# HG changeset patch
# User haftmann
# Date 1237831277 -3600
# Node ID b14b2cc4e25e5fc0531a056118ed20053325458a
# Parent  2d1d426e00e42540eb1090788286ef17f0b5e216
moved Imperative_HOL examples to Imperative_HOL/ex

diff -r 2d1d426e00e4 -r b14b2cc4e25e src/HOL/Imperative_HOL/ROOT.ML
--- a/src/HOL/Imperative_HOL/ROOT.ML	Mon Mar 23 19:01:17 2009 +0100
+++ b/src/HOL/Imperative_HOL/ROOT.ML	Mon Mar 23 19:01:17 2009 +0100
@@ -1,2 +1,2 @@
 
-use_thy "Imperative_HOL";
+use_thy "Imperative_HOL_ex";
diff -r 2d1d426e00e4 -r b14b2cc4e25e src/HOL/Imperative_HOL/ex/Imperative_Quicksort.thy
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/src/HOL/Imperative_HOL/ex/Imperative_Quicksort.thy	Mon Mar 23 19:01:17 2009 +0100
@@ -0,0 +1,639 @@
+(* Author: Lukas Bulwahn, TU Muenchen *)
+
+theory Imperative_Quicksort
+imports "~~/src/HOL/Imperative_HOL/Imperative_HOL" Subarray Multiset Efficient_Nat
+begin
+
+text {* We prove QuickSort correct in the Relational Calculus. *}
+
+definition swap :: "nat array \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> unit Heap"
+where
+  "swap arr i j = (
+     do
+       x \<leftarrow> nth arr i;
+       y \<leftarrow> nth arr j;
+       upd i y arr;
+       upd j x arr;
+       return ()
+     done)"
+
+lemma swap_permutes:
+  assumes "crel (swap a i j) h h' rs"
+  shows "multiset_of (get_array a h') 
+  = multiset_of (get_array a h)"
+  using assms
+  unfolding swap_def
+  by (auto simp add: Heap.length_def multiset_of_swap dest: sym [of _ "h'"] elim!: crelE crel_nth crel_return crel_upd)
+
+function part1 :: "nat array \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> nat Heap"
+where
+  "part1 a left right p = (
+     if (right \<le> left) then return right
+     else (do
+       v \<leftarrow> nth a left;
+       (if (v \<le> p) then (part1 a (left + 1) right p)
+                    else (do swap a left right;
+  part1 a left (right - 1) p done))
+     done))"
+by pat_completeness auto
+
+termination
+by (relation "measure (\<lambda>(_,l,r,_). r - l )") auto
+
+declare part1.simps[simp del]
+
+lemma part_permutes:
+  assumes "crel (part1 a l r p) h h' rs"
+  shows "multiset_of (get_array a h') 
+  = multiset_of (get_array a h)"
+  using assms
+proof (induct a l r p arbitrary: h h' rs rule:part1.induct)
+  case (1 a l r p h h' rs)
+  thus ?case
+    unfolding part1.simps [of a l r p]
+    by (elim crelE crel_if crel_return crel_nth) (auto simp add: swap_permutes)
+qed
+
+lemma part_returns_index_in_bounds:
+  assumes "crel (part1 a l r p) h h' rs"
+  assumes "l \<le> r"
+  shows "l \<le> rs \<and> rs \<le> r"
+using assms
+proof (induct a l r p arbitrary: h h' rs rule:part1.induct)
+  case (1 a l r p h h' rs)
+  note cr = `crel (part1 a l r p) h h' rs`
+  show ?case
+  proof (cases "r \<le> l")
+    case True (* Terminating case *)
+    with cr `l \<le> r` show ?thesis
+      unfolding part1.simps[of a l r p]
+      by (elim crelE crel_if crel_return crel_nth) auto
+  next
+    case False (* recursive case *)
+    note rec_condition = this
+    let ?v = "get_array a h ! l"
+    show ?thesis
+    proof (cases "?v \<le> p")
+      case True
+      with cr False
+      have rec1: "crel (part1 a (l + 1) r p) h h' rs"
+        unfolding part1.simps[of a l r p]
+        by (elim crelE crel_nth crel_if crel_return) auto
+      from rec_condition have "l + 1 \<le> r" by arith
+      from 1(1)[OF rec_condition True rec1 `l + 1 \<le> r`]
+      show ?thesis by simp
+    next
+      case False
+      with rec_condition cr
+      obtain h1 where swp: "crel (swap a l r) h h1 ()"
+        and rec2: "crel (part1 a l (r - 1) p) h1 h' rs"
+        unfolding part1.simps[of a l r p]
+        by (elim crelE crel_nth crel_if crel_return) auto
+      from rec_condition have "l \<le> r - 1" by arith
+      from 1(2) [OF rec_condition False rec2 `l \<le> r - 1`] show ?thesis by fastsimp
+    qed
+  qed
+qed
+
+lemma part_length_remains:
+  assumes "crel (part1 a l r p) h h' rs"
+  shows "Heap.length a h = Heap.length a h'"
+using assms
+proof (induct a l r p arbitrary: h h' rs rule:part1.induct)
+  case (1 a l r p h h' rs)
+  note cr = `crel (part1 a l r p) h h' rs`
+  
+  show ?case
+  proof (cases "r \<le> l")
+    case True (* Terminating case *)
+    with cr show ?thesis
+      unfolding part1.simps[of a l r p]
+      by (elim crelE crel_if crel_return crel_nth) auto
+  next
+    case False (* recursive case *)
+    with cr 1 show ?thesis
+      unfolding part1.simps [of a l r p] swap_def
+      by (auto elim!: crelE crel_if crel_nth crel_return crel_upd) fastsimp
+  qed
+qed
+
+lemma part_outer_remains:
+  assumes "crel (part1 a l r p) h h' rs"
+  shows "\<forall>i. i < l \<or> r < i \<longrightarrow> get_array (a::nat array) h ! i = get_array a h' ! i"
+  using assms
+proof (induct a l r p arbitrary: h h' rs rule:part1.induct)
+  case (1 a l r p h h' rs)
+  note cr = `crel (part1 a l r p) h h' rs`
+  
+  show ?case
+  proof (cases "r \<le> l")
+    case True (* Terminating case *)
+    with cr show ?thesis
+      unfolding part1.simps[of a l r p]
+      by (elim crelE crel_if crel_return crel_nth) auto
+  next
+    case False (* recursive case *)
+    note rec_condition = this
+    let ?v = "get_array a h ! l"
+    show ?thesis
+    proof (cases "?v \<le> p")
+      case True
+      with cr False
+      have rec1: "crel (part1 a (l + 1) r p) h h' rs"
+        unfolding part1.simps[of a l r p]
+        by (elim crelE crel_nth crel_if crel_return) auto
+      from 1(1)[OF rec_condition True rec1]
+      show ?thesis by fastsimp
+    next
+      case False
+      with rec_condition cr
+      obtain h1 where swp: "crel (swap a l r) h h1 ()"
+        and rec2: "crel (part1 a l (r - 1) p) h1 h' rs"
+        unfolding part1.simps[of a l r p]
+        by (elim crelE crel_nth crel_if crel_return) auto
+      from swp rec_condition have
+        "\<forall>i. i < l \<or> r < i \<longrightarrow> get_array a h ! i = get_array a h1 ! i"
+	unfolding swap_def
+	by (elim crelE crel_nth crel_upd crel_return) auto
+      with 1(2) [OF rec_condition False rec2] show ?thesis by fastsimp
+    qed
+  qed
+qed
+
+
+lemma part_partitions:
+  assumes "crel (part1 a l r p) h h' rs"
+  shows "(\<forall>i. l \<le> i \<and> i < rs \<longrightarrow> get_array (a::nat array) h' ! i \<le> p)
+  \<and> (\<forall>i. rs < i \<and> i \<le> r \<longrightarrow> get_array a h' ! i \<ge> p)"
+  using assms
+proof (induct a l r p arbitrary: h h' rs rule:part1.induct)
+  case (1 a l r p h h' rs)
+  note cr = `crel (part1 a l r p) h h' rs`
+  
+  show ?case
+  proof (cases "r \<le> l")
+    case True (* Terminating case *)
+    with cr have "rs = r"
+      unfolding part1.simps[of a l r p]
+      by (elim crelE crel_if crel_return crel_nth) auto
+    with True
+    show ?thesis by auto
+  next
+    case False (* recursive case *)
+    note lr = this
+    let ?v = "get_array a h ! l"
+    show ?thesis
+    proof (cases "?v \<le> p")
+      case True
+      with lr cr
+      have rec1: "crel (part1 a (l + 1) r p) h h' rs"
+        unfolding part1.simps[of a l r p]
+        by (elim crelE crel_nth crel_if crel_return) auto
+      from True part_outer_remains[OF rec1] have a_l: "get_array a h' ! l \<le> p"
+	by fastsimp
+      have "\<forall>i. (l \<le> i = (l = i \<or> Suc l \<le> i))" by arith
+      with 1(1)[OF False True rec1] a_l show ?thesis
+	by auto
+    next
+      case False
+      with lr cr
+      obtain h1 where swp: "crel (swap a l r) h h1 ()"
+        and rec2: "crel (part1 a l (r - 1) p) h1 h' rs"
+        unfolding part1.simps[of a l r p]
+        by (elim crelE crel_nth crel_if crel_return) auto
+      from swp False have "get_array a h1 ! r \<ge> p"
+	unfolding swap_def
+	by (auto simp add: Heap.length_def elim!: crelE crel_nth crel_upd crel_return)
+      with part_outer_remains [OF rec2] lr have a_r: "get_array a h' ! r \<ge> p"
+	by fastsimp
+      have "\<forall>i. (i \<le> r = (i = r \<or> i \<le> r - 1))" by arith
+      with 1(2)[OF lr False rec2] a_r show ?thesis
+	by auto
+    qed
+  qed
+qed
+
+
+fun partition :: "nat array \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> nat Heap"
+where
+  "partition a left right = (do
+     pivot \<leftarrow> nth a right;
+     middle \<leftarrow> part1 a left (right - 1) pivot;
+     v \<leftarrow> nth a middle;
+     m \<leftarrow> return (if (v \<le> pivot) then (middle + 1) else middle);
+     swap a m right;
+     return m
+   done)"
+
+declare partition.simps[simp del]
+
+lemma partition_permutes:
+  assumes "crel (partition a l r) h h' rs"
+  shows "multiset_of (get_array a h') 
+  = multiset_of (get_array a h)"
+proof -
+    from assms part_permutes swap_permutes show ?thesis
+      unfolding partition.simps
+      by (elim crelE crel_return crel_nth crel_if crel_upd) auto
+qed
+
+lemma partition_length_remains:
+  assumes "crel (partition a l r) h h' rs"
+  shows "Heap.length a h = Heap.length a h'"
+proof -
+  from assms part_length_remains show ?thesis
+    unfolding partition.simps swap_def
+    by (elim crelE crel_return crel_nth crel_if crel_upd) auto
+qed
+
+lemma partition_outer_remains:
+  assumes "crel (partition a l r) h h' rs"
+  assumes "l < r"
+  shows "\<forall>i. i < l \<or> r < i \<longrightarrow> get_array (a::nat array) h ! i = get_array a h' ! i"
+proof -
+  from assms part_outer_remains part_returns_index_in_bounds show ?thesis
+    unfolding partition.simps swap_def
+    by (elim crelE crel_return crel_nth crel_if crel_upd) fastsimp
+qed
+
+lemma partition_returns_index_in_bounds:
+  assumes crel: "crel (partition a l r) h h' rs"
+  assumes "l < r"
+  shows "l \<le> rs \<and> rs \<le> r"
+proof -
+  from crel obtain middle h'' p where part: "crel (part1 a l (r - 1) p) h h'' middle"
+    and rs_equals: "rs = (if get_array a h'' ! middle \<le> get_array a h ! r then middle + 1
+         else middle)"
+    unfolding partition.simps
+    by (elim crelE crel_return crel_nth crel_if crel_upd) simp
+  from `l < r` have "l \<le> r - 1" by arith
+  from part_returns_index_in_bounds[OF part this] rs_equals `l < r` show ?thesis by auto
+qed
+
+lemma partition_partitions:
+  assumes crel: "crel (partition a l r) h h' rs"
+  assumes "l < r"
+  shows "(\<forall>i. l \<le> i \<and> i < rs \<longrightarrow> get_array (a::nat array) h' ! i \<le> get_array a h' ! rs) \<and>
+  (\<forall>i. rs < i \<and> i \<le> r \<longrightarrow> get_array a h' ! rs \<le> get_array a h' ! i)"
+proof -
+  let ?pivot = "get_array a h ! r" 
+  from crel obtain middle h1 where part: "crel (part1 a l (r - 1) ?pivot) h h1 middle"
+    and swap: "crel (swap a rs r) h1 h' ()"
+    and rs_equals: "rs = (if get_array a h1 ! middle \<le> ?pivot then middle + 1
+         else middle)"
+    unfolding partition.simps
+    by (elim crelE crel_return crel_nth crel_if crel_upd) simp
+  from swap have h'_def: "h' = Heap.upd a r (get_array a h1 ! rs)
+    (Heap.upd a rs (get_array a h1 ! r) h1)"
+    unfolding swap_def
+    by (elim crelE crel_return crel_nth crel_upd) simp
+  from swap have in_bounds: "r < Heap.length a h1 \<and> rs < Heap.length a h1"
+    unfolding swap_def
+    by (elim crelE crel_return crel_nth crel_upd) simp
+  from swap have swap_length_remains: "Heap.length a h1 = Heap.length a h'"
+    unfolding swap_def by (elim crelE crel_return crel_nth crel_upd) auto
+  from `l < r` have "l \<le> r - 1" by simp 
+  note middle_in_bounds = part_returns_index_in_bounds[OF part this]
+  from part_outer_remains[OF part] `l < r`
+  have "get_array a h ! r = get_array a h1 ! r"
+    by fastsimp
+  with swap
+  have right_remains: "get_array a h ! r = get_array a h' ! rs"
+    unfolding swap_def
+    by (auto simp add: Heap.length_def elim!: crelE crel_return crel_nth crel_upd) (cases "r = rs", auto)
