrue%
   1.809 +%
   1.810 +\begin{isamarkuptext}%
   1.811 +\begin{matharray}{rcl}
   1.812 +    \indexdef{HOL}{method}{arith}\mbox{\isa{arith}} & : & \isarmeth \\
   1.813 +    \indexdef{HOL}{method}{arith-split}\mbox{\isa{arith{\isacharunderscore}split}} & : & \isaratt \\
   1.814 +  \end{matharray}
   1.815 +
   1.816 +  The \mbox{\isa{arith}} method decides linear arithmetic problems
   1.817 +  (on types \isa{nat}, \isa{int}, \isa{real}).  Any current
   1.818 +  facts are inserted into the goal before running the procedure.
   1.819 +
   1.820 +  The \mbox{\isa{arith{\isacharunderscore}split}} attribute declares case split rules
   1.821 +  to be expanded before the arithmetic procedure is invoked.
   1.822 +
   1.823 +  Note that a simpler (but faster) version of arithmetic reasoning is
   1.824 +  already performed by the Simplifier.%
   1.825 +\end{isamarkuptext}%
   1.826 +\isamarkuptrue%
   1.827 +%
   1.828 +\isamarkupsection{Cases and induction: emulating tactic scripts \label{sec:hol-induct-tac}%
   1.829 +}
   1.830 +\isamarkuptrue%
   1.831 +%
   1.832 +\begin{isamarkuptext}%
   1.833 +The following important tactical tools of Isabelle/HOL have been
   1.834 +  ported to Isar.  These should be never used in proper proof texts!
   1.835 +
   1.836 +  \begin{matharray}{rcl}
   1.837 +    \indexdef{HOL}{method}{case-tac}\mbox{\isa{case{\isacharunderscore}tac}}\isa{{\isachardoublequote}\isactrlsup {\isacharasterisk}{\isachardoublequote}} & : & \isarmeth \\
   1.838 +    \indexdef{HOL}{method}{induct-tac}\mbox{\isa{induct{\isacharunderscore}tac}}\isa{{\isachardoublequote}\isactrlsup {\isacharasterisk}{\isachardoublequote}} & : & \isarmeth \\
   1.839 +    \indexdef{HOL}{method}{ind-cases}\mbox{\isa{ind{\isacharunderscore}cases}}\isa{{\isachardoublequote}\isactrlsup {\isacharasterisk}{\isachardoublequote}} & : & \isarmeth \\
   1.840 +    \indexdef{HOL}{command}{inductive-cases}\mbox{\isa{\isacommand{inductive{\isacharunderscore}cases}}} & : & \isartrans{theory}{theory} \\
   1.841 +  \end{matharray}
   1.842 +
   1.843 +  \begin{rail}
   1.844 +    'case\_tac' goalspec? term rule?
   1.845 +    ;
   1.846 +    'induct\_tac' goalspec? (insts * 'and') rule?
   1.847 +    ;
   1.848 +    'ind\_cases' (prop +) ('for' (name +)) ?
   1.849 +    ;
   1.850 +    'inductive\_cases' (thmdecl? (prop +) + 'and')
   1.851 +    ;
   1.852 +
   1.853 +    rule: ('rule' ':' thmref)
   1.854 +    ;
   1.855 +  \end{rail}
   1.856 +
   1.857 +  \begin{descr}
   1.858 +
   1.859 +  \item [\mbox{\isa{case{\isacharunderscore}tac}} and \mbox{\isa{induct{\isacharunderscore}tac}}]
   1.860 +  admit to reason about inductive datatypes only (unless an
   1.861 +  alternative rule is given explicitly).  Furthermore, \mbox{\isa{case{\isacharunderscore}tac}} does a classical case split on booleans; \mbox{\isa{induct{\isacharunderscore}tac}} allows only variables to be given as instantiation.
   1.862 +  These tactic emulations feature both goal addressing and dynamic
   1.863 +  instantiation.  Note that named rule cases are \emph{not} provided
   1.864 +  as would be by the proper \mbox{\isa{induct}} and \mbox{\isa{cases}} proof
   1.865 +  methods (see \secref{sec:cases-induct}).
   1.866 +  
   1.867 +  \item [\mbox{\isa{ind{\isacharunderscore}cases}} and \mbox{\isa{\isacommand{inductive{\isacharunderscore}cases}}}] provide an interface to the internal
   1.868 +  \texttt{mk_cases} operation.  Rules are simplified in an
   1.869 +  unrestricted forward manner.
