# HG changeset patch # User huffman # Date 1235666913 28800 # Node ID e23770bc97c87cdf6eab5e03e72833512d96d92c # Parent 419116f1157a41d66a13a4abcaa1c344f32936ee# Parent 0726792e1726588ce34946a912df1fbe6cb7540f merged diff -r 419116f1157a -r e23770bc97c8 Admin/isatest/isatest-stats --- a/Admin/isatest/isatest-stats Thu Feb 26 08:44:44 2009 -0800 +++ b/Admin/isatest/isatest-stats Thu Feb 26 08:48:33 2009 -0800 @@ -16,6 +16,7 @@ HOL-Algebra \ HOL-Auth \ HOL-Bali \ + HOL-Decision_Procs \ HOL-Extraction \ HOL-Hoare \ HOL-HoareParallel \ diff -r 419116f1157a -r e23770bc97c8 NEWS --- a/NEWS Thu Feb 26 08:44:44 2009 -0800 +++ b/NEWS Thu Feb 26 08:48:33 2009 -0800 @@ -6,6 +6,10 @@ *** General *** +* The main reference manuals (isar-ref, implementation, system) have +been updated and extended. Formally checked references as hyperlinks +are now available in uniform manner. + * Simplified main Isabelle executables, with less surprises on case-insensitive file-systems (such as Mac OS). @@ -47,9 +51,6 @@ regular 4-core machine, if the initial heap space is made reasonably large (cf. Poly/ML option -H). [Poly/ML 5.2.1 or later] -* The Isabelle System Manual (system) has been updated, with formally -checked references as hyperlinks. - * Generalized Isar history, with support for linear undo, direct state addressing etc. @@ -111,30 +112,32 @@ unify_trace_bound = 50 (formerly 25) unify_search_bound = 60 (formerly 30) -* Different bookkeeping for code equations: - a) On theory merge, the last set of code equations for a particular constant - is taken (in accordance with the policy applied by other parts of the - code generator framework). - b) Code equations stemming from explicit declarations (e.g. code attribute) - gain priority over default code equations stemming from definition, primrec, - fun etc. - INCOMPATIBILITY. - -* Global versions of theorems stemming from classes do not carry -a parameter prefix any longer. INCOMPATIBILITY. +* Different bookkeeping for code equations (INCOMPATIBILITY): + + a) On theory merge, the last set of code equations for a particular + constant is taken (in accordance with the policy applied by other + parts of the code generator framework). + + b) Code equations stemming from explicit declarations (e.g. code + attribute) gain priority over default code equations stemming + from definition, primrec, fun etc. + +* Global versions of theorems stemming from classes do not carry a +parameter prefix any longer. INCOMPATIBILITY. * Dropped locale element "includes". This is a major INCOMPATIBILITY. In existing theorem specifications replace the includes element by the -respective context elements of the included locale, omitting those that -are already present in the theorem specification. Multiple assume -elements of a locale should be replaced by a single one involving the -locale predicate. In the proof body, declarations (most notably -theorems) may be regained by interpreting the respective locales in the -proof context as required (command "interpret"). +respective context elements of the included locale, omitting those +that are already present in the theorem specification. Multiple +assume elements of a locale should be replaced by a single one +involving the locale predicate. In the proof body, declarations (most +notably theorems) may be regained by interpreting the respective +locales in the proof context as required (command "interpret"). + If using "includes" in replacement of a target solely because the parameter types in the theorem are not as general as in the target, -consider declaring a new locale with additional type constraints on the -parameters (context element "constrains"). +consider declaring a new locale with additional type constraints on +the parameters (context element "constrains"). * Dropped "locale (open)". INCOMPATIBILITY. @@ -145,9 +148,9 @@ * Interpretation commands no longer accept interpretation attributes. INCOMPATBILITY. -* Complete re-implementation of locales. INCOMPATIBILITY. -The most important changes are listed below. See documentation -(forthcoming) and tutorial (also forthcoming) for details. +* Complete re-implementation of locales. INCOMPATIBILITY. The most +important changes are listed below. See documentation (forthcoming) +and tutorial (also forthcoming) for details. - In locale expressions, instantiation replaces renaming. Parameters must be declared in a for clause. To aid compatibility with previous @@ -161,15 +164,15 @@ - More flexible mechanisms to qualify names generated by locale expressions. Qualifiers (prefixes) may be specified in locale -expressions. Available are normal qualifiers (syntax "name:") and strict -qualifiers (syntax "name!:"). The latter must occur in name references -and are useful to avoid accidental hiding of names, the former are -optional. Qualifiers derived from the parameter names of a locale are no -longer generated. - -- "sublocale l < e" replaces "interpretation l < e". The instantiation -clause in "interpretation" and "interpret" (square brackets) is no -longer available. Use locale expressions. +expressions. Available are normal qualifiers (syntax "name:") and +strict qualifiers (syntax "name!:"). The latter must occur in name +references and are useful to avoid accidental hiding of names, the +former are optional. Qualifiers derived from the parameter names of a +locale are no longer generated. + +- "sublocale l < e" replaces "interpretation l < e". The +instantiation clause in "interpretation" and "interpret" (square +brackets) is no longer available. Use locale expressions. - When converting proof scripts, be sure to replace qualifiers in "interpretation" and "interpret" by strict qualifiers. Qualifiers in @@ -183,8 +186,8 @@ * The 'axiomatization' command now only works within a global theory context. INCOMPATIBILITY. -* New find_theorems criterion "solves" matching theorems that -directly solve the current goal. Try "find_theorems solves". +* New find_theorems criterion "solves" matching theorems that directly +solve the current goal. Try "find_theorems solves". * Added an auto solve option, which can be enabled through the ProofGeneral Isabelle settings menu (disabled by default). @@ -193,14 +196,15 @@ stated. Any theorems that could solve the lemma directly are listed underneath the goal. -* New command find_consts searches for constants based on type and name -patterns, e.g. +* New command find_consts searches for constants based on type and +name patterns, e.g. find_consts "_ => bool" -By default, matching is against subtypes, but it may be restricted to the -whole type. Searching by name is possible. Multiple queries are conjunctive -and queries may be negated by prefixing them with a hyphen: +By default, matching is against subtypes, but it may be restricted to +the whole type. Searching by name is possible. Multiple queries are +conjunctive and queries may be negated by prefixing them with a +hyphen: find_consts strict: "_ => bool" name: "Int" -"int => int" @@ -312,7 +316,7 @@ process. New thread-based implementation also works on non-Unix platforms (Cygwin). Provers are no longer hardwired, but defined within the theory via plain ML wrapper functions. Basic Sledgehammer -commands are covered in the isar-ref manual +commands are covered in the isar-ref manual. * Wrapper scripts for remote SystemOnTPTP service allows to use sledgehammer without local ATP installation (Vampire etc.). See also @@ -496,9 +500,8 @@ *** HOL-Algebra *** * New locales for orders and lattices where the equivalence relation - is not restricted to equality. INCOMPATIBILITY: all order and - lattice locales use a record structure with field eq for the - equivalence. +is not restricted to equality. INCOMPATIBILITY: all order and lattice +locales use a record structure with field eq for the equivalence. * New theory of factorial domains. diff -r 419116f1157a -r e23770bc97c8 doc-src/AxClass/Group/Group.thy --- a/doc-src/AxClass/Group/Group.thy Thu Feb 26 08:44:44 2009 -0800 +++ /dev/null Thu Jan 01 00:00:00 1970 +0000 @@ -1,322 +0,0 @@ - -header {* Basic group theory *} - -theory Group imports Main begin - -text {* - \medskip\noindent The meta-level type system of Isabelle supports - \emph{intersections} and \emph{inclusions} of type classes. These - directly correspond to intersections and inclusions of type - predicates in a purely set theoretic sense. This is sufficient as a - means to describe simple hierarchies of structures. As an - illustration, we use the well-known example of semigroups, monoids, - general groups and Abelian groups. -*} - -subsection {* Monoids and Groups *} - -text {* - First we declare some polymorphic constants required later for the - signature parts of our structures. -*} - -consts - times :: "'a \ 'a \ 'a" (infixl "\" 70) - invers :: "'a \ 'a" ("(_\)" [1000] 999) - one :: 'a ("\") - -text {* - \noindent Next we define class @{text monoid} of monoids with - operations @{text \} and @{text \}. Note that multiple class - axioms are allowed for user convenience --- they simply represent - the conjunction of their respective universal closures. -*} - -axclass monoid \ type - assoc: "(x \ y) \ z = x \ (y \ z)" - left_unit: "\ \ x = x" - right_unit: "x \ \ = x" - -text {* - \noindent So class @{text monoid} contains exactly those types - @{text \} where @{text "\ \ \ \ \ \ \"} and @{text "\ \ \"} - are specified appropriately, such that @{text \} is associative and - @{text \} is a left and right unit element for the @{text \} - operation. -*} - -text {* - \medskip Independently of @{text monoid}, we now define a linear - hierarchy of semigroups, general groups and Abelian groups. Note - that the names of class axioms are automatically qualified with each - class name, so we may re-use common names such as @{text assoc}. -*} - -axclass semigroup \ type - assoc: "(x \ y) \ z = x \ (y \ z)" - -axclass group \ semigroup - left_unit: "\ \ x = x" - left_inverse: "x\ \ x = \" - -axclass agroup \ group - commute: "x \ y = y \ x" - -text {* - \noindent Class @{text group} inherits associativity of @{text \} - from @{text semigroup} and adds two further group axioms. Similarly, - @{text agroup} is defined as the subset of @{text group} such that - for all of its elements @{text \}, the operation @{text "\ \ \ \ \ \ - \"} is even commutative. -*} - - -subsection {* Abstract reasoning *} - -text {* - In a sense, axiomatic type classes may be viewed as \emph{abstract - theories}. Above class definitions gives rise to abstract axioms - @{text assoc}, @{text left_unit}, @{text left_inverse}, @{text - commute}, where any of these contain a type variable @{text "'a \ - c"} that is restricted to types of the corresponding class @{text - c}. \emph{Sort constraints} like this express a logical - precondition for the whole formula. For example, @{text assoc} - states that for all @{text \}, provided that @{text "\ \ - semigroup"}, the operation @{text "\ \ \ \ \ \ \"} is associative. - - \medskip From a technical point of view, abstract axioms are just - ordinary Isabelle theorems, which may be used in proofs without - special treatment. Such ``abstract proofs'' usually yield new - ``abstract theorems''. For example, we may now derive the following - well-known laws of general groups. -*} - -theorem group_right_inverse: "x \ x\ = (\\'a\group)" -proof - - have "x \ x\ = \ \ (x \ x\)" - by (simp only: group_class.left_unit) - also have "... = \ \ x \ x\" - by (simp only: semigroup_class.assoc) - also have "... = (x\)\ \ x\ \ x \ x\" - by (simp only: group_class.left_inverse) - also have "... = (x\)\ \ (x\ \ x) \ x\" - by (simp only: semigroup_class.assoc) - also have "... = (x\)\ \ \ \ x\" - by (simp only: group_class.left_inverse) - also have "... = (x\)\ \ (\ \ x\)" - by (simp only: semigroup_class.assoc) - also have "... = (x\)\ \ x\" - by (simp only: group_class.left_unit) - also have "... = \" - by (simp only: group_class.left_inverse) - finally show ?thesis . -qed - -text {* - \noindent With @{text group_right_inverse} already available, @{text - group_right_unit}\label{thm:group-right-unit} is now established - much easier. -*} - -theorem group_right_unit: "x \ \ = (x\'a\group)" -proof - - have "x \ \ = x \ (x\ \ x)" - by (simp only: group_class.left_inverse) - also have "... = x \ x\ \ x" - by (simp only: semigroup_class.assoc) - also have "... = \ \ x" - by (simp only: group_right_inverse) - also have "... = x" - by (simp only: group_class.left_unit) - finally show ?thesis . -qed - -text {* - \medskip Abstract theorems may be instantiated to only those types - @{text \} where the appropriate class membership @{text "\ \ c"} is - known at Isabelle's type signature level. Since we have @{text - "agroup \ group \ semigroup"} by definition, all theorems of @{text - semigroup} and @{text group} are automatically inherited by @{text - group} and @{text agroup}. -*} - - -subsection {* Abstract instantiation *} - -text {* - From the definition, the @{text monoid} and @{text group} classes - have been independent. Note that for monoids, @{text right_unit} - had to be included as an axiom, but for groups both @{text - right_unit} and @{text right_inverse} are derivable from the other - axioms. With @{text group_right_unit} derived as a theorem of group - theory (see page~\pageref{thm:group-right-unit}), we may now - instantiate @{text "monoid \ semigroup"} and @{text "group \ - monoid"} properly as follows (cf.\ \figref{fig:monoid-group}). - - \begin{figure}[htbp] - \begin{center} - \small - \unitlength 0.6mm - \begin{picture}(65,90)(0,-10) - \put(15,10){\line(0,1){10}} \put(15,30){\line(0,1){10}} - \put(15,50){\line(1,1){10}} \put(35,60){\line(1,-1){10}} - \put(15,5){\makebox(0,0){@{text agroup}}} - \put(15,25){\makebox(0,0){@{text group}}} - \put(15,45){\makebox(0,0){@{text semigroup}}} - \put(30,65){\makebox(0,0){@{text type}}} \put(50,45){\makebox(0,0){@{text monoid}}} - \end{picture} - \hspace{4em} - \begin{picture}(30,90)(0,0) - \put(15,10){\line(0,1){10}} \put(15,30){\line(0,1){10}} - \put(15,50){\line(0,1){10}} \put(15,70){\line(0,1){10}} - \put(15,5){\makebox(0,0){@{text agroup}}} - \put(15,25){\makebox(0,0){@{text group}}} - \put(15,45){\makebox(0,0){@{text monoid}}} - \put(15,65){\makebox(0,0){@{text semigroup}}} - \put(15,85){\makebox(0,0){@{text type}}} - \end{picture} - \caption{Monoids and groups: according to definition, and by proof} - \label{fig:monoid-group} - \end{center} - \end{figure} -*} - -instance monoid \ semigroup -proof - fix x y z :: "'a\monoid" - show "x \ y \ z = x \ (y \ z)" - by (rule monoid_class.assoc) -qed - -instance group \ monoid -proof - fix x y z :: "'a\group" - show "x \ y \ z = x \ (y \ z)" - by (rule semigroup_class.assoc) - show "\ \ x = x" - by (rule group_class.left_unit) - show "x \ \ = x" - by (rule group_right_unit) -qed - -text {* - \medskip The \isakeyword{instance} command sets up an appropriate - goal that represents the class inclusion (or type arity, see - \secref{sec:inst-arity}) to be proven (see also - \cite{isabelle-isar-ref}). The initial proof step causes - back-chaining of class membership statements wrt.\ the hierarchy of - any classes defined in the current theory; the effect is to reduce - to the initial statement to a number of goals that directly - correspond to any class axioms encountered on the path upwards - through the class hierarchy. -*} - - -subsection {* Concrete instantiation \label{sec:inst-arity} *} - -text {* - So far we have covered the case of the form - \isakeyword{instance}~@{text "c\<^sub>1 \ c\<^sub>2"}, namely - \emph{abstract instantiation} --- $c@1$ is more special than @{text - "c\<^sub>1"} and thus an instance of @{text "c\<^sub>2"}. Even more - interesting for practical applications are \emph{concrete - instantiations} of axiomatic type classes. That is, certain simple - schemes @{text "(\\<^sub>1, \, \\<^sub>n) t \ c"} of class - membership may be established at the logical level and then - transferred to Isabelle's type signature level. - - \medskip As a typical example, we show that type @{typ bool} with - exclusive-or as @{text \} operation, identity as @{text \}, and - @{term False} as @{text \} forms an Abelian group. -*} - -defs (overloaded) - times_bool_def: "x \ y \ x \ (y\bool)" - inverse_bool_def: "x\ \ x\bool" - unit_bool_def: "\ \ False" - -text {* - \medskip It is important to note that above \isakeyword{defs} are - just overloaded meta-level constant definitions, where type classes - are not yet involved at all. This form of constant definition with - overloading (and optional recursion over the syntactic structure of - simple types) are admissible as definitional extensions of plain HOL - \cite{Wenzel:1997:TPHOL}. The Haskell-style type system is not - required for overloading. Nevertheless, overloaded definitions are - best applied in the context of type classes. - - \medskip Since we have chosen above \isakeyword{defs} of the generic - group operations on type @{typ bool} appropriately, the class - membership @{text "bool \ agroup"} may be now derived as follows. -*} - -instance bool :: agroup -proof (intro_classes, - unfold times_bool_def inverse_bool_def unit_bool_def) - fix x y z - show "((x \ y) \ z) = (x \ (y \ z))" by blast - show "(False \ x) = x" by blast - show "(x \ x) = False" by blast - show "(x \ y) = (y \ x)" by blast -qed - -text {* - The result of an \isakeyword{instance} statement is both expressed - as a theorem of Isabelle's meta-logic, and as a type arity of the - type signature. The latter enables type-inference system to take - care of this new instance automatically. - - \medskip We could now also instantiate our group theory classes to - many other concrete types. For example, @{text "int \ agroup"} - (e.g.\ by defining @{text \} as addition, @{text \} as negation - and @{text \} as zero) or @{text "list \ (type) semigroup"} - (e.g.\ if @{text \} is defined as list append). Thus, the - characteristic constants @{text \}, @{text \}, @{text \} - really become overloaded, i.e.\ have different meanings on different - types. -*} - - -subsection {* Lifting and Functors *} - -text {* - As already mentioned above, overloading in the simply-typed HOL - systems may include recursion over the syntactic structure of types. - That is, definitional equations @{text "c\<^sup>\ \ t"} may also - contain constants of name @{text c} on the right-hand side --- if - these have types that are structurally simpler than @{text \}. - - This feature enables us to \emph{lift operations}, say to Cartesian - products, direct sums or function spaces. Subsequently we lift - @{text \} component-wise to binary products @{typ "'a \ 'b"}. -*} - -defs (overloaded) - times_prod_def: "p \ q \ (fst p \ fst q, snd p \ snd q)" - -text {* - It is very easy to see that associativity of @{text \} on @{typ 'a} - and @{text \} on @{typ 'b} transfers to @{text \} on @{typ "'a \ - 'b"}. Hence the binary type constructor @{text \} maps semigroups - to semigroups. This may be established formally as follows. -*} - -instance * :: (semigroup, semigroup) semigroup -proof (intro_classes, unfold times_prod_def) - fix p q r :: "'a\semigroup \ 'b\semigroup" - show - "(fst (fst p \ fst q, snd p \ snd q) \ fst r, - snd (fst p \ fst q, snd p \ snd q) \ snd r) = - (fst p \ fst (fst q \ fst r, snd q \ snd r), - snd p \ snd (fst q \ fst r, snd q \ snd r))" - by (simp add: semigroup_class.assoc) -qed - -text {* - Thus, if we view class instances as ``structures'', then overloaded - constant definitions with recursion over types indirectly provide - some kind of ``functors'' --- i.e.\ mappings between abstract - theories. -*} - -end diff -r 419116f1157a -r e23770bc97c8 doc-src/AxClass/Group/Product.thy --- a/doc-src/AxClass/Group/Product.thy Thu Feb 26 08:44:44 2009 -0800 +++ /dev/null Thu Jan 01 00:00:00 1970 +0000 @@ -1,85 +0,0 @@ - -header {* Syntactic classes *} - -theory Product imports Main begin - -text {* - \medskip\noindent There is still a feature of Isabelle's type system - left that we have not yet discussed. When declaring polymorphic - constants @{text "c \ \"}, the type variables occurring in @{text \} - may be constrained by type classes (or even general sorts) in an - arbitrary way. Note that by default, in Isabelle/HOL the - declaration @{text "\ \ 'a \ 'a \ 'a"} is actually an abbreviation - for @{text "\ \ 'a\type \ 'a \ 'a"} Since class @{text type} is the - universal class of HOL, this is not really a constraint at all. - - The @{text product} class below provides a less degenerate example of - syntactic type classes. -*} - -axclass - product \ type -consts - product :: "'a\product \ 'a \ 'a" (infixl "\" 70) - -text {* - Here class @{text product} is defined as subclass of @{text type} - without any additional axioms. This effects in logical equivalence - of @{text product} and @{text type}, as is reflected by the trivial - introduction rule generated for this definition. - - \medskip So what is the difference of declaring @{text "\ \ - 'a\product \ 'a \ 'a"} vs.\ declaring @{text "\ \ 'a\type \ 'a \ - 'a"} anyway? In this particular case where @{text "product \ - type"}, it should be obvious that both declarations are the same - from the logic's point of view. It even makes the most sense to - remove sort constraints from constant declarations, as far as the - purely logical meaning is concerned \cite{Wenzel:1997:TPHOL}. - - On the other hand there are syntactic differences, of course. - Constants @{text \} on some type @{text \} are rejected by the - type-checker, unless the arity @{text "\ \ product"} is part of the - type signature. In our example, this arity may be always added when - required by means of an \isakeyword{instance} with the default proof - (double-dot). - - \medskip Thus, we may observe the following discipline of using - syntactic classes. Overloaded polymorphic constants have their type - arguments restricted to an associated (logically trivial) class - @{text c}. Only immediately before \emph{specifying} these - constants on a certain type @{text \} do we instantiate @{text "\ \ - c"}. - - This is done for class @{text product} and type @{typ bool} as - follows. -*} - -instance bool :: product .. -defs (overloaded) - product_bool_def: "x \ y \ x \ y" - -text {* - The definition @{text prod_bool_def} becomes syntactically - well-formed only after the arity @{text "bool \ product"} is made - known to the type checker. - - \medskip It is very important to see that above \isakeyword{defs} are - not directly connected with \isakeyword{instance} at all! We were - just following our convention to specify @{text \} on @{typ bool} - after having instantiated @{text "bool \ product"}. Isabelle does - not require these definitions, which is in contrast to programming - languages like Haskell \cite{haskell-report}. - - \medskip While Isabelle type classes and those of Haskell are almost - the same as far as type-checking and type inference are concerned, - there are important semantic differences. Haskell classes require - their instances to \emph{provide operations} of certain \emph{names}. - Therefore, its \texttt{instance} has a \texttt{where} part that tells - the system what these ``member functions'' should be. - - This style of \texttt{instance} would not make much sense in - Isabelle's meta-logic, because there is no internal notion of - ``providing operations'' or even ``names of functions''. -*} - -end diff -r 419116f1157a -r e23770bc97c8 doc-src/AxClass/Group/ROOT.ML --- a/doc-src/AxClass/Group/ROOT.ML Thu Feb 26 08:44:44 2009 -0800 +++ /dev/null Thu Jan 01 00:00:00 1970 +0000 @@ -1,4 +0,0 @@ - -use_thy "Semigroups"; -use_thy "Group"; -use_thy "Product"; diff -r 419116f1157a -r e23770bc97c8 doc-src/AxClass/Group/Semigroups.thy --- a/doc-src/AxClass/Group/Semigroups.thy Thu Feb 26 08:44:44 2009 -0800 +++ /dev/null Thu Jan 01 00:00:00 1970 +0000 @@ -1,54 +0,0 @@ - -header {* Semigroups *} - -theory Semigroups imports Main begin - -text {* - \medskip\noindent An axiomatic type class is simply a class of types - that all meet certain properties, which are also called \emph{class - axioms}. Thus, type classes may be also understood as type - predicates --- i.e.\ abstractions over a single type argument @{typ - 'a}. Class axioms typically contain polymorphic constants that - depend on this type @{typ 'a}. These \emph{characteristic - constants} behave like operations associated with the ``carrier'' - type @{typ 'a}. - - We illustrate these basic concepts by the following formulation of - semigroups. -*} - -consts - times :: "'a \ 'a \ 'a" (infixl "\" 70) -axclass semigroup \ type - assoc: "(x \ y) \ z = x \ (y \ z)" - -text {* - \noindent Above we have first declared a polymorphic constant @{text - "\ \ 'a \ 'a \ 'a"} and then defined the class @{text semigroup} of - all types @{text \} such that @{text "\ \ \ \ \ \ \"} is indeed an - associative operator. The @{text assoc} axiom contains exactly one - type variable, which is invisible in the above presentation, though. - Also note that free term variables (like @{term x}, @{term y}, - @{term z}) are allowed for user convenience --- conceptually all of - these are bound by outermost universal quantifiers. - - \medskip In general, type classes may be used to describe - \emph{structures} with exactly one carrier @{typ 'a} and a fixed - \emph{signature}. Different signatures require different classes. - Below, class @{text plus_semigroup} represents semigroups @{text - "(\, \\<^sup>\)"}, while the original @{text semigroup} would - correspond to semigroups of the form @{text "(\, \\<^sup>\)"}. -*} - -consts - plus :: "'a \ 'a \ 'a" (infixl "\" 70) -axclass plus_semigroup \ type - assoc: "(x \ y) \ z = x \ (y \ z)" - -text {* - \noindent Even if classes @{text plus_semigroup} and @{text - semigroup} both represent semigroups in a sense, they are certainly - not quite the same. -*} - -end diff -r 419116f1157a -r e23770bc97c8 doc-src/AxClass/Group/document/Group.tex --- a/doc-src/AxClass/Group/document/Group.tex Thu Feb 26 08:44:44 2009 -0800 +++ /dev/null Thu Jan 01 00:00:00 1970 +0000 @@ -1,512 +0,0 @@ -% -\begin{isabellebody}% -\def\isabellecontext{Group}% -% -\isamarkupheader{Basic group theory% -} -\isamarkuptrue% -% -\isadelimtheory -% -\endisadelimtheory -% -\isatagtheory -\isacommand{theory}\isamarkupfalse% -\ Group\ \isakeyword{imports}\ Main\ \isakeyword{begin}% -\endisatagtheory -{\isafoldtheory}% -% -\isadelimtheory -% -\endisadelimtheory -% -\begin{isamarkuptext}% -\medskip\noindent The meta-level type system of Isabelle supports - \emph{intersections} and \emph{inclusions} of type classes. These - directly correspond to intersections and inclusions of type - predicates in a purely set theoretic sense. This is sufficient as a - means to describe simple hierarchies of structures. As an - illustration, we use the well-known example of semigroups, monoids, - general groups and Abelian groups.% -\end{isamarkuptext}% -\isamarkuptrue% -% -\isamarkupsubsection{Monoids and Groups% -} -\isamarkuptrue% -% -\begin{isamarkuptext}% -First we declare some polymorphic constants required later for the - signature parts of our structures.% -\end{isamarkuptext}% -\isamarkuptrue% -\isacommand{consts}\isamarkupfalse% -\isanewline -\ \ times\ {\isacharcolon}{\isacharcolon}\ {\isachardoublequoteopen}{\isacharprime}a\ {\isasymRightarrow}\ {\isacharprime}a\ {\isasymRightarrow}\ {\isacharprime}a{\isachardoublequoteclose}\ \ \ \ {\isacharparenleft}\isakeyword{infixl}\ {\isachardoublequoteopen}{\isasymodot}{\isachardoublequoteclose}\ {\isadigit{7}}{\isadigit{0}}{\isacharparenright}\isanewline -\ \ invers\ {\isacharcolon}{\isacharcolon}\ {\isachardoublequoteopen}{\isacharprime}a\ {\isasymRightarrow}\ {\isacharprime}a{\isachardoublequoteclose}\ \ \ \ {\isacharparenleft}{\isachardoublequoteopen}{\isacharparenleft}{\isacharunderscore}{\isasyminv}{\isacharparenright}{\isachardoublequoteclose}\ {\isacharbrackleft}{\isadigit{1}}{\isadigit{0}}{\isadigit{0}}{\isadigit{0}}{\isacharbrackright}\ {\isadigit{9}}{\isadigit{9}}{\isadigit{9}}{\isacharparenright}\isanewline -\ \ one\ {\isacharcolon}{\isacharcolon}\ {\isacharprime}a\ \ \ \ {\isacharparenleft}{\isachardoublequoteopen}{\isasymone}{\isachardoublequoteclose}{\isacharparenright}% -\begin{isamarkuptext}% -\noindent Next we define class \isa{monoid} of monoids with - operations \isa{{\isasymodot}} and \isa{{\isasymone}}. Note that multiple class - axioms are allowed for user convenience --- they simply represent - the conjunction of their respective universal closures.% -\end{isamarkuptext}% -\isamarkuptrue% -\isacommand{axclass}\isamarkupfalse% -\ monoid\ {\isasymsubseteq}\ type\isanewline -\ \ assoc{\isacharcolon}\ {\isachardoublequoteopen}{\isacharparenleft}x\ {\isasymodot}\ y{\isacharparenright}\ {\isasymodot}\ z\ {\isacharequal}\ x\ {\isasymodot}\ {\isacharparenleft}y\ {\isasymodot}\ z{\isacharparenright}{\isachardoublequoteclose}\isanewline -\ \ left{\isacharunderscore}unit{\isacharcolon}\ {\isachardoublequoteopen}{\isasymone}\ {\isasymodot}\ x\ {\isacharequal}\ x{\isachardoublequoteclose}\isanewline -\ \ right{\isacharunderscore}unit{\isacharcolon}\ {\isachardoublequoteopen}x\ {\isasymodot}\ {\isasymone}\ {\isacharequal}\ x{\isachardoublequoteclose}% -\begin{isamarkuptext}% -\noindent So class \isa{monoid} contains exactly those types - \isa{{\isasymtau}} where \isa{{\isasymodot}\ {\isasymColon}\ {\isasymtau}\ {\isasymRightarrow}\ {\isasymtau}\ {\isasymRightarrow}\ {\isasymtau}} and \isa{{\isasymone}\ {\isasymColon}\ {\isasymtau}} - are specified appropriately, such that \isa{{\isasymodot}} is associative and - \isa{{\isasymone}} is a left and right unit element for the \isa{{\isasymodot}} - operation.% -\end{isamarkuptext}% -\isamarkuptrue% -% -\begin{isamarkuptext}% -\medskip Independently of \isa{monoid}, we now define a linear - hierarchy of semigroups, general groups and Abelian groups. Note - that the names of class axioms are automatically qualified with each - class name, so we may re-use common names such as \isa{assoc}.% -\end{isamarkuptext}% -\isamarkuptrue% -\isacommand{axclass}\isamarkupfalse% -\ semigroup\ {\isasymsubseteq}\ type\isanewline -\ \ assoc{\isacharcolon}\ {\isachardoublequoteopen}{\isacharparenleft}x\ {\isasymodot}\ y{\isacharparenright}\ {\isasymodot}\ z\ {\isacharequal}\ x\ {\isasymodot}\ {\isacharparenleft}y\ {\isasymodot}\ z{\isacharparenright}{\isachardoublequoteclose}\isanewline -\isanewline -\isacommand{axclass}\isamarkupfalse% -\ group\ {\isasymsubseteq}\ semigroup\isanewline -\ \ left{\isacharunderscore}unit{\isacharcolon}\ {\isachardoublequoteopen}{\isasymone}\ {\isasymodot}\ x\ {\isacharequal}\ x{\isachardoublequoteclose}\isanewline -\ \ left{\isacharunderscore}inverse{\isacharcolon}\ {\isachardoublequoteopen}x{\isasyminv}\ {\isasymodot}\ x\ {\isacharequal}\ {\isasymone}{\isachardoublequoteclose}\isanewline -\isanewline -\isacommand{axclass}\isamarkupfalse% -\ agroup\ {\isasymsubseteq}\ group\isanewline -\ \ commute{\isacharcolon}\ {\isachardoublequoteopen}x\ {\isasymodot}\ y\ {\isacharequal}\ y\ {\isasymodot}\ x{\isachardoublequoteclose}% -\begin{isamarkuptext}% -\noindent Class \isa{group} inherits associativity of \isa{{\isasymodot}} - from \isa{semigroup} and adds two further group axioms. Similarly, - \isa{agroup} is defined as the subset of \isa{group} such that - for all of its elements \isa{{\isasymtau}}, the operation \isa{{\isasymodot}\ {\isasymColon}\ {\isasymtau}\ {\isasymRightarrow}\ {\isasymtau}\ {\isasymRightarrow}\ {\isasymtau}} is even commutative.% -\end{isamarkuptext}% -\isamarkuptrue% -% -\isamarkupsubsection{Abstract reasoning% -} -\isamarkuptrue% -% -\begin{isamarkuptext}% -In a sense, axiomatic type classes may be viewed as \emph{abstract - theories}. Above class definitions gives rise to abstract axioms - \isa{assoc}, \isa{left{\isacharunderscore}unit}, \isa{left{\isacharunderscore}inverse}, \isa{commute}, where any of these contain a type variable \isa{{\isacharprime}a\ {\isasymColon}\ c} that is restricted to types of the corresponding class \isa{c}. \emph{Sort constraints} like this express a logical - precondition for the whole formula. For example, \isa{assoc} - states that for all \isa{{\isasymtau}}, provided that \isa{{\isasymtau}\ {\isasymColon}\ semigroup}, the operation \isa{{\isasymodot}\ {\isasymColon}\ {\isasymtau}\ {\isasymRightarrow}\ {\isasymtau}\ {\isasymRightarrow}\ {\isasymtau}} is associative. - - \medskip From a technical point of view, abstract axioms are just - ordinary Isabelle theorems, which may be used in proofs without - special treatment. Such ``abstract proofs'' usually yield new - ``abstract theorems''. For example, we may now derive the following - well-known laws of general groups.% -\end{isamarkuptext}% -\isamarkuptrue% -\isacommand{theorem}\isamarkupfalse% -\ group{\isacharunderscore}right{\isacharunderscore}inverse{\isacharcolon}\ {\isachardoublequoteopen}x\ {\isasymodot}\ x{\isasyminv}\ {\isacharequal}\ {\isacharparenleft}{\isasymone}{\isasymColon}{\isacharprime}a{\isasymColon}group{\isacharparenright}{\isachardoublequoteclose}\isanewline -% -\isadelimproof -% -\endisadelimproof -% -\isatagproof -\isacommand{proof}\isamarkupfalse% -\ {\isacharminus}\isanewline -\ \ \isacommand{have}\isamarkupfalse% -\ {\isachardoublequoteopen}x\ {\isasymodot}\ x{\isasyminv}\ {\isacharequal}\ {\isasymone}\ {\isasymodot}\ {\isacharparenleft}x\ {\isasymodot}\ x{\isasyminv}{\isacharparenright}{\isachardoublequoteclose}\isanewline -\ \ \ \ \isacommand{by}\isamarkupfalse% -\ {\isacharparenleft}simp\ only{\isacharcolon}\ group{\isacharunderscore}class{\isachardot}left{\isacharunderscore}unit{\isacharparenright}\isanewline -\ \ \isacommand{also}\isamarkupfalse% -\ \isacommand{have}\isamarkupfalse% -\ {\isachardoublequoteopen}{\isachardot}{\isachardot}{\isachardot}\ {\isacharequal}\ {\isasymone}\ {\isasymodot}\ x\ {\isasymodot}\ x{\isasyminv}{\isachardoublequoteclose}\isanewline -\ \ \ \ \isacommand{by}\isamarkupfalse% -\ {\isacharparenleft}simp\ only{\isacharcolon}\ semigroup{\isacharunderscore}class{\isachardot}assoc{\isacharparenright}\isanewline -\ \ \isacommand{also}\isamarkupfalse% -\ \isacommand{have}\isamarkupfalse% -\ {\isachardoublequoteopen}{\isachardot}{\isachardot}{\isachardot}\ {\isacharequal}\ {\isacharparenleft}x{\isasyminv}{\isacharparenright}{\isasyminv}\ {\isasymodot}\ x{\isasyminv}\ {\isasymodot}\ x\ {\isasymodot}\ x{\isasyminv}{\isachardoublequoteclose}\isanewline -\ \ \ \ \isacommand{by}\isamarkupfalse% -\ {\isacharparenleft}simp\ only{\isacharcolon}\ group{\isacharunderscore}class{\isachardot}left{\isacharunderscore}inverse{\isacharparenright}\isanewline -\ \ \isacommand{also}\isamarkupfalse% -\ \isacommand{have}\isamarkupfalse% -\ {\isachardoublequoteopen}{\isachardot}{\isachardot}{\isachardot}\ {\isacharequal}\ {\isacharparenleft}x{\isasyminv}{\isacharparenright}{\isasyminv}\ {\isasymodot}\ {\isacharparenleft}x{\isasyminv}\ {\isasymodot}\ x{\isacharparenright}\ {\isasymodot}\ x{\isasyminv}{\isachardoublequoteclose}\isanewline -\ \ \ \ \isacommand{by}\isamarkupfalse% -\ {\isacharparenleft}simp\ only{\isacharcolon}\ semigroup{\isacharunderscore}class{\isachardot}assoc{\isacharparenright}\isanewline -\ \ \isacommand{also}\isamarkupfalse% -\ \isacommand{have}\isamarkupfalse% -\ {\isachardoublequoteopen}{\isachardot}{\isachardot}{\isachardot}\ {\isacharequal}\ {\isacharparenleft}x{\isasyminv}{\isacharparenright}{\isasyminv}\ {\isasymodot}\ {\isasymone}\ {\isasymodot}\ x{\isasyminv}{\isachardoublequoteclose}\isanewline -\ \ \ \ \isacommand{by}\isamarkupfalse% -\ {\isacharparenleft}simp\ only{\isacharcolon}\ group{\isacharunderscore}class{\isachardot}left{\isacharunderscore}inverse{\isacharparenright}\isanewline -\ \ \isacommand{also}\isamarkupfalse% -\ \isacommand{have}\isamarkupfalse% -\ {\isachardoublequoteopen}{\isachardot}{\isachardot}{\isachardot}\ {\isacharequal}\ {\isacharparenleft}x{\isasyminv}{\isacharparenright}{\isasyminv}\ {\isasymodot}\ {\isacharparenleft}{\isasymone}\ {\isasymodot}\ x{\isasyminv}{\isacharparenright}{\isachardoublequoteclose}\isanewline -\ \ \ \ \isacommand{by}\isamarkupfalse% -\ {\isacharparenleft}simp\ only{\isacharcolon}\ semigroup{\isacharunderscore}class{\isachardot}assoc{\isacharparenright}\isanewline -\ \ \isacommand{also}\isamarkupfalse% -\ \isacommand{have}\isamarkupfalse% -\ {\isachardoublequoteopen}{\isachardot}{\isachardot}{\isachardot}\ {\isacharequal}\ {\isacharparenleft}x{\isasyminv}{\isacharparenright}{\isasyminv}\ {\isasymodot}\ x{\isasyminv}{\isachardoublequoteclose}\isanewline -\ \ \ \ \isacommand{by}\isamarkupfalse% -\ {\isacharparenleft}simp\ only{\isacharcolon}\ group{\isacharunderscore}class{\isachardot}left{\isacharunderscore}unit{\isacharparenright}\isanewline -\ \ \isacommand{also}\isamarkupfalse% -\ \isacommand{have}\isamarkupfalse% -\ {\isachardoublequoteopen}{\isachardot}{\isachardot}{\isachardot}\ {\isacharequal}\ {\isasymone}{\isachardoublequoteclose}\isanewline -\ \ \ \ \isacommand{by}\isamarkupfalse% -\ {\isacharparenleft}simp\ only{\isacharcolon}\ group{\isacharunderscore}class{\isachardot}left{\isacharunderscore}inverse{\isacharparenright}\isanewline -\ \ \isacommand{finally}\isamarkupfalse% -\ \isacommand{show}\isamarkupfalse% -\ {\isacharquery}thesis\ \isacommand{{\isachardot}}\isamarkupfalse% -\isanewline -\isacommand{qed}\isamarkupfalse% -% -\endisatagproof -{\isafoldproof}% -% -\isadelimproof -% -\endisadelimproof -% -\begin{isamarkuptext}% -\noindent With \isa{group{\isacharunderscore}right{\isacharunderscore}inverse} already available, \isa{group{\isacharunderscore}right{\isacharunderscore}unit}\label{thm:group-right-unit} is now established - much easier.% -\end{isamarkuptext}% -\isamarkuptrue% -\isacommand{theorem}\isamarkupfalse% -\ group{\isacharunderscore}right{\isacharunderscore}unit{\isacharcolon}\ {\isachardoublequoteopen}x\ {\isasymodot}\ {\isasymone}\ {\isacharequal}\ {\isacharparenleft}x{\isasymColon}{\isacharprime}a{\isasymColon}group{\isacharparenright}{\isachardoublequoteclose}\isanewline -% -\isadelimproof -% -\endisadelimproof -% -\isatagproof -\isacommand{proof}\isamarkupfalse% -\ {\isacharminus}\isanewline -\ \ \isacommand{have}\isamarkupfalse% -\ {\isachardoublequoteopen}x\ {\isasymodot}\ {\isasymone}\ {\isacharequal}\ x\ {\isasymodot}\ {\isacharparenleft}x{\isasyminv}\ {\isasymodot}\ x{\isacharparenright}{\isachardoublequoteclose}\isanewline -\ \ \ \ \isacommand{by}\isamarkupfalse% -\ {\isacharparenleft}simp\ only{\isacharcolon}\ group{\isacharunderscore}class{\isachardot}left{\isacharunderscore}inverse{\isacharparenright}\isanewline -\ \ \isacommand{also}\isamarkupfalse% -\ \isacommand{have}\isamarkupfalse% -\ {\isachardoublequoteopen}{\isachardot}{\isachardot}{\isachardot}\ {\isacharequal}\ x\ {\isasymodot}\ x{\isasyminv}\ {\isasymodot}\ x{\isachardoublequoteclose}\isanewline -\ \ \ \ \isacommand{by}\isamarkupfalse% -\ {\isacharparenleft}simp\ only{\isacharcolon}\ semigroup{\isacharunderscore}class{\isachardot}assoc{\isacharparenright}\isanewline -\ \ \isacommand{also}\isamarkupfalse% -\ \isacommand{have}\isamarkupfalse% -\ {\isachardoublequoteopen}{\isachardot}{\isachardot}{\isachardot}\ {\isacharequal}\ {\isasymone}\ {\isasymodot}\ x{\isachardoublequoteclose}\isanewline -\ \ \ \ \isacommand{by}\isamarkupfalse% -\ {\isacharparenleft}simp\ only{\isacharcolon}\ group{\isacharunderscore}right{\isacharunderscore}inverse{\isacharparenright}\isanewline -\ \ \isacommand{also}\isamarkupfalse% -\ \isacommand{have}\isamarkupfalse% -\ {\isachardoublequoteopen}{\isachardot}{\isachardot}{\isachardot}\ {\isacharequal}\ x{\isachardoublequoteclose}\isanewline -\ \ \ \ \isacommand{by}\isamarkupfalse% -\ {\isacharparenleft}simp\ only{\isacharcolon}\ group{\isacharunderscore}class{\isachardot}left{\isacharunderscore}unit{\isacharparenright}\isanewline -\ \ \isacommand{finally}\isamarkupfalse% -\ \isacommand{show}\isamarkupfalse% -\ {\isacharquery}thesis\ \isacommand{{\isachardot}}\isamarkupfalse% -\isanewline -\isacommand{qed}\isamarkupfalse% -% -\endisatagproof -{\isafoldproof}% -% -\isadelimproof -% -\endisadelimproof -% -\begin{isamarkuptext}% -\medskip Abstract theorems may be instantiated to only those types - \isa{{\isasymtau}} where the appropriate class membership \isa{{\isasymtau}\ {\isasymColon}\ c} is - known at Isabelle's type signature level. Since we have \isa{agroup\ {\isasymsubseteq}\ group\ {\isasymsubseteq}\ semigroup} by definition, all theorems of \isa{semigroup} and \isa{group} are automatically inherited by \isa{group} and \isa{agroup}.% -\end{isamarkuptext}% -\isamarkuptrue% -% -\isamarkupsubsection{Abstract instantiation% -} -\isamarkuptrue% -% -\begin{isamarkuptext}% -From the definition, the \isa{monoid} and \isa{group} classes - have been independent. Note that for monoids, \isa{right{\isacharunderscore}unit} - had to be included as an axiom, but for groups both \isa{right{\isacharunderscore}unit} and \isa{right{\isacharunderscore}inverse} are derivable from the other - axioms. With \isa{group{\isacharunderscore}right{\isacharunderscore}unit} derived as a theorem of group - theory (see page~\pageref{thm:group-right-unit}), we may now - instantiate \isa{monoid\ {\isasymsubseteq}\ semigroup} and \isa{group\ {\isasymsubseteq}\ monoid} properly as follows (cf.\ \figref{fig:monoid-group}). - - \begin{figure}[htbp] - \begin{center} - \small - \unitlength 0.6mm - \begin{picture}(65,90)(0,-10) - \put(15,10){\line(0,1){10}} \put(15,30){\line(0,1){10}} - \put(15,50){\line(1,1){10}} \put(35,60){\line(1,-1){10}} - \put(15,5){\makebox(0,0){\isa{agroup}}} - \put(15,25){\makebox(0,0){\isa{group}}} - \put(15,45){\makebox(0,0){\isa{semigroup}}} - \put(30,65){\makebox(0,0){\isa{type}}} \put(50,45){\makebox(0,0){\isa{monoid}}} - \end{picture} - \hspace{4em} - \begin{picture}(30,90)(0,0) - \put(15,10){\line(0,1){10}} \put(15,30){\line(0,1){10}} - \put(15,50){\line(0,1){10}} \put(15,70){\line(0,1){10}} - \put(15,5){\makebox(0,0){\isa{agroup}}} - \put(15,25){\makebox(0,0){\isa{group}}} - \put(15,45){\makebox(0,0){\isa{monoid}}} - \put(15,65){\makebox(0,0){\isa{semigroup}}} - \put(15,85){\makebox(0,0){\isa{type}}} - \end{picture} - \caption{Monoids and groups: according to definition, and by proof} - \label{fig:monoid-group} - \end{center} - \end{figure}% -\end{isamarkuptext}% -\isamarkuptrue% -\isacommand{instance}\isamarkupfalse% -\ monoid\ {\isasymsubseteq}\ semigroup\isanewline -% -\isadelimproof -% -\endisadelimproof -% -\isatagproof -\isacommand{proof}\isamarkupfalse% -\isanewline -\ \ \isacommand{fix}\isamarkupfalse% -\ x\ y\ z\ {\isacharcolon}{\isacharcolon}\ {\isachardoublequoteopen}{\isacharprime}a{\isasymColon}monoid{\isachardoublequoteclose}\isanewline -\ \ \isacommand{show}\isamarkupfalse% -\ {\isachardoublequoteopen}x\ {\isasymodot}\ y\ {\isasymodot}\ z\ {\isacharequal}\ x\ {\isasymodot}\ {\isacharparenleft}y\ {\isasymodot}\ z{\isacharparenright}{\isachardoublequoteclose}\isanewline -\ \ \ \ \isacommand{by}\isamarkupfalse% -\ {\isacharparenleft}rule\ monoid{\isacharunderscore}class{\isachardot}assoc{\isacharparenright}\isanewline -\isacommand{qed}\isamarkupfalse% -% -\endisatagproof -{\isafoldproof}% -% -\isadelimproof -\isanewline -% -\endisadelimproof -\isanewline -\isacommand{instance}\isamarkupfalse% -\ group\ {\isasymsubseteq}\ monoid\isanewline -% -\isadelimproof -% -\endisadelimproof -% -\isatagproof -\isacommand{proof}\isamarkupfalse% -\isanewline -\ \ \isacommand{fix}\isamarkupfalse% -\ x\ y\ z\ {\isacharcolon}{\isacharcolon}\ {\isachardoublequoteopen}{\isacharprime}a{\isasymColon}group{\isachardoublequoteclose}\isanewline -\ \ \isacommand{show}\isamarkupfalse% -\ {\isachardoublequoteopen}x\ {\isasymodot}\ y\ {\isasymodot}\ z\ {\isacharequal}\ x\ {\isasymodot}\ {\isacharparenleft}y\ {\isasymodot}\ z{\isacharparenright}{\isachardoublequoteclose}\isanewline -\ \ \ \ \isacommand{by}\isamarkupfalse% -\ {\isacharparenleft}rule\ semigroup{\isacharunderscore}class{\isachardot}assoc{\isacharparenright}\isanewline -\ \ \isacommand{show}\isamarkupfalse% -\ {\isachardoublequoteopen}{\isasymone}\ {\isasymodot}\ x\ {\isacharequal}\ x{\isachardoublequoteclose}\isanewline -\ \ \ \ \isacommand{by}\isamarkupfalse% -\ {\isacharparenleft}rule\ group{\isacharunderscore}class{\isachardot}left{\isacharunderscore}unit{\isacharparenright}\isanewline -\ \ \isacommand{show}\isamarkupfalse% -\ {\isachardoublequoteopen}x\ {\isasymodot}\ {\isasymone}\ {\isacharequal}\ x{\isachardoublequoteclose}\isanewline -\ \ \ \ \isacommand{by}\isamarkupfalse% -\ {\isacharparenleft}rule\ group{\isacharunderscore}right{\isacharunderscore}unit{\isacharparenright}\isanewline -\isacommand{qed}\isamarkupfalse% -% -\endisatagproof -{\isafoldproof}% -% -\isadelimproof -% -\endisadelimproof -% -\begin{isamarkuptext}% -\medskip The \isakeyword{instance} command sets up an appropriate - goal that represents the class inclusion (or type arity, see - \secref{sec:inst-arity}) to be proven (see also - \cite{isabelle-isar-ref}). The initial proof step causes - back-chaining of class membership statements wrt.\ the hierarchy of - any classes defined in the current theory; the effect is to reduce - to the initial statement to a number of goals that directly - correspond to any class axioms encountered on the path upwards - through the class hierarchy.% -\end{isamarkuptext}% -\isamarkuptrue% -% -\isamarkupsubsection{Concrete instantiation \label{sec:inst-arity}% -} -\isamarkuptrue% -% -\begin{isamarkuptext}% -So far we have covered the case of the form - \isakeyword{instance}~\isa{c\isactrlsub {\isadigit{1}}\ {\isasymsubseteq}\ c\isactrlsub {\isadigit{2}}}, namely - \emph{abstract instantiation} --- $c@1$ is more special than \isa{c\isactrlsub {\isadigit{1}}} and thus an instance of \isa{c\isactrlsub {\isadigit{2}}}. Even more - interesting for practical applications are \emph{concrete - instantiations} of axiomatic type classes. That is, certain simple - schemes \isa{{\isacharparenleft}{\isasymalpha}\isactrlsub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ {\isasymalpha}\isactrlsub n{\isacharparenright}\ t\ {\isasymColon}\ c} of class - membership may be established at the logical level and then - transferred to Isabelle's type signature level. - - \medskip As a typical example, we show that type \isa{bool} with - exclusive-or as \isa{{\isasymodot}} operation, identity as \isa{{\isasyminv}}, and - \isa{False} as \isa{{\isasymone}} forms an Abelian group.% -\end{isamarkuptext}% -\isamarkuptrue% -\isacommand{defs}\isamarkupfalse% -\ {\isacharparenleft}\isakeyword{overloaded}{\isacharparenright}\isanewline -\ \ times{\isacharunderscore}bool{\isacharunderscore}def{\isacharcolon}\ {\isachardoublequoteopen}x\ {\isasymodot}\ y\ {\isasymequiv}\ x\ {\isasymnoteq}\ {\isacharparenleft}y{\isasymColon}bool{\isacharparenright}{\isachardoublequoteclose}\isanewline -\ \ inverse{\isacharunderscore}bool{\isacharunderscore}def{\isacharcolon}\ {\isachardoublequoteopen}x{\isasyminv}\ {\isasymequiv}\ x{\isasymColon}bool{\isachardoublequoteclose}\isanewline -\ \ unit{\isacharunderscore}bool{\isacharunderscore}def{\isacharcolon}\ {\isachardoublequoteopen}{\isasymone}\ {\isasymequiv}\ False{\isachardoublequoteclose}% -\begin{isamarkuptext}% -\medskip It is important to note that above \isakeyword{defs} are - just overloaded meta-level constant definitions, where type classes - are not yet involved at all. This form of constant definition with - overloading (and optional recursion over the syntactic structure of - simple types) are admissible as definitional extensions of plain HOL - \cite{Wenzel:1997:TPHOL}. The Haskell-style type system is not - required for overloading. Nevertheless, overloaded definitions are - best applied in the context of type classes. - - \medskip Since we have chosen above \isakeyword{defs} of the generic - group operations on type \isa{bool} appropriately, the class - membership \isa{bool\ {\isasymColon}\ agroup} may be now derived as follows.% -\end{isamarkuptext}% -\isamarkuptrue% -\isacommand{instance}\isamarkupfalse% -\ bool\ {\isacharcolon}{\isacharcolon}\ agroup\isanewline -% -\isadelimproof -% -\endisadelimproof -% -\isatagproof -\isacommand{proof}\isamarkupfalse% -\ {\isacharparenleft}intro{\isacharunderscore}classes{\isacharcomma}\isanewline -\ \ \ \ unfold\ times{\isacharunderscore}bool{\isacharunderscore}def\ inverse{\isacharunderscore}bool{\isacharunderscore}def\ unit{\isacharunderscore}bool{\isacharunderscore}def{\isacharparenright}\isanewline -\ \ \isacommand{fix}\isamarkupfalse% -\ x\ y\ z\isanewline -\ \ \isacommand{show}\isamarkupfalse% -\ {\isachardoublequoteopen}{\isacharparenleft}{\isacharparenleft}x\ {\isasymnoteq}\ y{\isacharparenright}\ {\isasymnoteq}\ z{\isacharparenright}\ {\isacharequal}\ {\isacharparenleft}x\ {\isasymnoteq}\ {\isacharparenleft}y\ {\isasymnoteq}\ z{\isacharparenright}{\isacharparenright}{\isachardoublequoteclose}\ \isacommand{by}\isamarkupfalse% -\ blast\isanewline -\ \ \isacommand{show}\isamarkupfalse% -\ {\isachardoublequoteopen}{\isacharparenleft}False\ {\isasymnoteq}\ x{\isacharparenright}\ {\isacharequal}\ x{\isachardoublequoteclose}\ \isacommand{by}\isamarkupfalse% -\ blast\isanewline -\ \ \isacommand{show}\isamarkupfalse% -\ {\isachardoublequoteopen}{\isacharparenleft}x\ {\isasymnoteq}\ x{\isacharparenright}\ {\isacharequal}\ False{\isachardoublequoteclose}\ \isacommand{by}\isamarkupfalse% -\ blast\isanewline -\ \ \isacommand{show}\isamarkupfalse% -\ {\isachardoublequoteopen}{\isacharparenleft}x\ {\isasymnoteq}\ y{\isacharparenright}\ {\isacharequal}\ {\isacharparenleft}y\ {\isasymnoteq}\ x{\isacharparenright}{\isachardoublequoteclose}\ \isacommand{by}\isamarkupfalse% -\ blast\isanewline -\isacommand{qed}\isamarkupfalse% -% -\endisatagproof -{\isafoldproof}% -% -\isadelimproof -% -\endisadelimproof -% -\begin{isamarkuptext}% -The result of an \isakeyword{instance} statement is both expressed - as a theorem of Isabelle's meta-logic, and as a type arity of the - type signature. The latter enables type-inference system to take - care of this new instance automatically. - - \medskip We could now also instantiate our group theory classes to - many other concrete types. For example, \isa{int\ {\isasymColon}\ agroup} - (e.g.\ by defining \isa{{\isasymodot}} as addition, \isa{{\isasyminv}} as negation - and \isa{{\isasymone}} as zero) or \isa{list\ {\isasymColon}\ {\isacharparenleft}type{\isacharparenright}\ semigroup} - (e.g.\ if \isa{{\isasymodot}} is defined as list append). Thus, the - characteristic constants \isa{{\isasymodot}}, \isa{{\isasyminv}}, \isa{{\isasymone}} - really become overloaded, i.e.\ have different meanings on different - types.% -\end{isamarkuptext}% -\isamarkuptrue% -% -\isamarkupsubsection{Lifting and Functors% -} -\isamarkuptrue% -% -\begin{isamarkuptext}% -As already mentioned above, overloading in the simply-typed HOL - systems may include recursion over the syntactic structure of types. - That is, definitional equations \isa{c\isactrlsup {\isasymtau}\ {\isasymequiv}\ t} may also - contain constants of name \isa{c} on the right-hand side --- if - these have types that are structurally simpler than \isa{{\isasymtau}}. - - This feature enables us to \emph{lift operations}, say to Cartesian - products, direct sums or function spaces. Subsequently we lift - \isa{{\isasymodot}} component-wise to binary products \isa{{\isacharprime}a\ {\isasymtimes}\ {\isacharprime}b}.% -\end{isamarkuptext}% -\isamarkuptrue% -\isacommand{defs}\isamarkupfalse% -\ {\isacharparenleft}\isakeyword{overloaded}{\isacharparenright}\isanewline -\ \ times{\isacharunderscore}prod{\isacharunderscore}def{\isacharcolon}\ {\isachardoublequoteopen}p\ {\isasymodot}\ q\ {\isasymequiv}\ {\isacharparenleft}fst\ p\ {\isasymodot}\ fst\ q{\isacharcomma}\ snd\ p\ {\isasymodot}\ snd\ q{\isacharparenright}{\isachardoublequoteclose}% -\begin{isamarkuptext}% -It is very easy to see that associativity of \isa{{\isasymodot}} on \isa{{\isacharprime}a} - and \isa{{\isasymodot}} on \isa{{\isacharprime}b} transfers to \isa{{\isasymodot}} on \isa{{\isacharprime}a\ {\isasymtimes}\ {\isacharprime}b}. Hence the binary type constructor \isa{{\isasymodot}} maps semigroups - to semigroups. This may be established formally as follows.% -\end{isamarkuptext}% -\isamarkuptrue% -\isacommand{instance}\isamarkupfalse% -\ {\isacharasterisk}\ {\isacharcolon}{\isacharcolon}\ {\isacharparenleft}semigroup{\isacharcomma}\ semigroup{\isacharparenright}\ semigroup\isanewline -% -\isadelimproof -% -\endisadelimproof -% -\isatagproof -\isacommand{proof}\isamarkupfalse% -\ {\isacharparenleft}intro{\isacharunderscore}classes{\isacharcomma}\ unfold\ times{\isacharunderscore}prod{\isacharunderscore}def{\isacharparenright}\isanewline -\ \ \isacommand{fix}\isamarkupfalse% -\ p\ q\ r\ {\isacharcolon}{\isacharcolon}\ {\isachardoublequoteopen}{\isacharprime}a{\isasymColon}semigroup\ {\isasymtimes}\ {\isacharprime}b{\isasymColon}semigroup{\isachardoublequoteclose}\isanewline -\ \ \isacommand{show}\isamarkupfalse% -\isanewline -\ \ \ \ {\isachardoublequoteopen}{\isacharparenleft}fst\ {\isacharparenleft}fst\ p\ {\isasymodot}\ fst\ q{\isacharcomma}\ snd\ p\ {\isasymodot}\ snd\ q{\isacharparenright}\ {\isasymodot}\ fst\ r{\isacharcomma}\isanewline -\ \ \ \ \ \ snd\ {\isacharparenleft}fst\ p\ {\isasymodot}\ fst\ q{\isacharcomma}\ snd\ p\ {\isasymodot}\ snd\ q{\isacharparenright}\ {\isasymodot}\ snd\ r{\isacharparenright}\ {\isacharequal}\isanewline -\ \ \ \ \ \ \ {\isacharparenleft}fst\ p\ {\isasymodot}\ fst\ {\isacharparenleft}fst\ q\ {\isasymodot}\ fst\ r{\isacharcomma}\ snd\ q\ {\isasymodot}\ snd\ r{\isacharparenright}{\isacharcomma}\isanewline -\ \ \ \ \ \ \ \ snd\ p\ {\isasymodot}\ snd\ {\isacharparenleft}fst\ q\ {\isasymodot}\ fst\ r{\isacharcomma}\ snd\ q\ {\isasymodot}\ snd\ r{\isacharparenright}{\isacharparenright}{\isachardoublequoteclose}\isanewline -\ \ \ \ \isacommand{by}\isamarkupfalse% -\ {\isacharparenleft}simp\ add{\isacharcolon}\ semigroup{\isacharunderscore}class{\isachardot}assoc{\isacharparenright}\isanewline -\isacommand{qed}\isamarkupfalse% -% -\endisatagproof -{\isafoldproof}% -% -\isadelimproof -% -\endisadelimproof -% -\begin{isamarkuptext}% -Thus, if we view class instances as ``structures'', then overloaded - constant definitions with recursion over types indirectly provide - some kind of ``functors'' --- i.e.\ mappings between abstract - theories.% -\end{isamarkuptext}% -\isamarkuptrue% -% -\isadelimtheory -% -\endisadelimtheory -% -\isatagtheory -\isacommand{end}\isamarkupfalse% -% -\endisatagtheory -{\isafoldtheory}% -% -\isadelimtheory -% -\endisadelimtheory -\isanewline -\end{isabellebody}% -%%% Local Variables: -%%% mode: latex -%%% TeX-master: "root" -%%% End: diff -r 419116f1157a -r e23770bc97c8 doc-src/AxClass/Group/document/Product.tex --- a/doc-src/AxClass/Group/document/Product.tex Thu Feb 26 08:44:44 2009 -0800 +++ /dev/null Thu Jan 01 00:00:00 1970 +0000 @@ -1,133 +0,0 @@ -% -\begin{isabellebody}% -\def\isabellecontext{Product}% -% -\isamarkupheader{Syntactic classes% -} -\isamarkuptrue% -% -\isadelimtheory -% -\endisadelimtheory -% -\isatagtheory -\isacommand{theory}\isamarkupfalse% -\ Product\ \isakeyword{imports}\ Main\ \isakeyword{begin}% -\endisatagtheory -{\isafoldtheory}% -% -\isadelimtheory -% -\endisadelimtheory -% -\begin{isamarkuptext}% -\medskip\noindent There is still a feature of Isabelle's type system - left that we have not yet discussed. When declaring polymorphic - constants \isa{c\ {\isasymColon}\ {\isasymsigma}}, the type variables occurring in \isa{{\isasymsigma}} - may be constrained by type classes (or even general sorts) in an - arbitrary way. Note that by default, in Isabelle/HOL the - declaration \isa{{\isasymodot}\ {\isasymColon}\ {\isacharprime}a\ {\isasymRightarrow}\ {\isacharprime}a\ {\isasymRightarrow}\ {\isacharprime}a} is actually an abbreviation - for \isa{{\isasymodot}\ {\isasymColon}\ {\isacharprime}a{\isasymColon}type\ {\isasymRightarrow}\ {\isacharprime}a\ {\isasymRightarrow}\ {\isacharprime}a} Since class \isa{type} is the - universal class of HOL, this is not really a constraint at all. - - The \isa{product} class below provides a less degenerate example of - syntactic type classes.% -\end{isamarkuptext}% -\isamarkuptrue% -\isacommand{axclass}\isamarkupfalse% -\isanewline -\ \ product\ {\isasymsubseteq}\ type\isanewline -\isacommand{consts}\isamarkupfalse% -\isanewline -\ \ product\ {\isacharcolon}{\isacharcolon}\ {\isachardoublequoteopen}{\isacharprime}a{\isasymColon}product\ {\isasymRightarrow}\ {\isacharprime}a\ {\isasymRightarrow}\ {\isacharprime}a{\isachardoublequoteclose}\ \ \ \ {\isacharparenleft}\isakeyword{infixl}\ {\isachardoublequoteopen}{\isasymodot}{\isachardoublequoteclose}\ {\isadigit{7}}{\isadigit{0}}{\isacharparenright}% -\begin{isamarkuptext}% -Here class \isa{product} is defined as subclass of \isa{type} - without any additional axioms. This effects in logical equivalence - of \isa{product} and \isa{type}, as is reflected by the trivial - introduction rule generated for this definition. - - \medskip So what is the difference of declaring \isa{{\isasymodot}\ {\isasymColon}\ {\isacharprime}a{\isasymColon}product\ {\isasymRightarrow}\ {\isacharprime}a\ {\isasymRightarrow}\ {\isacharprime}a} vs.\ declaring \isa{{\isasymodot}\ {\isasymColon}\ {\isacharprime}a{\isasymColon}type\ {\isasymRightarrow}\ {\isacharprime}a\ {\isasymRightarrow}\ {\isacharprime}a} anyway? In this particular case where \isa{product\ {\isasymequiv}\ type}, it should be obvious that both declarations are the same - from the logic's point of view. It even makes the most sense to - remove sort constraints from constant declarations, as far as the - purely logical meaning is concerned \cite{Wenzel:1997:TPHOL}. - - On the other hand there are syntactic differences, of course. - Constants \isa{{\isasymodot}} on some type \isa{{\isasymtau}} are rejected by the - type-checker, unless the arity \isa{{\isasymtau}\ {\isasymColon}\ product} is part of the - type signature. In our example, this arity may be always added when - required by means of an \isakeyword{instance} with the default proof - (double-dot). - - \medskip Thus, we may observe the following discipline of using - syntactic classes. Overloaded polymorphic constants have their type - arguments restricted to an associated (logically trivial) class - \isa{c}. Only immediately before \emph{specifying} these - constants on a certain type \isa{{\isasymtau}} do we instantiate \isa{{\isasymtau}\ {\isasymColon}\ c}. - - This is done for class \isa{product} and type \isa{bool} as - follows.% -\end{isamarkuptext}% -\isamarkuptrue% -\isacommand{instance}\isamarkupfalse% -\ bool\ {\isacharcolon}{\isacharcolon}\ product% -\isadelimproof -\ % -\endisadelimproof -% -\isatagproof -\isacommand{{\isachardot}{\isachardot}}\isamarkupfalse% -% -\endisatagproof -{\isafoldproof}% -% -\isadelimproof -% -\endisadelimproof -\isanewline -\isacommand{defs}\isamarkupfalse% -\ {\isacharparenleft}\isakeyword{overloaded}{\isacharparenright}\isanewline -\ \ product{\isacharunderscore}bool{\isacharunderscore}def{\isacharcolon}\ {\isachardoublequoteopen}x\ {\isasymodot}\ y\ {\isasymequiv}\ x\ {\isasymand}\ y{\isachardoublequoteclose}% -\begin{isamarkuptext}% -The definition \isa{prod{\isacharunderscore}bool{\isacharunderscore}def} becomes syntactically - well-formed only after the arity \isa{bool\ {\isasymColon}\ product} is made - known to the type checker. - - \medskip It is very important to see that above \isakeyword{defs} are - not directly connected with \isakeyword{instance} at all! We were - just following our convention to specify \isa{{\isasymodot}} on \isa{bool} - after having instantiated \isa{bool\ {\isasymColon}\ product}. Isabelle does - not require these definitions, which is in contrast to programming - languages like Haskell \cite{haskell-report}. - - \medskip While Isabelle type classes and those of Haskell are almost - the same as far as type-checking and type inference are concerned, - there are important semantic differences. Haskell classes require - their instances to \emph{provide operations} of certain \emph{names}. - Therefore, its \texttt{instance} has a \texttt{where} part that tells - the system what these ``member functions'' should be. - - This style of \texttt{instance} would not make much sense in - Isabelle's meta-logic, because there is no internal notion of - ``providing operations'' or even ``names of functions''.% -\end{isamarkuptext}% -\isamarkuptrue% -% -\isadelimtheory -% -\endisadelimtheory -% -\isatagtheory -\isacommand{end}\isamarkupfalse% -% -\endisatagtheory -{\isafoldtheory}% -% -\isadelimtheory -% -\endisadelimtheory -\isanewline -\end{isabellebody}% -%%% Local Variables: -%%% mode: latex -%%% TeX-master: "root" -%%% End: diff -r 419116f1157a -r e23770bc97c8 doc-src/AxClass/Group/document/Semigroups.tex --- a/doc-src/AxClass/Group/document/Semigroups.tex Thu Feb 26 08:44:44 2009 -0800 +++ /dev/null Thu Jan 01 00:00:00 1970 +0000 @@ -1,88 +0,0 @@ -% -\begin{isabellebody}% -\def\isabellecontext{Semigroups}% -% -\isamarkupheader{Semigroups% -} -\isamarkuptrue% -% -\isadelimtheory -% -\endisadelimtheory -% -\isatagtheory -\isacommand{theory}\isamarkupfalse% -\ Semigroups\ \isakeyword{imports}\ Main\ \isakeyword{begin}% -\endisatagtheory -{\isafoldtheory}% -% -\isadelimtheory -% -\endisadelimtheory -% -\begin{isamarkuptext}% -\medskip\noindent An axiomatic type class is simply a class of types - that all meet certain properties, which are also called \emph{class - axioms}. Thus, type classes may be also understood as type - predicates --- i.e.\ abstractions over a single type argument \isa{{\isacharprime}a}. Class axioms typically contain polymorphic constants that - depend on this type \isa{{\isacharprime}a}. These \emph{characteristic - constants} behave like operations associated with the ``carrier'' - type \isa{{\isacharprime}a}. - - We illustrate these basic concepts by the following formulation of - semigroups.% -\end{isamarkuptext}% -\isamarkuptrue% -\isacommand{consts}\isamarkupfalse% -\isanewline -\ \ times\ {\isacharcolon}{\isacharcolon}\ {\isachardoublequoteopen}{\isacharprime}a\ {\isasymRightarrow}\ {\isacharprime}a\ {\isasymRightarrow}\ {\isacharprime}a{\isachardoublequoteclose}\ \ \ \ {\isacharparenleft}\isakeyword{infixl}\ {\isachardoublequoteopen}{\isasymodot}{\isachardoublequoteclose}\ {\isadigit{7}}{\isadigit{0}}{\isacharparenright}\isanewline -\isacommand{axclass}\isamarkupfalse% -\ semigroup\ {\isasymsubseteq}\ type\isanewline -\ \ assoc{\isacharcolon}\ {\isachardoublequoteopen}{\isacharparenleft}x\ {\isasymodot}\ y{\isacharparenright}\ {\isasymodot}\ z\ {\isacharequal}\ x\ {\isasymodot}\ {\isacharparenleft}y\ {\isasymodot}\ z{\isacharparenright}{\isachardoublequoteclose}% -\begin{isamarkuptext}% -\noindent Above we have first declared a polymorphic constant \isa{{\isasymodot}\ {\isasymColon}\ {\isacharprime}a\ {\isasymRightarrow}\ {\isacharprime}a\ {\isasymRightarrow}\ {\isacharprime}a} and then defined the class \isa{semigroup} of - all types \isa{{\isasymtau}} such that \isa{{\isasymodot}\ {\isasymColon}\ {\isasymtau}\ {\isasymRightarrow}\ {\isasymtau}\ {\isasymRightarrow}\ {\isasymtau}} is indeed an - associative operator. The \isa{assoc} axiom contains exactly one - type variable, which is invisible in the above presentation, though. - Also note that free term variables (like \isa{x}, \isa{y}, - \isa{z}) are allowed for user convenience --- conceptually all of - these are bound by outermost universal quantifiers. - - \medskip In general, type classes may be used to describe - \emph{structures} with exactly one carrier \isa{{\isacharprime}a} and a fixed - \emph{signature}. Different signatures require different classes. - Below, class \isa{plus{\isacharunderscore}semigroup} represents semigroups \isa{{\isacharparenleft}{\isasymtau}{\isacharcomma}\ {\isasymoplus}\isactrlsup {\isasymtau}{\isacharparenright}}, while the original \isa{semigroup} would - correspond to semigroups of the form \isa{{\isacharparenleft}{\isasymtau}{\isacharcomma}\ {\isasymodot}\isactrlsup {\isasymtau}{\isacharparenright}}.% -\end{isamarkuptext}% -\isamarkuptrue% -\isacommand{consts}\isamarkupfalse% -\isanewline -\ \ plus\ {\isacharcolon}{\isacharcolon}\ {\isachardoublequoteopen}{\isacharprime}a\ {\isasymRightarrow}\ {\isacharprime}a\ {\isasymRightarrow}\ {\isacharprime}a{\isachardoublequoteclose}\ \ \ \ {\isacharparenleft}\isakeyword{infixl}\ {\isachardoublequoteopen}{\isasymoplus}{\isachardoublequoteclose}\ {\isadigit{7}}{\isadigit{0}}{\isacharparenright}\isanewline -\isacommand{axclass}\isamarkupfalse% -\ plus{\isacharunderscore}semigroup\ {\isasymsubseteq}\ type\isanewline -\ \ assoc{\isacharcolon}\ {\isachardoublequoteopen}{\isacharparenleft}x\ {\isasymoplus}\ y{\isacharparenright}\ {\isasymoplus}\ z\ {\isacharequal}\ x\ {\isasymoplus}\ {\isacharparenleft}y\ {\isasymoplus}\ z{\isacharparenright}{\isachardoublequoteclose}% -\begin{isamarkuptext}% -\noindent Even if classes \isa{plus{\isacharunderscore}semigroup} and \isa{semigroup} both represent semigroups in a sense, they are certainly - not quite the same.% -\end{isamarkuptext}% -\isamarkuptrue% -% -\isadelimtheory -% -\endisadelimtheory -% -\isatagtheory -\isacommand{end}\isamarkupfalse% -% -\endisatagtheory -{\isafoldtheory}% -% -\isadelimtheory -% -\endisadelimtheory -\isanewline -\end{isabellebody}% -%%% Local Variables: -%%% mode: latex -%%% TeX-master: "root" -%%% End: diff -r 419116f1157a -r e23770bc97c8 doc-src/AxClass/IsaMakefile --- a/doc-src/AxClass/IsaMakefile Thu Feb 26 08:44:44 2009 -0800 +++ /dev/null Thu Jan 01 00:00:00 1970 +0000 @@ -1,47 +0,0 @@ - -## targets - -default: Group Nat -images: -test: Group Nat - -all: images test - - -## global settings - -SRC = $(ISABELLE_HOME)/src -OUT = $(ISABELLE_OUTPUT) -LOG = $(OUT)/log -USEDIR = $(ISABELLE_TOOL) usedir -d false -D document - - -## Group - -Group: HOL $(LOG)/HOL-Group.gz - -HOL: - @cd $(SRC)/HOL; $(ISABELLE_TOOL) make HOL - -$(LOG)/HOL-Group.gz: $(OUT)/HOL Group/ROOT.ML Group/Group.thy \ - Group/Product.thy Group/Semigroups.thy - @$(USEDIR) $(OUT)/HOL Group - @rm -f Group/document/pdfsetup.sty Group/document/session.tex - - -## Nat - -Nat: FOL $(LOG)/FOL-Nat.gz - -FOL: - @cd $(SRC)/FOL; $(ISABELLE_TOOL) make FOL - -$(LOG)/FOL-Nat.gz: $(OUT)/FOL Nat/ROOT.ML Nat/NatClass.thy - @$(USEDIR) $(OUT)/FOL Nat - @rm -f Nat/document/*.sty Nat/document/session.tex - - -## clean - -clean: - @rm -f $(LOG)/HOL-Group.gz $(LOG)/FOL-Nat.gz diff -r 419116f1157a -r e23770bc97c8 doc-src/AxClass/Makefile --- a/doc-src/AxClass/Makefile Thu Feb 26 08:44:44 2009 -0800 +++ /dev/null Thu Jan 01 00:00:00 1970 +0000 @@ -1,36 +0,0 @@ -# -# $Id$ -# - -## targets - -default: dvi - - -## dependencies - -include ../Makefile.in - -NAME = axclass - -FILES = axclass.tex body.tex ../iman.sty ../extra.sty ../isar.sty \ - ../isabelle.sty ../isabellesym.sty ../pdfsetup.sty \ - Group/document/Group.tex Nat/document/NatClass.tex \ - Group/document/Product.tex Group/document/Semigroups.tex - -dvi: $(NAME).dvi - -$(NAME).dvi: $(FILES) isabelle_isar.eps - $(LATEX) $(NAME) - $(BIBTEX) $(NAME) - $(LATEX) $(NAME) - $(LATEX) $(NAME) - -pdf: $(NAME).pdf - -$(NAME).pdf: $(FILES) isabelle_isar.pdf - $(PDFLATEX) $(NAME) - $(FIXBOOKMARKS) $(NAME).out - $(BIBTEX) $(NAME) - $(PDFLATEX) $(NAME) - $(PDFLATEX) $(NAME) diff -r 419116f1157a -r e23770bc97c8 doc-src/AxClass/Nat/NatClass.thy --- a/doc-src/AxClass/Nat/NatClass.thy Thu Feb 26 08:44:44 2009 -0800 +++ /dev/null Thu Jan 01 00:00:00 1970 +0000 @@ -1,117 +0,0 @@ - -header {* Defining natural numbers in FOL \label{sec:ex-natclass} *} - -theory NatClass imports FOL begin - -text {* - \medskip\noindent Axiomatic type classes abstract over exactly one - type argument. Thus, any \emph{axiomatic} theory extension where each - axiom refers to at most one type variable, may be trivially turned - into a \emph{definitional} one. - - We illustrate this with the natural numbers in - Isabelle/FOL.\footnote{See also - \url{http://isabelle.in.tum.de/library/FOL/ex/NatClass.html}} -*} - -consts - zero :: 'a ("\") - Suc :: "'a \ 'a" - rec :: "'a \ 'a \ ('a \ 'a \ 'a) \ 'a" - -axclass nat \ "term" - induct: "P(\) \ (\x. P(x) \ P(Suc(x))) \ P(n)" - Suc_inject: "Suc(m) = Suc(n) \ m = n" - Suc_neq_0: "Suc(m) = \ \ R" - rec_0: "rec(\, a, f) = a" - rec_Suc: "rec(Suc(m), a, f) = f(m, rec(m, a, f))" - -constdefs - add :: "'a::nat \ 'a \ 'a" (infixl "+" 60) - "m + n \ rec(m, n, \x y. Suc(y))" - -text {* - This is an abstract version of the plain @{text Nat} theory in - FOL.\footnote{See - \url{http://isabelle.in.tum.de/library/FOL/ex/Nat.html}} Basically, - we have just replaced all occurrences of type @{text nat} by @{typ - 'a} and used the natural number axioms to define class @{text nat}. - There is only a minor snag, that the original recursion operator - @{term rec} had to be made monomorphic. - - Thus class @{text nat} contains exactly those types @{text \} that - are isomorphic to ``the'' natural numbers (with signature @{term - \}, @{term Suc}, @{term rec}). - - \medskip What we have done here can be also viewed as \emph{type - specification}. Of course, it still remains open if there is some - type at all that meets the class axioms. Now a very nice property of - axiomatic type classes is that abstract reasoning is always possible - --- independent of satisfiability. The meta-logic won't break, even - if some classes (or general sorts) turns out to be empty later --- - ``inconsistent'' class definitions may be useless, but do not cause - any harm. - - Theorems of the abstract natural numbers may be derived in the same - way as for the concrete version. The original proof scripts may be - re-used with some trivial changes only (mostly adding some type - constraints). -*} - -(*<*) -lemma Suc_n_not_n: "Suc(k) ~= (k::'a::nat)" -apply (rule_tac n = k in induct) -apply (rule notI) -apply (erule Suc_neq_0) -apply (rule notI) -apply (erule notE) -apply (erule Suc_inject) -done - -lemma "(k+m)+n = k+(m+n)" -apply (rule induct) -back -back -back -back -back -back -oops - -lemma add_0 [simp]: "\+n = n" -apply (unfold add_def) -apply (rule rec_0) -done - -lemma add_Suc [simp]: "Suc(m)+n = Suc(m+n)" -apply (unfold add_def) -apply (rule rec_Suc) -done - -lemma add_assoc: "(k+m)+n = k+(m+n)" -apply (rule_tac n = k in induct) -apply simp -apply simp -done - -lemma add_0_right: "m+\ = m" -apply (rule_tac n = m in induct) -apply simp -apply simp -done - -lemma add_Suc_right: "m+Suc(n) = Suc(m+n)" -apply (rule_tac n = m in induct) -apply simp_all -done - -lemma - assumes prem: "!!n. f(Suc(n)) = Suc(f(n))" - shows "f(i+j) = i+f(j)" -apply (rule_tac n = i in induct) -apply simp -apply (simp add: prem) -done -(*>*) - -end \ No newline at end of file diff -r 419116f1157a -r e23770bc97c8 doc-src/AxClass/Nat/ROOT.ML --- a/doc-src/AxClass/Nat/ROOT.ML Thu Feb 26 08:44:44 2009 -0800 +++ /dev/null Thu Jan 01 00:00:00 1970 +0000 @@ -1,2 +0,0 @@ - -use_thy "NatClass"; diff -r 419116f1157a -r e23770bc97c8 doc-src/AxClass/Nat/document/NatClass.tex --- a/doc-src/AxClass/Nat/document/NatClass.tex Thu Feb 26 08:44:44 2009 -0800 +++ /dev/null Thu Jan 01 00:00:00 1970 +0000 @@ -1,201 +0,0 @@ -% -\begin{isabellebody}% -\def\isabellecontext{NatClass}% -% -\isamarkupheader{Defining natural numbers in FOL \label{sec:ex-natclass}% -} -\isamarkuptrue% -% -\isadelimtheory -% -\endisadelimtheory -% -\isatagtheory -\isacommand{theory}\isamarkupfalse% -\ NatClass\ \isakeyword{imports}\ FOL\ \isakeyword{begin}% -\endisatagtheory -{\isafoldtheory}% -% -\isadelimtheory -% -\endisadelimtheory -% -\begin{isamarkuptext}% -\medskip\noindent Axiomatic type classes abstract over exactly one - type argument. Thus, any \emph{axiomatic} theory extension where each - axiom refers to at most one type variable, may be trivially turned - into a \emph{definitional} one. - - We illustrate this with the natural numbers in - Isabelle/FOL.\footnote{See also - \url{http://isabelle.in.tum.de/library/FOL/ex/NatClass.html}}% -\end{isamarkuptext}% -\isamarkuptrue% -\isacommand{consts}\isamarkupfalse% -\isanewline -\ \ zero\ {\isacharcolon}{\isacharcolon}\ {\isacharprime}a\ \ \ \ {\isacharparenleft}{\isachardoublequoteopen}{\isasymzero}{\isachardoublequoteclose}{\isacharparenright}\isanewline -\ \ Suc\ {\isacharcolon}{\isacharcolon}\ {\isachardoublequoteopen}{\isacharprime}a\ {\isasymRightarrow}\ {\isacharprime}a{\isachardoublequoteclose}\isanewline -\ \ rec\ {\isacharcolon}{\isacharcolon}\ {\isachardoublequoteopen}{\isacharprime}a\ {\isasymRightarrow}\ {\isacharprime}a\ {\isasymRightarrow}\ {\isacharparenleft}{\isacharprime}a\ {\isasymRightarrow}\ {\isacharprime}a\ {\isasymRightarrow}\ {\isacharprime}a{\isacharparenright}\ {\isasymRightarrow}\ {\isacharprime}a{\isachardoublequoteclose}\isanewline -\isanewline -\isacommand{axclass}\isamarkupfalse% -\ nat\ {\isasymsubseteq}\ {\isachardoublequoteopen}term{\isachardoublequoteclose}\isanewline -\ \ induct{\isacharcolon}\ {\isachardoublequoteopen}P{\isacharparenleft}{\isasymzero}{\isacharparenright}\ {\isasymLongrightarrow}\ {\isacharparenleft}{\isasymAnd}x{\isachardot}\ P{\isacharparenleft}x{\isacharparenright}\ {\isasymLongrightarrow}\ P{\isacharparenleft}Suc{\isacharparenleft}x{\isacharparenright}{\isacharparenright}{\isacharparenright}\ {\isasymLongrightarrow}\ P{\isacharparenleft}n{\isacharparenright}{\isachardoublequoteclose}\isanewline -\ \ Suc{\isacharunderscore}inject{\isacharcolon}\ {\isachardoublequoteopen}Suc{\isacharparenleft}m{\isacharparenright}\ {\isacharequal}\ Suc{\isacharparenleft}n{\isacharparenright}\ {\isasymLongrightarrow}\ m\ {\isacharequal}\ n{\isachardoublequoteclose}\isanewline -\ \ Suc{\isacharunderscore}neq{\isacharunderscore}{\isadigit{0}}{\isacharcolon}\ {\isachardoublequoteopen}Suc{\isacharparenleft}m{\isacharparenright}\ {\isacharequal}\ {\isasymzero}\ {\isasymLongrightarrow}\ R{\isachardoublequoteclose}\isanewline -\ \ rec{\isacharunderscore}{\isadigit{0}}{\isacharcolon}\ {\isachardoublequoteopen}rec{\isacharparenleft}{\isasymzero}{\isacharcomma}\ a{\isacharcomma}\ f{\isacharparenright}\ {\isacharequal}\ a{\isachardoublequoteclose}\isanewline -\ \ rec{\isacharunderscore}Suc{\isacharcolon}\ {\isachardoublequoteopen}rec{\isacharparenleft}Suc{\isacharparenleft}m{\isacharparenright}{\isacharcomma}\ a{\isacharcomma}\ f{\isacharparenright}\ {\isacharequal}\ f{\isacharparenleft}m{\isacharcomma}\ rec{\isacharparenleft}m{\isacharcomma}\ a{\isacharcomma}\ f{\isacharparenright}{\isacharparenright}{\isachardoublequoteclose}\isanewline -\isanewline -\isacommand{constdefs}\isamarkupfalse% -\isanewline -\ \ add\ {\isacharcolon}{\isacharcolon}\ {\isachardoublequoteopen}{\isacharprime}a{\isacharcolon}{\isacharcolon}nat\ {\isasymRightarrow}\ {\isacharprime}a\ {\isasymRightarrow}\ {\isacharprime}a{\isachardoublequoteclose}\ \ \ \ {\isacharparenleft}\isakeyword{infixl}\ {\isachardoublequoteopen}{\isacharplus}{\isachardoublequoteclose}\ {\isadigit{6}}{\isadigit{0}}{\isacharparenright}\isanewline -\ \ {\isachardoublequoteopen}m\ {\isacharplus}\ n\ {\isasymequiv}\ rec{\isacharparenleft}m{\isacharcomma}\ n{\isacharcomma}\ {\isasymlambda}x\ y{\isachardot}\ Suc{\isacharparenleft}y{\isacharparenright}{\isacharparenright}{\isachardoublequoteclose}% -\begin{isamarkuptext}% -This is an abstract version of the plain \isa{Nat} theory in - FOL.