+  from part_partitions [OF part]
+  show ?thesis
+  proof (cases "get_array a h1 ! middle \<le> ?pivot")
+    case True
+    with rs_equals have rs_equals: "rs = middle + 1" by simp
+    { 
+      fix i
+      assume i_is_left: "l \<le> i \<and> i < rs"
+      with swap_length_remains in_bounds middle_in_bounds rs_equals `l < r`
+      have i_props: "i < Heap.length a h'" "i \<noteq> r" "i \<noteq> rs" by auto
+      from i_is_left rs_equals have "l \<le> i \<and> i < middle \<or> i = middle" by arith
+      with part_partitions[OF part] right_remains True
+      have "get_array a h1 ! i \<le> get_array a h' ! rs" by fastsimp
+      with i_props h'_def in_bounds have "get_array a h' ! i \<le> get_array a h' ! rs"
+	unfolding Heap.upd_def Heap.length_def by simp
+    }
+    moreover
+    {
+      fix i
+      assume "rs < i \<and> i \<le> r"
+
+      hence "(rs < i \<and> i \<le> r - 1) \<or> (rs < i \<and> i = r)" by arith
+      hence "get_array a h' ! rs \<le> get_array a h' ! i"
+      proof
+	assume i_is: "rs < i \<and> i \<le> r - 1"
+	with swap_length_remains in_bounds middle_in_bounds rs_equals
+	have i_props: "i < Heap.length a h'" "i \<noteq> r" "i \<noteq> rs" by auto
+	from part_partitions[OF part] rs_equals right_remains i_is
+	have "get_array a h' ! rs \<le> get_array a h1 ! i"
+	  by fastsimp
+	with i_props h'_def show ?thesis by fastsimp
+      next
+	assume i_is: "rs < i \<and> i = r"
+	with rs_equals have "Suc middle \<noteq> r" by arith
+	with middle_in_bounds `l < r` have "Suc middle \<le> r - 1" by arith
+	with part_partitions[OF part] right_remains 
+	have "get_array a h' ! rs \<le> get_array a h1 ! (Suc middle)"
+	  by fastsimp
+	with i_is True rs_equals right_remains h'_def
+	show ?thesis using in_bounds
+	  unfolding Heap.upd_def Heap.length_def
+	  by auto
+      qed
+    }
+    ultimately show ?thesis by auto
+  next
+    case False
+    with rs_equals have rs_equals: "middle = rs" by simp
+    { 
+      fix i
+      assume i_is_left: "l \<le> i \<and> i < rs"
+      with swap_length_remains in_bounds middle_in_bounds rs_equals
+      have i_props: "i < Heap.length a h'" "i \<noteq> r" "i \<noteq> rs" by auto
+      from part_partitions[OF part] rs_equals right_remains i_is_left
+      have "get_array a h1 ! i \<le> get_array a h' ! rs" by fastsimp
+      with i_props h'_def have "get_array a h' ! i \<le> get_array a h' ! rs"
+	unfolding Heap.upd_def by simp
+    }
+    moreover
+    {
+      fix i
+      assume "rs < i \<and> i \<le> r"
+      hence "(rs < i \<and> i \<le> r - 1) \<or> i = r" by arith
+      hence "get_array a h' ! rs \<le> get_array a h' ! i"
+      proof
+	assume i_is: "rs < i \<and> i \<le> r - 1"
+	with swap_length_remains in_bounds middle_in_bounds rs_equals
+	have i_props: "i < Heap.length a h'" "i \<noteq> r" "i \<noteq> rs" by auto
+	from part_partitions[OF part] rs_equals right_remains i_is
+	have "get_array a h' ! rs \<le> get_array a h1 ! i"
+	  by fastsimp
+	with i_props h'_def show ?thesis by fastsimp
+      next
+	assume i_is: "i = r"
+	from i_is False rs_equals right_remains h'_def
+	show ?thesis using in_bounds
+	  unfolding Heap.upd_def Heap.length_def
+	  by auto
+      qed
+    }
+    ultimately
+    show ?thesis by auto
+  qed
+qed
+
+
+function quicksort :: "nat array \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> unit Heap"
+where
+  "quicksort arr left right =
+     (if (right > left)  then
+        do
+          pivotNewIndex \<leftarrow> partition arr left right;
+          pivotNewIndex \<leftarrow> assert (\<lambda>x. left \<le> x \<and> x \<le> right) pivotNewIndex;
+          quicksort arr left (pivotNewIndex - 1);
+          quicksort arr (pivotNewIndex + 1) right
+        done
+     else return ())"
+by pat_completeness auto
+
+(* For termination, we must show that the pivotNewIndex is between left and right *) 
+termination
+by (relation "measure (\<lambda>(a, l, r). (r - l))") auto
+
+declare quicksort.simps[simp del]
+
+
+lemma quicksort_permutes:
+  assumes "crel (quicksort a l r) h h' rs"
+  shows "multiset_of (get_array a h') 
+  = multiset_of (get_array a h)"
+  using assms
+proof (induct a l r arbitrary: h h' rs rule: quicksort.induct)
+  case (1 a l r h h' rs)
+  with partition_permutes show ?case
+    unfolding quicksort.simps [of a l r]
+    by (elim crel_if crelE crel_assert crel_return) auto
+qed
+
+lemma length_remains:
+  assumes "crel (quicksort a l r) h h' rs"
+  shows "Heap.length a h = Heap.length a h'"
+using assms
+proof (induct a l r arbitrary: h h' rs rule: quicksort.induct)
+  case (1 a l r h h' rs)
+  with partition_length_remains show ?case
+    unfolding quicksort.simps [of a l r]
+    by (elim crel_if crelE crel_assert crel_return) auto
+qed
+
+lemma quicksort_outer_remains:
+  assumes "crel (quicksort a l r) h h' rs"
+   shows "\<forall>i. i < l \<or> r < i \<longrightarrow> get_array (a::nat array) h ! i = get_array a h' ! i"
+  using assms
+proof (induct a l r arbitrary: h h' rs rule: quicksort.induct)
+  case (1 a l r h h' rs)
+  note cr = `crel (quicksort a l r) h h' rs`
+  thus ?case
+  proof (cases "r > l")
+    case False
+    with cr have "h' = h"
+      unfolding quicksort.simps [of a l r]
+      by (elim crel_if crel_return) auto
+    thus ?thesis by simp
+  next
+  case True
+   { 
+      fix h1 h2 p ret1 ret2 i
+      assume part: "crel (partition a l r) h h1 p"
+      assume qs1: "crel (quicksort a l (p - 1)) h1 h2 ret1"
+      assume qs2: "crel (quicksort a (p + 1) r) h2 h' ret2"
+      assume pivot: "l \<le> p \<and> p \<le> r"
+      assume i_outer: "i < l \<or> r < i"
+      from  partition_outer_remains [OF part True] i_outer
+      have "get_array a h !i = get_array a h1 ! i" by fastsimp
+      moreover
+      with 1(1) [OF True pivot qs1] pivot i_outer
+      have "get_array a h1 ! i = get_array a h2 ! i" by auto
+      moreover
+      with qs2 1(2) [of p h2 h' ret2] True pivot i_outer
+      have "get_array a h2 ! i = get_array a h' ! i" by auto
+      ultimately have "get_array a h ! i= get_array a h' ! i" by simp
+    }
+    with cr show ?thesis
+      unfolding quicksort.simps [of a l r]
+      by (elim crel_if crelE crel_assert crel_return) auto
+  qed
+qed
+
+lemma quicksort_is_skip:
+  assumes "crel (quicksort a l r) h h' rs"
+  shows "r \<le> l \<longrightarrow> h = h'"
+  using assms
+  unfolding quicksort.simps [of a l r]
+  by (elim crel_if crel_return) auto
+ 
+lemma quicksort_sorts:
+  assumes "crel (quicksort a l r) h h' rs"
+  assumes l_r_length: "l < Heap.length a h" "r < Heap.length a h" 
+  shows "sorted (subarray l (r + 1) a h')"
+  using assms
+proof (induct a l r arbitrary: h h' rs rule: quicksort.induct)
+  case (1 a l r h h' rs)
+  note cr = `crel (quicksort a l r) h h' rs`
+  thus ?case
+  proof (cases "r > l")
+    case False
+    hence "l \<ge> r + 1 \<or> l = r" by arith 
+    with length_remains[OF cr] 1(5) show ?thesis
+      by (auto simp add: subarray_Nil subarray_single)
+  next
+    case True
+    { 
+      fix h1 h2 p
+      assume part: "crel (partition a l r) h h1 p"
+      assume qs1: "crel (quicksort a l (p - 1)) h1 h2 ()"
+      assume qs2: "crel (quicksort a (p + 1) r) h2 h' ()"
+      from partition_returns_index_in_bounds [OF part True]
+      have pivot: "l\<le> p \<and> p \<le> r" .
+     note length_remains = length_remains[OF qs2] length_remains[OF qs1] partition_length_remains[OF part]
+      from quicksort_outer_remains [OF qs2] quicksort_outer_remains [OF qs1] pivot quicksort_is_skip[OF qs1]
+      have pivot_unchanged: "get_array a h1 ! p = get_array a h' ! p" by (cases p, auto)
+        (*-- First of all, by induction hypothesis both sublists are sorted. *)
+      from 1(1)[OF True pivot qs1] length_remains pivot 1(5) 
+      have IH1: "sorted (subarray l p a h2)"  by (cases p, auto simp add: subarray_Nil)
+      from quicksort_outer_remains [OF qs2] length_remains
+      have left_subarray_remains: "subarray l p a h2 = subarray l p a h'"
+	by (simp add: subarray_eq_samelength_iff)
+      with IH1 have IH1': "sorted (subarray l p a h')" by simp
+      from 1(2)[OF True pivot qs2] pivot 1(5) length_remains
+      have IH2: "sorted (subarray (p + 1) (r + 1) a h')"
+        by (cases "Suc p \<le> r", auto simp add: subarray_Nil)
+           (* -- Secondly, both sublists remain partitioned. *)
+      from partition_partitions[OF part True]
+      have part_conds1: "\<forall>j. j \<in> set (subarray l p a h1) \<longrightarrow> j \<le> get_array a h1 ! p "
+        and part_conds2: "\<forall>j. j \<in> set (subarray (p + 1) (r + 1) a h1) \<longrightarrow> get_array a h1 ! p \<le> j"
+        by (auto simp add: all_in_set_subarray_conv)
+      from quicksort_outer_remains [OF qs1] quicksort_permutes [OF qs1] True
+        length_remains 1(5) pivot multiset_of_sublist [of l p "get_array a h1" "get_array a h2"]
+      have multiset_partconds1: "multiset_of (subarray l p a h2) = multiset_of (subarray l p a h1)"
+	unfolding Heap.length_def subarray_def by (cases p, auto)
+      with left_subarray_remains part_conds1 pivot_unchanged
+      have part_conds2': "\<forall>j. j \<in> set (subarray l p a h') \<longrightarrow> j \<le> get_array a h' ! p"
+        by (simp, subst set_of_multiset_of[symmetric], simp)
+          (* -- These steps are the analogous for the right sublist \<dots> *)
+      from quicksort_outer_remains [OF qs1] length_remains
+      have right_subarray_remains: "subarray (p + 1) (r + 1) a h1 = subarray (p + 1) (r + 1) a h2"
+	by (auto simp add: subarray_eq_samelength_iff)
+      from quicksort_outer_remains [OF qs2] quicksort_permutes [OF qs2] True
+        length_remains 1(5) pivot multiset_of_sublist [of "p + 1" "r + 1" "get_array a h2" "get_array a h'"]
+      have multiset_partconds2: "multiset_of (subarray (p + 1) (r + 1) a h') = multiset_of (subarray (p + 1) (r + 1) a h2)"
+        unfolding Heap.length_def subarray_def by auto
+      with right_subarray_remains part_conds2 pivot_unchanged
+      have part_conds1': "\<forall>j. j \<in> set (subarray (p + 1) (r + 1) a h') \<longrightarrow> get_array a h' ! p \<le> j"
+        by (simp, subst set_of_multiset_of[symmetric], simp)
+          (* -- Thirdly and finally, we show that the array is sorted
+          following from the facts above. *)
+      from True pivot 1(5) length_remains have "subarray l (r + 1) a h' = subarray l p a h' @ [get_array a h' ! p] @ subarray (p + 1) (r + 1) a h'"
+	by (simp add: subarray_nth_array_Cons, cases "l < p") (auto simp add: subarray_append subarray_Nil)
+      with IH1' IH2 part_conds1' part_conds2' pivot have ?thesis
+	unfolding subarray_def
+	apply (auto simp add: sorted_append sorted_Cons all_in_set_sublist'_conv)
+	by (auto simp add: set_sublist' dest: le_trans [of _ "get_array a h' ! p"])
+    }
+    with True cr show ?thesis
+      unfolding quicksort.simps [of a l r]
+      by (elim crel_if crel_return crelE crel_assert) auto
+  qed
+qed
+
+
+lemma quicksort_is_sort:
+  assumes crel: "crel (quicksort a 0 (Heap.length a h - 1)) h h' rs"
+  shows "get_array a h' = sort (get_array a h)"
+proof (cases "get_array a h = []")
+  case True
+  with quicksort_is_skip[OF crel] show ?thesis
+  unfolding Heap.length_def by simp
+next
+  case False
+  from quicksort_sorts [OF crel] False have "sorted (sublist' 0 (List.length (get_array a h)) (get_array a h'))"
+    unfolding Heap.length_def subarray_def by auto
+  with length_remains[OF crel] have "sorted (get_array a h')"
+    unfolding Heap.length_def by simp
+  with quicksort_permutes [OF crel] properties_for_sort show ?thesis by fastsimp
+qed
+
+subsection {* No Errors in quicksort *}
+text {* We have proved that quicksort sorts (if no exceptions occur).