   1.870 +
   1.871 +  While \mbox{\isa{ind{\isacharunderscore}cases}} is a proof method to apply the
   1.872 +  result immediately as elimination rules, \mbox{\isa{\isacommand{inductive{\isacharunderscore}cases}}} provides case split theorems at the theory level
   1.873 +  for later use.  The \mbox{\isa{\isakeyword{for}}} argument of the \mbox{\isa{ind{\isacharunderscore}cases}} method allows to specify a list of variables that should
   1.874 +  be generalized before applying the resulting rule.
   1.875 +
   1.876 +  \end{descr}%
   1.877 +\end{isamarkuptext}%
   1.878 +\isamarkuptrue%
   1.879 +%
   1.880 +\isamarkupsection{Executable code%
   1.881 +}
   1.882 +\isamarkuptrue%
   1.883 +%
   1.884 +\begin{isamarkuptext}%
   1.885 +Isabelle/Pure provides two generic frameworks to support code
   1.886 +  generation from executable specifications.  Isabelle/HOL
   1.887 +  instantiates these mechanisms in a way that is amenable to end-user
   1.888 +  applications.
   1.889 +
   1.890 +  One framework generates code from both functional and relational
   1.891 +  programs to SML.  See \cite{isabelle-HOL} for further information
   1.892 +  (this actually covers the new-style theory format as well).
   1.893 +
   1.894 +  \begin{matharray}{rcl}
   1.895 +    \indexdef{HOL}{command}{value}\mbox{\isa{\isacommand{value}}}\isa{{\isachardoublequote}\isactrlsup {\isacharasterisk}{\isachardoublequote}} & : & \isarkeep{theory~|~proof} \\
   1.896 +    \indexdef{HOL}{command}{code-module}\mbox{\isa{\isacommand{code{\isacharunderscore}module}}} & : & \isartrans{theory}{theory} \\
   1.897 +    \indexdef{HOL}{command}{code-library}\mbox{\isa{\isacommand{code{\isacharunderscore}library}}} & : & \isartrans{theory}{theory} \\
   1.898 +    \indexdef{HOL}{command}{consts-code}\mbox{\isa{\isacommand{consts{\isacharunderscore}code}}} & : & \isartrans{theory}{theory} \\
   1.899 +    \indexdef{HOL}{command}{types-code}\mbox{\isa{\isacommand{types{\isacharunderscore}code}}} & : & \isartrans{theory}{theory} \\  
   1.900 +    \indexdef{HOL}{attribute}{code}\mbox{\isa{code}} & : & \isaratt \\
   1.901 +  \end{matharray}
   1.902 +
   1.903 +  \begin{rail}
   1.904 +  'value' term
   1.905 +  ;
   1.906 +
   1.907 +  ( 'code\_module' | 'code\_library' ) modespec ? name ? \\
   1.908 +    ( 'file' name ) ? ( 'imports' ( name + ) ) ? \\
   1.909 +    'contains' ( ( name '=' term ) + | term + )
   1.910 +  ;
   1.911 +
   1.912 +  modespec: '(' ( name * ) ')'
   1.913 +  ;
   1.914 +
   1.915 +  'consts\_code' (codespec +)
   1.916 +  ;
   1.917 +
   1.918 +  codespec: const template attachment ?
   1.919 +  ;
   1.920 +
   1.921 +  'types\_code' (tycodespec +)
   1.922 +  ;
   1.923 +
   1.924 +  tycodespec: name template attachment ?
   1.925 +  ;
   1.926 +
   1.927 +  const: term
   1.928 +  ;
   1.929 +
   1.930 +  template: '(' string ')'
   1.931 +  ;
   1.932 +
   1.933 +  attachment: 'attach' modespec ? verblbrace text verbrbrace
   1.934 +  ;
   1.935 +
   1.936 +  'code' (name)?
   1.937 +  ;
   1.938 +  \end{rail}
   1.939 +
   1.940 +  \begin{descr}
   1.941 +
   1.942 +  \item [\mbox{\isa{\isacommand{value}}}~\isa{t}] evaluates and prints a
   1.943 +  term using the code generator.
   1.944 +
   1.945 +  \end{descr}
   1.946 +
   1.947 +  \medskip The other framework generates code from functional programs
   1.948 +  (including overloading using type classes) to SML \cite{SML}, OCaml
   1.949 +  \cite{OCaml} and Haskell \cite{haskell-revised-report}.
   1.950 +  Conceptually, code generation is split up in three steps:
   1.951 +  \emph{selection} of code theorems, \emph{translation} into an
   1.952 +  abstract executable view and \emph{serialization} to a specific
   1.953 +  \emph{target language}.  See \cite{isabelle-codegen} for an
   1.954 +  introduction on how to use it.