\footnote{See - \url{http://isabelle.in.tum.de/library/FOL/ex/Nat.html}} Basically, - we have just replaced all occurrences of type \isa{nat} by \isa{{\isacharprime}a} and used the natural number axioms to define class \isa{nat}. - There is only a minor snag, that the original recursion operator - \isa{rec} had to be made monomorphic. - - Thus class \isa{nat} contains exactly those types \isa{{\isasymtau}} that - are isomorphic to ``the'' natural numbers (with signature \isa{{\isasymzero}}, \isa{Suc}, \isa{rec}). - - \medskip What we have done here can be also viewed as \emph{type - specification}. Of course, it still remains open if there is some - type at all that meets the class axioms. Now a very nice property of - axiomatic type classes is that abstract reasoning is always possible - --- independent of satisfiability. The meta-logic won't break, even - if some classes (or general sorts) turns out to be empty later --- - ``inconsistent'' class definitions may be useless, but do not cause - any harm. - - Theorems of the abstract natural numbers may be derived in the same - way as for the concrete version. The original proof scripts may be - re-used with some trivial changes only (mostly adding some type - constraints).% -\end{isamarkuptext}% -\isamarkuptrue% -% -\isadelimproof -% -\endisadelimproof -% -\isatagproof -% -\endisatagproof -{\isafoldproof}% -% -\isadelimproof -% -\endisadelimproof -% -\isadelimproof -% -\endisadelimproof -% -\isatagproof -% -\endisatagproof -{\isafoldproof}% -% -\isadelimproof -% -\endisadelimproof -% -\isadelimproof -% -\endisadelimproof -% -\isatagproof -% -\endisatagproof -{\isafoldproof}% -% -\isadelimproof -% -\endisadelimproof -% -\isadelimproof -% -\endisadelimproof -% -\isatagproof -% -\endisatagproof -{\isafoldproof}% -% -\isadelimproof -% -\endisadelimproof -% -\isadelimproof -% -\endisadelimproof -% -\isatagproof -% -\endisatagproof -{\isafoldproof}% -% -\isadelimproof -% -\endisadelimproof -% -\isadelimproof -% -\endisadelimproof -% -\isatagproof -% -\endisatagproof -{\isafoldproof}% -% -\isadelimproof -% -\endisadelimproof -% -\isadelimproof -% -\endisadelimproof -% -\isatagproof -% -\endisatagproof -{\isafoldproof}% -% -\isadelimproof -% -\endisadelimproof -% -\isadelimproof -% -\endisadelimproof -% -\isatagproof -% -\endisatagproof -{\isafoldproof}% -% -\isadelimproof -\isanewline -% -\endisadelimproof -% -\isadelimtheory -% -\endisadelimtheory -% -\isatagtheory -\isacommand{end}\isamarkupfalse% -% -\endisatagtheory -{\isafoldtheory}% -% -\isadelimtheory -% -\endisadelimtheory -\end{isabellebody}% -%%% Local Variables: -%%% mode: latex -%%% TeX-master: "root" -%%% End: diff -r 419116f1157a -r e23770bc97c8 doc-src/AxClass/axclass.tex --- a/doc-src/AxClass/axclass.tex Thu Feb 26 08:44:44 2009 -0800 +++ /dev/null Thu Jan 01 00:00:00 1970 +0000 @@ -1,80 +0,0 @@ - -\documentclass[12pt,a4paper,fleqn]{report} -\usepackage{graphicx,../iman,../extra,../isar} -\usepackage{../isabelle,../isabellesym} -\usepackage{../pdfsetup} % last one! - -\isabellestyle{it} -\newcommand{\isasyminv}{\isamath{{}^{-1}}} -\renewcommand{\isasymzero}{\isamath{0}} -\renewcommand{\isasymone}{\isamath{1}} - -\newcommand{\secref}[1]{\S\ref{#1}} -\newcommand{\figref}[1]{figure~\ref{#1}} - -\hyphenation{Isabelle} -\hyphenation{Isar} -\hyphenation{Haskell} - -\title{\includegraphics[scale=0.5]{isabelle_isar} - \\[4ex] Using Axiomatic Type Classes in Isabelle} -\author{\emph{Markus Wenzel} \\ TU M\"unchen} - - -\setcounter{secnumdepth}{2} \setcounter{tocdepth}{2} - -\pagestyle{headings} -\sloppy -\binperiod %%%treat . like a binary operator - - -\begin{document} - -\underscoreoff - -\maketitle - -\begin{abstract} - Isabelle offers order-sorted type classes on top of the simple types of - plain Higher-Order Logic. The resulting type system is similar to that of - the programming language Haskell. Its interpretation within the logic - enables further application, though, apart from restricting polymorphism - syntactically. In particular, the concept of \emph{Axiomatic Type Classes} - provides a useful light-weight mechanism for hierarchically-structured - abstract theories. Subsequently, we demonstrate typical uses of Isabelle's - axiomatic type classes to model basic algebraic structures. - - This document describes axiomatic type classes using Isabelle/Isar theories, - with proofs expressed via Isar proof language elements. The new theory - format greatly simplifies the arrangement of the overall development, since - definitions and proofs may be freely intermixed. Users who prefer tactic - scripts over structured proofs do not need to fall back on separate ML - scripts, though, but may refer to Isar's tactic emulation commands. -\end{abstract} - - -\pagenumbering{roman} \tableofcontents \clearfirst - -\include{body} - -%FIXME -\nocite{nipkow-types93} -\nocite{nipkow-sorts93} -\nocite{Wenzel:1997:TPHOL} -\nocite{paulson-isa-book} -\nocite{isabelle-isar-ref} -\nocite{Wenzel:1999:TPHOL} - -\begingroup - \bibliographystyle{plain} \small\raggedright\frenchspacing - \bibliography{../manual} -\endgroup - -\end{document} - - -%%% Local Variables: -%%% mode: latex -%%% TeX-master: t -%%% End: -% LocalWords: Isabelle FIXME diff -r 419116f1157a -r e23770bc97c8 doc-src/AxClass/body.tex --- a/doc-src/AxClass/body.tex Thu Feb 26 08:44:44 2009 -0800 +++ /dev/null Thu Jan 01 00:00:00 1970 +0000 @@ -1,166 +0,0 @@ - -\chapter{Introduction} - -A Haskell-style type-system \cite{haskell-report} with ordered type-classes -has been present in Isabelle since 1991 already \cite{nipkow-sorts93}. -Initially, classes have mainly served as a \emph{purely syntactic} tool to -formulate polymorphic object-logics in a clean way, such as the standard -Isabelle formulation of many-sorted FOL \cite{paulson-isa-book}. - -Applying classes at the \emph{logical level} to provide a simple notion of -abstract theories and instantiations to concrete ones, has been long proposed -as well \cite{nipkow-types93,nipkow-sorts93}. At that time, Isabelle still -lacked built-in support for these \emph{axiomatic type classes}. More -importantly, their semantics was not yet fully fleshed out (and unnecessarily -complicated, too). - -Since Isabelle94, actual axiomatic type classes have been an integral part of -Isabelle's meta-logic. This very simple implementation is based on a -straight-forward extension of traditional simply-typed Higher-Order Logic, by -including types qualified by logical predicates and overloaded constant -definitions (see \cite{Wenzel:1997:TPHOL} for further details). - -Yet even until Isabelle99, there used to be still a fundamental methodological -problem in using axiomatic type classes conveniently, due to the traditional -distinction of Isabelle theory files vs.\ ML proof scripts. This has been -finally overcome with the advent of Isabelle/Isar theories -\cite{isabelle-isar-ref}: now definitions and proofs may be freely intermixed. -This nicely accommodates the usual procedure of defining axiomatic type -classes, proving abstract properties, defining operations on concrete types, -proving concrete properties for instantiation of classes etc. - -\medskip - -So to cut a long story short, the present version of axiomatic type classes -now provides an even more useful and convenient mechanism for light-weight -abstract theories, without any special technical provisions to be observed by -the user. - - -\chapter{Examples}\label{sec:ex} - -Axiomatic type classes are a concept of Isabelle's meta-logic -\cite{paulson-isa-book,Wenzel:1997:TPHOL}. They may be applied to any -object-logic that directly uses the meta type system, such as Isabelle/HOL -\cite{isabelle-HOL}. Subsequently, we present various examples that are all -formulated within HOL, except the one of \secref{sec:ex-natclass} which is in -FOL. See also \url{http://isabelle.in.tum.de/library/HOL/AxClasses/} and -\url{http://isabelle.in.tum.de/library/FOL/ex/NatClass.html}. - -\input{Group/document/Semigroups} - -\input{Group/document/Group} - -\input{Group/document/Product} - -\input{Nat/document/NatClass} - - -%% FIXME move some parts to ref or isar-ref manual (!?); - -% \chapter{The user interface of Isabelle's axclass package} - -% The actual axiomatic type class package of Isabelle/Pure mainly consists -% of two new theory sections: \texttt{axclass} and \texttt{instance}. Some -% typical applications of these have already been demonstrated in -% \secref{sec:ex}, below their syntax and semantics are presented more -% completely. - - -% \section{The axclass section} - -% Within theory files, \texttt{axclass} introduces an axiomatic type class -% definition. Its concrete syntax is: - -% \begin{matharray}{l} -% \texttt{axclass} \\ -% \ \ c \texttt{ < } c@1\texttt, \ldots\texttt, c@n \\ -% \ \ id@1\ axm@1 \\ -% \ \ \vdots \\ -% \ \ id@m\ axm@m -% \emphnd{matharray} - -% Where $c, c@1, \ldots, c@n$ are classes (category $id$ or -% $string$) and $axm@1, \ldots, axm@m$ (with $m \geq -% 0$) are formulas (category $string$). - -% Class $c$ has to be new, and sort $\{c@1, \ldots, c@n\}$ a subsort of -% \texttt{logic}. Each class axiom $axm@j$ may contain any term -% variables, but at most one type variable (which need not be the same -% for all axioms). The sort of this type variable has to be a supersort -% of $\{c@1, \ldots, c@n\}$. - -% \medskip - -% The \texttt{axclass} section declares $c$ as subclass of $c@1, \ldots, -% c@n$ to the type signature. - -% Furthermore, $axm@1, \ldots, axm@m$ are turned into the -% ``abstract axioms'' of $c$ with names $id@1, \ldots, -% id@m$. This is done by replacing all occurring type variables -% by $\alpha :: c$. Original axioms that do not contain any type -% variable will be prefixed by the logical precondition -% $\texttt{OFCLASS}(\alpha :: \texttt{logic}, c\texttt{_class})$. - -% Another axiom of name $c\texttt{I}$ --- the ``class $c$ introduction -% rule'' --- is built from the respective universal closures of -% $axm@1, \ldots, axm@m$ appropriately. - - -% \section{The instance section} - -% Section \texttt{instance} proves class inclusions or type arities at the -% logical level and then transfers these into the type signature. - -% Its concrete syntax is: - -% \begin{matharray}{l} -% \texttt{instance} \\ -% \ \ [\ c@1 \texttt{ < } c@2 \ |\ -% t \texttt{ ::\ (}sort@1\texttt, \ldots \texttt, sort@n\texttt) sort\ ] \\ -% \ \ [\ \texttt(name@1 \texttt, \ldots\texttt, name@m\texttt)\ ] \\ -% \ \ [\ \texttt{\{|} text \texttt{|\}}\ ] -% \emphnd{matharray} - -% Where $c@1, c@2$ are classes and $t$ is an $n$-place type constructor -% (all of category $id$ or $string)$. Furthermore, -% $sort@i$ are sorts in the usual Isabelle-syntax. - -% \medskip - -% Internally, \texttt{instance} first sets up an appropriate goal that -% expresses the class inclusion or type arity as a meta-proposition. -% Then tactic \texttt{AxClass.axclass_tac} is applied with all preceding -% meta-definitions of the current theory file and the user-supplied -% witnesses. The latter are $name@1, \ldots, name@m$, where -% $id$ refers to an \ML-name of a theorem, and $string$ to an -% axiom of the current theory node\footnote{Thus, the user may reference -% axioms from above this \texttt{instance} in the theory file. Note -% that new axioms appear at the \ML-toplevel only after the file is -% processed completely.}. - -% Tactic \texttt{AxClass.axclass_tac} first unfolds the class definition by -% resolving with rule $c\texttt\texttt{I}$, and then applies the witnesses -% according to their form: Meta-definitions are unfolded, all other -% formulas are repeatedly resolved\footnote{This is done in a way that -% enables proper object-\emph{rules} to be used as witnesses for -% corresponding class axioms.} with. - -% The final optional argument $text$ is \ML-code of an arbitrary -% user tactic which is applied last to any remaining goals. - -% \medskip - -% Because of the complexity of \texttt{instance}'s witnessing mechanisms, -% new users of the axclass package are advised to only use the simple -% form $\texttt{instance}\ \ldots\ (id@1, \ldots, id@!m)$, where -% the identifiers refer to theorems that are appropriate type instances -% of the class axioms. This typically requires an auxiliary theory, -% though, which defines some constants and then proves these witnesses. - - -%%% Local Variables: -%%% mode: latex -%%% TeX-master: "axclass" -%%% End: -% LocalWords: Isabelle FOL diff -r 419116f1157a -r e23770bc97c8 doc-src/Dirs --- a/doc-src/Dirs Thu Feb 26 08:44:44 2009 -0800 +++ b/doc-src/Dirs Thu Feb 26 08:48:33 2009 -0800 @@ -1,1 +1,1 @@ -Ref System Logics HOL ZF Inductive TutorialI IsarOverview IsarRef IsarImplementation Locales LaTeXsugar IsarAdvanced/Classes IsarAdvanced/Codegen IsarAdvanced/Functions +Intro Ref System Logics HOL ZF Inductive TutorialI IsarOverview IsarRef IsarImplementation Locales LaTeXsugar IsarAdvanced/Classes IsarAdvanced/Codegen IsarAdvanced/Functions diff -r 419116f1157a -r e23770bc97c8 doc-src/IsarAdvanced/Functions/functions.tex --- a/doc-src/IsarAdvanced/Functions/functions.tex Thu Feb 26 08:44:44 2009 -0800 +++ b/doc-src/IsarAdvanced/Functions/functions.tex Thu Feb 26 08:48:33 2009 -0800 @@ -1,5 +1,3 @@ - -%% $Id$ \documentclass[a4paper,fleqn]{article} @@ -19,11 +17,8 @@ \newcommand{\isasymINCLUDES}{\cmd{includes}} \newcommand{\isasymDATATYPE}{\cmd{datatype}} \newcommand{\isasymAXCLASS}{\cmd{axclass}} -\newcommand{\isasymFIXES}{\cmd{fixes}} -\newcommand{\isasymASSUMES}{\cmd{assumes}} \newcommand{\isasymDEFINES}{\cmd{defines}} \newcommand{\isasymNOTES}{\cmd{notes}} -\newcommand{\isasymSHOWS}{\cmd{shows}} \newcommand{\isasymCLASS}{\cmd{class}} \newcommand{\isasymINSTANCE}{\cmd{instance}} \newcommand{\isasymLEMMA}{\cmd{lemma}} diff -r 419116f1157a -r e23770bc97c8 doc-src/IsarAdvanced/Functions/style.sty --- a/doc-src/IsarAdvanced/Functions/style.sty Thu Feb 26 08:44:44 2009 -0800 +++ b/doc-src/IsarAdvanced/Functions/style.sty Thu Feb 26 08:48:33 2009 -0800 @@ -1,6 +1,3 @@ - -%% $Id$ - %% toc \newcommand{\tocentry}[1]{\cleardoublepage\phantomsection\addcontentsline{toc}{chapter}{#1} \@mkboth{\MakeUppercase{#1}}{\MakeUppercase{#1}}} @@ -10,13 +7,6 @@ \newcommand{\chref}[1]{chapter~\ref{#1}} \newcommand{\figref}[1]{figure~\ref{#1}} -%% glossary -\renewcommand{\glossary}[2]{\nomenclature{\bf #1}{#2}} -\newcommand{\seeglossary}[1]{\emph{#1}} -\newcommand{\glossaryname}{Glossary} -\renewcommand{\nomname}{\glossaryname} -\renewcommand{\pagedeclaration}[1]{\nobreak\quad\dotfill~page~\bold{#1}} - %% index \newcommand{\indexml}[1]{\index{\emph{#1}|bold}} \newcommand{\indexmltype}[1]{\index{\emph{#1} (type)|bold}} diff -r 419116f1157a -r e23770bc97c8 doc-src/IsarImplementation/IsaMakefile --- a/doc-src/IsarImplementation/IsaMakefile Thu Feb 26 08:44:44 2009 -0800 +++ b/doc-src/IsarImplementation/IsaMakefile Thu Feb 26 08:48:33 2009 -0800 @@ -21,9 +21,9 @@ Thy: $(LOG)/Pure-Thy.gz -$(LOG)/Pure-Thy.gz: Thy/ROOT.ML Thy/base.thy Thy/integration.thy Thy/isar.thy \ - Thy/locale.thy Thy/logic.thy Thy/prelim.thy Thy/proof.thy Thy/tactic.thy \ - Thy/ML.thy ../antiquote_setup.ML +$(LOG)/Pure-Thy.gz: Thy/ROOT.ML Thy/Base.thy Thy/Integration.thy \ + Thy/Isar.thy Thy/Local_Theory.thy Thy/Logic.thy Thy/Prelim.thy \ + Thy/Proof.thy Thy/Tactic.thy Thy/ML.thy ../antiquote_setup.ML @$(USEDIR) Pure Thy diff -r 419116f1157a -r e23770bc97c8 doc-src/IsarImplementation/Makefile --- a/doc-src/IsarImplementation/Makefile Thu Feb 26 08:44:44 2009 -0800 +++ b/doc-src/IsarImplementation/Makefile Thu Feb 26 08:48:33 2009 -0800 @@ -1,6 +1,3 @@ -# -# $Id$ -# ## targets @@ -11,14 +8,12 @@ include ../Makefile.in -MAKEGLOSSARY = ./makeglossary - NAME = implementation -FILES = implementation.tex intro.tex Thy/document/prelim.tex \ - Thy/document/logic.tex Thy/document/tactic.tex \ - Thy/document/proof.tex Thy/document/locale.tex \ - Thy/document/integration.tex style.sty ../iman.sty ../extra.sty \ +FILES = implementation.tex Thy/document/Prelim.tex \ + Thy/document/Logic.tex Thy/document/Tactic.tex \ + Thy/document/Proof.tex Thy/document/Local_Theory.tex \ + Thy/document/Integration.tex style.sty ../iman.sty ../extra.sty \ ../isar.sty ../isabelle.sty ../isabellesym.sty ../pdfsetup.sty \ ../manual.bib ../proof.sty @@ -29,7 +24,6 @@ $(BIBTEX) $(NAME) $(LATEX) $(NAME) $(LATEX) $(NAME) - $(MAKEGLOSSARY) $(NAME) $(SEDINDEX) $(NAME) $(LATEX) $(NAME) $(LATEX) $(NAME) @@ -41,7 +35,6 @@ $(BIBTEX) $(NAME) $(PDFLATEX) $(NAME) $(PDFLATEX) $(NAME) - $(MAKEGLOSSARY) $(NAME) $(SEDINDEX) $(NAME) $(FIXBOOKMARKS) $(NAME).out $(PDFLATEX) $(NAME) diff -r 419116f1157a -r e23770bc97c8 doc-src/IsarImplementation/Thy/Base.thy --- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/doc-src/IsarImplementation/Thy/Base.thy Thu Feb 26 08:48:33 2009 -0800 @@ -0,0 +1,6 @@ +theory Base +imports Pure +uses "../../antiquote_setup.ML" +begin + +end diff -r 419116f1157a -r e23770bc97c8 doc-src/IsarImplementation/Thy/Integration.thy --- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/doc-src/IsarImplementation/Thy/Integration.thy Thu Feb 26 08:48:33 2009 -0800 @@ -0,0 +1,425 @@ +theory Integration +imports Base +begin + +chapter {* System integration *} + +section {* Isar toplevel \label{sec:isar-toplevel} *} + +text {* The Isar toplevel may be considered the centeral hub of the + Isabelle/Isar system, where all key components and sub-systems are + integrated into a single read-eval-print loop of Isar commands. We + shall even incorporate the existing {\ML} toplevel of the compiler + and run-time system (cf.\ \secref{sec:ML-toplevel}). + + Isabelle/Isar departs from the original ``LCF system architecture'' + where {\ML} was really The Meta Language for defining theories and + conducting proofs. Instead, {\ML} now only serves as the + implementation language for the system (and user extensions), while + the specific Isar toplevel supports the concepts of theory and proof + development natively. This includes the graph structure of theories + and the block structure of proofs, support for unlimited undo, + facilities for tracing, debugging, timing, profiling etc. + + \medskip The toplevel maintains an implicit state, which is + transformed by a sequence of transitions -- either interactively or + in batch-mode. In interactive mode, Isar state transitions are + encapsulated as safe transactions, such that both failure and undo + are handled conveniently without destroying the underlying draft + theory (cf.~\secref{sec:context-theory}). In batch mode, + transitions operate in a linear (destructive) fashion, such that + error conditions abort the present attempt to construct a theory or + proof altogether. + + The toplevel state is a disjoint sum of empty @{text toplevel}, or + @{text theory}, or @{text proof}. On entering the main Isar loop we + start with an empty toplevel. A theory is commenced by giving a + @{text \} header; within a theory we may issue theory + commands such as @{text \}, or state a @{text + \} to be proven. Now we are within a proof state, with a + rich collection of Isar proof commands for structured proof + composition, or unstructured proof scripts. When the proof is + concluded we get back to the theory, which is then updated by + storing the resulting fact. Further theory declarations or theorem + statements with proofs may follow, until we eventually conclude the + theory development by issuing @{text \}. The resulting theory + is then stored within the theory database and we are back to the + empty toplevel. + + In addition to these proper state transformations, there are also + some diagnostic commands for peeking at the toplevel state without + modifying it (e.g.\ \isakeyword{thm}, \isakeyword{term}, + \isakeyword{print-cases}). +*} + +text %mlref {* + \begin{mldecls} + @{index_ML_type Toplevel.state} \\ + @{index_ML Toplevel.UNDEF: "exn"} \\ + @{index_ML Toplevel.is_toplevel: "Toplevel.state -> bool"} \\ + @{index_ML Toplevel.theory_of: "Toplevel.state -> theory"} \\ + @{index_ML Toplevel.proof_of: "Toplevel.state -> Proof.state"} \\ + @{index_ML Toplevel.debug: "bool ref"} \\ + @{index_ML Toplevel.timing: "bool ref"} \\ + @{index_ML Toplevel.profiling: "int ref"} \\ + \end{mldecls} + + \begin{description} + + \item @{ML_type Toplevel.state} represents Isar toplevel states, + which are normally manipulated through the concept of toplevel + transitions only (\secref{sec:toplevel-transition}). Also note that + a raw toplevel state is subject to the same linearity restrictions + as a theory context (cf.~\secref{sec:context-theory}). + + \item @{ML Toplevel.UNDEF} is raised for undefined toplevel + operations. Many operations work only partially for certain cases, + since @{ML_type Toplevel.state} is a sum type. + + \item @{ML Toplevel.is_toplevel}~@{text "state"} checks for an empty + toplevel state. + + \item @{ML Toplevel.theory_of}~@{text "state"} selects the theory of + a theory or proof (!), otherwise raises @{ML Toplevel.UNDEF}. + + \item @{ML Toplevel.proof_of}~@{text "state"} selects the Isar proof + state if available, otherwise raises @{ML Toplevel.UNDEF}. + + \item @{ML "set Toplevel.debug"} makes the toplevel print further + details about internal error conditions, exceptions being raised + etc. + + \item @{ML "set Toplevel.timing"} makes the toplevel print timing + information for each Isar command being executed. + + \item @{ML Toplevel.profiling}~@{verbatim ":="}~@{text "n"} controls + low-level profiling of the underlying {\ML} runtime system. For + Poly/ML, @{text "n = 1"} means time and @{text "n = 2"} space + profiling. + + \end{description} +*} + + +subsection {* Toplevel transitions \label{sec:toplevel-transition} *} + +text {* + An Isar toplevel transition consists of a partial function on the + toplevel state, with additional information for diagnostics and + error reporting: there are fields for command name, source position, + optional source text, as well as flags for interactive-only commands + (which issue a warning in batch-mode), printing of result state, + etc. + + The operational part is represented as the sequential union of a + list of partial functions, which are tried in turn until the first + one succeeds. This acts like an outer case-expression for various + alternative state transitions. For example, \isakeyword{qed} acts + differently for a local proofs vs.\ the global ending of the main + proof. + + Toplevel transitions are composed via transition transformers. + Internally, Isar commands are put together from an empty transition + extended by name and source position (and optional source text). It + is then left to the individual command parser to turn the given + concrete syntax into a suitable transition transformer that adjoins + actual operations on a theory or proof state etc. +*} + +text %mlref {* + \begin{mldecls} + @{index_ML Toplevel.print: "Toplevel.transition -> Toplevel.transition"} \\ + @{index_ML Toplevel.no_timing: "Toplevel.transition -> Toplevel.transition"} \\ + @{index_ML Toplevel.keep: "(Toplevel.state -> unit) -> + Toplevel.transition -> Toplevel.transition"} \\ + @{index_ML Toplevel.theory: "(theory -> theory) -> + Toplevel.transition -> Toplevel.transition"} \\ + @{index_ML Toplevel.theory_to_proof: "(theory -> Proof.state) -> + Toplevel.transition -> Toplevel.transition"} \\ + @{index_ML Toplevel.proof: "(Proof.state -> Proof.state) -> + Toplevel.transition -> Toplevel.transition"} \\ + @{index_ML Toplevel.proofs: "(Proof.state -> Proof.state Seq.seq) -> + Toplevel.transition -> Toplevel.transition"} \\ + @{index_ML Toplevel.end_proof: "(bool -> Proof.state -> Proof.context) -> + Toplevel.transition -> Toplevel.transition"} \\ + \end{mldecls} + + \begin{description} + + \item @{ML Toplevel.print}~@{text "tr"} sets the print flag, which + causes the toplevel loop to echo the result state (in interactive + mode). + + \item @{ML Toplevel.no_timing}~@{text "tr"} indicates that the + transition should never show timing information, e.g.\ because it is + a diagnostic command. + + \item @{ML Toplevel.keep}~@{text "tr"} adjoins a diagnostic + function. + + \item @{ML Toplevel.theory}~@{text "tr"} adjoins a theory + transformer. + + \item @{ML Toplevel.theory_to_proof}~@{text "tr"} adjoins a global + goal function, which turns a theory into a proof state. The theory + may be changed before entering the proof; the generic Isar goal + setup includes an argument that specifies how to apply the proven + result to the theory, when the proof is finished. + + \item @{ML Toplevel.proof}~@{text "tr"} adjoins a deterministic + proof command, with a singleton result. + + \item @{ML Toplevel.proofs}~@{text "tr"} adjoins a general proof + command, with zero or more result states (represented as a lazy + list). + + \item @{ML Toplevel.end_proof}~@{text "tr"} adjoins a concluding + proof command, that returns the resulting theory, after storing the + resulting facts in the context etc. + + \end{description} +*} + + +subsection {* Toplevel control *} + +text {* + There are a few special control commands that modify the behavior + the toplevel itself, and only make sense in interactive mode. Under + normal circumstances, the user encounters these only implicitly as + part of the protocol between the Isabelle/Isar system and a + user-interface such as ProofGeneral. + + \begin{description} + + \item \isacommand{undo} follows the three-level hierarchy of empty + toplevel vs.\ theory vs.\ proof: undo within a proof reverts to the + previous proof context, undo after a proof reverts to the theory + before the initial goal statement, undo of a theory command reverts + to the previous theory value, undo of a theory header discontinues + the current theory development and removes it from the theory + database (\secref{sec:theory-database}). + + \item \isacommand{kill} aborts the current level of development: + kill in a proof context reverts to the theory before the initial + goal statement, kill in a theory context aborts the current theory + development, removing it from the database. + + \item \isacommand{exit} drops out of the Isar toplevel into the + underlying {\ML} toplevel (\secref{sec:ML-toplevel}). The Isar + toplevel state is preserved and may be continued later. + + \item \isacommand{quit} terminates the Isabelle/Isar process without + saving. + + \end{description} +*} + + +section {* ML toplevel \label{sec:ML-toplevel} *} + +text {* + The {\ML} toplevel provides a read-compile-eval-print loop for {\ML} + values, types, structures, and functors. {\ML} declarations operate + on the global system state, which consists of the compiler + environment plus the values of {\ML} reference variables. There is + no clean way to undo {\ML} declarations, except for reverting to a + previously saved state of the whole Isabelle process. {\ML} input + is either read interactively from a TTY, or from a string (usually + within a theory text), or from a source file (usually loaded from a + theory). + + Whenever the {\ML} toplevel is active, the current Isabelle theory + context is passed as an internal reference variable. Thus {\ML} + code may access the theory context during compilation, it may even + change the value of a theory being under construction --- while + observing the usual linearity restrictions + (cf.~\secref{sec:context-theory}). +*} + +text %mlref {* + \begin{mldecls} + @{index_ML the_context: "unit -> theory"} \\ + @{index_ML "Context.>> ": "(Context.generic -> Context.generic) -> unit"} \\ + \end{mldecls} + + \begin{description} + + \item @{ML "the_context ()"} refers to the theory context of the + {\ML} toplevel --- at compile time! {\ML} code needs to take care + to refer to @{ML "the_context ()"} correctly. Recall that + evaluation of a function body is delayed until actual runtime. + Moreover, persistent {\ML} toplevel bindings to an unfinished theory + should be avoided: code should either project out the desired + information immediately, or produce an explicit @{ML_type + theory_ref} (cf.\ \secref{sec:context-theory}). + + \item @{ML "Context.>>"}~@{text f} applies context transformation + @{text f} to the implicit context of the {\ML} toplevel. + + \end{description} + + It is very important to note that the above functions are really + restricted to the compile time, even though the {\ML} compiler is + invoked at runtime! The majority of {\ML} code uses explicit + functional arguments of a theory or proof context instead. Thus it + may be invoked for an arbitrary context later on, without having to + worry about any operational details. + + \bigskip + + \begin{mldecls} + @{index_ML Isar.main: "unit -> unit"} \\ + @{index_ML Isar.loop: "unit -> unit"} \\ + @{index_ML Isar.state: "unit -> Toplevel.state"} \\ + @{index_ML Isar.exn: "unit -> (exn * string) option"} \\ + @{index_ML Isar.context: "unit -> Proof.context"} \\ + @{index_ML Isar.goal: "unit -> thm"} \\ + \end{mldecls} + + \begin{description} + + \item @{ML "Isar.main ()"} invokes the Isar toplevel from {\ML}, + initializing an empty toplevel state. + + \item @{ML "Isar.loop ()"} continues the Isar toplevel with the + current state, after having dropped out of the Isar toplevel loop. + + \item @{ML "Isar.state ()"} and @{ML "Isar.exn ()"} get current + toplevel state and error condition, respectively. This only works + after having dropped out of the Isar toplevel loop. + + \item @{ML "Isar.context ()"} produces the proof context from @{ML + "Isar.state ()"}, analogous to @{ML Context.proof_of} + (\secref{sec:generic-context}). + + \item @{ML "Isar.goal ()"} picks the tactical goal from @{ML + "Isar.state ()"}, represented as a theorem according to + \secref{sec:tactical-goals}. + + \end{description} +*} + + +section {* Theory database \label{sec:theory-database} *} + +text {* + The theory database maintains a collection of theories, together + with some administrative information about their original sources, + which are held in an external store (i.e.\ some directory within the + regular file system). + + The theory database is organized as a directed acyclic graph; + entries are referenced by theory name. Although some additional + interfaces allow to include a directory specification as well, this + is only a hint to the underlying theory loader. The internal theory + name space is flat! + + Theory @{text A} is associated with the main theory file @{text + A}\verb,.thy,, which needs to be accessible through the theory + loader path. Any number of additional {\ML} source files may be + associated with each theory, by declaring these dependencies in the + theory header as @{text \}, and loading them consecutively + within the theory context. The system keeps track of incoming {\ML} + sources and associates them with the current theory. The file + @{text A}\verb,.ML, is loaded after a theory has been concluded, in + order to support legacy proof {\ML} proof scripts. + + The basic internal actions of the theory database are @{text + "update"}, @{text "outdate"}, and @{text "remove"}: + + \begin{itemize} + + \item @{text "update A"} introduces a link of @{text "A"} with a + @{text "theory"} value of the same name; it asserts that the theory + sources are now consistent with that value; + + \item @{text "outdate A"} invalidates the link of a theory database + entry to its sources, but retains the present theory value; + + \item @{text "remove A"} deletes entry @{text "A"} from the theory + database. + + \end{itemize} + + These actions are propagated to sub- or super-graphs of a theory + entry as expected, in order to preserve global consistency of the + state of all loaded theories with the sources of the external store. + This implies certain causalities between actions: @{text "update"} + or @{text "outdate"} of an entry will @{text "outdate"} all + descendants; @{text "remove"} will @{text "remove"} all descendants. + + \medskip There are separate user-level interfaces to operate on the + theory database directly or indirectly. The primitive actions then + just happen automatically while working with the system. In + particular, processing a theory header @{text "\ A + \ B\<^sub>1 \ B\<^sub>n \"} ensures that the + sub-graph of the collective imports @{text "B\<^sub>1 \ B\<^sub>n"} + is up-to-date, too. Earlier theories are reloaded as required, with + @{text update} actions proceeding in topological order according to + theory dependencies. There may be also a wave of implied @{text + outdate} actions for derived theory nodes until a stable situation + is achieved eventually. +*} + +text %mlref {* + \begin{mldecls} + @{index_ML theory: "string -> theory"} \\ + @{index_ML use_thy: "string -> unit"} \\ + @{index_ML use_thys: "string list -> unit"} \\ + @{index_ML ThyInfo.touch_thy: "string -> unit"} \\ + @{index_ML ThyInfo.remove_thy: "string -> unit"} \\[1ex] + @{index_ML ThyInfo.begin_theory}@{verbatim ": ... -> bool -> theory"} \\ + @{index_ML ThyInfo.end_theory: "theory -> unit"} \\ + @{index_ML ThyInfo.register_theory: "theory -> unit"} \\[1ex] + @{verbatim "datatype action = Update | Outdate | Remove"} \\ + @{index_ML ThyInfo.add_hook: "(ThyInfo.action -> string -> unit) -> unit"} \\ + \end{mldecls} + + \begin{description} + + \item @{ML theory}~@{text A} retrieves the theory value presently + associated with name @{text A}. Note that the result might be + outdated. + + \item @{ML use_thy}~@{text A} ensures that theory @{text A} is fully + up-to-date wrt.\ the external file store, reloading outdated + ancestors as required. + + \item @{ML use_thys} is similar to @{ML use_thy}, but handles + several theories simultaneously. Thus it acts like processing the + import header of a theory, without performing the merge of the + result, though. + + \item @{ML ThyInfo.touch_thy}~@{text A} performs and @{text outdate} action + on theory @{text A} and all descendants. + + \item @{ML ThyInfo.remove_thy}~@{text A} deletes theory @{text A} and all + descendants from the theory database. + + \item @{ML ThyInfo.begin_theory} is the basic operation behind a + @{text \} header declaration. This is {\ML} functions is + normally not invoked directly. + + \item @{ML ThyInfo.end_theory} concludes the loading of a theory + proper and stores the result in the theory database. + + \item @{ML ThyInfo.register_theory}~@{text "text thy"} registers an + existing theory value with the theory loader database. There is no + management of associated sources. + + \item @{ML "ThyInfo.add_hook"}~@{text f} registers function @{text + f} as a hook for theory database actions. The function will be + invoked with the action and theory name being involved; thus derived + actions may be performed in associated system components, e.g.\ + maintaining the state of an editor for the theory sources. + + The kind and order of actions occurring in practice depends both on + user interactions and the internal process of resolving theory + imports. Hooks should not rely on a particular policy here! Any + exceptions raised by the hook are ignored. + + \end{description} +*} + +end diff -r 419116f1157a -r e23770bc97c8 doc-src/IsarImplementation/Thy/Isar.thy --- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/doc-src/IsarImplementation/Thy/Isar.thy Thu Feb 26 08:48:33 2009 -0800 @@ -0,0 +1,37 @@ +theory Isar +imports Base +begin + +chapter {* Isar language elements *} + +text {* + The primary Isar language consists of three main categories of + language elements: + + \begin{enumerate} + + \item Proof commands + + \item Proof methods + + \item Attributes + + \end{enumerate} +*} + + +section {* Proof commands *} + +text FIXME + + +section {* Proof methods *} + +text FIXME + + +section {* Attributes *} + +text FIXME + +end diff -r 419116f1157a -r e23770bc97c8 doc-src/IsarImplementation/Thy/Local_Theory.thy --- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/doc-src/IsarImplementation/Thy/Local_Theory.thy Thu Feb 26 08:48:33 2009 -0800 @@ -0,0 +1,168 @@ +theory Local_Theory +imports Base +begin + +chapter {* Local theory specifications *} + +text {* + A \emph{local theory} combines aspects of both theory and proof + context (cf.\ \secref{sec:context}), such that definitional + specifications may be given relatively to parameters and + assumptions. A local theory is represented as a regular proof + context, augmented by administrative data about the \emph{target + context}. + + The target is usually derived from the background theory by adding + local @{text "\"} and @{text "\"} elements, plus + suitable modifications of non-logical context data (e.g.\ a special + type-checking discipline). Once initialized, the target is ready to + absorb definitional primitives: @{text "\"} for terms and + @{text "\"} for theorems. Such definitions may get + transformed in a target-specific way, but the programming interface + hides such details. + + Isabelle/Pure provides target mechanisms for locales, type-classes, + type-class instantiations, and general overloading. In principle, + users can implement new targets as well, but this rather arcane + discipline is beyond the scope of this manual. In contrast, + implementing derived definitional packages to be used within a local + theory context is quite easy: the interfaces are even simpler and + more abstract than the underlying primitives for raw theories. + + Many definitional packages for local theories are available in + Isabelle. Although a few old packages only work for global + theories, the local theory interface is already the standard way of + implementing definitional packages in Isabelle. +*} + + +section {* Definitional elements *} + +text {* + There are separate elements @{text "\ c \ t"} for terms, and + @{text "\ b = thm"} for theorems. Types are treated + implicitly, according to Hindley-Milner discipline (cf.\ + \secref{sec:variables}). These definitional primitives essentially + act like @{text "let"}-bindings within a local context that may + already contain earlier @{text "let"}-bindings and some initial + @{text "\"}-bindings. Thus we gain \emph{dependent definitions} + that are relative to an initial axiomatic context. The following + diagram illustrates this idea of axiomatic elements versus + definitional elements: + + \begin{center} + \begin{tabular}{|l|l|l|} + \hline + & @{text "\"}-binding & @{text "let"}-binding \\ + \hline + types & fixed @{text "\"} & arbitrary @{text "\"} \\ + terms & @{text "\ x :: \"} & @{text "\ c \ t"} \\ + theorems & @{text "\ a: A"} & @{text "\ b = \<^BG>B\<^EN>"} \\ + \hline + \end{tabular} + \end{center} + + A user package merely needs to produce suitable @{text "\"} + and @{text "\"} elements according to the application. For + example, a package for inductive definitions might first @{text + "\"} a certain predicate as some fixed-point construction, + then @{text "\"} a proven result about monotonicity of the + functor involved here, and then produce further derived concepts via + additional @{text "\"} and @{text "\"} elements. + + The cumulative sequence of @{text "\"} and @{text "\"} + produced at package runtime is managed by the local theory + infrastructure by means of an \emph{auxiliary context}. Thus the + system holds up the impression of working within a fully abstract + situation with hypothetical entities: @{text "\ c \ t"} + always results in a literal fact @{text "\<^BG>c \ t\<^EN>"}, where + @{text "c"} is a fixed variable @{text "c"}. The details about + global constants, name spaces etc. are handled internally. + + So the general structure of a local theory is a sandwich of three + layers: + + \begin{center} + \framebox{\quad auxiliary context \quad\framebox{\quad target context \quad\framebox{\quad background theory\quad}}} + \end{center} + + \noindent When a definitional package is finished, the auxiliary + context is reset to the target context. The target now holds + definitions for terms and theorems that stem from the hypothetical + @{text "\"} and @{text "\"} elements, transformed by + the particular target policy (see + \cite[\S4--5]{Haftmann-Wenzel:2009} for details). +*} + +text %mlref {* + \begin{mldecls} + @{index_ML_type local_theory: Proof.context} \\ + @{index_ML TheoryTarget.init: "string option -> theory -> local_theory"} \\[1ex] + @{index_ML LocalTheory.define: "string -> + (binding * mixfix) * (Attrib.binding * term) -> local_theory -> + (term * (string * thm)) * local_theory"} \\ + @{index_ML LocalTheory.note: "string -> + Attrib.binding * thm list -> local_theory -> + (string * thm list) * local_theory"} \\ + \end{mldecls} + + \begin{description} + + \item @{ML_type local_theory} represents local theories. Although + this is merely an alias for @{ML_type Proof.context}, it is + semantically a subtype of the same: a @{ML_type local_theory} holds + target information as special context data. Subtyping means that + any value @{text "lthy:"}~@{ML_type local_theory} can be also used + with operations on expecting a regular @{text "ctxt:"}~@{ML_type + Proof.context}. + + \item @{ML TheoryTarget.init}~@{text "NONE thy"} initializes a + trivial local theory from the given background theory. + Alternatively, @{text "SOME name"} may be given to initialize a + @{command locale} or @{command class} context (a fully-qualified + internal name is expected here). This is useful for experimentation + --- normally the Isar toplevel already takes care to initialize the + local theory context. + + \item @{ML LocalTheory.define}~@{text "kind ((b, mx), (a, rhs)) + lthy"} defines a local entity according to the specification that is + given relatively to the current @{text "lthy"} context. In + particular the term of the RHS may refer to earlier local entities + from the auxiliary context, or hypothetical parameters from the + target context. The result is the newly defined term (which is + always a fixed variable with exactly the same name as specified for + the LHS), together with an equational theorem that states the + definition as a hypothetical fact. + + Unless an explicit name binding is given for the RHS, the resulting + fact will be called @{text "b_def"}. Any given attributes are + applied to that same fact --- immediately in the auxiliary context + \emph{and} in any transformed versions stemming from target-specific + policies or any later interpretations of results from the target + context (think of @{command locale} and @{command interpretation}, + for example). This means that attributes should be usually plain + declarations such as @{attribute simp}, while non-trivial rules like + @{attribute simplified} are better avoided. + + The @{text kind} determines the theorem kind tag of the resulting + fact. Typical examples are @{ML Thm.definitionK}, @{ML + Thm.theoremK}, or @{ML Thm.internalK}. + + \item @{ML LocalTheory.note}~@{text "kind (a, ths) lthy"} is + analogous to @{ML LocalTheory.define}, but defines facts instead of + terms. There is also a slightly more general variant @{ML + LocalTheory.notes} that defines several facts (with attribute + expressions) simultaneously. + + This is essentially the internal version of the @{command lemmas} + command, or @{command declare} if an empty name binding is given. + + \end{description} +*} + + +section {* Morphisms and declarations *} + +text FIXME + +end diff -r 419116f1157a -r e23770bc97c8 doc-src/IsarImplementation/Thy/Logic.thy --- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/doc-src/IsarImplementation/Thy/Logic.thy Thu Feb 26 08:48:33 2009 -0800 @@ -0,0 +1,909 @@ +theory Logic +imports Base +begin + +chapter {* Primitive logic \label{ch:logic} *} + +text {* + The logical foundations of Isabelle/Isar are that of the Pure logic, + which has been introduced as a Natural Deduction framework in + \cite{paulson700}. This is essentially the same logic as ``@{text + "\HOL"}'' in the more abstract setting of Pure Type Systems (PTS) + \cite{Barendregt-Geuvers:2001}, although there are some key + differences in the specific treatment of simple types in + Isabelle/Pure. + + Following type-theoretic parlance, the Pure logic consists of three + levels of @{text "\"}-calculus with corresponding arrows, @{text + "\"} for syntactic function space (terms depending on terms), @{text + "\"} for universal quantification (proofs depending on terms), and + @{text "\"} for implication (proofs depending on proofs). + + Derivations are relative to a logical theory, which declares type + constructors, constants, and axioms. Theory declarations support + schematic polymorphism, which is strictly speaking outside the + logic.\footnote{This is the deeper logical reason, why the theory + context @{text "\"} is separate from the proof context @{text "\"} + of the core calculus.} +*} + + +section {* Types \label{sec:types} *} + +text {* + The language of types is an uninterpreted order-sorted first-order + algebra; types are qualified by ordered type classes. + + \medskip A \emph{type class} is an abstract syntactic entity + declared in the theory context. The \emph{subclass relation} @{text + "c\<^isub>1 \ c\<^isub>2"} is specified by stating an acyclic + generating relation; the transitive closure is maintained + internally. The resulting relation is an ordering: reflexive, + transitive, and antisymmetric. + + A \emph{sort} is a list of type classes written as @{text "s = + {c\<^isub>1, \, c\<^isub>m}"}, which represents symbolic + intersection. Notationally, the curly braces are omitted for + singleton intersections, i.e.\ any class @{text "c"} may be read as + a sort @{text "{c}"}. The ordering on type classes is extended to + sorts according to the meaning of intersections: @{text + "{c\<^isub>1, \ c\<^isub>m} \ {d\<^isub>1, \, d\<^isub>n}"} iff + @{text "\j. \i. c\<^isub>i \ d\<^isub>j"}. The empty intersection + @{text "{}"} refers to the universal sort, which is the largest + element wrt.\ the sort order. The intersections of all (finitely + many) classes declared in the current theory are the minimal + elements wrt.\ the sort order. + + \medskip A \emph{fixed type variable} is a pair of a basic name + (starting with a @{text "'"} character) and a sort constraint, e.g.\ + @{text "('a, s)"} which is usually printed as @{text "\\<^isub>s"}. + A \emph{schematic type variable} is a pair of an indexname and a + sort constraint, e.g.\ @{text "(('a, 0), s)"} which is usually + printed as @{text "?\\<^isub>s"}. + + Note that \emph{all} syntactic components contribute to the identity + of type variables, including the sort constraint. The core logic + handles type variables with the same name but different sorts as + different, although some outer layers of the system make it hard to + produce anything like this. + + A \emph{type constructor} @{text "\"} is a @{text "k"}-ary operator + on types declared in the theory. Type constructor application is + written postfix as @{text "(\\<^isub>1, \, \\<^isub>k)\"}. For + @{text "k = 0"} the argument tuple is omitted, e.g.\ @{text "prop"} + instead of @{text "()prop"}. For @{text "k = 1"} the parentheses + are omitted, e.g.\ @{text "\ list"} instead of @{text "(\)list"}. + Further notation is provided for specific constructors, notably the + right-associative infix @{text "\ \ \"} instead of @{text "(\, + \)fun"}. + + A \emph{type} is defined inductively over type variables and type + constructors as follows: @{text "\ = \\<^isub>s | ?\\<^isub>s | + (\\<^sub>1, \, \\<^sub>k)\"}. + + A \emph{type abbreviation} is a syntactic definition @{text + "(\<^vec>\)\ = \"} of an arbitrary type expression @{text "\"} over + variables @{text "\<^vec>\"}. Type abbreviations appear as type + constructors in the syntax, but are expanded before entering the + logical core. + + A \emph{type arity} declares the image behavior of a type + constructor wrt.\ the algebra of sorts: @{text "\ :: (s\<^isub>1, \, + s\<^isub>k)s"} means that @{text "(\\<^isub>1, \, \\<^isub>k)\"} is + of sort @{text "s"} if every argument type @{text "\\<^isub>i"} is + of sort @{text "s\<^isub>i"}. Arity declarations are implicitly + completed, i.e.\ @{text "\ :: (\<^vec>s)c"} entails @{text "\ :: + (\<^vec>s)c'"} for any @{text "c' \ c"}. + + \medskip The sort algebra is always maintained as \emph{coregular}, + which means that type arities are consistent with the subclass + relation: for any type constructor @{text "\"}, and classes @{text + "c\<^isub>1 \ c\<^isub>2"}, and arities @{text "\ :: + (\<^vec>s\<^isub>1)c\<^isub>1"} and @{text "\ :: + (\<^vec>s\<^isub>2)c\<^isub>2"} holds @{text "\<^vec>s\<^isub>1 \ + \<^vec>s\<^isub>2"} component-wise. + + The key property of a coregular order-sorted algebra is that sort + constraints can be solved in a most general fashion: for each type + constructor @{text "\"} and sort @{text "s"} there is a most general + vector of argument sorts @{text "(s\<^isub>1, \, s\<^isub>k)"} such + that a type scheme @{text "(\\<^bsub>s\<^isub>1\<^esub>, \, + \\<^bsub>s\<^isub>k\<^esub>)\"} is of sort @{text "s"}. + Consequently, type unification has most general solutions (modulo + equivalence of sorts), so type-inference produces primary types as + expected \cite{nipkow-prehofer}. +*} + +text %mlref {* + \begin{mldecls} + @{index_ML_type class} \\ + @{index_ML_type sort} \\ + @{index_ML_type arity} \\ + @{index_ML_type typ} \\ + @{index_ML map_atyps: "(typ -> typ) -> typ -> typ"} \\ + @{index_ML fold_atyps: "(typ -> 'a -> 'a) -> typ -> 'a -> 'a"} \\ + \end{mldecls} + \begin{mldecls} + @{index_ML Sign.subsort: "theory -> sort * sort -> bool"} \\ + @{index_ML Sign.of_sort: "theory -> typ * sort -> bool"} \\ + @{index_ML Sign.add_types: "(string * int * mixfix) list -> theory -> theory"} \\ + @{index_ML Sign.add_tyabbrs_i: " + (string * string list * typ * mixfix) list -> theory -> theory"} \\ + @{index_ML Sign.primitive_class: "string * class list -> theory -> theory"} \\ + @{index_ML Sign.primitive_classrel: "class * class -> theory -> theory"} \\ + @{index_ML Sign.primitive_arity: "arity -> theory -> theory"} \\ + \end{mldecls} + + \begin{description} + + \item @{ML_type class} represents type classes; this is an alias for + @{ML_type string}. + + \item @{ML_type sort} represents sorts; this is an alias for + @{ML_type "class list"}. + + \item @{ML_type arity} represents type arities; this is an alias for + triples of the form @{text "(\, \<^vec>s, s)"} for @{text "\ :: + (\<^vec>s)s"} described above. + + \item @{ML_type typ} represents types; this is a datatype with + constructors @{ML TFree}, @{ML TVar}, @{ML Type}. + + \item @{ML map_atyps}~@{text "f \"} applies the mapping @{text "f"} + to all atomic types (@{ML TFree}, @{ML TVar}) occurring in @{text + "\"}. + + \item @{ML fold_atyps}~@{text "f \"} iterates the operation @{text + "f"} over all occurrences of atomic types (@{ML TFree}, @{ML TVar}) + in @{text "\"}; the type structure is traversed from left to right. + + \item @{ML Sign.subsort}~@{text "thy (s\<^isub>1, s\<^isub>2)"} + tests the subsort relation @{text "s\<^isub>1 \ s\<^isub>2"}. + + \item @{ML Sign.of_sort}~@{text "thy (\, s)"} tests whether type + @{text "\"} is of sort @{text "s"}. + + \item @{ML Sign.add_types}~@{text "[(\, k, mx), \]"} declares a new + type constructors @{text "\"} with @{text "k"} arguments and + optional mixfix syntax. + + \item @{ML Sign.add_tyabbrs_i}~@{text "[(\, \<^vec>\, \, mx), \]"} + defines a new type abbreviation @{text "(\<^vec>\)\ = \"} with + optional mixfix syntax. + + \item @{ML Sign.primitive_class}~@{text "(c, [c\<^isub>1, \, + c\<^isub>n])"} declares a new class @{text "c"}, together with class + relations @{text "c \ c\<^isub>i"}, for @{text "i = 1, \, n"}. + + \item @{ML Sign.primitive_classrel}~@{text "(c\<^isub>1, + c\<^isub>2)"} declares the class relation @{text "c\<^isub>1 \ + c\<^isub>2"}. + + \item @{ML Sign.primitive_arity}~@{text "(\, \<^vec>s, s)"} declares + the arity @{text "\ :: (\<^vec>s)s"}. + + \end{description} +*} + + +section {* Terms \label{sec:terms} *} + +text {* + The language of terms is that of simply-typed @{text "\"}-calculus + with de-Bruijn indices for bound variables (cf.\ \cite{debruijn72} + or \cite{paulson-ml2}), with the types being determined by the + corresponding binders. In contrast, free variables and constants + are have an explicit name and type in each occurrence. + + \medskip A \emph{bound variable} is a natural number @{text "b"}, + which accounts for the number of intermediate binders between the + variable occurrence in the body and its binding position. For + example, the de-Bruijn term @{text + "\\<^bsub>nat\<^esub>. \\<^bsub>nat\<^esub>. 1 + 0"} would + correspond to @{text + "\x\<^bsub>nat\<^esub>. \y\<^bsub>nat\<^esub>. x + y"} in a named + representation. Note that a bound variable may be represented by + different de-Bruijn indices at different occurrences, depending on + the nesting of abstractions. + + A \emph{loose variable} is a bound variable that is outside the + scope of local binders. The types (and names) for loose variables + can be managed as a separate context, that is maintained as a stack + of hypothetical binders. The core logic operates on closed terms, + without any loose variables. + + A \emph{fixed variable} is a pair of a basic name and a type, e.g.\ + @{text "(x, \)"} which is usually printed @{text "x\<^isub>\"}. A + \emph{schematic variable} is a pair of an indexname and a type, + e.g.\ @{text "((x, 0), \)"} which is usually printed as @{text + "?x\<^isub>\"}. + + \medskip A \emph{constant} is a pair of a basic name and a type, + e.g.\ @{text "(c, \)"} which is usually printed as @{text + "c\<^isub>\"}. Constants are declared in the context as polymorphic + families @{text "c :: \"}, meaning that all substitution instances + @{text "c\<^isub>\"} for @{text "\ = \\"} are valid. + + The vector of \emph{type arguments} of constant @{text "c\<^isub>\"} + wrt.\ the declaration @{text "c :: \"} is defined as the codomain of + the matcher @{text "\ = {?\\<^isub>1 \ \\<^isub>1, \, + ?\\<^isub>n \ \\<^isub>n}"} presented in canonical order @{text + "(\\<^isub>1, \, \\<^isub>n)"}. Within a given theory context, + there is a one-to-one correspondence between any constant @{text + "c\<^isub>\"} and the application @{text "c(\\<^isub>1, \, + \\<^isub>n)"} of its type arguments. For example, with @{text "plus + :: \ \ \ \ \"}, the instance @{text "plus\<^bsub>nat \ nat \ + nat\<^esub>"} corresponds to @{text "plus(nat)"}. + + Constant declarations @{text "c :: \"} may contain sort constraints + for type variables in @{text "\"}. These are observed by + type-inference as expected, but \emph{ignored} by the core logic. + This means the primitive logic is able to reason with instances of + polymorphic constants that the user-level type-checker would reject + due to violation of type class restrictions. + + \medskip An \emph{atomic} term is either a variable or constant. A + \emph{term} is defined inductively over atomic terms, with + abstraction and application as follows: @{text "t = b | x\<^isub>\ | + ?x\<^isub>\ | c\<^isub>\ | \\<^isub>\. t | t\<^isub>1 t\<^isub>2"}. + Parsing and printing takes care of converting between an external + representation with named bound variables. Subsequently, we shall + use the latter notation instead of internal de-Bruijn + representation. + + The inductive relation @{text "t :: \"} assigns a (unique) type to a + term according to the structure of atomic terms, abstractions, and + applicatins: + \[ + \infer{@{text "a\<^isub>\ :: \"}}{} + \qquad + \infer{@{text "(\x\<^sub>\. t) :: \ \ \"}}{@{text "t :: \"}} + \qquad + \infer{@{text "t u :: \"}}{@{text "t :: \ \ \"} & @{text "u :: \"}} + \] + A \emph{well-typed term} is a term that can be typed according to these rules. + + Typing information can be omitted: type-inference is able to + reconstruct the most general type of a raw term, while assigning + most general types to all of its variables and constants. + Type-inference depends on a context of type constraints for fixed + variables, and declarations for polymorphic constants. + + The identity of atomic terms consists both of the name and the type + component. This means that different variables @{text + "x\<^bsub>\\<^isub>1\<^esub>"} and @{text + "x\<^bsub>\\<^isub>2\<^esub>"} may become the same after type + instantiation. Some outer layers of the system make it hard to + produce variables of the same name, but different types. In + contrast, mixed instances of polymorphic constants occur frequently. + + \medskip The \emph{hidden polymorphism} of a term @{text "t :: \"} + is the set of type variables occurring in @{text "t"}, but not in + @{text "\"}. This means that the term implicitly depends on type + arguments that are not accounted in the result type, i.e.\ there are + different type instances @{text "t\ :: \"} and @{text + "t\' :: \"} with the same type. This slightly + pathological situation notoriously demands additional care. + + \medskip A \emph{term abbreviation} is a syntactic definition @{text + "c\<^isub>\ \ t"} of a closed term @{text "t"} of type @{text "\"}, + without any hidden polymorphism. A term abbreviation looks like a + constant in the syntax, but is expanded before entering the logical + core. Abbreviations are usually reverted when printing terms, using + @{text "t \ c\<^isub>\"} as rules for higher-order rewriting. + + \medskip Canonical operations on @{text "\"}-terms include @{text + "\\\"}-conversion: @{text "\"}-conversion refers to capture-free + renaming of bound variables; @{text "\"}-conversion contracts an + abstraction applied to an argument term, substituting the argument + in the body: @{text "(\x. b)a"} becomes @{text "b[a/x]"}; @{text + "\"}-conversion contracts vacuous application-abstraction: @{text + "\x. f x"} becomes @{text "f"}, provided that the bound variable + does not occur in @{text "f"}. + + Terms are normally treated modulo @{text "\"}-conversion, which is + implicit in the de-Bruijn representation. Names for bound variables + in abstractions are maintained separately as (meaningless) comments, + mostly for parsing and printing. Full @{text "\\\"}-conversion is + commonplace in various standard operations (\secref{sec:obj-rules}) + that are based on higher-order unification and matching. +*} + +text %mlref {* + \begin{mldecls} + @{index_ML_type term} \\ + @{index_ML "op aconv": "term * term -> bool"} \\ + @{index_ML map_types: "(typ -> typ) -> term -> term"} \\ + @{index_ML fold_types: "(typ -> 'a -> 'a) -> term -> 'a -> 'a"} \\ + @{index_ML map_aterms: "(term -> term) -> term -> term"} \\ + @{index_ML fold_aterms: "(term -> 'a -> 'a) -> term -> 'a -> 'a"} \\ + \end{mldecls} + \begin{mldecls} + @{index_ML fastype_of: "term -> typ"} \\ + @{index_ML lambda: "term -> term -> term"} \\ + @{index_ML betapply: "term * term -> term"} \\ + @{index_ML Sign.declare_const: "Properties.T -> (binding * typ) * mixfix -> + theory -> term * theory"} \\ + @{index_ML Sign.add_abbrev: "string -> Properties.T -> binding * term -> + theory -> (term * term) * theory"} \\ + @{index_ML Sign.const_typargs: "theory -> string * typ -> typ list"} \\ + @{index_ML Sign.const_instance: "theory -> string * typ list -> typ"} \\ + \end{mldecls} + + \begin{description} + + \item @{ML_type term} represents de-Bruijn terms, with comments in + abstractions, and explicitly named free variables and constants; + this is a datatype with constructors @{ML Bound}, @{ML Free}, @{ML + Var}, @{ML Const}, @{ML Abs}, @{ML "op $"}. + + \item @{text "t"}~@{ML aconv}~@{text "u"} checks @{text + "\"}-equivalence of two terms. This is the basic equality relation + on type @{ML_type term}; raw datatype equality should only be used + for operations related to parsing or printing! + + \item @{ML map_types}~@{text "f t"} applies the mapping @{text + "f"} to all types occurring in @{text "t"}. + + \item @{ML fold_types}~@{text "f t"} iterates the operation @{text + "f"} over all occurrences of types in @{text "t"}; the term + structure is traversed from left to right. + + \item @{ML map_aterms}~@{text "f t"} applies the mapping @{text "f"} + to all atomic terms (@{ML Bound}, @{ML Free}, @{ML Var}, @{ML + Const}) occurring in @{text "t"}. + + \item @{ML fold_aterms}~@{text "f t"} iterates the operation @{text + "f"} over all occurrences of atomic terms (@{ML Bound}, @{ML Free}, + @{ML Var}, @{ML Const}) in @{text "t"}; the term structure is + traversed from left to right. + + \item @{ML fastype_of}~@{text "t"} determines the type of a + well-typed term. This operation is relatively slow, despite the + omission of any sanity checks. + + \item @{ML lambda}~@{text "a b"} produces an abstraction @{text + "\a. b"}, where occurrences of the atomic term @{text "a"} in the + body @{text "b"} are replaced by bound variables. + + \item @{ML betapply}~@{text "(t, u)"} produces an application @{text + "t u"}, with topmost @{text "\"}-conversion if @{text "t"} is an + abstraction. + + \item @{ML Sign.declare_const}~@{text "properties ((c, \), mx)"} + declares a new constant @{text "c :: \"} with optional mixfix + syntax. + + \item @{ML Sign.add_abbrev}~@{text "print_mode properties (c, t)"} + introduces a new term abbreviation @{text "c \ t"}. + + \item @{ML Sign.const_typargs}~@{text "thy (c, \)"} and @{ML + Sign.const_instance}~@{text "thy (c, [\\<^isub>1, \, \\<^isub>n])"} + convert between two representations of polymorphic constants: full + type instance vs.\ compact type arguments form. + + \end{description} +*} + + +section {* Theorems \label{sec:thms} *} + +text {* + A \emph{proposition} is a well-typed term of type @{text "prop"}, a + \emph{theorem} is a proven proposition (depending on a context of + hypotheses and the background theory). Primitive inferences include + plain Natural Deduction rules for the primary connectives @{text + "\"} and @{text "\"} of the framework. There is also a builtin + notion of equality/equivalence @{text "\"}. +*} + + +subsection {* Primitive connectives and rules \label{sec:prim-rules} *} + +text {* + The theory @{text "Pure"} contains constant declarations for the + primitive connectives @{text "\"}, @{text "\"}, and @{text "\"} of + the logical framework, see \figref{fig:pure-connectives}. The + derivability judgment @{text "A\<^isub>1, \, A\<^isub>n \ B"} is + defined inductively by the primitive inferences given in + \figref{fig:prim-rules}, with the global restriction that the + hypotheses must \emph{not} contain any schematic variables. The + builtin equality is conceptually axiomatized as shown in + \figref{fig:pure-equality}, although the implementation works + directly with derived inferences. + + \begin{figure}[htb] + \begin{center} + \begin{tabular}{ll} + @{text "all :: (\ \ prop) \ prop"} & universal quantification (binder @{text "\"}) \\ + @{text "\ :: prop \ prop \ prop"} & implication (right associative infix) \\ + @{text "\ :: \ \ \ \ prop"} & equality relation (infix) \\ + \end{tabular} + \caption{Primitive connectives of Pure}\label{fig:pure-connectives} + \end{center} + \end{figure} + + \begin{figure}[htb] + \begin{center} + \[ + \infer[@{text "(axiom)"}]{@{text "\ A"}}{@{text "A \ \"}} + \qquad + \infer[@{text "(assume)"}]{@{text "A \ A"}}{} + \] + \[ + \infer[@{text "(\_intro)"}]{@{text "\ \ \x. b[x]"}}{@{text "\ \ b[x]"} & @{text "x \ \"}} + \qquad + \infer[@{text "(\_elim)"}]{@{text "\ \ b[a]"}}{@{text "\ \ \x. b[x]"}} + \] + \[ + \infer[@{text "(\_intro)"}]{@{text "\ - A \ A \ B"}}{@{text "\ \ B"}} + \qquad + \infer[@{text "(\_elim)"}]{@{text "\\<^sub>1 \ \\<^sub>2 \ B"}}{@{text "\\<^sub>1 \ A \ B"} & @{text "\\<^sub>2 \ A"}} + \] + \caption{Primitive inferences of Pure}\label{fig:prim-rules} + \end{center} + \end{figure} + + \begin{figure}[htb] + \begin{center} + \begin{tabular}{ll} + @{text "\ (\x. b[x]) a \ b[a]"} & @{text "\"}-conversion \\ + @{text "\ x \ x"} & reflexivity \\ + @{text "\ x \ y \ P x \ P y"} & substitution \\ + @{text "\ (\x. f x \ g x) \ f \ g"} & extensionality \\ + @{text "\ (A \ B) \ (B \ A) \ A \ B"} & logical equivalence \\ + \end{tabular} + \caption{Conceptual axiomatization of Pure equality}\label{fig:pure-equality} + \end{center} + \end{figure} + + The introduction and elimination rules for @{text "\"} and @{text + "\"} are analogous to formation of dependently typed @{text + "\"}-terms representing the underlying proof objects. Proof terms + are irrelevant in the Pure logic, though; they cannot occur within + propositions. The system provides a runtime option to record + explicit proof terms for primitive inferences. Thus all three + levels of @{text "\"}-calculus become explicit: @{text "\"} for + terms, and @{text "\/\"} for proofs (cf.\ + \cite{Berghofer-Nipkow:2000:TPHOL}). + + Observe that locally fixed parameters (as in @{text "\_intro"}) need + not be recorded in the hypotheses, because the simple syntactic + types of Pure are always inhabitable. ``Assumptions'' @{text "x :: + \"} for type-membership are only present as long as some @{text + "x\<^isub>\"} occurs in the statement body.\footnote{This is the key + difference to ``@{text "\HOL"}'' in the PTS framework + \cite{Barendregt-Geuvers:2001}, where hypotheses @{text "x : A"} are + treated uniformly for propositions and types.} + + \medskip The axiomatization of a theory is implicitly closed by + forming all instances of type and term variables: @{text "\ + A\"} holds for any substitution instance of an axiom + @{text "\ A"}. By pushing substitutions through derivations + inductively, we also get admissible @{text "generalize"} and @{text + "instance"} rules as shown in \figref{fig:subst-rules}. + + \begin{figure}[htb] + \begin{center} + \[ + \infer{@{text "\ \ B[?\]"}}{@{text "\ \ B[\]"} & @{text "\ \ \"}} + \quad + \infer[\quad@{text "(generalize)"}]{@{text "\ \ B[?x]"}}{@{text "\ \ B[x]"} & @{text "x \ \"}} + \] + \[ + \infer{@{text "\ \ B[\]"}}{@{text "\ \ B[?\]"}} + \quad + \infer[\quad@{text "(instantiate)"}]{@{text "\ \ B[t]"}}{@{text "\ \ B[?x]"}} + \] + \caption{Admissible substitution rules}\label{fig:subst-rules} + \end{center} + \end{figure} + + Note that @{text "instantiate"} does not require an explicit + side-condition, because @{text "\"} may never contain schematic + variables. + + In principle, variables could be substituted in hypotheses as well, + but this would disrupt the monotonicity of reasoning: deriving + @{text "\\ \ B\"} from @{text "\ \ B"} is + correct, but @{text "\\ \ \"} does not necessarily hold: + the result belongs to a different proof context. + + \medskip An \emph{oracle} is a function that produces axioms on the + fly. Logically, this is an instance of the @{text "axiom"} rule + (\figref{fig:prim-rules}), but there is an operational difference. + The system always records oracle invocations within derivations of + theorems by a unique tag. + + Axiomatizations should be limited to the bare minimum, typically as + part of the initial logical basis of an object-logic formalization. + Later on, theories are usually developed in a strictly definitional + fashion, by stating only certain equalities over new constants. + + A \emph{simple definition} consists of a constant declaration @{text + "c :: \"} together with an axiom @{text "\ c \ t"}, where @{text "t + :: \"} is a closed term without any hidden polymorphism. The RHS + may depend on further defined constants, but not @{text "c"} itself. + Definitions of functions may be presented as @{text "c \<^vec>x \ + t"} instead of the puristic @{text "c \ \\<^vec>x. t"}. + + An \emph{overloaded definition} consists of a collection of axioms + for the same constant, with zero or one equations @{text + "c((\<^vec>\)\) \ t"} for each type constructor @{text "\"} (for + distinct variables @{text "\<^vec>\"}). The RHS may mention + previously defined constants as above, or arbitrary constants @{text + "d(\\<^isub>i)"} for some @{text "\\<^isub>i"} projected from @{text + "\<^vec>\"}. Thus overloaded definitions essentially work by + primitive recursion over the syntactic structure of a single type + argument. +*} + +text %mlref {* + \begin{mldecls} + @{index_ML_type ctyp} \\ + @{index_ML_type cterm} \\ + @{index_ML Thm.ctyp_of: "theory -> typ -> ctyp"} \\ + @{index_ML Thm.cterm_of: "theory -> term -> cterm"} \\ + \end{mldecls} + \begin{mldecls} + @{index_ML_type thm} \\ + @{index_ML proofs: "int ref"} \\ + @{index_ML Thm.assume: "cterm -> thm"} \\ + @{index_ML Thm.forall_intr: "cterm -> thm -> thm"} \\ + @{index_ML Thm.forall_elim: "cterm -> thm -> thm"} \\ + @{index_ML Thm.implies_intr: "cterm -> thm -> thm"} \\ + @{index_ML Thm.implies_elim: "thm -> thm -> thm"} \\ + @{index_ML Thm.generalize: "string list * string list -> int -> thm -> thm"} \\ + @{index_ML Thm.instantiate: "(ctyp * ctyp) list * (cterm * cterm) list -> thm -> thm"} \\ + @{index_ML Thm.axiom: "theory -> string -> thm"} \\ + @{index_ML Thm.add_oracle: "bstring * ('a -> cterm) -> theory + -> (string * ('a -> thm)) * theory"} \\ + \end{mldecls} + \begin{mldecls} + @{index_ML Theory.add_axioms_i: "(binding * term) list -> theory -> theory"} \\ + @{index_ML Theory.add_deps: "string -> string * typ -> (string * typ) list -> theory -> theory"} \\ + @{index_ML Theory.add_defs_i: "bool -> bool -> (binding * term) list -> theory -> theory"} \\ + \end{mldecls} + + \begin{description} + + \item @{ML_type ctyp} and @{ML_type cterm} represent certified types + and terms, respectively. These are abstract datatypes that + guarantee that its values have passed the full well-formedness (and + well-typedness) checks, relative to the declarations of type + constructors, constants etc. in the theory. + + \item @{ML Thm.ctyp_of}~@{text "thy \"} and @{ML + Thm.cterm_of}~@{text "thy t"} explicitly checks types and terms, + respectively. This also involves some basic normalizations, such + expansion of type and term abbreviations from the theory context. + + Re-certification is relatively slow and should be avoided in tight + reasoning loops. There are separate operations to decompose + certified entities (including actual theorems). + + \item @{ML_type thm} represents proven propositions. This is an + abstract datatype that guarantees that its values have been + constructed by basic principles of the @{ML_struct Thm} module. + Every @{ML thm} value contains a sliding back-reference to the + enclosing theory, cf.\ \secref{sec:context-theory}. + + \item @{ML proofs} determines the detail of proof recording within + @{ML_type thm} values: @{ML 0} records only the names of oracles, + @{ML 1} records oracle names and propositions, @{ML 2} additionally + records full proof terms. Officially named theorems that contribute + to a result are always recorded. + + \item @{ML Thm.assume}, @{ML Thm.forall_intr}, @{ML + Thm.forall_elim}, @{ML Thm.implies_intr}, and @{ML Thm.implies_elim} + correspond to the primitive inferences of \figref{fig:prim-rules}. + + \item @{ML Thm.generalize}~@{text "(\<^vec>\, \<^vec>x)"} + corresponds to the @{text "generalize"} rules of + \figref{fig:subst-rules}. Here collections of type and term + variables are generalized simultaneously, specified by the given + basic names. + + \item @{ML Thm.instantiate}~@{text "(\<^vec>\\<^isub>s, + \<^vec>x\<^isub>\)"} corresponds to the @{text "instantiate"} rules + of \figref{fig:subst-rules}. Type variables are substituted before + term variables. Note that the types in @{text "\<^vec>x\<^isub>\"} + refer to the instantiated versions. + + \item @{ML Thm.axiom}~@{text "thy name"} retrieves a named + axiom, cf.\ @{text "axiom"} in \figref{fig:prim-rules}. + + \item @{ML Thm.add_oracle}~@{text "(name, oracle)"} produces a named + oracle rule, essentially generating arbitrary axioms on the fly, + cf.\ @{text "axiom"} in \figref{fig:prim-rules}. + + \item @{ML Theory.add_axioms_i}~@{text "[(name, A), \]"} declares + arbitrary propositions as axioms. + + \item @{ML Theory.add_deps}~@{text "name c\<^isub>\ + \<^vec>d\<^isub>\"} declares dependencies of a named specification + for constant @{text "c\<^isub>\"}, relative to existing + specifications for constants @{text "\<^vec>d\<^isub>\"}. + + \item @{ML Theory.add_defs_i}~@{text "unchecked overloaded [(name, c + \<^vec>x \ t), \]"} states a definitional axiom for an existing + constant @{text "c"}. Dependencies are recorded (cf.\ @{ML + Theory.add_deps}), unless the @{text "unchecked"} option is set. + + \end{description} +*} + + +subsection {* Auxiliary definitions *} + +text {* + Theory @{text "Pure"} provides a few auxiliary definitions, see + \figref{fig:pure-aux}. These special constants are normally not + exposed to the user, but appear in internal encodings. + + \begin{figure}[htb] + \begin{center} + \begin{tabular}{ll} + @{text "conjunction :: prop \ prop \ prop"} & (infix @{text "&"}) \\ + @{text "\ A & B \ (\C. (A \ B \ C) \ C)"} \\[1ex] + @{text "prop :: prop \ prop"} & (prefix @{text "#"}, suppressed) \\ + @{text "#A \ A"} \\[1ex] + @{text "term :: \ \ prop"} & (prefix @{text "TERM"}) \\ + @{text "term x \ (\A. A \ A)"} \\[1ex] + @{text "TYPE :: \ itself"} & (prefix @{text "TYPE"}) \\ + @{text "(unspecified)"} \\ + \end{tabular} + \caption{Definitions of auxiliary connectives}\label{fig:pure-aux} + \end{center} + \end{figure} + + Derived conjunction rules include introduction @{text "A \ B \ A & + B"}, and destructions @{text "A & B \ A"} and @{text "A & B \ B"}. + Conjunction allows to treat simultaneous assumptions and conclusions + uniformly. For example, multiple claims are intermediately + represented as explicit conjunction, but this is refined into + separate sub-goals before the user continues the proof; the final + result is projected into a list of theorems (cf.\ + \secref{sec:tactical-goals}). + + The @{text "prop"} marker (@{text "#"}) makes arbitrarily complex + propositions appear as atomic, without changing the meaning: @{text + "\ \ A"} and @{text "\ \ #A"} are interchangeable. See + \secref{sec:tactical-goals} for specific operations. + + The @{text "term"} marker turns any well-typed term into a derivable + proposition: @{text "\ TERM t"} holds unconditionally. Although + this is logically vacuous, it allows to treat terms and proofs + uniformly, similar to a type-theoretic framework. + + The @{text "TYPE"} constructor is the canonical representative of + the unspecified type @{text "\ itself"}; it essentially injects the + language of types into that of terms. There is specific notation + @{text "TYPE(\)"} for @{text "TYPE\<^bsub>\ + itself\<^esub>"}. + Although being devoid of any particular meaning, the @{text + "TYPE(\)"} accounts for the type @{text "\"} within the term + language. In particular, @{text "TYPE(\)"} may be used as formal + argument in primitive definitions, in order to circumvent hidden + polymorphism (cf.