+We will now show that exceptions do not occur. *}
+
+lemma noError_part1: 
+  assumes "l < Heap.length a h" "r < Heap.length a h"
+  shows "noError (part1 a l r p) h"
+  using assms
+proof (induct a l r p arbitrary: h rule: part1.induct)
+  case (1 a l r p)
+  thus ?case
+    unfolding part1.simps [of a l r] swap_def
+    by (auto intro!: noError_if noErrorI noError_return noError_nth noError_upd elim!: crelE crel_upd crel_nth crel_return)
+qed
+
+lemma noError_partition:
+  assumes "l < r" "l < Heap.length a h" "r < Heap.length a h"
+  shows "noError (partition a l r) h"
+using assms
+unfolding partition.simps swap_def
+apply (auto intro!: noError_if noErrorI noError_return noError_nth noError_upd noError_part1 elim!: crelE crel_upd crel_nth crel_return)
+apply (frule part_length_remains)
+apply (frule part_returns_index_in_bounds)
+apply auto
+apply (frule part_length_remains)
+apply (frule part_returns_index_in_bounds)
+apply auto
+apply (frule part_length_remains)
+apply auto
+done
+
+lemma noError_quicksort:
+  assumes "l < Heap.length a h" "r < Heap.length a h"
+  shows "noError (quicksort a l r) h"
+using assms
+proof (induct a l r arbitrary: h rule: quicksort.induct)
+  case (1 a l ri h)
+  thus ?case
+    unfolding quicksort.simps [of a l ri]
+    apply (auto intro!: noError_if noErrorI noError_return noError_nth noError_upd noError_assert noError_partition)
+    apply (frule partition_returns_index_in_bounds)
+    apply auto
+    apply (frule partition_returns_index_in_bounds)
+    apply auto
+    apply (auto elim!: crel_assert dest!: partition_length_remains length_remains)
+    apply (subgoal_tac "Suc r \<le> ri \<or> r = ri") 
+    apply (erule disjE)
+    apply auto
+    unfolding quicksort.simps [of a "Suc ri" ri]
+    apply (auto intro!: noError_if noError_return)
+    done
+qed
+
+
+subsection {* Example *}
+
+definition "qsort a = do
+    k \<leftarrow> length a;
+    quicksort a 0 (k - 1);
+    return a
+  done"
+
+ML {* @{code qsort} (Array.fromList [42, 2, 3, 5, 0, 1705, 8, 3, 15]) () *}
+
+export_code qsort in SML_imp module_name QSort
+export_code qsort in OCaml module_name QSort file -
+export_code qsort in OCaml_imp module_name QSort file -
+export_code qsort in Haskell module_name QSort file -
+
+end
\ No newline at end of file
diff -r 2d1d426e00e4 -r b14b2cc4e25e src/HOL/Imperative_HOL/ex/Subarray.thy
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/src/HOL/Imperative_HOL/ex/Subarray.thy	Mon Mar 23 19:01:17 2009 +0100
@@ -0,0 +1,66 @@
+theory Subarray
+imports Array Sublist
+begin
+
+definition subarray :: "nat \<Rightarrow> nat \<Rightarrow> ('a::heap) array \<Rightarrow> heap \<Rightarrow> 'a list"
+where
+  "subarray n m a h \<equiv> sublist' n m (get_array a h)"
+
+lemma subarray_upd: "i \<ge> m \<Longrightarrow> subarray n m a (Heap.upd a i v h) = subarray n m a h"
+apply (simp add: subarray_def Heap.upd_def)
+apply (simp add: sublist'_update1)
+done
+
+lemma subarray_upd2: " i < n  \<Longrightarrow> subarray n m a (Heap.upd a i v h) = subarray n m a h"
+apply (simp add: subarray_def Heap.upd_def)
+apply (subst sublist'_update2)
+apply fastsimp
+apply simp
+done
+
+lemma subarray_upd3: "\<lbrakk> n \<le> i; i < m\<rbrakk> \<Longrightarrow> subarray n m a (Heap.upd a i v h) = subarray n m a h[i - n := v]"
+unfolding subarray_def Heap.upd_def
+by (simp add: sublist'_update3)
+
+lemma subarray_Nil: "n \<ge> m \<Longrightarrow> subarray n m a h = []"
+by (simp add: subarray_def sublist'_Nil')
+
+lemma subarray_single: "\<lbrakk> n < Heap.length a h \<rbrakk> \<Longrightarrow> subarray n (Suc n) a h = [get_array a h ! n]" 
+by (simp add: subarray_def Heap.length_def sublist'_single)
+
+lemma length_subarray: "m \<le> Heap.length a h \<Longrightarrow> List.length (subarray n m a h) = m - n"
+by (simp add: subarray_def Heap.length_def length_sublist')
+
+lemma length_subarray_0: "m \<le> Heap.length a h \<Longrightarrow> List.length (subarray 0 m a h) = m"
+by (simp add: length_subarray)
+
+lemma subarray_nth_array_Cons: "\<lbrakk> i < Heap.length a h; i < j \<rbrakk> \<Longrightarrow> (get_array a h ! i) # subarray (Suc i) j a h = subarray i j a h"
+unfolding Heap.length_def subarray_def
+by (simp add: sublist'_front)
+
+lemma subarray_nth_array_back: "\<lbrakk> i < j; j \<le> Heap.length a h\<rbrakk> \<Longrightarrow> subarray i j a h = subarray i (j - 1) a h @ [get_array a h ! (j - 1)]"
+unfolding Heap.length_def subarray_def
+by (simp add: sublist'_back)
+
+lemma subarray_append: "\<lbrakk> i < j; j < k \<rbrakk> \<Longrightarrow> subarray i j a h @ subarray j k a h = subarray i k a h"
+unfolding subarray_def
+by (simp add: sublist'_append)
+
+lemma subarray_all: "subarray 0 (Heap.length a h) a h = get_array a h"
+unfolding Heap.length_def subarray_def
+by (simp add: sublist'_all)
+
+lemma nth_subarray: "\<lbrakk> k < j - i; j \<le> Heap.length a h \<rbrakk> \<Longrightarrow> subarray i j a h ! k = get_array a h ! (i + k)"
+unfolding Heap.length_def subarray_def
+by (simp add: nth_sublist')
+
+lemma subarray_eq_samelength_iff: "Heap.length a h = Heap.length a h' \<Longrightarrow> (subarray i j a h = subarray i j a h') = (\<forall>i'. i \<le> i' \<and> i' < j \<longrightarrow> get_array a h ! i' = get_array a h' ! i')"
+unfolding Heap.length_def subarray_def by (rule sublist'_eq_samelength_iff)
+
+lemma all_in_set_subarray_conv: "(\<forall>j. j \<in> set (subarray l r a h) \<longrightarrow> P j) = (\<forall>k. l \<le> k \<and> k < r \<and> k < Heap.length a h \<longrightarrow> P (get_array a h ! k))"
+unfolding subarray_def Heap.length_def by (rule all_in_set_sublist'_conv)
+
+lemma ball_in_set_subarray_conv: "(\<forall>j \<in> set (subarray l r a h). P j) = (\<forall>k. l \<le> k \<and> k < r \<and> k < Heap.length a h \<longrightarrow> P (get_array a h ! k))"
+unfolding subarray_def Heap.length_def by (rule ball_in_set_sublist'_conv)
+
+end
\ No newline at end of file
diff -r 2d1d426e00e4 -r b14b2cc4e25e src/HOL/Imperative_HOL/ex/Sublist.thy
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/src/HOL/Imperative_HOL/ex/Sublist.thy	Mon Mar 23 19:01:17 2009 +0100
@@ -0,0 +1,505 @@
+(* $Id$ *)
+
+header {* Slices of lists *}
+
+theory Sublist
+imports Multiset
+begin
+
+
+lemma sublist_split: "i \<le> j \<and> j \<le> k \<Longrightarrow> sublist xs {i..<j} @ sublist xs {j..<k} = sublist xs {i..<k}" 
+apply (induct xs arbitrary: i j k)
+apply simp
+apply (simp only: sublist_Cons)
+apply simp
+apply safe
+apply simp
+apply (erule_tac x="0" in meta_allE)
+apply (erule_tac x="j - 1" in meta_allE)
+apply (erule_tac x="k - 1" in meta_allE)
+apply (subgoal_tac "0 \<le> j - 1 \<and> j - 1 \<le> k - 1")
+apply simp
+apply (subgoal_tac "{ja. Suc ja < j} = {0..<j - Suc 0}")
+apply (subgoal_tac "{ja. j \<le> Suc ja \<and> Suc ja < k} = {j - Suc 0..<k - Suc 0}")
+apply (subgoal_tac "{j. Suc j < k} = {0..<k - Suc 0}")
+apply simp
+apply fastsimp
+apply fastsimp
+apply fastsimp
+apply fastsimp
+apply (erule_tac x="i - 1" in meta_allE)
+apply (erule_tac x="j - 1" in meta_allE)
+apply (erule_tac x="k - 1" in meta_allE)
+apply (subgoal_tac " {ja. i \<le> Suc ja \<and> Suc ja < j} = {i - 1 ..<j - 1}")
+apply (subgoal_tac " {ja. j \<le> Suc ja \<and> Suc ja < k} = {j - 1..<k - 1}")
+apply (subgoal_tac "{j. i \<le> Suc j \<and> Suc j < k} = {i - 1..<k - 1}")
+apply (subgoal_tac " i - 1 \<le> j - 1 \<and> j - 1 \<le> k - 1")
+apply simp
+apply fastsimp
+apply fastsimp
+apply fastsimp
+apply fastsimp
+done
+
+lemma sublist_update1: "i \<notin> inds \<Longrightarrow> sublist (xs[i := v]) inds = sublist xs inds"
+apply (induct xs arbitrary: i inds)
+apply simp
+apply (case_tac i)
+apply (simp add: sublist_Cons)
+apply (simp add: sublist_Cons)
+done
+
+lemma sublist_update2: "i \<in> inds \<Longrightarrow> sublist (xs[i := v]) inds = (sublist xs inds)[(card {k \<in> inds. k < i}):= v]"
+proof (induct xs arbitrary: i inds)
+  case Nil thus ?case by simp
+next
+  case (Cons x xs)
+  thus ?case
+  proof (cases i)
+    case 0 with Cons show ?thesis by (simp add: sublist_Cons)
+  next
+    case (Suc i')
+    with Cons show ?thesis
+      apply simp
+      apply (simp add: sublist_Cons)
+      apply auto
+      apply (auto simp add: nat.split)
+      apply (simp add: card_less_Suc[symmetric])
+      apply (simp add: card_less_Suc2)
+      done
+  qed
+qed
+
+lemma sublist_update: "sublist (xs[i := v]) inds = (if i \<in> inds then (sublist xs inds)[(card {k \<in> inds. k < i}) := v] else sublist xs inds)"
+by (simp add: sublist_update1 sublist_update2)
+
+lemma sublist_take: "sublist xs {j. j < m} = take m xs"
+apply (induct xs arbitrary: m)
+apply simp
+apply (case_tac m)
+apply simp
+apply (simp add: sublist_Cons)
+done
+
+lemma sublist_take': "sublist xs {0..<m} = take m xs"
+apply (induct xs arbitrary: m)
+apply simp
+apply (case_tac m)
+apply simp
+apply (simp add: sublist_Cons sublist_take)
+done
+
+lemma sublist_all[simp]: "sublist xs {j. j < length xs} = xs"
+apply (induct xs)
+apply simp
+apply (simp add: sublist_Cons)
+done
+
+lemma sublist_all'[simp]: "sublist xs {0..<length xs} = xs"
+apply (induct xs)
+apply simp
+apply (simp add: sublist_Cons)
+done
+
+lemma sublist_single: "a < length xs \<Longrightarrow> sublist xs {a} = [xs ! a]"
+apply (induct xs arbitrary: a)
+apply simp
+apply(case_tac aa)
+apply simp
+apply (simp add: sublist_Cons)
+apply simp
+apply (simp add: sublist_Cons)
+done
+
+lemma sublist_is_Nil: "\<forall>i \<in> inds. i \<ge> length xs \<Longrightarrow> sublist xs inds = []" 
+apply (induct xs arbitrary: inds)
+apply simp
+apply (simp add: sublist_Cons)
+apply auto
+apply (erule_tac x="{j. Suc j \<in> inds}" in meta_allE)
+apply auto
+done
+
+lemma sublist_Nil': "sublist xs inds = [] \<Longrightarrow> \<forall>i \<in> inds. i \<ge> length xs"
+apply (induct xs arbitrary: inds)
+apply simp
+apply (simp add: sublist_Cons)
+apply (auto split: if_splits)
+apply (erule_tac x="{j. Suc j \<in> inds}" in meta_allE)
+apply (case_tac x, auto)
+done
+
+lemma sublist_Nil[simp]: "(sublist xs inds = []) = (\<forall>i \<in> inds. i \<ge> length xs)"
+apply (induct xs arbitrary: inds)
+apply simp
+apply (simp add: sublist_Cons)
+apply auto
+apply (erule_tac x="{j. Suc j \<in> inds}" in meta_allE)
+apply (case_tac x, auto)
+done
+
+lemma sublist_eq_subseteq: " \<lbrakk> inds' \<subseteq> inds; sublist xs inds = sublist ys inds \<rbrakk> \<Longrightarrow> sublist xs inds' = sublist ys inds'"
+apply (induct xs arbitrary: ys inds inds')
+apply simp
+apply (drule sym, rule sym)
+apply (simp add: sublist_Nil, fastsimp)
+apply (case_tac ys)
+apply (simp add: sublist_Nil, fastsimp)
+apply (auto simp add: sublist_Cons)
+apply (erule_tac x="list" in meta_allE)
+apply (erule_tac x="{j. Suc j \<in> inds}" in meta_allE)
+apply (erule_tac x="{j. Suc j \<in> inds'}" in meta_allE)
+apply fastsimp
+apply (erule_tac x="list" in meta_allE)
+apply (erule_tac x="{j. Suc j \<in> inds}" in meta_allE)
+apply (erule_tac x="{j. Suc j \<in> inds'}" in meta_allE)
+apply fastsimp
+done
+
+lemma sublist_eq: "\<lbrakk> \<forall>i \<in> inds. ((i < length xs) \<and> (i < length ys)) \<or> ((i \<ge> length xs ) \<and> (i \<ge> length ys)); \<forall>i \<in> inds. xs ! i = ys ! i \<rbrakk> \<Longrightarrow> sublist xs inds = sublist ys inds"
+apply (induct xs arbitrary: ys inds)
+apply simp
+apply (rule sym, simp add: sublist_Nil)
+apply (case_tac ys)
+apply (simp add: sublist_Nil)
+apply (auto simp add: sublist_Cons)
+apply (erule_tac x="list" in meta_allE)
+apply (erule_tac x="{j. Suc j \<in> inds}" in meta_allE)
+apply fastsimp
+apply (erule_tac x="list" in meta_allE)