   1.955 +
   1.956 +  \begin{matharray}{rcl}
   1.957 +    \indexdef{HOL}{command}{export-code}\mbox{\isa{\isacommand{export{\isacharunderscore}code}}}\isa{{\isachardoublequote}\isactrlsup {\isacharasterisk}{\isachardoublequote}} & : & \isarkeep{theory~|~proof} \\
   1.958 +    \indexdef{HOL}{command}{code-thms}\mbox{\isa{\isacommand{code{\isacharunderscore}thms}}}\isa{{\isachardoublequote}\isactrlsup {\isacharasterisk}{\isachardoublequote}} & : & \isarkeep{theory~|~proof} \\
   1.959 +    \indexdef{HOL}{command}{code-deps}\mbox{\isa{\isacommand{code{\isacharunderscore}deps}}}\isa{{\isachardoublequote}\isactrlsup {\isacharasterisk}{\isachardoublequote}} & : & \isarkeep{theory~|~proof} \\
   1.960 +    \indexdef{HOL}{command}{code-datatype}\mbox{\isa{\isacommand{code{\isacharunderscore}datatype}}} & : & \isartrans{theory}{theory} \\
   1.961 +    \indexdef{HOL}{command}{code-const}\mbox{\isa{\isacommand{code{\isacharunderscore}const}}} & : & \isartrans{theory}{theory} \\
   1.962 +    \indexdef{HOL}{command}{code-type}\mbox{\isa{\isacommand{code{\isacharunderscore}type}}} & : & \isartrans{theory}{theory} \\
   1.963 +    \indexdef{HOL}{command}{code-class}\mbox{\isa{\isacommand{code{\isacharunderscore}class}}} & : & \isartrans{theory}{theory} \\
   1.964 +    \indexdef{HOL}{command}{code-instance}\mbox{\isa{\isacommand{code{\isacharunderscore}instance}}} & : & \isartrans{theory}{theory} \\
   1.965 +    \indexdef{HOL}{command}{code-monad}\mbox{\isa{\isacommand{code{\isacharunderscore}monad}}} & : & \isartrans{theory}{theory} \\
   1.966 +    \indexdef{HOL}{command}{code-reserved}\mbox{\isa{\isacommand{code{\isacharunderscore}reserved}}} & : & \isartrans{theory}{theory} \\
   1.967 +    \indexdef{HOL}{command}{code-include}\mbox{\isa{\isacommand{code{\isacharunderscore}include}}} & : & \isartrans{theory}{theory} \\
   1.968 +    \indexdef{HOL}{command}{code-modulename}\mbox{\isa{\isacommand{code{\isacharunderscore}modulename}}} & : & \isartrans{theory}{theory} \\
   1.969 +    \indexdef{HOL}{command}{code-exception}\mbox{\isa{\isacommand{code{\isacharunderscore}exception}}} & : & \isartrans{theory}{theory} \\
   1.970 +    \indexdef{HOL}{command}{print-codesetup}\mbox{\isa{\isacommand{print{\isacharunderscore}codesetup}}}\isa{{\isachardoublequote}\isactrlsup {\isacharasterisk}{\isachardoublequote}} & : & \isarkeep{theory~|~proof} \\
   1.971 +    \indexdef{HOL}{attribute}{code}\mbox{\isa{code}} & : & \isaratt \\
   1.972 +  \end{matharray}
   1.973 +
   1.974 +  \begin{rail}
   1.975 +    'export\_code' ( constexpr + ) ? \\
   1.976 +      ( ( 'in' target ( 'module\_name' string ) ? \\
   1.977 +        ( 'file' ( string | '-' ) ) ? ( '(' args ')' ) ?) + ) ?
   1.978 +    ;
   1.979 +
   1.980 +    'code\_thms' ( constexpr + ) ?
   1.981 +    ;
   1.982 +
   1.983 +    'code\_deps' ( constexpr + ) ?