\ \secref{sec:terms}). For example, @{text "c + TYPE(\) \ A[\]"} defines @{text "c :: \ itself \ prop"} in terms of + a proposition @{text "A"} that depends on an additional type + argument, which is essentially a predicate on types. +*} + +text %mlref {* + \begin{mldecls} + @{index_ML Conjunction.intr: "thm -> thm -> thm"} \\ + @{index_ML Conjunction.elim: "thm -> thm * thm"} \\ + @{index_ML Drule.mk_term: "cterm -> thm"} \\ + @{index_ML Drule.dest_term: "thm -> cterm"} \\ + @{index_ML Logic.mk_type: "typ -> term"} \\ + @{index_ML Logic.dest_type: "term -> typ"} \\ + \end{mldecls} + + \begin{description} + + \item @{ML Conjunction.intr} derives @{text "A & B"} from @{text + "A"} and @{text "B"}. + + \item @{ML Conjunction.elim} derives @{text "A"} and @{text "B"} + from @{text "A & B"}. + + \item @{ML Drule.mk_term} derives @{text "TERM t"}. + + \item @{ML Drule.dest_term} recovers term @{text "t"} from @{text + "TERM t"}. + + \item @{ML Logic.mk_type}~@{text "\"} produces the term @{text + "TYPE(\)"}. + + \item @{ML Logic.dest_type}~@{text "TYPE(\)"} recovers the type + @{text "\"}. + + \end{description} +*} + + +section {* Object-level rules \label{sec:obj-rules} *} + +text {* + The primitive inferences covered so far mostly serve foundational + purposes. User-level reasoning usually works via object-level rules + that are represented as theorems of Pure. Composition of rules + involves \emph{backchaining}, \emph{higher-order unification} modulo + @{text "\\\"}-conversion of @{text "\"}-terms, and so-called + \emph{lifting} of rules into a context of @{text "\"} and @{text + "\"} connectives. Thus the full power of higher-order Natural + Deduction in Isabelle/Pure becomes readily available. +*} + + +subsection {* Hereditary Harrop Formulae *} + +text {* + The idea of object-level rules is to model Natural Deduction + inferences in the style of Gentzen \cite{Gentzen:1935}, but we allow + arbitrary nesting similar to \cite{extensions91}. The most basic + rule format is that of a \emph{Horn Clause}: + \[ + \infer{@{text "A"}}{@{text "A\<^sub>1"} & @{text "\"} & @{text "A\<^sub>n"}} + \] + where @{text "A, A\<^sub>1, \, A\<^sub>n"} are atomic propositions + of the framework, usually of the form @{text "Trueprop B"}, where + @{text "B"} is a (compound) object-level statement. This + object-level inference corresponds to an iterated implication in + Pure like this: + \[ + @{text "A\<^sub>1 \ \ A\<^sub>n \ A"} + \] + As an example consider conjunction introduction: @{text "A \ B \ A \ + B"}. Any parameters occurring in such rule statements are + conceptionally treated as arbitrary: + \[ + @{text "\x\<^sub>1 \ x\<^sub>m. A\<^sub>1 x\<^sub>1 \ x\<^sub>m \ \ A\<^sub>n x\<^sub>1 \ x\<^sub>m \ A x\<^sub>1 \ x\<^sub>m"} + \] + + Nesting of rules means that the positions of @{text "A\<^sub>i"} may + again hold compound rules, not just atomic propositions. + Propositions of this format are called \emph{Hereditary Harrop + Formulae} in the literature \cite{Miller:1991}. Here we give an + inductive characterization as follows: + + \medskip + \begin{tabular}{ll} + @{text "\<^bold>x"} & set of variables \\ + @{text "\<^bold>A"} & set of atomic propositions \\ + @{text "\<^bold>H = \\<^bold>x\<^sup>*. \<^bold>H\<^sup>* \ \<^bold>A"} & set of Hereditary Harrop Formulas \\ + \end{tabular} + \medskip + + \noindent Thus we essentially impose nesting levels on propositions + formed from @{text "\"} and @{text "\"}. At each level there is a + prefix of parameters and compound premises, concluding an atomic + proposition. Typical examples are @{text "\"}-introduction @{text + "(A \ B) \ A \ B"} or mathematical induction @{text "P 0 \ (\n. P n + \ P (Suc n)) \ P n"}. Even deeper nesting occurs in well-founded + induction @{text "(\x. (\y. y \ x \ P y) \ P x) \ P x"}, but this + already marks the limit of rule complexity seen in practice. + + \medskip Regular user-level inferences in Isabelle/Pure always + maintain the following canonical form of results: + + \begin{itemize} + + \item Normalization by @{text "(A \ (\x. B x)) \ (\x. A \ B x)"}, + which is a theorem of Pure, means that quantifiers are pushed in + front of implication at each level of nesting. The normal form is a + Hereditary Harrop Formula. + + \item The outermost prefix of parameters is represented via + schematic variables: instead of @{text "\\<^vec>x. \<^vec>H \<^vec>x + \ A \<^vec>x"} we have @{text "\<^vec>H ?\<^vec>x \ A ?\<^vec>x"}. + Note that this representation looses information about the order of + parameters, and vacuous quantifiers vanish automatically. + + \end{itemize} +*} + +text %mlref {* + \begin{mldecls} + @{index_ML MetaSimplifier.norm_hhf: "thm -> thm"} \\ + \end{mldecls} + + \begin{description} + + \item @{ML MetaSimplifier.norm_hhf}~@{text thm} normalizes the given + theorem according to the canonical form specified above. This is + occasionally helpful to repair some low-level tools that do not + handle Hereditary Harrop Formulae properly. + + \end{description} +*} + + +subsection {* Rule composition *} + +text {* + The rule calculus of Isabelle/Pure provides two main inferences: + @{inference resolution} (i.e.\ back-chaining of rules) and + @{inference assumption} (i.e.\ closing a branch), both modulo + higher-order unification. There are also combined variants, notably + @{inference elim_resolution} and @{inference dest_resolution}. + + To understand the all-important @{inference resolution} principle, + we first consider raw @{inference_def composition} (modulo + higher-order unification with substitution @{text "\"}): + \[ + \infer[(@{inference_def composition})]{@{text "\<^vec>A\ \ C\"}} + {@{text "\<^vec>A \ B"} & @{text "B' \ C"} & @{text "B\ = B'\"}} + \] + Here the conclusion of the first rule is unified with the premise of + the second; the resulting rule instance inherits the premises of the + first and conclusion of the second. Note that @{text "C"} can again + consist of iterated implications. We can also permute the premises + of the second rule back-and-forth in order to compose with @{text + "B'"} in any position (subsequently we shall always refer to + position 1 w.l.o.g.). + + In @{inference composition} the internal structure of the common + part @{text "B"} and @{text "B'"} is not taken into account. For + proper @{inference resolution} we require @{text "B"} to be atomic, + and explicitly observe the structure @{text "\\<^vec>x. \<^vec>H + \<^vec>x \ B' \<^vec>x"} of the premise of the second rule. The + idea is to adapt the first rule by ``lifting'' it into this context, + by means of iterated application of the following inferences: + \[ + \infer[(@{inference_def imp_lift})]{@{text "(\<^vec>H \ \<^vec>A) \ (\<^vec>H \ B)"}}{@{text "\<^vec>A \ B"}} + \] + \[ + \infer[(@{inference_def all_lift})]{@{text "(\\<^vec>x. \<^vec>A (?\<^vec>a \<^vec>x)) \ (\\<^vec>x. B (?\<^vec>a \<^vec>x))"}}{@{text "\<^vec>A ?\<^vec>a \ B ?\<^vec>a"}} + \] + By combining raw composition with lifting, we get full @{inference + resolution} as follows: + \[ + \infer[(@{inference_def resolution})] + {@{text "(\\<^vec>x. \<^vec>H \<^vec>x \ \<^vec>A (?\<^vec>a \<^vec>x))\ \ C\"}} + {\begin{tabular}{l} + @{text "\<^vec>A ?\<^vec>a \ B ?\<^vec>a"} \\ + @{text "(\\<^vec>x. \<^vec>H \<^vec>x \ B' \<^vec>x) \ C"} \\ + @{text "(\\<^vec>x. B (?\<^vec>a \<^vec>x))\ = B'\"} \\ + \end{tabular}} + \] + + Continued resolution of rules allows to back-chain a problem towards + more and sub-problems. Branches are closed either by resolving with + a rule of 0 premises, or by producing a ``short-circuit'' within a + solved situation (again modulo unification): + \[ + \infer[(@{inference_def assumption})]{@{text "C\"}} + {@{text "(\\<^vec>x. \<^vec>H \<^vec>x \ A \<^vec>x) \ C"} & @{text "A\ = H\<^sub>i\"}~~\text{(for some~@{text i})}} + \] + + FIXME @{inference_def elim_resolution}, @{inference_def dest_resolution} +*} + +text %mlref {* + \begin{mldecls} + @{index_ML "op RS": "thm * thm -> thm"} \\ + @{index_ML "op OF": "thm * thm list -> thm"} \\ + \end{mldecls} + + \begin{description} + + \item @{text "rule\<^sub>1 RS rule\<^sub>2"} resolves @{text + "rule\<^sub>1"} with @{text "rule\<^sub>2"} according to the + @{inference resolution} principle explained above. Note that the + corresponding attribute in the Isar language is called @{attribute + THEN}. + + \item @{text "rule OF rules"} resolves a list of rules with the + first rule, addressing its premises @{text "1, \, length rules"} + (operating from last to first). This means the newly emerging + premises are all concatenated, without interfering. Also note that + compared to @{text "RS"}, the rule argument order is swapped: @{text + "rule\<^sub>1 RS rule\<^sub>2 = rule\<^sub>2 OF [rule\<^sub>1]"}. + + \end{description} +*} + +end diff -r 419116f1157a -r e23770bc97c8 doc-src/IsarImplementation/Thy/ML.thy --- a/doc-src/IsarImplementation/Thy/ML.thy Thu Feb 26 08:44:44 2009 -0800 +++ b/doc-src/IsarImplementation/Thy/ML.thy Thu Feb 26 08:48:33 2009 -0800 @@ -1,6 +1,6 @@ -(* $Id$ *) - -theory "ML" imports base begin +theory "ML" +imports Base +begin chapter {* Advanced ML programming *} diff -r 419116f1157a -r e23770bc97c8 doc-src/IsarImplementation/Thy/Prelim.thy --- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/doc-src/IsarImplementation/Thy/Prelim.thy Thu Feb 26 08:48:33 2009 -0800 @@ -0,0 +1,764 @@ +theory Prelim +imports Base +begin + +chapter {* Preliminaries *} + +section {* Contexts \label{sec:context} *} + +text {* + A logical context represents the background that is required for + formulating statements and composing proofs. It acts as a medium to + produce formal content, depending on earlier material (declarations, + results etc.). + + For example, derivations within the Isabelle/Pure logic can be + described as a judgment @{text "\ \\<^sub>\ \"}, which means that a + proposition @{text "\"} is derivable from hypotheses @{text "\"} + within the theory @{text "\"}. There are logical reasons for + keeping @{text "\"} and @{text "\"} separate: theories can be + liberal about supporting type constructors and schematic + polymorphism of constants and axioms, while the inner calculus of + @{text "\ \ \"} is strictly limited to Simple Type Theory (with + fixed type variables in the assumptions). + + \medskip Contexts and derivations are linked by the following key + principles: + + \begin{itemize} + + \item Transfer: monotonicity of derivations admits results to be + transferred into a \emph{larger} context, i.e.\ @{text "\ \\<^sub>\ + \"} implies @{text "\' \\<^sub>\\<^sub>' \"} for contexts @{text "\' + \ \"} and @{text "\' \ \"}. + + \item Export: discharge of hypotheses admits results to be exported + into a \emph{smaller} context, i.e.\ @{text "\' \\<^sub>\ \"} + implies @{text "\ \\<^sub>\ \ \ \"} where @{text "\' \ \"} and + @{text "\ = \' - \"}. Note that @{text "\"} remains unchanged here, + only the @{text "\"} part is affected. + + \end{itemize} + + \medskip By modeling the main characteristics of the primitive + @{text "\"} and @{text "\"} above, and abstracting over any + particular logical content, we arrive at the fundamental notions of + \emph{theory context} and \emph{proof context} in Isabelle/Isar. + These implement a certain policy to manage arbitrary \emph{context + data}. There is a strongly-typed mechanism to declare new kinds of + data at compile time. + + The internal bootstrap process of Isabelle/Pure eventually reaches a + stage where certain data slots provide the logical content of @{text + "\"} and @{text "\"} sketched above, but this does not stop there! + Various additional data slots support all kinds of mechanisms that + are not necessarily part of the core logic. + + For example, there would be data for canonical introduction and + elimination rules for arbitrary operators (depending on the + object-logic and application), which enables users to perform + standard proof steps implicitly (cf.\ the @{text "rule"} method + \cite{isabelle-isar-ref}). + + \medskip Thus Isabelle/Isar is able to bring forth more and more + concepts successively. In particular, an object-logic like + Isabelle/HOL continues the Isabelle/Pure setup by adding specific + components for automated reasoning (classical reasoner, tableau + prover, structured induction etc.) and derived specification + mechanisms (inductive predicates, recursive functions etc.). All of + this is ultimately based on the generic data management by theory + and proof contexts introduced here. +*} + + +subsection {* Theory context \label{sec:context-theory} *} + +text {* + A \emph{theory} is a data container with explicit name and unique + identifier. Theories are related by a (nominal) sub-theory + relation, which corresponds to the dependency graph of the original + construction; each theory is derived from a certain sub-graph of + ancestor theories. + + The @{text "merge"} operation produces the least upper bound of two + theories, which actually degenerates into absorption of one theory + into the other (due to the nominal sub-theory relation). + + The @{text "begin"} operation starts a new theory by importing + several parent theories and entering a special @{text "draft"} mode, + which is sustained until the final @{text "end"} operation. A draft + theory acts like a linear type, where updates invalidate earlier + versions. An invalidated draft is called ``stale''. + + The @{text "checkpoint"} operation produces an intermediate stepping + stone that will survive the next update: both the original and the + changed theory remain valid and are related by the sub-theory + relation. Checkpointing essentially recovers purely functional + theory values, at the expense of some extra internal bookkeeping. + + The @{text "copy"} operation produces an auxiliary version that has + the same data content, but is unrelated to the original: updates of + the copy do not affect the original, neither does the sub-theory + relation hold. + + \medskip The example in \figref{fig:ex-theory} below shows a theory + graph derived from @{text "Pure"}, with theory @{text "Length"} + importing @{text "Nat"} and @{text "List"}. The body of @{text + "Length"} consists of a sequence of updates, working mostly on + drafts. Intermediate checkpoints may occur as well, due to the + history mechanism provided by the Isar top-level, cf.\ + \secref{sec:isar-toplevel}. + + \begin{figure}[htb] + \begin{center} + \begin{tabular}{rcccl} + & & @{text "Pure"} \\ + & & @{text "\"} \\ + & & @{text "FOL"} \\ + & $\swarrow$ & & $\searrow$ & \\ + @{text "Nat"} & & & & @{text "List"} \\ + & $\searrow$ & & $\swarrow$ \\ + & & @{text "Length"} \\ + & & \multicolumn{3}{l}{~~@{keyword "imports"}} \\ + & & \multicolumn{3}{l}{~~@{keyword "begin"}} \\ + & & $\vdots$~~ \\ + & & @{text "\"}~~ \\ + & & $\vdots$~~ \\ + & & @{text "\"}~~ \\ + & & $\vdots$~~ \\ + & & \multicolumn{3}{l}{~~@{command "end"}} \\ + \end{tabular} + \caption{A theory definition depending on ancestors}\label{fig:ex-theory} + \end{center} + \end{figure} + + \medskip There is a separate notion of \emph{theory reference} for + maintaining a live link to an evolving theory context: updates on + drafts are propagated automatically. Dynamic updating stops after + an explicit @{text "end"} only. + + Derived entities may store a theory reference in order to indicate + the context they belong to. This implicitly assumes monotonic + reasoning, because the referenced context may become larger without + further notice. +*} + +text %mlref {* + \begin{mldecls} + @{index_ML_type theory} \\ + @{index_ML Theory.subthy: "theory * theory -> bool"} \\ + @{index_ML Theory.merge: "theory * theory -> theory"} \\ + @{index_ML Theory.checkpoint: "theory -> theory"} \\ + @{index_ML Theory.copy: "theory -> theory"} \\ + \end{mldecls} + \begin{mldecls} + @{index_ML_type theory_ref} \\ + @{index_ML Theory.deref: "theory_ref -> theory"} \\ + @{index_ML Theory.check_thy: "theory -> theory_ref"} \\ + \end{mldecls} + + \begin{description} + + \item @{ML_type theory} represents theory contexts. This is + essentially a linear type! Most operations destroy the original + version, which then becomes ``stale''. + + \item @{ML "Theory.subthy"}~@{text "(thy\<^sub>1, thy\<^sub>2)"} + compares theories according to the inherent graph structure of the + construction. This sub-theory relation is a nominal approximation + of inclusion (@{text "\"}) of the corresponding content. + + \item @{ML "Theory.merge"}~@{text "(thy\<^sub>1, thy\<^sub>2)"} + absorbs one theory into the other. This fails for unrelated + theories! + + \item @{ML "Theory.checkpoint"}~@{text "thy"} produces a safe + stepping stone in the linear development of @{text "thy"}. The next + update will result in two related, valid theories. + + \item @{ML "Theory.copy"}~@{text "thy"} produces a variant of @{text + "thy"} that holds a copy of the same data. The result is not + related to the original; the original is unchanged. + + \item @{ML_type theory_ref} represents a sliding reference to an + always valid theory; updates on the original are propagated + automatically. + + \item @{ML "Theory.deref"}~@{text "thy_ref"} turns a @{ML_type + "theory_ref"} into an @{ML_type "theory"} value. As the referenced + theory evolves monotonically over time, later invocations of @{ML + "Theory.deref"} may refer to a larger context. + + \item @{ML "Theory.check_thy"}~@{text "thy"} produces a @{ML_type + "theory_ref"} from a valid @{ML_type "theory"} value. + + \end{description} +*} + + +subsection {* Proof context \label{sec:context-proof} *} + +text {* + A proof context is a container for pure data with a back-reference + to the theory it belongs to. The @{text "init"} operation creates a + proof context from a given theory. Modifications to draft theories + are propagated to the proof context as usual, but there is also an + explicit @{text "transfer"} operation to force resynchronization + with more substantial updates to the underlying theory. The actual + context data does not require any special bookkeeping, thanks to the + lack of destructive features. + + Entities derived in a proof context need to record inherent logical + requirements explicitly, since there is no separate context + identification as for theories. For example, hypotheses used in + primitive derivations (cf.\ \secref{sec:thms}) are recorded + separately within the sequent @{text "\ \ \"}, just to make double + sure. Results could still leak into an alien proof context due to + programming errors, but Isabelle/Isar includes some extra validity + checks in critical positions, notably at the end of a sub-proof. + + Proof contexts may be manipulated arbitrarily, although the common + discipline is to follow block structure as a mental model: a given + context is extended consecutively, and results are exported back + into the original context. Note that the Isar proof states model + block-structured reasoning explicitly, using a stack of proof + contexts internally. +*} + +text %mlref {* + \begin{mldecls} + @{index_ML_type Proof.context} \\ + @{index_ML ProofContext.init: "theory -> Proof.context"} \\ + @{index_ML ProofContext.theory_of: "Proof.context -> theory"} \\ + @{index_ML ProofContext.transfer: "theory -> Proof.context -> Proof.context"} \\ + \end{mldecls} + + \begin{description} + + \item @{ML_type Proof.context} represents proof contexts. Elements + of this type are essentially pure values, with a sliding reference + to the background theory. + + \item @{ML ProofContext.init}~@{text "thy"} produces a proof context + derived from @{text "thy"}, initializing all data. + + \item @{ML ProofContext.theory_of}~@{text "ctxt"} selects the + background theory from @{text "ctxt"}, dereferencing its internal + @{ML_type theory_ref}. + + \item @{ML ProofContext.transfer}~@{text "thy ctxt"} promotes the + background theory of @{text "ctxt"} to the super theory @{text + "thy"}. + + \end{description} +*} + + +subsection {* Generic contexts \label{sec:generic-context} *} + +text {* + A generic context is the disjoint sum of either a theory or proof + context. Occasionally, this enables uniform treatment of generic + context data, typically extra-logical information. Operations on + generic contexts include the usual injections, partial selections, + and combinators for lifting operations on either component of the + disjoint sum. + + Moreover, there are total operations @{text "theory_of"} and @{text + "proof_of"} to convert a generic context into either kind: a theory + can always be selected from the sum, while a proof context might + have to be constructed by an ad-hoc @{text "init"} operation. +*} + +text %mlref {* + \begin{mldecls} + @{index_ML_type Context.generic} \\ + @{index_ML Context.theory_of: "Context.generic -> theory"} \\ + @{index_ML Context.proof_of: "Context.generic -> Proof.context"} \\ + \end{mldecls} + + \begin{description} + + \item @{ML_type Context.generic} is the direct sum of @{ML_type + "theory"} and @{ML_type "Proof.context"}, with the datatype + constructors @{ML "Context.Theory"} and @{ML "Context.Proof"}. + + \item @{ML Context.theory_of}~@{text "context"} always produces a + theory from the generic @{text "context"}, using @{ML + "ProofContext.theory_of"} as required. + + \item @{ML Context.proof_of}~@{text "context"} always produces a + proof context from the generic @{text "context"}, using @{ML + "ProofContext.init"} as required (note that this re-initializes the + context data with each invocation). + + \end{description} +*} + + +subsection {* Context data \label{sec:context-data} *} + +text {* + The main purpose of theory and proof contexts is to manage arbitrary + data. New data types can be declared incrementally at compile time. + There are separate declaration mechanisms for any of the three kinds + of contexts: theory, proof, generic. + + \paragraph{Theory data} may refer to destructive entities, which are + maintained in direct correspondence to the linear evolution of + theory values, including explicit copies.\footnote{Most existing + instances of destructive theory data are merely historical relics + (e.g.\ the destructive theorem storage, and destructive hints for + the Simplifier and Classical rules).} A theory data declaration + needs to implement the following SML signature: + + \medskip + \begin{tabular}{ll} + @{text "\ T"} & representing type \\ + @{text "\ empty: T"} & empty default value \\ + @{text "\ copy: T \ T"} & refresh impure data \\ + @{text "\ extend: T \ T"} & re-initialize on import \\ + @{text "\ merge: T \ T \ T"} & join on import \\ + \end{tabular} + \medskip + + \noindent The @{text "empty"} value acts as initial default for + \emph{any} theory that does not declare actual data content; @{text + "copy"} maintains persistent integrity for impure data, it is just + the identity for pure values; @{text "extend"} is acts like a + unitary version of @{text "merge"}, both operations should also + include the functionality of @{text "copy"} for impure data. + + \paragraph{Proof context data} is purely functional. A declaration + needs to implement the following SML signature: + + \medskip + \begin{tabular}{ll} + @{text "\ T"} & representing type \\ + @{text "\ init: theory \ T"} & produce initial value \\ + \end{tabular} + \medskip + + \noindent The @{text "init"} operation is supposed to produce a pure + value from the given background theory. + + \paragraph{Generic data} provides a hybrid interface for both theory + and proof data. The declaration is essentially the same as for + (pure) theory data, without @{text "copy"}. The @{text "init"} + operation for proof contexts merely selects the current data value + from the background theory. + + \bigskip A data declaration of type @{text "T"} results in the + following interface: + + \medskip + \begin{tabular}{ll} + @{text "init: theory \ T"} \\ + @{text "get: context \ T"} \\ + @{text "put: T \ context \ context"} \\ + @{text "map: (T \ T) \ context \ context"} \\ + \end{tabular} + \medskip + + \noindent Here @{text "init"} is only applicable to impure theory + data to install a fresh copy persistently (destructive update on + uninitialized has no permanent effect). The other operations provide + access for the particular kind of context (theory, proof, or generic + context). Note that this is a safe interface: there is no other way + to access the corresponding data slot of a context. By keeping + these operations private, a component may maintain abstract values + authentically, without other components interfering. +*} + +text %mlref {* + \begin{mldecls} + @{index_ML_functor TheoryDataFun} \\ + @{index_ML_functor ProofDataFun} \\ + @{index_ML_functor GenericDataFun} \\ + \end{mldecls} + + \begin{description} + + \item @{ML_functor TheoryDataFun}@{text "(spec)"} declares data for + type @{ML_type theory} according to the specification provided as + argument structure. The resulting structure provides data init and + access operations as described above. + + \item @{ML_functor ProofDataFun}@{text "(spec)"} is analogous to + @{ML_functor TheoryDataFun} for type @{ML_type Proof.context}. + + \item @{ML_functor GenericDataFun}@{text "(spec)"} is analogous to + @{ML_functor TheoryDataFun} for type @{ML_type Context.generic}. + + \end{description} +*} + + +section {* Names \label{sec:names} *} + +text {* + In principle, a name is just a string, but there are various + convention for encoding additional structure. For example, ``@{text + "Foo.bar.baz"}'' is considered as a qualified name consisting of + three basic name components. The individual constituents of a name + may have further substructure, e.g.\ the string + ``\verb,\,\verb,,'' encodes as a single symbol. +*} + + +subsection {* Strings of symbols *} + +text {* + A \emph{symbol} constitutes the smallest textual unit in Isabelle + --- raw characters are normally not encountered at all. Isabelle + strings consist of a sequence of symbols, represented as a packed + string or a list of strings. Each symbol is in itself a small + string, which has either one of the following forms: + + \begin{enumerate} + + \item a single ASCII character ``@{text "c"}'', for example + ``\verb,a,'', + + \item a regular symbol ``\verb,\,\verb,<,@{text "ident"}\verb,>,'', + for example ``\verb,\,\verb,,'', + + \item a control symbol ``\verb,\,\verb,<^,@{text "ident"}\verb,>,'', + for example ``\verb,\,\verb,<^bold>,'', + + \item a raw symbol ``\verb,\,\verb,<^raw:,@{text text}\verb,>,'' + where @{text text} constists of printable characters excluding + ``\verb,.,'' and ``\verb,>,'', for example + ``\verb,\,\verb,<^raw:$\sum_{i = 1}^n$>,'', + + \item a numbered raw control symbol ``\verb,\,\verb,<^raw,@{text + n}\verb,>, where @{text n} consists of digits, for example + ``\verb,\,\verb,<^raw42>,''. + + \end{enumerate} + + \noindent The @{text "ident"} syntax for symbol names is @{text + "letter (letter | digit)\<^sup>*"}, where @{text "letter = + A..Za..z"} and @{text "digit = 0..9"}. There are infinitely many + regular symbols and control symbols, but a fixed collection of + standard symbols is treated specifically. For example, + ``\verb,\,\verb,,'' is classified as a letter, which means it + may occur within regular Isabelle identifiers. + + Since the character set underlying Isabelle symbols is 7-bit ASCII + and 8-bit characters are passed through transparently, Isabelle may + also process Unicode/UCS data in UTF-8 encoding. Unicode provides + its own collection of mathematical symbols, but there is no built-in + link to the standard collection of Isabelle. + + \medskip Output of Isabelle symbols depends on the print mode + (\secref{print-mode}). For example, the standard {\LaTeX} setup of + the Isabelle document preparation system would present + ``\verb,\,\verb,,'' as @{text "\"}, and + ``\verb,\,\verb,<^bold>,\verb,\,\verb,,'' as @{text + "\<^bold>\"}. +*} + +text %mlref {* + \begin{mldecls} + @{index_ML_type "Symbol.symbol"} \\ + @{index_ML Symbol.explode: "string -> Symbol.symbol list"} \\ + @{index_ML Symbol.is_letter: "Symbol.symbol -> bool"} \\ + @{index_ML Symbol.is_digit: "Symbol.symbol -> bool"} \\ + @{index_ML Symbol.is_quasi: "Symbol.symbol -> bool"} \\ + @{index_ML Symbol.is_blank: "Symbol.symbol -> bool"} \\ + \end{mldecls} + \begin{mldecls} + @{index_ML_type "Symbol.sym"} \\ + @{index_ML Symbol.decode: "Symbol.symbol -> Symbol.sym"} \\ + \end{mldecls} + + \begin{description} + + \item @{ML_type "Symbol.symbol"} represents individual Isabelle + symbols; this is an alias for @{ML_type "string"}. + + \item @{ML "Symbol.explode"}~@{text "str"} produces a symbol list + from the packed form. This function supercedes @{ML + "String.explode"} for virtually all purposes of manipulating text in + Isabelle! + + \item @{ML "Symbol.is_letter"}, @{ML "Symbol.is_digit"}, @{ML + "Symbol.is_quasi"}, @{ML "Symbol.is_blank"} classify standard + symbols according to fixed syntactic conventions of Isabelle, cf.\ + \cite{isabelle-isar-ref}. + + \item @{ML_type "Symbol.sym"} is a concrete datatype that represents + the different kinds of symbols explicitly, with constructors @{ML + "Symbol.Char"}, @{ML "Symbol.Sym"}, @{ML "Symbol.Ctrl"}, @{ML + "Symbol.Raw"}. + + \item @{ML "Symbol.decode"} converts the string representation of a + symbol into the datatype version. + + \end{description} +*} + + +subsection {* Basic names \label{sec:basic-names} *} + +text {* + A \emph{basic name} essentially consists of a single Isabelle + identifier. There are conventions to mark separate classes of basic + names, by attaching a suffix of underscores: one underscore means + \emph{internal name}, two underscores means \emph{Skolem name}, + three underscores means \emph{internal Skolem name}. + + For example, the basic name @{text "foo"} has the internal version + @{text "foo_"}, with Skolem versions @{text "foo__"} and @{text + "foo___"}, respectively. + + These special versions provide copies of the basic name space, apart + from anything that normally appears in the user text. For example, + system generated variables in Isar proof contexts are usually marked + as internal, which prevents mysterious name references like @{text + "xaa"} to appear in the text. + + \medskip Manipulating binding scopes often requires on-the-fly + renamings. A \emph{name context} contains a collection of already + used names. The @{text "declare"} operation adds names to the + context. + + The @{text "invents"} operation derives a number of fresh names from + a given starting point. For example, the first three names derived + from @{text "a"} are @{text "a"}, @{text "b"}, @{text "c"}. + + The @{text "variants"} operation produces fresh names by + incrementing tentative names as base-26 numbers (with digits @{text + "a..z"}) until all clashes are resolved. For example, name @{text + "foo"} results in variants @{text "fooa"}, @{text "foob"}, @{text + "fooc"}, \dots, @{text "fooaa"}, @{text "fooab"} etc.; each renaming + step picks the next unused variant from this sequence. +*} + +text %mlref {* + \begin{mldecls} + @{index_ML Name.internal: "string -> string"} \\ + @{index_ML Name.skolem: "string -> string"} \\ + \end{mldecls} + \begin{mldecls} + @{index_ML_type Name.context} \\ + @{index_ML Name.context: Name.context} \\ + @{index_ML Name.declare: "string -> Name.context -> Name.context"} \\ + @{index_ML Name.invents: "Name.context -> string -> int -> string list"} \\ + @{index_ML Name.variants: "string list -> Name.context -> string list * Name.context"} \\ + \end{mldecls} + + \begin{description} + + \item @{ML Name.internal}~@{text "name"} produces an internal name + by adding one underscore. + + \item @{ML Name.skolem}~@{text "name"} produces a Skolem name by + adding two underscores. + + \item @{ML_type Name.context} represents the context of already used + names; the initial value is @{ML "Name.context"}. + + \item @{ML Name.declare}~@{text "name"} enters a used name into the + context. + + \item @{ML Name.invents}~@{text "context name n"} produces @{text + "n"} fresh names derived from @{text "name"}. + + \item @{ML Name.variants}~@{text "names context"} produces fresh + variants of @{text "names"}; the result is entered into the context. + + \end{description} +*} + + +subsection {* Indexed names *} + +text {* + An \emph{indexed name} (or @{text "indexname"}) is a pair of a basic + name and a natural number. This representation allows efficient + renaming by incrementing the second component only. The canonical + way to rename two collections of indexnames apart from each other is + this: determine the maximum index @{text "maxidx"} of the first + collection, then increment all indexes of the second collection by + @{text "maxidx + 1"}; the maximum index of an empty collection is + @{text "-1"}. + + Occasionally, basic names and indexed names are injected into the + same pair type: the (improper) indexname @{text "(x, -1)"} is used + to encode basic names. + + \medskip Isabelle syntax observes the following rules for + representing an indexname @{text "(x, i)"} as a packed string: + + \begin{itemize} + + \item @{text "?x"} if @{text "x"} does not end with a digit and @{text "i = 0"}, + + \item @{text "?xi"} if @{text "x"} does not end with a digit, + + \item @{text "?x.i"} otherwise. + + \end{itemize} + + Indexnames may acquire large index numbers over time. Results are + normalized towards @{text "0"} at certain checkpoints, notably at + the end of a proof. This works by producing variants of the + corresponding basic name components. For example, the collection + @{text "?x1, ?x7, ?x42"} becomes @{text "?x, ?xa, ?xb"}. +*} + +text %mlref {* + \begin{mldecls} + @{index_ML_type indexname} \\ + \end{mldecls} + + \begin{description} + + \item @{ML_type indexname} represents indexed names. This is an + abbreviation for @{ML_type "string * int"}. The second component is + usually non-negative, except for situations where @{text "(x, -1)"} + is used to embed basic names into this type. + + \end{description} +*} + + +subsection {* Qualified names and name spaces *} + +text {* + A \emph{qualified name} consists of a non-empty sequence of basic + name components. The packed representation uses a dot as separator, + as in ``@{text "A.b.c"}''. The last component is called \emph{base} + name, the remaining prefix \emph{qualifier} (which may be empty). + The idea of qualified names is to encode nested structures by + recording the access paths as qualifiers. For example, an item + named ``@{text "A.b.c"}'' may be understood as a local entity @{text + "c"}, within a local structure @{text "b"}, within a global + structure @{text "A"}. Typically, name space hierarchies consist of + 1--2 levels of qualification, but this need not be always so. + + The empty name is commonly used as an indication of unnamed + entities, whenever this makes any sense. The basic operations on + qualified names are smart enough to pass through such improper names + unchanged. + + \medskip A @{text "naming"} policy tells how to turn a name + specification into a fully qualified internal name (by the @{text + "full"} operation), and how fully qualified names may be accessed + externally. For example, the default naming policy is to prefix an + implicit path: @{text "full x"} produces @{text "path.x"}, and the + standard accesses for @{text "path.x"} include both @{text "x"} and + @{text "path.x"}. Normally, the naming is implicit in the theory or + proof context; there are separate versions of the corresponding. + + \medskip A @{text "name space"} manages a collection of fully + internalized names, together with a mapping between external names + and internal names (in both directions). The corresponding @{text + "intern"} and @{text "extern"} operations are mostly used for + parsing and printing only! The @{text "declare"} operation augments + a name space according to the accesses determined by the naming + policy. + + \medskip As a general principle, there is a separate name space for + each kind of formal entity, e.g.\ logical constant, type + constructor, type class, theorem. It is usually clear from the + occurrence in concrete syntax (or from the scope) which kind of + entity a name refers to. For example, the very same name @{text + "c"} may be used uniformly for a constant, type constructor, and + type class. + + There are common schemes to name theorems systematically, according + to the name of the main logical entity involved, e.g.\ @{text + "c.intro"} for a canonical theorem related to constant @{text "c"}. + This technique of mapping names from one space into another requires + some care in order to avoid conflicts. In particular, theorem names + derived from a type constructor or type class are better suffixed in + addition to the usual qualification, e.g.\ @{text "c_type.intro"} + and @{text "c_class.intro"} for theorems related to type @{text "c"} + and class @{text "c"}, respectively. +*} + +text %mlref {* + \begin{mldecls} + @{index_ML NameSpace.base: "string -> string"} \\ + @{index_ML NameSpace.qualifier: "string -> string"} \\ + @{index_ML NameSpace.append: "string -> string -> string"} \\ + @{index_ML NameSpace.implode: "string list -> string"} \\ + @{index_ML NameSpace.explode: "string -> string list"} \\ + \end{mldecls} + \begin{mldecls} + @{index_ML_type NameSpace.naming} \\ + @{index_ML NameSpace.default_naming: NameSpace.naming} \\ + @{index_ML NameSpace.add_path: "string -> NameSpace.naming -> NameSpace.naming"} \\ + @{index_ML NameSpace.full_name: "NameSpace.naming -> binding -> string"} \\ + \end{mldecls} + \begin{mldecls} + @{index_ML_type NameSpace.T} \\ + @{index_ML NameSpace.empty: NameSpace.T} \\ + @{index_ML NameSpace.merge: "NameSpace.T * NameSpace.T -> NameSpace.T"} \\ + @{index_ML NameSpace.declare: "NameSpace.naming -> binding -> NameSpace.T -> string * NameSpace.T"} \\ + @{index_ML NameSpace.intern: "NameSpace.T -> string -> string"} \\ + @{index_ML NameSpace.extern: "NameSpace.T -> string -> string"} \\ + \end{mldecls} + + \begin{description} + + \item @{ML NameSpace.base}~@{text "name"} returns the base name of a + qualified name. + + \item @{ML NameSpace.qualifier}~@{text "name"} returns the qualifier + of a qualified name. + + \item @{ML NameSpace.append}~@{text "name\<^isub>1 name\<^isub>2"} + appends two qualified names. + + \item @{ML NameSpace.implode}~@{text "name"} and @{ML + NameSpace.explode}~@{text "names"} convert between the packed string + representation and the explicit list form of qualified names. + + \item @{ML_type NameSpace.naming} represents the abstract concept of + a naming policy. + + \item @{ML NameSpace.default_naming} is the default naming policy. + In a theory context, this is usually augmented by a path prefix + consisting of the theory name. + + \item @{ML NameSpace.add_path}~@{text "path naming"} augments the + naming policy by extending its path component. + + \item @{ML NameSpace.full_name}@{text "naming binding"} turns a name + binding (usually a basic name) into the fully qualified + internal name, according to the given naming policy. + + \item @{ML_type NameSpace.T} represents name spaces. + + \item @{ML NameSpace.empty} and @{ML NameSpace.merge}~@{text + "(space\<^isub>1, space\<^isub>2)"} are the canonical operations for + maintaining name spaces according to theory data management + (\secref{sec:context-data}). + + \item @{ML NameSpace.declare}~@{text "naming bindings space"} enters a + name binding as fully qualified internal name into the name space, + with external accesses determined by the naming policy. + + \item @{ML NameSpace.intern}~@{text "space name"} internalizes a + (partially qualified) external name. + + This operation is mostly for parsing! Note that fully qualified + names stemming from declarations are produced via @{ML + "NameSpace.full_name"} and @{ML "NameSpace.declare"} + (or their derivatives for @{ML_type theory} and + @{ML_type Proof.context}). + + \item @{ML NameSpace.extern}~@{text "space name"} externalizes a + (fully qualified) internal name. + + This operation is mostly for printing! Note unqualified names are + produced via @{ML NameSpace.base}. + + \end{description} +*} + +end diff -r 419116f1157a -r e23770bc97c8 doc-src/IsarImplementation/Thy/Proof.thy --- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/doc-src/IsarImplementation/Thy/Proof.thy Thu Feb 26 08:48:33 2009 -0800 @@ -0,0 +1,330 @@ +theory Proof +imports Base +begin + +chapter {* Structured proofs *} + +section {* Variables \label{sec:variables} *} + +text {* + Any variable that is not explicitly bound by @{text "\"}-abstraction + is considered as ``free''. Logically, free variables act like + outermost universal quantification at the sequent level: @{text + "A\<^isub>1(x), \, A\<^isub>n(x) \ B(x)"} means that the result + holds \emph{for all} values of @{text "x"}. Free variables for + terms (not types) can be fully internalized into the logic: @{text + "\ B(x)"} and @{text "\ \x. B(x)"} are interchangeable, provided + that @{text "x"} does not occur elsewhere in the context. + Inspecting @{text "\ \x. B(x)"} more closely, we see that inside the + quantifier, @{text "x"} is essentially ``arbitrary, but fixed'', + while from outside it appears as a place-holder for instantiation + (thanks to @{text "\"} elimination). + + The Pure logic represents the idea of variables being either inside + or outside the current scope by providing separate syntactic + categories for \emph{fixed variables} (e.g.\ @{text "x"}) vs.\ + \emph{schematic variables} (e.g.\ @{text "?x"}). Incidently, a + universal result @{text "\ \x. B(x)"} has the HHF normal form @{text + "\ B(?x)"}, which represents its generality nicely without requiring + an explicit quantifier. The same principle works for type + variables: @{text "\ B(?\)"} represents the idea of ``@{text "\ + \\. B(\)"}'' without demanding a truly polymorphic framework. + + \medskip Additional care is required to treat type variables in a + way that facilitates type-inference. In principle, term variables + depend on type variables, which means that type variables would have + to be declared first. For example, a raw type-theoretic framework + would demand the context to be constructed in stages as follows: + @{text "\ = \: type, x: \, a: A(x\<^isub>\)"}. + + We allow a slightly less formalistic mode of operation: term + variables @{text "x"} are fixed without specifying a type yet + (essentially \emph{all} potential occurrences of some instance + @{text "x\<^isub>\"} are fixed); the first occurrence of @{text "x"} + within a specific term assigns its most general type, which is then + maintained consistently in the context. The above example becomes + @{text "\ = x: term, \: type, A(x\<^isub>\)"}, where type @{text + "\"} is fixed \emph{after} term @{text "x"}, and the constraint + @{text "x :: \"} is an implicit consequence of the occurrence of + @{text "x\<^isub>\"} in the subsequent proposition. + + This twist of dependencies is also accommodated by the reverse + operation of exporting results from a context: a type variable + @{text "\"} is considered fixed as long as it occurs in some fixed + term variable of the context. For example, exporting @{text "x: + term, \: type \ x\<^isub>\ = x\<^isub>\"} produces in the first step + @{text "x: term \ x\<^isub>\ = x\<^isub>\"} for fixed @{text "\"}, + and only in the second step @{text "\ ?x\<^isub>?\<^isub>\ = + ?x\<^isub>?\<^isub>\"} for schematic @{text "?x"} and @{text "?\"}. + + \medskip The Isabelle/Isar proof context manages the gory details of + term vs.\ type variables, with high-level principles for moving the + frontier between fixed and schematic variables. + + The @{text "add_fixes"} operation explictly declares fixed + variables; the @{text "declare_term"} operation absorbs a term into + a context by fixing new type variables and adding syntactic + constraints. + + The @{text "export"} operation is able to perform the main work of + generalizing term and type variables as sketched above, assuming + that fixing variables and terms have been declared properly. + + There @{text "import"} operation makes a generalized fact a genuine + part of the context, by inventing fixed variables for the schematic + ones. The effect can be reversed by using @{text "export"} later, + potentially with an extended context; the result is equivalent to + the original modulo renaming of schematic variables. + + The @{text "focus"} operation provides a variant of @{text "import"} + for nested propositions (with explicit quantification): @{text + "\x\<^isub>1 \ x\<^isub>n. B(x\<^isub>1, \, x\<^isub>n)"} is + decomposed by inventing fixed variables @{text "x\<^isub>1, \, + x\<^isub>n"} for the body. +*} + +text %mlref {* + \begin{mldecls} + @{index_ML Variable.add_fixes: " + string list -> Proof.context -> string list * Proof.context"} \\ + @{index_ML Variable.variant_fixes: " + string list -> Proof.context -> string list * Proof.context"} \\ + @{index_ML Variable.declare_term: "term -> Proof.context -> Proof.context"} \\ + @{index_ML Variable.declare_constraints: "term -> Proof.context -> Proof.context"} \\ + @{index_ML Variable.export: "Proof.context -> Proof.context -> thm list -> thm list"} \\ + @{index_ML Variable.polymorphic: "Proof.context -> term list -> term list"} \\ + @{index_ML Variable.import_thms: "bool -> thm list -> Proof.context -> + ((ctyp list * cterm list) * thm list) * Proof.context"} \\ + @{index_ML Variable.focus: "cterm -> Proof.context -> (cterm list * cterm) * Proof.context"} \\ + \end{mldecls} + + \begin{description} + + \item @{ML Variable.add_fixes}~@{text "xs ctxt"} fixes term + variables @{text "xs"}, returning the resulting internal names. By + default, the internal representation coincides with the external + one, which also means that the given variables must not be fixed + already. There is a different policy within a local proof body: the + given names are just hints for newly invented Skolem variables. + + \item @{ML Variable.variant_fixes} is similar to @{ML + Variable.add_fixes}, but always produces fresh variants of the given + names. + + \item @{ML Variable.declare_term}~@{text "t ctxt"} declares term + @{text "t"} to belong to the context. This automatically fixes new + type variables, but not term variables. Syntactic constraints for + type and term variables are declared uniformly, though. + + \item @{ML Variable.declare_constraints}~@{text "t ctxt"} declares + syntactic constraints from term @{text "t"}, without making it part + of the context yet. + + \item @{ML Variable.export}~@{text "inner outer thms"} generalizes + fixed type and term variables in @{text "thms"} according to the + difference of the @{text "inner"} and @{text "outer"} context, + following the principles sketched above. + + \item @{ML Variable.polymorphic}~@{text "ctxt ts"} generalizes type + variables in @{text "ts"} as far as possible, even those occurring + in fixed term variables. The default policy of type-inference is to + fix newly introduced type variables, which is essentially reversed + with @{ML Variable.polymorphic}: here the given terms are detached + from the context as far as possible. + + \item @{ML Variable.import_thms}~@{text "open thms ctxt"} invents fixed + type and term variables for the schematic ones occurring in @{text + "thms"}. The @{text "open"} flag indicates whether the fixed names + should be accessible to the user, otherwise newly introduced names + are marked as ``internal'' (\secref{sec:names}). + + \item @{ML Variable.focus}~@{text B} decomposes the outermost @{text + "\"} prefix of proposition @{text "B"}. + + \end{description} +*} + + +section {* Assumptions \label{sec:assumptions} *} + +text {* + An \emph{assumption} is a proposition that it is postulated in the + current context. Local conclusions may use assumptions as + additional facts, but this imposes implicit hypotheses that weaken + the overall statement. + + Assumptions are restricted to fixed non-schematic statements, i.e.\ + all generality needs to be expressed by explicit quantifiers. + Nevertheless, the result will be in HHF normal form with outermost + quantifiers stripped. For example, by assuming @{text "\x :: \. P + x"} we get @{text "\x :: \. P x \ P ?x"} for schematic @{text "?x"} + of fixed type @{text "\"}. Local derivations accumulate more and + more explicit references to hypotheses: @{text "A\<^isub>1, \, + A\<^isub>n \ B"} where @{text "A\<^isub>1, \, A\<^isub>n"} needs to + be covered by the assumptions of the current context. + + \medskip The @{text "add_assms"} operation augments the context by + local assumptions, which are parameterized by an arbitrary @{text + "export"} rule (see below). + + The @{text "export"} operation moves facts from a (larger) inner + context into a (smaller) outer context, by discharging the + difference of the assumptions as specified by the associated export + rules. Note that the discharged portion is determined by the + difference contexts, not the facts being exported! There is a + separate flag to indicate a goal context, where the result is meant + to refine an enclosing sub-goal of a structured proof state. + + \medskip The most basic export rule discharges assumptions directly + by means of the @{text "\"} introduction rule: + \[ + \infer[(@{text "\_intro"})]{@{text "\ \\ A \ A \ B"}}{@{text "\ \ B"}} + \] + + The variant for goal refinements marks the newly introduced + premises, which causes the canonical Isar goal refinement scheme to + enforce unification with local premises within the goal: + \[ + \infer[(@{text "#\_intro"})]{@{text "\ \\ A \ #A \ B"}}{@{text "\ \ B"}} + \] + + \medskip Alternative versions of assumptions may perform arbitrary + transformations on export, as long as the corresponding portion of + hypotheses is removed from the given facts. For example, a local + definition works by fixing @{text "x"} and assuming @{text "x \ t"}, + with the following export rule to reverse the effect: + \[ + \infer[(@{text "\-expand"})]{@{text "\ \\ x \ t \ B t"}}{@{text "\ \ B x"}} + \] + This works, because the assumption @{text "x \ t"} was introduced in + a context with @{text "x"} being fresh, so @{text "x"} does not + occur in @{text "\"} here. +*} + +text %mlref {* + \begin{mldecls} + @{index_ML_type Assumption.export} \\ + @{index_ML Assumption.assume: "cterm -> thm"} \\ + @{index_ML Assumption.add_assms: + "Assumption.export -> + cterm list -> Proof.context -> thm list * Proof.context"} \\ + @{index_ML Assumption.add_assumes: " + cterm list -> Proof.context -> thm list * Proof.context"} \\ + @{index_ML Assumption.export: "bool -> Proof.context -> Proof.context -> thm -> thm"} \\ + \end{mldecls} + + \begin{description} + + \item @{ML_type Assumption.export} represents arbitrary export + rules, which is any function of type @{ML_type "bool -> cterm list -> thm -> thm"}, + where the @{ML_type "bool"} indicates goal mode, and the @{ML_type + "cterm list"} the collection of assumptions to be discharged + simultaneously. + + \item @{ML Assumption.assume}~@{text "A"} turns proposition @{text + "A"} into a raw assumption @{text "A \ A'"}, where the conclusion + @{text "A'"} is in HHF normal form. + + \item @{ML Assumption.add_assms}~@{text "r As"} augments the context + by assumptions @{text "As"} with export rule @{text "r"}. The + resulting facts are hypothetical theorems as produced by the raw + @{ML Assumption.assume}. + + \item @{ML Assumption.add_assumes}~@{text "As"} is a special case of + @{ML Assumption.add_assms} where the export rule performs @{text + "\_intro"} or @{text "#\_intro"}, depending on goal mode. + + \item @{ML Assumption.export}~@{text "is_goal inner outer thm"} + exports result @{text "thm"} from the the @{text "inner"} context + back into the @{text "outer"} one; @{text "is_goal = true"} means + this is a goal context. The result is in HHF normal form. Note + that @{ML "ProofContext.export"} combines @{ML "Variable.export"} + and @{ML "Assumption.export"} in the canonical way. + + \end{description} +*} + + +section {* Results \label{sec:results} *} + +text {* + Local results are established by monotonic reasoning from facts + within a context. This allows common combinations of theorems, + e.g.\ via @{text "\/\"} elimination, resolution rules, or equational + reasoning, see \secref{sec:thms}. Unaccounted context manipulations + should be avoided, notably raw @{text "\/\"} introduction or ad-hoc + references to free variables or assumptions not present in the proof + context. + + \medskip The @{text "SUBPROOF"} combinator allows to structure a + tactical proof recursively by decomposing a selected sub-goal: + @{text "(\x. A(x) \ B(x)) \ \"} is turned into @{text "B(x) \ \"} + after fixing @{text "x"} and assuming @{text "A(x)"}. This means + the tactic needs to solve the conclusion, but may use the premise as + a local fact, for locally fixed variables. + + The @{text "prove"} operation provides an interface for structured + backwards reasoning under program control, with some explicit sanity + checks of the result. The goal context can be augmented by + additional fixed variables (cf.\ \secref{sec:variables}) and + assumptions (cf.\ \secref{sec:assumptions}), which will be available + as local facts during the proof and discharged into implications in + the result. Type and term variables are generalized as usual, + according to the context. + + The @{text "obtain"} operation produces results by eliminating + existing facts by means of a given tactic. This acts like a dual + conclusion: the proof demonstrates that the context may be augmented + by certain fixed variables and assumptions. See also + \cite{isabelle-isar-ref} for the user-level @{text "\"} and + @{text "\"} elements. Final results, which may not refer to + the parameters in the conclusion, need to exported explicitly into + the original context. +*} + +text %mlref {* + \begin{mldecls} + @{index_ML SUBPROOF: + "({context: Proof.context, schematics: ctyp list * cterm list, + params: cterm list, asms: cterm list, concl: cterm, + prems: thm list} -> tactic) -> Proof.context -> int -> tactic"} \\ + \end{mldecls} + \begin{mldecls} + @{index_ML Goal.prove: "Proof.context -> string list -> term list -> term -> + ({prems: thm list, context: Proof.context} -> tactic) -> thm"} \\ + @{index_ML Goal.prove_multi: "Proof.context -> string list -> term list -> term list -> + ({prems: thm list, context: Proof.context} -> tactic) -> thm list"} \\ + \end{mldecls} + \begin{mldecls} + @{index_ML Obtain.result: "(Proof.context -> tactic) -> + thm list -> Proof.context -> (cterm list * thm list) * Proof.context"} \\ + \end{mldecls} + + \begin{description} + + \item @{ML SUBPROOF}~@{text "tac ctxt i"} decomposes the structure + of the specified sub-goal, producing an extended context and a + reduced goal, which needs to be solved by the given tactic. All + schematic parameters of the goal are imported into the context as + fixed ones, which may not be instantiated in the sub-proof. + + \item @{ML Goal.prove}~@{text "ctxt xs As C tac"} states goal @{text + "C"} in the context augmented by fixed variables @{text "xs"} and + assumptions @{text "As"}, and applies tactic @{text "tac"} to solve + it. The latter may depend on the local assumptions being presented + as facts. The result is in HHF normal form. + + \item @{ML Goal.prove_multi} is simular to @{ML Goal.prove}, but + states several conclusions simultaneously. The goal is encoded by + means of Pure conjunction; @{ML Goal.conjunction_tac} will turn this + into a collection of individual subgoals. + + \item @{ML Obtain.result}~@{text "tac thms ctxt"} eliminates the + given facts using a tactic, which results in additional fixed + variables and assumptions in the context. Final results need to be + exported explicitly. + + \end{description} +*} + +end diff -r 419116f1157a -r e23770bc97c8 doc-src/IsarImplementation/Thy/ROOT.ML --- a/doc-src/IsarImplementation/Thy/ROOT.ML Thu Feb 26 08:44:44 2009 -0800 +++ b/doc-src/IsarImplementation/Thy/ROOT.ML Thu Feb 26 08:48:33 2009 -0800 @@ -1,11 +1,8 @@ - -(* $Id$ *) - -use_thy "prelim"; -use_thy "logic"; -use_thy "tactic"; -use_thy "proof"; -use_thy "isar"; -use_thy "locale"; -use_thy "integration"; +use_thy "Prelim"; +use_thy "Logic"; +use_thy "Tactic"; +use_thy "Proof"; +use_thy "Isar"; +use_thy "Local_Theory"; +use_thy "Integration"; use_thy "ML"; diff -r 419116f1157a -r e23770bc97c8 doc-src/IsarImplementation/Thy/Tactic.thy --- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/doc-src/IsarImplementation/Thy/Tactic.thy Thu Feb 26 08:48:33 2009 -0800 @@ -0,0 +1,405 @@ +theory Tactic +imports Base +begin + +chapter {* Tactical reasoning *} + +text {* + Tactical reasoning works by refining the initial claim in a + backwards fashion, until a solved form is reached. A @{text "goal"} + consists of several subgoals that need to be solved in order to + achieve the main statement; zero subgoals means that the proof may + be finished. A @{text "tactic"} is a refinement operation that maps + a goal to a lazy sequence of potential successors. A @{text + "tactical"} is a combinator for composing tactics. +*} + + +section {* Goals \label{sec:tactical-goals} *} + +text {* + Isabelle/Pure represents a goal as a theorem stating that the + subgoals imply the main goal: @{text "A\<^sub>1 \ \ \ A\<^sub>n \ + C"}. The outermost goal structure is that of a Horn Clause: i.e.\ + an iterated implication without any quantifiers\footnote{Recall that + outermost @{text "\x. \[x]"} is always represented via schematic + variables in the body: @{text "\[?x]"}. These variables may get + instantiated during the course of reasoning.}. For @{text "n = 0"} + a goal is called ``solved''. + + The structure of each subgoal @{text "A\<^sub>i"} is that of a + general Hereditary Harrop Formula @{text "\x\<^sub>1 \ + \x\<^sub>k. H\<^sub>1 \ \ \ H\<^sub>m \ B"}. Here @{text + "x\<^sub>1, \, x\<^sub>k"} are goal parameters, i.e.\ + arbitrary-but-fixed entities of certain types, and @{text + "H\<^sub>1, \, H\<^sub>m"} are goal hypotheses, i.e.\ facts that may + be assumed locally. Together, this forms the goal context of the + conclusion @{text B} to be established. The goal hypotheses may be + again arbitrary Hereditary Harrop Formulas, although the level of + nesting rarely exceeds 1--2 in practice. + + The main conclusion @{text C} is internally marked as a protected + proposition, which is represented explicitly by the notation @{text + "#C"}. This ensures that the decomposition into subgoals and main + conclusion is well-defined for arbitrarily structured claims. + + \medskip Basic goal management is performed via the following + Isabelle/Pure rules: + + \[ + \infer[@{text "(init)"}]{@{text "C \ #C"}}{} \qquad + \infer[@{text "(finish)"}]{@{text "C"}}{@{text "#C"}} + \] + + \medskip The following low-level variants admit general reasoning + with protected propositions: + + \[ + \infer[@{text "(protect)"}]{@{text "#C"}}{@{text "C"}} \qquad + \infer[@{text "(conclude)"}]{@{text "A\<^sub>1 \ \ \ A\<^sub>n \ C"}}{@{text "A\<^sub>1 \ \ \ A\<^sub>n \ #C"}} + \] +*} + +text %mlref {* + \begin{mldecls} + @{index_ML Goal.init: "cterm -> thm"} \\ + @{index_ML Goal.finish: "thm -> thm"} \\ + @{index_ML Goal.protect: "thm -> thm"} \\ + @{index_ML Goal.conclude: "thm -> thm"} \\ + \end{mldecls} + + \begin{description} + + \item @{ML "Goal.init"}~@{text C} initializes a tactical goal from + the well-formed proposition @{text C}. + + \item @{ML "Goal.finish"}~@{text "thm"} checks whether theorem + @{text "thm"} is a solved goal (no subgoals), and concludes the + result by removing the goal protection. + + \item @{ML "Goal.protect"}~@{text "thm"} protects the full statement + of theorem @{text "thm"}. + + \item @{ML "Goal.conclude"}~@{text "thm"} removes the goal + protection, even if there are pending subgoals. + + \end{description} +*} + + +section {* Tactics *} + +text {* A @{text "tactic"} is a function @{text "goal \ goal\<^sup>*\<^sup>*"} that + maps a given goal state (represented as a theorem, cf.\ + \secref{sec:tactical-goals}) to a lazy sequence of potential + successor states. The underlying sequence implementation is lazy + both in head and tail, and is purely functional in \emph{not} + supporting memoing.\footnote{The lack of memoing and the strict + nature of SML requires some care when working with low-level + sequence operations, to avoid duplicate or premature evaluation of + results.} + + An \emph{empty result sequence} means that the tactic has failed: in + a compound tactic expressions other tactics might be tried instead, + or the whole refinement step might fail outright, producing a + toplevel error message. When implementing tactics from scratch, one + should take care to observe the basic protocol of mapping regular + error conditions to an empty result; only serious faults should + emerge as exceptions. + + By enumerating \emph{multiple results}, a tactic can easily express + the potential outcome of an internal search process. There are also + combinators for building proof tools that involve search + systematically, see also \secref{sec:tacticals}. + + \medskip As explained in \secref{sec:tactical-goals}, a goal state + essentially consists of a list of subgoals that imply the main goal + (conclusion). Tactics may operate on all subgoals or on a + particularly specified subgoal, but must not change the main + conclusion (apart from instantiating schematic goal variables). + + Tactics with explicit \emph{subgoal addressing} are of the form + @{text "int \ tactic"} and may be applied to a particular subgoal + (counting from 1). If the subgoal number is out of range, the + tactic should fail with an empty result sequence, but must not raise + an exception! + + Operating on a particular subgoal means to replace it by an interval + of zero or more subgoals in the same place; other subgoals must not + be affected, apart from instantiating schematic variables ranging + over the whole goal state. + + A common pattern of composing tactics with subgoal addressing is to + try the first one, and then the second one only if the subgoal has + not been solved yet. Special care is required here to avoid bumping + into unrelated subgoals that happen to come after the original + subgoal. Assuming that there is only a single initial subgoal is a + very common error when implementing tactics! + + Tactics with internal subgoal addressing should expose the subgoal + index as @{text "int"} argument in full generality; a hardwired + subgoal 1 inappropriate. + + \medskip The main well-formedness conditions for proper tactics are + summarized as follows. + + \begin{itemize} + + \item General tactic failure is indicated by an empty result, only + serious faults may produce an exception. + + \item The main conclusion must not be changed, apart from + instantiating schematic variables. + + \item A tactic operates either uniformly on all subgoals, or + specifically on a selected subgoal (without bumping into unrelated + subgoals). + + \item Range errors in subgoal addressing produce an empty result. + + \end{itemize} + + Some of these conditions are checked by higher-level goal + infrastructure (\secref{sec:results}); others are not checked + explicitly, and violating them merely results in ill-behaved tactics + experienced by the user (e.g.\ tactics that insist in being + applicable only to singleton goals, or disallow composition with + basic tacticals). +*} + +text %mlref {* + \begin{mldecls} + @{index_ML_type tactic: "thm -> thm Seq.seq"} \\ + @{index_ML no_tac: tactic} \\ + @{index_ML all_tac: tactic} \\ + @{index_ML print_tac: "string -> tactic"} \\[1ex] + @{index_ML PRIMITIVE: "(thm -> thm) -> tactic"} \\[1ex] + @{index_ML SUBGOAL: "(term * int -> tactic) -> int -> tactic"} \\ + @{index_ML CSUBGOAL: "(cterm * int -> tactic) -> int -> tactic"} \\ + \end{mldecls} + + \begin{description} + + \item @{ML_type tactic} represents tactics. The well-formedness + conditions described above need to be observed. See also @{"file" + "~~/src/Pure/General/seq.ML"} for the underlying implementation of + lazy sequences. + + \item @{ML_type "int -> tactic"} represents tactics with explicit + subgoal addressing, with well-formedness conditions as described + above. + + \item @{ML no_tac} is a tactic that always fails, returning the + empty sequence. + + \item @{ML all_tac} is a tactic that always succeeds, returning a + singleton sequence with unchanged goal state. + + \item @{ML print_tac}~@{text "message"} is like @{ML all_tac}, but + prints a message together with the goal state on the tracing + channel. + + \item @{ML PRIMITIVE}~@{text rule} turns a primitive inference rule + into a tactic with unique result. Exception @{ML THM} is considered + a regular tactic failure and produces an empty result; other + exceptions are passed through. + + \item @{ML SUBGOAL}~@{text "(fn (subgoal, i) => tactic)"} is the + most basic form to produce a tactic with subgoal addressing. The + given abstraction over the subgoal term and subgoal number allows to + peek at the relevant information of the full goal state. The + subgoal range is checked as required above. + + \item @{ML CSUBGOAL} is similar to @{ML SUBGOAL}, but passes the + subgoal as @{ML_type cterm} instead of raw @{ML_type term}. This + avoids expensive re-certification in situations where the subgoal is + used directly for primitive inferences. + + \end{description} +*} + + +subsection {* Resolution and assumption tactics \label{sec:resolve-assume-tac} *} + +text {* \emph{Resolution} is the most basic mechanism for refining a + subgoal using a theorem as object-level rule. + \emph{Elim-resolution} is particularly suited for elimination rules: + it resolves with a rule, proves its first premise by assumption, and + finally deletes that assumption from any new subgoals. + \emph{Destruct-resolution} is like elim-resolution, but the given + destruction rules are first turned into canonical elimination + format. \emph{Forward-resolution} is like destruct-resolution, but + without deleting the selected assumption. The @{text "r/e/d/f"} + naming convention is maintained for several different kinds of + resolution rules and tactics. + + Assumption tactics close a subgoal by unifying some of its premises + against its conclusion. + + \medskip All the tactics in this section operate on a subgoal + designated by a positive integer. Other subgoals might be affected + indirectly, due to instantiation of schematic variables. + + There are various sources of non-determinism, the tactic result + sequence enumerates all possibilities of the following choices (if + applicable): + + \begin{enumerate} + + \item selecting one of the rules given as argument to the tactic; + + \item selecting a subgoal premise to eliminate, unifying it against + the first premise of the rule; + + \item unifying the conclusion of the subgoal to the conclusion of + the rule. + + \end{enumerate} + + Recall that higher-order unification may produce multiple results + that are enumerated here. +*} + +text %mlref {* + \begin{mldecls} + @{index_ML resolve_tac: "thm list -> int -> tactic"} \\ + @{index_ML eresolve_tac: "thm list -> int -> tactic"} \\ + @{index_ML dresolve_tac: "thm list -> int -> tactic"} \\ + @{index_ML forward_tac: "thm list -> int -> tactic"} \\[1ex] + @{index_ML assume_tac: "int -> tactic"} \\ + @{index_ML eq_assume_tac: "int -> tactic"} \\[1ex] + @{index_ML match_tac: "thm list -> int -> tactic"} \\ + @{index_ML ematch_tac: "thm list -> int -> tactic"} \\ + @{index_ML dmatch_tac: "thm list -> int -> tactic"} \\ + \end{mldecls} + + \begin{description} + + \item @{ML resolve_tac}~@{text "thms i"} refines the goal state + using the given theorems, which should normally be introduction + rules. The tactic resolves a rule's conclusion with subgoal @{text + i}, replacing it by the corresponding versions of the rule's + premises. + + \item @{ML eresolve_tac}~@{text "thms i"} performs elim-resolution + with the given theorems, which should normally be elimination rules. + + \item @{ML dresolve_tac}~@{text "thms i"} performs + destruct-resolution with the given theorems, which should normally + be destruction rules. This replaces an assumption by the result of + applying one of the rules. + + \item @{ML forward_tac} is like @{ML dresolve_tac} except that the + selected assumption is not deleted. It applies a rule to an + assumption, adding the result as a new assumption. + + \item @{ML assume_tac}~@{text i} attempts to solve subgoal @{text i} + by assumption (modulo higher-order unification). + + \item @{ML eq_assume_tac} is similar to @{ML assume_tac}, but checks + only for immediate @{text "\"}-convertibility instead of using + unification. It succeeds (with a unique next state) if one of the + assumptions is equal to the subgoal's conclusion. Since it does not + instantiate variables, it cannot make other subgoals unprovable. + + \item @{ML match_tac}, @{ML ematch_tac}, and @{ML dmatch_tac} are + similar to @{ML resolve_tac}, @{ML eresolve_tac}, and @{ML + dresolve_tac}, respectively, but do not instantiate schematic + variables in the goal state. + + Flexible subgoals are not updated at will, but are left alone. + Strictly speaking, matching means to treat the unknowns in the goal + state as constants; these tactics merely discard unifiers that would + update the goal state. + + \end{description} +*} + + +subsection {* Explicit instantiation within a subgoal context *} + +text {* The main resolution tactics (\secref{sec:resolve-assume-tac}) + use higher-order unification, which works well in many practical + situations despite its daunting theoretical properties. + Nonetheless, there are important problem classes where unguided + higher-order unification is not so useful. This typically involves + rules like universal elimination, existential introduction, or + equational substitution. Here the unification problem involves + fully flexible @{text "?P ?x"} schemes, which are hard to manage + without further hints. + + By providing a (small) rigid term for @{text "?x"} explicitly, the + remaining unification problem is to assign a (large) term to @{text + "?P"}, according to the shape of the given subgoal. This is + sufficiently well-behaved in most practical situations. + + \medskip Isabelle provides separate versions of the standard @{text + "r/e/d/f"} resolution tactics that allow to provide explicit + instantiations of unknowns of the given rule, wrt.\ terms that refer + to the implicit context of the selected subgoal. + + An instantiation consists of a list of pairs of the form @{text + "(?x, t)"}, where @{text ?x} is a schematic variable occurring in + the given rule, and @{text t} is a term from the current proof + context, augmented by the local goal parameters of the selected + subgoal; cf.\ the @{text "focus"} operation described in + \secref{sec:variables}. + + Entering the syntactic context of a subgoal is a brittle operation, + because its exact form is somewhat accidental, and the choice of + bound variable names depends on the presence of other local and + global names. Explicit renaming of subgoal parameters prior to + explicit instantiation might help to achieve a bit more robustness. + + Type instantiations may be given as well, via pairs like @{text + "(?'a, \)"}. Type instantiations are distinguished from term + instantiations by the syntactic form of the schematic variable. + Types are instantiated before terms are. Since term instantiation + already performs type-inference as expected, explicit type + instantiations are seldom necessary. +*} + +text %mlref {* + \begin{mldecls} + @{index_ML res_inst_tac: "Proof.context -> (indexname * string) list -> thm -> int -> tactic"} \\ + @{index_ML eres_inst_tac: "Proof.context -> (indexname * string) list -> thm -> int -> tactic"} \\ + @{index_ML dres_inst_tac: "Proof.context -> (indexname * string) list -> thm -> int -> tactic"} \\ + @{index_ML forw_inst_tac: "Proof.context -> (indexname * string) list -> thm -> int -> tactic"} \\[1ex] + @{index_ML rename_tac: "string list -> int -> tactic"} \\ + \end{mldecls} + + \begin{description} + + \item @{ML res_inst_tac}~@{text "ctxt insts thm i"} instantiates the + rule @{text thm} with the instantiations @{text insts}, as described + above, and then performs resolution on subgoal @{text i}. + + \item @{ML eres_inst_tac} is like @{ML res_inst_tac}, but performs + elim-resolution. + + \item @{ML dres_inst_tac} is like @{ML res_inst_tac}, but performs + destruct-resolution. + + \item @{ML forw_inst_tac} is like @{ML dres_inst_tac} except that + the selected assumption is not deleted. + + \item @{ML rename_tac}~@{text "names i"} renames the innermost + parameters of subgoal @{text i} according to the provided @{text + names} (which need to be distinct indentifiers). + + \end{description} +*} + + +section {* Tacticals \label{sec:tacticals} *} + +text {* + A \emph{tactical} is a functional combinator for building up complex + tactics from simpler ones. Typical tactical perform sequential + composition, disjunction (choice), iteration, or goal addressing. + Various search strategies may be expressed via tacticals. + + \medskip FIXME +*} + +end diff -r 419116f1157a -r e23770bc97c8 doc-src/IsarImplementation/Thy/base.thy --- a/doc-src/IsarImplementation/Thy/base.thy Thu Feb 26 08:44:44 2009 -0800 +++ /dev/null Thu Jan 01 00:00:00 1970 +0000 @@ -1,9 +0,0 @@ - -(* $Id$ *) - -theory base -imports Pure -uses "../../antiquote_setup.ML" -begin - -end diff -r 419116f1157a -r e23770bc97c8 doc-src/IsarImplementation/Thy/document/Base.tex --- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/doc-src/IsarImplementation/Thy/document/Base.tex Thu Feb 26 08:48:33 2009 -0800 @@ -0,0 +1,29 @@ +% +\begin{isabellebody}% +\def\isabellecontext{Base}% +% +\isadelimtheory +% +\endisadelimtheory +% +\isatagtheory +\isacommand{theory}\isamarkupfalse% +\ Base\isanewline +\isakeyword{imports}\ Pure\isanewline +\isakeyword{uses}\ {\isachardoublequoteopen}{\isachardot}{\isachardot}{\isacharslash}{\isachardot}{\isachardot}{\isacharslash}antiquote{\isacharunderscore}setup{\isachardot}ML{\isachardoublequoteclose}\isanewline +\isakeyword{begin}\isanewline +\isanewline +\isacommand{end}\isamarkupfalse% +% +\endisatagtheory +{\isafoldtheory}% +% +\isadelimtheory +\isanewline +% +\endisadelimtheory +\end{isabellebody}% +%%% Local Variables: +%%% mode: latex +%%% TeX-master: "root" +%%% End: diff -r 419116f1157a -r e23770bc97c8 doc-src/IsarImplementation/Thy/document/Integration.tex --- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/doc-src/IsarImplementation/Thy/document/Integration.tex Thu Feb 26 08:48:33 2009 -0800 @@ -0,0 +1,520 @@ +% +\begin{isabellebody}% +\def\isabellecontext{Integration}% +% +\isadelimtheory +% +\endisadelimtheory +% +\isatagtheory +\isacommand{theory}\isamarkupfalse% +\ Integration\isanewline +\isakeyword{imports}\ Base\isanewline +\isakeyword{begin}% +\endisatagtheory +{\isafoldtheory}% +% +\isadelimtheory +% +\endisadelimtheory +% +\isamarkupchapter{System integration% +} +\isamarkuptrue% +% +\isamarkupsection{Isar toplevel \label{sec:isar-toplevel}% +} +\isamarkuptrue% +% +\begin{isamarkuptext}% +The Isar toplevel may be considered the centeral hub of the + Isabelle/Isar system, where all key components and sub-systems are + integrated into a single read-eval-print loop of Isar commands. We + shall even incorporate the existing {\ML} toplevel of the compiler + and run-time system (cf.\ \secref{sec:ML-toplevel}). + + Isabelle/Isar departs from the original ``LCF system architecture'' + where {\ML} was really The Meta Language for defining theories and + conducting proofs. Instead, {\ML} now only serves as the + implementation language for the system (and user extensions), while + the specific Isar toplevel supports the concepts of theory and proof + development natively. This includes the graph structure of theories + and the block structure of proofs, support for unlimited undo, + facilities for tracing, debugging, timing, profiling etc. + + \medskip The toplevel maintains an implicit state, which is + transformed by a sequence of transitions -- either interactively or + in batch-mode. In interactive mode, Isar state transitions are + encapsulated as safe transactions, such that both failure and undo + are handled conveniently without destroying the underlying draft + theory (cf.