+apply (erule_tac x="{j. Suc j \<in> inds}" in meta_allE)
+apply fastsimp
+done
+
+lemma sublist_eq_samelength: "\<lbrakk> length xs = length ys; \<forall>i \<in> inds. xs ! i = ys ! i \<rbrakk> \<Longrightarrow> sublist xs inds = sublist ys inds"
+by (rule sublist_eq, auto)
+
+lemma sublist_eq_samelength_iff: "length xs = length ys \<Longrightarrow> (sublist xs inds = sublist ys inds) = (\<forall>i \<in> inds. xs ! i = ys ! i)"
+apply (induct xs arbitrary: ys inds)
+apply simp
+apply (rule sym, simp add: sublist_Nil)
+apply (case_tac ys)
+apply (simp add: sublist_Nil)
+apply (auto simp add: sublist_Cons)
+apply (case_tac i)
+apply auto
+apply (case_tac i)
+apply auto
+done
+
+section {* Another sublist function *}
+
+function sublist' :: "nat \<Rightarrow> nat \<Rightarrow> 'a list \<Rightarrow> 'a list"
+where
+  "sublist' n m [] = []"
+| "sublist' n 0 xs = []"
+| "sublist' 0 (Suc m) (x#xs) = (x#sublist' 0 m xs)"
+| "sublist' (Suc n) (Suc m) (x#xs) = sublist' n m xs"
+by pat_completeness auto
+termination by lexicographic_order
+
+subsection {* Proving equivalence to the other sublist command *}
+
+lemma sublist'_sublist: "sublist' n m xs = sublist xs {j. n \<le> j \<and> j < m}"
+apply (induct xs arbitrary: n m)
+apply simp
+apply (case_tac n)
+apply (case_tac m)
+apply simp
+apply (simp add: sublist_Cons)
+apply (case_tac m)
+apply simp
+apply (simp add: sublist_Cons)
+done
+
+
+lemma "sublist' n m xs = sublist xs {n..<m}"
+apply (induct xs arbitrary: n m)
+apply simp
+apply (case_tac n, case_tac m)
+apply simp
+apply simp
+apply (simp add: sublist_take')
+apply (case_tac m)
+apply simp
+apply (simp add: sublist_Cons sublist'_sublist)
+done
+
+
+subsection {* Showing equivalence to use of drop and take for definition *}
+
+lemma "sublist' n m xs = take (m - n) (drop n xs)"
+apply (induct xs arbitrary: n m)
+apply simp
+apply (case_tac m)
+apply simp
+apply (case_tac n)
+apply simp
+apply simp
+done
+
+subsection {* General lemma about sublist *}
+
+lemma sublist'_Nil[simp]: "sublist' i j [] = []"
+by simp
+
+lemma sublist'_Cons[simp]: "sublist' i (Suc j) (x#xs) = (case i of 0 \<Rightarrow> (x # sublist' 0 j xs) | Suc i' \<Rightarrow>  sublist' i' j xs)"
+by (cases i) auto
+
+lemma sublist'_Cons2[simp]: "sublist' i j (x#xs) = (if (j = 0) then [] else ((if (i = 0) then [x] else []) @ sublist' (i - 1) (j - 1) xs))"
+apply (cases j)
+apply auto
+apply (cases i)
+apply auto
+done
+
+lemma sublist_n_0: "sublist' n 0 xs = []"
+by (induct xs, auto)
+
+lemma sublist'_Nil': "n \<ge> m \<Longrightarrow> sublist' n m xs = []"
+apply (induct xs arbitrary: n m)
+apply simp
+apply (case_tac m)
+apply simp
+apply (case_tac n)
+apply simp
+apply simp
+done
+
+lemma sublist'_Nil2: "n \<ge> length xs \<Longrightarrow> sublist' n m xs = []"
+apply (induct xs arbitrary: n m)
+apply simp
+apply (case_tac m)
+apply simp
+apply (case_tac n)
+apply simp
+apply simp
+done
+
+lemma sublist'_Nil3: "(sublist' n m xs = []) = ((n \<ge> m) \<or> (n \<ge> length xs))"
+apply (induct xs arbitrary: n m)
+apply simp
+apply (case_tac m)
+apply simp
+apply (case_tac n)
+apply simp
+apply simp
+done
+
+lemma sublist'_notNil: "\<lbrakk> n < length xs; n < m \<rbrakk> \<Longrightarrow> sublist' n m xs \<noteq> []"
+apply (induct xs arbitrary: n m)
+apply simp
+apply (case_tac m)
+apply simp
+apply (case_tac n)
+apply simp
+apply simp
+done
+
+lemma sublist'_single: "n < length xs \<Longrightarrow> sublist' n (Suc n) xs = [xs ! n]"
+apply (induct xs arbitrary: n)
+apply simp
+apply simp
+apply (case_tac n)
+apply (simp add: sublist_n_0)
+apply simp
+done
+
+lemma sublist'_update1: "i \<ge> m \<Longrightarrow> sublist' n m (xs[i:=v]) = sublist' n m xs"
+apply (induct xs arbitrary: n m i)
+apply simp
+apply simp
+apply (case_tac i)
+apply simp
+apply simp
+done
+
+lemma sublist'_update2: "i < n \<Longrightarrow> sublist' n m (xs[i:=v]) = sublist' n m xs"
+apply (induct xs arbitrary: n m i)
+apply simp
+apply simp
+apply (case_tac i)
+apply simp
+apply simp
+done
+
+lemma sublist'_update3: "\<lbrakk>n \<le> i; i < m\<rbrakk> \<Longrightarrow> sublist' n m (xs[i := v]) = (sublist' n m xs)[i - n := v]"
+proof (induct xs arbitrary: n m i)
+  case Nil thus ?case by auto
+next
+  case (Cons x xs)
+  thus ?case
+    apply -
+    apply auto
+    apply (cases i)
+    apply auto
+    apply (cases i)
+    apply auto
+    done
+qed
+
+lemma "\<lbrakk> sublist' i j xs = sublist' i j ys; n \<ge> i; m \<le> j \<rbrakk> \<Longrightarrow> sublist' n m xs = sublist' n m ys"
+proof (induct xs arbitrary: i j ys n m)
+  case Nil
+  thus ?case
+    apply -
+    apply (rule sym, drule sym)
+    apply (simp add: sublist'_Nil)
+    apply (simp add: sublist'_Nil3)
+    apply arith
+    done
+next
+  case (Cons x xs i j ys n m)
+  note c = this
+  thus ?case
+  proof (cases m)
+    case 0 thus ?thesis by (simp add: sublist_n_0)
+  next
+    case (Suc m')
+    note a = this
+    thus ?thesis
+    proof (cases n)
+      case 0 note b = this
+      show ?thesis
+      proof (cases ys)
+	case Nil  with a b Cons.prems show ?thesis by (simp add: sublist'_Nil3)
+      next
+	case (Cons y ys)
+	show ?thesis
+	proof (cases j)
+	  case 0 with a b Cons.prems show ?thesis by simp
+	next
+	  case (Suc j') with a b Cons.prems Cons show ?thesis 
+	    apply -
+	    apply (simp, rule Cons.hyps [of "0" "j'" "ys" "0" "m'"], auto)
+	    done
+	qed
+      qed
+    next
+      case (Suc n')
+      show ?thesis
+      proof (cases ys)
+	case Nil with Suc a Cons.prems show ?thesis by (auto simp add: sublist'_Nil3)
+      next
+	case (Cons y ys) with Suc a Cons.prems show ?thesis
+	  apply -
+	  apply simp
+	  apply (cases j)
+	  apply simp
+	  apply (cases i)
+	  apply simp
+	  apply (rule_tac j="nat" in Cons.hyps [of "0" _ "ys" "n'" "m'"])
+	  apply simp
+	  apply simp
+	  apply simp
+	  apply simp
+	  apply (rule_tac i="nata" and j="nat" in Cons.hyps [of _ _ "ys" "n'" "m'"])
+	  apply simp
+	  apply simp
+	  apply simp
+	  done
+      qed
+    qed
+  qed
+qed
+
+lemma length_sublist': "j \<le> length xs \<Longrightarrow> length (sublist' i j xs) = j - i"
+by (induct xs arbitrary: i j, auto)
+
+lemma sublist'_front: "\<lbrakk> i < j; i < length xs \<rbrakk> \<Longrightarrow> sublist' i j xs = xs ! i # sublist' (Suc i) j xs"
+apply (induct xs arbitrary: a i j)
+apply simp
+apply (case_tac j)
+apply simp
+apply (case_tac i)
+apply simp
+apply simp
+done
+
+lemma sublist'_back: "\<lbrakk> i < j; j \<le> length xs \<rbrakk> \<Longrightarrow> sublist' i j xs = sublist' i (j - 1) xs @ [xs ! (j - 1)]"
+apply (induct xs arbitrary: a i j)
+apply simp
+apply simp
+apply (case_tac j)
+apply simp
+apply auto
+apply (case_tac nat)
+apply auto
+done
+
+(* suffices that j \<le> length xs and length ys *) 
+lemma sublist'_eq_samelength_iff: "length xs = length ys \<Longrightarrow> (sublist' i j xs  = sublist' i j ys) = (\<forall>i'. i \<le> i' \<and> i' < j \<longrightarrow> xs ! i' = ys ! i')"
+proof (induct xs arbitrary: ys i j)
+  case Nil thus ?case by simp
+next
+  case (Cons x xs)
+  thus ?case
+    apply -
+    apply (cases ys)
+    apply simp
+    apply simp
+    apply auto
+    apply (case_tac i', auto)
+    apply (erule_tac x="Suc i'" in allE, auto)
+    apply (erule_tac x="i' - 1" in allE, auto)
+    apply (case_tac i', auto)
+    apply (erule_tac x="Suc i'" in allE, auto)
+    done
+qed
+
+lemma sublist'_all[simp]: "sublist' 0 (length xs) xs = xs"
+by (induct xs, auto)
+
+lemma sublist'_sublist': "sublist' n m (sublist' i j xs) = sublist' (i + n) (min (i + m) j) xs" 
+by (induct xs arbitrary: i j n m) (auto simp add: min_diff)
+
+lemma sublist'_append: "\<lbrakk> i \<le> j; j \<le> k \<rbrakk> \<Longrightarrow>(sublist' i j xs) @ (sublist' j k xs) = sublist' i k xs"
+by (induct xs arbitrary: i j k) auto
+
+lemma nth_sublist': "\<lbrakk> k < j - i; j \<le> length xs \<rbrakk> \<Longrightarrow> (sublist' i j xs) ! k = xs ! (i + k)"
+apply (induct xs arbitrary: i j k)
+apply auto
+apply (case_tac k)
+apply auto
+apply (case_tac i)
+apply auto
+done
+
+lemma set_sublist': "set (sublist' i j xs) = {x. \<exists>k. i \<le> k \<and> k < j \<and> k < List.length xs \<and> x = xs ! k}"
+apply (simp add: sublist'_sublist)
+apply (simp add: set_sublist)
+apply auto
+done
+
+lemma all_in_set_sublist'_conv: "(\<forall>j. j \<in> set (sublist' l r xs) \<longrightarrow> P j) = (\<forall>k. l \<le> k \<and> k < r \<and> k < List.length xs \<longrightarrow> P (xs ! k))"
+unfolding set_sublist' by blast
+
+lemma ball_in_set_sublist'_conv: "(\<forall>j \<in> set (sublist' l r xs). P j) = (\<forall>k. l \<le> k \<and> k < r \<and> k < List.length xs \<longrightarrow> P (xs ! k))"
+unfolding set_sublist' by blast
+
+
+lemma multiset_of_sublist:
+assumes l_r: "l \<le> r \<and> r \<le> List.length xs"
+assumes left: "\<forall> i. i < l \<longrightarrow> (xs::'a list) ! i = ys ! i"
+assumes right: "\<forall> i. i \<ge> r \<longrightarrow> (xs::'a list) ! i = ys ! i"
+assumes multiset: "multiset_of xs = multiset_of ys"
+  shows "multiset_of (sublist' l r xs) = multiset_of (sublist' l r ys)"
+proof -
+  from l_r have xs_def: "xs = (sublist' 0 l xs) @ (sublist' l r xs) @ (sublist' r (List.length xs) xs)" (is "_ = ?xs_long") 
+    by (simp add: sublist'_append)
+  from multiset have length_eq: "List.length xs = List.length ys" by (rule multiset_of_eq_length)
+  with l_r have ys_def: "ys = (sublist' 0 l ys) @ (sublist' l r ys) @ (sublist' r (List.length ys) ys)" (is "_ = ?ys_long") 
+    by (simp add: sublist'_append)
+  from xs_def ys_def multiset have "multiset_of ?xs_long = multiset_of ?ys_long" by simp
+  moreover
+  from left l_r length_eq have "sublist' 0 l xs = sublist' 0 l ys"
+    by (auto simp add: length_sublist' nth_sublist' intro!: nth_equalityI)
+  moreover
+  from right l_r length_eq have "sublist' r (List.length xs) xs = sublist' r (List.length ys) ys"
+    by (auto simp add: length_sublist' nth_sublist' intro!: nth_equalityI)
+  moreover
+  ultimately show ?thesis by (simp add: multiset_of_append)
+qed
+
+
+end
diff -r 2d1d426e00e4 -r b14b2cc4e25e src/HOL/IsaMakefile
--- a/src/HOL/IsaMakefile	Mon Mar 23 19:01:17 2009 +0100
+++ b/src/HOL/IsaMakefile	Mon Mar 23 19:01:17 2009 +0100
@@ -649,7 +649,11 @@
 $(LOG)/HOL-Imperative_HOL.gz: $(OUT)/HOL Imperative_HOL/Heap.thy \
   Imperative_HOL/Heap_Monad.thy Imperative_HOL/Array.thy \
   Imperative_HOL/Relational.thy \
-  Imperative_HOL/Ref.thy Imperative_HOL/Imperative_HOL.thy
+  Imperative_HOL/Ref.thy Imperative_HOL/Imperative_HOL.thy \
+  Imperative_HOL/Imperative_HOL_ex.thy \
+  Imperative_HOL/ex/Imperative_Quicksort.thy \
+  Imperative_HOL/ex/Subarray.thy \
+  Imperative_HOL/ex/Sublist.thy
 	@$(ISABELLE_TOOL) usedir $(OUT)/HOL Imperative_HOL
 
 
@@ -836,7 +840,7 @@
   ex/Formal_Power_Series_Examples.thy ex/Fundefs.thy			\
   ex/Groebner_Examples.thy ex/Guess.thy ex/HarmonicSeries.thy		\
   ex/Hebrew.thy ex/Hex_Bin_Examples.thy ex/Higher_Order_Logic.thy	\
-  ex/Hilbert_Classical.thy ex/ImperativeQuicksort.thy			\
+  ex/Hilbert_Classical.thy			\
   ex/Induction_Scheme.thy ex/InductiveInvariant.thy			\
   ex/InductiveInvariant_examples.thy ex/Intuitionistic.thy		\
   ex/Lagrange.thy ex/LocaleTest2.thy ex/MT.thy ex/MergeSort.thy		\
@@ -845,8 +849,8 @@
   ex/Quickcheck_Examples.thy ex/Quickcheck_Generators.thy ex/ROOT.ML	\
   ex/Recdefs.thy ex/Records.thy ex/ReflectionEx.thy			\
   ex/Refute_Examples.thy ex/SAT_Examples.thy ex/SVC_Oracle.thy		\
-  ex/Serbian.thy ex/Sqrt.thy ex/Sqrt_Script.thy ex/Subarray.thy		\
-  ex/Sublist.thy ex/Sudoku.thy ex/Tarski.thy ex/Term_Of_Syntax.thy	\
+  ex/Serbian.thy ex/Sqrt.thy ex/Sqrt_Script.thy \