   1.984 +    ;
   1.985 +
   1.986 +    const: term
   1.987 +    ;
   1.988 +
   1.989 +    constexpr: ( const | 'name.*' | '*' )
   1.990 +    ;
   1.991 +
   1.992 +    typeconstructor: nameref
   1.993 +    ;
   1.994 +
   1.995 +    class: nameref
   1.996 +    ;
   1.997 +
   1.998 +    target: 'OCaml' | 'SML' | 'Haskell'
   1.999 +    ;
  1.1000 +
  1.1001 +    'code\_datatype' const +
  1.1002 +    ;
  1.1003 +
  1.1004 +    'code\_const' (const + 'and') \\
  1.1005 +      ( ( '(' target ( syntax ? + 'and' ) ')' ) + )
  1.1006 +    ;
  1.1007 +
  1.1008 +    'code\_type' (typeconstructor + 'and') \\
  1.1009 +      ( ( '(' target ( syntax ? + 'and' ) ')' ) + )
  1.1010 +    ;
  1.1011 +
  1.1012 +    'code\_class' (class + 'and') \\
  1.1013 +      ( ( '(' target \\
  1.1014 +        ( ( string ('where' \\
  1.1015 +          ( const ( '==' | equiv ) string ) + ) ? ) ? + 'and' ) ')' ) + )
  1.1016 +    ;
  1.1017 +
  1.1018 +    'code\_instance' (( typeconstructor '::' class ) + 'and') \\
  1.1019 +      ( ( '(' target ( '-' ? + 'and' ) ')' ) + )
  1.1020 +    ;
  1.1021 +
  1.1022 +    'code\_monad' const const target
  1.1023 +    ;
  1.1024 +
  1.1025 +    'code\_reserved' target ( string + )
  1.1026 +    ;
  1.1027 +
  1.1028 +    'code\_include' target ( string ( string | '-') )
  1.1029 +    ;
  1.1030 +
  1.1031 +    'code\_modulename' target ( ( string string ) + )
  1.1032 +    ;
  1.1033 +
  1.1034 +    'code\_exception' ( const + )
  1.1035 +    ;
  1.1036 +
  1.1037 +    syntax: string | ( 'infix' | 'infixl' | 'infixr' ) nat string
  1.1038 +    ;
  1.1039 +
  1.1040 +    'code' ('func' | 'inline') ( 'del' )?
  1.1041 +    ;
  1.1042 +  \end{rail}
  1.1043 +
  1.1044 +  \begin{descr}
  1.1045 +
  1.1046 +  \item [\mbox{\isa{\isacommand{export{\isacharunderscore}code}}}] is the canonical interface
  1.1047 +  for generating and serializing code: for a given list of constants,
  1.1048 +  code is generated for the specified target languages.  Abstract code
  1.1049 +  is cached incrementally.  If no constant is given, the currently
  1.1050 +  cached code is serialized.  If no serialization instruction is
  1.1051 +  given, only abstract code is cached.
  1.1052 +
  1.1053 +  Constants may be specified by giving them literally, referring to
  1.1054 +  all executable contants within a certain theory by giving \isa{{\isachardoublequote}name{\isachardot}{\isacharasterisk}{\isachardoublequote}}, or referring to \emph{all} executable constants currently
  1.1055 +  available by giving \isa{{\isachardoublequote}{\isacharasterisk}{\isachardoublequote}}.
  1.1056 +
  1.1057 +  By default, for each involved theory one corresponding name space
  1.1058 +  module is generated.  Alternativly, a module name may be specified
  1.1059 +  after the \mbox{\isa{\isakeyword{module{\isacharunderscore}name}}} keyword; then \emph{all} code is
  1.1060 +  placed in this module.
  1.1061 +
  1.1062 +  For \emph{SML} and \emph{OCaml}, the file specification refers to a
  1.1063 +  single file; for \emph{Haskell}, it refers to a whole directory,
  1.1064 +  where code is generated in multiple files reflecting the module
  1.1065 +  hierarchy.  The file specification ``\isa{{\isachardoublequote}{\isacharminus}{\isachardoublequote}}'' denotes standard
  1.1066 +  output.  For \emph{SML}, omitting the file specification compiles
  1.1067 +  code internally in the context of the current ML session.
  1.1068 +
  1.1069 +  Serializers take an optional list of arguments in parentheses.  For
  1.1070 +  \emph{Haskell} a module name prefix may be given using the ``\isa{{\isachardoublequote}root{\isacharcolon}{\isachardoublequote}}'' argument; ``\isa{string{\isacharunderscore}classes}'' adds a ``\verb|deriving (Read, Show)|'' clause to each appropriate datatype
  1.1071 +  declaration.
  1.1072 +
  1.1073 +  \item [\mbox{\isa{\isacommand{code{\isacharunderscore}thms}}}] prints a list of theorems
  1.1074 +  representing the corresponding program containing all given
  1.1075 +  constants; if no constants are given, the currently cached code
  1.1076 +  theorems are printed.
  1.1077 +
  1.1078 +  \item [\mbox{\isa{\isacommand{code{\isacharunderscore}deps}}}] visualizes dependencies of
  1.1079 +  theorems representing the corresponding program containing all given
  1.1080 +  constants; if no constants are given, the currently cached code
  1.1081 +  theorems are visualized.