~\secref{sec:context-theory}). In batch mode, + transitions operate in a linear (destructive) fashion, such that + error conditions abort the present attempt to construct a theory or + proof altogether. + + The toplevel state is a disjoint sum of empty \isa{toplevel}, or + \isa{theory}, or \isa{proof}. On entering the main Isar loop we + start with an empty toplevel. A theory is commenced by giving a + \isa{{\isasymTHEORY}} header; within a theory we may issue theory + commands such as \isa{{\isasymDEFINITION}}, or state a \isa{{\isasymTHEOREM}} to be proven. Now we are within a proof state, with a + rich collection of Isar proof commands for structured proof + composition, or unstructured proof scripts. When the proof is + concluded we get back to the theory, which is then updated by + storing the resulting fact. Further theory declarations or theorem + statements with proofs may follow, until we eventually conclude the + theory development by issuing \isa{{\isasymEND}}. The resulting theory + is then stored within the theory database and we are back to the + empty toplevel. + + In addition to these proper state transformations, there are also + some diagnostic commands for peeking at the toplevel state without + modifying it (e.g.\ \isakeyword{thm}, \isakeyword{term}, + \isakeyword{print-cases}).% +\end{isamarkuptext}% +\isamarkuptrue% +% +\isadelimmlref +% +\endisadelimmlref +% +\isatagmlref +% +\begin{isamarkuptext}% +\begin{mldecls} + \indexmltype{Toplevel.state}\verb|type Toplevel.state| \\ + \indexml{Toplevel.UNDEF}\verb|Toplevel.UNDEF: exn| \\ + \indexml{Toplevel.is\_toplevel}\verb|Toplevel.is_toplevel: Toplevel.state -> bool| \\ + \indexml{Toplevel.theory\_of}\verb|Toplevel.theory_of: Toplevel.state -> theory| \\ + \indexml{Toplevel.proof\_of}\verb|Toplevel.proof_of: Toplevel.state -> Proof.state| \\ + \indexml{Toplevel.debug}\verb|Toplevel.debug: bool ref| \\ + \indexml{Toplevel.timing}\verb|Toplevel.timing: bool ref| \\ + \indexml{Toplevel.profiling}\verb|Toplevel.profiling: int ref| \\ + \end{mldecls} + + \begin{description} + + \item \verb|Toplevel.state| represents Isar toplevel states, + which are normally manipulated through the concept of toplevel + transitions only (\secref{sec:toplevel-transition}). Also note that + a raw toplevel state is subject to the same linearity restrictions + as a theory context (cf.~\secref{sec:context-theory}). + + \item \verb|Toplevel.UNDEF| is raised for undefined toplevel + operations. Many operations work only partially for certain cases, + since \verb|Toplevel.state| is a sum type. + + \item \verb|Toplevel.is_toplevel|~\isa{state} checks for an empty + toplevel state. + + \item \verb|Toplevel.theory_of|~\isa{state} selects the theory of + a theory or proof (!), otherwise raises \verb|Toplevel.UNDEF|. + + \item \verb|Toplevel.proof_of|~\isa{state} selects the Isar proof + state if available, otherwise raises \verb|Toplevel.UNDEF|. + + \item \verb|set Toplevel.debug| makes the toplevel print further + details about internal error conditions, exceptions being raised + etc. + + \item \verb|set Toplevel.timing| makes the toplevel print timing + information for each Isar command being executed. + + \item \verb|Toplevel.profiling|~\verb|:=|~\isa{n} controls + low-level profiling of the underlying {\ML} runtime system. For + Poly/ML, \isa{n\ {\isacharequal}\ {\isadigit{1}}} means time and \isa{n\ {\isacharequal}\ {\isadigit{2}}} space + profiling. + + \end{description}% +\end{isamarkuptext}% +\isamarkuptrue% +% +\endisatagmlref +{\isafoldmlref}% +% +\isadelimmlref +% +\endisadelimmlref +% +\isamarkupsubsection{Toplevel transitions \label{sec:toplevel-transition}% +} +\isamarkuptrue% +% +\begin{isamarkuptext}% +An Isar toplevel transition consists of a partial function on the + toplevel state, with additional information for diagnostics and + error reporting: there are fields for command name, source position, + optional source text, as well as flags for interactive-only commands + (which issue a warning in batch-mode), printing of result state, + etc. + + The operational part is represented as the sequential union of a + list of partial functions, which are tried in turn until the first + one succeeds. This acts like an outer case-expression for various + alternative state transitions. For example, \isakeyword{qed} acts + differently for a local proofs vs.\ the global ending of the main + proof. + + Toplevel transitions are composed via transition transformers. + Internally, Isar commands are put together from an empty transition + extended by name and source position (and optional source text). It + is then left to the individual command parser to turn the given + concrete syntax into a suitable transition transformer that adjoins + actual operations on a theory or proof state etc.% +\end{isamarkuptext}% +\isamarkuptrue% +% +\isadelimmlref +% +\endisadelimmlref +% +\isatagmlref +% +\begin{isamarkuptext}% +\begin{mldecls} + \indexml{Toplevel.print}\verb|Toplevel.print: Toplevel.transition -> Toplevel.transition| \\ + \indexml{Toplevel.no\_timing}\verb|Toplevel.no_timing: Toplevel.transition -> Toplevel.transition| \\ + \indexml{Toplevel.keep}\verb|Toplevel.keep: (Toplevel.state -> unit) ->|\isasep\isanewline% +\verb| Toplevel.transition -> Toplevel.transition| \\ + \indexml{Toplevel.theory}\verb|Toplevel.theory: (theory -> theory) ->|\isasep\isanewline% +\verb| Toplevel.transition -> Toplevel.transition| \\ + \indexml{Toplevel.theory\_to\_proof}\verb|Toplevel.theory_to_proof: (theory -> Proof.state) ->|\isasep\isanewline% +\verb| Toplevel.transition -> Toplevel.transition| \\ + \indexml{Toplevel.proof}\verb|Toplevel.proof: (Proof.state -> Proof.state) ->|\isasep\isanewline% +\verb| Toplevel.transition -> Toplevel.transition| \\ + \indexml{Toplevel.proofs}\verb|Toplevel.proofs: (Proof.state -> Proof.state Seq.seq) ->|\isasep\isanewline% +\verb| Toplevel.transition -> Toplevel.transition| \\ + \indexml{Toplevel.end\_proof}\verb|Toplevel.end_proof: (bool -> Proof.state -> Proof.context) ->|\isasep\isanewline% +\verb| Toplevel.transition -> Toplevel.transition| \\ + \end{mldecls} + + \begin{description} + + \item \verb|Toplevel.print|~\isa{tr} sets the print flag, which + causes the toplevel loop to echo the result state (in interactive + mode). + + \item \verb|Toplevel.no_timing|~\isa{tr} indicates that the + transition should never show timing information, e.g.\ because it is + a diagnostic command. + + \item \verb|Toplevel.keep|~\isa{tr} adjoins a diagnostic + function. + + \item \verb|Toplevel.theory|~\isa{tr} adjoins a theory + transformer. + + \item \verb|Toplevel.theory_to_proof|~\isa{tr} adjoins a global + goal function, which turns a theory into a proof state. The theory + may be changed before entering the proof; the generic Isar goal + setup includes an argument that specifies how to apply the proven + result to the theory, when the proof is finished. + + \item \verb|Toplevel.proof|~\isa{tr} adjoins a deterministic + proof command, with a singleton result. + + \item \verb|Toplevel.proofs|~\isa{tr} adjoins a general proof + command, with zero or more result states (represented as a lazy + list). + + \item \verb|Toplevel.end_proof|~\isa{tr} adjoins a concluding + proof command, that returns the resulting theory, after storing the + resulting facts in the context etc. + + \end{description}% +\end{isamarkuptext}% +\isamarkuptrue% +% +\endisatagmlref +{\isafoldmlref}% +% +\isadelimmlref +% +\endisadelimmlref +% +\isamarkupsubsection{Toplevel control% +} +\isamarkuptrue% +% +\begin{isamarkuptext}% +There are a few special control commands that modify the behavior + the toplevel itself, and only make sense in interactive mode. Under + normal circumstances, the user encounters these only implicitly as + part of the protocol between the Isabelle/Isar system and a + user-interface such as ProofGeneral. + + \begin{description} + + \item \isacommand{undo} follows the three-level hierarchy of empty + toplevel vs.\ theory vs.\ proof: undo within a proof reverts to the + previous proof context, undo after a proof reverts to the theory + before the initial goal statement, undo of a theory command reverts + to the previous theory value, undo of a theory header discontinues + the current theory development and removes it from the theory + database (\secref{sec:theory-database}). + + \item \isacommand{kill} aborts the current level of development: + kill in a proof context reverts to the theory before the initial + goal statement, kill in a theory context aborts the current theory + development, removing it from the database. + + \item \isacommand{exit} drops out of the Isar toplevel into the + underlying {\ML} toplevel (\secref{sec:ML-toplevel}). The Isar + toplevel state is preserved and may be continued later. + + \item \isacommand{quit} terminates the Isabelle/Isar process without + saving. + + \end{description}% +\end{isamarkuptext}% +\isamarkuptrue% +% +\isamarkupsection{ML toplevel \label{sec:ML-toplevel}% +} +\isamarkuptrue% +% +\begin{isamarkuptext}% +The {\ML} toplevel provides a read-compile-eval-print loop for {\ML} + values, types, structures, and functors. {\ML} declarations operate + on the global system state, which consists of the compiler + environment plus the values of {\ML} reference variables. There is + no clean way to undo {\ML} declarations, except for reverting to a + previously saved state of the whole Isabelle process. {\ML} input + is either read interactively from a TTY, or from a string (usually + within a theory text), or from a source file (usually loaded from a + theory). + + Whenever the {\ML} toplevel is active, the current Isabelle theory + context is passed as an internal reference variable. Thus {\ML} + code may access the theory context during compilation, it may even + change the value of a theory being under construction --- while + observing the usual linearity restrictions + (cf.~\secref{sec:context-theory}).% +\end{isamarkuptext}% +\isamarkuptrue% +% +\isadelimmlref +% +\endisadelimmlref +% +\isatagmlref +% +\begin{isamarkuptext}% +\begin{mldecls} + \indexml{the\_context}\verb|the_context: unit -> theory| \\ + \indexml{Context.$>$$>$ }\verb|Context.>> : (Context.generic -> Context.generic) -> unit| \\ + \end{mldecls} + + \begin{description} + + \item \verb|the_context ()| refers to the theory context of the + {\ML} toplevel --- at compile time! {\ML} code needs to take care + to refer to \verb|the_context ()| correctly. Recall that + evaluation of a function body is delayed until actual runtime. + Moreover, persistent {\ML} toplevel bindings to an unfinished theory + should be avoided: code should either project out the desired + information immediately, or produce an explicit \verb|theory_ref| (cf.\ \secref{sec:context-theory}). + + \item \verb|Context.>>|~\isa{f} applies context transformation + \isa{f} to the implicit context of the {\ML} toplevel. + + \end{description} + + It is very important to note that the above functions are really + restricted to the compile time, even though the {\ML} compiler is + invoked at runtime! The majority of {\ML} code uses explicit + functional arguments of a theory or proof context instead. Thus it + may be invoked for an arbitrary context later on, without having to + worry about any operational details. + + \bigskip + + \begin{mldecls} + \indexml{Isar.main}\verb|Isar.main: unit -> unit| \\ + \indexml{Isar.loop}\verb|Isar.loop: unit -> unit| \\ + \indexml{Isar.state}\verb|Isar.state: unit -> Toplevel.state| \\ + \indexml{Isar.exn}\verb|Isar.exn: unit -> (exn * string) option| \\ + \indexml{Isar.context}\verb|Isar.context: unit -> Proof.context| \\ + \indexml{Isar.goal}\verb|Isar.goal: unit -> thm| \\ + \end{mldecls} + + \begin{description} + + \item \verb|Isar.main ()| invokes the Isar toplevel from {\ML}, + initializing an empty toplevel state. + + \item \verb|Isar.loop ()| continues the Isar toplevel with the + current state, after having dropped out of the Isar toplevel loop. + + \item \verb|Isar.state ()| and \verb|Isar.exn ()| get current + toplevel state and error condition, respectively. This only works + after having dropped out of the Isar toplevel loop. + + \item \verb|Isar.context ()| produces the proof context from \verb|Isar.state ()|, analogous to \verb|Context.proof_of| + (\secref{sec:generic-context}). + + \item \verb|Isar.goal ()| picks the tactical goal from \verb|Isar.state ()|, represented as a theorem according to + \secref{sec:tactical-goals}. + + \end{description}% +\end{isamarkuptext}% +\isamarkuptrue% +% +\endisatagmlref +{\isafoldmlref}% +% +\isadelimmlref +% +\endisadelimmlref +% +\isamarkupsection{Theory database \label{sec:theory-database}% +} +\isamarkuptrue% +% +\begin{isamarkuptext}% +The theory database maintains a collection of theories, together + with some administrative information about their original sources, + which are held in an external store (i.e.\ some directory within the + regular file system). + + The theory database is organized as a directed acyclic graph; + entries are referenced by theory name. Although some additional + interfaces allow to include a directory specification as well, this + is only a hint to the underlying theory loader. The internal theory + name space is flat! + + Theory \isa{A} is associated with the main theory file \isa{A}\verb,.thy,, which needs to be accessible through the theory + loader path. Any number of additional {\ML} source files may be + associated with each theory, by declaring these dependencies in the + theory header as \isa{{\isasymUSES}}, and loading them consecutively + within the theory context. The system keeps track of incoming {\ML} + sources and associates them with the current theory. The file + \isa{A}\verb,.ML, is loaded after a theory has been concluded, in + order to support legacy proof {\ML} proof scripts. + + The basic internal actions of the theory database are \isa{update}, \isa{outdate}, and \isa{remove}: + + \begin{itemize} + + \item \isa{update\ A} introduces a link of \isa{A} with a + \isa{theory} value of the same name; it asserts that the theory + sources are now consistent with that value; + + \item \isa{outdate\ A} invalidates the link of a theory database + entry to its sources, but retains the present theory value; + + \item \isa{remove\ A} deletes entry \isa{A} from the theory + database. + + \end{itemize} + + These actions are propagated to sub- or super-graphs of a theory + entry as expected, in order to preserve global consistency of the + state of all loaded theories with the sources of the external store. + This implies certain causalities between actions: \isa{update} + or \isa{outdate} of an entry will \isa{outdate} all + descendants; \isa{remove} will \isa{remove} all descendants. + + \medskip There are separate user-level interfaces to operate on the + theory database directly or indirectly. The primitive actions then + just happen automatically while working with the system. In + particular, processing a theory header \isa{{\isasymTHEORY}\ A\ {\isasymIMPORTS}\ B\isactrlsub {\isadigit{1}}\ {\isasymdots}\ B\isactrlsub n\ {\isasymBEGIN}} ensures that the + sub-graph of the collective imports \isa{B\isactrlsub {\isadigit{1}}\ {\isasymdots}\ B\isactrlsub n} + is up-to-date, too. Earlier theories are reloaded as required, with + \isa{update} actions proceeding in topological order according to + theory dependencies. There may be also a wave of implied \isa{outdate} actions for derived theory nodes until a stable situation + is achieved eventually.% +\end{isamarkuptext}% +\isamarkuptrue% +% +\isadelimmlref +% +\endisadelimmlref +% +\isatagmlref +% +\begin{isamarkuptext}% +\begin{mldecls} + \indexml{theory}\verb|theory: string -> theory| \\ + \indexml{use\_thy}\verb|use_thy: string -> unit| \\ + \indexml{use\_thys}\verb|use_thys: string list -> unit| \\ + \indexml{ThyInfo.touch\_thy}\verb|ThyInfo.touch_thy: string -> unit| \\ + \indexml{ThyInfo.remove\_thy}\verb|ThyInfo.remove_thy: string -> unit| \\[1ex] + \indexml{ThyInfo.begin\_theory}\verb|ThyInfo.begin_theory|\verb|: ... -> bool -> theory| \\ + \indexml{ThyInfo.end\_theory}\verb|ThyInfo.end_theory: theory -> unit| \\ + \indexml{ThyInfo.register\_theory}\verb|ThyInfo.register_theory: theory -> unit| \\[1ex] + \verb|datatype action = Update |\verb,|,\verb| Outdate |\verb,|,\verb| Remove| \\ + \indexml{ThyInfo.add\_hook}\verb|ThyInfo.add_hook: (ThyInfo.action -> string -> unit) -> unit| \\ + \end{mldecls} + + \begin{description} + + \item \verb|theory|~\isa{A} retrieves the theory value presently + associated with name \isa{A}. Note that the result might be + outdated. + + \item \verb|use_thy|~\isa{A} ensures that theory \isa{A} is fully + up-to-date wrt.\ the external file store, reloading outdated + ancestors as required. + + \item \verb|use_thys| is similar to \verb|use_thy|, but handles + several theories simultaneously. Thus it acts like processing the + import header of a theory, without performing the merge of the + result, though. + + \item \verb|ThyInfo.touch_thy|~\isa{A} performs and \isa{outdate} action + on theory \isa{A} and all descendants. + + \item \verb|ThyInfo.remove_thy|~\isa{A} deletes theory \isa{A} and all + descendants from the theory database. + + \item \verb|ThyInfo.begin_theory| is the basic operation behind a + \isa{{\isasymTHEORY}} header declaration. This is {\ML} functions is + normally not invoked directly. + + \item \verb|ThyInfo.end_theory| concludes the loading of a theory + proper and stores the result in the theory database. + + \item \verb|ThyInfo.register_theory|~\isa{text\ thy} registers an + existing theory value with the theory loader database. There is no + management of associated sources. + + \item \verb|ThyInfo.add_hook|~\isa{f} registers function \isa{f} as a hook for theory database actions. The function will be + invoked with the action and theory name being involved; thus derived + actions may be performed in associated system components, e.g.\ + maintaining the state of an editor for the theory sources. + + The kind and order of actions occurring in practice depends both on + user interactions and the internal process of resolving theory + imports. Hooks should not rely on a particular policy here! Any + exceptions raised by the hook are ignored. + + \end{description}% +\end{isamarkuptext}% +\isamarkuptrue% +% +\endisatagmlref +{\isafoldmlref}% +% +\isadelimmlref +% +\endisadelimmlref +% +\isadelimtheory +% +\endisadelimtheory +% +\isatagtheory +\isacommand{end}\isamarkupfalse% +% +\endisatagtheory +{\isafoldtheory}% +% +\isadelimtheory +% +\endisadelimtheory +\isanewline +\end{isabellebody}% +%%% Local Variables: +%%% mode: latex +%%% TeX-master: "root" +%%% End: diff -r 419116f1157a -r e23770bc97c8 doc-src/IsarImplementation/Thy/document/Isar.tex --- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/doc-src/IsarImplementation/Thy/document/Isar.tex Thu Feb 26 08:48:33 2009 -0800 @@ -0,0 +1,86 @@ +% +\begin{isabellebody}% +\def\isabellecontext{Isar}% +% +\isadelimtheory +% +\endisadelimtheory +% +\isatagtheory +\isacommand{theory}\isamarkupfalse% +\ Isar\isanewline +\isakeyword{imports}\ Base\isanewline +\isakeyword{begin}% +\endisatagtheory +{\isafoldtheory}% +% +\isadelimtheory +% +\endisadelimtheory +% +\isamarkupchapter{Isar language elements% +} +\isamarkuptrue% +% +\begin{isamarkuptext}% +The primary Isar language consists of three main categories of + language elements: + + \begin{enumerate} + + \item Proof commands + + \item Proof methods + + \item Attributes + + \end{enumerate}% +\end{isamarkuptext}% +\isamarkuptrue% +% +\isamarkupsection{Proof commands% +} +\isamarkuptrue% +% +\begin{isamarkuptext}% +FIXME% +\end{isamarkuptext}% +\isamarkuptrue% +% +\isamarkupsection{Proof methods% +} +\isamarkuptrue% +% +\begin{isamarkuptext}% +FIXME% +\end{isamarkuptext}% +\isamarkuptrue% +% +\isamarkupsection{Attributes% +} +\isamarkuptrue% +% +\begin{isamarkuptext}% +FIXME% +\end{isamarkuptext}% +\isamarkuptrue% +% +\isadelimtheory +% +\endisadelimtheory +% +\isatagtheory +\isacommand{end}\isamarkupfalse% +% +\endisatagtheory +{\isafoldtheory}% +% +\isadelimtheory +% +\endisadelimtheory +\isanewline +\end{isabellebody}% +%%% Local Variables: +%%% mode: latex +%%% TeX-master: "root" +%%% End: diff -r 419116f1157a -r e23770bc97c8 doc-src/IsarImplementation/Thy/document/Local_Theory.tex --- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/doc-src/IsarImplementation/Thy/document/Local_Theory.tex Thu Feb 26 08:48:33 2009 -0800 @@ -0,0 +1,220 @@ +% +\begin{isabellebody}% +\def\isabellecontext{Local{\isacharunderscore}Theory}% +% +\isadelimtheory +% +\endisadelimtheory +% +\isatagtheory +\isacommand{theory}\isamarkupfalse% +\ Local{\isacharunderscore}Theory\isanewline +\isakeyword{imports}\ Base\isanewline +\isakeyword{begin}% +\endisatagtheory +{\isafoldtheory}% +% +\isadelimtheory +% +\endisadelimtheory +% +\isamarkupchapter{Local theory specifications% +} +\isamarkuptrue% +% +\begin{isamarkuptext}% +A \emph{local theory} combines aspects of both theory and proof + context (cf.\ \secref{sec:context}), such that definitional + specifications may be given relatively to parameters and + assumptions. A local theory is represented as a regular proof + context, augmented by administrative data about the \emph{target + context}. + + The target is usually derived from the background theory by adding + local \isa{{\isasymFIX}} and \isa{{\isasymASSUME}} elements, plus + suitable modifications of non-logical context data (e.g.\ a special + type-checking discipline). Once initialized, the target is ready to + absorb definitional primitives: \isa{{\isasymDEFINE}} for terms and + \isa{{\isasymNOTE}} for theorems. Such definitions may get + transformed in a target-specific way, but the programming interface + hides such details. + + Isabelle/Pure provides target mechanisms for locales, type-classes, + type-class instantiations, and general overloading. In principle, + users can implement new targets as well, but this rather arcane + discipline is beyond the scope of this manual. In contrast, + implementing derived definitional packages to be used within a local + theory context is quite easy: the interfaces are even simpler and + more abstract than the underlying primitives for raw theories. + + Many definitional packages for local theories are available in + Isabelle. Although a few old packages only work for global + theories, the local theory interface is already the standard way of + implementing definitional packages in Isabelle.% +\end{isamarkuptext}% +\isamarkuptrue% +% +\isamarkupsection{Definitional elements% +} +\isamarkuptrue% +% +\begin{isamarkuptext}% +There are separate elements \isa{{\isasymDEFINE}\ c\ {\isasymequiv}\ t} for terms, and + \isa{{\isasymNOTE}\ b\ {\isacharequal}\ thm} for theorems. Types are treated + implicitly, according to Hindley-Milner discipline (cf.\ + \secref{sec:variables}). These definitional primitives essentially + act like \isa{let}-bindings within a local context that may + already contain earlier \isa{let}-bindings and some initial + \isa{{\isasymlambda}}-bindings. Thus we gain \emph{dependent definitions} + that are relative to an initial axiomatic context. The following + diagram illustrates this idea of axiomatic elements versus + definitional elements: + + \begin{center} + \begin{tabular}{|l|l|l|} + \hline + & \isa{{\isasymlambda}}-binding & \isa{let}-binding \\ + \hline + types & fixed \isa{{\isasymalpha}} & arbitrary \isa{{\isasymbeta}} \\ + terms & \isa{{\isasymFIX}\ x\ {\isacharcolon}{\isacharcolon}\ {\isasymtau}} & \isa{{\isasymDEFINE}\ c\ {\isasymequiv}\ t} \\ + theorems & \isa{{\isasymASSUME}\ a{\isacharcolon}\ A} & \isa{{\isasymNOTE}\ b\ {\isacharequal}\ \isactrlBG B\isactrlEN } \\ + \hline + \end{tabular} + \end{center} + + A user package merely needs to produce suitable \isa{{\isasymDEFINE}} + and \isa{{\isasymNOTE}} elements according to the application. For + example, a package for inductive definitions might first \isa{{\isasymDEFINE}} a certain predicate as some fixed-point construction, + then \isa{{\isasymNOTE}} a proven result about monotonicity of the + functor involved here, and then produce further derived concepts via + additional \isa{{\isasymDEFINE}} and \isa{{\isasymNOTE}} elements. + + The cumulative sequence of \isa{{\isasymDEFINE}} and \isa{{\isasymNOTE}} + produced at package runtime is managed by the local theory + infrastructure by means of an \emph{auxiliary context}. Thus the + system holds up the impression of working within a fully abstract + situation with hypothetical entities: \isa{{\isasymDEFINE}\ c\ {\isasymequiv}\ t} + always results in a literal fact \isa{\isactrlBG c\ {\isasymequiv}\ t\isactrlEN }, where + \isa{c} is a fixed variable \isa{c}. The details about + global constants, name spaces etc. are handled internally. + + So the general structure of a local theory is a sandwich of three + layers: + + \begin{center} + \framebox{\quad auxiliary context \quad\framebox{\quad target context \quad\framebox{\quad background theory\quad}}} + \end{center} + + \noindent When a definitional package is finished, the auxiliary + context is reset to the target context. The target now holds + definitions for terms and theorems that stem from the hypothetical + \isa{{\isasymDEFINE}} and \isa{{\isasymNOTE}} elements, transformed by + the particular target policy (see + \cite[\S4--5]{Haftmann-Wenzel:2009} for details).% +\end{isamarkuptext}% +\isamarkuptrue% +% +\isadelimmlref +% +\endisadelimmlref +% +\isatagmlref +% +\begin{isamarkuptext}% +\begin{mldecls} + \indexmltype{local\_theory}\verb|type local_theory = Proof.context| \\ + \indexml{TheoryTarget.init}\verb|TheoryTarget.init: string option -> theory -> local_theory| \\[1ex] + \indexml{LocalTheory.define}\verb|LocalTheory.define: string ->|\isasep\isanewline% +\verb| (binding * mixfix) * (Attrib.binding * term) -> local_theory ->|\isasep\isanewline% +\verb| (term * (string * thm)) * local_theory| \\ + \indexml{LocalTheory.note}\verb|LocalTheory.note: string ->|\isasep\isanewline% +\verb| Attrib.binding * thm list -> local_theory ->|\isasep\isanewline% +\verb| (string * thm list) * local_theory| \\ + \end{mldecls} + + \begin{description} + + \item \verb|local_theory| represents local theories. Although + this is merely an alias for \verb|Proof.context|, it is + semantically a subtype of the same: a \verb|local_theory| holds + target information as special context data. Subtyping means that + any value \isa{lthy{\isacharcolon}}~\verb|local_theory| can be also used + with operations on expecting a regular \isa{ctxt{\isacharcolon}}~\verb|Proof.context|. + + \item \verb|TheoryTarget.init|~\isa{NONE\ thy} initializes a + trivial local theory from the given background theory. + Alternatively, \isa{SOME\ name} may be given to initialize a + \hyperlink{command.locale}{\mbox{\isa{\isacommand{locale}}}} or \hyperlink{command.class}{\mbox{\isa{\isacommand{class}}}} context (a fully-qualified + internal name is expected here). This is useful for experimentation + --- normally the Isar toplevel already takes care to initialize the + local theory context. + + \item \verb|LocalTheory.define|~\isa{kind\ {\isacharparenleft}{\isacharparenleft}b{\isacharcomma}\ mx{\isacharparenright}{\isacharcomma}\ {\isacharparenleft}a{\isacharcomma}\ rhs{\isacharparenright}{\isacharparenright}\ lthy} defines a local entity according to the specification that is + given relatively to the current \isa{lthy} context. In + particular the term of the RHS may refer to earlier local entities + from the auxiliary context, or hypothetical parameters from the + target context. The result is the newly defined term (which is + always a fixed variable with exactly the same name as specified for + the LHS), together with an equational theorem that states the + definition as a hypothetical fact. + + Unless an explicit name binding is given for the RHS, the resulting + fact will be called \isa{b{\isacharunderscore}def}. Any given attributes are + applied to that same fact --- immediately in the auxiliary context + \emph{and} in any transformed versions stemming from target-specific + policies or any later interpretations of results from the target + context (think of \hyperlink{command.locale}{\mbox{\isa{\isacommand{locale}}}} and \hyperlink{command.interpretation}{\mbox{\isa{\isacommand{interpretation}}}}, + for example). This means that attributes should be usually plain + declarations such as \hyperlink{attribute.simp}{\mbox{\isa{simp}}}, while non-trivial rules like + \hyperlink{attribute.simplified}{\mbox{\isa{simplified}}} are better avoided. + + The \isa{kind} determines the theorem kind tag of the resulting + fact. Typical examples are \verb|Thm.definitionK|, \verb|Thm.theoremK|, or \verb|Thm.internalK|. + + \item \verb|LocalTheory.note|~\isa{kind\ {\isacharparenleft}a{\isacharcomma}\ ths{\isacharparenright}\ lthy} is + analogous to \verb|LocalTheory.define|, but defines facts instead of + terms. There is also a slightly more general variant \verb|LocalTheory.notes| that defines several facts (with attribute + expressions) simultaneously. + + This is essentially the internal version of the \hyperlink{command.lemmas}{\mbox{\isa{\isacommand{lemmas}}}} + command, or \hyperlink{command.declare}{\mbox{\isa{\isacommand{declare}}}} if an empty name binding is given. + + \end{description}% +\end{isamarkuptext}% +\isamarkuptrue% +% +\endisatagmlref +{\isafoldmlref}% +% +\isadelimmlref +% +\endisadelimmlref +% +\isamarkupsection{Morphisms and declarations% +} +\isamarkuptrue% +% +\begin{isamarkuptext}% +FIXME% +\end{isamarkuptext}% +\isamarkuptrue% +% +\isadelimtheory +% +\endisadelimtheory +% +\isatagtheory +\isacommand{end}\isamarkupfalse% +% +\endisatagtheory +{\isafoldtheory}% +% +\isadelimtheory +% +\endisadelimtheory +\isanewline +\end{isabellebody}% +%%% Local Variables: +%%% mode: latex +%%% TeX-master: "root" +%%% End: diff -r 419116f1157a -r e23770bc97c8 doc-src/IsarImplementation/Thy/document/Logic.tex --- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/doc-src/IsarImplementation/Thy/document/Logic.tex Thu Feb 26 08:48:33 2009 -0800 @@ -0,0 +1,959 @@ +% +\begin{isabellebody}% +\def\isabellecontext{Logic}% +% +\isadelimtheory +% +\endisadelimtheory +% +\isatagtheory +\isacommand{theory}\isamarkupfalse% +\ Logic\isanewline +\isakeyword{imports}\ Base\isanewline +\isakeyword{begin}% +\endisatagtheory +{\isafoldtheory}% +% +\isadelimtheory +% +\endisadelimtheory +% +\isamarkupchapter{Primitive logic \label{ch:logic}% +} +\isamarkuptrue% +% +\begin{isamarkuptext}% +The logical foundations of Isabelle/Isar are that of the Pure logic, + which has been introduced as a Natural Deduction framework in + \cite{paulson700}. This is essentially the same logic as ``\isa{{\isasymlambda}HOL}'' in the more abstract setting of Pure Type Systems (PTS) + \cite{Barendregt-Geuvers:2001}, although there are some key + differences in the specific treatment of simple types in + Isabelle/Pure. + + Following type-theoretic parlance, the Pure logic consists of three + levels of \isa{{\isasymlambda}}-calculus with corresponding arrows, \isa{{\isasymRightarrow}} for syntactic function space (terms depending on terms), \isa{{\isasymAnd}} for universal quantification (proofs depending on terms), and + \isa{{\isasymLongrightarrow}} for implication (proofs depending on proofs). + + Derivations are relative to a logical theory, which declares type + constructors, constants, and axioms. Theory declarations support + schematic polymorphism, which is strictly speaking outside the + logic.\footnote{This is the deeper logical reason, why the theory + context \isa{{\isasymTheta}} is separate from the proof context \isa{{\isasymGamma}} + of the core calculus.}% +\end{isamarkuptext}% +\isamarkuptrue% +% +\isamarkupsection{Types \label{sec:types}% +} +\isamarkuptrue% +% +\begin{isamarkuptext}% +The language of types is an uninterpreted order-sorted first-order + algebra; types are qualified by ordered type classes. + + \medskip A \emph{type class} is an abstract syntactic entity + declared in the theory context. The \emph{subclass relation} \isa{c\isactrlisub {\isadigit{1}}\ {\isasymsubseteq}\ c\isactrlisub {\isadigit{2}}} is specified by stating an acyclic + generating relation; the transitive closure is maintained + internally. The resulting relation is an ordering: reflexive, + transitive, and antisymmetric. + + A \emph{sort} is a list of type classes written as \isa{s\ {\isacharequal}\ {\isacharbraceleft}c\isactrlisub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ c\isactrlisub m{\isacharbraceright}}, which represents symbolic + intersection. Notationally, the curly braces are omitted for + singleton intersections, i.e.\ any class \isa{c} may be read as + a sort \isa{{\isacharbraceleft}c{\isacharbraceright}}. The ordering on type classes is extended to + sorts according to the meaning of intersections: \isa{{\isacharbraceleft}c\isactrlisub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}\ c\isactrlisub m{\isacharbraceright}\ {\isasymsubseteq}\ {\isacharbraceleft}d\isactrlisub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ d\isactrlisub n{\isacharbraceright}} iff + \isa{{\isasymforall}j{\isachardot}\ {\isasymexists}i{\isachardot}\ c\isactrlisub i\ {\isasymsubseteq}\ d\isactrlisub j}. The empty intersection + \isa{{\isacharbraceleft}{\isacharbraceright}} refers to the universal sort, which is the largest + element wrt.\ the sort order. The intersections of all (finitely + many) classes declared in the current theory are the minimal + elements wrt.\ the sort order. + + \medskip A \emph{fixed type variable} is a pair of a basic name + (starting with a \isa{{\isacharprime}} character) and a sort constraint, e.g.\ + \isa{{\isacharparenleft}{\isacharprime}a{\isacharcomma}\ s{\isacharparenright}} which is usually printed as \isa{{\isasymalpha}\isactrlisub s}. + A \emph{schematic type variable} is a pair of an indexname and a + sort constraint, e.g.\ \isa{{\isacharparenleft}{\isacharparenleft}{\isacharprime}a{\isacharcomma}\ {\isadigit{0}}{\isacharparenright}{\isacharcomma}\ s{\isacharparenright}} which is usually + printed as \isa{{\isacharquery}{\isasymalpha}\isactrlisub s}. + + Note that \emph{all} syntactic components contribute to the identity + of type variables, including the sort constraint. The core logic + handles type variables with the same name but different sorts as + different, although some outer layers of the system make it hard to + produce anything like this. + + A \emph{type constructor} \isa{{\isasymkappa}} is a \isa{k}-ary operator + on types declared in the theory. Type constructor application is + written postfix as \isa{{\isacharparenleft}{\isasymalpha}\isactrlisub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ {\isasymalpha}\isactrlisub k{\isacharparenright}{\isasymkappa}}. For + \isa{k\ {\isacharequal}\ {\isadigit{0}}} the argument tuple is omitted, e.g.\ \isa{prop} + instead of \isa{{\isacharparenleft}{\isacharparenright}prop}. For \isa{k\ {\isacharequal}\ {\isadigit{1}}} the parentheses + are omitted, e.g.\ \isa{{\isasymalpha}\ list} instead of \isa{{\isacharparenleft}{\isasymalpha}{\isacharparenright}list}. + Further notation is provided for specific constructors, notably the + right-associative infix \isa{{\isasymalpha}\ {\isasymRightarrow}\ {\isasymbeta}} instead of \isa{{\isacharparenleft}{\isasymalpha}{\isacharcomma}\ {\isasymbeta}{\isacharparenright}fun}. + + A \emph{type} is defined inductively over type variables and type + constructors as follows: \isa{{\isasymtau}\ {\isacharequal}\ {\isasymalpha}\isactrlisub s\ {\isacharbar}\ {\isacharquery}{\isasymalpha}\isactrlisub s\ {\isacharbar}\ {\isacharparenleft}{\isasymtau}\isactrlsub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ {\isasymtau}\isactrlsub k{\isacharparenright}{\isasymkappa}}. + + A \emph{type abbreviation} is a syntactic definition \isa{{\isacharparenleft}\isactrlvec {\isasymalpha}{\isacharparenright}{\isasymkappa}\ {\isacharequal}\ {\isasymtau}} of an arbitrary type expression \isa{{\isasymtau}} over + variables \isa{\isactrlvec {\isasymalpha}}. Type abbreviations appear as type + constructors in the syntax, but are expanded before entering the + logical core. + + A \emph{type arity} declares the image behavior of a type + constructor wrt.\ the algebra of sorts: \isa{{\isasymkappa}\ {\isacharcolon}{\isacharcolon}\ {\isacharparenleft}s\isactrlisub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ s\isactrlisub k{\isacharparenright}s} means that \isa{{\isacharparenleft}{\isasymtau}\isactrlisub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ {\isasymtau}\isactrlisub k{\isacharparenright}{\isasymkappa}} is + of sort \isa{s} if every argument type \isa{{\isasymtau}\isactrlisub i} is + of sort \isa{s\isactrlisub i}. Arity declarations are implicitly + completed, i.e.\ \isa{{\isasymkappa}\ {\isacharcolon}{\isacharcolon}\ {\isacharparenleft}\isactrlvec s{\isacharparenright}c} entails \isa{{\isasymkappa}\ {\isacharcolon}{\isacharcolon}\ {\isacharparenleft}\isactrlvec s{\isacharparenright}c{\isacharprime}} for any \isa{c{\isacharprime}\ {\isasymsupseteq}\ c}. + + \medskip The sort algebra is always maintained as \emph{coregular}, + which means that type arities are consistent with the subclass + relation: for any type constructor \isa{{\isasymkappa}}, and classes \isa{c\isactrlisub {\isadigit{1}}\ {\isasymsubseteq}\ c\isactrlisub {\isadigit{2}}}, and arities \isa{{\isasymkappa}\ {\isacharcolon}{\isacharcolon}\ {\isacharparenleft}\isactrlvec s\isactrlisub {\isadigit{1}}{\isacharparenright}c\isactrlisub {\isadigit{1}}} and \isa{{\isasymkappa}\ {\isacharcolon}{\isacharcolon}\ {\isacharparenleft}\isactrlvec s\isactrlisub {\isadigit{2}}{\isacharparenright}c\isactrlisub {\isadigit{2}}} holds \isa{\isactrlvec s\isactrlisub {\isadigit{1}}\ {\isasymsubseteq}\ \isactrlvec s\isactrlisub {\isadigit{2}}} component-wise. + + The key property of a coregular order-sorted algebra is that sort + constraints can be solved in a most general fashion: for each type + constructor \isa{{\isasymkappa}} and sort \isa{s} there is a most general + vector of argument sorts \isa{{\isacharparenleft}s\isactrlisub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ s\isactrlisub k{\isacharparenright}} such + that a type scheme \isa{{\isacharparenleft}{\isasymalpha}\isactrlbsub s\isactrlisub {\isadigit{1}}\isactrlesub {\isacharcomma}\ {\isasymdots}{\isacharcomma}\ {\isasymalpha}\isactrlbsub s\isactrlisub k\isactrlesub {\isacharparenright}{\isasymkappa}} is of sort \isa{s}. + Consequently, type unification has most general solutions (modulo + equivalence of sorts), so type-inference produces primary types as + expected \cite{nipkow-prehofer}.% +\end{isamarkuptext}% +\isamarkuptrue% +% +\isadelimmlref +% +\endisadelimmlref +% +\isatagmlref +% +\begin{isamarkuptext}% +\begin{mldecls} + \indexmltype{class}\verb|type class| \\ + \indexmltype{sort}\verb|type sort| \\ + \indexmltype{arity}\verb|type arity| \\ + \indexmltype{typ}\verb|type typ| \\ + \indexml{map\_atyps}\verb|map_atyps: (typ -> typ) -> typ -> typ| \\ + \indexml{fold\_atyps}\verb|fold_atyps: (typ -> 'a -> 'a) -> typ -> 'a -> 'a| \\ + \end{mldecls} + \begin{mldecls} + \indexml{Sign.subsort}\verb|Sign.subsort: theory -> sort * sort -> bool| \\ + \indexml{Sign.of\_sort}\verb|Sign.of_sort: theory -> typ * sort -> bool| \\ + \indexml{Sign.add\_types}\verb|Sign.add_types: (string * int * mixfix) list -> theory -> theory| \\ + \indexml{Sign.add\_tyabbrs\_i}\verb|Sign.add_tyabbrs_i: |\isasep\isanewline% +\verb| (string * string list * typ * mixfix) list -> theory -> theory| \\ + \indexml{Sign.primitive\_class}\verb|Sign.primitive_class: string * class list -> theory -> theory| \\ + \indexml{Sign.primitive\_classrel}\verb|Sign.primitive_classrel: class * class -> theory -> theory| \\ + \indexml{Sign.primitive\_arity}\verb|Sign.primitive_arity: arity -> theory -> theory| \\ + \end{mldecls} + + \begin{description} + + \item \verb|class| represents type classes; this is an alias for + \verb|string|. + + \item \verb|sort| represents sorts; this is an alias for + \verb|class list|. + + \item \verb|arity| represents type arities; this is an alias for + triples of the form \isa{{\isacharparenleft}{\isasymkappa}{\isacharcomma}\ \isactrlvec s{\isacharcomma}\ s{\isacharparenright}} for \isa{{\isasymkappa}\ {\isacharcolon}{\isacharcolon}\ {\isacharparenleft}\isactrlvec s{\isacharparenright}s} described above. + + \item \verb|typ| represents types; this is a datatype with + constructors \verb|TFree|, \verb|TVar|, \verb|Type|. + + \item \verb|map_atyps|~\isa{f\ {\isasymtau}} applies the mapping \isa{f} + to all atomic types (\verb|TFree|, \verb|TVar|) occurring in \isa{{\isasymtau}}. + + \item \verb|fold_atyps|~\isa{f\ {\isasymtau}} iterates the operation \isa{f} over all occurrences of atomic types (\verb|TFree|, \verb|TVar|) + in \isa{{\isasymtau}}; the type structure is traversed from left to right. + + \item \verb|Sign.subsort|~\isa{thy\ {\isacharparenleft}s\isactrlisub {\isadigit{1}}{\isacharcomma}\ s\isactrlisub {\isadigit{2}}{\isacharparenright}} + tests the subsort relation \isa{s\isactrlisub {\isadigit{1}}\ {\isasymsubseteq}\ s\isactrlisub {\isadigit{2}}}. + + \item \verb|Sign.of_sort|~\isa{thy\ {\isacharparenleft}{\isasymtau}{\isacharcomma}\ s{\isacharparenright}} tests whether type + \isa{{\isasymtau}} is of sort \isa{s}. + + \item \verb|Sign.add_types|~\isa{{\isacharbrackleft}{\isacharparenleft}{\isasymkappa}{\isacharcomma}\ k{\isacharcomma}\ mx{\isacharparenright}{\isacharcomma}\ {\isasymdots}{\isacharbrackright}} declares a new + type constructors \isa{{\isasymkappa}} with \isa{k} arguments and + optional mixfix syntax. + + \item \verb|Sign.add_tyabbrs_i|~\isa{{\isacharbrackleft}{\isacharparenleft}{\isasymkappa}{\isacharcomma}\ \isactrlvec {\isasymalpha}{\isacharcomma}\ {\isasymtau}{\isacharcomma}\ mx{\isacharparenright}{\isacharcomma}\ {\isasymdots}{\isacharbrackright}} + defines a new type abbreviation \isa{{\isacharparenleft}\isactrlvec {\isasymalpha}{\isacharparenright}{\isasymkappa}\ {\isacharequal}\ {\isasymtau}} with + optional mixfix syntax. + + \item \verb|Sign.primitive_class|~\isa{{\isacharparenleft}c{\isacharcomma}\ {\isacharbrackleft}c\isactrlisub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ c\isactrlisub n{\isacharbrackright}{\isacharparenright}} declares a new class \isa{c}, together with class + relations \isa{c\ {\isasymsubseteq}\ c\isactrlisub i}, for \isa{i\ {\isacharequal}\ {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ n}. + + \item \verb|Sign.primitive_classrel|~\isa{{\isacharparenleft}c\isactrlisub {\isadigit{1}}{\isacharcomma}\ c\isactrlisub {\isadigit{2}}{\isacharparenright}} declares the class relation \isa{c\isactrlisub {\isadigit{1}}\ {\isasymsubseteq}\ c\isactrlisub {\isadigit{2}}}. + + \item \verb|Sign.primitive_arity|~\isa{{\isacharparenleft}{\isasymkappa}{\isacharcomma}\ \isactrlvec s{\isacharcomma}\ s{\isacharparenright}} declares + the arity \isa{{\isasymkappa}\ {\isacharcolon}{\isacharcolon}\ {\isacharparenleft}\isactrlvec s{\isacharparenright}s}. + + \end{description}% +\end{isamarkuptext}% +\isamarkuptrue% +% +\endisatagmlref +{\isafoldmlref}% +% +\isadelimmlref +% +\endisadelimmlref +% +\isamarkupsection{Terms \label{sec:terms}% +} +\isamarkuptrue% +% +\begin{isamarkuptext}% +The language of terms is that of simply-typed \isa{{\isasymlambda}}-calculus + with de-Bruijn indices for bound variables (cf.\ \cite{debruijn72} + or \cite{paulson-ml2}), with the types being determined by the + corresponding binders. In contrast, free variables and constants + are have an explicit name and type in each occurrence. + + \medskip A \emph{bound variable} is a natural number \isa{b}, + which accounts for the number of intermediate binders between the + variable occurrence in the body and its binding position. For + example, the de-Bruijn term \isa{{\isasymlambda}\isactrlbsub nat\isactrlesub {\isachardot}\ {\isasymlambda}\isactrlbsub nat\isactrlesub {\isachardot}\ {\isadigit{1}}\ {\isacharplus}\ {\isadigit{0}}} would + correspond to \isa{{\isasymlambda}x\isactrlbsub nat\isactrlesub {\isachardot}\ {\isasymlambda}y\isactrlbsub nat\isactrlesub {\isachardot}\ x\ {\isacharplus}\ y} in a named + representation. Note that a bound variable may be represented by + different de-Bruijn indices at different occurrences, depending on + the nesting of abstractions. + + A \emph{loose variable} is a bound variable that is outside the + scope of local binders. The types (and names) for loose variables + can be managed as a separate context, that is maintained as a stack + of hypothetical binders. The core logic operates on closed terms, + without any loose variables. + + A \emph{fixed variable} is a pair of a basic name and a type, e.g.\ + \isa{{\isacharparenleft}x{\isacharcomma}\ {\isasymtau}{\isacharparenright}} which is usually printed \isa{x\isactrlisub {\isasymtau}}. A + \emph{schematic variable} is a pair of an indexname and a type, + e.g.\ \isa{{\isacharparenleft}{\isacharparenleft}x{\isacharcomma}\ {\isadigit{0}}{\isacharparenright}{\isacharcomma}\ {\isasymtau}{\isacharparenright}} which is usually printed as \isa{{\isacharquery}x\isactrlisub {\isasymtau}}. + + \medskip A \emph{constant} is a pair of a basic name and a type, + e.g.\ \isa{{\isacharparenleft}c{\isacharcomma}\ {\isasymtau}{\isacharparenright}} which is usually printed as \isa{c\isactrlisub {\isasymtau}}. Constants are declared in the context as polymorphic + families \isa{c\ {\isacharcolon}{\isacharcolon}\ {\isasymsigma}}, meaning that all substitution instances + \isa{c\isactrlisub {\isasymtau}} for \isa{{\isasymtau}\ {\isacharequal}\ {\isasymsigma}{\isasymvartheta}} are valid. + + The vector of \emph{type arguments} of constant \isa{c\isactrlisub {\isasymtau}} + wrt.\ the declaration \isa{c\ {\isacharcolon}{\isacharcolon}\ {\isasymsigma}} is defined as the codomain of + the matcher \isa{{\isasymvartheta}\ {\isacharequal}\ {\isacharbraceleft}{\isacharquery}{\isasymalpha}\isactrlisub {\isadigit{1}}\ {\isasymmapsto}\ {\isasymtau}\isactrlisub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ {\isacharquery}{\isasymalpha}\isactrlisub n\ {\isasymmapsto}\ {\isasymtau}\isactrlisub n{\isacharbraceright}} presented in canonical order \isa{{\isacharparenleft}{\isasymtau}\isactrlisub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ {\isasymtau}\isactrlisub n{\isacharparenright}}. Within a given theory context, + there is a one-to-one correspondence between any constant \isa{c\isactrlisub {\isasymtau}} and the application \isa{c{\isacharparenleft}{\isasymtau}\isactrlisub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ {\isasymtau}\isactrlisub n{\isacharparenright}} of its type arguments. For example, with \isa{plus\ {\isacharcolon}{\isacharcolon}\ {\isasymalpha}\ {\isasymRightarrow}\ {\isasymalpha}\ {\isasymRightarrow}\ {\isasymalpha}}, the instance \isa{plus\isactrlbsub nat\ {\isasymRightarrow}\ nat\ {\isasymRightarrow}\ nat\isactrlesub } corresponds to \isa{plus{\isacharparenleft}nat{\isacharparenright}}. + + Constant declarations \isa{c\ {\isacharcolon}{\isacharcolon}\ {\isasymsigma}} may contain sort constraints + for type variables in \isa{{\isasymsigma}}. These are observed by + type-inference as expected, but \emph{ignored} by the core logic. + This means the primitive logic is able to reason with instances of + polymorphic constants that the user-level type-checker would reject + due to violation of type class restrictions. + + \medskip An \emph{atomic} term is either a variable or constant. A + \emph{term} is defined inductively over atomic terms, with + abstraction and application as follows: \isa{t\ {\isacharequal}\ b\ {\isacharbar}\ x\isactrlisub {\isasymtau}\ {\isacharbar}\ {\isacharquery}x\isactrlisub {\isasymtau}\ {\isacharbar}\ c\isactrlisub {\isasymtau}\ {\isacharbar}\ {\isasymlambda}\isactrlisub {\isasymtau}{\isachardot}\ t\ {\isacharbar}\ t\isactrlisub {\isadigit{1}}\ t\isactrlisub {\isadigit{2}}}. + Parsing and printing takes care of converting between an external + representation with named bound variables. Subsequently, we shall + use the latter notation instead of internal de-Bruijn + representation. + + The inductive relation \isa{t\ {\isacharcolon}{\isacharcolon}\ {\isasymtau}} assigns a (unique) type to a + term according to the structure of atomic terms, abstractions, and + applicatins: + \[ + \infer{\isa{a\isactrlisub {\isasymtau}\ {\isacharcolon}{\isacharcolon}\ {\isasymtau}}}{} + \qquad + \infer{\isa{{\isacharparenleft}{\isasymlambda}x\isactrlsub {\isasymtau}{\isachardot}\ t{\isacharparenright}\ {\isacharcolon}{\isacharcolon}\ {\isasymtau}\ {\isasymRightarrow}\ {\isasymsigma}}}{\isa{t\ {\isacharcolon}{\isacharcolon}\ {\isasymsigma}}} + \qquad + \infer{\isa{t\ u\ {\isacharcolon}{\isacharcolon}\ {\isasymsigma}}}{\isa{t\ {\isacharcolon}{\isacharcolon}\ {\isasymtau}\ {\isasymRightarrow}\ {\isasymsigma}} & \isa{u\ {\isacharcolon}{\isacharcolon}\ {\isasymtau}}} + \] + A \emph{well-typed term} is a term that can be typed according to these rules. + + Typing information can be omitted: type-inference is able to + reconstruct the most general type of a raw term, while assigning + most general types to all of its variables and constants. + Type-inference depends on a context of type constraints for fixed + variables, and declarations for polymorphic constants. + + The identity of atomic terms consists both of the name and the type + component. This means that different variables \isa{x\isactrlbsub {\isasymtau}\isactrlisub {\isadigit{1}}\isactrlesub } and \isa{x\isactrlbsub {\isasymtau}\isactrlisub {\isadigit{2}}\isactrlesub } may become the same after type + instantiation. Some outer layers of the system make it hard to + produce variables of the same name, but different types. In + contrast, mixed instances of polymorphic constants occur frequently. + + \medskip The \emph{hidden polymorphism} of a term \isa{t\ {\isacharcolon}{\isacharcolon}\ {\isasymsigma}} + is the set of type variables occurring in \isa{t}, but not in + \isa{{\isasymsigma}}. This means that the term implicitly depends on type + arguments that are not accounted in the result type, i.e.\ there are + different type instances \isa{t{\isasymvartheta}\ {\isacharcolon}{\isacharcolon}\ {\isasymsigma}} and \isa{t{\isasymvartheta}{\isacharprime}\ {\isacharcolon}{\isacharcolon}\ {\isasymsigma}} with the same type. This slightly + pathological situation notoriously demands additional care. + + \medskip A \emph{term abbreviation} is a syntactic definition \isa{c\isactrlisub {\isasymsigma}\ {\isasymequiv}\ t} of a closed term \isa{t} of type \isa{{\isasymsigma}}, + without any hidden polymorphism. A term abbreviation looks like a + constant in the syntax, but is expanded before entering the logical + core. Abbreviations are usually reverted when printing terms, using + \isa{t\ {\isasymrightarrow}\ c\isactrlisub {\isasymsigma}} as rules for higher-order rewriting. + + \medskip Canonical operations on \isa{{\isasymlambda}}-terms include \isa{{\isasymalpha}{\isasymbeta}{\isasymeta}}-conversion: \isa{{\isasymalpha}}-conversion refers to capture-free + renaming of bound variables; \isa{{\isasymbeta}}-conversion contracts an + abstraction applied to an argument term, substituting the argument + in the body: \isa{{\isacharparenleft}{\isasymlambda}x{\isachardot}\ b{\isacharparenright}a} becomes \isa{b{\isacharbrackleft}a{\isacharslash}x{\isacharbrackright}}; \isa{{\isasymeta}}-conversion contracts vacuous application-abstraction: \isa{{\isasymlambda}x{\isachardot}\ f\ x} becomes \isa{f}, provided that the bound variable + does not occur in \isa{f}. + + Terms are normally treated modulo \isa{{\isasymalpha}}-conversion, which is + implicit in the de-Bruijn representation. Names for bound variables + in abstractions are maintained separately as (meaningless) comments, + mostly for parsing and printing. Full \isa{{\isasymalpha}{\isasymbeta}{\isasymeta}}-conversion is + commonplace in various standard operations (\secref{sec:obj-rules}) + that are based on higher-order unification and matching.% +\end{isamarkuptext}% +\isamarkuptrue% +% +\isadelimmlref +% +\endisadelimmlref +% +\isatagmlref +% +\begin{isamarkuptext}% +\begin{mldecls} + \indexmltype{term}\verb|type term| \\ + \indexml{op aconv}\verb|op aconv: term * term -> bool| \\ + \indexml{map\_types}\verb|map_types: (typ -> typ) -> term -> term| \\ + \indexml{fold\_types}\verb|fold_types: (typ -> 'a -> 'a) -> term -> 'a -> 'a| \\ + \indexml{map\_aterms}\verb|map_aterms: (term -> term) -> term -> term| \\ + \indexml{fold\_aterms}\verb|fold_aterms: (term -> 'a -> 'a) -> term -> 'a -> 'a| \\ + \end{mldecls} + \begin{mldecls} + \indexml{fastype\_of}\verb|fastype_of: term -> typ| \\ + \indexml{lambda}\verb|lambda: term -> term -> term| \\ + \indexml{betapply}\verb|betapply: term * term -> term| \\ + \indexml{Sign.declare\_const}\verb|Sign.declare_const: Properties.T -> (binding * typ) * mixfix ->|\isasep\isanewline% +\verb| theory -> term * theory| \\ + \indexml{Sign.add\_abbrev}\verb|Sign.add_abbrev: string -> Properties.T -> binding * term ->|\isasep\isanewline% +\verb| theory -> (term * term) * theory| \\ + \indexml{Sign.const\_typargs}\verb|Sign.const_typargs: theory -> string * typ -> typ list| \\ + \indexml{Sign.const\_instance}\verb|Sign.const_instance: theory -> string * typ list -> typ| \\ + \end{mldecls} + + \begin{description} + + \item \verb|term| represents de-Bruijn terms, with comments in + abstractions, and explicitly named free variables and constants; + this is a datatype with constructors \verb|Bound|, \verb|Free|, \verb|Var|, \verb|Const|, \verb|Abs|, \verb|op $|. + + \item \isa{t}~\verb|aconv|~\isa{u} checks \isa{{\isasymalpha}}-equivalence of two terms. This is the basic equality relation + on type \verb|term|; raw datatype equality should only be used + for operations related to parsing or printing! + + \item \verb|map_types|~\isa{f\ t} applies the mapping \isa{f} to all types occurring in \isa{t}. + + \item \verb|fold_types|~\isa{f\ t} iterates the operation \isa{f} over all occurrences of types in \isa{t}; the term + structure is traversed from left to right. + + \item \verb|map_aterms|~\isa{f\ t} applies the mapping \isa{f} + to all atomic terms (\verb|Bound|, \verb|Free|, \verb|Var|, \verb|Const|) occurring in \isa{t}. + + \item \verb|fold_aterms|~\isa{f\ t} iterates the operation \isa{f} over all occurrences of atomic terms (\verb|Bound|, \verb|Free|, + \verb|Var|, \verb|Const|) in \isa{t}; the term structure is + traversed from left to right. + + \item \verb|fastype_of|~\isa{t} determines the type of a + well-typed term. This operation is relatively slow, despite the + omission of any sanity checks. + + \item \verb|lambda|~\isa{a\ b} produces an abstraction \isa{{\isasymlambda}a{\isachardot}\ b}, where occurrences of the atomic term \isa{a} in the + body \isa{b} are replaced by bound variables. + + \item \verb|betapply|~\isa{{\isacharparenleft}t{\isacharcomma}\ u{\isacharparenright}} produces an application \isa{t\ u}, with topmost \isa{{\isasymbeta}}-conversion if \isa{t} is an + abstraction. + + \item \verb|Sign.declare_const|~\isa{properties\ {\isacharparenleft}{\isacharparenleft}c{\isacharcomma}\ {\isasymsigma}{\isacharparenright}{\isacharcomma}\ mx{\isacharparenright}} + declares a new constant \isa{c\ {\isacharcolon}{\isacharcolon}\ {\isasymsigma}} with optional mixfix + syntax. + + \item \verb|Sign.add_abbrev|~\isa{print{\isacharunderscore}mode\ properties\ {\isacharparenleft}c{\isacharcomma}\ t{\isacharparenright}} + introduces a new term abbreviation \isa{c\ {\isasymequiv}\ t}. + + \item \verb|Sign.const_typargs|~\isa{thy\ {\isacharparenleft}c{\isacharcomma}\ {\isasymtau}{\isacharparenright}} and \verb|Sign.const_instance|~\isa{thy\ {\isacharparenleft}c{\isacharcomma}\ {\isacharbrackleft}{\isasymtau}\isactrlisub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ {\isasymtau}\isactrlisub n{\isacharbrackright}{\isacharparenright}} + convert between two representations of polymorphic constants: full + type instance vs.\ compact type arguments form. + + \end{description}% +\end{isamarkuptext}% +\isamarkuptrue% +% +\endisatagmlref +{\isafoldmlref}% +% +\isadelimmlref +% +\endisadelimmlref +% +\isamarkupsection{Theorems \label{sec:thms}% +} +\isamarkuptrue% +% +\begin{isamarkuptext}% +A \emph{proposition} is a well-typed term of type \isa{prop}, a + \emph{theorem} is a proven proposition (depending on a context of + hypotheses and the background theory). Primitive inferences include + plain Natural Deduction rules for the primary connectives \isa{{\isasymAnd}} and \isa{{\isasymLongrightarrow}} of the framework. There is also a builtin + notion of equality/equivalence \isa{{\isasymequiv}}.% +\end{isamarkuptext}% +\isamarkuptrue% +% +\isamarkupsubsection{Primitive connectives and rules \label{sec:prim-rules}% +} +\isamarkuptrue% +% +\begin{isamarkuptext}% +The theory \isa{Pure} contains constant declarations for the + primitive connectives \isa{{\isasymAnd}}, \isa{{\isasymLongrightarrow}}, and \isa{{\isasymequiv}} of + the logical framework, see \figref{fig:pure-connectives}. The + derivability judgment \isa{A\isactrlisub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ A\isactrlisub n\ {\isasymturnstile}\ B} is + defined inductively by the primitive inferences given in + \figref{fig:prim-rules}, with the global restriction that the + hypotheses must \emph{not} contain any schematic variables. The + builtin equality is conceptually axiomatized as shown in + \figref{fig:pure-equality}, although the implementation works + directly with derived inferences. + + \begin{figure}[htb] + \begin{center} + \begin{tabular}{ll} + \isa{all\ {\isacharcolon}{\isacharcolon}\ {\isacharparenleft}{\isasymalpha}\ {\isasymRightarrow}\ prop{\isacharparenright}\ {\isasymRightarrow}\ prop} & universal quantification (binder \isa{{\isasymAnd}}) \\ + \isa{{\isasymLongrightarrow}\ {\isacharcolon}{\isacharcolon}\ prop\ {\isasymRightarrow}\ prop\ {\isasymRightarrow}\ prop} & implication (right associative infix) \\ + \isa{{\isasymequiv}\ {\isacharcolon}{\isacharcolon}\ {\isasymalpha}\ {\isasymRightarrow}\ {\isasymalpha}\ {\isasymRightarrow}\ prop} & equality relation (infix) \\ + \end{tabular} + \caption{Primitive connectives of Pure}\label{fig:pure-connectives} + \end{center} + \end{figure} + + \begin{figure}[htb] + \begin{center} + \[ + \infer[\isa{{\isacharparenleft}axiom{\isacharparenright}}]{\isa{{\isasymturnstile}\ A}}{\isa{A\ {\isasymin}\ {\isasymTheta}}} + \qquad + \infer[\isa{{\isacharparenleft}assume{\isacharparenright}}]{\isa{A\ {\isasymturnstile}\ A}}{} + \] + \[ + \infer[\isa{{\isacharparenleft}{\isasymAnd}{\isacharunderscore}intro{\isacharparenright}}]{\isa{{\isasymGamma}\ {\isasymturnstile}\ {\isasymAnd}x{\isachardot}\ b{\isacharbrackleft}x{\isacharbrackright}}}{\isa{{\isasymGamma}\ {\isasymturnstile}\ b{\isacharbrackleft}x{\isacharbrackright}} & \isa{x\ {\isasymnotin}\ {\isasymGamma}}} + \qquad + \infer[\isa{{\isacharparenleft}{\isasymAnd}{\isacharunderscore}elim{\isacharparenright}}]{\isa{{\isasymGamma}\ {\isasymturnstile}\ b{\isacharbrackleft}a{\isacharbrackright}}}{\isa{{\isasymGamma}\ {\isasymturnstile}\ {\isasymAnd}x{\isachardot}\ b{\isacharbrackleft}x{\isacharbrackright}}} + \] + \[ + \infer[\isa{{\isacharparenleft}{\isasymLongrightarrow}{\isacharunderscore}intro{\isacharparenright}}]{\isa{{\isasymGamma}\ {\isacharminus}\ A\ {\isasymturnstile}\ A\ {\isasymLongrightarrow}\ B}}{\isa{{\isasymGamma}\ {\isasymturnstile}\ B}} + \qquad + \infer[\isa{{\isacharparenleft}{\isasymLongrightarrow}{\isacharunderscore}elim{\isacharparenright}}]{\isa{{\isasymGamma}\isactrlsub {\isadigit{1}}\ {\isasymunion}\ {\isasymGamma}\isactrlsub {\isadigit{2}}\ {\isasymturnstile}\ B}}{\isa{{\isasymGamma}\isactrlsub {\isadigit{1}}\ {\isasymturnstile}\ A\ {\isasymLongrightarrow}\ B} & \isa{{\isasymGamma}\isactrlsub {\isadigit{2}}\ {\isasymturnstile}\ A}} + \] + \caption{Primitive inferences of Pure}\label{fig:prim-rules} + \end{center} + \end{figure} + + \begin{figure}[htb] + \begin{center} + \begin{tabular}{ll} + \isa{{\isasymturnstile}\ {\isacharparenleft}{\isasymlambda}x{\isachardot}\ b{\isacharbrackleft}x{\isacharbrackright}{\isacharparenright}\ a\ {\isasymequiv}\ b{\isacharbrackleft}a{\isacharbrackright}} & \isa{{\isasymbeta}}-conversion \\ + \isa{{\isasymturnstile}\ x\ {\isasymequiv}\ x} & reflexivity \\ + \isa{{\isasymturnstile}\ x\ {\isasymequiv}\ y\ {\isasymLongrightarrow}\ P\ x\ {\isasymLongrightarrow}\ P\ y} & substitution \\ + \isa{{\isasymturnstile}\ {\isacharparenleft}{\isasymAnd}x{\isachardot}\ f\ x\ {\isasymequiv}\ g\ x{\isacharparenright}\ {\isasymLongrightarrow}\ f\ {\isasymequiv}\ g} & extensionality \\ + \isa{{\isasymturnstile}\ {\isacharparenleft}A\ {\isasymLongrightarrow}\ B{\isacharparenright}\ {\isasymLongrightarrow}\ {\isacharparenleft}B\ {\isasymLongrightarrow}\ A{\isacharparenright}\ {\isasymLongrightarrow}\ A\ {\isasymequiv}\ B} & logical equivalence \\ + \end{tabular} + \caption{Conceptual axiomatization of Pure equality}\label{fig:pure-equality} + \end{center} + \end{figure} + + The introduction and elimination rules for \isa{{\isasymAnd}} and \isa{{\isasymLongrightarrow}} are analogous to formation of dependently typed \isa{{\isasymlambda}}-terms representing the underlying proof objects. Proof terms + are irrelevant in the Pure logic, though; they cannot occur within + propositions. The system provides a runtime option to record + explicit proof terms for primitive inferences. Thus all three + levels of \isa{{\isasymlambda}}-calculus become explicit: \isa{{\isasymRightarrow}} for + terms, and \isa{{\isasymAnd}{\isacharslash}{\isasymLongrightarrow}} for proofs (cf.\ + \cite{Berghofer-Nipkow:2000:TPHOL}). + + Observe that locally fixed parameters (as in \isa{{\isasymAnd}{\isacharunderscore}intro}) need + not be recorded in the hypotheses, because the simple syntactic + types of Pure are always inhabitable. ``Assumptions'' \isa{x\ {\isacharcolon}{\isacharcolon}\ {\isasymtau}} for type-membership are only present as long as some \isa{x\isactrlisub {\isasymtau}} occurs in the statement body.\footnote{This is the key + difference to ``\isa{{\isasymlambda}HOL}'' in the PTS framework + \cite{Barendregt-Geuvers:2001}, where hypotheses \isa{x\ {\isacharcolon}\ A} are + treated uniformly for propositions and types.} + + \medskip The axiomatization of a theory is implicitly closed by + forming all instances of type and term variables: \isa{{\isasymturnstile}\ A{\isasymvartheta}} holds for any substitution instance of an axiom + \isa{{\isasymturnstile}\ A}. By pushing substitutions through derivations + inductively, we also get admissible \isa{generalize} and \isa{instance} rules as shown in \figref{fig:subst-rules}. + + \begin{figure}[htb] + \begin{center} + \[ + \infer{\isa{{\isasymGamma}\ {\isasymturnstile}\ B{\isacharbrackleft}{\isacharquery}{\isasymalpha}{\isacharbrackright}}}{\isa{{\isasymGamma}\ {\isasymturnstile}\ B{\isacharbrackleft}{\isasymalpha}{\isacharbrackright}} & \isa{{\isasymalpha}\ {\isasymnotin}\ {\isasymGamma}}} + \quad + \infer[\quad\isa{{\isacharparenleft}generalize{\isacharparenright}}]{\isa{{\isasymGamma}\ {\isasymturnstile}\ B{\isacharbrackleft}{\isacharquery}x{\isacharbrackright}}}{\isa{{\isasymGamma}\ {\isasymturnstile}\ B{\isacharbrackleft}x{\isacharbrackright}} & \isa{x\ {\isasymnotin}\ {\isasymGamma}}} + \] + \[ + \infer{\isa{{\isasymGamma}\ {\isasymturnstile}\ B{\isacharbrackleft}{\isasymtau}{\isacharbrackright}}}{\isa{{\isasymGamma}\ {\isasymturnstile}\ B{\isacharbrackleft}{\isacharquery}{\isasymalpha}{\isacharbrackright}}} + \quad + \infer[\quad\isa{{\isacharparenleft}instantiate{\isacharparenright}}]{\isa{{\isasymGamma}\ {\isasymturnstile}\ B{\isacharbrackleft}t{\isacharbrackright}}}{\isa{{\isasymGamma}\ {\isasymturnstile}\ B{\isacharbrackleft}{\isacharquery}x{\isacharbrackright}}} + \] + \caption{Admissible substitution rules}\label{fig:subst-rules} + \end{center} + \end{figure} + + Note that \isa{instantiate} does not require an explicit + side-condition, because \isa{{\isasymGamma}} may never contain schematic + variables. + + In principle, variables could be substituted in hypotheses as well, + but this would disrupt the monotonicity of reasoning: deriving + \isa{{\isasymGamma}{\isasymvartheta}\ {\isasymturnstile}\ B{\isasymvartheta}} from \isa{{\isasymGamma}\ {\isasymturnstile}\ B} is + correct, but \isa{{\isasymGamma}{\isasymvartheta}\ {\isasymsupseteq}\ {\isasymGamma}} does not necessarily hold: + the result belongs to a different proof context. + + \medskip An \emph{oracle} is a function that produces axioms on the + fly. Logically, this is an instance of the \isa{axiom} rule + (\figref{fig:prim-rules}), but there is an operational difference. + The system always records oracle invocations within derivations of + theorems by a unique tag. + + Axiomatizations should be limited to the bare minimum, typically as + part of the initial logical basis of an object-logic formalization. + Later on, theories are usually developed in a strictly definitional + fashion, by stating only certain equalities over new constants. + + A \emph{simple definition} consists of a constant declaration \isa{c\ {\isacharcolon}{\isacharcolon}\ {\isasymsigma}} together with an axiom \isa{{\isasymturnstile}\ c\ {\isasymequiv}\ t}, where \isa{t\ {\isacharcolon}{\isacharcolon}\ {\isasymsigma}} is a closed term without any hidden polymorphism. The RHS + may depend on further defined constants, but not \isa{c} itself. + Definitions of functions may be presented as \isa{c\ \isactrlvec x\ {\isasymequiv}\ t} instead of the puristic \isa{c\ {\isasymequiv}\ {\isasymlambda}\isactrlvec x{\isachardot}\ t}. + + An \emph{overloaded definition} consists of a collection of axioms + for the same constant, with zero or one equations \isa{c{\isacharparenleft}{\isacharparenleft}\isactrlvec {\isasymalpha}{\isacharparenright}{\isasymkappa}{\isacharparenright}\ {\isasymequiv}\ t} for each type constructor \isa{{\isasymkappa}} (for + distinct variables \isa{\isactrlvec {\isasymalpha}}). The RHS may mention + previously defined constants as above, or arbitrary constants \isa{d{\isacharparenleft}{\isasymalpha}\isactrlisub i{\isacharparenright}} for some \isa{{\isasymalpha}\isactrlisub i} projected from \isa{\isactrlvec {\isasymalpha}}. Thus overloaded definitions essentially work by + primitive recursion over the syntactic structure of a single type + argument.% +\end{isamarkuptext}% +\isamarkuptrue% +% +\isadelimmlref +% +\endisadelimmlref +% +\isatagmlref +% +\begin{isamarkuptext}% +\begin{mldecls} + \indexmltype{ctyp}\verb|type ctyp| \\ + \indexmltype{cterm}\verb|type cterm| \\ + \indexml{Thm.ctyp\_of}\verb|Thm.ctyp_of: theory -> typ -> ctyp| \\ + \indexml{Thm.cterm\_of}\verb|Thm.cterm_of: theory -> term -> cterm| \\ + \end{mldecls} + \begin{mldecls} + \indexmltype{thm}\verb|type thm| \\ + \indexml{proofs}\verb|proofs: int ref| \\ + \indexml{Thm.assume}\verb|Thm.assume: cterm -> thm| \\ + \indexml{Thm.forall\_intr}\verb|Thm.forall_intr: cterm -> thm -> thm| \\ + \indexml{Thm.forall\_elim}\verb|Thm.forall_elim: cterm -> thm -> thm| \\ + \indexml{Thm.implies\_intr}\verb|Thm.implies_intr: cterm -> thm -> thm| \\ + \indexml{Thm.implies\_elim}\verb|Thm.implies_elim: thm -> thm -> thm| \\ + \indexml{Thm.generalize}\verb|Thm.generalize: string list * string list -> int -> thm -> thm| \\ + \indexml{Thm.instantiate}\verb|Thm.instantiate: (ctyp * ctyp) list * (cterm * cterm) list -> thm -> thm| \\ + \indexml{Thm.axiom}\verb|Thm.axiom: theory -> string -> thm| \\ + \indexml{Thm.add\_oracle}\verb|Thm.add_oracle: bstring * ('a -> cterm) -> theory|\isasep\isanewline% +\verb| -> (string * ('a -> thm)) * theory| \\ + \end{mldecls} + \begin{mldecls} + \indexml{Theory.add\_axioms\_i}\verb|Theory.add_axioms_i: (binding * term) list -> theory -> theory| \\ + \indexml{Theory.add\_deps}\verb|Theory.add_deps: string -> string * typ -> (string * typ) list -> theory -> theory| \\ + \indexml{Theory.add\_defs\_i}\verb|Theory.add_defs_i: bool -> bool -> (binding * term) list -> theory -> theory| \\ + \end{mldecls} + + \begin{description} + + \item \verb|ctyp| and \verb|cterm| represent certified types + and terms, respectively. These are abstract datatypes that + guarantee that its values have passed the full well-formedness (and + well-typedness) checks, relative to the declarations of type + constructors, constants etc. in the theory. + + \item \verb|Thm.ctyp_of|~\isa{thy\ {\isasymtau}} and \verb|Thm.cterm_of|~\isa{thy\ t} explicitly checks types and terms, + respectively. This also involves some basic normalizations, such + expansion of type and term abbreviations from the theory context. + + Re-certification is relatively slow and should be avoided in tight + reasoning loops. There are separate operations to decompose + certified entities (including actual theorems). + + \item \verb|thm| represents proven propositions. This is an + abstract datatype that guarantees that its values have been + constructed by basic principles of the \verb|Thm| module. + Every \verb|thm| value contains a sliding back-reference to the + enclosing theory, cf.\ \secref{sec:context-theory}. + + \item \verb|proofs| determines the detail of proof recording within + \verb|thm| values: \verb|0| records only the names of oracles, + \verb|1| records oracle names and propositions, \verb|2| additionally + records full proof terms. Officially named theorems that contribute + to a result are always recorded. + + \item \verb|Thm.assume|, \verb|Thm.forall_intr|, \verb|Thm.forall_elim|, \verb|Thm.implies_intr|, and \verb|Thm.implies_elim| + correspond to the primitive inferences of \figref{fig:prim-rules}. + + \item \verb|Thm.generalize|~\isa{{\isacharparenleft}\isactrlvec {\isasymalpha}{\isacharcomma}\ \isactrlvec x{\isacharparenright}} + corresponds to the \isa{generalize} rules of + \figref{fig:subst-rules}. Here collections of type and term + variables are generalized simultaneously, specified by the given + basic names. + + \item \verb|Thm.instantiate|~\isa{{\isacharparenleft}\isactrlvec {\isasymalpha}\isactrlisub s{\isacharcomma}\ \isactrlvec x\isactrlisub {\isasymtau}{\isacharparenright}} corresponds to the \isa{instantiate} rules + of \figref{fig:subst-rules}. Type variables are substituted before + term variables. Note that the types in \isa{\isactrlvec x\isactrlisub {\isasymtau}} + refer to the instantiated versions. + + \item \verb|Thm.axiom|~\isa{thy\ name} retrieves a named + axiom, cf.\ \isa{axiom} in \figref{fig:prim-rules}. + + \item \verb|Thm.add_oracle|~\isa{{\isacharparenleft}name{\isacharcomma}\ oracle{\isacharparenright}} produces a named + oracle rule, essentially generating arbitrary axioms on the fly, + cf.\ \isa{axiom} in \figref{fig:prim-rules}. + + \item \verb|Theory.add_axioms_i|~\isa{{\isacharbrackleft}{\isacharparenleft}name{\isacharcomma}\ A{\isacharparenright}{\isacharcomma}\ {\isasymdots}{\isacharbrackright}} declares + arbitrary propositions as axioms. + + \item \verb|Theory.add_deps|~\isa{name\ c\isactrlisub {\isasymtau}\ \isactrlvec d\isactrlisub {\isasymsigma}} declares dependencies of a named specification + for constant \isa{c\isactrlisub {\isasymtau}}, relative to existing + specifications for constants \isa{\isactrlvec d\isactrlisub {\isasymsigma}}. + + \item \verb|Theory.add_defs_i|~\isa{unchecked\ overloaded\ {\isacharbrackleft}{\isacharparenleft}name{\isacharcomma}\ c\ \isactrlvec x\ {\isasymequiv}\ t{\isacharparenright}{\isacharcomma}\ {\isasymdots}{\isacharbrackright}} states a definitional axiom for an existing + constant \isa{c}. Dependencies are recorded (cf.\ \verb|Theory.add_deps|), unless the \isa{unchecked} option is set. + + \end{description}% +\end{isamarkuptext}% +\isamarkuptrue% +% +\endisatagmlref +{\isafoldmlref}% +% +\isadelimmlref +% +\endisadelimmlref +% +\isamarkupsubsection{Auxiliary definitions% +} +\isamarkuptrue% +% +\begin{isamarkuptext}% +Theory \isa{Pure} provides a few auxiliary definitions, see + \figref{fig:pure-aux}. These special constants are normally not + exposed to the user, but appear in internal encodings. + + \begin{figure}[htb] + \begin{center} + \begin{tabular}{ll} + \isa{conjunction\ {\isacharcolon}{\isacharcolon}\ prop\ {\isasymRightarrow}\ prop\ {\isasymRightarrow}\ prop} & (infix \isa{{\isacharampersand}}) \\ + \isa{{\isasymturnstile}\ A\ {\isacharampersand}\ B\ {\isasymequiv}\ {\isacharparenleft}{\isasymAnd}C{\isachardot}\ {\isacharparenleft}A\ {\isasymLongrightarrow}\ B\ {\isasymLongrightarrow}\ C{\isacharparenright}\ {\isasymLongrightarrow}\ C{\isacharparenright}} \\[1ex] + \isa{prop\ {\isacharcolon}{\isacharcolon}\ prop\ {\isasymRightarrow}\ prop} & (prefix \isa{{\isacharhash}}, suppressed) \\ + \isa{{\isacharhash}A\ {\isasymequiv}\ A} \\[1ex] + \isa{term\ {\isacharcolon}{\isacharcolon}\ {\isasymalpha}\ {\isasymRightarrow}\ prop} & (prefix \isa{TERM}) \\ + \isa{term\ x\ {\isasymequiv}\ {\isacharparenleft}{\isasymAnd}A{\isachardot}\ A\ {\isasymLongrightarrow}\ A{\isacharparenright}} \\[1ex] + \isa{TYPE\ {\isacharcolon}{\isacharcolon}\ {\isasymalpha}\ itself} & (prefix \isa{TYPE}) \\ + \isa{{\isacharparenleft}unspecified{\isacharparenright}} \\ + \end{tabular} + \caption{Definitions of auxiliary connectives}\label{fig:pure-aux} + \end{center} + \end{figure} + + Derived conjunction rules include introduction \isa{A\ {\isasymLongrightarrow}\ B\ {\isasymLongrightarrow}\ A\ {\isacharampersand}\ B}, and destructions \isa{A\ {\isacharampersand}\ B\ {\isasymLongrightarrow}\ A} and \isa{A\ {\isacharampersand}\ B\ {\isasymLongrightarrow}\ B}. + Conjunction allows to treat simultaneous assumptions and conclusions + uniformly. For example, multiple claims are intermediately + represented as explicit conjunction, but this is refined into + separate sub-goals before the user continues the proof; the final + result is projected into a list of theorems (cf.\ + \secref{sec:tactical-goals}). + + The \isa{prop} marker (\isa{{\isacharhash}}) makes arbitrarily complex + propositions appear as atomic, without changing the meaning: \isa{{\isasymGamma}\ {\isasymturnstile}\ A} and \isa{{\isasymGamma}\ {\isasymturnstile}\ {\isacharhash}A} are interchangeable. See + \secref{sec:tactical-goals} for specific operations. + + The \isa{term} marker turns any well-typed term into a derivable + proposition: \isa{{\isasymturnstile}\ TERM\ t} holds unconditionally. Although + this is logically vacuous, it allows to treat terms and proofs + uniformly, similar to a type-theoretic framework. + + The \isa{TYPE} constructor is the canonical representative of + the unspecified type \isa{{\isasymalpha}\ itself}; it essentially injects the + language of types into that of terms. There is specific notation + \isa{TYPE{\isacharparenleft}{\isasymtau}{\isacharparenright}} for \isa{TYPE\isactrlbsub {\isasymtau}\ itself\isactrlesub }. + Although being devoid of any particular meaning, the \isa{TYPE{\isacharparenleft}{\isasymtau}{\isacharparenright}} accounts for the type \isa{{\isasymtau}} within the term + language. In particular, \isa{TYPE{\isacharparenleft}{\isasymalpha}{\isacharparenright}} may be used as formal + argument in primitive definitions, in order to circumvent hidden + polymorphism (cf.