+  ex/Sudoku.thy ex/Tarski.thy ex/Term_Of_Syntax.thy	\
   ex/Termination.thy ex/Unification.thy ex/document/root.bib		\
   ex/document/root.tex ex/set.thy ex/svc_funcs.ML ex/svc_test.thy \
   ex/Predicate_Compile.thy ex/predicate_compile.ML
diff -r 2d1d426e00e4 -r b14b2cc4e25e src/HOL/ex/ImperativeQuicksort.thy
--- a/src/HOL/ex/ImperativeQuicksort.thy	Mon Mar 23 19:01:17 2009 +0100
+++ /dev/null	Thu Jan 01 00:00:00 1970 +0000
@@ -1,637 +0,0 @@
-theory ImperativeQuicksort
-imports "~~/src/HOL/Imperative_HOL/Imperative_HOL" Subarray Multiset Efficient_Nat
-begin
-
-text {* We prove QuickSort correct in the Relational Calculus. *}
-
-definition swap :: "nat array \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> unit Heap"
-where
-  "swap arr i j = (
-     do
-       x \<leftarrow> nth arr i;
-       y \<leftarrow> nth arr j;
-       upd i y arr;
-       upd j x arr;
-       return ()
-     done)"
-
-lemma swap_permutes:
-  assumes "crel (swap a i j) h h' rs"
-  shows "multiset_of (get_array a h') 
-  = multiset_of (get_array a h)"
-  using assms
-  unfolding swap_def
-  by (auto simp add: Heap.length_def multiset_of_swap dest: sym [of _ "h'"] elim!: crelE crel_nth crel_return crel_upd)
-
-function part1 :: "nat array \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> nat Heap"
-where
-  "part1 a left right p = (
-     if (right \<le> left) then return right
-     else (do
-       v \<leftarrow> nth a left;
-       (if (v \<le> p) then (part1 a (left + 1) right p)
-                    else (do swap a left right;
-  part1 a left (right - 1) p done))
-     done))"
-by pat_completeness auto
-
-termination
-by (relation "measure (\<lambda>(_,l,r,_). r - l )") auto
-
-declare part1.simps[simp del]
-
-lemma part_permutes:
-  assumes "crel (part1 a l r p) h h' rs"
-  shows "multiset_of (get_array a h') 
-  = multiset_of (get_array a h)"
-  using assms
-proof (induct a l r p arbitrary: h h' rs rule:part1.induct)
-  case (1 a l r p h h' rs)
-  thus ?case
-    unfolding part1.simps [of a l r p]
-    by (elim crelE crel_if crel_return crel_nth) (auto simp add: swap_permutes)
-qed
-
-lemma part_returns_index_in_bounds:
-  assumes "crel (part1 a l r p) h h' rs"
-  assumes "l \<le> r"
-  shows "l \<le> rs \<and> rs \<le> r"
-using assms
-proof (induct a l r p arbitrary: h h' rs rule:part1.induct)
-  case (1 a l r p h h' rs)
-  note cr = `crel (part1 a l r p) h h' rs`
-  show ?case
-  proof (cases "r \<le> l")
-    case True (* Terminating case *)
-    with cr `l \<le> r` show ?thesis
-      unfolding part1.simps[of a l r p]
-      by (elim crelE crel_if crel_return crel_nth) auto
-  next
-    case False (* recursive case *)
-    note rec_condition = this
-    let ?v = "get_array a h ! l"
-    show ?thesis
-    proof (cases "?v \<le> p")
-      case True
-      with cr False
-      have rec1: "crel (part1 a (l + 1) r p) h h' rs"
-        unfolding part1.simps[of a l r p]
-        by (elim crelE crel_nth crel_if crel_return) auto
-      from rec_condition have "l + 1 \<le> r" by arith
-      from 1(1)[OF rec_condition True rec1 `l + 1 \<le> r`]
-      show ?thesis by simp
-    next
-      case False
-      with rec_condition cr
-      obtain h1 where swp: "crel (swap a l r) h h1 ()"
-        and rec2: "crel (part1 a l (r - 1) p) h1 h' rs"
-        unfolding part1.simps[of a l r p]
-        by (elim crelE crel_nth crel_if crel_return) auto
-      from rec_condition have "l \<le> r - 1" by arith
-      from 1(2) [OF rec_condition False rec2 `l \<le> r - 1`] show ?thesis by fastsimp
-    qed
-  qed
-qed
-
-lemma part_length_remains:
-  assumes "crel (part1 a l r p) h h' rs"
-  shows "Heap.length a h = Heap.length a h'"
-using assms
-proof (induct a l r p arbitrary: h h' rs rule:part1.induct)
-  case (1 a l r p h h' rs)
-  note cr = `crel (part1 a l r p) h h' rs`
-  
-  show ?case
-  proof (cases "r \<le> l")
-    case True (* Terminating case *)
-    with cr show ?thesis
-      unfolding part1.simps[of a l r p]
-      by (elim crelE crel_if crel_return crel_nth) auto
-  next
-    case False (* recursive case *)
-    with cr 1 show ?thesis
-      unfolding part1.simps [of a l r p] swap_def
-      by (auto elim!: crelE crel_if crel_nth crel_return crel_upd) fastsimp
-  qed
-qed
-
-lemma part_outer_remains:
-  assumes "crel (part1 a l r p) h h' rs"
-  shows "\<forall>i. i < l \<or> r < i \<longrightarrow> get_array (a::nat array) h ! i = get_array a h' ! i"
-  using assms
-proof (induct a l r p arbitrary: h h' rs rule:part1.induct)
-  case (1 a l r p h h' rs)
-  note cr = `crel (part1 a l r p) h h' rs`
-  
-  show ?case
-  proof (cases "r \<le> l")
-    case True (* Terminating case *)
-    with cr show ?thesis
-      unfolding part1.simps[of a l r p]
-      by (elim crelE crel_if crel_return crel_nth) auto
-  next
-    case False (* recursive case *)
-    note rec_condition = this
-    let ?v = "get_array a h ! l"
-    show ?thesis
-    proof (cases "?v \<le> p")
-      case True
-      with cr False
-      have rec1: "crel (part1 a (l + 1) r p) h h' rs"
-        unfolding part1.simps[of a l r p]
-        by (elim crelE crel_nth crel_if crel_return) auto
-      from 1(1)[OF rec_condition True rec1]
-      show ?thesis by fastsimp
-    next
-      case False
-      with rec_condition cr
-      obtain h1 where swp: "crel (swap a l r) h h1 ()"
-        and rec2: "crel (part1 a l (r - 1) p) h1 h' rs"
-        unfolding part1.simps[of a l r p]
-        by (elim crelE crel_nth crel_if crel_return) auto
-      from swp rec_condition have
-        "\<forall>i. i < l \<or> r < i \<longrightarrow> get_array a h ! i = get_array a h1 ! i"
-	unfolding swap_def
-	by (elim crelE crel_nth crel_upd crel_return) auto
-      with 1(2) [OF rec_condition False rec2] show ?thesis by fastsimp
-    qed
-  qed
-qed
-
-
-lemma part_partitions:
-  assumes "crel (part1 a l r p) h h' rs"
-  shows "(\<forall>i. l \<le> i \<and> i < rs \<longrightarrow> get_array (a::nat array) h' ! i \<le> p)
-  \<and> (\<forall>i. rs < i \<and> i \<le> r \<longrightarrow> get_array a h' ! i \<ge> p)"
-  using assms
-proof (induct a l r p arbitrary: h h' rs rule:part1.induct)
-  case (1 a l r p h h' rs)
-  note cr = `crel (part1 a l r p) h h' rs`
-  
-  show ?case
-  proof (cases "r \<le> l")
-    case True (* Terminating case *)
-    with cr have "rs = r"
-      unfolding part1.simps[of a l r p]
-      by (elim crelE crel_if crel_return crel_nth) auto
-    with True
-    show ?thesis by auto
-  next
-    case False (* recursive case *)
-    note lr = this
-    let ?v = "get_array a h ! l"
-    show ?thesis
-    proof (cases "?v \<le> p")
-      case True
-      with lr cr
-      have rec1: "crel (part1 a (l + 1) r p) h h' rs"
-        unfolding part1.simps[of a l r p]
-        by (elim crelE crel_nth crel_if crel_return) auto
-      from True part_outer_remains[OF rec1] have a_l: "get_array a h' ! l \<le> p"
-	by fastsimp
-      have "\<forall>i. (l \<le> i = (l = i \<or> Suc l \<le> i))" by arith
-      with 1(1)[OF False True rec1] a_l show ?thesis
-	by auto
-    next
-      case False
-      with lr cr
-      obtain h1 where swp: "crel (swap a l r) h h1 ()"
-        and rec2: "crel (part1 a l (r - 1) p) h1 h' rs"
-        unfolding part1.simps[of a l r p]
-        by (elim crelE crel_nth crel_if crel_return) auto
-      from swp False have "get_array a h1 ! r \<ge> p"
-	unfolding swap_def
-	by (auto simp add: Heap.length_def elim!: crelE crel_nth crel_upd crel_return)
-      with part_outer_remains [OF rec2] lr have a_r: "get_array a h' ! r \<ge> p"
-	by fastsimp
-      have "\<forall>i. (i \<le> r = (i = r \<or> i \<le> r - 1))" by arith
-      with 1(2)[OF lr False rec2] a_r show ?thesis
-	by auto
-    qed
-  qed
-qed
-
-
-fun partition :: "nat array \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> nat Heap"
-where
-  "partition a left right = (do
-     pivot \<leftarrow> nth a right;
-     middle \<leftarrow> part1 a left (right - 1) pivot;
-     v \<leftarrow> nth a middle;
-     m \<leftarrow> return (if (v \<le> pivot) then (middle + 1) else middle);
-     swap a m right;
-     return m
-   done)"
-
-declare partition.simps[simp del]
-
-lemma partition_permutes:
-  assumes "crel (partition a l r) h h' rs"
-  shows "multiset_of (get_array a h') 
-  = multiset_of (get_array a h)"
-proof -
-    from assms part_permutes swap_permutes show ?thesis
-      unfolding partition.simps
-      by (elim crelE crel_return crel_nth crel_if crel_upd) auto
-qed
-
-lemma partition_length_remains:
-  assumes "crel (partition a l r) h h' rs"
-  shows "Heap.length a h = Heap.length a h'"
-proof -
-  from assms part_length_remains show ?thesis
-    unfolding partition.simps swap_def
-    by (elim crelE crel_return crel_nth crel_if crel_upd) auto
-qed
-
-lemma partition_outer_remains:
-  assumes "crel (partition a l r) h h' rs"
-  assumes "l < r"
-  shows "\<forall>i. i < l \<or> r < i \<longrightarrow> get_array (a::nat array) h ! i = get_array a h' ! i"
-proof -
-  from assms part_outer_remains part_returns_index_in_bounds show ?thesis
-    unfolding partition.simps swap_def
-    by (elim crelE crel_return crel_nth crel_if crel_upd) fastsimp
-qed
-
-lemma partition_returns_index_in_bounds:
-  assumes crel: "crel (partition a l r) h h' rs"
-  assumes "l < r"
-  shows "l \<le> rs \<and> rs \<le> r"
-proof -
-  from crel obtain middle h'' p where part: "crel (part1 a l (r - 1) p) h h'' middle"
-    and rs_equals: "rs = (if get_array a h'' ! middle \<le> get_array a h ! r then middle + 1
-         else middle)"
-    unfolding partition.simps
-    by (elim crelE crel_return crel_nth crel_if crel_upd) simp
-  from `l < r` have "l \<le> r - 1" by arith
-  from part_returns_index_in_bounds[OF part this] rs_equals `l < r` show ?thesis by auto
-qed
-
-lemma partition_partitions:
-  assumes crel: "crel (partition a l r) h h' rs"
-  assumes "l < r"
-  shows "(\<forall>i. l \<le> i \<and> i < rs \<longrightarrow> get_array (a::nat array) h' ! i \<le> get_array a h' ! rs) \<and>
-  (\<forall>i. rs < i \<and> i \<le> r \<longrightarrow> get_array a h' ! rs \<le> get_array a h' ! i)"
-proof -
-  let ?pivot = "get_array a h ! r" 
-  from crel obtain middle h1 where part: "crel (part1 a l (r - 1) ?pivot) h h1 middle"
-    and swap: "crel (swap a rs r) h1 h' ()"
-    and rs_equals: "rs = (if get_array a h1 ! middle \<le> ?pivot then middle + 1
-         else middle)"
-    unfolding partition.simps
-    by (elim crelE crel_return crel_nth crel_if crel_upd) simp
-  from swap have h'_def: "h' = Heap.upd a r (get_array a h1 ! rs)
-    (Heap.upd a rs (get_array a h1 ! r) h1)"
-    unfolding swap_def
-    by (elim crelE crel_return crel_nth crel_upd) simp
-  from swap have in_bounds: "r < Heap.length a h1 \<and> rs < Heap.length a h1"
-    unfolding swap_def
-    by (elim crelE crel_return crel_nth crel_upd) simp
-  from swap have swap_length_remains: "Heap.length a h1 = Heap.length a h'"
-    unfolding swap_def by (elim crelE crel_return crel_nth crel_upd) auto
-  from `l < r` have "l \<le> r - 1" by simp 
-  note middle_in_bounds = part_returns_index_in_bounds[OF part this]
-  from part_outer_remains[OF part] `l < r`
-  have "get_array a h ! r = get_array a h1 ! r"
-    by fastsimp
-  with swap
-  have right_remains: "get_array a h ! r = get_array a h' ! rs"
-    unfolding swap_def
-    by (auto simp add: Heap.length_def elim!: crelE crel_return crel_nth crel_upd) (cases "r = rs", auto)
-  from part_partitions [OF part]
-  show ?thesis
-  proof (cases "get_array a h1 ! middle \<le> ?pivot")
-    case True