  1.1082 +
  1.1083 +  \item [\mbox{\isa{\isacommand{code{\isacharunderscore}datatype}}}] specifies a constructor set
  1.1084 +  for a logical type.
  1.1085 +
  1.1086 +  \item [\mbox{\isa{\isacommand{code{\isacharunderscore}const}}}] associates a list of constants
  1.1087 +  with target-specific serializations; omitting a serialization
  1.1088 +  deletes an existing serialization.
  1.1089 +
  1.1090 +  \item [\mbox{\isa{\isacommand{code{\isacharunderscore}type}}}] associates a list of type
  1.1091 +  constructors with target-specific serializations; omitting a
  1.1092 +  serialization deletes an existing serialization.
  1.1093 +
  1.1094 +  \item [\mbox{\isa{\isacommand{code{\isacharunderscore}class}}}] associates a list of classes
  1.1095 +  with target-specific class names; in addition, constants associated
  1.1096 +  with this class may be given target-specific names used for instance
  1.1097 +  declarations; omitting a serialization deletes an existing
  1.1098 +  serialization.  This applies only to \emph{Haskell}.
  1.1099 +
  1.1100 +  \item [\mbox{\isa{\isacommand{code{\isacharunderscore}instance}}}] declares a list of type
  1.1101 +  constructor / class instance relations as ``already present'' for a
  1.1102 +  given target.  Omitting a ``\isa{{\isachardoublequote}{\isacharminus}{\isachardoublequote}}'' deletes an existing
  1.1103 +  ``already present'' declaration.  This applies only to
  1.1104 +  \emph{Haskell}.
  1.1105 +
  1.1106 +  \item [\mbox{\isa{\isacommand{code{\isacharunderscore}monad}}}] provides an auxiliary
  1.1107 +  mechanism to generate monadic code.
  1.1108 +
  1.1109 +  \item [\mbox{\isa{\isacommand{code{\isacharunderscore}reserved}}}] declares a list of names as
  1.1110 +  reserved for a given target, preventing it to be shadowed by any
  1.1111 +  generated code.
  1.1112 +
  1.1113 +  \item [\mbox{\isa{\isacommand{code{\isacharunderscore}include}}}] adds arbitrary named content
  1.1114 +  (``include'') to generated code.  A as last argument ``\isa{{\isachardoublequote}{\isacharminus}{\isachardoublequote}}''
  1.1115 +  will remove an already added ``include''.
  1.1116 +
  1.1117 +  \item [\mbox{\isa{\isacommand{code{\isacharunderscore}modulename}}}] declares aliasings from
  1.1118 +  one module name onto another.
  1.1119 +
  1.1120 +  \item [\mbox{\isa{\isacommand{code{\isacharunderscore}exception}}}] declares constants which
  1.1121 +  are not required to have a definition by a defining equations; these
  1.1122 +  are mapped on exceptions instead.
  1.1123 +
  1.1124 +  \item [\mbox{\isa{code}}~\isa{func}] explicitly selects (or
  1.1125 +  with option ``\isa{{\isachardoublequote}del{\isacharcolon}{\isachardoublequote}}'' deselects) a defining equation for
  1.1126 +  code generation.  Usually packages introducing defining equations
  1.1127 +  provide a resonable default setup for selection.
  1.1128 +
  1.1129 +  \item [\mbox{\isa{code}}\isa{inline}] declares (or with
  1.1130 +  option ``\isa{{\isachardoublequote}del{\isacharcolon}{\isachardoublequote}}'' removes) inlining theorems which are
  1.1131 +  applied as rewrite rules to any defining equation during
  1.1132 +  preprocessing.
  1.1133 +
  1.1134 +  \item [\mbox{\isa{\isacommand{print{\isacharunderscore}codesetup}}}] gives an overview on
  1.1135 +  selected defining equations, code generator datatypes and
  1.1136 +  preprocessor setup.
  1.1137 +
  1.1138 +  \end{descr}%
  1.1139 +\end{isamarkuptext}%
  1.1140 +\isamarkuptrue%
  1.1141 +%
  1.1142 +\isadelimtheory
  1.1143 +%
  1.1144 +\endisadelimtheory
  1.1145 +%
  1.1146 +\isatagtheory
  1.1147  \isacommand{end}\isamarkupfalse%
  1.1148  %
  1.1149  \endisatagtheory
  1.1150  {\isafoldtheory}%
  1.1151  %
  1.1152  \isadelimtheory
  1.1153 -\isanewline
  1.1154  %
  1.1155  \endisadelimtheory
  1.1156 +\isanewline
  1.1157 +\isanewline
  1.1158  \end{isabellebody}%
  1.1159  %%% Local Variables:
  1.1160  %%% mode: latex