\ \secref{sec:terms}). For example, \isa{c\ TYPE{\isacharparenleft}{\isasymalpha}{\isacharparenright}\ {\isasymequiv}\ A{\isacharbrackleft}{\isasymalpha}{\isacharbrackright}} defines \isa{c\ {\isacharcolon}{\isacharcolon}\ {\isasymalpha}\ itself\ {\isasymRightarrow}\ prop} in terms of + a proposition \isa{A} that depends on an additional type + argument, which is essentially a predicate on types.% +\end{isamarkuptext}% +\isamarkuptrue% +% +\isadelimmlref +% +\endisadelimmlref +% +\isatagmlref +% +\begin{isamarkuptext}% +\begin{mldecls} + \indexml{Conjunction.intr}\verb|Conjunction.intr: thm -> thm -> thm| \\ + \indexml{Conjunction.elim}\verb|Conjunction.elim: thm -> thm * thm| \\ + \indexml{Drule.mk\_term}\verb|Drule.mk_term: cterm -> thm| \\ + \indexml{Drule.dest\_term}\verb|Drule.dest_term: thm -> cterm| \\ + \indexml{Logic.mk\_type}\verb|Logic.mk_type: typ -> term| \\ + \indexml{Logic.dest\_type}\verb|Logic.dest_type: term -> typ| \\ + \end{mldecls} + + \begin{description} + + \item \verb|Conjunction.intr| derives \isa{A\ {\isacharampersand}\ B} from \isa{A} and \isa{B}. + + \item \verb|Conjunction.elim| derives \isa{A} and \isa{B} + from \isa{A\ {\isacharampersand}\ B}. + + \item \verb|Drule.mk_term| derives \isa{TERM\ t}. + + \item \verb|Drule.dest_term| recovers term \isa{t} from \isa{TERM\ t}. + + \item \verb|Logic.mk_type|~\isa{{\isasymtau}} produces the term \isa{TYPE{\isacharparenleft}{\isasymtau}{\isacharparenright}}. + + \item \verb|Logic.dest_type|~\isa{TYPE{\isacharparenleft}{\isasymtau}{\isacharparenright}} recovers the type + \isa{{\isasymtau}}. + + \end{description}% +\end{isamarkuptext}% +\isamarkuptrue% +% +\endisatagmlref +{\isafoldmlref}% +% +\isadelimmlref +% +\endisadelimmlref +% +\isamarkupsection{Object-level rules \label{sec:obj-rules}% +} +\isamarkuptrue% +% +\begin{isamarkuptext}% +The primitive inferences covered so far mostly serve foundational + purposes. User-level reasoning usually works via object-level rules + that are represented as theorems of Pure. Composition of rules + involves \emph{backchaining}, \emph{higher-order unification} modulo + \isa{{\isasymalpha}{\isasymbeta}{\isasymeta}}-conversion of \isa{{\isasymlambda}}-terms, and so-called + \emph{lifting} of rules into a context of \isa{{\isasymAnd}} and \isa{{\isasymLongrightarrow}} connectives. Thus the full power of higher-order Natural + Deduction in Isabelle/Pure becomes readily available.% +\end{isamarkuptext}% +\isamarkuptrue% +% +\isamarkupsubsection{Hereditary Harrop Formulae% +} +\isamarkuptrue% +% +\begin{isamarkuptext}% +The idea of object-level rules is to model Natural Deduction + inferences in the style of Gentzen \cite{Gentzen:1935}, but we allow + arbitrary nesting similar to \cite{extensions91}. The most basic + rule format is that of a \emph{Horn Clause}: + \[ + \infer{\isa{A}}{\isa{A\isactrlsub {\isadigit{1}}} & \isa{{\isasymdots}} & \isa{A\isactrlsub n}} + \] + where \isa{A{\isacharcomma}\ A\isactrlsub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ A\isactrlsub n} are atomic propositions + of the framework, usually of the form \isa{Trueprop\ B}, where + \isa{B} is a (compound) object-level statement. This + object-level inference corresponds to an iterated implication in + Pure like this: + \[ + \isa{A\isactrlsub {\isadigit{1}}\ {\isasymLongrightarrow}\ {\isasymdots}\ A\isactrlsub n\ {\isasymLongrightarrow}\ A} + \] + As an example consider conjunction introduction: \isa{A\ {\isasymLongrightarrow}\ B\ {\isasymLongrightarrow}\ A\ {\isasymand}\ B}. Any parameters occurring in such rule statements are + conceptionally treated as arbitrary: + \[ + \isa{{\isasymAnd}x\isactrlsub {\isadigit{1}}\ {\isasymdots}\ x\isactrlsub m{\isachardot}\ A\isactrlsub {\isadigit{1}}\ x\isactrlsub {\isadigit{1}}\ {\isasymdots}\ x\isactrlsub m\ {\isasymLongrightarrow}\ {\isasymdots}\ A\isactrlsub n\ x\isactrlsub {\isadigit{1}}\ {\isasymdots}\ x\isactrlsub m\ {\isasymLongrightarrow}\ A\ x\isactrlsub {\isadigit{1}}\ {\isasymdots}\ x\isactrlsub m} + \] + + Nesting of rules means that the positions of \isa{A\isactrlsub i} may + again hold compound rules, not just atomic propositions. + Propositions of this format are called \emph{Hereditary Harrop + Formulae} in the literature \cite{Miller:1991}. Here we give an + inductive characterization as follows: + + \medskip + \begin{tabular}{ll} + \isa{\isactrlbold x} & set of variables \\ + \isa{\isactrlbold A} & set of atomic propositions \\ + \isa{\isactrlbold H\ \ {\isacharequal}\ \ {\isasymAnd}\isactrlbold x\isactrlsup {\isacharasterisk}{\isachardot}\ \isactrlbold H\isactrlsup {\isacharasterisk}\ {\isasymLongrightarrow}\ \isactrlbold A} & set of Hereditary Harrop Formulas \\ + \end{tabular} + \medskip + + \noindent Thus we essentially impose nesting levels on propositions + formed from \isa{{\isasymAnd}} and \isa{{\isasymLongrightarrow}}. At each level there is a + prefix of parameters and compound premises, concluding an atomic + proposition. Typical examples are \isa{{\isasymlongrightarrow}}-introduction \isa{{\isacharparenleft}A\ {\isasymLongrightarrow}\ B{\isacharparenright}\ {\isasymLongrightarrow}\ A\ {\isasymlongrightarrow}\ B} or mathematical induction \isa{P\ {\isadigit{0}}\ {\isasymLongrightarrow}\ {\isacharparenleft}{\isasymAnd}n{\isachardot}\ P\ n\ {\isasymLongrightarrow}\ P\ {\isacharparenleft}Suc\ n{\isacharparenright}{\isacharparenright}\ {\isasymLongrightarrow}\ P\ n}. Even deeper nesting occurs in well-founded + induction \isa{{\isacharparenleft}{\isasymAnd}x{\isachardot}\ {\isacharparenleft}{\isasymAnd}y{\isachardot}\ y\ {\isasymprec}\ x\ {\isasymLongrightarrow}\ P\ y{\isacharparenright}\ {\isasymLongrightarrow}\ P\ x{\isacharparenright}\ {\isasymLongrightarrow}\ P\ x}, but this + already marks the limit of rule complexity seen in practice. + + \medskip Regular user-level inferences in Isabelle/Pure always + maintain the following canonical form of results: + + \begin{itemize} + + \item Normalization by \isa{{\isacharparenleft}A\ {\isasymLongrightarrow}\ {\isacharparenleft}{\isasymAnd}x{\isachardot}\ B\ x{\isacharparenright}{\isacharparenright}\ {\isasymequiv}\ {\isacharparenleft}{\isasymAnd}x{\isachardot}\ A\ {\isasymLongrightarrow}\ B\ x{\isacharparenright}}, + which is a theorem of Pure, means that quantifiers are pushed in + front of implication at each level of nesting. The normal form is a + Hereditary Harrop Formula. + + \item The outermost prefix of parameters is represented via + schematic variables: instead of \isa{{\isasymAnd}\isactrlvec x{\isachardot}\ \isactrlvec H\ \isactrlvec x\ {\isasymLongrightarrow}\ A\ \isactrlvec x} we have \isa{\isactrlvec H\ {\isacharquery}\isactrlvec x\ {\isasymLongrightarrow}\ A\ {\isacharquery}\isactrlvec x}. + Note that this representation looses information about the order of + parameters, and vacuous quantifiers vanish automatically. + + \end{itemize}% +\end{isamarkuptext}% +\isamarkuptrue% +% +\isadelimmlref +% +\endisadelimmlref +% +\isatagmlref +% +\begin{isamarkuptext}% +\begin{mldecls} + \indexml{MetaSimplifier.norm\_hhf}\verb|MetaSimplifier.norm_hhf: thm -> thm| \\ + \end{mldecls} + + \begin{description} + + \item \verb|MetaSimplifier.norm_hhf|~\isa{thm} normalizes the given + theorem according to the canonical form specified above. This is + occasionally helpful to repair some low-level tools that do not + handle Hereditary Harrop Formulae properly. + + \end{description}% +\end{isamarkuptext}% +\isamarkuptrue% +% +\endisatagmlref +{\isafoldmlref}% +% +\isadelimmlref +% +\endisadelimmlref +% +\isamarkupsubsection{Rule composition% +} +\isamarkuptrue% +% +\begin{isamarkuptext}% +The rule calculus of Isabelle/Pure provides two main inferences: + \hyperlink{inference.resolution}{\mbox{\isa{resolution}}} (i.e.\ back-chaining of rules) and + \hyperlink{inference.assumption}{\mbox{\isa{assumption}}} (i.e.\ closing a branch), both modulo + higher-order unification. There are also combined variants, notably + \hyperlink{inference.elim-resolution}{\mbox{\isa{elim{\isacharunderscore}resolution}}} and \hyperlink{inference.dest-resolution}{\mbox{\isa{dest{\isacharunderscore}resolution}}}. + + To understand the all-important \hyperlink{inference.resolution}{\mbox{\isa{resolution}}} principle, + we first consider raw \indexdef{}{inference}{composition}\hypertarget{inference.composition}{\hyperlink{inference.composition}{\mbox{\isa{composition}}}} (modulo + higher-order unification with substitution \isa{{\isasymvartheta}}): + \[ + \infer[(\indexdef{}{inference}{composition}\hypertarget{inference.composition}{\hyperlink{inference.composition}{\mbox{\isa{composition}}}})]{\isa{\isactrlvec A{\isasymvartheta}\ {\isasymLongrightarrow}\ C{\isasymvartheta}}} + {\isa{\isactrlvec A\ {\isasymLongrightarrow}\ B} & \isa{B{\isacharprime}\ {\isasymLongrightarrow}\ C} & \isa{B{\isasymvartheta}\ {\isacharequal}\ B{\isacharprime}{\isasymvartheta}}} + \] + Here the conclusion of the first rule is unified with the premise of + the second; the resulting rule instance inherits the premises of the + first and conclusion of the second. Note that \isa{C} can again + consist of iterated implications. We can also permute the premises + of the second rule back-and-forth in order to compose with \isa{B{\isacharprime}} in any position (subsequently we shall always refer to + position 1 w.l.o.g.). + + In \hyperlink{inference.composition}{\mbox{\isa{composition}}} the internal structure of the common + part \isa{B} and \isa{B{\isacharprime}} is not taken into account. For + proper \hyperlink{inference.resolution}{\mbox{\isa{resolution}}} we require \isa{B} to be atomic, + and explicitly observe the structure \isa{{\isasymAnd}\isactrlvec x{\isachardot}\ \isactrlvec H\ \isactrlvec x\ {\isasymLongrightarrow}\ B{\isacharprime}\ \isactrlvec x} of the premise of the second rule. The + idea is to adapt the first rule by ``lifting'' it into this context, + by means of iterated application of the following inferences: + \[ + \infer[(\indexdef{}{inference}{imp\_lift}\hypertarget{inference.imp-lift}{\hyperlink{inference.imp-lift}{\mbox{\isa{imp{\isacharunderscore}lift}}}})]{\isa{{\isacharparenleft}\isactrlvec H\ {\isasymLongrightarrow}\ \isactrlvec A{\isacharparenright}\ {\isasymLongrightarrow}\ {\isacharparenleft}\isactrlvec H\ {\isasymLongrightarrow}\ B{\isacharparenright}}}{\isa{\isactrlvec A\ {\isasymLongrightarrow}\ B}} + \] + \[ + \infer[(\indexdef{}{inference}{all\_lift}\hypertarget{inference.all-lift}{\hyperlink{inference.all-lift}{\mbox{\isa{all{\isacharunderscore}lift}}}})]{\isa{{\isacharparenleft}{\isasymAnd}\isactrlvec x{\isachardot}\ \isactrlvec A\ {\isacharparenleft}{\isacharquery}\isactrlvec a\ \isactrlvec x{\isacharparenright}{\isacharparenright}\ {\isasymLongrightarrow}\ {\isacharparenleft}{\isasymAnd}\isactrlvec x{\isachardot}\ B\ {\isacharparenleft}{\isacharquery}\isactrlvec a\ \isactrlvec x{\isacharparenright}{\isacharparenright}}}{\isa{\isactrlvec A\ {\isacharquery}\isactrlvec a\ {\isasymLongrightarrow}\ B\ {\isacharquery}\isactrlvec a}} + \] + By combining raw composition with lifting, we get full \hyperlink{inference.resolution}{\mbox{\isa{resolution}}} as follows: + \[ + \infer[(\indexdef{}{inference}{resolution}\hypertarget{inference.resolution}{\hyperlink{inference.resolution}{\mbox{\isa{resolution}}}})] + {\isa{{\isacharparenleft}{\isasymAnd}\isactrlvec x{\isachardot}\ \isactrlvec H\ \isactrlvec x\ {\isasymLongrightarrow}\ \isactrlvec A\ {\isacharparenleft}{\isacharquery}\isactrlvec a\ \isactrlvec x{\isacharparenright}{\isacharparenright}{\isasymvartheta}\ {\isasymLongrightarrow}\ C{\isasymvartheta}}} + {\begin{tabular}{l} + \isa{\isactrlvec A\ {\isacharquery}\isactrlvec a\ {\isasymLongrightarrow}\ B\ {\isacharquery}\isactrlvec a} \\ + \isa{{\isacharparenleft}{\isasymAnd}\isactrlvec x{\isachardot}\ \isactrlvec H\ \isactrlvec x\ {\isasymLongrightarrow}\ B{\isacharprime}\ \isactrlvec x{\isacharparenright}\ {\isasymLongrightarrow}\ C} \\ + \isa{{\isacharparenleft}{\isasymlambda}\isactrlvec x{\isachardot}\ B\ {\isacharparenleft}{\isacharquery}\isactrlvec a\ \isactrlvec x{\isacharparenright}{\isacharparenright}{\isasymvartheta}\ {\isacharequal}\ B{\isacharprime}{\isasymvartheta}} \\ + \end{tabular}} + \] + + Continued resolution of rules allows to back-chain a problem towards + more and sub-problems. Branches are closed either by resolving with + a rule of 0 premises, or by producing a ``short-circuit'' within a + solved situation (again modulo unification): + \[ + \infer[(\indexdef{}{inference}{assumption}\hypertarget{inference.assumption}{\hyperlink{inference.assumption}{\mbox{\isa{assumption}}}})]{\isa{C{\isasymvartheta}}} + {\isa{{\isacharparenleft}{\isasymAnd}\isactrlvec x{\isachardot}\ \isactrlvec H\ \isactrlvec x\ {\isasymLongrightarrow}\ A\ \isactrlvec x{\isacharparenright}\ {\isasymLongrightarrow}\ C} & \isa{A{\isasymvartheta}\ {\isacharequal}\ H\isactrlsub i{\isasymvartheta}}~~\text{(for some~\isa{i})}} + \] + + FIXME \indexdef{}{inference}{elim\_resolution}\hypertarget{inference.elim-resolution}{\hyperlink{inference.elim-resolution}{\mbox{\isa{elim{\isacharunderscore}resolution}}}}, \indexdef{}{inference}{dest\_resolution}\hypertarget{inference.dest-resolution}{\hyperlink{inference.dest-resolution}{\mbox{\isa{dest{\isacharunderscore}resolution}}}}% +\end{isamarkuptext}% +\isamarkuptrue% +% +\isadelimmlref +% +\endisadelimmlref +% +\isatagmlref +% +\begin{isamarkuptext}% +\begin{mldecls} + \indexml{op RS}\verb|op RS: thm * thm -> thm| \\ + \indexml{op OF}\verb|op OF: thm * thm list -> thm| \\ + \end{mldecls} + + \begin{description} + + \item \isa{rule\isactrlsub {\isadigit{1}}\ RS\ rule\isactrlsub {\isadigit{2}}} resolves \isa{rule\isactrlsub {\isadigit{1}}} with \isa{rule\isactrlsub {\isadigit{2}}} according to the + \hyperlink{inference.resolution}{\mbox{\isa{resolution}}} principle explained above. Note that the + corresponding attribute in the Isar language is called \hyperlink{attribute.THEN}{\mbox{\isa{THEN}}}. + + \item \isa{rule\ OF\ rules} resolves a list of rules with the + first rule, addressing its premises \isa{{\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ length\ rules} + (operating from last to first). This means the newly emerging + premises are all concatenated, without interfering. Also note that + compared to \isa{RS}, the rule argument order is swapped: \isa{rule\isactrlsub {\isadigit{1}}\ RS\ rule\isactrlsub {\isadigit{2}}\ {\isacharequal}\ rule\isactrlsub {\isadigit{2}}\ OF\ {\isacharbrackleft}rule\isactrlsub {\isadigit{1}}{\isacharbrackright}}. + + \end{description}% +\end{isamarkuptext}% +\isamarkuptrue% +% +\endisatagmlref +{\isafoldmlref}% +% +\isadelimmlref +% +\endisadelimmlref +% +\isadelimtheory +% +\endisadelimtheory +% +\isatagtheory +\isacommand{end}\isamarkupfalse% +% +\endisatagtheory +{\isafoldtheory}% +% +\isadelimtheory +% +\endisadelimtheory +\isanewline +\end{isabellebody}% +%%% Local Variables: +%%% mode: latex +%%% TeX-master: "root" +%%% End: diff -r 419116f1157a -r e23770bc97c8 doc-src/IsarImplementation/Thy/document/ML.tex --- a/doc-src/IsarImplementation/Thy/document/ML.tex Thu Feb 26 08:44:44 2009 -0800 +++ b/doc-src/IsarImplementation/Thy/document/ML.tex Thu Feb 26 08:48:33 2009 -0800 @@ -3,14 +3,14 @@ \def\isabellecontext{ML}% % \isadelimtheory -\isanewline -\isanewline % \endisadelimtheory % \isatagtheory \isacommand{theory}\isamarkupfalse% -\ {\isachardoublequoteopen}ML{\isachardoublequoteclose}\ \isakeyword{imports}\ base\ \isakeyword{begin}% +\ {\isachardoublequoteopen}ML{\isachardoublequoteclose}\isanewline +\isakeyword{imports}\ Base\isanewline +\isakeyword{begin}% \endisatagtheory {\isafoldtheory}% % diff -r 419116f1157a -r e23770bc97c8 doc-src/IsarImplementation/Thy/document/Prelim.tex --- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/doc-src/IsarImplementation/Thy/document/Prelim.tex Thu Feb 26 08:48:33 2009 -0800 @@ -0,0 +1,896 @@ +% +\begin{isabellebody}% +\def\isabellecontext{Prelim}% +% +\isadelimtheory +% +\endisadelimtheory +% +\isatagtheory +\isacommand{theory}\isamarkupfalse% +\ Prelim\isanewline +\isakeyword{imports}\ Base\isanewline +\isakeyword{begin}% +\endisatagtheory +{\isafoldtheory}% +% +\isadelimtheory +% +\endisadelimtheory +% +\isamarkupchapter{Preliminaries% +} +\isamarkuptrue% +% +\isamarkupsection{Contexts \label{sec:context}% +} +\isamarkuptrue% +% +\begin{isamarkuptext}% +A logical context represents the background that is required for + formulating statements and composing proofs. It acts as a medium to + produce formal content, depending on earlier material (declarations, + results etc.). + + For example, derivations within the Isabelle/Pure logic can be + described as a judgment \isa{{\isasymGamma}\ {\isasymturnstile}\isactrlsub {\isasymTheta}\ {\isasymphi}}, which means that a + proposition \isa{{\isasymphi}} is derivable from hypotheses \isa{{\isasymGamma}} + within the theory \isa{{\isasymTheta}}. There are logical reasons for + keeping \isa{{\isasymTheta}} and \isa{{\isasymGamma}} separate: theories can be + liberal about supporting type constructors and schematic + polymorphism of constants and axioms, while the inner calculus of + \isa{{\isasymGamma}\ {\isasymturnstile}\ {\isasymphi}} is strictly limited to Simple Type Theory (with + fixed type variables in the assumptions). + + \medskip Contexts and derivations are linked by the following key + principles: + + \begin{itemize} + + \item Transfer: monotonicity of derivations admits results to be + transferred into a \emph{larger} context, i.e.\ \isa{{\isasymGamma}\ {\isasymturnstile}\isactrlsub {\isasymTheta}\ {\isasymphi}} implies \isa{{\isasymGamma}{\isacharprime}\ {\isasymturnstile}\isactrlsub {\isasymTheta}\isactrlsub {\isacharprime}\ {\isasymphi}} for contexts \isa{{\isasymTheta}{\isacharprime}\ {\isasymsupseteq}\ {\isasymTheta}} and \isa{{\isasymGamma}{\isacharprime}\ {\isasymsupseteq}\ {\isasymGamma}}. + + \item Export: discharge of hypotheses admits results to be exported + into a \emph{smaller} context, i.e.\ \isa{{\isasymGamma}{\isacharprime}\ {\isasymturnstile}\isactrlsub {\isasymTheta}\ {\isasymphi}} + implies \isa{{\isasymGamma}\ {\isasymturnstile}\isactrlsub {\isasymTheta}\ {\isasymDelta}\ {\isasymLongrightarrow}\ {\isasymphi}} where \isa{{\isasymGamma}{\isacharprime}\ {\isasymsupseteq}\ {\isasymGamma}} and + \isa{{\isasymDelta}\ {\isacharequal}\ {\isasymGamma}{\isacharprime}\ {\isacharminus}\ {\isasymGamma}}. Note that \isa{{\isasymTheta}} remains unchanged here, + only the \isa{{\isasymGamma}} part is affected. + + \end{itemize} + + \medskip By modeling the main characteristics of the primitive + \isa{{\isasymTheta}} and \isa{{\isasymGamma}} above, and abstracting over any + particular logical content, we arrive at the fundamental notions of + \emph{theory context} and \emph{proof context} in Isabelle/Isar. + These implement a certain policy to manage arbitrary \emph{context + data}. There is a strongly-typed mechanism to declare new kinds of + data at compile time. + + The internal bootstrap process of Isabelle/Pure eventually reaches a + stage where certain data slots provide the logical content of \isa{{\isasymTheta}} and \isa{{\isasymGamma}} sketched above, but this does not stop there! + Various additional data slots support all kinds of mechanisms that + are not necessarily part of the core logic. + + For example, there would be data for canonical introduction and + elimination rules for arbitrary operators (depending on the + object-logic and application), which enables users to perform + standard proof steps implicitly (cf.\ the \isa{rule} method + \cite{isabelle-isar-ref}). + + \medskip Thus Isabelle/Isar is able to bring forth more and more + concepts successively. In particular, an object-logic like + Isabelle/HOL continues the Isabelle/Pure setup by adding specific + components for automated reasoning (classical reasoner, tableau + prover, structured induction etc.) and derived specification + mechanisms (inductive predicates, recursive functions etc.). All of + this is ultimately based on the generic data management by theory + and proof contexts introduced here.% +\end{isamarkuptext}% +\isamarkuptrue% +% +\isamarkupsubsection{Theory context \label{sec:context-theory}% +} +\isamarkuptrue% +% +\begin{isamarkuptext}% +A \emph{theory} is a data container with explicit name and unique + identifier. Theories are related by a (nominal) sub-theory + relation, which corresponds to the dependency graph of the original + construction; each theory is derived from a certain sub-graph of + ancestor theories. + + The \isa{merge} operation produces the least upper bound of two + theories, which actually degenerates into absorption of one theory + into the other (due to the nominal sub-theory relation). + + The \isa{begin} operation starts a new theory by importing + several parent theories and entering a special \isa{draft} mode, + which is sustained until the final \isa{end} operation. A draft + theory acts like a linear type, where updates invalidate earlier + versions. An invalidated draft is called ``stale''. + + The \isa{checkpoint} operation produces an intermediate stepping + stone that will survive the next update: both the original and the + changed theory remain valid and are related by the sub-theory + relation. Checkpointing essentially recovers purely functional + theory values, at the expense of some extra internal bookkeeping. + + The \isa{copy} operation produces an auxiliary version that has + the same data content, but is unrelated to the original: updates of + the copy do not affect the original, neither does the sub-theory + relation hold. + + \medskip The example in \figref{fig:ex-theory} below shows a theory + graph derived from \isa{Pure}, with theory \isa{Length} + importing \isa{Nat} and \isa{List}. The body of \isa{Length} consists of a sequence of updates, working mostly on + drafts. Intermediate checkpoints may occur as well, due to the + history mechanism provided by the Isar top-level, cf.\ + \secref{sec:isar-toplevel}. + + \begin{figure}[htb] + \begin{center} + \begin{tabular}{rcccl} + & & \isa{Pure} \\ + & & \isa{{\isasymdown}} \\ + & & \isa{FOL} \\ + & $\swarrow$ & & $\searrow$ & \\ + \isa{Nat} & & & & \isa{List} \\ + & $\searrow$ & & $\swarrow$ \\ + & & \isa{Length} \\ + & & \multicolumn{3}{l}{~~\hyperlink{keyword.imports}{\mbox{\isa{\isakeyword{imports}}}}} \\ + & & \multicolumn{3}{l}{~~\hyperlink{keyword.begin}{\mbox{\isa{\isakeyword{begin}}}}} \\ + & & $\vdots$~~ \\ + & & \isa{{\isasymbullet}}~~ \\ + & & $\vdots$~~ \\ + & & \isa{{\isasymbullet}}~~ \\ + & & $\vdots$~~ \\ + & & \multicolumn{3}{l}{~~\hyperlink{command.end}{\mbox{\isa{\isacommand{end}}}}} \\ + \end{tabular} + \caption{A theory definition depending on ancestors}\label{fig:ex-theory} + \end{center} + \end{figure} + + \medskip There is a separate notion of \emph{theory reference} for + maintaining a live link to an evolving theory context: updates on + drafts are propagated automatically. Dynamic updating stops after + an explicit \isa{end} only. + + Derived entities may store a theory reference in order to indicate + the context they belong to. This implicitly assumes monotonic + reasoning, because the referenced context may become larger without + further notice.% +\end{isamarkuptext}% +\isamarkuptrue% +% +\isadelimmlref +% +\endisadelimmlref +% +\isatagmlref +% +\begin{isamarkuptext}% +\begin{mldecls} + \indexmltype{theory}\verb|type theory| \\ + \indexml{Theory.subthy}\verb|Theory.subthy: theory * theory -> bool| \\ + \indexml{Theory.merge}\verb|Theory.merge: theory * theory -> theory| \\ + \indexml{Theory.checkpoint}\verb|Theory.checkpoint: theory -> theory| \\ + \indexml{Theory.copy}\verb|Theory.copy: theory -> theory| \\ + \end{mldecls} + \begin{mldecls} + \indexmltype{theory\_ref}\verb|type theory_ref| \\ + \indexml{Theory.deref}\verb|Theory.deref: theory_ref -> theory| \\ + \indexml{Theory.check\_thy}\verb|Theory.check_thy: theory -> theory_ref| \\ + \end{mldecls} + + \begin{description} + + \item \verb|theory| represents theory contexts. This is + essentially a linear type! Most operations destroy the original + version, which then becomes ``stale''. + + \item \verb|Theory.subthy|~\isa{{\isacharparenleft}thy\isactrlsub {\isadigit{1}}{\isacharcomma}\ thy\isactrlsub {\isadigit{2}}{\isacharparenright}} + compares theories according to the inherent graph structure of the + construction. This sub-theory relation is a nominal approximation + of inclusion (\isa{{\isasymsubseteq}}) of the corresponding content. + + \item \verb|Theory.merge|~\isa{{\isacharparenleft}thy\isactrlsub {\isadigit{1}}{\isacharcomma}\ thy\isactrlsub {\isadigit{2}}{\isacharparenright}} + absorbs one theory into the other. This fails for unrelated + theories! + + \item \verb|Theory.checkpoint|~\isa{thy} produces a safe + stepping stone in the linear development of \isa{thy}. The next + update will result in two related, valid theories. + + \item \verb|Theory.copy|~\isa{thy} produces a variant of \isa{thy} that holds a copy of the same data. The result is not + related to the original; the original is unchanged. + + \item \verb|theory_ref| represents a sliding reference to an + always valid theory; updates on the original are propagated + automatically. + + \item \verb|Theory.deref|~\isa{thy{\isacharunderscore}ref} turns a \verb|theory_ref| into an \verb|theory| value. As the referenced + theory evolves monotonically over time, later invocations of \verb|Theory.deref| may refer to a larger context. + + \item \verb|Theory.check_thy|~\isa{thy} produces a \verb|theory_ref| from a valid \verb|theory| value. + + \end{description}% +\end{isamarkuptext}% +\isamarkuptrue% +% +\endisatagmlref +{\isafoldmlref}% +% +\isadelimmlref +% +\endisadelimmlref +% +\isamarkupsubsection{Proof context \label{sec:context-proof}% +} +\isamarkuptrue% +% +\begin{isamarkuptext}% +A proof context is a container for pure data with a back-reference + to the theory it belongs to. The \isa{init} operation creates a + proof context from a given theory. Modifications to draft theories + are propagated to the proof context as usual, but there is also an + explicit \isa{transfer} operation to force resynchronization + with more substantial updates to the underlying theory. The actual + context data does not require any special bookkeeping, thanks to the + lack of destructive features. + + Entities derived in a proof context need to record inherent logical + requirements explicitly, since there is no separate context + identification as for theories. For example, hypotheses used in + primitive derivations (cf.\ \secref{sec:thms}) are recorded + separately within the sequent \isa{{\isasymGamma}\ {\isasymturnstile}\ {\isasymphi}}, just to make double + sure. Results could still leak into an alien proof context due to + programming errors, but Isabelle/Isar includes some extra validity + checks in critical positions, notably at the end of a sub-proof. + + Proof contexts may be manipulated arbitrarily, although the common + discipline is to follow block structure as a mental model: a given + context is extended consecutively, and results are exported back + into the original context. Note that the Isar proof states model + block-structured reasoning explicitly, using a stack of proof + contexts internally.% +\end{isamarkuptext}% +\isamarkuptrue% +% +\isadelimmlref +% +\endisadelimmlref +% +\isatagmlref +% +\begin{isamarkuptext}% +\begin{mldecls} + \indexmltype{Proof.context}\verb|type Proof.context| \\ + \indexml{ProofContext.init}\verb|ProofContext.init: theory -> Proof.context| \\ + \indexml{ProofContext.theory\_of}\verb|ProofContext.theory_of: Proof.context -> theory| \\ + \indexml{ProofContext.transfer}\verb|ProofContext.transfer: theory -> Proof.context -> Proof.context| \\ + \end{mldecls} + + \begin{description} + + \item \verb|Proof.context| represents proof contexts. Elements + of this type are essentially pure values, with a sliding reference + to the background theory. + + \item \verb|ProofContext.init|~\isa{thy} produces a proof context + derived from \isa{thy}, initializing all data. + + \item \verb|ProofContext.theory_of|~\isa{ctxt} selects the + background theory from \isa{ctxt}, dereferencing its internal + \verb|theory_ref|. + + \item \verb|ProofContext.transfer|~\isa{thy\ ctxt} promotes the + background theory of \isa{ctxt} to the super theory \isa{thy}. + + \end{description}% +\end{isamarkuptext}% +\isamarkuptrue% +% +\endisatagmlref +{\isafoldmlref}% +% +\isadelimmlref +% +\endisadelimmlref +% +\isamarkupsubsection{Generic contexts \label{sec:generic-context}% +} +\isamarkuptrue% +% +\begin{isamarkuptext}% +A generic context is the disjoint sum of either a theory or proof + context. Occasionally, this enables uniform treatment of generic + context data, typically extra-logical information. Operations on + generic contexts include the usual injections, partial selections, + and combinators for lifting operations on either component of the + disjoint sum. + + Moreover, there are total operations \isa{theory{\isacharunderscore}of} and \isa{proof{\isacharunderscore}of} to convert a generic context into either kind: a theory + can always be selected from the sum, while a proof context might + have to be constructed by an ad-hoc \isa{init} operation.% +\end{isamarkuptext}% +\isamarkuptrue% +% +\isadelimmlref +% +\endisadelimmlref +% +\isatagmlref +% +\begin{isamarkuptext}% +\begin{mldecls} + \indexmltype{Context.generic}\verb|type Context.generic| \\ + \indexml{Context.theory\_of}\verb|Context.theory_of: Context.generic -> theory| \\ + \indexml{Context.proof\_of}\verb|Context.proof_of: Context.generic -> Proof.context| \\ + \end{mldecls} + + \begin{description} + + \item \verb|Context.generic| is the direct sum of \verb|theory| and \verb|Proof.context|, with the datatype + constructors \verb|Context.Theory| and \verb|Context.Proof|. + + \item \verb|Context.theory_of|~\isa{context} always produces a + theory from the generic \isa{context}, using \verb|ProofContext.theory_of| as required. + + \item \verb|Context.proof_of|~\isa{context} always produces a + proof context from the generic \isa{context}, using \verb|ProofContext.init| as required (note that this re-initializes the + context data with each invocation). + + \end{description}% +\end{isamarkuptext}% +\isamarkuptrue% +% +\endisatagmlref +{\isafoldmlref}% +% +\isadelimmlref +% +\endisadelimmlref +% +\isamarkupsubsection{Context data \label{sec:context-data}% +} +\isamarkuptrue% +% +\begin{isamarkuptext}% +The main purpose of theory and proof contexts is to manage arbitrary + data. New data types can be declared incrementally at compile time. + There are separate declaration mechanisms for any of the three kinds + of contexts: theory, proof, generic. + + \paragraph{Theory data} may refer to destructive entities, which are + maintained in direct correspondence to the linear evolution of + theory values, including explicit copies.\footnote{Most existing + instances of destructive theory data are merely historical relics + (e.g.\ the destructive theorem storage, and destructive hints for + the Simplifier and Classical rules).} A theory data declaration + needs to implement the following SML signature: + + \medskip + \begin{tabular}{ll} + \isa{{\isasymtype}\ T} & representing type \\ + \isa{{\isasymval}\ empty{\isacharcolon}\ T} & empty default value \\ + \isa{{\isasymval}\ copy{\isacharcolon}\ T\ {\isasymrightarrow}\ T} & refresh impure data \\ + \isa{{\isasymval}\ extend{\isacharcolon}\ T\ {\isasymrightarrow}\ T} & re-initialize on import \\ + \isa{{\isasymval}\ merge{\isacharcolon}\ T\ {\isasymtimes}\ T\ {\isasymrightarrow}\ T} & join on import \\ + \end{tabular} + \medskip + + \noindent The \isa{empty} value acts as initial default for + \emph{any} theory that does not declare actual data content; \isa{copy} maintains persistent integrity for impure data, it is just + the identity for pure values; \isa{extend} is acts like a + unitary version of \isa{merge}, both operations should also + include the functionality of \isa{copy} for impure data. + + \paragraph{Proof context data} is purely functional. A declaration + needs to implement the following SML signature: + + \medskip + \begin{tabular}{ll} + \isa{{\isasymtype}\ T} & representing type \\ + \isa{{\isasymval}\ init{\isacharcolon}\ theory\ {\isasymrightarrow}\ T} & produce initial value \\ + \end{tabular} + \medskip + + \noindent The \isa{init} operation is supposed to produce a pure + value from the given background theory. + + \paragraph{Generic data} provides a hybrid interface for both theory + and proof data. The declaration is essentially the same as for + (pure) theory data, without \isa{copy}. The \isa{init} + operation for proof contexts merely selects the current data value + from the background theory. + + \bigskip A data declaration of type \isa{T} results in the + following interface: + + \medskip + \begin{tabular}{ll} + \isa{init{\isacharcolon}\ theory\ {\isasymrightarrow}\ T} \\ + \isa{get{\isacharcolon}\ context\ {\isasymrightarrow}\ T} \\ + \isa{put{\isacharcolon}\ T\ {\isasymrightarrow}\ context\ {\isasymrightarrow}\ context} \\ + \isa{map{\isacharcolon}\ {\isacharparenleft}T\ {\isasymrightarrow}\ T{\isacharparenright}\ {\isasymrightarrow}\ context\ {\isasymrightarrow}\ context} \\ + \end{tabular} + \medskip + + \noindent Here \isa{init} is only applicable to impure theory + data to install a fresh copy persistently (destructive update on + uninitialized has no permanent effect). The other operations provide + access for the particular kind of context (theory, proof, or generic + context). Note that this is a safe interface: there is no other way + to access the corresponding data slot of a context. By keeping + these operations private, a component may maintain abstract values + authentically, without other components interfering.% +\end{isamarkuptext}% +\isamarkuptrue% +% +\isadelimmlref +% +\endisadelimmlref +% +\isatagmlref +% +\begin{isamarkuptext}% +\begin{mldecls} + \indexmlfunctor{TheoryDataFun}\verb|functor TheoryDataFun| \\ + \indexmlfunctor{ProofDataFun}\verb|functor ProofDataFun| \\ + \indexmlfunctor{GenericDataFun}\verb|functor GenericDataFun| \\ + \end{mldecls} + + \begin{description} + + \item \verb|TheoryDataFun|\isa{{\isacharparenleft}spec{\isacharparenright}} declares data for + type \verb|theory| according to the specification provided as + argument structure. The resulting structure provides data init and + access operations as described above. + + \item \verb|ProofDataFun|\isa{{\isacharparenleft}spec{\isacharparenright}} is analogous to + \verb|TheoryDataFun| for type \verb|Proof.context|. + + \item \verb|GenericDataFun|\isa{{\isacharparenleft}spec{\isacharparenright}} is analogous to + \verb|TheoryDataFun| for type \verb|Context.generic|. + + \end{description}% +\end{isamarkuptext}% +\isamarkuptrue% +% +\endisatagmlref +{\isafoldmlref}% +% +\isadelimmlref +% +\endisadelimmlref +% +\isamarkupsection{Names \label{sec:names}% +} +\isamarkuptrue% +% +\begin{isamarkuptext}% +In principle, a name is just a string, but there are various + convention for encoding additional structure. For example, ``\isa{Foo{\isachardot}bar{\isachardot}baz}'' is considered as a qualified name consisting of + three basic name components. The individual constituents of a name + may have further substructure, e.g.\ the string + ``\verb,\,\verb,,'' encodes as a single symbol.% +\end{isamarkuptext}% +\isamarkuptrue% +% +\isamarkupsubsection{Strings of symbols% +} +\isamarkuptrue% +% +\begin{isamarkuptext}% +A \emph{symbol} constitutes the smallest textual unit in Isabelle + --- raw characters are normally not encountered at all. Isabelle + strings consist of a sequence of symbols, represented as a packed + string or a list of strings. Each symbol is in itself a small + string, which has either one of the following forms: + + \begin{enumerate} + + \item a single ASCII character ``\isa{c}'', for example + ``\verb,a,'', + + \item a regular symbol ``\verb,\,\verb,<,\isa{ident}\verb,>,'', + for example ``\verb,\,\verb,,'', + + \item a control symbol ``\verb,\,\verb,<^,\isa{ident}\verb,>,'', + for example ``\verb,\,\verb,<^bold>,'', + + \item a raw symbol ``\verb,\,\verb,<^raw:,\isa{text}\verb,>,'' + where \isa{text} constists of printable characters excluding + ``\verb,.,'' and ``\verb,>,'', for example + ``\verb,\,\verb,<^raw:$\sum_{i = 1}^n$>,'', + + \item a numbered raw control symbol ``\verb,\,\verb,<^raw,\isa{n}\verb,>, where \isa{n} consists of digits, for example + ``\verb,\,\verb,<^raw42>,''. + + \end{enumerate} + + \noindent The \isa{ident} syntax for symbol names is \isa{letter\ {\isacharparenleft}letter\ {\isacharbar}\ digit{\isacharparenright}\isactrlsup {\isacharasterisk}}, where \isa{letter\ {\isacharequal}\ A{\isachardot}{\isachardot}Za{\isachardot}{\isachardot}z} and \isa{digit\ {\isacharequal}\ {\isadigit{0}}{\isachardot}{\isachardot}{\isadigit{9}}}. There are infinitely many + regular symbols and control symbols, but a fixed collection of + standard symbols is treated specifically. For example, + ``\verb,\,\verb,,'' is classified as a letter, which means it + may occur within regular Isabelle identifiers. + + Since the character set underlying Isabelle symbols is 7-bit ASCII + and 8-bit characters are passed through transparently, Isabelle may + also process Unicode/UCS data in UTF-8 encoding. Unicode provides + its own collection of mathematical symbols, but there is no built-in + link to the standard collection of Isabelle. + + \medskip Output of Isabelle symbols depends on the print mode + (\secref{print-mode}). For example, the standard {\LaTeX} setup of + the Isabelle document preparation system would present + ``\verb,\,\verb,,'' as \isa{{\isasymalpha}}, and + ``\verb,\,\verb,<^bold>,\verb,\,\verb,,'' as \isa{\isactrlbold {\isasymalpha}}.% +\end{isamarkuptext}% +\isamarkuptrue% +% +\isadelimmlref +% +\endisadelimmlref +% +\isatagmlref +% +\begin{isamarkuptext}% +\begin{mldecls} + \indexmltype{Symbol.symbol}\verb|type Symbol.symbol| \\ + \indexml{Symbol.explode}\verb|Symbol.explode: string -> Symbol.symbol list| \\ + \indexml{Symbol.is\_letter}\verb|Symbol.is_letter: Symbol.symbol -> bool| \\ + \indexml{Symbol.is\_digit}\verb|Symbol.is_digit: Symbol.symbol -> bool| \\ + \indexml{Symbol.is\_quasi}\verb|Symbol.is_quasi: Symbol.symbol -> bool| \\ + \indexml{Symbol.is\_blank}\verb|Symbol.is_blank: Symbol.symbol -> bool| \\ + \end{mldecls} + \begin{mldecls} + \indexmltype{Symbol.sym}\verb|type Symbol.sym| \\ + \indexml{Symbol.decode}\verb|Symbol.decode: Symbol.symbol -> Symbol.sym| \\ + \end{mldecls} + + \begin{description} + + \item \verb|Symbol.symbol| represents individual Isabelle + symbols; this is an alias for \verb|string|. + + \item \verb|Symbol.explode|~\isa{str} produces a symbol list + from the packed form. This function supercedes \verb|String.explode| for virtually all purposes of manipulating text in + Isabelle! + + \item \verb|Symbol.is_letter|, \verb|Symbol.is_digit|, \verb|Symbol.is_quasi|, \verb|Symbol.is_blank| classify standard + symbols according to fixed syntactic conventions of Isabelle, cf.\ + \cite{isabelle-isar-ref}. + + \item \verb|Symbol.sym| is a concrete datatype that represents + the different kinds of symbols explicitly, with constructors \verb|Symbol.Char|, \verb|Symbol.Sym|, \verb|Symbol.Ctrl|, \verb|Symbol.Raw|. + + \item \verb|Symbol.decode| converts the string representation of a + symbol into the datatype version. + + \end{description}% +\end{isamarkuptext}% +\isamarkuptrue% +% +\endisatagmlref +{\isafoldmlref}% +% +\isadelimmlref +% +\endisadelimmlref +% +\isamarkupsubsection{Basic names \label{sec:basic-names}% +} +\isamarkuptrue% +% +\begin{isamarkuptext}% +A \emph{basic name} essentially consists of a single Isabelle + identifier. There are conventions to mark separate classes of basic + names, by attaching a suffix of underscores: one underscore means + \emph{internal name}, two underscores means \emph{Skolem name}, + three underscores means \emph{internal Skolem name}. + + For example, the basic name \isa{foo} has the internal version + \isa{foo{\isacharunderscore}}, with Skolem versions \isa{foo{\isacharunderscore}{\isacharunderscore}} and \isa{foo{\isacharunderscore}{\isacharunderscore}{\isacharunderscore}}, respectively. + + These special versions provide copies of the basic name space, apart + from anything that normally appears in the user text. For example, + system generated variables in Isar proof contexts are usually marked + as internal, which prevents mysterious name references like \isa{xaa} to appear in the text. + + \medskip Manipulating binding scopes often requires on-the-fly + renamings. A \emph{name context} contains a collection of already + used names. The \isa{declare} operation adds names to the + context. + + The \isa{invents} operation derives a number of fresh names from + a given starting point. For example, the first three names derived + from \isa{a} are \isa{a}, \isa{b}, \isa{c}. + + The \isa{variants} operation produces fresh names by + incrementing tentative names as base-26 numbers (with digits \isa{a{\isachardot}{\isachardot}z}) until all clashes are resolved. For example, name \isa{foo} results in variants \isa{fooa}, \isa{foob}, \isa{fooc}, \dots, \isa{fooaa}, \isa{fooab} etc.; each renaming + step picks the next unused variant from this sequence.% +\end{isamarkuptext}% +\isamarkuptrue% +% +\isadelimmlref +% +\endisadelimmlref +% +\isatagmlref +% +\begin{isamarkuptext}% +\begin{mldecls} + \indexml{Name.internal}\verb|Name.internal: string -> string| \\ + \indexml{Name.skolem}\verb|Name.skolem: string -> string| \\ + \end{mldecls} + \begin{mldecls} + \indexmltype{Name.context}\verb|type Name.context| \\ + \indexml{Name.context}\verb|Name.context: Name.context| \\ + \indexml{Name.declare}\verb|Name.declare: string -> Name.context -> Name.context| \\ + \indexml{Name.invents}\verb|Name.invents: Name.context -> string -> int -> string list| \\ + \indexml{Name.variants}\verb|Name.variants: string list -> Name.context -> string list * Name.context| \\ + \end{mldecls} + + \begin{description} + + \item \verb|Name.internal|~\isa{name} produces an internal name + by adding one underscore. + + \item \verb|Name.skolem|~\isa{name} produces a Skolem name by + adding two underscores. + + \item \verb|Name.context| represents the context of already used + names; the initial value is \verb|Name.context|. + + \item \verb|Name.declare|~\isa{name} enters a used name into the + context. + + \item \verb|Name.invents|~\isa{context\ name\ n} produces \isa{n} fresh names derived from \isa{name}. + + \item \verb|Name.variants|~\isa{names\ context} produces fresh + variants of \isa{names}; the result is entered into the context. + + \end{description}% +\end{isamarkuptext}% +\isamarkuptrue% +% +\endisatagmlref +{\isafoldmlref}% +% +\isadelimmlref +% +\endisadelimmlref +% +\isamarkupsubsection{Indexed names% +} +\isamarkuptrue% +% +\begin{isamarkuptext}% +An \emph{indexed name} (or \isa{indexname}) is a pair of a basic + name and a natural number. This representation allows efficient + renaming by incrementing the second component only. The canonical + way to rename two collections of indexnames apart from each other is + this: determine the maximum index \isa{maxidx} of the first + collection, then increment all indexes of the second collection by + \isa{maxidx\ {\isacharplus}\ {\isadigit{1}}}; the maximum index of an empty collection is + \isa{{\isacharminus}{\isadigit{1}}}. + + Occasionally, basic names and indexed names are injected into the + same pair type: the (improper) indexname \isa{{\isacharparenleft}x{\isacharcomma}\ {\isacharminus}{\isadigit{1}}{\isacharparenright}} is used + to encode basic names. + + \medskip Isabelle syntax observes the following rules for + representing an indexname \isa{{\isacharparenleft}x{\isacharcomma}\ i{\isacharparenright}} as a packed string: + + \begin{itemize} + + \item \isa{{\isacharquery}x} if \isa{x} does not end with a digit and \isa{i\ {\isacharequal}\ {\isadigit{0}}}, + + \item \isa{{\isacharquery}xi} if \isa{x} does not end with a digit, + + \item \isa{{\isacharquery}x{\isachardot}i} otherwise. + + \end{itemize} + + Indexnames may acquire large index numbers over time. Results are + normalized towards \isa{{\isadigit{0}}} at certain checkpoints, notably at + the end of a proof. This works by producing variants of the + corresponding basic name components. For example, the collection + \isa{{\isacharquery}x{\isadigit{1}}{\isacharcomma}\ {\isacharquery}x{\isadigit{7}}{\isacharcomma}\ {\isacharquery}x{\isadigit{4}}{\isadigit{2}}} becomes \isa{{\isacharquery}x{\isacharcomma}\ {\isacharquery}xa{\isacharcomma}\ {\isacharquery}xb}.% +\end{isamarkuptext}% +\isamarkuptrue% +% +\isadelimmlref +% +\endisadelimmlref +% +\isatagmlref +% +\begin{isamarkuptext}% +\begin{mldecls} + \indexmltype{indexname}\verb|type indexname| \\ + \end{mldecls} + + \begin{description} + + \item \verb|indexname| represents indexed names. This is an + abbreviation for \verb|string * int|. The second component is + usually non-negative, except for situations where \isa{{\isacharparenleft}x{\isacharcomma}\ {\isacharminus}{\isadigit{1}}{\isacharparenright}} + is used to embed basic names into this type. + + \end{description}% +\end{isamarkuptext}% +\isamarkuptrue% +% +\endisatagmlref +{\isafoldmlref}% +% +\isadelimmlref +% +\endisadelimmlref +% +\isamarkupsubsection{Qualified names and name spaces% +} +\isamarkuptrue% +% +\begin{isamarkuptext}% +A \emph{qualified name} consists of a non-empty sequence of basic + name components. The packed representation uses a dot as separator, + as in ``\isa{A{\isachardot}b{\isachardot}c}''. The last component is called \emph{base} + name, the remaining prefix \emph{qualifier} (which may be empty). + The idea of qualified names is to encode nested structures by + recording the access paths as qualifiers. For example, an item + named ``\isa{A{\isachardot}b{\isachardot}c}'' may be understood as a local entity \isa{c}, within a local structure \isa{b}, within a global + structure \isa{A}. Typically, name space hierarchies consist of + 1--2 levels of qualification, but this need not be always so. + + The empty name is commonly used as an indication of unnamed + entities, whenever this makes any sense. The basic operations on + qualified names are smart enough to pass through such improper names + unchanged. + + \medskip A \isa{naming} policy tells how to turn a name + specification into a fully qualified internal name (by the \isa{full} operation), and how fully qualified names may be accessed + externally. For example, the default naming policy is to prefix an + implicit path: \isa{full\ x} produces \isa{path{\isachardot}x}, and the + standard accesses for \isa{path{\isachardot}x} include both \isa{x} and + \isa{path{\isachardot}x}. Normally, the naming is implicit in the theory or + proof context; there are separate versions of the corresponding. + + \medskip A \isa{name\ space} manages a collection of fully + internalized names, together with a mapping between external names + and internal names (in both directions). The corresponding \isa{intern} and \isa{extern} operations are mostly used for + parsing and printing only! The \isa{declare} operation augments + a name space according to the accesses determined by the naming + policy. + + \medskip As a general principle, there is a separate name space for + each kind of formal entity, e.g.\ logical constant, type + constructor, type class, theorem. It is usually clear from the + occurrence in concrete syntax (or from the scope) which kind of + entity a name refers to. For example, the very same name \isa{c} may be used uniformly for a constant, type constructor, and + type class. + + There are common schemes to name theorems systematically, according + to the name of the main logical entity involved, e.g.\ \isa{c{\isachardot}intro} for a canonical theorem related to constant \isa{c}. + This technique of mapping names from one space into another requires + some care in order to avoid conflicts. In particular, theorem names + derived from a type constructor or type class are better suffixed in + addition to the usual qualification, e.g.\ \isa{c{\isacharunderscore}type{\isachardot}intro} + and \isa{c{\isacharunderscore}class{\isachardot}intro} for theorems related to type \isa{c} + and class \isa{c}, respectively.% +\end{isamarkuptext}% +\isamarkuptrue% +% +\isadelimmlref +% +\endisadelimmlref +% +\isatagmlref +% +\begin{isamarkuptext}% +\begin{mldecls} + \indexml{NameSpace.base}\verb|NameSpace.base: string -> string| \\ + \indexml{NameSpace.qualifier}\verb|NameSpace.qualifier: string -> string| \\ + \indexml{NameSpace.append}\verb|NameSpace.append: string -> string -> string| \\ + \indexml{NameSpace.implode}\verb|NameSpace.implode: string list -> string| \\ + \indexml{NameSpace.explode}\verb|NameSpace.explode: string -> string list| \\ + \end{mldecls} + \begin{mldecls} + \indexmltype{NameSpace.naming}\verb|type NameSpace.naming| \\ + \indexml{NameSpace.default\_naming}\verb|NameSpace.default_naming: NameSpace.naming| \\ + \indexml{NameSpace.add\_path}\verb|NameSpace.add_path: string -> NameSpace.naming -> NameSpace.naming| \\ + \indexml{NameSpace.full\_name}\verb|NameSpace.full_name: NameSpace.naming -> binding -> string| \\ + \end{mldecls} + \begin{mldecls} + \indexmltype{NameSpace.T}\verb|type NameSpace.T| \\ + \indexml{NameSpace.empty}\verb|NameSpace.empty: NameSpace.T| \\ + \indexml{NameSpace.merge}\verb|NameSpace.merge: NameSpace.T * NameSpace.T -> NameSpace.T| \\ + \indexml{NameSpace.declare}\verb|NameSpace.declare: NameSpace.naming -> binding -> NameSpace.T -> string * NameSpace.T| \\ + \indexml{NameSpace.intern}\verb|NameSpace.intern: NameSpace.T -> string -> string| \\ + \indexml{NameSpace.extern}\verb|NameSpace.extern: NameSpace.T -> string -> string| \\ + \end{mldecls} + + \begin{description} + + \item \verb|NameSpace.base|~\isa{name} returns the base name of a + qualified name. + + \item \verb|NameSpace.qualifier|~\isa{name} returns the qualifier + of a qualified name. + + \item \verb|NameSpace.append|~\isa{name\isactrlisub {\isadigit{1}}\ name\isactrlisub {\isadigit{2}}} + appends two qualified names. + + \item \verb|NameSpace.implode|~\isa{name} and \verb|NameSpace.explode|~\isa{names} convert between the packed string + representation and the explicit list form of qualified names. + + \item \verb|NameSpace.naming| represents the abstract concept of + a naming policy. + + \item \verb|NameSpace.default_naming| is the default naming policy. + In a theory context, this is usually augmented by a path prefix + consisting of the theory name. + + \item \verb|NameSpace.add_path|~\isa{path\ naming} augments the + naming policy by extending its path component. + + \item \verb|NameSpace.full_name|\isa{naming\ binding} turns a name + binding (usually a basic name) into the fully qualified + internal name, according to the given naming policy. + + \item \verb|NameSpace.T| represents name spaces. + + \item \verb|NameSpace.empty| and \verb|NameSpace.merge|~\isa{{\isacharparenleft}space\isactrlisub {\isadigit{1}}{\isacharcomma}\ space\isactrlisub {\isadigit{2}}{\isacharparenright}} are the canonical operations for + maintaining name spaces according to theory data management + (\secref{sec:context-data}). + + \item \verb|NameSpace.declare|~\isa{naming\ bindings\ space} enters a + name binding as fully qualified internal name into the name space, + with external accesses determined by the naming policy. + + \item \verb|NameSpace.intern|~\isa{space\ name} internalizes a + (partially qualified) external name. + + This operation is mostly for parsing! Note that fully qualified + names stemming from declarations are produced via \verb|NameSpace.full_name| and \verb|NameSpace.declare| + (or their derivatives for \verb|theory| and + \verb|Proof.context|). + + \item \verb|NameSpace.extern|~\isa{space\ name} externalizes a + (fully qualified) internal name. + + This operation is mostly for printing! Note unqualified names are + produced via \verb|NameSpace.base|. + + \end{description}% +\end{isamarkuptext}% +\isamarkuptrue% +% +\endisatagmlref +{\isafoldmlref}% +% +\isadelimmlref +% +\endisadelimmlref +% +\isadelimtheory +% +\endisadelimtheory +% +\isatagtheory +\isacommand{end}\isamarkupfalse% +% +\endisatagtheory +{\isafoldtheory}% +% +\isadelimtheory +% +\endisadelimtheory +\isanewline +\end{isabellebody}% +%%% Local Variables: +%%% mode: latex +%%% TeX-master: "root" +%%% End: diff -r 419116f1157a -r e23770bc97c8 doc-src/IsarImplementation/Thy/document/Proof.tex --- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/doc-src/IsarImplementation/Thy/document/Proof.tex Thu Feb 26 08:48:33 2009 -0800 @@ -0,0 +1,394 @@ +% +\begin{isabellebody}% +\def\isabellecontext{Proof}% +% +\isadelimtheory +% +\endisadelimtheory +% +\isatagtheory +\isacommand{theory}\isamarkupfalse% +\ Proof\isanewline +\isakeyword{imports}\ Base\isanewline +\isakeyword{begin}% +\endisatagtheory +{\isafoldtheory}% +% +\isadelimtheory +% +\endisadelimtheory +% +\isamarkupchapter{Structured proofs% +} +\isamarkuptrue% +% +\isamarkupsection{Variables \label{sec:variables}% +} +\isamarkuptrue% +% +\begin{isamarkuptext}% +Any variable that is not explicitly bound by \isa{{\isasymlambda}}-abstraction + is considered as ``free''. Logically, free variables act like + outermost universal quantification at the sequent level: \isa{A\isactrlisub {\isadigit{1}}{\isacharparenleft}x{\isacharparenright}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ A\isactrlisub n{\isacharparenleft}x{\isacharparenright}\ {\isasymturnstile}\ B{\isacharparenleft}x{\isacharparenright}} means that the result + holds \emph{for all} values of \isa{x}. Free variables for + terms (not types) can be fully internalized into the logic: \isa{{\isasymturnstile}\ B{\isacharparenleft}x{\isacharparenright}} and \isa{{\isasymturnstile}\ {\isasymAnd}x{\isachardot}\ B{\isacharparenleft}x{\isacharparenright}} are interchangeable, provided + that \isa{x} does not occur elsewhere in the context. + Inspecting \isa{{\isasymturnstile}\ {\isasymAnd}x{\isachardot}\ B{\isacharparenleft}x{\isacharparenright}} more closely, we see that inside the + quantifier, \isa{x} is essentially ``arbitrary, but fixed'', + while from outside it appears as a place-holder for instantiation + (thanks to \isa{{\isasymAnd}} elimination). + + The Pure logic represents the idea of variables being either inside + or outside the current scope by providing separate syntactic + categories for \emph{fixed variables} (e.g.\ \isa{x}) vs.\ + \emph{schematic variables} (e.g.\ \isa{{\isacharquery}x}). Incidently, a + universal result \isa{{\isasymturnstile}\ {\isasymAnd}x{\isachardot}\ B{\isacharparenleft}x{\isacharparenright}} has the HHF normal form \isa{{\isasymturnstile}\ B{\isacharparenleft}{\isacharquery}x{\isacharparenright}}, which represents its generality nicely without requiring + an explicit quantifier. The same principle works for type + variables: \isa{{\isasymturnstile}\ B{\isacharparenleft}{\isacharquery}{\isasymalpha}{\isacharparenright}} represents the idea of ``\isa{{\isasymturnstile}\ {\isasymforall}{\isasymalpha}{\isachardot}\ B{\isacharparenleft}{\isasymalpha}{\isacharparenright}}'' without demanding a truly polymorphic framework. + + \medskip Additional care is required to treat type variables in a + way that facilitates type-inference. In principle, term variables + depend on type variables, which means that type variables would have + to be declared first. For example, a raw type-theoretic framework + would demand the context to be constructed in stages as follows: + \isa{{\isasymGamma}\ {\isacharequal}\ {\isasymalpha}{\isacharcolon}\ type{\isacharcomma}\ x{\isacharcolon}\ {\isasymalpha}{\isacharcomma}\ a{\isacharcolon}\ A{\isacharparenleft}x\isactrlisub {\isasymalpha}{\isacharparenright}}. + + We allow a slightly less formalistic mode of operation: term + variables \isa{x} are fixed without specifying a type yet + (essentially \emph{all} potential occurrences of some instance + \isa{x\isactrlisub {\isasymtau}} are fixed); the first occurrence of \isa{x} + within a specific term assigns its most general type, which is then + maintained consistently in the context. The above example becomes + \isa{{\isasymGamma}\ {\isacharequal}\ x{\isacharcolon}\ term{\isacharcomma}\ {\isasymalpha}{\isacharcolon}\ type{\isacharcomma}\ A{\isacharparenleft}x\isactrlisub {\isasymalpha}{\isacharparenright}}, where type \isa{{\isasymalpha}} is fixed \emph{after} term \isa{x}, and the constraint + \isa{x\ {\isacharcolon}{\isacharcolon}\ {\isasymalpha}} is an implicit consequence of the occurrence of + \isa{x\isactrlisub {\isasymalpha}} in the subsequent proposition. + + This twist of dependencies is also accommodated by the reverse + operation of exporting results from a context: a type variable + \isa{{\isasymalpha}} is considered fixed as long as it occurs in some fixed + term variable of the context. For example, exporting \isa{x{\isacharcolon}\ term{\isacharcomma}\ {\isasymalpha}{\isacharcolon}\ type\ {\isasymturnstile}\ x\isactrlisub {\isasymalpha}\ {\isacharequal}\ x\isactrlisub {\isasymalpha}} produces in the first step + \isa{x{\isacharcolon}\ term\ {\isasymturnstile}\ x\isactrlisub {\isasymalpha}\ {\isacharequal}\ x\isactrlisub {\isasymalpha}} for fixed \isa{{\isasymalpha}}, + and only in the second step \isa{{\isasymturnstile}\ {\isacharquery}x\isactrlisub {\isacharquery}\isactrlisub {\isasymalpha}\ {\isacharequal}\ {\isacharquery}x\isactrlisub {\isacharquery}\isactrlisub {\isasymalpha}} for schematic \isa{{\isacharquery}x} and \isa{{\isacharquery}{\isasymalpha}}. + + \medskip The Isabelle/Isar proof context manages the gory details of + term vs.\ type variables, with high-level principles for moving the + frontier between fixed and schematic variables. + + The \isa{add{\isacharunderscore}fixes} operation explictly declares fixed + variables; the \isa{declare{\isacharunderscore}term} operation absorbs a term into + a context by fixing new type variables and adding syntactic + constraints. + + The \isa{export} operation is able to perform the main work of + generalizing term and type variables as sketched above, assuming + that fixing variables and terms have been declared properly. + + There \isa{import} operation makes a generalized fact a genuine + part of the context, by inventing fixed variables for the schematic + ones. The effect can be reversed by using \isa{export} later, + potentially with an extended context; the result is equivalent to + the original modulo renaming of schematic variables. + + The \isa{focus} operation provides a variant of \isa{import} + for nested propositions (with explicit quantification): \isa{{\isasymAnd}x\isactrlisub {\isadigit{1}}\ {\isasymdots}\ x\isactrlisub n{\isachardot}\ B{\isacharparenleft}x\isactrlisub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ x\isactrlisub n{\isacharparenright}} is + decomposed by inventing fixed variables \isa{x\isactrlisub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ x\isactrlisub n} for the body.% +\end{isamarkuptext}% +\isamarkuptrue% +% +\isadelimmlref +% +\endisadelimmlref +% +\isatagmlref +% +\begin{isamarkuptext}% +\begin{mldecls} + \indexml{Variable.add\_fixes}\verb|Variable.add_fixes: |\isasep\isanewline% +\verb| string list -> Proof.context -> string list * Proof.context| \\ + \indexml{Variable.variant\_fixes}\verb|Variable.variant_fixes: |\isasep\isanewline% +\verb| string list -> Proof.context -> string list * Proof.context| \\ + \indexml{Variable.declare\_term}\verb|Variable.declare_term: term -> Proof.context -> Proof.context| \\ + \indexml{Variable.declare\_constraints}\verb|Variable.declare_constraints: term -> Proof.context -> Proof.context| \\ + \indexml{Variable.export}\verb|Variable.export: Proof.context -> Proof.context -> thm list -> thm list| \\ + \indexml{Variable.polymorphic}\verb|Variable.polymorphic: Proof.context -> term list -> term list| \\ + \indexml{Variable.import\_thms}\verb|Variable.import_thms: bool -> thm list -> Proof.context ->|\isasep\isanewline% +\verb| ((ctyp list * cterm list) * thm list) * Proof.context| \\ + \indexml{Variable.focus}\verb|Variable.focus: cterm -> Proof.context -> (cterm list * cterm) * Proof.context| \\ + \end{mldecls} + + \begin{description} + + \item \verb|Variable.add_fixes|~\isa{xs\ ctxt} fixes term + variables \isa{xs}, returning the resulting internal names. By + default, the internal representation coincides with the external + one, which also means that the given variables must not be fixed + already. There is a different policy within a local proof body: the + given names are just hints for newly invented Skolem variables. + + \item \verb|Variable.variant_fixes| is similar to \verb|Variable.add_fixes|, but always produces fresh variants of the given + names. + + \item \verb|Variable.declare_term|~\isa{t\ ctxt} declares term + \isa{t} to belong to the context. This automatically fixes new + type variables, but not term variables. Syntactic constraints for + type and term variables are declared uniformly, though. + + \item \verb|Variable.declare_constraints|~\isa{t\ ctxt} declares + syntactic constraints from term \isa{t}, without making it part + of the context yet. + + \item \verb|Variable.export|~\isa{inner\ outer\ thms} generalizes + fixed type and term variables in \isa{thms} according to the + difference of the \isa{inner} and \isa{outer} context, + following the principles sketched above. + + \item \verb|Variable.polymorphic|~\isa{ctxt\ ts} generalizes type + variables in \isa{ts} as far as possible, even those occurring + in fixed term variables. The default policy of type-inference is to + fix newly introduced type variables, which is essentially reversed + with \verb|Variable.polymorphic|: here the given terms are detached + from the context as far as possible. + + \item \verb|Variable.import_thms|~\isa{open\ thms\ ctxt} invents fixed + type and term variables for the schematic ones occurring in \isa{thms}. The \isa{open} flag indicates whether the fixed names + should be accessible to the user, otherwise newly introduced names + are marked as ``internal'' (\secref{sec:names}). + + \item \verb|Variable.focus|~\isa{B} decomposes the outermost \isa{{\isasymAnd}} prefix of proposition \isa{B}. + + \end{description}% +\end{isamarkuptext}% +\isamarkuptrue% +% +\endisatagmlref +{\isafoldmlref}% +% +\isadelimmlref +% +\endisadelimmlref +% +\isamarkupsection{Assumptions \label{sec:assumptions}% +} +\isamarkuptrue% +% +\begin{isamarkuptext}% +An \emph{assumption} is a proposition that it is postulated in the + current context. Local conclusions may use assumptions as + additional facts, but this imposes implicit hypotheses that weaken + the overall statement. + + Assumptions are restricted to fixed non-schematic statements, i.e.\ + all generality needs to be expressed by explicit quantifiers. + Nevertheless, the result will be in HHF normal form with outermost + quantifiers stripped. For example, by assuming \isa{{\isasymAnd}x\ {\isacharcolon}{\isacharcolon}\ {\isasymalpha}{\isachardot}\ P\ x} we get \isa{{\isasymAnd}x\ {\isacharcolon}{\isacharcolon}\ {\isasymalpha}{\isachardot}\ P\ x\ {\isasymturnstile}\ P\ {\isacharquery}x} for schematic \isa{{\isacharquery}x} + of fixed type \isa{{\isasymalpha}}. Local derivations accumulate more and + more explicit references to hypotheses: \isa{A\isactrlisub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ A\isactrlisub n\ {\isasymturnstile}\ B} where \isa{A\isactrlisub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ A\isactrlisub n} needs to + be covered by the assumptions of the current context. + + \medskip The \isa{add{\isacharunderscore}assms} operation augments the context by + local assumptions, which are parameterized by an arbitrary \isa{export} rule (see below). + + The \isa{export} operation moves facts from a (larger) inner + context into a (smaller) outer context, by discharging the + difference of the assumptions as specified by the associated export + rules. Note that the discharged portion is determined by the + difference contexts, not the facts being exported! There is a + separate flag to indicate a goal context, where the result is meant + to refine an enclosing sub-goal of a structured proof state. + + \medskip The most basic export rule discharges assumptions directly + by means of the \isa{{\isasymLongrightarrow}} introduction rule: + \[ + \infer[(\isa{{\isasymLongrightarrow}{\isacharunderscore}intro})]{\isa{{\isasymGamma}\ {\isacharbackslash}\ A\ {\isasymturnstile}\ A\ {\isasymLongrightarrow}\ B}}{\isa{{\isasymGamma}\ {\isasymturnstile}\ B}} + \] + + The variant for goal refinements marks the newly introduced + premises, which causes the canonical Isar goal refinement scheme to + enforce unification with local premises within the goal: + \[ + \infer[(\isa{{\isacharhash}{\isasymLongrightarrow}{\isacharunderscore}intro})]{\isa{{\isasymGamma}\ {\isacharbackslash}\ A\ {\isasymturnstile}\ {\isacharhash}A\ {\isasymLongrightarrow}\ B}}{\isa{{\isasymGamma}\ {\isasymturnstile}\ B}} + \] + + \medskip Alternative versions of assumptions may perform arbitrary + transformations on export, as long as the corresponding portion of + hypotheses is removed from the given facts. For example, a local + definition works by fixing \isa{x} and assuming \isa{x\ {\isasymequiv}\ t}, + with the following export rule to reverse the effect: + \[ + \infer[(\isa{{\isasymequiv}{\isacharminus}expand})]{\isa{{\isasymGamma}\ {\isacharbackslash}\ x\ {\isasymequiv}\ t\ {\isasymturnstile}\ B\ t}}{\isa{{\isasymGamma}\ {\isasymturnstile}\ B\ x}} + \] + This works, because the assumption \isa{x\ {\isasymequiv}\ t} was introduced in + a context with \isa{x} being fresh, so \isa{x} does not + occur in \isa{{\isasymGamma}} here.% +\end{isamarkuptext}% +\isamarkuptrue% +% +\isadelimmlref +% +\endisadelimmlref +% +\isatagmlref +% +\begin{isamarkuptext}% +\begin{mldecls} + \indexmltype{Assumption.export}\verb|type Assumption.export| \\ + \indexml{Assumption.assume}\verb|Assumption.assume: cterm -> thm| \\ + \indexml{Assumption.add\_assms}\verb|Assumption.add_assms: Assumption.export ->|\isasep\isanewline% +\verb| cterm list -> Proof.context -> thm list * Proof.context| \\ + \indexml{Assumption.add\_assumes}\verb|Assumption.add_assumes: |\isasep\isanewline% +\verb| cterm list -> Proof.context -> thm list * Proof.context| \\ + \indexml{Assumption.export}\verb|Assumption.export: bool -> Proof.context -> Proof.context -> thm -> thm| \\ + \end{mldecls} + + \begin{description} + + \item \verb|Assumption.export| represents arbitrary export + rules, which is any function of type \verb|bool -> cterm list -> thm -> thm|, + where the \verb|bool| indicates goal mode, and the \verb|cterm list| the collection of assumptions to be discharged + simultaneously. + + \item \verb|Assumption.assume|~\isa{A} turns proposition \isa{A} into a raw assumption \isa{A\ {\isasymturnstile}\ A{\isacharprime}}, where the conclusion + \isa{A{\isacharprime}} is in HHF normal form. + + \item \verb|Assumption.add_assms|~\isa{r\ As} augments the context + by assumptions \isa{As} with export rule \isa{r}. The + resulting facts are hypothetical theorems as produced by the raw + \verb|Assumption.assume|. + + \item \verb|Assumption.add_assumes|~\isa{As} is a special case of + \verb|Assumption.add_assms| where the export rule performs \isa{{\isasymLongrightarrow}{\isacharunderscore}intro} or \isa{{\isacharhash}{\isasymLongrightarrow}{\isacharunderscore}intro}, depending on goal mode. + + \item \verb|Assumption.export|~\isa{is{\isacharunderscore}goal\ inner\ outer\ thm} + exports result \isa{thm} from the the \isa{inner} context + back into the \isa{outer} one; \isa{is{\isacharunderscore}goal\ {\isacharequal}\ true} means + this is a goal context. The result is in HHF normal form. Note + that \verb|ProofContext.export| combines \verb|Variable.export| + and \verb|Assumption.export| in the canonical way. + + \end{description}% +\end{isamarkuptext}% +\isamarkuptrue% +% +\endisatagmlref +{\isafoldmlref}% +% +\isadelimmlref +% +\endisadelimmlref +% +\isamarkupsection{Results \label{sec:results}% +} +\isamarkuptrue% +% +\begin{isamarkuptext}% +Local results are established by monotonic reasoning from facts + within a context. This allows common combinations of theorems, + e.g.\ via \isa{{\isasymAnd}{\isacharslash}{\isasymLongrightarrow}} elimination, resolution rules, or equational + reasoning, see \secref{sec:thms}. Unaccounted context manipulations + should be avoided, notably raw \isa{{\isasymAnd}{\isacharslash}{\isasymLongrightarrow}} introduction or ad-hoc + references to free variables or assumptions not present in the proof + context. + + \medskip The \isa{SUBPROOF} combinator allows to structure a + tactical proof recursively by decomposing a selected sub-goal: + \isa{{\isacharparenleft}{\isasymAnd}x{\isachardot}\ A{\isacharparenleft}x{\isacharparenright}\ {\isasymLongrightarrow}\ B{\isacharparenleft}x{\isacharparenright}{\isacharparenright}\ {\isasymLongrightarrow}\ {\isasymdots}} is turned into \isa{B{\isacharparenleft}x{\isacharparenright}\ {\isasymLongrightarrow}\ {\isasymdots}} + after fixing \isa{x} and assuming \isa{A{\isacharparenleft}x{\isacharparenright}}. This means + the tactic needs to solve the conclusion, but may use the premise as + a local fact, for locally fixed variables. + + The \isa{prove} operation provides an interface for structured + backwards reasoning under program control, with some explicit sanity + checks of the result. The goal context can be augmented by + additional fixed variables (cf.\ \secref{sec:variables}) and + assumptions (cf.\ \secref{sec:assumptions}), which will be available + as local facts during the proof and discharged into implications in + the result. Type and term variables are generalized as usual, + according to the context. + + The \isa{obtain} operation produces results by eliminating + existing facts by means of a given tactic. This acts like a dual + conclusion: the proof demonstrates that the context may be augmented + by certain fixed variables and assumptions. See also + \cite{isabelle-isar-ref} for the user-level \isa{{\isasymOBTAIN}} and + \isa{{\isasymGUESS}} elements. Final results, which may not refer to + the parameters in the conclusion, need to exported explicitly into + the original context.% +\end{isamarkuptext}% +\isamarkuptrue% +% +\isadelimmlref +% +\endisadelimmlref +% +\isatagmlref +% +\begin{isamarkuptext}% +\begin{mldecls} + \indexml{SUBPROOF}\verb|SUBPROOF: ({context: Proof.context, schematics: ctyp list * cterm list,|\isasep\isanewline% +\verb| params: cterm list, asms: cterm list, concl: cterm,|\isasep\isanewline% +\verb| prems: thm list} -> tactic) -> Proof.context -> int -> tactic| \\ + \end{mldecls} + \begin{mldecls} + \indexml{Goal.prove}\verb|Goal.prove: Proof.context -> string list -> term list -> term ->|\isasep\isanewline% +\verb| ({prems: thm list, context: Proof.context} -> tactic) -> thm| \\ + \indexml{Goal.prove\_multi}\verb|Goal.prove_multi: Proof.context -> string list -> term list -> term list ->|\isasep\isanewline% +\verb| ({prems: thm list, context: Proof.context} -> tactic) -> thm list| \\ + \end{mldecls} + \begin{mldecls} + \indexml{Obtain.result}\verb|Obtain.result: (Proof.context -> tactic) ->|\isasep\isanewline% +\verb| thm list -> Proof.context -> (cterm list * thm list) * Proof.context| \\ + \end{mldecls} + + \begin{description} + + \item \verb|SUBPROOF|~\isa{tac\ ctxt\ i} decomposes the structure + of the specified sub-goal, producing an extended context and a + reduced goal, which needs to be solved by the given tactic. All + schematic parameters of the goal are imported into the context as + fixed ones, which may not be instantiated in the sub-proof. + + \item \verb|Goal.prove|~\isa{ctxt\ xs\ As\ C\ tac} states goal \isa{C} in the context augmented by fixed variables \isa{xs} and + assumptions \isa{As}, and applies tactic \isa{tac} to solve + it. The latter may depend on the local assumptions being presented + as facts. The result is in HHF normal form. + + \item \verb|Goal.prove_multi| is simular to \verb|Goal.prove|, but + states several conclusions simultaneously. The goal is encoded by + means of Pure conjunction; \verb|Goal.conjunction_tac| will turn this + into a collection of individual subgoals. + + \item \verb|Obtain.result|~\isa{tac\ thms\ ctxt} eliminates the + given facts using a tactic, which results in additional fixed + variables and assumptions in the context. Final results need to be + exported explicitly. + + \end{description}% +\end{isamarkuptext}% +\isamarkuptrue% +% +\endisatagmlref +{\isafoldmlref}% +% +\isadelimmlref +% +\endisadelimmlref +% +\isadelimtheory +% +\endisadelimtheory +% +\isatagtheory +\isacommand{end}\isamarkupfalse% +% +\endisatagtheory +{\isafoldtheory}% +% +\isadelimtheory +% +\endisadelimtheory +\isanewline +\end{isabellebody}% +%%% Local Variables: +%%% mode: latex +%%% TeX-master: "root" +%%% End: diff -r 419116f1157a -r e23770bc97c8 doc-src/IsarImplementation/Thy/document/Tactic.tex --- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/doc-src/IsarImplementation/Thy/document/Tactic.tex Thu Feb 26 08:48:33 2009 -0800 @@ -0,0 +1,497 @@ +% +\begin{isabellebody}% +\def\isabellecontext{Tactic}% +% +\isadelimtheory +% +\endisadelimtheory +% +\isatagtheory +\isacommand{theory}\isamarkupfalse% +\ Tactic\isanewline +\isakeyword{imports}\ Base\isanewline +\isakeyword{begin}% +\endisatagtheory +{\isafoldtheory}% +% +\isadelimtheory +% +\endisadelimtheory +% +\isamarkupchapter{Tactical reasoning% +} +\isamarkuptrue% +% +\begin{isamarkuptext}% +Tactical reasoning works by refining the initial claim in a + backwards fashion, until a solved form is reached. A \isa{goal} + consists of several subgoals that need to be solved in order to + achieve the main statement; zero subgoals means that the proof may + be finished. A \isa{tactic} is a refinement operation that maps + a goal to a lazy sequence of potential successors. A \isa{tactical} is a combinator for composing tactics.% +\end{isamarkuptext}% +\isamarkuptrue% +% +\isamarkupsection{Goals \label{sec:tactical-goals}% +} +\isamarkuptrue% +% +\begin{isamarkuptext}% +Isabelle/Pure represents a goal as a theorem stating that the + subgoals imply the main goal: \isa{A\isactrlsub {\isadigit{1}}\ {\isasymLongrightarrow}\ {\isasymdots}\ {\isasymLongrightarrow}\ A\isactrlsub n\ {\isasymLongrightarrow}\ C}. The outermost goal structure is that of a Horn Clause: i.e.