-    with rs_equals have rs_equals: "rs = middle + 1" by simp
-    { 
-      fix i
-      assume i_is_left: "l \<le> i \<and> i < rs"
-      with swap_length_remains in_bounds middle_in_bounds rs_equals `l < r`
-      have i_props: "i < Heap.length a h'" "i \<noteq> r" "i \<noteq> rs" by auto
-      from i_is_left rs_equals have "l \<le> i \<and> i < middle \<or> i = middle" by arith
-      with part_partitions[OF part] right_remains True
-      have "get_array a h1 ! i \<le> get_array a h' ! rs" by fastsimp
-      with i_props h'_def in_bounds have "get_array a h' ! i \<le> get_array a h' ! rs"
-	unfolding Heap.upd_def Heap.length_def by simp
-    }
-    moreover
-    {
-      fix i
-      assume "rs < i \<and> i \<le> r"
-
-      hence "(rs < i \<and> i \<le> r - 1) \<or> (rs < i \<and> i = r)" by arith
-      hence "get_array a h' ! rs \<le> get_array a h' ! i"
-      proof
-	assume i_is: "rs < i \<and> i \<le> r - 1"
-	with swap_length_remains in_bounds middle_in_bounds rs_equals
-	have i_props: "i < Heap.length a h'" "i \<noteq> r" "i \<noteq> rs" by auto
-	from part_partitions[OF part] rs_equals right_remains i_is
-	have "get_array a h' ! rs \<le> get_array a h1 ! i"
-	  by fastsimp
-	with i_props h'_def show ?thesis by fastsimp
-      next
-	assume i_is: "rs < i \<and> i = r"
-	with rs_equals have "Suc middle \<noteq> r" by arith
-	with middle_in_bounds `l < r` have "Suc middle \<le> r - 1" by arith
-	with part_partitions[OF part] right_remains 
-	have "get_array a h' ! rs \<le> get_array a h1 ! (Suc middle)"
-	  by fastsimp
-	with i_is True rs_equals right_remains h'_def
-	show ?thesis using in_bounds
-	  unfolding Heap.upd_def Heap.length_def
-	  by auto
-      qed
-    }
-    ultimately show ?thesis by auto
-  next
-    case False
-    with rs_equals have rs_equals: "middle = rs" by simp
-    { 
-      fix i
-      assume i_is_left: "l \<le> i \<and> i < rs"
-      with swap_length_remains in_bounds middle_in_bounds rs_equals
-      have i_props: "i < Heap.length a h'" "i \<noteq> r" "i \<noteq> rs" by auto
-      from part_partitions[OF part] rs_equals right_remains i_is_left
-      have "get_array a h1 ! i \<le> get_array a h' ! rs" by fastsimp
-      with i_props h'_def have "get_array a h' ! i \<le> get_array a h' ! rs"
-	unfolding Heap.upd_def by simp
-    }
-    moreover
-    {
-      fix i
-      assume "rs < i \<and> i \<le> r"
-      hence "(rs < i \<and> i \<le> r - 1) \<or> i = r" by arith
-      hence "get_array a h' ! rs \<le> get_array a h' ! i"
-      proof
-	assume i_is: "rs < i \<and> i \<le> r - 1"
-	with swap_length_remains in_bounds middle_in_bounds rs_equals
-	have i_props: "i < Heap.length a h'" "i \<noteq> r" "i \<noteq> rs" by auto
-	from part_partitions[OF part] rs_equals right_remains i_is
-	have "get_array a h' ! rs \<le> get_array a h1 ! i"
-	  by fastsimp
-	with i_props h'_def show ?thesis by fastsimp
-      next
-	assume i_is: "i = r"
-	from i_is False rs_equals right_remains h'_def
-	show ?thesis using in_bounds
-	  unfolding Heap.upd_def Heap.length_def
-	  by auto
-      qed
-    }
-    ultimately
-    show ?thesis by auto
-  qed
-qed
-
-
-function quicksort :: "nat array \<Rightarrow> nat \<Rightarrow> nat \<Rightarrow> unit Heap"
-where
-  "quicksort arr left right =
-     (if (right > left)  then
-        do
-          pivotNewIndex \<leftarrow> partition arr left right;
-          pivotNewIndex \<leftarrow> assert (\<lambda>x. left \<le> x \<and> x \<le> right) pivotNewIndex;
-          quicksort arr left (pivotNewIndex - 1);
-          quicksort arr (pivotNewIndex + 1) right
-        done
-     else return ())"
-by pat_completeness auto
-
-(* For termination, we must show that the pivotNewIndex is between left and right *) 
-termination
-by (relation "measure (\<lambda>(a, l, r). (r - l))") auto
-
-declare quicksort.simps[simp del]
-
-
-lemma quicksort_permutes:
-  assumes "crel (quicksort a l r) h h' rs"
-  shows "multiset_of (get_array a h') 
-  = multiset_of (get_array a h)"
-  using assms
-proof (induct a l r arbitrary: h h' rs rule: quicksort.induct)
-  case (1 a l r h h' rs)
-  with partition_permutes show ?case
-    unfolding quicksort.simps [of a l r]
-    by (elim crel_if crelE crel_assert crel_return) auto
-qed
-
-lemma length_remains:
-  assumes "crel (quicksort a l r) h h' rs"
-  shows "Heap.length a h = Heap.length a h'"
-using assms
-proof (induct a l r arbitrary: h h' rs rule: quicksort.induct)
-  case (1 a l r h h' rs)
-  with partition_length_remains show ?case
-    unfolding quicksort.simps [of a l r]
-    by (elim crel_if crelE crel_assert crel_return) auto
-qed
-
-lemma quicksort_outer_remains:
-  assumes "crel (quicksort a l r) h h' rs"
-   shows "\<forall>i. i < l \<or> r < i \<longrightarrow> get_array (a::nat array) h ! i = get_array a h' ! i"
-  using assms
-proof (induct a l r arbitrary: h h' rs rule: quicksort.induct)
-  case (1 a l r h h' rs)
-  note cr = `crel (quicksort a l r) h h' rs`
-  thus ?case
-  proof (cases "r > l")
-    case False
-    with cr have "h' = h"
-      unfolding quicksort.simps [of a l r]
-      by (elim crel_if crel_return) auto
-    thus ?thesis by simp
-  next
-  case True
-   { 
-      fix h1 h2 p ret1 ret2 i
-      assume part: "crel (partition a l r) h h1 p"
-      assume qs1: "crel (quicksort a l (p - 1)) h1 h2 ret1"
-      assume qs2: "crel (quicksort a (p + 1) r) h2 h' ret2"
-      assume pivot: "l \<le> p \<and> p \<le> r"
-      assume i_outer: "i < l \<or> r < i"
-      from  partition_outer_remains [OF part True] i_outer
-      have "get_array a h !i = get_array a h1 ! i" by fastsimp
-      moreover
-      with 1(1) [OF True pivot qs1] pivot i_outer
-      have "get_array a h1 ! i = get_array a h2 ! i" by auto
-      moreover
-      with qs2 1(2) [of p h2 h' ret2] True pivot i_outer
-      have "get_array a h2 ! i = get_array a h' ! i" by auto
-      ultimately have "get_array a h ! i= get_array a h' ! i" by simp
-    }
-    with cr show ?thesis
-      unfolding quicksort.simps [of a l r]
-      by (elim crel_if crelE crel_assert crel_return) auto
-  qed
-qed
-
-lemma quicksort_is_skip:
-  assumes "crel (quicksort a l r) h h' rs"
-  shows "r \<le> l \<longrightarrow> h = h'"
-  using assms
-  unfolding quicksort.simps [of a l r]
-  by (elim crel_if crel_return) auto
- 
-lemma quicksort_sorts:
-  assumes "crel (quicksort a l r) h h' rs"
-  assumes l_r_length: "l < Heap.length a h" "r < Heap.length a h" 
-  shows "sorted (subarray l (r + 1) a h')"
-  using assms
-proof (induct a l r arbitrary: h h' rs rule: quicksort.induct)
-  case (1 a l r h h' rs)
-  note cr = `crel (quicksort a l r) h h' rs`
-  thus ?case
-  proof (cases "r > l")
-    case False
-    hence "l \<ge> r + 1 \<or> l = r" by arith 
-    with length_remains[OF cr] 1(5) show ?thesis
-      by (auto simp add: subarray_Nil subarray_single)
-  next
-    case True
-    { 
-      fix h1 h2 p
-      assume part: "crel (partition a l r) h h1 p"
-      assume qs1: "crel (quicksort a l (p - 1)) h1 h2 ()"
-      assume qs2: "crel (quicksort a (p + 1) r) h2 h' ()"
-      from partition_returns_index_in_bounds [OF part True]
-      have pivot: "l\<le> p \<and> p \<le> r" .
-     note length_remains = length_remains[OF qs2] length_remains[OF qs1] partition_length_remains[OF part]
-      from quicksort_outer_remains [OF qs2] quicksort_outer_remains [OF qs1] pivot quicksort_is_skip[OF qs1]
-      have pivot_unchanged: "get_array a h1 ! p = get_array a h' ! p" by (cases p, auto)
-        (*-- First of all, by induction hypothesis both sublists are sorted. *)
-      from 1(1)[OF True pivot qs1] length_remains pivot 1(5) 
-      have IH1: "sorted (subarray l p a h2)"  by (cases p, auto simp add: subarray_Nil)
-      from quicksort_outer_remains [OF qs2] length_remains
-      have left_subarray_remains: "subarray l p a h2 = subarray l p a h'"
-	by (simp add: subarray_eq_samelength_iff)
-      with IH1 have IH1': "sorted (subarray l p a h')" by simp
-      from 1(2)[OF True pivot qs2] pivot 1(5) length_remains
-      have IH2: "sorted (subarray (p + 1) (r + 1) a h')"
-        by (cases "Suc p \<le> r", auto simp add: subarray_Nil)
-           (* -- Secondly, both sublists remain partitioned. *)
-      from partition_partitions[OF part True]
-      have part_conds1: "\<forall>j. j \<in> set (subarray l p a h1) \<longrightarrow> j \<le> get_array a h1 ! p "
-        and part_conds2: "\<forall>j. j \<in> set (subarray (p + 1) (r + 1) a h1) \<longrightarrow> get_array a h1 ! p \<le> j"
-        by (auto simp add: all_in_set_subarray_conv)
-      from quicksort_outer_remains [OF qs1] quicksort_permutes [OF qs1] True
-        length_remains 1(5) pivot multiset_of_sublist [of l p "get_array a h1" "get_array a h2"]
-      have multiset_partconds1: "multiset_of (subarray l p a h2) = multiset_of (subarray l p a h1)"
-	unfolding Heap.length_def subarray_def by (cases p, auto)
-      with left_subarray_remains part_conds1 pivot_unchanged
-      have part_conds2': "\<forall>j. j \<in> set (subarray l p a h') \<longrightarrow> j \<le> get_array a h' ! p"
-        by (simp, subst set_of_multiset_of[symmetric], simp)
-          (* -- These steps are the analogous for the right sublist \<dots> *)
-      from quicksort_outer_remains [OF qs1] length_remains
-      have right_subarray_remains: "subarray (p + 1) (r + 1) a h1 = subarray (p + 1) (r + 1) a h2"
-	by (auto simp add: subarray_eq_samelength_iff)
-      from quicksort_outer_remains [OF qs2] quicksort_permutes [OF qs2] True
-        length_remains 1(5) pivot multiset_of_sublist [of "p + 1" "r + 1" "get_array a h2" "get_array a h'"]
-      have multiset_partconds2: "multiset_of (subarray (p + 1) (r + 1) a h') = multiset_of (subarray (p + 1) (r + 1) a h2)"
-        unfolding Heap.length_def subarray_def by auto
-      with right_subarray_remains part_conds2 pivot_unchanged
-      have part_conds1': "\<forall>j. j \<in> set (subarray (p + 1) (r + 1) a h') \<longrightarrow> get_array a h' ! p \<le> j"
-        by (simp, subst set_of_multiset_of[symmetric], simp)
-          (* -- Thirdly and finally, we show that the array is sorted
-          following from the facts above. *)
-      from True pivot 1(5) length_remains have "subarray l (r + 1) a h' = subarray l p a h' @ [get_array a h' ! p] @ subarray (p + 1) (r + 1) a h'"
-	by (simp add: subarray_nth_array_Cons, cases "l < p") (auto simp add: subarray_append subarray_Nil)
-      with IH1' IH2 part_conds1' part_conds2' pivot have ?thesis
-	unfolding subarray_def
-	apply (auto simp add: sorted_append sorted_Cons all_in_set_sublist'_conv)
-	by (auto simp add: set_sublist' dest: le_trans [of _ "get_array a h' ! p"])
-    }
-    with True cr show ?thesis
-      unfolding quicksort.simps [of a l r]
-      by (elim crel_if crel_return crelE crel_assert) auto
-  qed
-qed
-
-
-lemma quicksort_is_sort:
-  assumes crel: "crel (quicksort a 0 (Heap.length a h - 1)) h h' rs"
-  shows "get_array a h' = sort (get_array a h)"
-proof (cases "get_array a h = []")
-  case True
-  with quicksort_is_skip[OF crel] show ?thesis
-  unfolding Heap.length_def by simp
-next
-  case False
-  from quicksort_sorts [OF crel] False have "sorted (sublist' 0 (List.length (get_array a h)) (get_array a h'))"
-    unfolding Heap.length_def subarray_def by auto
-  with length_remains[OF crel] have "sorted (get_array a h')"
-    unfolding Heap.length_def by simp
-  with quicksort_permutes [OF crel] properties_for_sort show ?thesis by fastsimp
-qed
-
-subsection {* No Errors in quicksort *}
-text {* We have proved that quicksort sorts (if no exceptions occur).
-We will now show that exceptions do not occur. *}
-
-lemma noError_part1: 
-  assumes "l < Heap.length a h" "r < Heap.length a h"
-  shows "noError (part1 a l r p) h"
-  using assms
-proof (induct a l r p arbitrary: h rule: part1.induct)
-  case (1 a l r p)
-  thus ?case
-    unfolding part1.simps [of a l r] swap_def
-    by (auto intro!: noError_if noErrorI noError_return noError_nth noError_upd elim!: crelE crel_upd crel_nth crel_return)
-qed
-
-lemma noError_partition:
-  assumes "l < r" "l < Heap.length a h" "r < Heap.length a h"
-  shows "noError (partition a l r) h"
-using assms
-unfolding partition.simps swap_def
-apply (auto intro!: noError_if noErrorI noError_return noError_nth noError_upd noError_part1 elim!: crelE crel_upd crel_nth crel_return)
-apply (frule part_length_remains)
-apply (frule part_returns_index_in_bounds)
-apply auto
-apply (frule part_length_remains)
-apply (frule part_returns_index_in_bounds)
-apply auto
-apply (frule part_length_remains)
-apply auto
-done
-
-lemma noError_quicksort:
-  assumes "l < Heap.length a h" "r < Heap.length a h"
-  shows "noError (quicksort a l r) h"
-using assms
-proof (induct a l r arbitrary: h rule: quicksort.induct)
-  case (1 a l ri h)
-  thus ?case
-    unfolding quicksort.simps [of a l ri]
-    apply (auto intro!: noError_if noErrorI noError_return noError_nth noError_upd noError_assert noError_partition)
-    apply (frule partition_returns_index_in_bounds)
-    apply auto
-    apply (frule partition_returns_index_in_bounds)
-    apply auto
-    apply (auto elim!: crel_assert dest!: partition_length_remains length_remains)
-    apply (subgoal_tac "Suc r \<le> ri \<or> r = ri") 
-    apply (erule disjE)
-    apply auto
-    unfolding quicksort.simps [of a "Suc ri" ri]
-    apply (auto intro!: noError_if noError_return)
-    done
-qed
-
-
-subsection {* Example *}
-
-definition "qsort a = do
-    k \<leftarrow> length a;
-    quicksort a 0 (k - 1);
-    return a
-  done"
-
-ML {* @{code qsort} (Array.fromList [42, 2, 3, 5, 0, 1705, 8, 3, 15]) () *}
-
-export_code qsort in SML_imp module_name QSort
-export_code qsort in OCaml module_name QSort file -
-export_code qsort in OCaml_imp module_name QSort file -
-export_code qsort in Haskell module_name QSort file -
-
-end
\ No newline at end of file
diff -r 2d1d426e00e4 -r b14b2cc4e25e src/HOL/ex/ROOT.ML
--- a/src/HOL/ex/ROOT.ML	Mon Mar 23 19:01:17 2009 +0100
+++ b/src/HOL/ex/ROOT.ML	Mon Mar 23 19:01:17 2009 +0100
@@ -21,7 +21,6 @@
 
 use_thys [
   "Numeral",
-  "ImperativeQuicksort",
   "Higher_Order_Logic",
   "Abstract_NAT",
   "Guess",
diff -r 2d1d426e00e4 -r b14b2cc4e25e src/HOL/ex/Subarray.thy
--- a/src/HOL/ex/Subarray.thy	Mon Mar 23 19:01:17 2009 +0100
+++ /dev/null	Thu Jan 01 00:00:00 1970 +0000
@@ -1,66 +0,0 @@
-theory Subarray
-imports Array Sublist
-begin
-
-definition subarray :: "nat \<Rightarrow> nat \<Rightarrow> ('a::heap) array \<Rightarrow> heap \<Rightarrow> 'a list"
-where
-  "subarray n m a h \<equiv> sublist' n m (get_array a h)"
-
-lemma subarray_upd: "i \<ge> m \<Longrightarrow> subarray n m a (Heap.upd a i v h) = subarray n m a h"
-apply (simp add: subarray_def Heap.upd_def)
-apply (simp add: sublist'_update1)
-done
-
-lemma subarray_upd2: " i < n  \<Longrightarrow> subarray n m a (Heap.upd a i v h) = subarray n m a h"
-apply (simp add: subarray_def Heap.upd_def)
-apply (subst sublist'_update2)
-apply fastsimp
-apply simp
-done
-
-lemma subarray_upd3: "\<lbrakk> n \<le> i; i < m\<rbrakk> \<Longrightarrow> subarray n m a (Heap.upd a i v h) = subarray n m a h[i - n := v]"
-unfolding subarray_def Heap.upd_def
-by (simp add: sublist'_update3)
-
-lemma subarray_Nil: "n \<ge> m \<Longrightarrow> subarray n m a h = []"
-by (simp add: subarray_def sublist'_Nil')
-
-lemma subarray_single: "\<lbrakk> n < Heap.length a h \<rbrakk> \<Longrightarrow> subarray n (Suc n) a h = [get_array a h ! n]" 
-by (simp add: subarray_def Heap.length_def sublist'_single)
-
-lemma length_subarray: "m \<le> Heap.length a h \<Longrightarrow> List.length (subarray n m a h) = m - n"
-by (simp add: subarray_def Heap.length_def length_sublist')
-
-lemma length_subarray_0: "m \<le> Heap.length a h \<Longrightarrow> List.length (subarray 0 m a h) = m"
-by (simp add: length_subarray)
-
-lemma subarray_nth_array_Cons: "\<lbrakk> i < Heap.length a h; i < j \<rbrakk> \<Longrightarrow> (get_array a h ! i) # subarray (Suc i) j a h = subarray i j a h"
-unfolding Heap.length_def subarray_def
-by (simp add: sublist'_front)
-
-lemma subarray_nth_array_back: "\<lbrakk> i < j; j \<le> Heap.length a h\<rbrakk> \<Longrightarrow> subarray i j a h = subarray i (j - 1) a h @ [get_array a h ! (j - 1)]"
-unfolding Heap.length_def subarray_def
-by (simp add: sublist'_back)
-
-lemma subarray_append: "\<lbrakk> i < j; j < k \<rbrakk> \<Longrightarrow> subarray i j a h @ subarray j k a h = subarray i k a h"
-unfolding subarray_def
-by (simp add: sublist'_append)
-
-lemma subarray_all: "subarray 0 (Heap.length a h) a h = get_array a h"
-unfolding Heap.length_def subarray_def
-by (simp add: sublist'_all)
-
-lemma nth_subarray: "\<lbrakk> k < j - i; j \<le> Heap.length a h \<rbrakk> \<Longrightarrow> subarray i j a h ! k = get_array a h ! (i + k)"
-unfolding Heap.length_def subarray_def
-by (simp add: nth_sublist')
-
-lemma subarray_eq_samelength_iff: "Heap.length a h = Heap.length a h' \<Longrightarrow> (subarray i j a h = subarray i j a h') = (\<forall>i'. i \<le> i' \<and> i' < j \<longrightarrow> get_array a h ! i' = get_array a h' ! i')"
-unfolding Heap.length_def subarray_def by (rule sublist'_eq_samelength_iff)
-
-lemma all_in_set_subarray_conv: "(\<forall>j. j \<in> set (subarray l r a h) \<longrightarrow> P j) = (\<forall>k. l \<le> k \<and> k < r \<and> k < Heap.length a h \<longrightarrow> P (get_array a h ! k))"
-unfolding subarray_def Heap.length_def by (rule all_in_set_sublist'_conv)
-
-lemma ball_in_set_subarray_conv: "(\<forall>j \<in> set (subarray l r a h). P j) = (\<forall>k. l \<le> k \<and> k < r \<and> k < Heap.length a h \<longrightarrow> P (get_array a h ! k))"
-unfolding subarray_def Heap.length_def by (rule ball_in_set_sublist'_conv)
-
-end
\ No newline at end of file
diff -r 2d1d426e00e4 -r b14b2cc4e25e src/HOL/ex/Sublist.thy
--- a/src/HOL/ex/Sublist.thy	Mon Mar 23 19:01:17 2009 +0100
+++ /dev/null	Thu Jan 01 00:00:00 1970 +0000
@@ -1,505 +0,0 @@
-(* $Id$ *)
-
-header {* Slices of lists *}
-
-theory Sublist
-imports Multiset
-begin
-
-
-lemma sublist_split: "i \<le> j \<and> j \<le> k \<Longrightarrow> sublist xs {i..<j} @ sublist xs {j..<k} = sublist xs {i..<k}" 
-apply (induct xs arbitrary: i j k)
-apply simp
-apply (simp only: sublist_Cons)
-apply simp
-apply safe
-apply simp
-apply (erule_tac x="0" in meta_allE)
-apply (erule_tac x="j - 1" in meta_allE)
-apply (erule_tac x="k - 1" in meta_allE)
-apply (subgoal_tac "0 \<le> j - 1 \<and> j - 1 \<le> k - 1")
-apply simp
-apply (subgoal_tac "{ja. Suc ja < j} = {0..<j - Suc 0}")
-apply (subgoal_tac "{ja. j \<le> Suc ja \<and> Suc ja < k} = {j - Suc 0..<k - Suc 0}")
-apply (subgoal_tac "{j. Suc j < k} = {0..<k - Suc 0}")
-apply simp
-apply fastsimp
-apply fastsimp
-apply fastsimp
-apply fastsimp
-apply (erule_tac x="i - 1" in meta_allE)
-apply (erule_tac x="j - 1" in meta_allE)
-apply (erule_tac x="k - 1" in meta_allE)
-apply (subgoal_tac " {ja. i \<le> Suc ja \<and> Suc ja < j} = {i - 1 ..<j - 1}")
-apply (subgoal_tac " {ja. j \<le> Suc ja \<and> Suc ja < k} = {j - 1..<k - 1}")
-apply (subgoal_tac "{j. i \<le> Suc j \<and> Suc j < k} = {i - 1..<k - 1}")
-apply (subgoal_tac " i - 1 \<le> j - 1 \<and> j - 1 \<le> k - 1")
-apply simp
-apply fastsimp
-apply fastsimp
-apply fastsimp
-apply fastsimp
-done
-
-lemma sublist_update1: "i \<notin> inds \<Longrightarrow> sublist (xs[i := v]) inds = sublist xs inds"
-apply (induct xs arbitrary: i inds)
-apply simp
-apply (case_tac i)
-apply (simp add: sublist_Cons)
-apply (simp add: sublist_Cons)
-done
-
-lemma sublist_update2: "i \<in> inds \<Longrightarrow> sublist (xs[i := v]) inds = (sublist xs inds)[(card {k \<in> inds. k < i}):= v]"
-proof (induct xs arbitrary: i inds)
-  case Nil thus ?case by simp
-next
-  case (Cons x xs)
-  thus ?case
-  proof (cases i)
-    case 0 with Cons show ?thesis by (simp add: sublist_Cons)
-  next
-    case (Suc i')
-    with Cons show ?thesis
-      apply simp
-      apply (simp add: sublist_Cons)
-      apply auto
-      apply (auto simp add: nat.split)
-      apply (simp add: card_less_Suc[symmetric])
-      apply (simp add: card_less_Suc2)
-      done
-  qed
-qed
-
-lemma sublist_update: "sublist (xs[i := v]) inds = (if i \<in> inds then (sublist xs inds)[(card {k \<in> inds. k < i}) := v] else sublist xs inds)"
-by (simp add: sublist_update1 sublist_update2)
-
-lemma sublist_take: "sublist xs {j. j < m} = take m xs"
-apply (induct xs arbitrary: m)
-apply simp
-apply (case_tac m)
-apply simp
-apply (simp add: sublist_Cons)
-done
-
-lemma sublist_take': "sublist xs {0..<m} = take m xs"
-apply (induct xs arbitrary: m)
-apply simp
-apply (case_tac m)
-apply simp
-apply (simp add: sublist_Cons sublist_take)
-done
-
-lemma sublist_all[simp]: "sublist xs {j. j < length xs} = xs"
-apply (induct xs)
-apply simp
-apply (simp add: sublist_Cons)
-done
-
-lemma sublist_all'[simp]: "sublist xs {0..<length xs} = xs"
-apply (induct xs)
-apply simp
-apply (simp add: sublist_Cons)
-done
-
-lemma sublist_single: "a < length xs \<Longrightarrow> sublist xs {a} = [xs ! a]"
-apply (induct xs arbitrary: a)
-apply simp
-apply(case_tac aa)
-apply simp
-apply (simp add: sublist_Cons)
-apply simp
-apply (simp add: sublist_Cons)
-done
-
-lemma sublist_is_Nil: "\<forall>i \<in> inds. i \<ge> length xs \<Longrightarrow> sublist xs inds = []" 
-apply (induct xs arbitrary: inds)
-apply simp
-apply (simp add: sublist_Cons)
-apply auto
-apply (erule_tac x="{j. Suc j \<in> inds}" in meta_allE)
-apply auto
-done
-
-lemma sublist_Nil': "sublist xs inds = [] \<Longrightarrow> \<forall>i \<in> inds. i \<ge> length xs"
-apply (induct xs arbitrary: inds)
-apply simp
-apply (simp add: sublist_Cons)
-apply (auto split: if_splits)
-apply (erule_tac x="{j. Suc j \<in> inds}" in meta_allE)
-apply (case_tac x, auto)
-done
-
-lemma sublist_Nil[simp]: "(sublist xs inds = []) = (\<forall>i \<in> inds. i \<ge> length xs)"
-apply (induct xs arbitrary: inds)
-apply simp
-apply (simp add: sublist_Cons)
-apply auto
-apply (erule_tac x="{j. Suc j \<in> inds}" in meta_allE)
-apply (case_tac x, auto)
-done
-
-lemma sublist_eq_subseteq: " \<lbrakk> inds' \<subseteq> inds; sublist xs inds = sublist ys inds \<rbrakk> \<Longrightarrow> sublist xs inds' = sublist ys inds'"
-apply (induct xs arbitrary: ys inds inds')
-apply simp
-apply (drule sym, rule sym)
-apply (simp add: sublist_Nil, fastsimp)
-apply (case_tac ys)
-apply (simp add: sublist_Nil, fastsimp)
-apply (auto simp add: sublist_Cons)
-apply (erule_tac x="list" in meta_allE)