\ + an iterated implication without any quantifiers\footnote{Recall that + outermost \isa{{\isasymAnd}x{\isachardot}\ {\isasymphi}{\isacharbrackleft}x{\isacharbrackright}} is always represented via schematic + variables in the body: \isa{{\isasymphi}{\isacharbrackleft}{\isacharquery}x{\isacharbrackright}}. These variables may get + instantiated during the course of reasoning.}. For \isa{n\ {\isacharequal}\ {\isadigit{0}}} + a goal is called ``solved''. + + The structure of each subgoal \isa{A\isactrlsub i} is that of a + general Hereditary Harrop Formula \isa{{\isasymAnd}x\isactrlsub {\isadigit{1}}\ {\isasymdots}\ {\isasymAnd}x\isactrlsub k{\isachardot}\ H\isactrlsub {\isadigit{1}}\ {\isasymLongrightarrow}\ {\isasymdots}\ {\isasymLongrightarrow}\ H\isactrlsub m\ {\isasymLongrightarrow}\ B}. Here \isa{x\isactrlsub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ x\isactrlsub k} are goal parameters, i.e.\ + arbitrary-but-fixed entities of certain types, and \isa{H\isactrlsub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ H\isactrlsub m} are goal hypotheses, i.e.\ facts that may + be assumed locally. Together, this forms the goal context of the + conclusion \isa{B} to be established. The goal hypotheses may be + again arbitrary Hereditary Harrop Formulas, although the level of + nesting rarely exceeds 1--2 in practice. + + The main conclusion \isa{C} is internally marked as a protected + proposition, which is represented explicitly by the notation \isa{{\isacharhash}C}. This ensures that the decomposition into subgoals and main + conclusion is well-defined for arbitrarily structured claims. + + \medskip Basic goal management is performed via the following + Isabelle/Pure rules: + + \[ + \infer[\isa{{\isacharparenleft}init{\isacharparenright}}]{\isa{C\ {\isasymLongrightarrow}\ {\isacharhash}C}}{} \qquad + \infer[\isa{{\isacharparenleft}finish{\isacharparenright}}]{\isa{C}}{\isa{{\isacharhash}C}} + \] + + \medskip The following low-level variants admit general reasoning + with protected propositions: + + \[ + \infer[\isa{{\isacharparenleft}protect{\isacharparenright}}]{\isa{{\isacharhash}C}}{\isa{C}} \qquad + \infer[\isa{{\isacharparenleft}conclude{\isacharparenright}}]{\isa{A\isactrlsub {\isadigit{1}}\ {\isasymLongrightarrow}\ {\isasymdots}\ {\isasymLongrightarrow}\ A\isactrlsub n\ {\isasymLongrightarrow}\ C}}{\isa{A\isactrlsub {\isadigit{1}}\ {\isasymLongrightarrow}\ {\isasymdots}\ {\isasymLongrightarrow}\ A\isactrlsub n\ {\isasymLongrightarrow}\ {\isacharhash}C}} + \]% +\end{isamarkuptext}% +\isamarkuptrue% +% +\isadelimmlref +% +\endisadelimmlref +% +\isatagmlref +% +\begin{isamarkuptext}% +\begin{mldecls} + \indexml{Goal.init}\verb|Goal.init: cterm -> thm| \\ + \indexml{Goal.finish}\verb|Goal.finish: thm -> thm| \\ + \indexml{Goal.protect}\verb|Goal.protect: thm -> thm| \\ + \indexml{Goal.conclude}\verb|Goal.conclude: thm -> thm| \\ + \end{mldecls} + + \begin{description} + + \item \verb|Goal.init|~\isa{C} initializes a tactical goal from + the well-formed proposition \isa{C}. + + \item \verb|Goal.finish|~\isa{thm} checks whether theorem + \isa{thm} is a solved goal (no subgoals), and concludes the + result by removing the goal protection. + + \item \verb|Goal.protect|~\isa{thm} protects the full statement + of theorem \isa{thm}. + + \item \verb|Goal.conclude|~\isa{thm} removes the goal + protection, even if there are pending subgoals. + + \end{description}% +\end{isamarkuptext}% +\isamarkuptrue% +% +\endisatagmlref +{\isafoldmlref}% +% +\isadelimmlref +% +\endisadelimmlref +% +\isamarkupsection{Tactics% +} +\isamarkuptrue% +% +\begin{isamarkuptext}% +A \isa{tactic} is a function \isa{goal\ {\isasymrightarrow}\ goal\isactrlsup {\isacharasterisk}\isactrlsup {\isacharasterisk}} that + maps a given goal state (represented as a theorem, cf.\ + \secref{sec:tactical-goals}) to a lazy sequence of potential + successor states. The underlying sequence implementation is lazy + both in head and tail, and is purely functional in \emph{not} + supporting memoing.\footnote{The lack of memoing and the strict + nature of SML requires some care when working with low-level + sequence operations, to avoid duplicate or premature evaluation of + results.} + + An \emph{empty result sequence} means that the tactic has failed: in + a compound tactic expressions other tactics might be tried instead, + or the whole refinement step might fail outright, producing a + toplevel error message. When implementing tactics from scratch, one + should take care to observe the basic protocol of mapping regular + error conditions to an empty result; only serious faults should + emerge as exceptions. + + By enumerating \emph{multiple results}, a tactic can easily express + the potential outcome of an internal search process. There are also + combinators for building proof tools that involve search + systematically, see also \secref{sec:tacticals}. + + \medskip As explained in \secref{sec:tactical-goals}, a goal state + essentially consists of a list of subgoals that imply the main goal + (conclusion). Tactics may operate on all subgoals or on a + particularly specified subgoal, but must not change the main + conclusion (apart from instantiating schematic goal variables). + + Tactics with explicit \emph{subgoal addressing} are of the form + \isa{int\ {\isasymrightarrow}\ tactic} and may be applied to a particular subgoal + (counting from 1). If the subgoal number is out of range, the + tactic should fail with an empty result sequence, but must not raise + an exception! + + Operating on a particular subgoal means to replace it by an interval + of zero or more subgoals in the same place; other subgoals must not + be affected, apart from instantiating schematic variables ranging + over the whole goal state. + + A common pattern of composing tactics with subgoal addressing is to + try the first one, and then the second one only if the subgoal has + not been solved yet. Special care is required here to avoid bumping + into unrelated subgoals that happen to come after the original + subgoal. Assuming that there is only a single initial subgoal is a + very common error when implementing tactics! + + Tactics with internal subgoal addressing should expose the subgoal + index as \isa{int} argument in full generality; a hardwired + subgoal 1 inappropriate. + + \medskip The main well-formedness conditions for proper tactics are + summarized as follows. + + \begin{itemize} + + \item General tactic failure is indicated by an empty result, only + serious faults may produce an exception. + + \item The main conclusion must not be changed, apart from + instantiating schematic variables. + + \item A tactic operates either uniformly on all subgoals, or + specifically on a selected subgoal (without bumping into unrelated + subgoals). + + \item Range errors in subgoal addressing produce an empty result. + + \end{itemize} + + Some of these conditions are checked by higher-level goal + infrastructure (\secref{sec:results}); others are not checked + explicitly, and violating them merely results in ill-behaved tactics + experienced by the user (e.g.\ tactics that insist in being + applicable only to singleton goals, or disallow composition with + basic tacticals).% +\end{isamarkuptext}% +\isamarkuptrue% +% +\isadelimmlref +% +\endisadelimmlref +% +\isatagmlref +% +\begin{isamarkuptext}% +\begin{mldecls} + \indexmltype{tactic}\verb|type tactic = thm -> thm Seq.seq| \\ + \indexml{no\_tac}\verb|no_tac: tactic| \\ + \indexml{all\_tac}\verb|all_tac: tactic| \\ + \indexml{print\_tac}\verb|print_tac: string -> tactic| \\[1ex] + \indexml{PRIMITIVE}\verb|PRIMITIVE: (thm -> thm) -> tactic| \\[1ex] + \indexml{SUBGOAL}\verb|SUBGOAL: (term * int -> tactic) -> int -> tactic| \\ + \indexml{CSUBGOAL}\verb|CSUBGOAL: (cterm * int -> tactic) -> int -> tactic| \\ + \end{mldecls} + + \begin{description} + + \item \verb|tactic| represents tactics. The well-formedness + conditions described above need to be observed. See also \hyperlink{file.~~/src/Pure/General/seq.ML}{\mbox{\isa{\isatt{{\isachartilde}{\isachartilde}{\isacharslash}src{\isacharslash}Pure{\isacharslash}General{\isacharslash}seq{\isachardot}ML}}}} for the underlying implementation of + lazy sequences. + + \item \verb|int -> tactic| represents tactics with explicit + subgoal addressing, with well-formedness conditions as described + above. + + \item \verb|no_tac| is a tactic that always fails, returning the + empty sequence. + + \item \verb|all_tac| is a tactic that always succeeds, returning a + singleton sequence with unchanged goal state. + + \item \verb|print_tac|~\isa{message} is like \verb|all_tac|, but + prints a message together with the goal state on the tracing + channel. + + \item \verb|PRIMITIVE|~\isa{rule} turns a primitive inference rule + into a tactic with unique result. Exception \verb|THM| is considered + a regular tactic failure and produces an empty result; other + exceptions are passed through. + + \item \verb|SUBGOAL|~\isa{{\isacharparenleft}fn\ {\isacharparenleft}subgoal{\isacharcomma}\ i{\isacharparenright}\ {\isacharequal}{\isachargreater}\ tactic{\isacharparenright}} is the + most basic form to produce a tactic with subgoal addressing. The + given abstraction over the subgoal term and subgoal number allows to + peek at the relevant information of the full goal state. The + subgoal range is checked as required above. + + \item \verb|CSUBGOAL| is similar to \verb|SUBGOAL|, but passes the + subgoal as \verb|cterm| instead of raw \verb|term|. This + avoids expensive re-certification in situations where the subgoal is + used directly for primitive inferences. + + \end{description}% +\end{isamarkuptext}% +\isamarkuptrue% +% +\endisatagmlref +{\isafoldmlref}% +% +\isadelimmlref +% +\endisadelimmlref +% +\isamarkupsubsection{Resolution and assumption tactics \label{sec:resolve-assume-tac}% +} +\isamarkuptrue% +% +\begin{isamarkuptext}% +\emph{Resolution} is the most basic mechanism for refining a + subgoal using a theorem as object-level rule. + \emph{Elim-resolution} is particularly suited for elimination rules: + it resolves with a rule, proves its first premise by assumption, and + finally deletes that assumption from any new subgoals. + \emph{Destruct-resolution} is like elim-resolution, but the given + destruction rules are first turned into canonical elimination + format. \emph{Forward-resolution} is like destruct-resolution, but + without deleting the selected assumption. The \isa{r{\isacharslash}e{\isacharslash}d{\isacharslash}f} + naming convention is maintained for several different kinds of + resolution rules and tactics. + + Assumption tactics close a subgoal by unifying some of its premises + against its conclusion. + + \medskip All the tactics in this section operate on a subgoal + designated by a positive integer. Other subgoals might be affected + indirectly, due to instantiation of schematic variables. + + There are various sources of non-determinism, the tactic result + sequence enumerates all possibilities of the following choices (if + applicable): + + \begin{enumerate} + + \item selecting one of the rules given as argument to the tactic; + + \item selecting a subgoal premise to eliminate, unifying it against + the first premise of the rule; + + \item unifying the conclusion of the subgoal to the conclusion of + the rule. + + \end{enumerate} + + Recall that higher-order unification may produce multiple results + that are enumerated here.% +\end{isamarkuptext}% +\isamarkuptrue% +% +\isadelimmlref +% +\endisadelimmlref +% +\isatagmlref +% +\begin{isamarkuptext}% +\begin{mldecls} + \indexml{resolve\_tac}\verb|resolve_tac: thm list -> int -> tactic| \\ + \indexml{eresolve\_tac}\verb|eresolve_tac: thm list -> int -> tactic| \\ + \indexml{dresolve\_tac}\verb|dresolve_tac: thm list -> int -> tactic| \\ + \indexml{forward\_tac}\verb|forward_tac: thm list -> int -> tactic| \\[1ex] + \indexml{assume\_tac}\verb|assume_tac: int -> tactic| \\ + \indexml{eq\_assume\_tac}\verb|eq_assume_tac: int -> tactic| \\[1ex] + \indexml{match\_tac}\verb|match_tac: thm list -> int -> tactic| \\ + \indexml{ematch\_tac}\verb|ematch_tac: thm list -> int -> tactic| \\ + \indexml{dmatch\_tac}\verb|dmatch_tac: thm list -> int -> tactic| \\ + \end{mldecls} + + \begin{description} + + \item \verb|resolve_tac|~\isa{thms\ i} refines the goal state + using the given theorems, which should normally be introduction + rules. The tactic resolves a rule's conclusion with subgoal \isa{i}, replacing it by the corresponding versions of the rule's + premises. + + \item \verb|eresolve_tac|~\isa{thms\ i} performs elim-resolution + with the given theorems, which should normally be elimination rules. + + \item \verb|dresolve_tac|~\isa{thms\ i} performs + destruct-resolution with the given theorems, which should normally + be destruction rules. This replaces an assumption by the result of + applying one of the rules. + + \item \verb|forward_tac| is like \verb|dresolve_tac| except that the + selected assumption is not deleted. It applies a rule to an + assumption, adding the result as a new assumption. + + \item \verb|assume_tac|~\isa{i} attempts to solve subgoal \isa{i} + by assumption (modulo higher-order unification). + + \item \verb|eq_assume_tac| is similar to \verb|assume_tac|, but checks + only for immediate \isa{{\isasymalpha}}-convertibility instead of using + unification. It succeeds (with a unique next state) if one of the + assumptions is equal to the subgoal's conclusion. Since it does not + instantiate variables, it cannot make other subgoals unprovable. + + \item \verb|match_tac|, \verb|ematch_tac|, and \verb|dmatch_tac| are + similar to \verb|resolve_tac|, \verb|eresolve_tac|, and \verb|dresolve_tac|, respectively, but do not instantiate schematic + variables in the goal state. + + Flexible subgoals are not updated at will, but are left alone. + Strictly speaking, matching means to treat the unknowns in the goal + state as constants; these tactics merely discard unifiers that would + update the goal state. + + \end{description}% +\end{isamarkuptext}% +\isamarkuptrue% +% +\endisatagmlref +{\isafoldmlref}% +% +\isadelimmlref +% +\endisadelimmlref +% +\isamarkupsubsection{Explicit instantiation within a subgoal context% +} +\isamarkuptrue% +% +\begin{isamarkuptext}% +The main resolution tactics (\secref{sec:resolve-assume-tac}) + use higher-order unification, which works well in many practical + situations despite its daunting theoretical properties. + Nonetheless, there are important problem classes where unguided + higher-order unification is not so useful. This typically involves + rules like universal elimination, existential introduction, or + equational substitution. Here the unification problem involves + fully flexible \isa{{\isacharquery}P\ {\isacharquery}x} schemes, which are hard to manage + without further hints. + + By providing a (small) rigid term for \isa{{\isacharquery}x} explicitly, the + remaining unification problem is to assign a (large) term to \isa{{\isacharquery}P}, according to the shape of the given subgoal. This is + sufficiently well-behaved in most practical situations. + + \medskip Isabelle provides separate versions of the standard \isa{r{\isacharslash}e{\isacharslash}d{\isacharslash}f} resolution tactics that allow to provide explicit + instantiations of unknowns of the given rule, wrt.\ terms that refer + to the implicit context of the selected subgoal. + + An instantiation consists of a list of pairs of the form \isa{{\isacharparenleft}{\isacharquery}x{\isacharcomma}\ t{\isacharparenright}}, where \isa{{\isacharquery}x} is a schematic variable occurring in + the given rule, and \isa{t} is a term from the current proof + context, augmented by the local goal parameters of the selected + subgoal; cf.\ the \isa{focus} operation described in + \secref{sec:variables}. + + Entering the syntactic context of a subgoal is a brittle operation, + because its exact form is somewhat accidental, and the choice of + bound variable names depends on the presence of other local and + global names. Explicit renaming of subgoal parameters prior to + explicit instantiation might help to achieve a bit more robustness. + + Type instantiations may be given as well, via pairs like \isa{{\isacharparenleft}{\isacharquery}{\isacharprime}a{\isacharcomma}\ {\isasymtau}{\isacharparenright}}. Type instantiations are distinguished from term + instantiations by the syntactic form of the schematic variable. + Types are instantiated before terms are. Since term instantiation + already performs type-inference as expected, explicit type + instantiations are seldom necessary.% +\end{isamarkuptext}% +\isamarkuptrue% +% +\isadelimmlref +% +\endisadelimmlref +% +\isatagmlref +% +\begin{isamarkuptext}% +\begin{mldecls} + \indexml{res\_inst\_tac}\verb|res_inst_tac: Proof.context -> (indexname * string) list -> thm -> int -> tactic| \\ + \indexml{eres\_inst\_tac}\verb|eres_inst_tac: Proof.context -> (indexname * string) list -> thm -> int -> tactic| \\ + \indexml{dres\_inst\_tac}\verb|dres_inst_tac: Proof.context -> (indexname * string) list -> thm -> int -> tactic| \\ + \indexml{forw\_inst\_tac}\verb|forw_inst_tac: Proof.context -> (indexname * string) list -> thm -> int -> tactic| \\[1ex] + \indexml{rename\_tac}\verb|rename_tac: string list -> int -> tactic| \\ + \end{mldecls} + + \begin{description} + + \item \verb|res_inst_tac|~\isa{ctxt\ insts\ thm\ i} instantiates the + rule \isa{thm} with the instantiations \isa{insts}, as described + above, and then performs resolution on subgoal \isa{i}. + + \item \verb|eres_inst_tac| is like \verb|res_inst_tac|, but performs + elim-resolution. + + \item \verb|dres_inst_tac| is like \verb|res_inst_tac|, but performs + destruct-resolution. + + \item \verb|forw_inst_tac| is like \verb|dres_inst_tac| except that + the selected assumption is not deleted. + + \item \verb|rename_tac|~\isa{names\ i} renames the innermost + parameters of subgoal \isa{i} according to the provided \isa{names} (which need to be distinct indentifiers). + + \end{description}% +\end{isamarkuptext}% +\isamarkuptrue% +% +\endisatagmlref +{\isafoldmlref}% +% +\isadelimmlref +% +\endisadelimmlref +% +\isamarkupsection{Tacticals \label{sec:tacticals}% +} +\isamarkuptrue% +% +\begin{isamarkuptext}% +A \emph{tactical} is a functional combinator for building up complex + tactics from simpler ones. Typical tactical perform sequential + composition, disjunction (choice), iteration, or goal addressing. + Various search strategies may be expressed via tacticals. + + \medskip FIXME% +\end{isamarkuptext}% +\isamarkuptrue% +% +\isadelimtheory +% +\endisadelimtheory +% +\isatagtheory +\isacommand{end}\isamarkupfalse% +% +\endisatagtheory +{\isafoldtheory}% +% +\isadelimtheory +% +\endisadelimtheory +\isanewline +\end{isabellebody}% +%%% Local Variables: +%%% mode: latex +%%% TeX-master: "root" +%%% End: diff -r 419116f1157a -r e23770bc97c8 doc-src/IsarImplementation/Thy/document/base.tex --- a/doc-src/IsarImplementation/Thy/document/base.tex Thu Feb 26 08:44:44 2009 -0800 +++ /dev/null Thu Jan 01 00:00:00 1970 +0000 @@ -1,32 +0,0 @@ -% -\begin{isabellebody}% -\def\isabellecontext{base}% -% -\isadelimtheory -\isanewline -\isanewline -\isanewline -% -\endisadelimtheory -% -\isatagtheory -\isacommand{theory}\isamarkupfalse% -\ base\isanewline -\isakeyword{imports}\ Pure\isanewline -\isakeyword{uses}\ {\isachardoublequoteopen}{\isachardot}{\isachardot}{\isacharslash}{\isachardot}{\isachardot}{\isacharslash}antiquote{\isacharunderscore}setup{\isachardot}ML{\isachardoublequoteclose}\isanewline -\isakeyword{begin}\isanewline -\isanewline -\isacommand{end}\isamarkupfalse% -% -\endisatagtheory -{\isafoldtheory}% -% -\isadelimtheory -\isanewline -% -\endisadelimtheory -\end{isabellebody}% -%%% Local Variables: -%%% mode: latex -%%% TeX-master: "root" -%%% End: diff -r 419116f1157a -r e23770bc97c8 doc-src/IsarImplementation/Thy/document/integration.tex --- a/doc-src/IsarImplementation/Thy/document/integration.tex Thu Feb 26 08:44:44 2009 -0800 +++ /dev/null Thu Jan 01 00:00:00 1970 +0000 @@ -1,521 +0,0 @@ -% -\begin{isabellebody}% -\def\isabellecontext{integration}% -% -\isadelimtheory -\isanewline -\isanewline -\isanewline -% -\endisadelimtheory -% -\isatagtheory -\isacommand{theory}\isamarkupfalse% -\ integration\ \isakeyword{imports}\ base\ \isakeyword{begin}% -\endisatagtheory -{\isafoldtheory}% -% -\isadelimtheory -% -\endisadelimtheory -% -\isamarkupchapter{System integration% -} -\isamarkuptrue% -% -\isamarkupsection{Isar toplevel \label{sec:isar-toplevel}% -} -\isamarkuptrue% -% -\begin{isamarkuptext}% -The Isar toplevel may be considered the centeral hub of the - Isabelle/Isar system, where all key components and sub-systems are - integrated into a single read-eval-print loop of Isar commands. We - shall even incorporate the existing {\ML} toplevel of the compiler - and run-time system (cf.\ \secref{sec:ML-toplevel}). - - Isabelle/Isar departs from the original ``LCF system architecture'' - where {\ML} was really The Meta Language for defining theories and - conducting proofs. Instead, {\ML} now only serves as the - implementation language for the system (and user extensions), while - the specific Isar toplevel supports the concepts of theory and proof - development natively. This includes the graph structure of theories - and the block structure of proofs, support for unlimited undo, - facilities for tracing, debugging, timing, profiling etc. - - \medskip The toplevel maintains an implicit state, which is - transformed by a sequence of transitions -- either interactively or - in batch-mode. In interactive mode, Isar state transitions are - encapsulated as safe transactions, such that both failure and undo - are handled conveniently without destroying the underlying draft - theory (cf.~\secref{sec:context-theory}). In batch mode, - transitions operate in a linear (destructive) fashion, such that - error conditions abort the present attempt to construct a theory or - proof altogether. - - The toplevel state is a disjoint sum of empty \isa{toplevel}, or - \isa{theory}, or \isa{proof}. On entering the main Isar loop we - start with an empty toplevel. A theory is commenced by giving a - \isa{{\isasymTHEORY}} header; within a theory we may issue theory - commands such as \isa{{\isasymDEFINITION}}, or state a \isa{{\isasymTHEOREM}} to be proven. Now we are within a proof state, with a - rich collection of Isar proof commands for structured proof - composition, or unstructured proof scripts. When the proof is - concluded we get back to the theory, which is then updated by - storing the resulting fact. Further theory declarations or theorem - statements with proofs may follow, until we eventually conclude the - theory development by issuing \isa{{\isasymEND}}. The resulting theory - is then stored within the theory database and we are back to the - empty toplevel. - - In addition to these proper state transformations, there are also - some diagnostic commands for peeking at the toplevel state without - modifying it (e.g.\ \isakeyword{thm}, \isakeyword{term}, - \isakeyword{print-cases}).% -\end{isamarkuptext}% -\isamarkuptrue% -% -\isadelimmlref -% -\endisadelimmlref -% -\isatagmlref -% -\begin{isamarkuptext}% -\begin{mldecls} - \indexmltype{Toplevel.state}\verb|type Toplevel.state| \\ - \indexml{Toplevel.UNDEF}\verb|Toplevel.UNDEF: exn| \\ - \indexml{Toplevel.is\_toplevel}\verb|Toplevel.is_toplevel: Toplevel.state -> bool| \\ - \indexml{Toplevel.theory\_of}\verb|Toplevel.theory_of: Toplevel.state -> theory| \\ - \indexml{Toplevel.proof\_of}\verb|Toplevel.proof_of: Toplevel.state -> Proof.state| \\ - \indexml{Toplevel.debug}\verb|Toplevel.debug: bool ref| \\ - \indexml{Toplevel.timing}\verb|Toplevel.timing: bool ref| \\ - \indexml{Toplevel.profiling}\verb|Toplevel.profiling: int ref| \\ - \end{mldecls} - - \begin{description} - - \item \verb|Toplevel.state| represents Isar toplevel states, - which are normally manipulated through the concept of toplevel - transitions only (\secref{sec:toplevel-transition}). Also note that - a raw toplevel state is subject to the same linearity restrictions - as a theory context (cf.~\secref{sec:context-theory}). - - \item \verb|Toplevel.UNDEF| is raised for undefined toplevel - operations. Many operations work only partially for certain cases, - since \verb|Toplevel.state| is a sum type. - - \item \verb|Toplevel.is_toplevel|~\isa{state} checks for an empty - toplevel state. - - \item \verb|Toplevel.theory_of|~\isa{state} selects the theory of - a theory or proof (!), otherwise raises \verb|Toplevel.UNDEF|. - - \item \verb|Toplevel.proof_of|~\isa{state} selects the Isar proof - state if available, otherwise raises \verb|Toplevel.UNDEF|. - - \item \verb|set Toplevel.debug| makes the toplevel print further - details about internal error conditions, exceptions being raised - etc. - - \item \verb|set Toplevel.timing| makes the toplevel print timing - information for each Isar command being executed. - - \item \verb|Toplevel.profiling|~\verb|:=|~\isa{n} controls - low-level profiling of the underlying {\ML} runtime system. For - Poly/ML, \isa{n\ {\isacharequal}\ {\isadigit{1}}} means time and \isa{n\ {\isacharequal}\ {\isadigit{2}}} space - profiling. - - \end{description}% -\end{isamarkuptext}% -\isamarkuptrue% -% -\endisatagmlref -{\isafoldmlref}% -% -\isadelimmlref -% -\endisadelimmlref -% -\isamarkupsubsection{Toplevel transitions \label{sec:toplevel-transition}% -} -\isamarkuptrue% -% -\begin{isamarkuptext}% -An Isar toplevel transition consists of a partial function on the - toplevel state, with additional information for diagnostics and - error reporting: there are fields for command name, source position, - optional source text, as well as flags for interactive-only commands - (which issue a warning in batch-mode), printing of result state, - etc. - - The operational part is represented as the sequential union of a - list of partial functions, which are tried in turn until the first - one succeeds. This acts like an outer case-expression for various - alternative state transitions. For example, \isakeyword{qed} acts - differently for a local proofs vs.\ the global ending of the main - proof. - - Toplevel transitions are composed via transition transformers. - Internally, Isar commands are put together from an empty transition - extended by name and source position (and optional source text). It - is then left to the individual command parser to turn the given - concrete syntax into a suitable transition transformer that adjoin - actual operations on a theory or proof state etc.% -\end{isamarkuptext}% -\isamarkuptrue% -% -\isadelimmlref -% -\endisadelimmlref -% -\isatagmlref -% -\begin{isamarkuptext}% -\begin{mldecls} - \indexml{Toplevel.print}\verb|Toplevel.print: Toplevel.transition -> Toplevel.transition| \\ - \indexml{Toplevel.no\_timing}\verb|Toplevel.no_timing: Toplevel.transition -> Toplevel.transition| \\ - \indexml{Toplevel.keep}\verb|Toplevel.keep: (Toplevel.state -> unit) ->|\isasep\isanewline% -\verb| Toplevel.transition -> Toplevel.transition| \\ - \indexml{Toplevel.theory}\verb|Toplevel.theory: (theory -> theory) ->|\isasep\isanewline% -\verb| Toplevel.transition -> Toplevel.transition| \\ - \indexml{Toplevel.theory\_to\_proof}\verb|Toplevel.theory_to_proof: (theory -> Proof.state) ->|\isasep\isanewline% -\verb| Toplevel.transition -> Toplevel.transition| \\ - \indexml{Toplevel.proof}\verb|Toplevel.proof: (Proof.state -> Proof.state) ->|\isasep\isanewline% -\verb| Toplevel.transition -> Toplevel.transition| \\ - \indexml{Toplevel.proofs}\verb|Toplevel.proofs: (Proof.state -> Proof.state Seq.seq) ->|\isasep\isanewline% -\verb| Toplevel.transition -> Toplevel.transition| \\ - \indexml{Toplevel.end\_proof}\verb|Toplevel.end_proof: (bool -> Proof.state -> Proof.context) ->|\isasep\isanewline% -\verb| Toplevel.transition -> Toplevel.transition| \\ - \end{mldecls} - - \begin{description} - - \item \verb|Toplevel.print|~\isa{tr} sets the print flag, which - causes the toplevel loop to echo the result state (in interactive - mode). - - \item \verb|Toplevel.no_timing|~\isa{tr} indicates that the - transition should never show timing information, e.g.\ because it is - a diagnostic command. - - \item \verb|Toplevel.keep|~\isa{tr} adjoins a diagnostic - function. - - \item \verb|Toplevel.theory|~\isa{tr} adjoins a theory - transformer. - - \item \verb|Toplevel.theory_to_proof|~\isa{tr} adjoins a global - goal function, which turns a theory into a proof state. The theory - may be changed before entering the proof; the generic Isar goal - setup includes an argument that specifies how to apply the proven - result to the theory, when the proof is finished. - - \item \verb|Toplevel.proof|~\isa{tr} adjoins a deterministic - proof command, with a singleton result. - - \item \verb|Toplevel.proofs|~\isa{tr} adjoins a general proof - command, with zero or more result states (represented as a lazy - list). - - \item \verb|Toplevel.end_proof|~\isa{tr} adjoins a concluding - proof command, that returns the resulting theory, after storing the - resulting facts in the context etc. - - \end{description}% -\end{isamarkuptext}% -\isamarkuptrue% -% -\endisatagmlref -{\isafoldmlref}% -% -\isadelimmlref -% -\endisadelimmlref -% -\isamarkupsubsection{Toplevel control% -} -\isamarkuptrue% -% -\begin{isamarkuptext}% -There are a few special control commands that modify the behavior - the toplevel itself, and only make sense in interactive mode. Under - normal circumstances, the user encounters these only implicitly as - part of the protocol between the Isabelle/Isar system and a - user-interface such as ProofGeneral. - - \begin{description} - - \item \isacommand{undo} follows the three-level hierarchy of empty - toplevel vs.\ theory vs.\ proof: undo within a proof reverts to the - previous proof context, undo after a proof reverts to the theory - before the initial goal statement, undo of a theory command reverts - to the previous theory value, undo of a theory header discontinues - the current theory development and removes it from the theory - database (\secref{sec:theory-database}). - - \item \isacommand{kill} aborts the current level of development: - kill in a proof context reverts to the theory before the initial - goal statement, kill in a theory context aborts the current theory - development, removing it from the database. - - \item \isacommand{exit} drops out of the Isar toplevel into the - underlying {\ML} toplevel (\secref{sec:ML-toplevel}). The Isar - toplevel state is preserved and may be continued later. - - \item \isacommand{quit} terminates the Isabelle/Isar process without - saving. - - \end{description}% -\end{isamarkuptext}% -\isamarkuptrue% -% -\isamarkupsection{ML toplevel \label{sec:ML-toplevel}% -} -\isamarkuptrue% -% -\begin{isamarkuptext}% -The {\ML} toplevel provides a read-compile-eval-print loop for {\ML} - values, types, structures, and functors. {\ML} declarations operate - on the global system state, which consists of the compiler - environment plus the values of {\ML} reference variables. There is - no clean way to undo {\ML} declarations, except for reverting to a - previously saved state of the whole Isabelle process. {\ML} input - is either read interactively from a TTY, or from a string (usually - within a theory text), or from a source file (usually loaded from a - theory). - - Whenever the {\ML} toplevel is active, the current Isabelle theory - context is passed as an internal reference variable. Thus {\ML} - code may access the theory context during compilation, it may even - change the value of a theory being under construction --- while - observing the usual linearity restrictions - (cf.~\secref{sec:context-theory}).% -\end{isamarkuptext}% -\isamarkuptrue% -% -\isadelimmlref -% -\endisadelimmlref -% -\isatagmlref -% -\begin{isamarkuptext}% -\begin{mldecls} - \indexml{the\_context}\verb|the_context: unit -> theory| \\ - \indexml{Context.$>$$>$ }\verb|Context.>> : (Context.generic -> Context.generic) -> unit| \\ - \end{mldecls} - - \begin{description} - - \item \verb|the_context ()| refers to the theory context of the - {\ML} toplevel --- at compile time! {\ML} code needs to take care - to refer to \verb|the_context ()| correctly. Recall that - evaluation of a function body is delayed until actual runtime. - Moreover, persistent {\ML} toplevel bindings to an unfinished theory - should be avoided: code should either project out the desired - information immediately, or produce an explicit \verb|theory_ref| (cf.\ \secref{sec:context-theory}). - - \item \verb|Context.>>|~\isa{f} applies context transformation - \isa{f} to the implicit context of the {\ML} toplevel. - - \end{description} - - It is very important to note that the above functions are really - restricted to the compile time, even though the {\ML} compiler is - invoked at runtime! The majority of {\ML} code uses explicit - functional arguments of a theory or proof context instead. Thus it - may be invoked for an arbitrary context later on, without having to - worry about any operational details. - - \bigskip - - \begin{mldecls} - \indexml{Isar.main}\verb|Isar.main: unit -> unit| \\ - \indexml{Isar.loop}\verb|Isar.loop: unit -> unit| \\ - \indexml{Isar.state}\verb|Isar.state: unit -> Toplevel.state| \\ - \indexml{Isar.exn}\verb|Isar.exn: unit -> (exn * string) option| \\ - \indexml{Isar.context}\verb|Isar.context: unit -> Proof.context| \\ - \indexml{Isar.goal}\verb|Isar.goal: unit -> thm| \\ - \end{mldecls} - - \begin{description} - - \item \verb|Isar.main ()| invokes the Isar toplevel from {\ML}, - initializing an empty toplevel state. - - \item \verb|Isar.loop ()| continues the Isar toplevel with the - current state, after having dropped out of the Isar toplevel loop. - - \item \verb|Isar.state ()| and \verb|Isar.exn ()| get current - toplevel state and error condition, respectively. This only works - after having dropped out of the Isar toplevel loop. - - \item \verb|Isar.context ()| produces the proof context from \verb|Isar.state ()|, analogous to \verb|Context.proof_of| - (\secref{sec:generic-context}). - - \item \verb|Isar.goal ()| picks the tactical goal from \verb|Isar.state ()|, represented as a theorem according to - \secref{sec:tactical-goals}. - - \end{description}% -\end{isamarkuptext}% -\isamarkuptrue% -% -\endisatagmlref -{\isafoldmlref}% -% -\isadelimmlref -% -\endisadelimmlref -% -\isamarkupsection{Theory database \label{sec:theory-database}% -} -\isamarkuptrue% -% -\begin{isamarkuptext}% -The theory database maintains a collection of theories, together - with some administrative information about their original sources, - which are held in an external store (i.e.\ some directory within the - regular file system). - - The theory database is organized as a directed acyclic graph; - entries are referenced by theory name. Although some additional - interfaces allow to include a directory specification as well, this - is only a hint to the underlying theory loader. The internal theory - name space is flat! - - Theory \isa{A} is associated with the main theory file \isa{A}\verb,.thy,, which needs to be accessible through the theory - loader path. Any number of additional {\ML} source files may be - associated with each theory, by declaring these dependencies in the - theory header as \isa{{\isasymUSES}}, and loading them consecutively - within the theory context. The system keeps track of incoming {\ML} - sources and associates them with the current theory. The file - \isa{A}\verb,.ML, is loaded after a theory has been concluded, in - order to support legacy proof {\ML} proof scripts. - - The basic internal actions of the theory database are \isa{update}, \isa{outdate}, and \isa{remove}: - - \begin{itemize} - - \item \isa{update\ A} introduces a link of \isa{A} with a - \isa{theory} value of the same name; it asserts that the theory - sources are now consistent with that value; - - \item \isa{outdate\ A} invalidates the link of a theory database - entry to its sources, but retains the present theory value; - - \item \isa{remove\ A} deletes entry \isa{A} from the theory - database. - - \end{itemize} - - These actions are propagated to sub- or super-graphs of a theory - entry as expected, in order to preserve global consistency of the - state of all loaded theories with the sources of the external store. - This implies certain causalities between actions: \isa{update} - or \isa{outdate} of an entry will \isa{outdate} all - descendants; \isa{remove} will \isa{remove} all descendants. - - \medskip There are separate user-level interfaces to operate on the - theory database directly or indirectly. The primitive actions then - just happen automatically while working with the system. In - particular, processing a theory header \isa{{\isasymTHEORY}\ A\ {\isasymIMPORTS}\ B\isactrlsub {\isadigit{1}}\ {\isasymdots}\ B\isactrlsub n\ {\isasymBEGIN}} ensures that the - sub-graph of the collective imports \isa{B\isactrlsub {\isadigit{1}}\ {\isasymdots}\ B\isactrlsub n} - is up-to-date, too. Earlier theories are reloaded as required, with - \isa{update} actions proceeding in topological order according to - theory dependencies. There may be also a wave of implied \isa{outdate} actions for derived theory nodes until a stable situation - is achieved eventually.% -\end{isamarkuptext}% -\isamarkuptrue% -% -\isadelimmlref -% -\endisadelimmlref -% -\isatagmlref -% -\begin{isamarkuptext}% -\begin{mldecls} - \indexml{theory}\verb|theory: string -> theory| \\ - \indexml{use\_thy}\verb|use_thy: string -> unit| \\ - \indexml{use\_thys}\verb|use_thys: string list -> unit| \\ - \indexml{ThyInfo.touch\_thy}\verb|ThyInfo.touch_thy: string -> unit| \\ - \indexml{ThyInfo.remove\_thy}\verb|ThyInfo.remove_thy: string -> unit| \\[1ex] - \indexml{ThyInfo.begin\_theory}\verb|ThyInfo.begin_theory|\verb|: ... -> bool -> theory| \\ - \indexml{ThyInfo.end\_theory}\verb|ThyInfo.end_theory: theory -> unit| \\ - \indexml{ThyInfo.register\_theory}\verb|ThyInfo.register_theory: theory -> unit| \\[1ex] - \verb|datatype action = Update |\verb,|,\verb| Outdate |\verb,|,\verb| Remove| \\ - \indexml{ThyInfo.add\_hook}\verb|ThyInfo.add_hook: (ThyInfo.action -> string -> unit) -> unit| \\ - \end{mldecls} - - \begin{description} - - \item \verb|theory|~\isa{A} retrieves the theory value presently - associated with name \isa{A}. Note that the result might be - outdated. - - \item \verb|use_thy|~\isa{A} ensures that theory \isa{A} is fully - up-to-date wrt.\ the external file store, reloading outdated - ancestors as required. - - \item \verb|use_thys| is similar to \verb|use_thy|, but handles - several theories simultaneously. Thus it acts like processing the - import header of a theory, without performing the merge of the - result, though. - - \item \verb|ThyInfo.touch_thy|~\isa{A} performs and \isa{outdate} action - on theory \isa{A} and all descendants. - - \item \verb|ThyInfo.remove_thy|~\isa{A} deletes theory \isa{A} and all - descendants from the theory database. - - \item \verb|ThyInfo.begin_theory| is the basic operation behind a - \isa{{\isasymTHEORY}} header declaration. This is {\ML} functions is - normally not invoked directly. - - \item \verb|ThyInfo.end_theory| concludes the loading of a theory - proper and stores the result in the theory database. - - \item \verb|ThyInfo.register_theory|~\isa{text\ thy} registers an - existing theory value with the theory loader database. There is no - management of associated sources. - - \item \verb|ThyInfo.add_hook|~\isa{f} registers function \isa{f} as a hook for theory database actions. The function will be - invoked with the action and theory name being involved; thus derived - actions may be performed in associated system components, e.g.\ - maintaining the state of an editor for the theory sources. - - The kind and order of actions occurring in practice depends both on - user interactions and the internal process of resolving theory - imports. Hooks should not rely on a particular policy here! Any - exceptions raised by the hook are ignored. - - \end{description}% -\end{isamarkuptext}% -\isamarkuptrue% -% -\endisatagmlref -{\isafoldmlref}% -% -\isadelimmlref -% -\endisadelimmlref -% -\isadelimtheory -% -\endisadelimtheory -% -\isatagtheory -\isacommand{end}\isamarkupfalse% -% -\endisatagtheory -{\isafoldtheory}% -% -\isadelimtheory -% -\endisadelimtheory -\isanewline -\end{isabellebody}% -%%% Local Variables: -%%% mode: latex -%%% TeX-master: "root" -%%% End: diff -r 419116f1157a -r e23770bc97c8 doc-src/IsarImplementation/Thy/document/isar.tex --- a/doc-src/IsarImplementation/Thy/document/isar.tex Thu Feb 26 08:44:44 2009 -0800 +++ /dev/null Thu Jan 01 00:00:00 1970 +0000 @@ -1,91 +0,0 @@ -% -\begin{isabellebody}% -\def\isabellecontext{isar}% -% -\isadelimtheory -\isanewline -\isanewline -\isanewline -% -\endisadelimtheory -% -\isatagtheory -\isacommand{theory}\isamarkupfalse% -\ isar\ \isakeyword{imports}\ base\ \isakeyword{begin}% -\endisatagtheory -{\isafoldtheory}% -% -\isadelimtheory -% -\endisadelimtheory -% -\isamarkupchapter{Isar proof texts% -} -\isamarkuptrue% -% -\isamarkupsection{Proof context% -} -\isamarkuptrue% -% -\begin{isamarkuptext}% -FIXME% -\end{isamarkuptext}% -\isamarkuptrue% -% -\isamarkupsection{Proof state \label{sec:isar-proof-state}% -} -\isamarkuptrue% -% -\begin{isamarkuptext}% -FIXME - -\glossary{Proof state}{The whole configuration of a structured proof, -consisting of a \seeglossary{proof context} and an optional -\seeglossary{structured goal}. Internally, an Isar proof state is -organized as a stack to accomodate block structure of proof texts. -For historical reasons, a low-level \seeglossary{tactical goal} is -occasionally called ``proof state'' as well.} - -\glossary{Structured goal}{FIXME} - -\glossary{Goal}{See \seeglossary{tactical goal} or \seeglossary{structured goal}. \norefpage}% -\end{isamarkuptext}% -\isamarkuptrue% -% -\isamarkupsection{Proof methods% -} -\isamarkuptrue% -% -\begin{isamarkuptext}% -FIXME% -\end{isamarkuptext}% -\isamarkuptrue% -% -\isamarkupsection{Attributes% -} -\isamarkuptrue% -% -\begin{isamarkuptext}% -FIXME ?!% -\end{isamarkuptext}% -\isamarkuptrue% -% -\isadelimtheory -% -\endisadelimtheory -% -\isatagtheory -\isacommand{end}\isamarkupfalse% -% -\endisatagtheory -{\isafoldtheory}% -% -\isadelimtheory -% -\endisadelimtheory -\isanewline -\end{isabellebody}% -%%% Local Variables: -%%% mode: latex -%%% TeX-master: "root" -%%% End: diff -r 419116f1157a -r e23770bc97c8 doc-src/IsarImplementation/Thy/document/locale.tex --- a/doc-src/IsarImplementation/Thy/document/locale.tex Thu Feb 26 08:44:44 2009 -0800 +++ /dev/null Thu Jan 01 00:00:00 1970 +0000 @@ -1,73 +0,0 @@ -% -\begin{isabellebody}% -\def\isabellecontext{locale}% -% -\isadelimtheory -\isanewline -\isanewline -\isanewline -% -\endisadelimtheory -% -\isatagtheory -\isacommand{theory}\isamarkupfalse% -\ {\isachardoublequoteopen}locale{\isachardoublequoteclose}\ \isakeyword{imports}\ base\ \isakeyword{begin}% -\endisatagtheory -{\isafoldtheory}% -% -\isadelimtheory -% -\endisadelimtheory -% -\isamarkupchapter{Structured specifications% -} -\isamarkuptrue% -% -\isamarkupsection{Specification elements% -} -\isamarkuptrue% -% -\begin{isamarkuptext}% -FIXME% -\end{isamarkuptext}% -\isamarkuptrue% -% -\isamarkupsection{Type-inference% -} -\isamarkuptrue% -% -\begin{isamarkuptext}% -FIXME% -\end{isamarkuptext}% -\isamarkuptrue% -% -\isamarkupsection{Local theories% -} -\isamarkuptrue% -% -\begin{isamarkuptext}% -FIXME - - \glossary{Local theory}{FIXME}% -\end{isamarkuptext}% -\isamarkuptrue% -% -\isadelimtheory -% -\endisadelimtheory -% -\isatagtheory -\isacommand{end}\isamarkupfalse% -% -\endisatagtheory -{\isafoldtheory}% -% -\isadelimtheory -% -\endisadelimtheory -\isanewline -\end{isabellebody}% -%%% Local Variables: -%%% mode: latex -%%% TeX-master: "root" -%%% End: diff -r 419116f1157a -r e23770bc97c8 doc-src/IsarImplementation/Thy/document/logic.tex --- a/doc-src/IsarImplementation/Thy/document/logic.tex Thu Feb 26 08:44:44 2009 -0800 +++ /dev/null Thu Jan 01 00:00:00 1970 +0000 @@ -1,886 +0,0 @@ -% -\begin{isabellebody}% -\def\isabellecontext{logic}% -% -\isadelimtheory -% -\endisadelimtheory -% -\isatagtheory -\isacommand{theory}\isamarkupfalse% -\ logic\ \isakeyword{imports}\ base\ \isakeyword{begin}% -\endisatagtheory -{\isafoldtheory}% -% -\isadelimtheory -% -\endisadelimtheory -% -\isamarkupchapter{Primitive logic \label{ch:logic}% -} -\isamarkuptrue% -% -\begin{isamarkuptext}% -The logical foundations of Isabelle/Isar are that of the Pure logic, - which has been introduced as a natural-deduction framework in - \cite{paulson700}. This is essentially the same logic as ``\isa{{\isasymlambda}HOL}'' in the more abstract setting of Pure Type Systems (PTS) - \cite{Barendregt-Geuvers:2001}, although there are some key - differences in the specific treatment of simple types in - Isabelle/Pure. - - Following type-theoretic parlance, the Pure logic consists of three - levels of \isa{{\isasymlambda}}-calculus with corresponding arrows, \isa{{\isasymRightarrow}} for syntactic function space (terms depending on terms), \isa{{\isasymAnd}} for universal quantification (proofs depending on terms), and - \isa{{\isasymLongrightarrow}} for implication (proofs depending on proofs). - - Derivations are relative to a logical theory, which declares type - constructors, constants, and axioms. Theory declarations support - schematic polymorphism, which is strictly speaking outside the - logic.\footnote{This is the deeper logical reason, why the theory - context \isa{{\isasymTheta}} is separate from the proof context \isa{{\isasymGamma}} - of the core calculus.}% -\end{isamarkuptext}% -\isamarkuptrue% -% -\isamarkupsection{Types \label{sec:types}% -} -\isamarkuptrue% -% -\begin{isamarkuptext}% -The language of types is an uninterpreted order-sorted first-order - algebra; types are qualified by ordered type classes. - - \medskip A \emph{type class} is an abstract syntactic entity - declared in the theory context. The \emph{subclass relation} \isa{c\isactrlisub {\isadigit{1}}\ {\isasymsubseteq}\ c\isactrlisub {\isadigit{2}}} is specified by stating an acyclic - generating relation; the transitive closure is maintained - internally. The resulting relation is an ordering: reflexive, - transitive, and antisymmetric. - - A \emph{sort} is a list of type classes written as \isa{s\ {\isacharequal}\ {\isacharbraceleft}c\isactrlisub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ c\isactrlisub m{\isacharbraceright}}, which represents symbolic - intersection. Notationally, the curly braces are omitted for - singleton intersections, i.e.\ any class \isa{c} may be read as - a sort \isa{{\isacharbraceleft}c{\isacharbraceright}}. The ordering on type classes is extended to - sorts according to the meaning of intersections: \isa{{\isacharbraceleft}c\isactrlisub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}\ c\isactrlisub m{\isacharbraceright}\ {\isasymsubseteq}\ {\isacharbraceleft}d\isactrlisub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ d\isactrlisub n{\isacharbraceright}} iff - \isa{{\isasymforall}j{\isachardot}\ {\isasymexists}i{\isachardot}\ c\isactrlisub i\ {\isasymsubseteq}\ d\isactrlisub j}. The empty intersection - \isa{{\isacharbraceleft}{\isacharbraceright}} refers to the universal sort, which is the largest - element wrt.\ the sort order. The intersections of all (finitely - many) classes declared in the current theory are the minimal - elements wrt.\ the sort order. - - \medskip A \emph{fixed type variable} is a pair of a basic name - (starting with a \isa{{\isacharprime}} character) and a sort constraint, e.g.\ - \isa{{\isacharparenleft}{\isacharprime}a{\isacharcomma}\ s{\isacharparenright}} which is usually printed as \isa{{\isasymalpha}\isactrlisub s}. - A \emph{schematic type variable} is a pair of an indexname and a - sort constraint, e.g.\ \isa{{\isacharparenleft}{\isacharparenleft}{\isacharprime}a{\isacharcomma}\ {\isadigit{0}}{\isacharparenright}{\isacharcomma}\ s{\isacharparenright}} which is usually - printed as \isa{{\isacharquery}{\isasymalpha}\isactrlisub s}. - - Note that \emph{all} syntactic components contribute to the identity - of type variables, including the sort constraint. The core logic - handles type variables with the same name but different sorts as - different, although some outer layers of the system make it hard to - produce anything like this. - - A \emph{type constructor} \isa{{\isasymkappa}} is a \isa{k}-ary operator - on types declared in the theory. Type constructor application is - written postfix as \isa{{\isacharparenleft}{\isasymalpha}\isactrlisub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ {\isasymalpha}\isactrlisub k{\isacharparenright}{\isasymkappa}}. For - \isa{k\ {\isacharequal}\ {\isadigit{0}}} the argument tuple is omitted, e.g.\ \isa{prop} - instead of \isa{{\isacharparenleft}{\isacharparenright}prop}. For \isa{k\ {\isacharequal}\ {\isadigit{1}}} the parentheses - are omitted, e.g.\ \isa{{\isasymalpha}\ list} instead of \isa{{\isacharparenleft}{\isasymalpha}{\isacharparenright}list}. - Further notation is provided for specific constructors, notably the - right-associative infix \isa{{\isasymalpha}\ {\isasymRightarrow}\ {\isasymbeta}} instead of \isa{{\isacharparenleft}{\isasymalpha}{\isacharcomma}\ {\isasymbeta}{\isacharparenright}fun}. - - A \emph{type} is defined inductively over type variables and type - constructors as follows: \isa{{\isasymtau}\ {\isacharequal}\ {\isasymalpha}\isactrlisub s\ {\isacharbar}\ {\isacharquery}{\isasymalpha}\isactrlisub s\ {\isacharbar}\ {\isacharparenleft}{\isasymtau}\isactrlsub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ {\isasymtau}\isactrlsub k{\isacharparenright}{\isasymkappa}}. - - A \emph{type abbreviation} is a syntactic definition \isa{{\isacharparenleft}\isactrlvec {\isasymalpha}{\isacharparenright}{\isasymkappa}\ {\isacharequal}\ {\isasymtau}} of an arbitrary type expression \isa{{\isasymtau}} over - variables \isa{\isactrlvec {\isasymalpha}}. Type abbreviations appear as type - constructors in the syntax, but are expanded before entering the - logical core. - - A \emph{type arity} declares the image behavior of a type - constructor wrt.\ the algebra of sorts: \isa{{\isasymkappa}\ {\isacharcolon}{\isacharcolon}\ {\isacharparenleft}s\isactrlisub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ s\isactrlisub k{\isacharparenright}s} means that \isa{{\isacharparenleft}{\isasymtau}\isactrlisub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ {\isasymtau}\isactrlisub k{\isacharparenright}{\isasymkappa}} is - of sort \isa{s} if every argument type \isa{{\isasymtau}\isactrlisub i} is - of sort \isa{s\isactrlisub i}. Arity declarations are implicitly - completed, i.e.\ \isa{{\isasymkappa}\ {\isacharcolon}{\isacharcolon}\ {\isacharparenleft}\isactrlvec s{\isacharparenright}c} entails \isa{{\isasymkappa}\ {\isacharcolon}{\isacharcolon}\ {\isacharparenleft}\isactrlvec s{\isacharparenright}c{\isacharprime}} for any \isa{c{\isacharprime}\ {\isasymsupseteq}\ c}. - - \medskip The sort algebra is always maintained as \emph{coregular}, - which means that type arities are consistent with the subclass - relation: for any type constructor \isa{{\isasymkappa}}, and classes \isa{c\isactrlisub {\isadigit{1}}\ {\isasymsubseteq}\ c\isactrlisub {\isadigit{2}}}, and arities \isa{{\isasymkappa}\ {\isacharcolon}{\isacharcolon}\ {\isacharparenleft}\isactrlvec s\isactrlisub {\isadigit{1}}{\isacharparenright}c\isactrlisub {\isadigit{1}}} and \isa{{\isasymkappa}\ {\isacharcolon}{\isacharcolon}\ {\isacharparenleft}\isactrlvec s\isactrlisub {\isadigit{2}}{\isacharparenright}c\isactrlisub {\isadigit{2}}} holds \isa{\isactrlvec s\isactrlisub {\isadigit{1}}\ {\isasymsubseteq}\ \isactrlvec s\isactrlisub {\isadigit{2}}} component-wise. - - The key property of a coregular order-sorted algebra is that sort - constraints can be solved in a most general fashion: for each type - constructor \isa{{\isasymkappa}} and sort \isa{s} there is a most general - vector of argument sorts \isa{{\isacharparenleft}s\isactrlisub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ s\isactrlisub k{\isacharparenright}} such - that a type scheme \isa{{\isacharparenleft}{\isasymalpha}\isactrlbsub s\isactrlisub {\isadigit{1}}\isactrlesub {\isacharcomma}\ {\isasymdots}{\isacharcomma}\ {\isasymalpha}\isactrlbsub s\isactrlisub k\isactrlesub {\isacharparenright}{\isasymkappa}} is of sort \isa{s}. - Consequently, type unification has most general solutions (modulo - equivalence of sorts), so type-inference produces primary types as - expected \cite{nipkow-prehofer}.% -\end{isamarkuptext}% -\isamarkuptrue% -% -\isadelimmlref -% -\endisadelimmlref -% -\isatagmlref -% -\begin{isamarkuptext}% -\begin{mldecls} - \indexmltype{class}\verb|type class| \\ - \indexmltype{sort}\verb|type sort| \\ - \indexmltype{arity}\verb|type arity| \\ - \indexmltype{typ}\verb|type typ| \\ - \indexml{map\_atyps}\verb|map_atyps: (typ -> typ) -> typ -> typ| \\ - \indexml{fold\_atyps}\verb|fold_atyps: (typ -> 'a -> 'a) -> typ -> 'a -> 'a| \\ - \end{mldecls} - \begin{mldecls} - \indexml{Sign.subsort}\verb|Sign.subsort: theory -> sort * sort -> bool| \\ - \indexml{Sign.of\_sort}\verb|Sign.of_sort: theory -> typ * sort -> bool| \\ - \indexml{Sign.add\_types}\verb|Sign.add_types: (string * int * mixfix) list -> theory -> theory| \\ - \indexml{Sign.add\_tyabbrs\_i}\verb|Sign.add_tyabbrs_i: |\isasep\isanewline% -\verb| (string * string list * typ * mixfix) list -> theory -> theory| \\ - \indexml{Sign.primitive\_class}\verb|Sign.primitive_class: string * class list -> theory -> theory| \\ - \indexml{Sign.primitive\_classrel}\verb|Sign.primitive_classrel: class * class -> theory -> theory| \\ - \indexml{Sign.primitive\_arity}\verb|Sign.primitive_arity: arity -> theory -> theory| \\ - \end{mldecls} - - \begin{description} - - \item \verb|class| represents type classes; this is an alias for - \verb|string|. - - \item \verb|sort| represents sorts; this is an alias for - \verb|class list|. - - \item \verb|arity| represents type arities; this is an alias for - triples of the form \isa{{\isacharparenleft}{\isasymkappa}{\isacharcomma}\ \isactrlvec s{\isacharcomma}\ s{\isacharparenright}} for \isa{{\isasymkappa}\ {\isacharcolon}{\isacharcolon}\ {\isacharparenleft}\isactrlvec s{\isacharparenright}s} described above. - - \item \verb|typ| represents types; this is a datatype with - constructors \verb|TFree|, \verb|TVar|, \verb|Type|. - - \item \verb|map_atyps|~\isa{f\ {\isasymtau}} applies the mapping \isa{f} - to all atomic types (\verb|TFree|, \verb|TVar|) occurring in \isa{{\isasymtau}}. - - \item \verb|fold_atyps|~\isa{f\ {\isasymtau}} iterates the operation \isa{f} over all occurrences of atomic types (\verb|TFree|, \verb|TVar|) - in \isa{{\isasymtau}}; the type structure is traversed from left to right. - - \item \verb|Sign.subsort|~\isa{thy\ {\isacharparenleft}s\isactrlisub {\isadigit{1}}{\isacharcomma}\ s\isactrlisub {\isadigit{2}}{\isacharparenright}} - tests the subsort relation \isa{s\isactrlisub {\isadigit{1}}\ {\isasymsubseteq}\ s\isactrlisub {\isadigit{2}}}. - - \item \verb|Sign.of_sort|~\isa{thy\ {\isacharparenleft}{\isasymtau}{\isacharcomma}\ s{\isacharparenright}} tests whether type - \isa{{\isasymtau}} is of sort \isa{s}. - - \item \verb|Sign.add_types|~\isa{{\isacharbrackleft}{\isacharparenleft}{\isasymkappa}{\isacharcomma}\ k{\isacharcomma}\ mx{\isacharparenright}{\isacharcomma}\ {\isasymdots}{\isacharbrackright}} declares a new - type constructors \isa{{\isasymkappa}} with \isa{k} arguments and - optional mixfix syntax. - - \item \verb|Sign.add_tyabbrs_i|~\isa{{\isacharbrackleft}{\isacharparenleft}{\isasymkappa}{\isacharcomma}\ \isactrlvec {\isasymalpha}{\isacharcomma}\ {\isasymtau}{\isacharcomma}\ mx{\isacharparenright}{\isacharcomma}\ {\isasymdots}{\isacharbrackright}} - defines a new type abbreviation \isa{{\isacharparenleft}\isactrlvec {\isasymalpha}{\isacharparenright}{\isasymkappa}\ {\isacharequal}\ {\isasymtau}} with - optional mixfix syntax. - - \item \verb|Sign.primitive_class|~\isa{{\isacharparenleft}c{\isacharcomma}\ {\isacharbrackleft}c\isactrlisub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ c\isactrlisub n{\isacharbrackright}{\isacharparenright}} declares a new class \isa{c}, together with class - relations \isa{c\ {\isasymsubseteq}\ c\isactrlisub i}, for \isa{i\ {\isacharequal}\ {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ n}. - - \item \verb|Sign.primitive_classrel|~\isa{{\isacharparenleft}c\isactrlisub {\isadigit{1}}{\isacharcomma}\ c\isactrlisub {\isadigit{2}}{\isacharparenright}} declares the class relation \isa{c\isactrlisub {\isadigit{1}}\ {\isasymsubseteq}\ c\isactrlisub {\isadigit{2}}}. - - \item \verb|Sign.primitive_arity|~\isa{{\isacharparenleft}{\isasymkappa}{\isacharcomma}\ \isactrlvec s{\isacharcomma}\ s{\isacharparenright}} declares - the arity \isa{{\isasymkappa}\ {\isacharcolon}{\isacharcolon}\ {\isacharparenleft}\isactrlvec s{\isacharparenright}s}. - - \end{description}% -\end{isamarkuptext}% -\isamarkuptrue% -% -\endisatagmlref -{\isafoldmlref}% -% -\isadelimmlref -% -\endisadelimmlref -% -\isamarkupsection{Terms \label{sec:terms}% -} -\isamarkuptrue% -% -\begin{isamarkuptext}% -\glossary{Term}{FIXME} - - The language of terms is that of simply-typed \isa{{\isasymlambda}}-calculus - with de-Bruijn indices for bound variables (cf.\ \cite{debruijn72} - or \cite{paulson-ml2}), with the types being determined determined - by the corresponding binders. In contrast, free variables and - constants are have an explicit name and type in each occurrence. - - \medskip A \emph{bound variable} is a natural number \isa{b}, - which accounts for the number of intermediate binders between the - variable occurrence in the body and its binding position. For - example, the de-Bruijn term \isa{{\isasymlambda}\isactrlbsub nat\isactrlesub {\isachardot}\ {\isasymlambda}\isactrlbsub nat\isactrlesub {\isachardot}\ {\isadigit{1}}\ {\isacharplus}\ {\isadigit{0}}} would - correspond to \isa{{\isasymlambda}x\isactrlbsub nat\isactrlesub {\isachardot}\ {\isasymlambda}y\isactrlbsub nat\isactrlesub {\isachardot}\ x\ {\isacharplus}\ y} in a named - representation. Note that a bound variable may be represented by - different de-Bruijn indices at different occurrences, depending on - the nesting of abstractions. - - A \emph{loose variable} is a bound variable that is outside the - scope of local binders. The types (and names) for loose variables - can be managed as a separate context, that is maintained as a stack - of hypothetical binders. The core logic operates on closed terms, - without any loose variables. - - A \emph{fixed variable} is a pair of a basic name and a type, e.g.\ - \isa{{\isacharparenleft}x{\isacharcomma}\ {\isasymtau}{\isacharparenright}} which is usually printed \isa{x\isactrlisub {\isasymtau}}. A - \emph{schematic variable} is a pair of an indexname and a type, - e.g.\ \isa{{\isacharparenleft}{\isacharparenleft}x{\isacharcomma}\ {\isadigit{0}}{\isacharparenright}{\isacharcomma}\ {\isasymtau}{\isacharparenright}} which is usually printed as \isa{{\isacharquery}x\isactrlisub {\isasymtau}}. - - \medskip A \emph{constant} is a pair of a basic name and a type, - e.g.\ \isa{{\isacharparenleft}c{\isacharcomma}\ {\isasymtau}{\isacharparenright}} which is usually printed as \isa{c\isactrlisub {\isasymtau}}. Constants are declared in the context as polymorphic - families \isa{c\ {\isacharcolon}{\isacharcolon}\ {\isasymsigma}}, meaning that all substitution instances - \isa{c\isactrlisub {\isasymtau}} for \isa{{\isasymtau}\ {\isacharequal}\ {\isasymsigma}{\isasymvartheta}} are valid. - - The vector of \emph{type arguments} of constant \isa{c\isactrlisub {\isasymtau}} - wrt.\ the declaration \isa{c\ {\isacharcolon}{\isacharcolon}\ {\isasymsigma}} is defined as the codomain of - the matcher \isa{{\isasymvartheta}\ {\isacharequal}\ {\isacharbraceleft}{\isacharquery}{\isasymalpha}\isactrlisub {\isadigit{1}}\ {\isasymmapsto}\ {\isasymtau}\isactrlisub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ {\isacharquery}{\isasymalpha}\isactrlisub n\ {\isasymmapsto}\ {\isasymtau}\isactrlisub n{\isacharbraceright}} presented in canonical order \isa{{\isacharparenleft}{\isasymtau}\isactrlisub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ {\isasymtau}\isactrlisub n{\isacharparenright}}. Within a given theory context, - there is a one-to-one correspondence between any constant \isa{c\isactrlisub {\isasymtau}} and the application \isa{c{\isacharparenleft}{\isasymtau}\isactrlisub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ {\isasymtau}\isactrlisub n{\isacharparenright}} of its type arguments. For example, with \isa{plus\ {\isacharcolon}{\isacharcolon}\ {\isasymalpha}\ {\isasymRightarrow}\ {\isasymalpha}\ {\isasymRightarrow}\ {\isasymalpha}}, the instance \isa{plus\isactrlbsub nat\ {\isasymRightarrow}\ nat\ {\isasymRightarrow}\ nat\isactrlesub } corresponds to \isa{plus{\isacharparenleft}nat{\isacharparenright}}. - - Constant declarations \isa{c\ {\isacharcolon}{\isacharcolon}\ {\isasymsigma}} may contain sort constraints - for type variables in \isa{{\isasymsigma}}. These are observed by - type-inference as expected, but \emph{ignored} by the core logic. - This means the primitive logic is able to reason with instances of - polymorphic constants that the user-level type-checker would reject - due to violation of type class restrictions. - - \medskip An \emph{atomic} term is either a variable or constant. A - \emph{term} is defined inductively over atomic terms, with - abstraction and application as follows: \isa{t\ {\isacharequal}\ b\ {\isacharbar}\ x\isactrlisub {\isasymtau}\ {\isacharbar}\ {\isacharquery}x\isactrlisub {\isasymtau}\ {\isacharbar}\ c\isactrlisub {\isasymtau}\ {\isacharbar}\ {\isasymlambda}\isactrlisub {\isasymtau}{\isachardot}\ t\ {\isacharbar}\ t\isactrlisub {\isadigit{1}}\ t\isactrlisub {\isadigit{2}}}. - Parsing and printing takes care of converting between an external - representation with named bound variables. Subsequently, we shall - use the latter notation instead of internal de-Bruijn - representation. - - The inductive relation \isa{t\ {\isacharcolon}{\isacharcolon}\ {\isasymtau}} assigns a (unique) type to a - term according to the structure of atomic terms, abstractions, and - applicatins: - \[ - \infer{\isa{a\isactrlisub {\isasymtau}\ {\isacharcolon}{\isacharcolon}\ {\isasymtau}}}{} - \qquad - \infer{\isa{{\isacharparenleft}{\isasymlambda}x\isactrlsub {\isasymtau}{\isachardot}\ t{\isacharparenright}\ {\isacharcolon}{\isacharcolon}\ {\isasymtau}\ {\isasymRightarrow}\ {\isasymsigma}}}{\isa{t\ {\isacharcolon}{\isacharcolon}\ {\isasymsigma}}} - \qquad - \infer{\isa{t\ u\ {\isacharcolon}{\isacharcolon}\ {\isasymsigma}}}{\isa{t\ {\isacharcolon}{\isacharcolon}\ {\isasymtau}\ {\isasymRightarrow}\ {\isasymsigma}} & \isa{u\ {\isacharcolon}{\isacharcolon}\ {\isasymtau}}} - \] - A \emph{well-typed term} is a term that can be typed according to these rules. - - Typing information can be omitted: type-inference is able to - reconstruct the most general type of a raw term, while assigning - most general types to all of its variables and constants. - Type-inference depends on a context of type constraints for fixed - variables, and declarations for polymorphic constants. - - The identity of atomic terms consists both of the name and the type - component. This means that different variables \isa{x\isactrlbsub {\isasymtau}\isactrlisub {\isadigit{1}}\isactrlesub } and \isa{x\isactrlbsub {\isasymtau}\isactrlisub {\isadigit{2}}\isactrlesub } may become the same after type - instantiation. Some outer layers of the system make it hard to - produce variables of the same name, but different types. In - contrast, mixed instances of polymorphic constants occur frequently. - - \medskip The \emph{hidden polymorphism} of a term \isa{t\ {\isacharcolon}{\isacharcolon}\ {\isasymsigma}} - is the set of type variables occurring in \isa{t}, but not in - \isa{{\isasymsigma}}. This means that the term implicitly depends on type - arguments that are not accounted in the result type, i.e.\ there are - different type instances \isa{t{\isasymvartheta}\ {\isacharcolon}{\isacharcolon}\ {\isasymsigma}} and \isa{t{\isasymvartheta}{\isacharprime}\ {\isacharcolon}{\isacharcolon}\ {\isasymsigma}} with the same type. This slightly - pathological situation notoriously demands additional care. - - \medskip A \emph{term abbreviation} is a syntactic definition \isa{c\isactrlisub {\isasymsigma}\ {\isasymequiv}\ t} of a closed term \isa{t} of type \isa{{\isasymsigma}}, - without any hidden polymorphism. A term abbreviation looks like a - constant in the syntax, but is expanded before entering the logical - core. Abbreviations are usually reverted when printing terms, using - \isa{t\ {\isasymrightarrow}\ c\isactrlisub {\isasymsigma}} as rules for higher-order rewriting. - - \medskip Canonical operations on \isa{{\isasymlambda}}-terms include \isa{{\isasymalpha}{\isasymbeta}{\isasymeta}}-conversion: \isa{{\isasymalpha}}-conversion refers to capture-free - renaming of bound variables; \isa{{\isasymbeta}}-conversion contracts an - abstraction applied to an argument term, substituting the argument - in the body: \isa{{\isacharparenleft}{\isasymlambda}x{\isachardot}\ b{\isacharparenright}a} becomes \isa{b{\isacharbrackleft}a{\isacharslash}x{\isacharbrackright}}; \isa{{\isasymeta}}-conversion contracts vacuous application-abstraction: \isa{{\isasymlambda}x{\isachardot}\ f\ x} becomes \isa{f}, provided that the bound variable - does not occur in \isa{f}. - - Terms are normally treated modulo \isa{{\isasymalpha}}-conversion, which is - implicit in the de-Bruijn representation. Names for bound variables - in abstractions are maintained separately as (meaningless) comments, - mostly for parsing and printing. Full \isa{{\isasymalpha}{\isasymbeta}{\isasymeta}}-conversion is - commonplace in various standard operations (\secref{sec:obj-rules}) - that are based on higher-order unification and matching.% -\end{isamarkuptext}% -\isamarkuptrue% -% -\isadelimmlref -% -\endisadelimmlref -% -\isatagmlref -% -\begin{isamarkuptext}% -\begin{mldecls} - \indexmltype{term}\verb|type term| \\ - \indexml{op aconv}\verb|op aconv: term * term -> bool| \\ - \indexml{map\_types}\verb|map_types: (typ -> typ) -> term -> term| \\ - \indexml{fold\_types}\verb|fold_types: (typ -> 'a -> 'a) -> term -> 'a -> 'a| \\ - \indexml{map\_aterms}\verb|map_aterms: (term -> term) -> term -> term| \\ - \indexml{fold\_aterms}\verb|fold_aterms: (term -> 'a -> 'a) -> term -> 'a -> 'a| \\ - \end{mldecls} - \begin{mldecls} - \indexml{fastype\_of}\verb|fastype_of: term -> typ| \\ - \indexml{lambda}\verb|lambda: term -> term -> term| \\ - \indexml{betapply}\verb|betapply: term * term -> term| \\ - \indexml{Sign.declare\_const}\verb|Sign.declare_const: Properties.T -> (binding * typ) * mixfix ->|\isasep\isanewline% -\verb| theory -> term * theory| \\ - \indexml{Sign.add\_abbrev}\verb|Sign.add_abbrev: string -> Properties.T -> binding * term ->|\isasep\isanewline% -\verb| theory -> (term * term) * theory| \\ - \indexml{Sign.const\_typargs}\verb|Sign.const_typargs: theory -> string * typ -> typ list| \\ - \indexml{Sign.const\_instance}\verb|Sign.const_instance: theory -> string * typ list -> typ| \\ - \end{mldecls} - - \begin{description} - - \item \verb|term| represents de-Bruijn terms, with comments in - abstractions, and explicitly named free variables and constants; - this is a datatype with constructors \verb|Bound|, \verb|Free|, \verb|Var|, \verb|Const|, \verb|Abs|, \verb|op $|. - - \item \isa{t}~\verb|aconv|~\isa{u} checks \isa{{\isasymalpha}}-equivalence of two terms. This is the basic equality relation - on type \verb|term|; raw datatype equality should only be used - for operations related to parsing or printing! - - \item \verb|map_types|~\isa{f\ t} applies the mapping \isa{f} to all types occurring in \isa{t}. - - \item \verb|fold_types|~\isa{f\ t} iterates the operation \isa{f} over all occurrences of types in \isa{t}; the term - structure is traversed from left to right. - - \item \verb|map_aterms|~\isa{f\ t} applies the mapping \isa{f} - to all atomic terms (\verb|Bound|, \verb|Free|, \verb|Var|, \verb|Const|) occurring in \isa{t}. - - \item \verb|fold_aterms|~\isa{f\ t} iterates the operation \isa{f} over all occurrences of atomic terms (\verb|Bound|, \verb|Free|, - \verb|Var|, \verb|Const|) in \isa{t}; the term structure is - traversed from left to right. - - \item \verb|fastype_of|~\isa{t} determines the type of a - well-typed term. This operation is relatively slow, despite the - omission of any sanity checks. - - \item \verb|lambda|~\isa{a\ b} produces an abstraction \isa{{\isasymlambda}a{\isachardot}\ b}, where occurrences of the atomic term \isa{a} in the - body \isa{b} are replaced by bound variables. - - \item \verb|betapply|~\isa{{\isacharparenleft}t{\isacharcomma}\ u{\isacharparenright}} produces an application \isa{t\ u}, with topmost \isa{{\isasymbeta}}-conversion if \isa{t} is an - abstraction. - - \item \verb|Sign.declare_const|~\isa{properties\ {\isacharparenleft}{\isacharparenleft}c{\isacharcomma}\ {\isasymsigma}{\isacharparenright}{\isacharcomma}\ mx{\isacharparenright}} - declares a new constant \isa{c\ {\isacharcolon}{\isacharcolon}\ {\isasymsigma}} with optional mixfix - syntax. - - \item \verb|Sign.add_abbrev|~\isa{print{\isacharunderscore}mode\ properties\ {\isacharparenleft}c{\isacharcomma}\ t{\isacharparenright}} - introduces a new term abbreviation \isa{c\ {\isasymequiv}\ t}. - - \item \verb|Sign.const_typargs|~\isa{thy\ {\isacharparenleft}c{\isacharcomma}\ {\isasymtau}{\isacharparenright}} and \verb|Sign.const_instance|~\isa{thy\ {\isacharparenleft}c{\isacharcomma}\ {\isacharbrackleft}{\isasymtau}\isactrlisub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ {\isasymtau}\isactrlisub n{\isacharbrackright}{\isacharparenright}} - convert between two representations of polymorphic constants: full - type instance vs.\ compact type arguments form. - - \end{description}% -\end{isamarkuptext}% -\isamarkuptrue% -% -\endisatagmlref -{\isafoldmlref}% -% -\isadelimmlref -% -\endisadelimmlref -% -\isamarkupsection{Theorems \label{sec:thms}% -} -\isamarkuptrue% -% -\begin{isamarkuptext}% -\glossary{Proposition}{FIXME A \seeglossary{term} of - \seeglossary{type} \isa{prop}. Internally, there is nothing - special about propositions apart from their type, but the concrete - syntax enforces a clear distinction. Propositions are structured - via implication \isa{A\ {\isasymLongrightarrow}\ B} or universal quantification \isa{{\isasymAnd}x{\isachardot}\ B\ x} --- anything else is considered atomic. The canonical - form for propositions is that of a \seeglossary{Hereditary Harrop - Formula}. FIXME} - - \glossary{Theorem}{A proven proposition within a certain theory and - proof context, formally \isa{{\isasymGamma}\ {\isasymturnstile}\isactrlsub {\isasymTheta}\ {\isasymphi}}; both contexts are - rarely spelled out explicitly. Theorems are usually normalized - according to the \seeglossary{HHF} format. FIXME} - - \glossary{Fact}{Sometimes used interchangeably for - \seeglossary{theorem}. Strictly speaking, a list of theorems, - essentially an extra-logical conjunction. Facts emerge either as - local assumptions, or as results of local goal statements --- both - may be simultaneous, hence the list representation. FIXME} - - \glossary{Schematic variable}{FIXME} - - \glossary{Fixed variable}{A variable that is bound within a certain - proof context; an arbitrary-but-fixed entity within a portion of - proof text. FIXME} - - \glossary{Free variable}{Synonymous for \seeglossary{fixed - variable}. FIXME} - - \glossary{Bound variable}{FIXME} - - \glossary{Variable}{See \seeglossary{schematic variable}, - \seeglossary{fixed variable}, \seeglossary{bound variable}, or - \seeglossary{type variable}. The distinguishing feature of - different variables is their binding scope. FIXME} - - A \emph{proposition} is a well-typed term of type \isa{prop}, a - \emph{theorem} is a proven proposition (depending on a context of - hypotheses and the background theory). Primitive inferences include - plain natural deduction rules for the primary connectives \isa{{\isasymAnd}} and \isa{{\isasymLongrightarrow}} of the framework. There is also a builtin - notion of equality/equivalence \isa{{\isasymequiv}}.% -\end{isamarkuptext}% -\isamarkuptrue% -% -\isamarkupsubsection{Primitive connectives and rules \label{sec:prim-rules}% -} -\isamarkuptrue% -% -\begin{isamarkuptext}% -The theory \isa{Pure} contains constant declarations for the - primitive connectives \isa{{\isasymAnd}}, \isa{{\isasymLongrightarrow}}, and \isa{{\isasymequiv}} of - the logical framework, see \figref{fig:pure-connectives}. The - derivability judgment \isa{A\isactrlisub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ A\isactrlisub n\ {\isasymturnstile}\ B} is - defined inductively by the primitive inferences given in - \figref{fig:prim-rules}, with the global restriction that the - hypotheses must \emph{not} contain any schematic variables. The - builtin equality is conceptually axiomatized as shown in - \figref{fig:pure-equality}, although the implementation works - directly with derived inferences. - - \begin{figure}[htb] - \begin{center} - \begin{tabular}{ll} - \isa{all\ {\isacharcolon}{\isacharcolon}\ {\isacharparenleft}{\isasymalpha}\ {\isasymRightarrow}\ prop{\isacharparenright}\ {\isasymRightarrow}\ prop} & universal quantification (binder \isa{{\isasymAnd}}) \\ - \isa{{\isasymLongrightarrow}\ {\isacharcolon}{\isacharcolon}\ prop\ {\isasymRightarrow}\ prop\ {\isasymRightarrow}\ prop} & implication (right associative infix) \\ - \isa{{\isasymequiv}\ {\isacharcolon}{\isacharcolon}\ {\isasymalpha}\ {\isasymRightarrow}\ {\isasymalpha}\ {\isasymRightarrow}\ prop} & equality relation (infix) \\ - \end{tabular} - \caption{Primitive connectives of Pure}\label{fig:pure-connectives} - \end{center} - \end{figure} - - \begin{figure}[htb] - \begin{center} - \[ - \infer[\isa{{\isacharparenleft}axiom{\isacharparenright}}]{\isa{{\isasymturnstile}\ A}}{\isa{A\ {\isasymin}\ {\isasymTheta}}} - \qquad - \infer[\isa{{\isacharparenleft}assume{\isacharparenright}}]{\isa{A\ {\isasymturnstile}\ A}}{} - \] - \[ - \infer[\isa{{\isacharparenleft}{\isasymAnd}{\isacharunderscore}intro{\isacharparenright}}]{\isa{{\isasymGamma}\ {\isasymturnstile}\ {\isasymAnd}x{\isachardot}\ b{\isacharbrackleft}x{\isacharbrackright}}}{\isa{{\isasymGamma}\ {\isasymturnstile}\ b{\isacharbrackleft}x{\isacharbrackright}} & \isa{x\ {\isasymnotin}\ {\isasymGamma}}} - \qquad - \infer[\isa{{\isacharparenleft}{\isasymAnd}{\isacharunderscore}elim{\isacharparenright}}]{\isa{{\isasymGamma}\ {\isasymturnstile}\ b{\isacharbrackleft}a{\isacharbrackright}}}{\isa{{\isasymGamma}\ {\isasymturnstile}\ {\isasymAnd}x{\isachardot}\ b{\isacharbrackleft}x{\isacharbrackright}}} - \] - \[ - \infer[\isa{{\isacharparenleft}{\isasymLongrightarrow}{\isacharunderscore}intro{\isacharparenright}}]{\isa{{\isasymGamma}\ {\isacharminus}\ A\ {\isasymturnstile}\ A\ {\isasymLongrightarrow}\ B}}{\isa{{\isasymGamma}\ {\isasymturnstile}\ B}} - \qquad - \infer[\isa{{\isacharparenleft}{\isasymLongrightarrow}{\isacharunderscore}elim{\isacharparenright}}]{\isa{{\isasymGamma}\isactrlsub {\isadigit{1}}\ {\isasymunion}\ {\isasymGamma}\isactrlsub {\isadigit{2}}\ {\isasymturnstile}\ B}}{\isa{{\isasymGamma}\isactrlsub {\isadigit{1}}\ {\isasymturnstile}\ A\ {\isasymLongrightarrow}\ B} & \isa{{\isasymGamma}\isactrlsub {\isadigit{2}}\ {\isasymturnstile}\ A}} - \] - \caption{Primitive inferences of Pure}\label{fig:prim-rules} - \end{center} - \end{figure} - - \begin{figure}[htb] - \begin{center} - \begin{tabular}{ll} - \isa{{\isasymturnstile}\ {\isacharparenleft}{\isasymlambda}x{\isachardot}\ b{\isacharbrackleft}x{\isacharbrackright}{\isacharparenright}\ a\ {\isasymequiv}\ b{\isacharbrackleft}a{\isacharbrackright}} & \isa{{\isasymbeta}}-conversion \\ - \isa{{\isasymturnstile}\ x\ {\isasymequiv}\ x} & reflexivity \\ - \isa{{\isasymturnstile}\ x\ {\isasymequiv}\ y\ {\isasymLongrightarrow}\ P\ x\ {\isasymLongrightarrow}\ P\ y} & substitution \\ - \isa{{\isasymturnstile}\ {\isacharparenleft}{\isasymAnd}x{\isachardot}\ f\ x\ {\isasymequiv}\ g\ x{\isacharparenright}\ {\isasymLongrightarrow}\ f\ {\isasymequiv}\ g} & extensionality \\ - \isa{{\isasymturnstile}\ {\isacharparenleft}A\ {\isasymLongrightarrow}\ B{\isacharparenright}\ {\isasymLongrightarrow}\ {\isacharparenleft}B\ {\isasymLongrightarrow}\ A{\isacharparenright}\ {\isasymLongrightarrow}\ A\ {\isasymequiv}\ B} & logical equivalence \\ - \end{tabular} - \caption{Conceptual axiomatization of Pure equality}\label{fig:pure-equality} - \end{center} - \end{figure} - - The introduction and elimination rules for \isa{{\isasymAnd}} and \isa{{\isasymLongrightarrow}} are analogous to formation of dependently typed \isa{{\isasymlambda}}-terms representing the underlying proof objects. Proof terms - are irrelevant in the Pure logic, though; they cannot occur within - propositions. The system provides a runtime option to record - explicit proof terms for primitive inferences. Thus all three - levels of \isa{{\isasymlambda}}-calculus become explicit: \isa{{\isasymRightarrow}} for - terms, and \isa{{\isasymAnd}{\isacharslash}{\isasymLongrightarrow}} for proofs (cf.