-apply (erule_tac x="{j. Suc j \<in> inds}" in meta_allE)
-apply (erule_tac x="{j. Suc j \<in> inds'}" in meta_allE)
-apply fastsimp
-apply (erule_tac x="list" in meta_allE)
-apply (erule_tac x="{j. Suc j \<in> inds}" in meta_allE)
-apply (erule_tac x="{j. Suc j \<in> inds'}" in meta_allE)
-apply fastsimp
-done
-
-lemma sublist_eq: "\<lbrakk> \<forall>i \<in> inds. ((i < length xs) \<and> (i < length ys)) \<or> ((i \<ge> length xs ) \<and> (i \<ge> length ys)); \<forall>i \<in> inds. xs ! i = ys ! i \<rbrakk> \<Longrightarrow> sublist xs inds = sublist ys inds"
-apply (induct xs arbitrary: ys inds)
-apply simp
-apply (rule sym, simp add: sublist_Nil)
-apply (case_tac ys)
-apply (simp add: sublist_Nil)
-apply (auto simp add: sublist_Cons)
-apply (erule_tac x="list" in meta_allE)
-apply (erule_tac x="{j. Suc j \<in> inds}" in meta_allE)
-apply fastsimp
-apply (erule_tac x="list" in meta_allE)
-apply (erule_tac x="{j. Suc j \<in> inds}" in meta_allE)
-apply fastsimp
-done
-
-lemma sublist_eq_samelength: "\<lbrakk> length xs = length ys; \<forall>i \<in> inds. xs ! i = ys ! i \<rbrakk> \<Longrightarrow> sublist xs inds = sublist ys inds"
-by (rule sublist_eq, auto)
-
-lemma sublist_eq_samelength_iff: "length xs = length ys \<Longrightarrow> (sublist xs inds = sublist ys inds) = (\<forall>i \<in> inds. xs ! i = ys ! i)"
-apply (induct xs arbitrary: ys inds)
-apply simp
-apply (rule sym, simp add: sublist_Nil)
-apply (case_tac ys)
-apply (simp add: sublist_Nil)
-apply (auto simp add: sublist_Cons)
-apply (case_tac i)
-apply auto
-apply (case_tac i)
-apply auto
-done
-
-section {* Another sublist function *}
-
-function sublist' :: "nat \<Rightarrow> nat \<Rightarrow> 'a list \<Rightarrow> 'a list"
-where
-  "sublist' n m [] = []"
-| "sublist' n 0 xs = []"
-| "sublist' 0 (Suc m) (x#xs) = (x#sublist' 0 m xs)"
-| "sublist' (Suc n) (Suc m) (x#xs) = sublist' n m xs"
-by pat_completeness auto
-termination by lexicographic_order
-
-subsection {* Proving equivalence to the other sublist command *}
-
-lemma sublist'_sublist: "sublist' n m xs = sublist xs {j. n \<le> j \<and> j < m}"
-apply (induct xs arbitrary: n m)
-apply simp
-apply (case_tac n)
-apply (case_tac m)
-apply simp
-apply (simp add: sublist_Cons)
-apply (case_tac m)
-apply simp
-apply (simp add: sublist_Cons)
-done
-
-
-lemma "sublist' n m xs = sublist xs {n..<m}"
-apply (induct xs arbitrary: n m)
-apply simp
-apply (case_tac n, case_tac m)
-apply simp
-apply simp
-apply (simp add: sublist_take')
-apply (case_tac m)
-apply simp
-apply (simp add: sublist_Cons sublist'_sublist)
-done
-
-
-subsection {* Showing equivalence to use of drop and take for definition *}
-
-lemma "sublist' n m xs = take (m - n) (drop n xs)"
-apply (induct xs arbitrary: n m)
-apply simp
-apply (case_tac m)
-apply simp
-apply (case_tac n)
-apply simp
-apply simp
-done
-
-subsection {* General lemma about sublist *}
-
-lemma sublist'_Nil[simp]: "sublist' i j [] = []"
-by simp
-
-lemma sublist'_Cons[simp]: "sublist' i (Suc j) (x#xs) = (case i of 0 \<Rightarrow> (x # sublist' 0 j xs) | Suc i' \<Rightarrow>  sublist' i' j xs)"
-by (cases i) auto
-
-lemma sublist'_Cons2[simp]: "sublist' i j (x#xs) = (if (j = 0) then [] else ((if (i = 0) then [x] else []) @ sublist' (i - 1) (j - 1) xs))"
-apply (cases j)
-apply auto
-apply (cases i)
-apply auto
-done
-
-lemma sublist_n_0: "sublist' n 0 xs = []"
-by (induct xs, auto)
-
-lemma sublist'_Nil': "n \<ge> m \<Longrightarrow> sublist' n m xs = []"
-apply (induct xs arbitrary: n m)
-apply simp
-apply (case_tac m)
-apply simp
-apply (case_tac n)
-apply simp
-apply simp
-done
-
-lemma sublist'_Nil2: "n \<ge> length xs \<Longrightarrow> sublist' n m xs = []"
-apply (induct xs arbitrary: n m)
-apply simp
-apply (case_tac m)
-apply simp
-apply (case_tac n)
-apply simp
-apply simp
-done
-
-lemma sublist'_Nil3: "(sublist' n m xs = []) = ((n \<ge> m) \<or> (n \<ge> length xs))"
-apply (induct xs arbitrary: n m)
-apply simp
-apply (case_tac m)
-apply simp
-apply (case_tac n)
-apply simp
-apply simp
-done
-
-lemma sublist'_notNil: "\<lbrakk> n < length xs; n < m \<rbrakk> \<Longrightarrow> sublist' n m xs \<noteq> []"
-apply (induct xs arbitrary: n m)
-apply simp
-apply (case_tac m)
-apply simp
-apply (case_tac n)
-apply simp
-apply simp
-done
-
-lemma sublist'_single: "n < length xs \<Longrightarrow> sublist' n (Suc n) xs = [xs ! n]"
-apply (induct xs arbitrary: n)
-apply simp
-apply simp
-apply (case_tac n)
-apply (simp add: sublist_n_0)
-apply simp
-done
-
-lemma sublist'_update1: "i \<ge> m \<Longrightarrow> sublist' n m (xs[i:=v]) = sublist' n m xs"
-apply (induct xs arbitrary: n m i)
-apply simp
-apply simp
-apply (case_tac i)
-apply simp
-apply simp
-done
-
-lemma sublist'_update2: "i < n \<Longrightarrow> sublist' n m (xs[i:=v]) = sublist' n m xs"
-apply (induct xs arbitrary: n m i)
-apply simp
-apply simp
-apply (case_tac i)
-apply simp
-apply simp
-done
-
-lemma sublist'_update3: "\<lbrakk>n \<le> i; i < m\<rbrakk> \<Longrightarrow> sublist' n m (xs[i := v]) = (sublist' n m xs)[i - n := v]"
-proof (induct xs arbitrary: n m i)
-  case Nil thus ?case by auto
-next
-  case (Cons x xs)
-  thus ?case
-    apply -
-    apply auto
-    apply (cases i)
-    apply auto
-    apply (cases i)
-    apply auto
-    done
-qed
-
-lemma "\<lbrakk> sublist' i j xs = sublist' i j ys; n \<ge> i; m \<le> j \<rbrakk> \<Longrightarrow> sublist' n m xs = sublist' n m ys"
-proof (induct xs arbitrary: i j ys n m)
-  case Nil
-  thus ?case
-    apply -
-    apply (rule sym, drule sym)
-    apply (simp add: sublist'_Nil)
-    apply (simp add: sublist'_Nil3)
-    apply arith
-    done
-next
-  case (Cons x xs i j ys n m)
-  note c = this
-  thus ?case
-  proof (cases m)
-    case 0 thus ?thesis by (simp add: sublist_n_0)
-  next
-    case (Suc m')
-    note a = this
-    thus ?thesis
-    proof (cases n)
-      case 0 note b = this
-      show ?thesis
-      proof (cases ys)
-	case Nil  with a b Cons.prems show ?thesis by (simp add: sublist'_Nil3)
-      next
-	case (Cons y ys)
-	show ?thesis
-	proof (cases j)
-	  case 0 with a b Cons.prems show ?thesis by simp
-	next
-	  case (Suc j') with a b Cons.prems Cons show ?thesis 
-	    apply -
-	    apply (simp, rule Cons.hyps [of "0" "j'" "ys" "0" "m'"], auto)
-	    done
-	qed
-      qed
-    next
-      case (Suc n')
-      show ?thesis
-      proof (cases ys)
-	case Nil with Suc a Cons.prems show ?thesis by (auto simp add: sublist'_Nil3)
-      next
-	case (Cons y ys) with Suc a Cons.prems show ?thesis
-	  apply -
-	  apply simp
-	  apply (cases j)
-	  apply simp
-	  apply (cases i)
-	  apply simp
-	  apply (rule_tac j="nat" in Cons.hyps [of "0" _ "ys" "n'" "m'"])
-	  apply simp
-	  apply simp
-	  apply simp
-	  apply simp
-	  apply (rule_tac i="nata" and j="nat" in Cons.hyps [of _ _ "ys" "n'" "m'"])
-	  apply simp
-	  apply simp
-	  apply simp
-	  done
-      qed
-    qed
-  qed
-qed
-
-lemma length_sublist': "j \<le> length xs \<Longrightarrow> length (sublist' i j xs) = j - i"
-by (induct xs arbitrary: i j, auto)
-
-lemma sublist'_front: "\<lbrakk> i < j; i < length xs \<rbrakk> \<Longrightarrow> sublist' i j xs = xs ! i # sublist' (Suc i) j xs"
-apply (induct xs arbitrary: a i j)
-apply simp
-apply (case_tac j)
-apply simp
-apply (case_tac i)
-apply simp
-apply simp
-done
-
-lemma sublist'_back: "\<lbrakk> i < j; j \<le> length xs \<rbrakk> \<Longrightarrow> sublist' i j xs = sublist' i (j - 1) xs @ [xs ! (j - 1)]"
-apply (induct xs arbitrary: a i j)
-apply simp
-apply simp
-apply (case_tac j)
-apply simp
-apply auto
-apply (case_tac nat)
-apply auto
-done
-
-(* suffices that j \<le> length xs and length ys *) 
-lemma sublist'_eq_samelength_iff: "length xs = length ys \<Longrightarrow> (sublist' i j xs  = sublist' i j ys) = (\<forall>i'. i \<le> i' \<and> i' < j \<longrightarrow> xs ! i' = ys ! i')"
-proof (induct xs arbitrary: ys i j)
-  case Nil thus ?case by simp
-next
-  case (Cons x xs)
-  thus ?case
-    apply -
-    apply (cases ys)
-    apply simp
-    apply simp
-    apply auto
-    apply (case_tac i', auto)
-    apply (erule_tac x="Suc i'" in allE, auto)
-    apply (erule_tac x="i' - 1" in allE, auto)
-    apply (case_tac i', auto)
-    apply (erule_tac x="Suc i'" in allE, auto)
-    done
-qed
-
-lemma sublist'_all[simp]: "sublist' 0 (length xs) xs = xs"
-by (induct xs, auto)
-
-lemma sublist'_sublist': "sublist' n m (sublist' i j xs) = sublist' (i + n) (min (i + m) j) xs" 
-by (induct xs arbitrary: i j n m) (auto simp add: min_diff)
-
-lemma sublist'_append: "\<lbrakk> i \<le> j; j \<le> k \<rbrakk> \<Longrightarrow>(sublist' i j xs) @ (sublist' j k xs) = sublist' i k xs"
-by (induct xs arbitrary: i j k) auto
-
-lemma nth_sublist': "\<lbrakk> k < j - i; j \<le> length xs \<rbrakk> \<Longrightarrow> (sublist' i j xs) ! k = xs ! (i + k)"
-apply (induct xs arbitrary: i j k)
-apply auto
-apply (case_tac k)
-apply auto
-apply (case_tac i)
-apply auto
-done
-
-lemma set_sublist': "set (sublist' i j xs) = {x. \<exists>k. i \<le> k \<and> k < j \<and> k < List.length xs \<and> x = xs ! k}"
-apply (simp add: sublist'_sublist)
-apply (simp add: set_sublist)
-apply auto
-done
-
-lemma all_in_set_sublist'_conv: "(\<forall>j. j \<in> set (sublist' l r xs) \<longrightarrow> P j) = (\<forall>k. l \<le> k \<and> k < r \<and> k < List.length xs \<longrightarrow> P (xs ! k))"
-unfolding set_sublist' by blast
-
-lemma ball_in_set_sublist'_conv: "(\<forall>j \<in> set (sublist' l r xs). P j) = (\<forall>k. l \<le> k \<and> k < r \<and> k < List.length xs \<longrightarrow> P (xs ! k))"
-unfolding set_sublist' by blast
-
-
-lemma multiset_of_sublist:
-assumes l_r: "l \<le> r \<and> r \<le> List.length xs"
-assumes left: "\<forall> i. i < l \<longrightarrow> (xs::'a list) ! i = ys ! i"
-assumes right: "\<forall> i. i \<ge> r \<longrightarrow> (xs::'a list) ! i = ys ! i"
-assumes multiset: "multiset_of xs = multiset_of ys"
-  shows "multiset_of (sublist' l r xs) = multiset_of (sublist' l r ys)"
-proof -
-  from l_r have xs_def: "xs = (sublist' 0 l xs) @ (sublist' l r xs) @ (sublist' r (List.length xs) xs)" (is "_ = ?xs_long") 
-    by (simp add: sublist'_append)
-  from multiset have length_eq: "List.length xs = List.length ys" by (rule multiset_of_eq_length)
-  with l_r have ys_def: "ys = (sublist' 0 l ys) @ (sublist' l r ys) @ (sublist' r (List.length ys) ys)" (is "_ = ?ys_long") 
-    by (simp add: sublist'_append)
-  from xs_def ys_def multiset have "multiset_of ?xs_long = multiset_of ?ys_long" by simp
-  moreover
-  from left l_r length_eq have "sublist' 0 l xs = sublist' 0 l ys"
-    by (auto simp add: length_sublist' nth_sublist' intro!: nth_equalityI)
-  moreover
-  from right l_r length_eq have "sublist' r (List.length xs) xs = sublist' r (List.length ys) ys"
-    by (auto simp add: length_sublist' nth_sublist' intro!: nth_equalityI)
-  moreover
-  ultimately show ?thesis by (simp add: multiset_of_append)
-qed
-
-
-end