\ - \cite{Berghofer-Nipkow:2000:TPHOL}). - - Observe that locally fixed parameters (as in \isa{{\isasymAnd}{\isacharunderscore}intro}) need - not be recorded in the hypotheses, because the simple syntactic - types of Pure are always inhabitable. ``Assumptions'' \isa{x\ {\isacharcolon}{\isacharcolon}\ {\isasymtau}} for type-membership are only present as long as some \isa{x\isactrlisub {\isasymtau}} occurs in the statement body.\footnote{This is the key - difference to ``\isa{{\isasymlambda}HOL}'' in the PTS framework - \cite{Barendregt-Geuvers:2001}, where hypotheses \isa{x\ {\isacharcolon}\ A} are - treated uniformly for propositions and types.} - - \medskip The axiomatization of a theory is implicitly closed by - forming all instances of type and term variables: \isa{{\isasymturnstile}\ A{\isasymvartheta}} holds for any substitution instance of an axiom - \isa{{\isasymturnstile}\ A}. By pushing substitutions through derivations - inductively, we also get admissible \isa{generalize} and \isa{instance} rules as shown in \figref{fig:subst-rules}. - - \begin{figure}[htb] - \begin{center} - \[ - \infer{\isa{{\isasymGamma}\ {\isasymturnstile}\ B{\isacharbrackleft}{\isacharquery}{\isasymalpha}{\isacharbrackright}}}{\isa{{\isasymGamma}\ {\isasymturnstile}\ B{\isacharbrackleft}{\isasymalpha}{\isacharbrackright}} & \isa{{\isasymalpha}\ {\isasymnotin}\ {\isasymGamma}}} - \quad - \infer[\quad\isa{{\isacharparenleft}generalize{\isacharparenright}}]{\isa{{\isasymGamma}\ {\isasymturnstile}\ B{\isacharbrackleft}{\isacharquery}x{\isacharbrackright}}}{\isa{{\isasymGamma}\ {\isasymturnstile}\ B{\isacharbrackleft}x{\isacharbrackright}} & \isa{x\ {\isasymnotin}\ {\isasymGamma}}} - \] - \[ - \infer{\isa{{\isasymGamma}\ {\isasymturnstile}\ B{\isacharbrackleft}{\isasymtau}{\isacharbrackright}}}{\isa{{\isasymGamma}\ {\isasymturnstile}\ B{\isacharbrackleft}{\isacharquery}{\isasymalpha}{\isacharbrackright}}} - \quad - \infer[\quad\isa{{\isacharparenleft}instantiate{\isacharparenright}}]{\isa{{\isasymGamma}\ {\isasymturnstile}\ B{\isacharbrackleft}t{\isacharbrackright}}}{\isa{{\isasymGamma}\ {\isasymturnstile}\ B{\isacharbrackleft}{\isacharquery}x{\isacharbrackright}}} - \] - \caption{Admissible substitution rules}\label{fig:subst-rules} - \end{center} - \end{figure} - - Note that \isa{instantiate} does not require an explicit - side-condition, because \isa{{\isasymGamma}} may never contain schematic - variables. - - In principle, variables could be substituted in hypotheses as well, - but this would disrupt the monotonicity of reasoning: deriving - \isa{{\isasymGamma}{\isasymvartheta}\ {\isasymturnstile}\ B{\isasymvartheta}} from \isa{{\isasymGamma}\ {\isasymturnstile}\ B} is - correct, but \isa{{\isasymGamma}{\isasymvartheta}\ {\isasymsupseteq}\ {\isasymGamma}} does not necessarily hold: - the result belongs to a different proof context. - - \medskip An \emph{oracle} is a function that produces axioms on the - fly. Logically, this is an instance of the \isa{axiom} rule - (\figref{fig:prim-rules}), but there is an operational difference. - The system always records oracle invocations within derivations of - theorems. Tracing plain axioms (and named theorems) is optional. - - Axiomatizations should be limited to the bare minimum, typically as - part of the initial logical basis of an object-logic formalization. - Later on, theories are usually developed in a strictly definitional - fashion, by stating only certain equalities over new constants. - - A \emph{simple definition} consists of a constant declaration \isa{c\ {\isacharcolon}{\isacharcolon}\ {\isasymsigma}} together with an axiom \isa{{\isasymturnstile}\ c\ {\isasymequiv}\ t}, where \isa{t\ {\isacharcolon}{\isacharcolon}\ {\isasymsigma}} is a closed term without any hidden polymorphism. The RHS - may depend on further defined constants, but not \isa{c} itself. - Definitions of functions may be presented as \isa{c\ \isactrlvec x\ {\isasymequiv}\ t} instead of the puristic \isa{c\ {\isasymequiv}\ {\isasymlambda}\isactrlvec x{\isachardot}\ t}. - - An \emph{overloaded definition} consists of a collection of axioms - for the same constant, with zero or one equations \isa{c{\isacharparenleft}{\isacharparenleft}\isactrlvec {\isasymalpha}{\isacharparenright}{\isasymkappa}{\isacharparenright}\ {\isasymequiv}\ t} for each type constructor \isa{{\isasymkappa}} (for - distinct variables \isa{\isactrlvec {\isasymalpha}}). The RHS may mention - previously defined constants as above, or arbitrary constants \isa{d{\isacharparenleft}{\isasymalpha}\isactrlisub i{\isacharparenright}} for some \isa{{\isasymalpha}\isactrlisub i} projected from \isa{\isactrlvec {\isasymalpha}}. Thus overloaded definitions essentially work by - primitive recursion over the syntactic structure of a single type - argument.% -\end{isamarkuptext}% -\isamarkuptrue% -% -\isadelimmlref -% -\endisadelimmlref -% -\isatagmlref -% -\begin{isamarkuptext}% -\begin{mldecls} - \indexmltype{ctyp}\verb|type ctyp| \\ - \indexmltype{cterm}\verb|type cterm| \\ - \indexml{Thm.ctyp\_of}\verb|Thm.ctyp_of: theory -> typ -> ctyp| \\ - \indexml{Thm.cterm\_of}\verb|Thm.cterm_of: theory -> term -> cterm| \\ - \end{mldecls} - \begin{mldecls} - \indexmltype{thm}\verb|type thm| \\ - \indexml{proofs}\verb|proofs: int ref| \\ - \indexml{Thm.assume}\verb|Thm.assume: cterm -> thm| \\ - \indexml{Thm.forall\_intr}\verb|Thm.forall_intr: cterm -> thm -> thm| \\ - \indexml{Thm.forall\_elim}\verb|Thm.forall_elim: cterm -> thm -> thm| \\ - \indexml{Thm.implies\_intr}\verb|Thm.implies_intr: cterm -> thm -> thm| \\ - \indexml{Thm.implies\_elim}\verb|Thm.implies_elim: thm -> thm -> thm| \\ - \indexml{Thm.generalize}\verb|Thm.generalize: string list * string list -> int -> thm -> thm| \\ - \indexml{Thm.instantiate}\verb|Thm.instantiate: (ctyp * ctyp) list * (cterm * cterm) list -> thm -> thm| \\ - \indexml{Thm.axiom}\verb|Thm.axiom: theory -> string -> thm| \\ - \indexml{Thm.add\_oracle}\verb|Thm.add_oracle: bstring * ('a -> cterm) -> theory|\isasep\isanewline% -\verb| -> (string * ('a -> thm)) * theory| \\ - \end{mldecls} - \begin{mldecls} - \indexml{Theory.add\_axioms\_i}\verb|Theory.add_axioms_i: (binding * term) list -> theory -> theory| \\ - \indexml{Theory.add\_deps}\verb|Theory.add_deps: string -> string * typ -> (string * typ) list -> theory -> theory| \\ - \indexml{Theory.add\_defs\_i}\verb|Theory.add_defs_i: bool -> bool -> (binding * term) list -> theory -> theory| \\ - \end{mldecls} - - \begin{description} - - \item \verb|ctyp| and \verb|cterm| represent certified types - and terms, respectively. These are abstract datatypes that - guarantee that its values have passed the full well-formedness (and - well-typedness) checks, relative to the declarations of type - constructors, constants etc. in the theory. - - \item \verb|ctyp_of|~\isa{thy\ {\isasymtau}} and \verb|cterm_of|~\isa{thy\ t} explicitly checks types and terms, respectively. This also - involves some basic normalizations, such expansion of type and term - abbreviations from the theory context. - - Re-certification is relatively slow and should be avoided in tight - reasoning loops. There are separate operations to decompose - certified entities (including actual theorems). - - \item \verb|thm| represents proven propositions. This is an - abstract datatype that guarantees that its values have been - constructed by basic principles of the \verb|Thm| module. - Every \verb|thm| value contains a sliding back-reference to the - enclosing theory, cf.\ \secref{sec:context-theory}. - - \item \verb|proofs| determines the detail of proof recording within - \verb|thm| values: \verb|0| records only oracles, \verb|1| records - oracles, axioms and named theorems, \verb|2| records full proof - terms. - - \item \verb|Thm.assume|, \verb|Thm.forall_intr|, \verb|Thm.forall_elim|, \verb|Thm.implies_intr|, and \verb|Thm.implies_elim| - correspond to the primitive inferences of \figref{fig:prim-rules}. - - \item \verb|Thm.generalize|~\isa{{\isacharparenleft}\isactrlvec {\isasymalpha}{\isacharcomma}\ \isactrlvec x{\isacharparenright}} - corresponds to the \isa{generalize} rules of - \figref{fig:subst-rules}. Here collections of type and term - variables are generalized simultaneously, specified by the given - basic names. - - \item \verb|Thm.instantiate|~\isa{{\isacharparenleft}\isactrlvec {\isasymalpha}\isactrlisub s{\isacharcomma}\ \isactrlvec x\isactrlisub {\isasymtau}{\isacharparenright}} corresponds to the \isa{instantiate} rules - of \figref{fig:subst-rules}. Type variables are substituted before - term variables. Note that the types in \isa{\isactrlvec x\isactrlisub {\isasymtau}} - refer to the instantiated versions. - - \item \verb|Thm.axiom|~\isa{thy\ name} retrieves a named - axiom, cf.\ \isa{axiom} in \figref{fig:prim-rules}. - - \item \verb|Thm.add_oracle|~\isa{{\isacharparenleft}name{\isacharcomma}\ oracle{\isacharparenright}} produces a named - oracle rule, essentially generating arbitrary axioms on the fly, - cf.\ \isa{axiom} in \figref{fig:prim-rules}. - - \item \verb|Theory.add_axioms_i|~\isa{{\isacharbrackleft}{\isacharparenleft}name{\isacharcomma}\ A{\isacharparenright}{\isacharcomma}\ {\isasymdots}{\isacharbrackright}} declares - arbitrary propositions as axioms. - - \item \verb|Theory.add_deps|~\isa{name\ c\isactrlisub {\isasymtau}\ \isactrlvec d\isactrlisub {\isasymsigma}} declares dependencies of a named specification - for constant \isa{c\isactrlisub {\isasymtau}}, relative to existing - specifications for constants \isa{\isactrlvec d\isactrlisub {\isasymsigma}}. - - \item \verb|Theory.add_defs_i|~\isa{unchecked\ overloaded\ {\isacharbrackleft}{\isacharparenleft}name{\isacharcomma}\ c\ \isactrlvec x\ {\isasymequiv}\ t{\isacharparenright}{\isacharcomma}\ {\isasymdots}{\isacharbrackright}} states a definitional axiom for an existing - constant \isa{c}. Dependencies are recorded (cf.\ \verb|Theory.add_deps|), unless the \isa{unchecked} option is set. - - \end{description}% -\end{isamarkuptext}% -\isamarkuptrue% -% -\endisatagmlref -{\isafoldmlref}% -% -\isadelimmlref -% -\endisadelimmlref -% -\isamarkupsubsection{Auxiliary definitions% -} -\isamarkuptrue% -% -\begin{isamarkuptext}% -Theory \isa{Pure} provides a few auxiliary definitions, see - \figref{fig:pure-aux}. These special constants are normally not - exposed to the user, but appear in internal encodings. - - \begin{figure}[htb] - \begin{center} - \begin{tabular}{ll} - \isa{conjunction\ {\isacharcolon}{\isacharcolon}\ prop\ {\isasymRightarrow}\ prop\ {\isasymRightarrow}\ prop} & (infix \isa{{\isacharampersand}}) \\ - \isa{{\isasymturnstile}\ A\ {\isacharampersand}\ B\ {\isasymequiv}\ {\isacharparenleft}{\isasymAnd}C{\isachardot}\ {\isacharparenleft}A\ {\isasymLongrightarrow}\ B\ {\isasymLongrightarrow}\ C{\isacharparenright}\ {\isasymLongrightarrow}\ C{\isacharparenright}} \\[1ex] - \isa{prop\ {\isacharcolon}{\isacharcolon}\ prop\ {\isasymRightarrow}\ prop} & (prefix \isa{{\isacharhash}}, suppressed) \\ - \isa{{\isacharhash}A\ {\isasymequiv}\ A} \\[1ex] - \isa{term\ {\isacharcolon}{\isacharcolon}\ {\isasymalpha}\ {\isasymRightarrow}\ prop} & (prefix \isa{TERM}) \\ - \isa{term\ x\ {\isasymequiv}\ {\isacharparenleft}{\isasymAnd}A{\isachardot}\ A\ {\isasymLongrightarrow}\ A{\isacharparenright}} \\[1ex] - \isa{TYPE\ {\isacharcolon}{\isacharcolon}\ {\isasymalpha}\ itself} & (prefix \isa{TYPE}) \\ - \isa{{\isacharparenleft}unspecified{\isacharparenright}} \\ - \end{tabular} - \caption{Definitions of auxiliary connectives}\label{fig:pure-aux} - \end{center} - \end{figure} - - Derived conjunction rules include introduction \isa{A\ {\isasymLongrightarrow}\ B\ {\isasymLongrightarrow}\ A\ {\isacharampersand}\ B}, and destructions \isa{A\ {\isacharampersand}\ B\ {\isasymLongrightarrow}\ A} and \isa{A\ {\isacharampersand}\ B\ {\isasymLongrightarrow}\ B}. - Conjunction allows to treat simultaneous assumptions and conclusions - uniformly. For example, multiple claims are intermediately - represented as explicit conjunction, but this is refined into - separate sub-goals before the user continues the proof; the final - result is projected into a list of theorems (cf.\ - \secref{sec:tactical-goals}). - - The \isa{prop} marker (\isa{{\isacharhash}}) makes arbitrarily complex - propositions appear as atomic, without changing the meaning: \isa{{\isasymGamma}\ {\isasymturnstile}\ A} and \isa{{\isasymGamma}\ {\isasymturnstile}\ {\isacharhash}A} are interchangeable. See - \secref{sec:tactical-goals} for specific operations. - - The \isa{term} marker turns any well-typed term into a derivable - proposition: \isa{{\isasymturnstile}\ TERM\ t} holds unconditionally. Although - this is logically vacuous, it allows to treat terms and proofs - uniformly, similar to a type-theoretic framework. - - The \isa{TYPE} constructor is the canonical representative of - the unspecified type \isa{{\isasymalpha}\ itself}; it essentially injects the - language of types into that of terms. There is specific notation - \isa{TYPE{\isacharparenleft}{\isasymtau}{\isacharparenright}} for \isa{TYPE\isactrlbsub {\isasymtau}\ itself\isactrlesub }. - Although being devoid of any particular meaning, the \isa{TYPE{\isacharparenleft}{\isasymtau}{\isacharparenright}} accounts for the type \isa{{\isasymtau}} within the term - language. In particular, \isa{TYPE{\isacharparenleft}{\isasymalpha}{\isacharparenright}} may be used as formal - argument in primitive definitions, in order to circumvent hidden - polymorphism (cf.\ \secref{sec:terms}). For example, \isa{c\ TYPE{\isacharparenleft}{\isasymalpha}{\isacharparenright}\ {\isasymequiv}\ A{\isacharbrackleft}{\isasymalpha}{\isacharbrackright}} defines \isa{c\ {\isacharcolon}{\isacharcolon}\ {\isasymalpha}\ itself\ {\isasymRightarrow}\ prop} in terms of - a proposition \isa{A} that depends on an additional type - argument, which is essentially a predicate on types.% -\end{isamarkuptext}% -\isamarkuptrue% -% -\isadelimmlref -% -\endisadelimmlref -% -\isatagmlref -% -\begin{isamarkuptext}% -\begin{mldecls} - \indexml{Conjunction.intr}\verb|Conjunction.intr: thm -> thm -> thm| \\ - \indexml{Conjunction.elim}\verb|Conjunction.elim: thm -> thm * thm| \\ - \indexml{Drule.mk\_term}\verb|Drule.mk_term: cterm -> thm| \\ - \indexml{Drule.dest\_term}\verb|Drule.dest_term: thm -> cterm| \\ - \indexml{Logic.mk\_type}\verb|Logic.mk_type: typ -> term| \\ - \indexml{Logic.dest\_type}\verb|Logic.dest_type: term -> typ| \\ - \end{mldecls} - - \begin{description} - - \item \verb|Conjunction.intr| derives \isa{A\ {\isacharampersand}\ B} from \isa{A} and \isa{B}. - - \item \verb|Conjunction.elim| derives \isa{A} and \isa{B} - from \isa{A\ {\isacharampersand}\ B}. - - \item \verb|Drule.mk_term| derives \isa{TERM\ t}. - - \item \verb|Drule.dest_term| recovers term \isa{t} from \isa{TERM\ t}. - - \item \verb|Logic.mk_type|~\isa{{\isasymtau}} produces the term \isa{TYPE{\isacharparenleft}{\isasymtau}{\isacharparenright}}. - - \item \verb|Logic.dest_type|~\isa{TYPE{\isacharparenleft}{\isasymtau}{\isacharparenright}} recovers the type - \isa{{\isasymtau}}. - - \end{description}% -\end{isamarkuptext}% -\isamarkuptrue% -% -\endisatagmlref -{\isafoldmlref}% -% -\isadelimmlref -% -\endisadelimmlref -% -\isamarkupsection{Object-level rules \label{sec:obj-rules}% -} -\isamarkuptrue% -% -\isadelimFIXME -% -\endisadelimFIXME -% -\isatagFIXME -% -\begin{isamarkuptext}% -FIXME - - A \emph{rule} is any Pure theorem in HHF normal form; there is a - separate calculus for rule composition, which is modeled after - Gentzen's Natural Deduction \cite{Gentzen:1935}, but allows - rules to be nested arbitrarily, similar to \cite{extensions91}. - - Normally, all theorems accessible to the user are proper rules. - Low-level inferences are occasional required internally, but the - result should be always presented in canonical form. The higher - interfaces of Isabelle/Isar will always produce proper rules. It is - important to maintain this invariant in add-on applications! - - There are two main principles of rule composition: \isa{resolution} (i.e.\ backchaining of rules) and \isa{by{\isacharminus}assumption} (i.e.\ closing a branch); both principles are - combined in the variants of \isa{elim{\isacharminus}resolution} and \isa{dest{\isacharminus}resolution}. Raw \isa{composition} is occasionally - useful as well, also it is strictly speaking outside of the proper - rule calculus. - - Rules are treated modulo general higher-order unification, which is - unification modulo the equational theory of \isa{{\isasymalpha}{\isasymbeta}{\isasymeta}}-conversion - on \isa{{\isasymlambda}}-terms. Moreover, propositions are understood modulo - the (derived) equivalence \isa{{\isacharparenleft}A\ {\isasymLongrightarrow}\ {\isacharparenleft}{\isasymAnd}x{\isachardot}\ B\ x{\isacharparenright}{\isacharparenright}\ {\isasymequiv}\ {\isacharparenleft}{\isasymAnd}x{\isachardot}\ A\ {\isasymLongrightarrow}\ B\ x{\isacharparenright}}. - - This means that any operations within the rule calculus may be - subject to spontaneous \isa{{\isasymalpha}{\isasymbeta}{\isasymeta}}-HHF conversions. It is common - practice not to contract or expand unnecessarily. Some mechanisms - prefer an one form, others the opposite, so there is a potential - danger to produce some oscillation! - - Only few operations really work \emph{modulo} HHF conversion, but - expect a normal form: quantifiers \isa{{\isasymAnd}} before implications - \isa{{\isasymLongrightarrow}} at each level of nesting. - -\glossary{Hereditary Harrop Formula}{The set of propositions in HHF -format is defined inductively as \isa{H\ {\isacharequal}\ {\isacharparenleft}{\isasymAnd}x\isactrlsup {\isacharasterisk}{\isachardot}\ H\isactrlsup {\isacharasterisk}\ {\isasymLongrightarrow}\ A{\isacharparenright}}, for variables \isa{x} and atomic propositions \isa{A}. -Any proposition may be put into HHF form by normalizing with the rule -\isa{{\isacharparenleft}A\ {\isasymLongrightarrow}\ {\isacharparenleft}{\isasymAnd}x{\isachardot}\ B\ x{\isacharparenright}{\isacharparenright}\ {\isasymequiv}\ {\isacharparenleft}{\isasymAnd}x{\isachardot}\ A\ {\isasymLongrightarrow}\ B\ x{\isacharparenright}}. In Isabelle, the outermost -quantifier prefix is represented via \seeglossary{schematic -variables}, such that the top-level structure is merely that of a -\seeglossary{Horn Clause}}. - -\glossary{HHF}{See \seeglossary{Hereditary Harrop Formula}.} - - - \[ - \infer[\isa{{\isacharparenleft}assumption{\isacharparenright}}]{\isa{C{\isasymvartheta}}} - {\isa{{\isacharparenleft}{\isasymAnd}\isactrlvec x{\isachardot}\ \isactrlvec H\ \isactrlvec x\ {\isasymLongrightarrow}\ A\ \isactrlvec x{\isacharparenright}\ {\isasymLongrightarrow}\ C} & \isa{A{\isasymvartheta}\ {\isacharequal}\ H\isactrlsub i{\isasymvartheta}}~~\text{(for some~\isa{i})}} - \] - - - \[ - \infer[\isa{{\isacharparenleft}compose{\isacharparenright}}]{\isa{\isactrlvec A{\isasymvartheta}\ {\isasymLongrightarrow}\ C{\isasymvartheta}}} - {\isa{\isactrlvec A\ {\isasymLongrightarrow}\ B} & \isa{B{\isacharprime}\ {\isasymLongrightarrow}\ C} & \isa{B{\isasymvartheta}\ {\isacharequal}\ B{\isacharprime}{\isasymvartheta}}} - \] - - - \[ - \infer[\isa{{\isacharparenleft}{\isasymAnd}{\isacharunderscore}lift{\isacharparenright}}]{\isa{{\isacharparenleft}{\isasymAnd}\isactrlvec x{\isachardot}\ \isactrlvec A\ {\isacharparenleft}{\isacharquery}\isactrlvec a\ \isactrlvec x{\isacharparenright}{\isacharparenright}\ {\isasymLongrightarrow}\ {\isacharparenleft}{\isasymAnd}\isactrlvec x{\isachardot}\ B\ {\isacharparenleft}{\isacharquery}\isactrlvec a\ \isactrlvec x{\isacharparenright}{\isacharparenright}}}{\isa{\isactrlvec A\ {\isacharquery}\isactrlvec a\ {\isasymLongrightarrow}\ B\ {\isacharquery}\isactrlvec a}} - \] - \[ - \infer[\isa{{\isacharparenleft}{\isasymLongrightarrow}{\isacharunderscore}lift{\isacharparenright}}]{\isa{{\isacharparenleft}\isactrlvec H\ {\isasymLongrightarrow}\ \isactrlvec A{\isacharparenright}\ {\isasymLongrightarrow}\ {\isacharparenleft}\isactrlvec H\ {\isasymLongrightarrow}\ B{\isacharparenright}}}{\isa{\isactrlvec A\ {\isasymLongrightarrow}\ B}} - \] - - The \isa{resolve} scheme is now acquired from \isa{{\isasymAnd}{\isacharunderscore}lift}, - \isa{{\isasymLongrightarrow}{\isacharunderscore}lift}, and \isa{compose}. - - \[ - \infer[\isa{{\isacharparenleft}resolution{\isacharparenright}}] - {\isa{{\isacharparenleft}{\isasymAnd}\isactrlvec x{\isachardot}\ \isactrlvec H\ \isactrlvec x\ {\isasymLongrightarrow}\ \isactrlvec A\ {\isacharparenleft}{\isacharquery}\isactrlvec a\ \isactrlvec x{\isacharparenright}{\isacharparenright}{\isasymvartheta}\ {\isasymLongrightarrow}\ C{\isasymvartheta}}} - {\begin{tabular}{l} - \isa{\isactrlvec A\ {\isacharquery}\isactrlvec a\ {\isasymLongrightarrow}\ B\ {\isacharquery}\isactrlvec a} \\ - \isa{{\isacharparenleft}{\isasymAnd}\isactrlvec x{\isachardot}\ \isactrlvec H\ \isactrlvec x\ {\isasymLongrightarrow}\ B{\isacharprime}\ \isactrlvec x{\isacharparenright}\ {\isasymLongrightarrow}\ C} \\ - \isa{{\isacharparenleft}{\isasymlambda}\isactrlvec x{\isachardot}\ B\ {\isacharparenleft}{\isacharquery}\isactrlvec a\ \isactrlvec x{\isacharparenright}{\isacharparenright}{\isasymvartheta}\ {\isacharequal}\ B{\isacharprime}{\isasymvartheta}} \\ - \end{tabular}} - \] - - - FIXME \isa{elim{\isacharunderscore}resolution}, \isa{dest{\isacharunderscore}resolution}% -\end{isamarkuptext}% -\isamarkuptrue% -% -\endisatagFIXME -{\isafoldFIXME}% -% -\isadelimFIXME -% -\endisadelimFIXME -% -\isadelimtheory -% -\endisadelimtheory -% -\isatagtheory -\isacommand{end}\isamarkupfalse% -% -\endisatagtheory -{\isafoldtheory}% -% -\isadelimtheory -% -\endisadelimtheory -\isanewline -\end{isabellebody}% -%%% Local Variables: -%%% mode: latex -%%% TeX-master: "root" -%%% End: diff -r 419116f1157a -r e23770bc97c8 doc-src/IsarImplementation/Thy/document/prelim.tex --- a/doc-src/IsarImplementation/Thy/document/prelim.tex Thu Feb 26 08:44:44 2009 -0800 +++ /dev/null Thu Jan 01 00:00:00 1970 +0000 @@ -1,911 +0,0 @@ -% -\begin{isabellebody}% -\def\isabellecontext{prelim}% -% -\isadelimtheory -\isanewline -\isanewline -\isanewline -% -\endisadelimtheory -% -\isatagtheory -\isacommand{theory}\isamarkupfalse% -\ prelim\ \isakeyword{imports}\ base\ \isakeyword{begin}% -\endisatagtheory -{\isafoldtheory}% -% -\isadelimtheory -% -\endisadelimtheory -% -\isamarkupchapter{Preliminaries% -} -\isamarkuptrue% -% -\isamarkupsection{Contexts \label{sec:context}% -} -\isamarkuptrue% -% -\begin{isamarkuptext}% -A logical context represents the background that is required for - formulating statements and composing proofs. It acts as a medium to - produce formal content, depending on earlier material (declarations, - results etc.). - - For example, derivations within the Isabelle/Pure logic can be - described as a judgment \isa{{\isasymGamma}\ {\isasymturnstile}\isactrlsub {\isasymTheta}\ {\isasymphi}}, which means that a - proposition \isa{{\isasymphi}} is derivable from hypotheses \isa{{\isasymGamma}} - within the theory \isa{{\isasymTheta}}. There are logical reasons for - keeping \isa{{\isasymTheta}} and \isa{{\isasymGamma}} separate: theories can be - liberal about supporting type constructors and schematic - polymorphism of constants and axioms, while the inner calculus of - \isa{{\isasymGamma}\ {\isasymturnstile}\ {\isasymphi}} is strictly limited to Simple Type Theory (with - fixed type variables in the assumptions). - - \medskip Contexts and derivations are linked by the following key - principles: - - \begin{itemize} - - \item Transfer: monotonicity of derivations admits results to be - transferred into a \emph{larger} context, i.e.\ \isa{{\isasymGamma}\ {\isasymturnstile}\isactrlsub {\isasymTheta}\ {\isasymphi}} implies \isa{{\isasymGamma}{\isacharprime}\ {\isasymturnstile}\isactrlsub {\isasymTheta}\isactrlsub {\isacharprime}\ {\isasymphi}} for contexts \isa{{\isasymTheta}{\isacharprime}\ {\isasymsupseteq}\ {\isasymTheta}} and \isa{{\isasymGamma}{\isacharprime}\ {\isasymsupseteq}\ {\isasymGamma}}. - - \item Export: discharge of hypotheses admits results to be exported - into a \emph{smaller} context, i.e.\ \isa{{\isasymGamma}{\isacharprime}\ {\isasymturnstile}\isactrlsub {\isasymTheta}\ {\isasymphi}} - implies \isa{{\isasymGamma}\ {\isasymturnstile}\isactrlsub {\isasymTheta}\ {\isasymDelta}\ {\isasymLongrightarrow}\ {\isasymphi}} where \isa{{\isasymGamma}{\isacharprime}\ {\isasymsupseteq}\ {\isasymGamma}} and - \isa{{\isasymDelta}\ {\isacharequal}\ {\isasymGamma}{\isacharprime}\ {\isacharminus}\ {\isasymGamma}}. Note that \isa{{\isasymTheta}} remains unchanged here, - only the \isa{{\isasymGamma}} part is affected. - - \end{itemize} - - \medskip By modeling the main characteristics of the primitive - \isa{{\isasymTheta}} and \isa{{\isasymGamma}} above, and abstracting over any - particular logical content, we arrive at the fundamental notions of - \emph{theory context} and \emph{proof context} in Isabelle/Isar. - These implement a certain policy to manage arbitrary \emph{context - data}. There is a strongly-typed mechanism to declare new kinds of - data at compile time. - - The internal bootstrap process of Isabelle/Pure eventually reaches a - stage where certain data slots provide the logical content of \isa{{\isasymTheta}} and \isa{{\isasymGamma}} sketched above, but this does not stop there! - Various additional data slots support all kinds of mechanisms that - are not necessarily part of the core logic. - - For example, there would be data for canonical introduction and - elimination rules for arbitrary operators (depending on the - object-logic and application), which enables users to perform - standard proof steps implicitly (cf.\ the \isa{rule} method - \cite{isabelle-isar-ref}). - - \medskip Thus Isabelle/Isar is able to bring forth more and more - concepts successively. In particular, an object-logic like - Isabelle/HOL continues the Isabelle/Pure setup by adding specific - components for automated reasoning (classical reasoner, tableau - prover, structured induction etc.) and derived specification - mechanisms (inductive predicates, recursive functions etc.). All of - this is ultimately based on the generic data management by theory - and proof contexts introduced here.% -\end{isamarkuptext}% -\isamarkuptrue% -% -\isamarkupsubsection{Theory context \label{sec:context-theory}% -} -\isamarkuptrue% -% -\begin{isamarkuptext}% -\glossary{Theory}{FIXME} - - A \emph{theory} is a data container with explicit named and unique - identifier. Theories are related by a (nominal) sub-theory - relation, which corresponds to the dependency graph of the original - construction; each theory is derived from a certain sub-graph of - ancestor theories. - - The \isa{merge} operation produces the least upper bound of two - theories, which actually degenerates into absorption of one theory - into the other (due to the nominal sub-theory relation). - - The \isa{begin} operation starts a new theory by importing - several parent theories and entering a special \isa{draft} mode, - which is sustained until the final \isa{end} operation. A draft - theory acts like a linear type, where updates invalidate earlier - versions. An invalidated draft is called ``stale''. - - The \isa{checkpoint} operation produces an intermediate stepping - stone that will survive the next update: both the original and the - changed theory remain valid and are related by the sub-theory - relation. Checkpointing essentially recovers purely functional - theory values, at the expense of some extra internal bookkeeping. - - The \isa{copy} operation produces an auxiliary version that has - the same data content, but is unrelated to the original: updates of - the copy do not affect the original, neither does the sub-theory - relation hold. - - \medskip The example in \figref{fig:ex-theory} below shows a theory - graph derived from \isa{Pure}, with theory \isa{Length} - importing \isa{Nat} and \isa{List}. The body of \isa{Length} consists of a sequence of updates, working mostly on - drafts. Intermediate checkpoints may occur as well, due to the - history mechanism provided by the Isar top-level, cf.\ - \secref{sec:isar-toplevel}. - - \begin{figure}[htb] - \begin{center} - \begin{tabular}{rcccl} - & & \isa{Pure} \\ - & & \isa{{\isasymdown}} \\ - & & \isa{FOL} \\ - & $\swarrow$ & & $\searrow$ & \\ - \isa{Nat} & & & & \isa{List} \\ - & $\searrow$ & & $\swarrow$ \\ - & & \isa{Length} \\ - & & \multicolumn{3}{l}{~~\hyperlink{keyword.imports}{\mbox{\isa{\isakeyword{imports}}}}} \\ - & & \multicolumn{3}{l}{~~\hyperlink{keyword.begin}{\mbox{\isa{\isakeyword{begin}}}}} \\ - & & $\vdots$~~ \\ - & & \isa{{\isasymbullet}}~~ \\ - & & $\vdots$~~ \\ - & & \isa{{\isasymbullet}}~~ \\ - & & $\vdots$~~ \\ - & & \multicolumn{3}{l}{~~\hyperlink{command.end}{\mbox{\isa{\isacommand{end}}}}} \\ - \end{tabular} - \caption{A theory definition depending on ancestors}\label{fig:ex-theory} - \end{center} - \end{figure} - - \medskip There is a separate notion of \emph{theory reference} for - maintaining a live link to an evolving theory context: updates on - drafts are propagated automatically. Dynamic updating stops after - an explicit \isa{end} only. - - Derived entities may store a theory reference in order to indicate - the context they belong to. This implicitly assumes monotonic - reasoning, because the referenced context may become larger without - further notice.% -\end{isamarkuptext}% -\isamarkuptrue% -% -\isadelimmlref -% -\endisadelimmlref -% -\isatagmlref -% -\begin{isamarkuptext}% -\begin{mldecls} - \indexmltype{theory}\verb|type theory| \\ - \indexml{Theory.subthy}\verb|Theory.subthy: theory * theory -> bool| \\ - \indexml{Theory.merge}\verb|Theory.merge: theory * theory -> theory| \\ - \indexml{Theory.checkpoint}\verb|Theory.checkpoint: theory -> theory| \\ - \indexml{Theory.copy}\verb|Theory.copy: theory -> theory| \\ - \end{mldecls} - \begin{mldecls} - \indexmltype{theory\_ref}\verb|type theory_ref| \\ - \indexml{Theory.deref}\verb|Theory.deref: theory_ref -> theory| \\ - \indexml{Theory.check\_thy}\verb|Theory.check_thy: theory -> theory_ref| \\ - \end{mldecls} - - \begin{description} - - \item \verb|theory| represents theory contexts. This is - essentially a linear type! Most operations destroy the original - version, which then becomes ``stale''. - - \item \verb|Theory.subthy|~\isa{{\isacharparenleft}thy\isactrlsub {\isadigit{1}}{\isacharcomma}\ thy\isactrlsub {\isadigit{2}}{\isacharparenright}} - compares theories according to the inherent graph structure of the - construction. This sub-theory relation is a nominal approximation - of inclusion (\isa{{\isasymsubseteq}}) of the corresponding content. - - \item \verb|Theory.merge|~\isa{{\isacharparenleft}thy\isactrlsub {\isadigit{1}}{\isacharcomma}\ thy\isactrlsub {\isadigit{2}}{\isacharparenright}} - absorbs one theory into the other. This fails for unrelated - theories! - - \item \verb|Theory.checkpoint|~\isa{thy} produces a safe - stepping stone in the linear development of \isa{thy}. The next - update will result in two related, valid theories. - - \item \verb|Theory.copy|~\isa{thy} produces a variant of \isa{thy} that holds a copy of the same data. The result is not - related to the original; the original is unchanched. - - \item \verb|theory_ref| represents a sliding reference to an - always valid theory; updates on the original are propagated - automatically. - - \item \verb|Theory.deref|~\isa{thy{\isacharunderscore}ref} turns a \verb|theory_ref| into an \verb|theory| value. As the referenced - theory evolves monotonically over time, later invocations of \verb|Theory.deref| may refer to a larger context. - - \item \verb|Theory.check_thy|~\isa{thy} produces a \verb|theory_ref| from a valid \verb|theory| value. - - \end{description}% -\end{isamarkuptext}% -\isamarkuptrue% -% -\endisatagmlref -{\isafoldmlref}% -% -\isadelimmlref -% -\endisadelimmlref -% -\isamarkupsubsection{Proof context \label{sec:context-proof}% -} -\isamarkuptrue% -% -\begin{isamarkuptext}% -\glossary{Proof context}{The static context of a structured proof, - acts like a local ``theory'' of the current portion of Isar proof - text, generalizes the idea of local hypotheses \isa{{\isasymGamma}} in - judgments \isa{{\isasymGamma}\ {\isasymturnstile}\ {\isasymphi}} of natural deduction calculi. There is a - generic notion of introducing and discharging hypotheses. - Arbritrary auxiliary context data may be adjoined.} - - A proof context is a container for pure data with a back-reference - to the theory it belongs to. The \isa{init} operation creates a - proof context from a given theory. Modifications to draft theories - are propagated to the proof context as usual, but there is also an - explicit \isa{transfer} operation to force resynchronization - with more substantial updates to the underlying theory. The actual - context data does not require any special bookkeeping, thanks to the - lack of destructive features. - - Entities derived in a proof context need to record inherent logical - requirements explicitly, since there is no separate context - identification as for theories. For example, hypotheses used in - primitive derivations (cf.\ \secref{sec:thms}) are recorded - separately within the sequent \isa{{\isasymGamma}\ {\isasymturnstile}\ {\isasymphi}}, just to make double - sure. Results could still leak into an alien proof context do to - programming errors, but Isabelle/Isar includes some extra validity - checks in critical positions, notably at the end of a sub-proof. - - Proof contexts may be manipulated arbitrarily, although the common - discipline is to follow block structure as a mental model: a given - context is extended consecutively, and results are exported back - into the original context. Note that the Isar proof states model - block-structured reasoning explicitly, using a stack of proof - contexts internally, cf.\ \secref{sec:isar-proof-state}.% -\end{isamarkuptext}% -\isamarkuptrue% -% -\isadelimmlref -% -\endisadelimmlref -% -\isatagmlref -% -\begin{isamarkuptext}% -\begin{mldecls} - \indexmltype{Proof.context}\verb|type Proof.context| \\ - \indexml{ProofContext.init}\verb|ProofContext.init: theory -> Proof.context| \\ - \indexml{ProofContext.theory\_of}\verb|ProofContext.theory_of: Proof.context -> theory| \\ - \indexml{ProofContext.transfer}\verb|ProofContext.transfer: theory -> Proof.context -> Proof.context| \\ - \end{mldecls} - - \begin{description} - - \item \verb|Proof.context| represents proof contexts. Elements - of this type are essentially pure values, with a sliding reference - to the background theory. - - \item \verb|ProofContext.init|~\isa{thy} produces a proof context - derived from \isa{thy}, initializing all data. - - \item \verb|ProofContext.theory_of|~\isa{ctxt} selects the - background theory from \isa{ctxt}, dereferencing its internal - \verb|theory_ref|. - - \item \verb|ProofContext.transfer|~\isa{thy\ ctxt} promotes the - background theory of \isa{ctxt} to the super theory \isa{thy}. - - \end{description}% -\end{isamarkuptext}% -\isamarkuptrue% -% -\endisatagmlref -{\isafoldmlref}% -% -\isadelimmlref -% -\endisadelimmlref -% -\isamarkupsubsection{Generic contexts \label{sec:generic-context}% -} -\isamarkuptrue% -% -\begin{isamarkuptext}% -A generic context is the disjoint sum of either a theory or proof - context. Occasionally, this enables uniform treatment of generic - context data, typically extra-logical information. Operations on - generic contexts include the usual injections, partial selections, - and combinators for lifting operations on either component of the - disjoint sum. - - Moreover, there are total operations \isa{theory{\isacharunderscore}of} and \isa{proof{\isacharunderscore}of} to convert a generic context into either kind: a theory - can always be selected from the sum, while a proof context might - have to be constructed by an ad-hoc \isa{init} operation.% -\end{isamarkuptext}% -\isamarkuptrue% -% -\isadelimmlref -% -\endisadelimmlref -% -\isatagmlref -% -\begin{isamarkuptext}% -\begin{mldecls} - \indexmltype{Context.generic}\verb|type Context.generic| \\ - \indexml{Context.theory\_of}\verb|Context.theory_of: Context.generic -> theory| \\ - \indexml{Context.proof\_of}\verb|Context.proof_of: Context.generic -> Proof.context| \\ - \end{mldecls} - - \begin{description} - - \item \verb|Context.generic| is the direct sum of \verb|theory| and \verb|Proof.context|, with the datatype - constructors \verb|Context.Theory| and \verb|Context.Proof|. - - \item \verb|Context.theory_of|~\isa{context} always produces a - theory from the generic \isa{context}, using \verb|ProofContext.theory_of| as required. - - \item \verb|Context.proof_of|~\isa{context} always produces a - proof context from the generic \isa{context}, using \verb|ProofContext.init| as required (note that this re-initializes the - context data with each invocation). - - \end{description}% -\end{isamarkuptext}% -\isamarkuptrue% -% -\endisatagmlref -{\isafoldmlref}% -% -\isadelimmlref -% -\endisadelimmlref -% -\isamarkupsubsection{Context data \label{sec:context-data}% -} -\isamarkuptrue% -% -\begin{isamarkuptext}% -The main purpose of theory and proof contexts is to manage arbitrary - data. New data types can be declared incrementally at compile time. - There are separate declaration mechanisms for any of the three kinds - of contexts: theory, proof, generic. - - \paragraph{Theory data} may refer to destructive entities, which are - maintained in direct correspondence to the linear evolution of - theory values, including explicit copies.\footnote{Most existing - instances of destructive theory data are merely historical relics - (e.g.\ the destructive theorem storage, and destructive hints for - the Simplifier and Classical rules).} A theory data declaration - needs to implement the following SML signature: - - \medskip - \begin{tabular}{ll} - \isa{{\isasymtype}\ T} & representing type \\ - \isa{{\isasymval}\ empty{\isacharcolon}\ T} & empty default value \\ - \isa{{\isasymval}\ copy{\isacharcolon}\ T\ {\isasymrightarrow}\ T} & refresh impure data \\ - \isa{{\isasymval}\ extend{\isacharcolon}\ T\ {\isasymrightarrow}\ T} & re-initialize on import \\ - \isa{{\isasymval}\ merge{\isacharcolon}\ T\ {\isasymtimes}\ T\ {\isasymrightarrow}\ T} & join on import \\ - \end{tabular} - \medskip - - \noindent The \isa{empty} value acts as initial default for - \emph{any} theory that does not declare actual data content; \isa{copy} maintains persistent integrity for impure data, it is just - the identity for pure values; \isa{extend} is acts like a - unitary version of \isa{merge}, both operations should also - include the functionality of \isa{copy} for impure data. - - \paragraph{Proof context data} is purely functional. A declaration - needs to implement the following SML signature: - - \medskip - \begin{tabular}{ll} - \isa{{\isasymtype}\ T} & representing type \\ - \isa{{\isasymval}\ init{\isacharcolon}\ theory\ {\isasymrightarrow}\ T} & produce initial value \\ - \end{tabular} - \medskip - - \noindent The \isa{init} operation is supposed to produce a pure - value from the given background theory. - - \paragraph{Generic data} provides a hybrid interface for both theory - and proof data. The declaration is essentially the same as for - (pure) theory data, without \isa{copy}. The \isa{init} - operation for proof contexts merely selects the current data value - from the background theory. - - \bigskip A data declaration of type \isa{T} results in the - following interface: - - \medskip - \begin{tabular}{ll} - \isa{init{\isacharcolon}\ theory\ {\isasymrightarrow}\ theory} \\ - \isa{get{\isacharcolon}\ context\ {\isasymrightarrow}\ T} \\ - \isa{put{\isacharcolon}\ T\ {\isasymrightarrow}\ context\ {\isasymrightarrow}\ context} \\ - \isa{map{\isacharcolon}\ {\isacharparenleft}T\ {\isasymrightarrow}\ T{\isacharparenright}\ {\isasymrightarrow}\ context\ {\isasymrightarrow}\ context} \\ - \end{tabular} - \medskip - - \noindent Here \isa{init} is only applicable to impure theory - data to install a fresh copy persistently (destructive update on - uninitialized has no permanent effect). The other operations provide - access for the particular kind of context (theory, proof, or generic - context). Note that this is a safe interface: there is no other way - to access the corresponding data slot of a context. By keeping - these operations private, a component may maintain abstract values - authentically, without other components interfering.% -\end{isamarkuptext}% -\isamarkuptrue% -% -\isadelimmlref -% -\endisadelimmlref -% -\isatagmlref -% -\begin{isamarkuptext}% -\begin{mldecls} - \indexmlfunctor{TheoryDataFun}\verb|functor TheoryDataFun| \\ - \indexmlfunctor{ProofDataFun}\verb|functor ProofDataFun| \\ - \indexmlfunctor{GenericDataFun}\verb|functor GenericDataFun| \\ - \end{mldecls} - - \begin{description} - - \item \verb|TheoryDataFun|\isa{{\isacharparenleft}spec{\isacharparenright}} declares data for - type \verb|theory| according to the specification provided as - argument structure. The resulting structure provides data init and - access operations as described above. - - \item \verb|ProofDataFun|\isa{{\isacharparenleft}spec{\isacharparenright}} is analogous to - \verb|TheoryDataFun| for type \verb|Proof.context|. - - \item \verb|GenericDataFun|\isa{{\isacharparenleft}spec{\isacharparenright}} is analogous to - \verb|TheoryDataFun| for type \verb|Context.generic|. - - \end{description}% -\end{isamarkuptext}% -\isamarkuptrue% -% -\endisatagmlref -{\isafoldmlref}% -% -\isadelimmlref -% -\endisadelimmlref -% -\isamarkupsection{Names \label{sec:names}% -} -\isamarkuptrue% -% -\begin{isamarkuptext}% -In principle, a name is just a string, but there are various - convention for encoding additional structure. For example, ``\isa{Foo{\isachardot}bar{\isachardot}baz}'' is considered as a qualified name consisting of - three basic name components. The individual constituents of a name - may have further substructure, e.g.\ the string - ``\verb,\,\verb,,'' encodes as a single symbol.% -\end{isamarkuptext}% -\isamarkuptrue% -% -\isamarkupsubsection{Strings of symbols% -} -\isamarkuptrue% -% -\begin{isamarkuptext}% -\glossary{Symbol}{The smallest unit of text in Isabelle, subsumes - plain ASCII characters as well as an infinite collection of named - symbols (for greek, math etc.).} - - A \emph{symbol} constitutes the smallest textual unit in Isabelle - --- raw characters are normally not encountered at all. Isabelle - strings consist of a sequence of symbols, represented as a packed - string or a list of strings. Each symbol is in itself a small - string, which has either one of the following forms: - - \begin{enumerate} - - \item a single ASCII character ``\isa{c}'', for example - ``\verb,a,'', - - \item a regular symbol ``\verb,\,\verb,<,\isa{ident}\verb,>,'', - for example ``\verb,\,\verb,,'', - - \item a control symbol ``\verb,\,\verb,<^,\isa{ident}\verb,>,'', - for example ``\verb,\,\verb,<^bold>,'', - - \item a raw symbol ``\verb,\,\verb,<^raw:,\isa{text}\verb,>,'' - where \isa{text} constists of printable characters excluding - ``\verb,.,'' and ``\verb,>,'', for example - ``\verb,\,\verb,<^raw:$\sum_{i = 1}^n$>,'', - - \item a numbered raw control symbol ``\verb,\,\verb,<^raw,\isa{n}\verb,>, where \isa{n} consists of digits, for example - ``\verb,\,\verb,<^raw42>,''. - - \end{enumerate} - - \noindent The \isa{ident} syntax for symbol names is \isa{letter\ {\isacharparenleft}letter\ {\isacharbar}\ digit{\isacharparenright}\isactrlsup {\isacharasterisk}}, where \isa{letter\ {\isacharequal}\ A{\isachardot}{\isachardot}Za{\isachardot}{\isachardot}z} and \isa{digit\ {\isacharequal}\ {\isadigit{0}}{\isachardot}{\isachardot}{\isadigit{9}}}. There are infinitely many - regular symbols and control symbols, but a fixed collection of - standard symbols is treated specifically. For example, - ``\verb,\,\verb,,'' is classified as a letter, which means it - may occur within regular Isabelle identifiers. - - Since the character set underlying Isabelle symbols is 7-bit ASCII - and 8-bit characters are passed through transparently, Isabelle may - also process Unicode/UCS data in UTF-8 encoding. Unicode provides - its own collection of mathematical symbols, but there is no built-in - link to the standard collection of Isabelle. - - \medskip Output of Isabelle symbols depends on the print mode - (\secref{FIXME}). For example, the standard {\LaTeX} setup of the - Isabelle document preparation system would present - ``\verb,\,\verb,,'' as \isa{{\isasymalpha}}, and - ``\verb,\,\verb,<^bold>,\verb,\,\verb,,'' as \isa{\isactrlbold {\isasymalpha}}.% -\end{isamarkuptext}% -\isamarkuptrue% -% -\isadelimmlref -% -\endisadelimmlref -% -\isatagmlref -% -\begin{isamarkuptext}% -\begin{mldecls} - \indexmltype{Symbol.symbol}\verb|type Symbol.symbol| \\ - \indexml{Symbol.explode}\verb|Symbol.explode: string -> Symbol.symbol list| \\ - \indexml{Symbol.is\_letter}\verb|Symbol.is_letter: Symbol.symbol -> bool| \\ - \indexml{Symbol.is\_digit}\verb|Symbol.is_digit: Symbol.symbol -> bool| \\ - \indexml{Symbol.is\_quasi}\verb|Symbol.is_quasi: Symbol.symbol -> bool| \\ - \indexml{Symbol.is\_blank}\verb|Symbol.is_blank: Symbol.symbol -> bool| \\ - \end{mldecls} - \begin{mldecls} - \indexmltype{Symbol.sym}\verb|type Symbol.sym| \\ - \indexml{Symbol.decode}\verb|Symbol.decode: Symbol.symbol -> Symbol.sym| \\ - \end{mldecls} - - \begin{description} - - \item \verb|Symbol.symbol| represents individual Isabelle - symbols; this is an alias for \verb|string|. - - \item \verb|Symbol.explode|~\isa{str} produces a symbol list - from the packed form. This function supercedes \verb|String.explode| for virtually all purposes of manipulating text in - Isabelle! - - \item \verb|Symbol.is_letter|, \verb|Symbol.is_digit|, \verb|Symbol.is_quasi|, \verb|Symbol.is_blank| classify standard - symbols according to fixed syntactic conventions of Isabelle, cf.\ - \cite{isabelle-isar-ref}. - - \item \verb|Symbol.sym| is a concrete datatype that represents - the different kinds of symbols explicitly, with constructors \verb|Symbol.Char|, \verb|Symbol.Sym|, \verb|Symbol.Ctrl|, \verb|Symbol.Raw|. - - \item \verb|Symbol.decode| converts the string representation of a - symbol into the datatype version. - - \end{description}% -\end{isamarkuptext}% -\isamarkuptrue% -% -\endisatagmlref -{\isafoldmlref}% -% -\isadelimmlref -% -\endisadelimmlref -% -\isamarkupsubsection{Basic names \label{sec:basic-names}% -} -\isamarkuptrue% -% -\begin{isamarkuptext}% -A \emph{basic name} essentially consists of a single Isabelle - identifier. There are conventions to mark separate classes of basic - names, by attaching a suffix of underscores (\isa{{\isacharunderscore}}): one - underscore means \emph{internal name}, two underscores means - \emph{Skolem name}, three underscores means \emph{internal Skolem - name}. - - For example, the basic name \isa{foo} has the internal version - \isa{foo{\isacharunderscore}}, with Skolem versions \isa{foo{\isacharunderscore}{\isacharunderscore}} and \isa{foo{\isacharunderscore}{\isacharunderscore}{\isacharunderscore}}, respectively. - - These special versions provide copies of the basic name space, apart - from anything that normally appears in the user text. For example, - system generated variables in Isar proof contexts are usually marked - as internal, which prevents mysterious name references like \isa{xaa} to appear in the text. - - \medskip Manipulating binding scopes often requires on-the-fly - renamings. A \emph{name context} contains a collection of already - used names. The \isa{declare} operation adds names to the - context. - - The \isa{invents} operation derives a number of fresh names from - a given starting point. For example, the first three names derived - from \isa{a} are \isa{a}, \isa{b}, \isa{c}. - - The \isa{variants} operation produces fresh names by - incrementing tentative names as base-26 numbers (with digits \isa{a{\isachardot}{\isachardot}z}) until all clashes are resolved. For example, name \isa{foo} results in variants \isa{fooa}, \isa{foob}, \isa{fooc}, \dots, \isa{fooaa}, \isa{fooab} etc.; each renaming - step picks the next unused variant from this sequence.% -\end{isamarkuptext}% -\isamarkuptrue% -% -\isadelimmlref -% -\endisadelimmlref -% -\isatagmlref -% -\begin{isamarkuptext}% -\begin{mldecls} - \indexml{Name.internal}\verb|Name.internal: string -> string| \\ - \indexml{Name.skolem}\verb|Name.skolem: string -> string| \\ - \end{mldecls} - \begin{mldecls} - \indexmltype{Name.context}\verb|type Name.context| \\ - \indexml{Name.context}\verb|Name.context: Name.context| \\ - \indexml{Name.declare}\verb|Name.declare: string -> Name.context -> Name.context| \\ - \indexml{Name.invents}\verb|Name.invents: Name.context -> string -> int -> string list| \\ - \indexml{Name.variants}\verb|Name.variants: string list -> Name.context -> string list * Name.context| \\ - \end{mldecls} - - \begin{description} - - \item \verb|Name.internal|~\isa{name} produces an internal name - by adding one underscore. - - \item \verb|Name.skolem|~\isa{name} produces a Skolem name by - adding two underscores. - - \item \verb|Name.context| represents the context of already used - names; the initial value is \verb|Name.context|. - - \item \verb|Name.declare|~\isa{name} enters a used name into the - context. - - \item \verb|Name.invents|~\isa{context\ name\ n} produces \isa{n} fresh names derived from \isa{name}. - - \item \verb|Name.variants|~\isa{names\ context} produces fresh - varians of \isa{names}; the result is entered into the context. - - \end{description}% -\end{isamarkuptext}% -\isamarkuptrue% -% -\endisatagmlref -{\isafoldmlref}% -% -\isadelimmlref -% -\endisadelimmlref -% -\isamarkupsubsection{Indexed names% -} -\isamarkuptrue% -% -\begin{isamarkuptext}% -An \emph{indexed name} (or \isa{indexname}) is a pair of a basic - name and a natural number. This representation allows efficient - renaming by incrementing the second component only. The canonical - way to rename two collections of indexnames apart from each other is - this: determine the maximum index \isa{maxidx} of the first - collection, then increment all indexes of the second collection by - \isa{maxidx\ {\isacharplus}\ {\isadigit{1}}}; the maximum index of an empty collection is - \isa{{\isacharminus}{\isadigit{1}}}. - - Occasionally, basic names and indexed names are injected into the - same pair type: the (improper) indexname \isa{{\isacharparenleft}x{\isacharcomma}\ {\isacharminus}{\isadigit{1}}{\isacharparenright}} is used - to encode basic names. - - \medskip Isabelle syntax observes the following rules for - representing an indexname \isa{{\isacharparenleft}x{\isacharcomma}\ i{\isacharparenright}} as a packed string: - - \begin{itemize} - - \item \isa{{\isacharquery}x} if \isa{x} does not end with a digit and \isa{i\ {\isacharequal}\ {\isadigit{0}}}, - - \item \isa{{\isacharquery}xi} if \isa{x} does not end with a digit, - - \item \isa{{\isacharquery}x{\isachardot}i} otherwise. - - \end{itemize} - - Indexnames may acquire large index numbers over time. Results are - normalized towards \isa{{\isadigit{0}}} at certain checkpoints, notably at - the end of a proof. This works by producing variants of the - corresponding basic name components. For example, the collection - \isa{{\isacharquery}x{\isadigit{1}}{\isacharcomma}\ {\isacharquery}x{\isadigit{7}}{\isacharcomma}\ {\isacharquery}x{\isadigit{4}}{\isadigit{2}}} becomes \isa{{\isacharquery}x{\isacharcomma}\ {\isacharquery}xa{\isacharcomma}\ {\isacharquery}xb}.% -\end{isamarkuptext}% -\isamarkuptrue% -% -\isadelimmlref -% -\endisadelimmlref -% -\isatagmlref -% -\begin{isamarkuptext}% -\begin{mldecls} - \indexmltype{indexname}\verb|type indexname| \\ - \end{mldecls} - - \begin{description} - - \item \verb|indexname| represents indexed names. This is an - abbreviation for \verb|string * int|. The second component is - usually non-negative, except for situations where \isa{{\isacharparenleft}x{\isacharcomma}\ {\isacharminus}{\isadigit{1}}{\isacharparenright}} - is used to embed basic names into this type. - - \end{description}% -\end{isamarkuptext}% -\isamarkuptrue% -% -\endisatagmlref -{\isafoldmlref}% -% -\isadelimmlref -% -\endisadelimmlref -% -\isamarkupsubsection{Qualified names and name spaces% -} -\isamarkuptrue% -% -\begin{isamarkuptext}% -A \emph{qualified name} consists of a non-empty sequence of basic - name components. The packed representation uses a dot as separator, - as in ``\isa{A{\isachardot}b{\isachardot}c}''. The last component is called \emph{base} - name, the remaining prefix \emph{qualifier} (which may be empty). - The idea of qualified names is to encode nested structures by - recording the access paths as qualifiers. For example, an item - named ``\isa{A{\isachardot}b{\isachardot}c}'' may be understood as a local entity \isa{c}, within a local structure \isa{b}, within a global - structure \isa{A}. Typically, name space hierarchies consist of - 1--2 levels of qualification, but this need not be always so. - - The empty name is commonly used as an indication of unnamed - entities, whenever this makes any sense. The basic operations on - qualified names are smart enough to pass through such improper names - unchanged. - - \medskip A \isa{naming} policy tells how to turn a name - specification into a fully qualified internal name (by the \isa{full} operation), and how fully qualified names may be accessed - externally. For example, the default naming policy is to prefix an - implicit path: \isa{full\ x} produces \isa{path{\isachardot}x}, and the - standard accesses for \isa{path{\isachardot}x} include both \isa{x} and - \isa{path{\isachardot}x}. Normally, the naming is implicit in the theory or - proof context; there are separate versions of the corresponding. - - \medskip A \isa{name\ space} manages a collection of fully - internalized names, together with a mapping between external names - and internal names (in both directions). The corresponding \isa{intern} and \isa{extern} operations are mostly used for - parsing and printing only! The \isa{declare} operation augments - a name space according to the accesses determined by the naming - policy. - - \medskip As a general principle, there is a separate name space for - each kind of formal entity, e.g.\ logical constant, type - constructor, type class, theorem. It is usually clear from the - occurrence in concrete syntax (or from the scope) which kind of - entity a name refers to. For example, the very same name \isa{c} may be used uniformly for a constant, type constructor, and - type class. - - There are common schemes to name theorems systematically, according - to the name of the main logical entity involved, e.g.\ \isa{c{\isachardot}intro} for a canonical theorem related to constant \isa{c}. - This technique of mapping names from one space into another requires - some care in order to avoid conflicts. In particular, theorem names - derived from a type constructor or type class are better suffixed in - addition to the usual qualification, e.g.\ \isa{c{\isacharunderscore}type{\isachardot}intro} - and \isa{c{\isacharunderscore}class{\isachardot}intro} for theorems related to type \isa{c} - and class \isa{c}, respectively.% -\end{isamarkuptext}% -\isamarkuptrue% -% -\isadelimmlref -% -\endisadelimmlref -% -\isatagmlref -% -\begin{isamarkuptext}% -\begin{mldecls} - \indexml{NameSpace.base}\verb|NameSpace.base: string -> string| \\ - \indexml{NameSpace.qualifier}\verb|NameSpace.qualifier: string -> string| \\ - \indexml{NameSpace.append}\verb|NameSpace.append: string -> string -> string| \\ - \indexml{NameSpace.implode}\verb|NameSpace.implode: string list -> string| \\ - \indexml{NameSpace.explode}\verb|NameSpace.explode: string -> string list| \\ - \end{mldecls} - \begin{mldecls} - \indexmltype{NameSpace.naming}\verb|type NameSpace.naming| \\ - \indexml{NameSpace.default\_naming}\verb|NameSpace.default_naming: NameSpace.naming| \\ - \indexml{NameSpace.add\_path}\verb|NameSpace.add_path: string -> NameSpace.naming -> NameSpace.naming| \\ - \indexml{NameSpace.full\_name}\verb|NameSpace.full_name: NameSpace.naming -> binding -> string| \\ - \end{mldecls} - \begin{mldecls} - \indexmltype{NameSpace.T}\verb|type NameSpace.T| \\ - \indexml{NameSpace.empty}\verb|NameSpace.empty: NameSpace.T| \\ - \indexml{NameSpace.merge}\verb|NameSpace.merge: NameSpace.T * NameSpace.T -> NameSpace.T| \\ - \indexml{NameSpace.declare}\verb|NameSpace.declare: NameSpace.naming -> binding -> NameSpace.T -> string * NameSpace.T| \\ - \indexml{NameSpace.intern}\verb|NameSpace.intern: NameSpace.T -> string -> string| \\ - \indexml{NameSpace.extern}\verb|NameSpace.extern: NameSpace.T -> string -> string| \\ - \end{mldecls} - - \begin{description} - - \item \verb|NameSpace.base|~\isa{name} returns the base name of a - qualified name. - - \item \verb|NameSpace.qualifier|~\isa{name} returns the qualifier - of a qualified name. - - \item \verb|NameSpace.append|~\isa{name\isactrlisub {\isadigit{1}}\ name\isactrlisub {\isadigit{2}}} - appends two qualified names. - - \item \verb|NameSpace.implode|~\isa{name} and \verb|NameSpace.explode|~\isa{names} convert between the packed string - representation and the explicit list form of qualified names. - - \item \verb|NameSpace.naming| represents the abstract concept of - a naming policy. - - \item \verb|NameSpace.default_naming| is the default naming policy. - In a theory context, this is usually augmented by a path prefix - consisting of the theory name. - - \item \verb|NameSpace.add_path|~\isa{path\ naming} augments the - naming policy by extending its path component. - - \item \verb|NameSpace.full_name|\isa{naming\ binding} turns a name - binding (usually a basic name) into the fully qualified - internal name, according to the given naming policy. - - \item \verb|NameSpace.T| represents name spaces. - - \item \verb|NameSpace.empty| and \verb|NameSpace.merge|~\isa{{\isacharparenleft}space\isactrlisub {\isadigit{1}}{\isacharcomma}\ space\isactrlisub {\isadigit{2}}{\isacharparenright}} are the canonical operations for - maintaining name spaces according to theory data management - (\secref{sec:context-data}). - - \item \verb|NameSpace.declare|~\isa{naming\ bindings\ space} enters a - name binding as fully qualified internal name into the name space, - with external accesses determined by the naming policy. - - \item \verb|NameSpace.intern|~\isa{space\ name} internalizes a - (partially qualified) external name. - - This operation is mostly for parsing! Note that fully qualified - names stemming from declarations are produced via \verb|NameSpace.full_name| and \verb|NameSpace.declare| - (or their derivatives for \verb|theory| and - \verb|Proof.context|). - - \item \verb|NameSpace.extern|~\isa{space\ name} externalizes a - (fully qualified) internal name. - - This operation is mostly for printing! Note unqualified names are - produced via \verb|NameSpace.base|. - - \end{description}% -\end{isamarkuptext}% -\isamarkuptrue% -% -\endisatagmlref -{\isafoldmlref}% -% -\isadelimmlref -% -\endisadelimmlref -% -\isadelimtheory -% -\endisadelimtheory -% -\isatagtheory -\isacommand{end}\isamarkupfalse% -% -\endisatagtheory -{\isafoldtheory}% -% -\isadelimtheory -% -\endisadelimtheory -\isanewline -\end{isabellebody}% -%%% Local Variables: -%%% mode: latex -%%% TeX-master: "root" -%%% End: diff -r 419116f1157a -r e23770bc97c8 doc-src/IsarImplementation/Thy/document/proof.tex --- a/doc-src/IsarImplementation/Thy/document/proof.tex Thu Feb 26 08:44:44 2009 -0800 +++ /dev/null Thu Jan 01 00:00:00 1970 +0000 @@ -1,396 +0,0 @@ -% -\begin{isabellebody}% -\def\isabellecontext{proof}% -% -\isadelimtheory -\isanewline -\isanewline -\isanewline -% -\endisadelimtheory -% -\isatagtheory -\isacommand{theory}\isamarkupfalse% -\ {\isachardoublequoteopen}proof{\isachardoublequoteclose}\ \isakeyword{imports}\ base\ \isakeyword{begin}% -\endisatagtheory -{\isafoldtheory}% -% -\isadelimtheory -% -\endisadelimtheory -% -\isamarkupchapter{Structured proofs% -} -\isamarkuptrue% -% -\isamarkupsection{Variables \label{sec:variables}% -} -\isamarkuptrue% -% -\begin{isamarkuptext}% -Any variable that is not explicitly bound by \isa{{\isasymlambda}}-abstraction - is considered as ``free''. Logically, free variables act like - outermost universal quantification at the sequent level: \isa{A\isactrlisub {\isadigit{1}}{\isacharparenleft}x{\isacharparenright}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ A\isactrlisub n{\isacharparenleft}x{\isacharparenright}\ {\isasymturnstile}\ B{\isacharparenleft}x{\isacharparenright}} means that the result - holds \emph{for all} values of \isa{x}. Free variables for - terms (not types) can be fully internalized into the logic: \isa{{\isasymturnstile}\ B{\isacharparenleft}x{\isacharparenright}} and \isa{{\isasymturnstile}\ {\isasymAnd}x{\isachardot}\ B{\isacharparenleft}x{\isacharparenright}} are interchangeable, provided - that \isa{x} does not occur elsewhere in the context. - Inspecting \isa{{\isasymturnstile}\ {\isasymAnd}x{\isachardot}\ B{\isacharparenleft}x{\isacharparenright}} more closely, we see that inside the - quantifier, \isa{x} is essentially ``arbitrary, but fixed'', - while from outside it appears as a place-holder for instantiation - (thanks to \isa{{\isasymAnd}} elimination). - - The Pure logic represents the idea of variables being either inside - or outside the current scope by providing separate syntactic - categories for \emph{fixed variables} (e.g.\ \isa{x}) vs.\ - \emph{schematic variables} (e.g.\ \isa{{\isacharquery}x}). Incidently, a - universal result \isa{{\isasymturnstile}\ {\isasymAnd}x{\isachardot}\ B{\isacharparenleft}x{\isacharparenright}} has the HHF normal form \isa{{\isasymturnstile}\ B{\isacharparenleft}{\isacharquery}x{\isacharparenright}}, which represents its generality nicely without requiring - an explicit quantifier. The same principle works for type - variables: \isa{{\isasymturnstile}\ B{\isacharparenleft}{\isacharquery}{\isasymalpha}{\isacharparenright}} represents the idea of ``\isa{{\isasymturnstile}\ {\isasymforall}{\isasymalpha}{\isachardot}\ B{\isacharparenleft}{\isasymalpha}{\isacharparenright}}'' without demanding a truly polymorphic framework. - - \medskip Additional care is required to treat type variables in a - way that facilitates type-inference. In principle, term variables - depend on type variables, which means that type variables would have - to be declared first. For example, a raw type-theoretic framework - would demand the context to be constructed in stages as follows: - \isa{{\isasymGamma}\ {\isacharequal}\ {\isasymalpha}{\isacharcolon}\ type{\isacharcomma}\ x{\isacharcolon}\ {\isasymalpha}{\isacharcomma}\ a{\isacharcolon}\ A{\isacharparenleft}x\isactrlisub {\isasymalpha}{\isacharparenright}}. - - We allow a slightly less formalistic mode of operation: term - variables \isa{x} are fixed without specifying a type yet - (essentially \emph{all} potential occurrences of some instance - \isa{x\isactrlisub {\isasymtau}} are fixed); the first occurrence of \isa{x} - within a specific term assigns its most general type, which is then - maintained consistently in the context. The above example becomes - \isa{{\isasymGamma}\ {\isacharequal}\ x{\isacharcolon}\ term{\isacharcomma}\ {\isasymalpha}{\isacharcolon}\ type{\isacharcomma}\ A{\isacharparenleft}x\isactrlisub {\isasymalpha}{\isacharparenright}}, where type \isa{{\isasymalpha}} is fixed \emph{after} term \isa{x}, and the constraint - \isa{x\ {\isacharcolon}{\isacharcolon}\ {\isasymalpha}} is an implicit consequence of the occurrence of - \isa{x\isactrlisub {\isasymalpha}} in the subsequent proposition. - - This twist of dependencies is also accommodated by the reverse - operation of exporting results from a context: a type variable - \isa{{\isasymalpha}} is considered fixed as long as it occurs in some fixed - term variable of the context. For example, exporting \isa{x{\isacharcolon}\ term{\isacharcomma}\ {\isasymalpha}{\isacharcolon}\ type\ {\isasymturnstile}\ x\isactrlisub {\isasymalpha}\ {\isacharequal}\ x\isactrlisub {\isasymalpha}} produces in the first step - \isa{x{\isacharcolon}\ term\ {\isasymturnstile}\ x\isactrlisub {\isasymalpha}\ {\isacharequal}\ x\isactrlisub {\isasymalpha}} for fixed \isa{{\isasymalpha}}, - and only in the second step \isa{{\isasymturnstile}\ {\isacharquery}x\isactrlisub {\isacharquery}\isactrlisub {\isasymalpha}\ {\isacharequal}\ {\isacharquery}x\isactrlisub {\isacharquery}\isactrlisub {\isasymalpha}} for schematic \isa{{\isacharquery}x} and \isa{{\isacharquery}{\isasymalpha}}. - - \medskip The Isabelle/Isar proof context manages the gory details of - term vs.\ type variables, with high-level principles for moving the - frontier between fixed and schematic variables. - - The \isa{add{\isacharunderscore}fixes} operation explictly declares fixed - variables; the \isa{declare{\isacharunderscore}term} operation absorbs a term into - a context by fixing new type variables and adding syntactic - constraints. - - The \isa{export} operation is able to perform the main work of - generalizing term and type variables as sketched above, assuming - that fixing variables and terms have been declared properly. - - There \isa{import} operation makes a generalized fact a genuine - part of the context, by inventing fixed variables for the schematic - ones. The effect can be reversed by using \isa{export} later, - potentially with an extended context; the result is equivalent to - the original modulo renaming of schematic variables. - - The \isa{focus} operation provides a variant of \isa{import} - for nested propositions (with explicit quantification): \isa{{\isasymAnd}x\isactrlisub {\isadigit{1}}\ {\isasymdots}\ x\isactrlisub n{\isachardot}\ B{\isacharparenleft}x\isactrlisub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ x\isactrlisub n{\isacharparenright}} is - decomposed by inventing fixed variables \isa{x\isactrlisub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ x\isactrlisub n} for the body.% -\end{isamarkuptext}% -\isamarkuptrue% -% -\isadelimmlref -% -\endisadelimmlref -% -\isatagmlref -% -\begin{isamarkuptext}% -\begin{mldecls} - \indexml{Variable.add\_fixes}\verb|Variable.add_fixes: |\isasep\isanewline% -\verb| string list -> Proof.context -> string list * Proof.context| \\ - \indexml{Variable.variant\_fixes}\verb|Variable.variant_fixes: |\isasep\isanewline% -\verb| string list -> Proof.context -> string list * Proof.context| \\ - \indexml{Variable.declare\_term}\verb|Variable.declare_term: term -> Proof.context -> Proof.context| \\ - \indexml{Variable.declare\_constraints}\verb|Variable.declare_constraints: term -> Proof.context -> Proof.context| \\ - \indexml{Variable.export}\verb|Variable.export: Proof.context -> Proof.context -> thm list -> thm list| \\ - \indexml{Variable.polymorphic}\verb|Variable.polymorphic: Proof.context -> term list -> term list| \\ - \indexml{Variable.import\_thms}\verb|Variable.import_thms: bool -> thm list -> Proof.context ->|\isasep\isanewline% -\verb| ((ctyp list * cterm list) * thm list) * Proof.context| \\ - \indexml{Variable.focus}\verb|Variable.focus: cterm -> Proof.context -> (cterm list * cterm) * Proof.context| \\ - \end{mldecls} - - \begin{description} - - \item \verb|Variable.add_fixes|~\isa{xs\ ctxt} fixes term - variables \isa{xs}, returning the resulting internal names. By - default, the internal representation coincides with the external - one, which also means that the given variables must not be fixed - already. There is a different policy within a local proof body: the - given names are just hints for newly invented Skolem variables. - - \item \verb|Variable.variant_fixes| is similar to \verb|Variable.add_fixes|, but always produces fresh variants of the given - names. - - \item \verb|Variable.declare_term|~\isa{t\ ctxt} declares term - \isa{t} to belong to the context. This automatically fixes new - type variables, but not term variables. Syntactic constraints for - type and term variables are declared uniformly, though. - - \item \verb|Variable.declare_constraints|~\isa{t\ ctxt} declares - syntactic constraints from term \isa{t}, without making it part - of the context yet. - - \item \verb|Variable.export|~\isa{inner\ outer\ thms} generalizes - fixed type and term variables in \isa{thms} according to the - difference of the \isa{inner} and \isa{outer} context, - following the principles sketched above. - - \item \verb|Variable.polymorphic|~\isa{ctxt\ ts} generalizes type - variables in \isa{ts} as far as possible, even those occurring - in fixed term variables. The default policy of type-inference is to - fix newly introduced type variables, which is essentially reversed - with \verb|Variable.polymorphic|: here the given terms are detached - from the context as far as possible. - - \item \verb|Variable.import_thms|~\isa{open\ thms\ ctxt} invents fixed - type and term variables for the schematic ones occurring in \isa{thms}. The \isa{open} flag indicates whether the fixed names - should be accessible to the user, otherwise newly introduced names - are marked as ``internal'' (\secref{sec:names}). - - \item \verb|Variable.focus|~\isa{B} decomposes the outermost \isa{{\isasymAnd}} prefix of proposition \isa{B}. - - \end{description}% -\end{isamarkuptext}% -\isamarkuptrue% -% -\endisatagmlref -{\isafoldmlref}% -% -\isadelimmlref -% -\endisadelimmlref -% -\isamarkupsection{Assumptions \label{sec:assumptions}% -} -\isamarkuptrue% -% -\begin{isamarkuptext}% -An \emph{assumption} is a proposition that it is postulated in the - current context. Local conclusions may use assumptions as - additional facts, but this imposes implicit hypotheses that weaken - the overall statement. - - Assumptions are restricted to fixed non-schematic statements, i.e.\ - all generality needs to be expressed by explicit quantifiers. - Nevertheless, the result will be in HHF normal form with outermost - quantifiers stripped. For example, by assuming \isa{{\isasymAnd}x\ {\isacharcolon}{\isacharcolon}\ {\isasymalpha}{\isachardot}\ P\ x} we get \isa{{\isasymAnd}x\ {\isacharcolon}{\isacharcolon}\ {\isasymalpha}{\isachardot}\ P\ x\ {\isasymturnstile}\ P\ {\isacharquery}x} for schematic \isa{{\isacharquery}x} - of fixed type \isa{{\isasymalpha}}. Local derivations accumulate more and - more explicit references to hypotheses: \isa{A\isactrlisub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ A\isactrlisub n\ {\isasymturnstile}\ B} where \isa{A\isactrlisub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ A\isactrlisub n} needs to - be covered by the assumptions of the current context. - - \medskip The \isa{add{\isacharunderscore}assms} operation augments the context by - local assumptions, which are parameterized by an arbitrary \isa{export} rule (see below). - - The \isa{export} operation moves facts from a (larger) inner - context into a (smaller) outer context, by discharging the - difference of the assumptions as specified by the associated export - rules. Note that the discharged portion is determined by the - difference contexts, not the facts being exported! There is a - separate flag to indicate a goal context, where the result is meant - to refine an enclosing sub-goal of a structured proof state (cf.\ - \secref{sec:isar-proof-state}). - - \medskip The most basic export rule discharges assumptions directly - by means of the \isa{{\isasymLongrightarrow}} introduction rule: - \[ - \infer[(\isa{{\isasymLongrightarrow}{\isacharunderscore}intro})]{\isa{{\isasymGamma}\ {\isacharbackslash}\ A\ {\isasymturnstile}\ A\ {\isasymLongrightarrow}\ B}}{\isa{{\isasymGamma}\ {\isasymturnstile}\ B}} - \] - - The variant for goal refinements marks the newly introduced - premises, which causes the canonical Isar goal refinement scheme to - enforce unification with local premises within the goal: - \[ - \infer[(\isa{{\isacharhash}{\isasymLongrightarrow}{\isacharunderscore}intro})]{\isa{{\isasymGamma}\ {\isacharbackslash}\ A\ {\isasymturnstile}\ {\isacharhash}A\ {\isasymLongrightarrow}\ B}}{\isa{{\isasymGamma}\ {\isasymturnstile}\ B}} - \] - - \medskip Alternative versions of assumptions may perform arbitrary - transformations on export, as long as the corresponding portion of - hypotheses is removed from the given facts. For example, a local - definition works by fixing \isa{x} and assuming \isa{x\ {\isasymequiv}\ t}, - with the following export rule to reverse the effect: - \[ - \infer[(\isa{{\isasymequiv}{\isacharminus}expand})]{\isa{{\isasymGamma}\ {\isacharbackslash}\ x\ {\isasymequiv}\ t\ {\isasymturnstile}\ B\ t}}{\isa{{\isasymGamma}\ {\isasymturnstile}\ B\ x}} - \] - This works, because the assumption \isa{x\ {\isasymequiv}\ t} was introduced in - a context with \isa{x} being fresh, so \isa{x} does not - occur in \isa{{\isasymGamma}} here.% -\end{isamarkuptext}% -\isamarkuptrue% -% -\isadelimmlref -% -\endisadelimmlref -% -\isatagmlref -% -\begin{isamarkuptext}% -\begin{mldecls} - \indexmltype{Assumption.export}\verb|type Assumption.export| \\ - \indexml{Assumption.assume}\verb|Assumption.assume: cterm -> thm| \\ - \indexml{Assumption.add\_assms}\verb|Assumption.add_assms: Assumption.export ->|\isasep\isanewline% -\verb| cterm list -> Proof.context -> thm list * Proof.context| \\ - \indexml{Assumption.add\_assumes}\verb|Assumption.add_assumes: |\isasep\isanewline% -\verb| cterm list -> Proof.context -> thm list * Proof.context| \\ - \indexml{Assumption.export}\verb|Assumption.export: bool -> Proof.context -> Proof.context -> thm -> thm| \\ - \end{mldecls} - - \begin{description} - - \item \verb|Assumption.export| represents arbitrary export - rules, which is any function of type \verb|bool -> cterm list -> thm -> thm|, - where the \verb|bool| indicates goal mode, and the \verb|cterm list| the collection of assumptions to be discharged - simultaneously. - - \item \verb|Assumption.assume|~\isa{A} turns proposition \isa{A} into a raw assumption \isa{A\ {\isasymturnstile}\ A{\isacharprime}}, where the conclusion - \isa{A{\isacharprime}} is in HHF normal form. - - \item \verb|Assumption.add_assms|~\isa{r\ As} augments the context - by assumptions \isa{As} with export rule \isa{r}. The - resulting facts are hypothetical theorems as produced by the raw - \verb|Assumption.assume|. - - \item \verb|Assumption.add_assumes|~\isa{As} is a special case of - \verb|Assumption.add_assms| where the export rule performs \isa{{\isasymLongrightarrow}{\isacharunderscore}intro} or \isa{{\isacharhash}{\isasymLongrightarrow}{\isacharunderscore}intro}, depending on goal mode. - - \item \verb|Assumption.export|~\isa{is{\isacharunderscore}goal\ inner\ outer\ thm} - exports result \isa{thm} from the the \isa{inner} context - back into the \isa{outer} one; \isa{is{\isacharunderscore}goal\ {\isacharequal}\ true} means - this is a goal context. The result is in HHF normal form. Note - that \verb|ProofContext.export| combines \verb|Variable.export| - and \verb|Assumption.export| in the canonical way. - - \end{description}% -\end{isamarkuptext}% -\isamarkuptrue% -% -\endisatagmlref -{\isafoldmlref}% -% -\isadelimmlref -% -\endisadelimmlref -% -\isamarkupsection{Results \label{sec:results}% -} -\isamarkuptrue% -% -\begin{isamarkuptext}% -Local results are established by monotonic reasoning from facts - within a context. This allows common combinations of theorems, - e.g.\ via \isa{{\isasymAnd}{\isacharslash}{\isasymLongrightarrow}} elimination, resolution rules, or equational - reasoning, see \secref{sec:thms}. Unaccounted context manipulations - should be avoided, notably raw \isa{{\isasymAnd}{\isacharslash}{\isasymLongrightarrow}} introduction or ad-hoc - references to free variables or assumptions not present in the proof - context. - - \medskip The \isa{SUBPROOF} combinator allows to structure a - tactical proof recursively by decomposing a selected sub-goal: - \isa{{\isacharparenleft}{\isasymAnd}x{\isachardot}\ A{\isacharparenleft}x{\isacharparenright}\ {\isasymLongrightarrow}\ B{\isacharparenleft}x{\isacharparenright}{\isacharparenright}\ {\isasymLongrightarrow}\ {\isasymdots}} is turned into \isa{B{\isacharparenleft}x{\isacharparenright}\ {\isasymLongrightarrow}\ {\isasymdots}} - after fixing \isa{x} and assuming \isa{A{\isacharparenleft}x{\isacharparenright}}. This means - the tactic needs to solve the conclusion, but may use the premise as - a local fact, for locally fixed variables. - - The \isa{prove} operation provides an interface for structured - backwards reasoning under program control, with some explicit sanity - checks of the result. The goal context can be augmented by - additional fixed variables (cf.\ \secref{sec:variables}) and - assumptions (cf.\ \secref{sec:assumptions}), which will be available - as local facts during the proof and discharged into implications in - the result. Type and term variables are generalized as usual, - according to the context. - - The \isa{obtain} operation produces results by eliminating - existing facts by means of a given tactic. This acts like a dual - conclusion: the proof demonstrates that the context may be augmented - by certain fixed variables and assumptions. See also - \cite{isabelle-isar-ref} for the user-level \isa{{\isasymOBTAIN}} and - \isa{{\isasymGUESS}} elements. Final results, which may not refer to - the parameters in the conclusion, need to exported explicitly into - the original context.% -\end{isamarkuptext}% -\isamarkuptrue% -% -\isadelimmlref -% -\endisadelimmlref -% -\isatagmlref -% -\begin{isamarkuptext}% -\begin{mldecls} - \indexml{SUBPROOF}\verb|SUBPROOF: ({context: Proof.context, schematics: ctyp list * cterm list,|\isasep\isanewline% -\verb| params: cterm list, asms: cterm list, concl: cterm,|\isasep\isanewline% -\verb| prems: thm list} -> tactic) -> Proof.context -> int -> tactic| \\ - \end{mldecls} - \begin{mldecls} - \indexml{Goal.prove}\verb|Goal.prove: Proof.context -> string list -> term list -> term ->|\isasep\isanewline% -\verb| ({prems: thm list, context: Proof.context} -> tactic) -> thm| \\ - \indexml{Goal.prove\_multi}\verb|Goal.prove_multi: Proof.context -> string list -> term list -> term list ->|\isasep\isanewline% -\verb| ({prems: thm list, context: Proof.context} -> tactic) -> thm list| \\ - \end{mldecls} - \begin{mldecls} - \indexml{Obtain.result}\verb|Obtain.result: (Proof.context -> tactic) ->|\isasep\isanewline% -\verb| thm list -> Proof.context -> (cterm list * thm list) * Proof.context| \\ - \end{mldecls} - - \begin{description} - - \item \verb|SUBPROOF|~\isa{tac} decomposes the structure of a - particular sub-goal, producing an extended context and a reduced - goal, which needs to be solved by the given tactic. All schematic - parameters of the goal are imported into the context as fixed ones, - which may not be instantiated in the sub-proof. - - \item \verb|Goal.prove|~\isa{ctxt\ xs\ As\ C\ tac} states goal \isa{C} in the context augmented by fixed variables \isa{xs} and - assumptions \isa{As}, and applies tactic \isa{tac} to solve - it. The latter may depend on the local assumptions being presented - as facts. The result is in HHF normal form. - - \item \verb|Goal.prove_multi| is simular to \verb|Goal.prove|, but - states several conclusions simultaneously. The goal is encoded by - means of Pure conjunction; \verb|Goal.conjunction_tac| will turn this - into a collection of individual subgoals. - - \item \verb|Obtain.result|~\isa{tac\ thms\ ctxt} eliminates the - given facts using a tactic, which results in additional fixed - variables and assumptions in the context. Final results need to be - exported explicitly. - - \end{description}% -\end{isamarkuptext}% -\isamarkuptrue% -% -\endisatagmlref -{\isafoldmlref}% -% -\isadelimmlref -% -\endisadelimmlref -% -\isadelimtheory -% -\endisadelimtheory -% -\isatagtheory -\isacommand{end}\isamarkupfalse% -% -\endisatagtheory -{\isafoldtheory}% -% -\isadelimtheory -% -\endisadelimtheory -\isanewline -\end{isabellebody}% -%%% Local Variables: -%%% mode: latex -%%% TeX-master: "root" -%%% End: diff -r 419116f1157a -r e23770bc97c8 doc-src/IsarImplementation/Thy/document/session.tex --- a/doc-src/IsarImplementation/Thy/document/session.tex Thu Feb 26 08:44:44 2009 -0800 +++ b/doc-src/IsarImplementation/Thy/document/session.tex Thu Feb 26 08:48:33 2009 -0800 @@ -1,18 +1,18 @@ -\input{base.tex} +\input{Base.tex} -\input{prelim.tex} +\input{Prelim.tex} -\input{logic.tex} +\input{Logic.tex} -\input{tactic.tex} +\input{Tactic.tex} -\input{proof.tex} +\input{Proof.tex} -\input{isar.tex} +\input{Isar.tex} -\input{locale.tex} +\input{Local_Theory.tex} -\input{integration.tex} +\input{Integration.tex} \input{ML.tex} diff -r 419116f1157a -r e23770bc97c8 doc-src/IsarImplementation/Thy/document/tactic.tex --- a/doc-src/IsarImplementation/Thy/document/tactic.tex Thu Feb 26 08:44:44 2009 -0800 +++ /dev/null Thu Jan 01 00:00:00 1970 +0000 @@ -1,512 +0,0 @@ -% -\begin{isabellebody}% -\def\isabellecontext{tactic}% -% -\isadelimtheory -\isanewline -\isanewline -\isanewline -% -\endisadelimtheory -% -\isatagtheory -\isacommand{theory}\isamarkupfalse% -\ tactic\ \isakeyword{imports}\ base\ \isakeyword{begin}% -\endisatagtheory -{\isafoldtheory}% -% -\isadelimtheory -% -\endisadelimtheory -% -\isamarkupchapter{Tactical reasoning% -} -\isamarkuptrue% -% -\begin{isamarkuptext}% -Tactical reasoning works by refining the initial claim in a - backwards fashion, until a solved form is reached. A \isa{goal} - consists of several subgoals that need to be solved in order to - achieve the main statement; zero subgoals means that the proof may - be finished. A \isa{tactic} is a refinement operation that maps - a goal to a lazy sequence of potential successors. A \isa{tactical} is a combinator for composing tactics.% -\end{isamarkuptext}% -\isamarkuptrue% -% -\isamarkupsection{Goals \label{sec:tactical-goals}% -} -\isamarkuptrue% -% -\begin{isamarkuptext}% -Isabelle/Pure represents a goal\glossary{Tactical goal}{A theorem of - \seeglossary{Horn Clause} form stating that a number of subgoals - imply the main conclusion, which is marked as a protected - proposition.} as a theorem stating that the subgoals imply the main - goal: \isa{A\isactrlsub {\isadigit{1}}\ {\isasymLongrightarrow}\ {\isasymdots}\ {\isasymLongrightarrow}\ A\isactrlsub n\ {\isasymLongrightarrow}\ C}. The outermost goal - structure is that of a Horn Clause\glossary{Horn Clause}{An iterated - implication \isa{A\isactrlsub {\isadigit{1}}\ {\isasymLongrightarrow}\ {\isasymdots}\ {\isasymLongrightarrow}\ A\isactrlsub n\ {\isasymLongrightarrow}\ C}, without any - outermost quantifiers. Strictly speaking, propositions \isa{A\isactrlsub i} need to be atomic in Horn Clauses, but Isabelle admits - arbitrary substructure here (nested \isa{{\isasymLongrightarrow}} and \isa{{\isasymAnd}} - connectives).}: i.e.\ an iterated implication without any - quantifiers\footnote{Recall that outermost \isa{{\isasymAnd}x{\isachardot}\ {\isasymphi}{\isacharbrackleft}x{\isacharbrackright}} is - always represented via schematic variables in the body: \isa{{\isasymphi}{\isacharbrackleft}{\isacharquery}x{\isacharbrackright}}. These variables may get instantiated during the course of - reasoning.}. For \isa{n\ {\isacharequal}\ {\isadigit{0}}} a goal is called ``solved''. - - The structure of each subgoal \isa{A\isactrlsub i} is that of a general - Hereditary Harrop Formula \isa{{\isasymAnd}x\isactrlsub {\isadigit{1}}\ {\isasymdots}\ {\isasymAnd}x\isactrlsub k{\isachardot}\ H\isactrlsub {\isadigit{1}}\ {\isasymLongrightarrow}\ {\isasymdots}\ {\isasymLongrightarrow}\ H\isactrlsub m\ {\isasymLongrightarrow}\ B} in - normal form. Here \isa{x\isactrlsub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ x\isactrlsub k} are goal parameters, i.e.\ - arbitrary-but-fixed entities of certain types, and \isa{H\isactrlsub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ H\isactrlsub m} are goal hypotheses, i.e.\ facts that may be assumed locally. - Together, this forms the goal context of the conclusion \isa{B} to - be established. The goal hypotheses may be again arbitrary - Hereditary Harrop Formulas, although the level of nesting rarely - exceeds 1--2 in practice. - - The main conclusion \isa{C} is internally marked as a protected - proposition\glossary{Protected proposition}{An arbitrarily - structured proposition \isa{C} which is forced to appear as - atomic by wrapping it into a propositional identity operator; - notation \isa{{\isacharhash}C}. Protecting a proposition prevents basic - inferences from entering into that structure for the time being.}, - which is represented explicitly by the notation \isa{{\isacharhash}C}. This - ensures that the decomposition into subgoals and main conclusion is - well-defined for arbitrarily structured claims. - - \medskip Basic goal management is performed via the following - Isabelle/Pure rules: - - \[ - \infer[\isa{{\isacharparenleft}init{\isacharparenright}}]{\isa{C\ {\isasymLongrightarrow}\ {\isacharhash}C}}{} \qquad - \infer[\isa{{\isacharparenleft}finish{\isacharparenright}}]{\isa{C}}{\isa{{\isacharhash}C}} - \] - - \medskip The following low-level variants admit general reasoning - with protected propositions: - - \[ - \infer[\isa{{\isacharparenleft}protect{\isacharparenright}}]{\isa{{\isacharhash}C}}{\isa{C}} \qquad - \infer[\isa{{\isacharparenleft}conclude{\isacharparenright}}]{\isa{A\isactrlsub {\isadigit{1}}\ {\isasymLongrightarrow}\ {\isasymdots}\ {\isasymLongrightarrow}\ A\isactrlsub n\ {\isasymLongrightarrow}\ C}}{\isa{A\isactrlsub {\isadigit{1}}\ {\isasymLongrightarrow}\ {\isasymdots}\ {\isasymLongrightarrow}\ A\isactrlsub n\ {\isasymLongrightarrow}\ {\isacharhash}C}} - \]% -\end{isamarkuptext}% -\isamarkuptrue% -% -\isadelimmlref -% -\endisadelimmlref -% -\isatagmlref -% -\begin{isamarkuptext}% -\begin{mldecls} - \indexml{Goal.init}\verb|Goal.init: cterm -> thm| \\ - \indexml{Goal.finish}\verb|Goal.finish: thm -> thm| \\ - \indexml{Goal.protect}\verb|Goal.protect: thm -> thm| \\ - \indexml{Goal.conclude}\verb|Goal.conclude: thm -> thm| \\ - \end{mldecls} - - \begin{description} - - \item \verb|Goal.init|~\isa{C} initializes a tactical goal from - the well-formed proposition \isa{C}. - - \item \verb|Goal.finish|~\isa{thm} checks whether theorem - \isa{thm} is a solved goal (no subgoals), and concludes the - result by removing the goal protection. - - \item \verb|Goal.protect|~\isa{thm} protects the full statement - of theorem \isa{thm}. - - \item \verb|Goal.conclude|~\isa{thm} removes the goal - protection, even if there are pending subgoals. - - \end{description}% -\end{isamarkuptext}% -\isamarkuptrue% -% -\endisatagmlref -{\isafoldmlref}% -% -\isadelimmlref -% -\endisadelimmlref -% -\isamarkupsection{Tactics% -} -\isamarkuptrue% -% -\begin{isamarkuptext}% -A \isa{tactic} is a function \isa{goal\ {\isasymrightarrow}\ goal\isactrlsup {\isacharasterisk}\isactrlsup {\isacharasterisk}} that - maps a given goal state (represented as a theorem, cf.\ - \secref{sec:tactical-goals}) to a lazy sequence of potential - successor states. The underlying sequence implementation is lazy - both in head and tail, and is purely functional in \emph{not} - supporting memoing.\footnote{The lack of memoing and the strict - nature of SML requires some care when working with low-level - sequence operations, to avoid duplicate or premature evaluation of - results.} - - An \emph{empty result sequence} means that the tactic has failed: in - a compound tactic expressions other tactics might be tried instead, - or the whole refinement step might fail outright, producing a - toplevel error message. When implementing tactics from scratch, one - should take care to observe the basic protocol of mapping regular - error conditions to an empty result; only serious faults should - emerge as exceptions. - - By enumerating \emph{multiple results}, a tactic can easily express - the potential outcome of an internal search process. There are also - combinators for building proof tools that involve search - systematically, see also \secref{sec:tacticals}. - - \medskip As explained in \secref{sec:tactical-goals}, a goal state - essentially consists of a list of subgoals that imply the main goal - (conclusion). Tactics may operate on all subgoals or on a - particularly specified subgoal, but must not change the main - conclusion (apart from instantiating schematic goal variables). - - Tactics with explicit \emph{subgoal addressing} are of the form - \isa{int\ {\isasymrightarrow}\ tactic} and may be applied to a particular subgoal - (counting from 1). If the subgoal number is out of range, the - tactic should fail with an empty result sequence, but must not raise - an exception! - - Operating on a particular subgoal means to replace it by an interval - of zero or more subgoals in the same place; other subgoals must not - be affected, apart from instantiating schematic variables ranging - over the whole goal state. - - A common pattern of composing tactics with subgoal addressing is to - try the first one, and then the second one only if the subgoal has - not been solved yet. Special care is required here to avoid bumping - into unrelated subgoals that happen to come after the original - subgoal. Assuming that there is only a single initial subgoal is a - very common error when implementing tactics! - - Tactics with internal subgoal addressing should expose the subgoal - index as \isa{int} argument in full generality; a hardwired - subgoal 1 inappropriate. - - \medskip The main well-formedness conditions for proper tactics are - summarized as follows. - - \begin{itemize} - - \item General tactic failure is indicated by an empty result, only - serious faults may produce an exception. - - \item The main conclusion must not be changed, apart from - instantiating schematic variables. - - \item A tactic operates either uniformly on all subgoals, or - specifically on a selected subgoal (without bumping into unrelated - subgoals). - - \item Range errors in subgoal addressing produce an empty result. - - \end{itemize} - - Some of these conditions are checked by higher-level goal - infrastructure (\secref{sec:results}); others are not checked - explicitly, and violating them merely results in ill-behaved tactics - experienced by the user (e.g.\ tactics that insist in being - applicable only to singleton goals, or disallow composition with - basic tacticals).% -\end{isamarkuptext}% -\isamarkuptrue% -% -\isadelimmlref -% -\endisadelimmlref -% -\isatagmlref -% -\begin{isamarkuptext}% -\begin{mldecls} - \indexmltype{tactic}\verb|type tactic = thm -> thm Seq.seq| \\ - \indexml{no\_tac}\verb|no_tac: tactic| \\ - \indexml{all\_tac}\verb|all_tac: tactic| \\ - \indexml{print\_tac}\verb|print_tac: string -> tactic| \\[1ex] - \indexml{PRIMITIVE}\verb|PRIMITIVE: (thm -> thm) -> tactic| \\[1ex] - \indexml{SUBGOAL}\verb|SUBGOAL: (term * int -> tactic) -> int -> tactic| \\ - \indexml{CSUBGOAL}\verb|CSUBGOAL: (cterm * int -> tactic) -> int -> tactic| \\ - \end{mldecls} - - \begin{description} - - \item \verb|tactic| represents tactics. The well-formedness - conditions described above need to be observed. See also \hyperlink{file.~~/src/Pure/General/seq.ML}{\mbox{\isa{\isatt{{\isachartilde}{\isachartilde}{\isacharslash}src{\isacharslash}Pure{\isacharslash}General{\isacharslash}seq{\isachardot}ML}}}} for the underlying implementation of - lazy sequences. - - \item \verb|int -> tactic| represents tactics with explicit - subgoal addressing, with well-formedness conditions as described - above. - - \item \verb|no_tac| is a tactic that always fails, returning the - empty sequence. - - \item \verb|all_tac| is a tactic that always succeeds, returning a - singleton sequence with unchanged goal state. - - \item \verb|print_tac|~\isa{message} is like \verb|all_tac|, but - prints a message together with the goal state on the tracing - channel. - - \item \verb|PRIMITIVE|~\isa{rule} turns a primitive inference rule - into a tactic with unique result. Exception \verb|THM| is considered - a regular tactic failure and produces an empty result; other - exceptions are passed through. - - \item \verb|SUBGOAL|~\isa{{\isacharparenleft}fn\ {\isacharparenleft}subgoal{\isacharcomma}\ i{\isacharparenright}\ {\isacharequal}{\isachargreater}\ tactic{\isacharparenright}} is the - most basic form to produce a tactic with subgoal addressing. The - given abstraction over the subgoal term and subgoal number allows to - peek at the relevant information of the full goal state. The - subgoal range is checked as required above. - - \item \verb|CSUBGOAL| is similar to \verb|SUBGOAL|, but passes the - subgoal as \verb|cterm| instead of raw \verb|term|. This - avoids expensive re-certification in situations where the subgoal is - used directly for primitive inferences. - - \end{description}% -\end{isamarkuptext}% -\isamarkuptrue% -% -\endisatagmlref -{\isafoldmlref}% -% -\isadelimmlref -% -\endisadelimmlref -% -\isamarkupsubsection{Resolution and assumption tactics \label{sec:resolve-assume-tac}% -} -\isamarkuptrue% -% -\begin{isamarkuptext}% -\emph{Resolution} is the most basic mechanism for refining a - subgoal using a theorem as object-level rule. - \emph{Elim-resolution} is particularly suited for elimination rules: - it resolves with a rule, proves its first premise by assumption, and - finally deletes that assumption from any new subgoals. - \emph{Destruct-resolution} is like elim-resolution, but the given - destruction rules are first turned into canonical elimination - format. \emph{Forward-resolution} is like destruct-resolution, but - without deleting the selected assumption. The \isa{r{\isacharslash}e{\isacharslash}d{\isacharslash}f} - naming convention is maintained for several different kinds of - resolution rules and tactics. - - Assumption tactics close a subgoal by unifying some of its premises - against its conclusion. - - \medskip All the tactics in this section operate on a subgoal - designated by a positive integer. Other subgoals might be affected - indirectly, due to instantiation of schematic variables. - - There are various sources of non-determinism, the tactic result - sequence enumerates all possibilities of the following choices (if - applicable): - - \begin{enumerate} - - \item selecting one of the rules given as argument to the tactic; - - \item selecting a subgoal premise to eliminate, unifying it against - the first premise of the rule; - - \item unifying the conclusion of the subgoal to the conclusion of - the rule. - - \end{enumerate} - - Recall that higher-order unification may produce multiple results - that are enumerated here.% -\end{isamarkuptext}% -\isamarkuptrue% -% -\isadelimmlref -% -\endisadelimmlref -% -\isatagmlref -% -\begin{isamarkuptext}% -\begin{mldecls} - \indexml{resolve\_tac}\verb|resolve_tac: thm list -> int -> tactic| \\ - \indexml{eresolve\_tac}\verb|eresolve_tac: thm list -> int -> tactic| \\ - \indexml{dresolve\_tac}\verb|dresolve_tac: thm list -> int -> tactic| \\ - \indexml{forward\_tac}\verb|forward_tac: thm list -> int -> tactic| \\[1ex] - \indexml{assume\_tac}\verb|assume_tac: int -> tactic| \\ - \indexml{eq\_assume\_tac}\verb|eq_assume_tac: int -> tactic| \\[1ex] - \indexml{match\_tac}\verb|match_tac: thm list -> int -> tactic| \\ - \indexml{ematch\_tac}\verb|ematch_tac: thm list -> int -> tactic| \\ - \indexml{dmatch\_tac}\verb|dmatch_tac: thm list -> int -> tactic| \\ - \end{mldecls} - - \begin{description} - - \item \verb|resolve_tac|~\isa{thms\ i} refines the goal state - using the given theorems, which should normally be introduction - rules. The tactic resolves a rule's conclusion with subgoal \isa{i}, replacing it by the corresponding versions of the rule's - premises. - - \item \verb|eresolve_tac|~\isa{thms\ i} performs elim-resolution - with the given theorems, which should normally be elimination rules. - - \item \verb|dresolve_tac|~\isa{thms\ i} performs - destruct-resolution with the given theorems, which should normally - be destruction rules. This replaces an assumption by the result of - applying one of the rules. - - \item \verb|forward_tac| is like \verb|dresolve_tac| except that the - selected assumption is not deleted. It applies a rule to an - assumption, adding the result as a new assumption. - - \item \verb|assume_tac|~\isa{i} attempts to solve subgoal \isa{i} - by assumption (modulo higher-order unification). - - \item \verb|eq_assume_tac| is similar to \verb|assume_tac|, but checks - only for immediate \isa{{\isasymalpha}}-convertibility instead of using - unification. It succeeds (with a unique next state) if one of the - assumptions is equal to the subgoal's conclusion. Since it does not - instantiate variables, it cannot make other subgoals unprovable. - - \item \verb|match_tac|, \verb|ematch_tac|, and \verb|dmatch_tac| are - similar to \verb|resolve_tac|, \verb|eresolve_tac|, and \verb|dresolve_tac|, respectively, but do not instantiate schematic - variables in the goal state. - - Flexible subgoals are not updated at will, but are left alone. - Strictly speaking, matching means to treat the unknowns in the goal - state as constants; these tactics merely discard unifiers that would - update the goal state. - - \end{description}% -\end{isamarkuptext}% -\isamarkuptrue% -% -\endisatagmlref -{\isafoldmlref}% -% -\isadelimmlref -% -\endisadelimmlref -% -\isamarkupsubsection{Explicit instantiation within a subgoal context% -} -\isamarkuptrue% -% -\begin{isamarkuptext}% -The main resolution tactics (\secref{sec:resolve-assume-tac}) - use higher-order unification, which works well in many practical - situations despite its daunting theoretical properties. - Nonetheless, there are important problem classes where unguided - higher-order unification is not so useful. This typically involves - rules like universal elimination, existential introduction, or - equational substitution. Here the unification problem involves - fully flexible \isa{{\isacharquery}P\ {\isacharquery}x} schemes, which are hard to manage - without further hints. - - By providing a (small) rigid term for \isa{{\isacharquery}x} explicitly, the - remaining unification problem is to assign a (large) term to \isa{{\isacharquery}P}, according to the shape of the given subgoal. This is - sufficiently well-behaved in most practical situations. - - \medskip Isabelle provides separate versions of the standard \isa{r{\isacharslash}e{\isacharslash}d{\isacharslash}f} resolution tactics that allow to provide explicit - instantiations of unknowns of the given rule, wrt.\ terms that refer - to the implicit context of the selected subgoal. - - An instantiation consists of a list of pairs of the form \isa{{\isacharparenleft}{\isacharquery}x{\isacharcomma}\ t{\isacharparenright}}, where \isa{{\isacharquery}x} is a schematic variable occurring in - the given rule, and \isa{t} is a term from the current proof - context, augmented by the local goal parameters of the selected - subgoal; cf.\ the \isa{focus} operation described in - \secref{sec:variables}. - - Entering the syntactic context of a subgoal is a brittle operation, - because its exact form is somewhat accidental, and the choice of - bound variable names depends on the presence of other local and - global names. Explicit renaming of subgoal parameters prior to - explicit instantiation might help to achieve a bit more robustness. - - Type instantiations may be given as well, via pairs like \isa{{\isacharparenleft}{\isacharquery}{\isacharprime}a{\isacharcomma}\ {\isasymtau}{\isacharparenright}}. Type instantiations are distinguished from term - instantiations by the syntactic form of the schematic variable. - Types are instantiated before terms are. Since term instantiation - already performs type-inference as expected, explicit type - instantiations are seldom necessary.% -\end{isamarkuptext}% -\isamarkuptrue% -% -\isadelimmlref -% -\endisadelimmlref -% -\isatagmlref -% -\begin{isamarkuptext}% -\begin{mldecls} - \indexml{res\_inst\_tac}\verb|res_inst_tac: Proof.context -> (indexname * string) list -> thm -> int -> tactic| \\ - \indexml{eres\_inst\_tac}\verb|eres_inst_tac: Proof.context -> (indexname * string) list -> thm -> int -> tactic| \\ - \indexml{dres\_inst\_tac}\verb|dres_inst_tac: Proof.context -> (indexname * string) list -> thm -> int -> tactic| \\ - \indexml{forw\_inst\_tac}\verb|forw_inst_tac: Proof.context -> (indexname * string) list -> thm -> int -> tactic| \\[1ex] - \indexml{rename\_tac}\verb|rename_tac: string list -> int -> tactic| \\ - \end{mldecls} - - \begin{description} - - \item \verb|res_inst_tac|~\isa{ctxt\ insts\ thm\ i} instantiates the - rule \isa{thm} with the instantiations \isa{insts}, as described - above, and then performs resolution on subgoal \isa{i}. - - \item \verb|eres_inst_tac| is like \verb|res_inst_tac|, but performs - elim-resolution. - - \item \verb|dres_inst_tac| is like \verb|res_inst_tac|, but performs - destruct-resolution. - - \item \verb|forw_inst_tac| is like \verb|dres_inst_tac| except that - the selected assumption is not deleted. - - \item \verb|rename_tac|~\isa{names\ i} renames the innermost - parameters of subgoal \isa{i} according to the provided \isa{names} (which need to be distinct indentifiers). - - \end{description}% -\end{isamarkuptext}% -\isamarkuptrue% -% -\endisatagmlref -{\isafoldmlref}% -% -\isadelimmlref -% -\endisadelimmlref -% -\isamarkupsection{Tacticals \label{sec:tacticals}% -} -\isamarkuptrue% -% -\begin{isamarkuptext}% -FIXME - -\glossary{Tactical}{A functional combinator for building up complex -tactics from simpler ones. Typical tactical perform sequential -composition, disjunction (choice), iteration, or goal addressing. -Various search strategies may be expressed via tacticals.}% -\end{isamarkuptext}% -\isamarkuptrue% -% -\isadelimtheory -% -\endisadelimtheory -% -\isatagtheory -\isacommand{end}\isamarkupfalse% -% -\endisatagtheory -{\isafoldtheory}% -% -\isadelimtheory -% -\endisadelimtheory -\isanewline -\isanewline -\end{isabellebody}% -%%% Local Variables: -%%% mode: latex -%%% TeX-master: "root" -%%% End: diff -r 419116f1157a -r e23770bc97c8 doc-src/IsarImplementation/Thy/integration.thy --- a/doc-src/IsarImplementation/Thy/integration.thy Thu Feb 26 08:44:44 2009 -0800 +++ /dev/null Thu Jan 01 00:00:00 1970 +0000 @@ -1,426 +0,0 @@ - -(* $Id$ *) - -theory integration imports base begin - -chapter {* System integration *} - -section {* Isar toplevel \label{sec:isar-toplevel} *} - -text {* The Isar toplevel may be considered the centeral hub of the - Isabelle/Isar system, where all key components and sub-systems are - integrated into a single read-eval-print loop of Isar commands. We - shall even incorporate the existing {\ML} toplevel of the compiler - and run-time system (cf.\ \secref{sec:ML-toplevel}). - - Isabelle/Isar departs from the original ``LCF system architecture'' - where {\ML} was really The Meta Language for defining theories and - conducting proofs. Instead, {\ML} now only serves as the - implementation language for the system (and user extensions), while - the specific Isar toplevel supports the concepts of theory and proof - development natively. This includes the graph structure of theories - and the block structure of proofs, support for unlimited undo, - facilities for tracing, debugging, timing, profiling etc. - - \medskip The toplevel maintains an implicit state, which is - transformed by a sequence of transitions -- either interactively or - in batch-mode. In interactive mode, Isar state transitions are - encapsulated as safe transactions, such that both failure and undo - are handled conveniently without destroying the underlying draft - theory (cf.~\secref{sec:context-theory}). In batch mode, - transitions operate in a linear (destructive) fashion, such that - error conditions abort the present attempt to construct a theory or - proof altogether. - - The toplevel state is a disjoint sum of empty @{text toplevel}, or - @{text theory}, or @{text proof}. On entering the main Isar loop we - start with an empty toplevel. A theory is commenced by giving a - @{text \} header; within a theory we may issue theory - commands such as @{text \}, or state a @{text - \} to be proven. Now we are within a proof state, with a - rich collection of Isar proof commands for structured proof - composition, or unstructured proof scripts. When the proof is - concluded we get back to the theory, which is then updated by - storing the resulting fact. Further theory declarations or theorem - statements with proofs may follow, until we eventually conclude the - theory development by issuing @{text \}. The resulting theory - is then stored within the theory database and we are back to the - empty toplevel. - - In addition to these proper state transformations, there are also - some diagnostic commands for peeking at the toplevel state without - modifying it (e.g.\ \isakeyword{thm}, \isakeyword{term}, - \isakeyword{print-cases}). -*} - -text %mlref {* - \begin{mldecls} - @{index_ML_type Toplevel.state} \\ - @{index_ML Toplevel.UNDEF: "exn"} \\ - @{index_ML Toplevel.is_toplevel: "Toplevel.state -> bool"} \\ - @{index_ML Toplevel.theory_of: "Toplevel.state -> theory"} \\ - @{index_ML Toplevel.proof_of: "Toplevel.state -> Proof.state"} \\ - @{index_ML Toplevel.debug: "bool ref"} \\ - @{index_ML Toplevel.timing: "bool ref"} \\ - @{index_ML Toplevel.profiling: "int ref"} \\ - \end{mldecls} - - \begin{description} - - \item @{ML_type Toplevel.state} represents Isar toplevel states, - which are normally manipulated through the concept of toplevel - transitions only (\secref{sec:toplevel-transition}). Also note that - a raw toplevel state is subject to the same linearity restrictions - as a theory context (cf.~\secref{sec:context-theory}). - - \item @{ML Toplevel.UNDEF} is raised for undefined toplevel - operations. Many operations work only partially for certain cases, - since @{ML_type Toplevel.state} is a sum type. - - \item @{ML Toplevel.is_toplevel}~@{text "state"} checks for an empty - toplevel state. - - \item @{ML Toplevel.theory_of}~@{text "state"} selects the theory of - a theory or proof (!), otherwise raises @{ML Toplevel.UNDEF}. - - \item @{ML Toplevel.proof_of}~@{text "state"} selects the Isar proof - state if available, otherwise raises @{ML Toplevel.UNDEF}. - - \item @{ML "set Toplevel.debug"} makes the toplevel print further - details about internal error conditions, exceptions being raised - etc. - - \item @{ML "set Toplevel.timing"} makes the toplevel print timing - information for each Isar command being executed. - - \item @{ML Toplevel.profiling}~@{verbatim ":="}~@{text "n"} controls - low-level profiling of the underlying {\ML} runtime system. For - Poly/ML, @{text "n = 1"} means time and @{text "n = 2"} space - profiling. - - \end{description} -*} - - -subsection {* Toplevel transitions \label{sec:toplevel-transition} *} - -text {* - An Isar toplevel transition consists of a partial function on the - toplevel state, with additional information for diagnostics and - error reporting: there are fields for command name, source position, - optional source text, as well as flags for interactive-only commands - (which issue a warning in batch-mode), printing of result state, - etc. - - The operational part is represented as the sequential union of a - list of partial functions, which are tried in turn until the first - one succeeds. This acts like an outer case-expression for various - alternative state transitions. For example, \isakeyword{qed} acts - differently for a local proofs vs.\ the global ending of the main - proof. - - Toplevel transitions are composed via transition transformers. - Internally, Isar commands are put together from an empty transition - extended by name and source position (and optional source text). It - is then left to the individual command parser to turn the given - concrete syntax into a suitable transition transformer that adjoin - actual operations on a theory or proof state etc. -*} - -text %mlref {* - \begin{mldecls} - @{index_ML Toplevel.print: "Toplevel.transition -> Toplevel.transition"} \\ - @{index_ML Toplevel.no_timing: "Toplevel.transition -> Toplevel.transition"} \\ - @{index_ML Toplevel.keep: "(Toplevel.state -> unit) -> - Toplevel.transition -> Toplevel.transition"} \\ - @{index_ML Toplevel.theory: "(theory -> theory) -> - Toplevel.transition -> Toplevel.transition"} \\ - @{index_ML Toplevel.theory_to_proof: "(theory -> Proof.state) -> - Toplevel.transition -> Toplevel.transition"} \\ - @{index_ML Toplevel.proof: "(Proof.state -> Proof.state) -> - Toplevel.transition -> Toplevel.transition"} \\ - @{index_ML Toplevel.proofs: "(Proof.state -> Proof.state Seq.seq) -> - Toplevel.transition -> Toplevel.transition"} \\ - @{index_ML Toplevel.end_proof: "(bool -> Proof.state -> Proof.context) -> - Toplevel.transition -> Toplevel.transition"} \\ - \end{mldecls} - - \begin{description} - - \item @{ML Toplevel.print}~@{text "tr"} sets the print flag, which - causes the toplevel loop to echo the result state (in interactive - mode). - - \item @{ML Toplevel.no_timing}~@{text "tr"} indicates that the - transition should never show timing information, e.g.\ because it is - a diagnostic command. - - \item @{ML Toplevel.keep}~@{text "tr"} adjoins a diagnostic - function. - - \item @{ML Toplevel.theory}~@{text "tr"} adjoins a theory - transformer. - - \item @{ML Toplevel.theory_to_proof}~@{text "tr"} adjoins a global - goal function, which turns a theory into a proof state. The theory - may be changed before entering the proof; the generic Isar goal - setup includes an argument that specifies how to apply the proven - result to the theory, when the proof is finished. - - \item @{ML Toplevel.proof}~@{text "tr"} adjoins a deterministic - proof command, with a singleton result. - - \item @{ML Toplevel.proofs}~@{text "tr"} adjoins a general proof - command, with zero or more result states (represented as a lazy - list). - - \item @{ML Toplevel.end_proof}~@{text "tr"} adjoins a concluding - proof command, that returns the resulting theory, after storing the - resulting facts in the context etc. - - \end{description} -*} - - -subsection {* Toplevel control *} - -text {* - There are a few special control commands that modify the behavior - the toplevel itself, and only make sense in interactive mode. Under - normal circumstances, the user encounters these only implicitly as - part of the protocol between the Isabelle/Isar system and a - user-interface such as ProofGeneral. - - \begin{description} - - \item \isacommand{undo} follows the three-level hierarchy of empty - toplevel vs.\ theory vs.\ proof: undo within a proof reverts to the - previous proof context, undo after a proof reverts to the theory - before the initial goal statement, undo of a theory command reverts - to the previous theory value, undo of a theory header discontinues - the current theory development and removes it from the theory - database (\secref{sec:theory-database}). - - \item \isacommand{kill} aborts the current level of development: - kill in a proof context reverts to the theory before the initial - goal statement, kill in a theory context aborts the current theory - development, removing it from the database. - - \item \isacommand{exit} drops out of the Isar toplevel into the - underlying {\ML} toplevel (\secref{sec:ML-toplevel}). The Isar - toplevel state is preserved and may be continued later. - - \item \isacommand{quit} terminates the Isabelle/Isar process without - saving. - - \end{description} -*} - - -section {* ML toplevel \label{sec:ML-toplevel} *} - -text {* - The {\ML} toplevel provides a read-compile-eval-print loop for {\ML} - values, types, structures, and functors. {\ML} declarations operate - on the global system state, which consists of the compiler - environment plus the values of {\ML} reference variables. There is - no clean way to undo {\ML} declarations, except for reverting to a - previously saved state of the whole Isabelle process. {\ML} input - is either read interactively from a TTY, or from a string (usually - within a theory text), or from a source file (usually loaded from a - theory). - - Whenever the {\ML} toplevel is active, the current Isabelle theory - context is passed as an internal reference variable. Thus {\ML} - code may access the theory context during compilation, it may even - change the value of a theory being under construction --- while - observing the usual linearity restrictions - (cf.~\secref{sec:context-theory}). -*} - -text %mlref {* - \begin{mldecls} - @{index_ML the_context: "unit -> theory"} \\ - @{index_ML "Context.>> ": "(Context.generic -> Context.generic) -> unit"} \\ - \end{mldecls} - - \begin{description} - - \item @{ML "the_context ()"} refers to the theory context of the - {\ML} toplevel --- at compile time! {\ML} code needs to take care - to refer to @{ML "the_context ()"} correctly. Recall that - evaluation of a function body is delayed until actual runtime. - Moreover, persistent {\ML} toplevel bindings to an unfinished theory - should be avoided: code should either project out the desired - information immediately, or produce an explicit @{ML_type - theory_ref} (cf.\ \secref{sec:context-theory}). - - \item @{ML "Context.>>"}~@{text f} applies context transformation - @{text f} to the implicit context of the {\ML} toplevel. - - \end{description} - - It is very important to note that the above functions are really - restricted to the compile time, even though the {\ML} compiler is - invoked at runtime! The majority of {\ML} code uses explicit - functional arguments of a theory or proof context instead. Thus it - may be invoked for an arbitrary context later on, without having to - worry about any operational details. - - \bigskip - - \begin{mldecls} - @{index_ML Isar.main: "unit -> unit"} \\ - @{index_ML Isar.loop: "unit -> unit"} \\ - @{index_ML Isar.state: "unit -> Toplevel.state"} \\ - @{index_ML Isar.exn: "unit -> (exn * string) option"} \\ - @{index_ML Isar.context: "unit -> Proof.context"} \\ - @{index_ML Isar.goal: "unit -> thm"} \\ - \end{mldecls} - - \begin{description} - - \item @{ML "Isar.main ()"} invokes the Isar toplevel from {\ML}, - initializing an empty toplevel state. - - \item @{ML "Isar.loop ()"} continues the Isar toplevel with the - current state, after having dropped out of the Isar toplevel loop. - - \item @{ML "Isar.state ()"} and @{ML "Isar.exn ()"} get current - toplevel state and error condition, respectively. This only works - after having dropped out of the Isar toplevel loop. - - \item @{ML "Isar.context ()"} produces the proof context from @{ML - "Isar.state ()"}, analogous to @{ML Context.proof_of} - (\secref{sec:generic-context}). - - \item @{ML "Isar.goal ()"} picks the tactical goal from @{ML - "Isar.state ()"}, represented as a theorem according to - \secref{sec:tactical-goals}. - - \end{description} -*} - - -section {* Theory database \label{sec:theory-database} *} - -text {* - The theory database maintains a collection of theories, together - with some administrative information about their original sources, - which are held in an external store (i.e.\ some directory within the - regular file system). - - The theory database is organized as a directed acyclic graph; - entries are referenced by theory name. Although some additional - interfaces allow to include a directory specification as well, this - is only a hint to the underlying theory loader. The internal theory - name space is flat! - - Theory @{text A} is associated with the main theory file @{text - A}\verb,.thy,, which needs to be accessible through the theory - loader path. Any number of additional {\ML} source files may be - associated with each theory, by declaring these dependencies in the - theory header as @{text \}, and loading them consecutively - within the theory context. The system keeps track of incoming {\ML} - sources and associates them with the current theory. The file - @{text A}\verb,.ML, is loaded after a theory has been concluded, in - order to support legacy proof {\ML} proof scripts. - - The basic internal actions of the theory database are @{text - "update"}, @{text "outdate"}, and @{text "remove"}: - - \begin{itemize} - - \item @{text "update A"} introduces a link of @{text "A"} with a - @{text "theory"} value of the same name; it asserts that the theory - sources are now consistent with that value; - - \item @{text "outdate A"} invalidates the link of a theory database - entry to its sources, but retains the present theory value; - - \item @{text "remove A"} deletes entry @{text "A"} from the theory - database. - - \end{itemize} - - These actions are propagated to sub- or super-graphs of a theory - entry as expected, in order to preserve global consistency of the - state of all loaded theories with the sources of the external store. - This implies certain causalities between actions: @{text "update"} - or @{text "outdate"} of an entry will @{text "outdate"} all - descendants; @{text "remove"} will @{text "remove"} all descendants. - - \medskip There are separate user-level interfaces to operate on the - theory database directly or indirectly. The primitive actions then - just happen automatically while working with the system. In - particular, processing a theory header @{text "\ A - \ B\<^sub>1 \ B\<^sub>n \"} ensures that the - sub-graph of the collective imports @{text "B\<^sub>1 \ B\<^sub>n"} - is up-to-date, too. Earlier theories are reloaded as required, with - @{text update} actions proceeding in topological order according to - theory dependencies. There may be also a wave of implied @{text - outdate} actions for derived theory nodes until a stable situation - is achieved eventually. -*} - -text %mlref {* - \begin{mldecls} - @{index_ML theory: "string -> theory"} \\ - @{index_ML use_thy: "string -> unit"} \\ - @{index_ML use_thys: "string list -> unit"} \\ - @{index_ML ThyInfo.touch_thy: "string -> unit"} \\ - @{index_ML ThyInfo.remove_thy: "string -> unit"} \\[1ex] - @{index_ML ThyInfo.begin_theory}@{verbatim ": ... -> bool -> theory"} \\ - @{index_ML ThyInfo.end_theory: "theory -> unit"} \\ - @{index_ML ThyInfo.register_theory: "theory -> unit"} \\[1ex] - @{verbatim "datatype action = Update | Outdate | Remove"} \\ - @{index_ML ThyInfo.add_hook: "(ThyInfo.action -> string -> unit) -> unit"} \\ - \end{mldecls} - - \begin{description} - - \item @{ML theory}~@{text A} retrieves the theory value presently - associated with name @{text A}. Note that the result might be - outdated. - - \item @{ML use_thy}~@{text A} ensures that theory @{text A} is fully - up-to-date wrt.\ the external file store, reloading outdated - ancestors as required. - - \item @{ML use_thys} is similar to @{ML use_thy}, but handles - several theories simultaneously. Thus it acts like processing the - import header of a theory, without performing the merge of the - result, though. - - \item @{ML ThyInfo.touch_thy}~@{text A} performs and @{text outdate} action - on theory @{text A} and all descendants. - - \item @{ML ThyInfo.remove_thy}~@{text A} deletes theory @{text A} and all - descendants from the theory database. - - \item @{ML ThyInfo.begin_theory} is the basic operation behind a - @{text \} header declaration. This is {\ML} functions is - normally not invoked directly. - - \item @{ML ThyInfo.end_theory} concludes the loading of a theory - proper and stores the result in the theory database. - - \item @{ML ThyInfo.register_theory}~@{text "text thy"} registers an - existing theory value with the theory loader database. There is no - management of associated sources. - - \item @{ML "ThyInfo.add_hook"}~@{text f} registers function @{text - f} as a hook for theory database actions. The function will be - invoked with the action and theory name being involved; thus derived - actions may be performed in associated system components, e.g.\ - maintaining the state of an editor for the theory sources. - - The kind and order of actions occurring in practice depends both on - user interactions and the internal process of resolving theory - imports. Hooks should not rely on a particular policy here! Any - exceptions raised by the hook are ignored. - - \end{description} -*} - -end diff -r 419116f1157a -r e23770bc97c8 doc-src/IsarImplementation/Thy/isar.thy --- a/doc-src/IsarImplementation/Thy/isar.thy Thu Feb 26 08:44:44 2009 -0800 +++ /dev/null Thu Jan 01 00:00:00 1970 +0000 @@ -1,41 +0,0 @@ - -(* $Id$ *) - -theory isar imports base begin - -chapter {* Isar proof texts *} - -section {* Proof context *} - -text FIXME - - -section {* Proof state \label{sec:isar-proof-state} *} - -text {* - FIXME - -\glossary{Proof state}{The whole configuration of a structured proof, -consisting of a \seeglossary{proof context} and an optional -\seeglossary{structured goal}. Internally, an Isar proof state is -organized as a stack to accomodate block structure of proof texts. -For historical reasons, a low-level \seeglossary{tactical goal} is -occasionally called ``proof state'' as well.} - -\glossary{Structured goal}{FIXME} - -\glossary{Goal}{See \seeglossary{tactical goal} or \seeglossary{structured goal}. \norefpage} - - -*} - -section {* Proof methods *} - -text FIXME - -section {* Attributes *} - -text "FIXME ?!" - - -end diff -r 419116f1157a -r e23770bc97c8 doc-src/IsarImplementation/Thy/locale.thy --- a/doc-src/IsarImplementation/Thy/locale.thy Thu Feb 26 08:44:44 2009 -0800 +++ /dev/null Thu Jan 01 00:00:00 1970 +0000 @@ -1,26 +0,0 @@ - -(* $Id$ *) - -theory "locale" imports base begin - -chapter {* Structured specifications *} - -section {* Specification elements *} - -text FIXME - - -section {* Type-inference *} - -text FIXME - - -section {* Local theories *} - -text {* - FIXME - - \glossary{Local theory}{FIXME} -*} - -end diff -r 419116f1157a -r e23770bc97c8 doc-src/IsarImplementation/Thy/logic.thy --- a/doc-src/IsarImplementation/Thy/logic.thy Thu Feb 26 08:44:44 2009 -0800 +++ /dev/null Thu Jan 01 00:00:00 1970 +0000 @@ -1,851 +0,0 @@ -theory logic imports base begin - -chapter {* Primitive logic \label{ch:logic} *} - -text {* - The logical foundations of Isabelle/Isar are that of the Pure logic, - which has been introduced as a natural-deduction framework in - \cite{paulson700}. This is essentially the same logic as ``@{text - "\HOL"}'' in the more abstract setting of Pure Type Systems (PTS) - \cite{Barendregt-Geuvers:2001}, although there are some key - differences in the specific treatment of simple types in - Isabelle/Pure. - - Following type-theoretic parlance, the Pure logic consists of three - levels of @{text "\"}-calculus with corresponding arrows, @{text - "\"} for syntactic function space (terms depending on terms), @{text - "\"} for universal quantification (proofs depending on terms), and - @{text "\"} for implication (proofs depending on proofs). - - Derivations are relative to a logical theory, which declares type - constructors, constants, and axioms. Theory declarations support - schematic polymorphism, which is strictly speaking outside the - logic.\footnote{This is the deeper logical reason, why the theory - context @{text "\"} is separate from the proof context @{text "\"} - of the core calculus.} -*} - - -section {* Types \label{sec:types} *} - -text {* - The language of types is an uninterpreted order-sorted first-order - algebra; types are qualified by ordered type classes. - - \medskip A \emph{type class} is an abstract syntactic entity - declared in the theory context. The \emph{subclass relation} @{text - "c\<^isub>1 \ c\<^isub>2"} is specified by stating an acyclic - generating relation; the transitive closure is maintained - internally. The resulting relation is an ordering: reflexive, - transitive, and antisymmetric. - - A \emph{sort} is a list of type classes written as @{text "s = - {c\<^isub>1, \, c\<^isub>m}"}, which represents symbolic - intersection. Notationally, the curly braces are omitted for - singleton intersections, i.e.\ any class @{text "c"} may be read as - a sort @{text "{c}"}. The ordering on type classes is extended to - sorts according to the meaning of intersections: @{text - "{c\<^isub>1, \ c\<^isub>m} \ {d\<^isub>1, \, d\<^isub>n}"} iff - @{text "\j. \i. c\<^isub>i \ d\<^isub>j"}. The empty intersection - @{text "{}"} refers to the universal sort, which is the largest - element wrt.\ the sort order. The intersections of all (finitely - many) classes declared in the current theory are the minimal - elements wrt.\ the sort order. - - \medskip A \emph{fixed type variable} is a pair of a basic name - (starting with a @{text "'"} character) and a sort constraint, e.g.\ - @{text "('a, s)"} which is usually printed as @{text "\\<^isub>s"}. - A \emph{schematic type variable} is a pair of an indexname and a - sort constraint, e.g.\ @{text "(('a, 0), s)"} which is usually - printed as @{text "?\\<^isub>s"}. - - Note that \emph{all} syntactic components contribute to the identity - of type variables, including the sort constraint. The core logic - handles type variables with the same name but different sorts as - different, although some outer layers of the system make it hard to - produce anything like this. - - A \emph{type constructor} @{text "\"} is a @{text "k"}-ary operator - on types declared in the theory. Type constructor application is - written postfix as @{text "(\\<^isub>1, \, \\<^isub>k)\"}. For - @{text "k = 0"} the argument tuple is omitted, e.g.\ @{text "prop"} - instead of @{text "()prop"}. For @{text "k = 1"} the parentheses - are omitted, e.g.\ @{text "\ list"} instead of @{text "(\)list"}. - Further notation is provided for specific constructors, notably the - right-associative infix @{text "\ \ \"} instead of @{text "(\, - \)fun"}. - - A \emph{type} is defined inductively over type variables and type - constructors as follows: @{text "\ = \\<^isub>s | ?\\<^isub>s | - (\\<^sub>1, \, \\<^sub>k)\"}. - - A \emph{type abbreviation} is a syntactic definition @{text - "(\<^vec>\)\ = \"} of an arbitrary type expression @{text "\"} over - variables @{text "\<^vec>\"}. Type abbreviations appear as type - constructors in the syntax, but are expanded before entering the - logical core. - - A \emph{type arity} declares the image behavior of a type - constructor wrt.\ the algebra of sorts: @{text "\ :: (s\<^isub>1, \, - s\<^isub>k)s"} means that @{text "(\\<^isub>1, \, \\<^isub>k)\"} is - of sort @{text "s"} if every argument type @{text "\\<^isub>i"} is - of sort @{text "s\<^isub>i"}. Arity declarations are implicitly - completed, i.e.\ @{text "\ :: (\<^vec>s)c"} entails @{text "\ :: - (\<^vec>s)c'"} for any @{text "c' \ c"}. - - \medskip The sort algebra is always maintained as \emph{coregular}, - which means that type arities are consistent with the subclass - relation: for any type constructor @{text "\"}, and classes @{text - "c\<^isub>1 \ c\<^isub>2"}, and arities @{text "\ :: - (\<^vec>s\<^isub>1)c\<^isub>1"} and @{text "\ :: - (\<^vec>s\<^isub>2)c\<^isub>2"} holds @{text "\<^vec>s\<^isub>1 \ - \<^vec>s\<^isub>2"} component-wise. - - The key property of a coregular order-sorted algebra is that sort - constraints can be solved in a most general fashion: for each type - constructor @{text "\"} and sort @{text "s"} there is a most general - vector of argument sorts @{text "(s\<^isub>1, \, s\<^isub>k)"} such - that a type scheme @{text "(\\<^bsub>s\<^isub>1\<^esub>, \, - \\<^bsub>s\<^isub>k\<^esub>)\"} is of sort @{text "s"}. - Consequently, type unification has most general solutions (modulo - equivalence of sorts), so type-inference produces primary types as - expected \cite{nipkow-prehofer}. -*} - -text %mlref {* - \begin{mldecls} - @{index_ML_type class} \\ - @{index_ML_type sort} \\ - @{index_ML_type arity} \\ - @{index_ML_type typ} \\ - @{index_ML map_atyps: "(typ -> typ) -> typ -> typ"} \\ - @{index_ML fold_atyps: "(typ -> 'a -> 'a) -> typ -> 'a -> 'a"} \\ - \end{mldecls} - \begin{mldecls} - @{index_ML Sign.subsort: "theory -> sort * sort -> bool"} \\ - @{index_ML Sign.of_sort: "theory -> typ * sort -> bool"} \\ - @{index_ML Sign.add_types: "(string * int * mixfix) list -> theory -> theory"} \\ - @{index_ML Sign.add_tyabbrs_i: " - (string * string list * typ * mixfix) list -> theory -> theory"} \\ - @{index_ML Sign.primitive_class: "string * class list -> theory -> theory"} \\ - @{index_ML Sign.primitive_classrel: "class * class -> theory -> theory"} \\ - @{index_ML Sign.primitive_arity: "arity -> theory -> theory"} \\ - \end{mldecls} - - \begin{description} - - \item @{ML_type class} represents type classes; this is an alias for - @{ML_type string}. - - \item @{ML_type sort} represents sorts; this is an alias for - @{ML_type "class list"}. - - \item @{ML_type arity} represents type arities; this is an alias for - triples of the form @{text "(\, \<^vec>s, s)"} for @{text "\ :: - (\<^vec>s)s"} described above. - - \item @{ML_type typ} represents types; this is a datatype with - constructors @{ML TFree}, @{ML TVar}, @{ML Type}. - - \item @{ML map_atyps}~@{text "f \"} applies the mapping @{text "f"} - to all atomic types (@{ML TFree}, @{ML TVar}) occurring in @{text - "\"}. - - \item @{ML fold_atyps}~@{text "f \"} iterates the operation @{text - "f"} over all occurrences of atomic types (@{ML TFree}, @{ML TVar}) - in @{text "\"}; the type structure is traversed from left to right. - - \item @{ML Sign.subsort}~@{text "thy (s\<^isub>1, s\<^isub>2)"} - tests the subsort relation @{text "s\<^isub>1 \ s\<^isub>2"}. - - \item @{ML Sign.of_sort}~@{text "thy (\, s)"} tests whether type - @{text "\"} is of sort @{text "s"}. - - \item @{ML Sign.add_types}~@{text "[(\, k, mx), \]"} declares a new - type constructors @{text "\"} with @{text "k"} arguments and - optional mixfix syntax. - - \item @{ML Sign.add_tyabbrs_i}~@{text "[(\, \<^vec>\, \, mx), \]"} - defines a new type abbreviation @{text "(\<^vec>\)\ = \"} with - optional mixfix syntax. - - \item @{ML Sign.primitive_class}~@{text "(c, [c\<^isub>1, \, - c\<^isub>n])"} declares a new class @{text "c"}, together with class - relations @{text "c \ c\<^isub>i"}, for @{text "i = 1, \, n"}. - - \item @{ML Sign.primitive_classrel}~@{text "(c\<^isub>1, - c\<^isub>2)"} declares the class relation @{text "c\<^isub>1 \ - c\<^isub>2"}. - - \item @{ML Sign.primitive_arity}~@{text "(\, \<^vec>s, s)"} declares - the arity @{text "\ :: (\<^vec>s)s"}. - - \end{description} -*} - - - -section {* Terms \label{sec:terms} *} - -text {* - \glossary{Term}{FIXME} - - The language of terms is that of simply-typed @{text "\"}-calculus - with de-Bruijn indices for bound variables (cf.\ \cite{debruijn72} - or \cite{paulson-ml2}), with the types being determined determined - by the corresponding binders. In contrast, free variables and - constants are have an explicit name and type in each occurrence. - - \medskip A \emph{bound variable} is a natural number @{text "b"}, - which accounts for the number of intermediate binders between the - variable occurrence in the body and its binding position. For - example, the de-Bruijn term @{text - "\\<^bsub>nat\<^esub>. \\<^bsub>nat\<^esub>. 1 + 0"} would - correspond to @{text - "\x\<^bsub>nat\<^esub>. \y\<^bsub>nat\<^esub>. x + y"} in a named - representation. Note that a bound variable may be represented by - different de-Bruijn indices at different occurrences, depending on - the nesting of abstractions. - - A \emph{loose variable} is a bound variable that is outside the - scope of local binders. The types (and names) for loose variables - can be managed as a separate context, that is maintained as a stack - of hypothetical binders. The core logic operates on closed terms, - without any loose variables. - - A \emph{fixed variable} is a pair of a basic name and a type, e.g.\ - @{text "(x, \)"} which is usually printed @{text "x\<^isub>\"}. A - \emph{schematic variable} is a pair of an indexname and a type, - e.g.\ @{text "((x, 0), \)"} which is usually printed as @{text - "?x\<^isub>\"}. - - \medskip A \emph{constant} is a pair of a basic name and a type, - e.g.\ @{text "(c, \)"} which is usually printed as @{text - "c\<^isub>\"}. Constants are declared in the context as polymorphic - families @{text "c :: \"}, meaning that all substitution instances - @{text "c\<^isub>\"} for @{text "\ = \\"} are valid. - - The vector of \emph{type arguments} of constant @{text "c\<^isub>\"} - wrt.\ the declaration @{text "c :: \"} is defined as the codomain of - the matcher @{text "\ = {?\\<^isub>1 \ \\<^isub>1, \, - ?\\<^isub>n \ \\<^isub>n}"} presented in canonical order @{text - "(\\<^isub>1, \, \\<^isub>n)"}. Within a given theory context, - there is a one-to-one correspondence between any constant @{text - "c\<^isub>\"} and the application @{text "c(\\<^isub>1, \, - \\<^isub>n)"} of its type arguments. For example, with @{text "plus - :: \ \ \ \ \"}, the instance @{text "plus\<^bsub>nat \ nat \ - nat\<^esub>"} corresponds to @{text "plus(nat)"}. - - Constant declarations @{text "c :: \"} may contain sort constraints - for type variables in @{text "\"}. These are observed by - type-inference as expected, but \emph{ignored} by the core logic. - This means the primitive logic is able to reason with instances of - polymorphic constants that the user-level type-checker would reject - due to violation of type class restrictions. - - \medskip An \emph{atomic} term is either a variable or constant. A - \emph{term} is defined inductively over atomic terms, with - abstraction and application as follows: @{text "t = b | x\<^isub>\ | - ?x\<^isub>\ | c\<^isub>\ | \\<^isub>\. t | t\<^isub>1 t\<^isub>2"}. - Parsing and printing takes care of converting between an external - representation with named bound variables. Subsequently, we shall - use the latter notation instead of internal de-Bruijn - representation. - - The inductive relation @{text "t :: \"} assigns a (unique) type to a - term according to the structure of atomic terms, abstractions, and - applicatins: - \[ - \infer{@{text "a\<^isub>\ :: \"}}{} - \qquad - \infer{@{text "(\x\<^sub>\. t) :: \ \ \"}}{@{text "t :: \"}} - \qquad - \infer{@{text "t u :: \"}}{@{text "t :: \ \ \"} & @{text "u :: \"}} - \] - A \emph{well-typed term} is a term that can be typed according to these rules. - - Typing information can be omitted: type-inference is able to - reconstruct the most general type of a raw term, while assigning - most general types to all of its variables and constants. - Type-inference depends on a context of type constraints for fixed - variables, and declarations for polymorphic constants. - - The identity of atomic terms consists both of the name and the type - component. This means that different variables @{text - "x\<^bsub>\\<^isub>1\<^esub>"} and @{text - "x\<^bsub>\\<^isub>2\<^esub>"} may become the same after type - instantiation. Some outer layers of the system make it hard to - produce variables of the same name, but different types. In - contrast, mixed instances of polymorphic constants occur frequently. - - \medskip The \emph{hidden polymorphism} of a term @{text "t :: \"} - is the set of type variables occurring in @{text "t"}, but not in - @{text "\"}. This means that the term implicitly depends on type - arguments that are not accounted in the result type, i.e.\ there are - different type instances @{text "t\ :: \"} and @{text - "t\' :: \"} with the same type. This slightly - pathological situation notoriously demands additional care. - - \medskip A \emph{term abbreviation} is a syntactic definition @{text - "c\<^isub>\ \ t"} of a closed term @{text "t"} of type @{text "\"}, - without any hidden polymorphism. A term abbreviation looks like a - constant in the syntax, but is expanded before entering the logical - core. Abbreviations are usually reverted when printing terms, using - @{text "t \ c\<^isub>\"} as rules for higher-order rewriting. - - \medskip Canonical operations on @{text "\"}-terms include @{text - "\\\"}-conversion: @{text "\"}-conversion refers to capture-free - renaming of bound variables; @{text "\"}-conversion contracts an - abstraction applied to an argument term, substituting the argument - in the body: @{text "(\x. b)a"} becomes @{text "b[a/x]"}; @{text - "\"}-conversion contracts vacuous application-abstraction: @{text - "\x. f x"} becomes @{text "f"}, provided that the bound variable - does not occur in @{text "f"}. - - Terms are normally treated modulo @{text "\"}-conversion, which is - implicit in the de-Bruijn representation. Names for bound variables - in abstractions are maintained separately as (meaningless) comments, - mostly for parsing and printing. Full @{text "\\\"}-conversion is - commonplace in various standard operations (\secref{sec:obj-rules}) - that are based on higher-order unification and matching. -*} - -text %mlref {* - \begin{mldecls} - @{index_ML_type term} \\ - @{index_ML "op aconv": "term * term -> bool"} \\ - @{index_ML map_types: "(typ -> typ) -> term -> term"} \\ - @{index_ML fold_types: "(typ -> 'a -> 'a) -> term -> 'a -> 'a"} \\ - @{index_ML map_aterms: "(term -> term) -> term -> term"} \\ - @{index_ML fold_aterms: "(term -> 'a -> 'a) -> term -> 'a -> 'a"} \\ - \end{mldecls} - \begin{mldecls} - @{index_ML fastype_of: "term -> typ"} \\ - @{index_ML lambda: "term -> term -> term"} \\ - @{index_ML betapply: "term * term -> term"} \\ - @{index_ML Sign.declare_const: "Properties.T -> (binding * typ) * mixfix -> - theory -> term * theory"} \\ - @{index_ML Sign.add_abbrev: "string -> Properties.T -> binding * term -> - theory -> (term * term) * theory"} \\ - @{index_ML Sign.const_typargs: "theory -> string * typ -> typ list"} \\ - @{index_ML Sign.const_instance: "theory -> string * typ list -> typ"} \\ - \end{mldecls} - - \begin{description} - - \item @{ML_type term} represents de-Bruijn terms, with comments in - abstractions, and explicitly named free variables and constants; - this is a datatype with constructors @{ML Bound}, @{ML Free}, @{ML - Var}, @{ML Const}, @{ML Abs}, @{ML "op $"}. - - \item @{text "t"}~@{ML aconv}~@{text "u"} checks @{text - "\"}-equivalence of two terms. This is the basic equality relation - on type @{ML_type term}; raw datatype equality should only be used - for operations related to parsing or printing! - - \item @{ML map_types}~@{text "f t"} applies the mapping @{text - "f"} to all types occurring in @{text "t"}. - - \item @{ML fold_types}~@{text "f t"} iterates the operation @{text - "f"} over all occurrences of types in @{text "t"}; the term - structure is traversed from left to right. - - \item @{ML map_aterms}~@{text "f t"} applies the mapping @{text "f"} - to all atomic terms (@{ML Bound}, @{ML Free}, @{ML Var}, @{ML - Const}) occurring in @{text "t"}. - - \item @{ML fold_aterms}~@{text "f t"} iterates the operation @{text - "f"} over all occurrences of atomic terms (@{ML Bound}, @{ML Free}, - @{ML Var}, @{ML Const}) in @{text "t"}; the term structure is - traversed from left to right. - - \item @{ML fastype_of}~@{text "t"} determines the type of a - well-typed term. This operation is relatively slow, despite the - omission of any sanity checks. - - \item @{ML lambda}~@{text "a b"} produces an abstraction @{text - "\a. b"}, where occurrences of the atomic term @{text "a"} in the - body @{text "b"} are replaced by bound variables. - - \item @{ML betapply}~@{text "(t, u)"} produces an application @{text - "t u"}, with topmost @{text "\"}-conversion if @{text "t"} is an - abstraction. - - \item @{ML Sign.declare_const}~@{text "properties ((c, \), mx)"} - declares a new constant @{text "c :: \"} with optional mixfix - syntax. - - \item @{ML Sign.add_abbrev}~@{text "print_mode properties (c, t)"} - introduces a new term abbreviation @{text "c \ t"}. - - \item @{ML Sign.const_typargs}~@{text "thy (c, \)"} and @{ML - Sign.const_instance}~@{text "thy (c, [\\<^isub>1, \, \\<^isub>n])"} - convert between two representations of polymorphic constants: full - type instance vs.\ compact type arguments form. - - \end{description} -*} - - -section {* Theorems \label{sec:thms} *} - -text {* - \glossary{Proposition}{FIXME A \seeglossary{term} of - \seeglossary{type} @{text "prop"}. Internally, there is nothing - special about propositions apart from their type, but the concrete - syntax enforces a clear distinction. Propositions are structured - via implication @{text "A \ B"} or universal quantification @{text - "\x. B x"} --- anything else is considered atomic. The canonical - form for propositions is that of a \seeglossary{Hereditary Harrop - Formula}. FIXME} - - \glossary{Theorem}{A proven proposition within a certain theory and - proof context, formally @{text "\ \\<^sub>\ \"}; both contexts are - rarely spelled out explicitly. Theorems are usually normalized - according to the \seeglossary{HHF} format. FIXME} - - \glossary{Fact}{Sometimes used interchangeably for - \seeglossary{theorem}. Strictly speaking, a list of theorems, - essentially an extra-logical conjunction. Facts emerge either as - local assumptions, or as results of local goal statements --- both - may be simultaneous, hence the list representation. FIXME} - - \glossary{Schematic variable}{FIXME} - - \glossary{Fixed variable}{A variable that is bound within a certain - proof context; an arbitrary-but-fixed entity within a portion of - proof text. FIXME} - - \glossary{Free variable}{Synonymous for \seeglossary{fixed - variable}. FIXME} - - \glossary{Bound variable}{FIXME} - - \glossary{Variable}{See \seeglossary{schematic variable}, - \seeglossary{fixed variable}, \seeglossary{bound variable}, or - \seeglossary{type variable}. The distinguishing feature of - different variables is their binding scope. FIXME} - - A \emph{proposition} is a well-typed term of type @{text "prop"}, a - \emph{theorem} is a proven proposition (depending on a context of - hypotheses and the background theory). Primitive inferences include - plain natural deduction rules for the primary connectives @{text - "\"} and @{text "\"} of the framework. There is also a builtin - notion of equality/equivalence @{text "\"}. -*} - -subsection {* Primitive connectives and rules \label{sec:prim-rules} *} - -text {* - The theory @{text "Pure"} contains constant declarations for the - primitive connectives @{text "\"}, @{text "\"}, and @{text "\"} of - the logical framework, see \figref{fig:pure-connectives}. The - derivability judgment @{text "A\<^isub>1, \, A\<^isub>n \ B"} is - defined inductively by the primitive inferences given in - \figref{fig:prim-rules}, with the global restriction that the - hypotheses must \emph{not} contain any schematic variables. The - builtin equality is conceptually axiomatized as shown in - \figref{fig:pure-equality}, although the implementation works - directly with derived inferences. - - \begin{figure}[htb] - \begin{center} - \begin{tabular}{ll} - @{text "all :: (\ \ prop) \ prop"} & universal quantification (binder @{text "\"}) \\ - @{text "\ :: prop \ prop \ prop"} & implication (right associative infix) \\ - @{text "\ :: \ \ \ \ prop"} & equality relation (infix) \\ - \end{tabular} - \caption{Primitive connectives of Pure}\label{fig:pure-connectives} - \end{center} - \end{figure} - - \begin{figure}[htb] - \begin{center} - \[ - \infer[@{text "(axiom)"}]{@{text "\ A"}}{@{text "A \ \"}} - \qquad - \infer[@{text "(assume)"}]{@{text "A \ A"}}{} - \] - \[ - \infer[@{text "(\_intro)"}]{@{text "\ \ \x. b[x]"}}{@{text "\ \ b[x]"} & @{text "x \ \"}} - \qquad - \infer[@{text "(\_elim)"}]{@{text "\ \ b[a]"}}{@{text "\ \ \x. b[x]"}} - \] - \[ - \infer[@{text "(\_intro)"}]{@{text "\ - A \ A \ B"}}{@{text "\ \ B"}} - \qquad - \infer[@{text "(\_elim)"}]{@{text "\\<^sub>1 \ \\<^sub>2 \ B"}}{@{text "\\<^sub>1 \ A \ B"} & @{text "\\<^sub>2 \ A"}} - \] - \caption{Primitive inferences of Pure}\label{fig:prim-rules} - \end{center} - \end{figure} - - \begin{figure}[htb] - \begin{center} - \begin{tabular}{ll} - @{text "\ (\x. b[x]) a \ b[a]"} & @{text "\"}-conversion \\ - @{text "\ x \ x"} & reflexivity \\ - @{text "\ x \ y \ P x \ P y"} & substitution \\ - @{text "\ (\x. f x \ g x) \ f \ g"} & extensionality \\ - @{text "\ (A \ B) \ (B \ A) \ A \ B"} & logical equivalence \\ - \end{tabular} - \caption{Conceptual axiomatization of Pure equality}\label{fig:pure-equality} - \end{center} - \end{figure} - - The introduction and elimination rules for @{text "\"} and @{text - "\"} are analogous to formation of dependently typed @{text - "\"}-terms representing the underlying proof objects. Proof terms - are irrelevant in the Pure logic, though; they cannot occur within - propositions. The system provides a runtime option to record - explicit proof terms for primitive inferences. Thus all three - levels of @{text "\"}-calculus become explicit: @{text "\"} for - terms, and @{text "\/\"} for proofs (cf.\ - \cite{Berghofer-Nipkow:2000:TPHOL}). - - Observe that locally fixed parameters (as in @{text "\_intro"}) need - not be recorded in the hypotheses, because the simple syntactic - types of Pure are always inhabitable. ``Assumptions'' @{text "x :: - \"} for type-membership are only present as long as some @{text - "x\<^isub>\"} occurs in the statement body.\footnote{This is the key - difference to ``@{text "\HOL"}'' in the PTS framework - \cite{Barendregt-Geuvers:2001}, where hypotheses @{text "x : A"} are - treated uniformly for propositions and types.} - - \medskip The axiomatization of a theory is implicitly closed by - forming all instances of type and term variables: @{text "\ - A\"} holds for any substitution instance of an axiom - @{text "\ A"}. By pushing substitutions through derivations - inductively, we also get admissible @{text "generalize"} and @{text - "instance"} rules as shown in \figref{fig:subst-rules}. - - \begin{figure}[htb] - \begin{center} - \[ - \infer{@{text "\ \ B[?\]"}}{@{text "\ \ B[\]"} & @{text "\ \ \"}} - \quad - \infer[\quad@{text "(generalize)"}]{@{text "\ \ B[?x]"}}{@{text "\ \ B[x]"} & @{text "x \ \"}} - \] - \[ - \infer{@{text "\ \ B[\]"}}{@{text "\ \ B[?\]"}} - \quad - \infer[\quad@{text "(instantiate)"}]{@{text "\ \ B[t]"}}{@{text "\ \ B[?x]"}} - \] - \caption{Admissible substitution rules}\label{fig:subst-rules} - \end{center} - \end{figure} - - Note that @{text "instantiate"} does not require an explicit - side-condition, because @{text "\"} may never contain schematic - variables. - - In principle, variables could be substituted in hypotheses as well, - but this would disrupt the monotonicity of reasoning: deriving - @{text "\\ \ B\"} from @{text "\ \ B"} is - correct, but @{text "\\ \ \"} does not necessarily hold: - the result belongs to a different proof context. - - \medskip An \emph{oracle} is a function that produces axioms on the - fly. Logically, this is an instance of the @{text "axiom"} rule - (\figref{fig:prim-rules}), but there is an operational difference. - The system always records oracle invocations within derivations of - theorems. Tracing plain axioms (and named theorems) is optional. - - Axiomatizations should be limited to the bare minimum, typically as - part of the initial logical basis of an object-logic formalization. - Later on, theories are usually developed in a strictly definitional - fashion, by stating only certain equalities over new constants. - - A \emph{simple definition} consists of a constant declaration @{text - "c :: \"} together with an axiom @{text "\ c \ t"}, where @{text "t - :: \"} is a closed term without any hidden polymorphism. The RHS - may depend on further defined constants, but not @{text "c"} itself. - Definitions of functions may be presented as @{text "c \<^vec>x \ - t"} instead of the puristic @{text "c \ \\<^vec>x. t"}. - - An \emph{overloaded definition} consists of a collection of axioms - for the same constant, with zero or one equations @{text - "c((\<^vec>\)\) \ t"} for each type constructor @{text "\"} (for - distinct variables @{text "\<^vec>\"}). The RHS may mention - previously defined constants as above, or arbitrary constants @{text - "d(\\<^isub>i)"} for some @{text "\\<^isub>i"} projected from @{text - "\<^vec>\"}. Thus overloaded definitions essentially work by - primitive recursion over the syntactic structure of a single type - argument. -*} - -text %mlref {* - \begin{mldecls} - @{index_ML_type ctyp} \\ - @{index_ML_type cterm} \\ - @{index_ML Thm.ctyp_of: "theory -> typ -> ctyp"} \\ - @{index_ML Thm.cterm_of: "theory -> term -> cterm"} \\ - \end{mldecls} - \begin{mldecls} - @{index_ML_type thm} \\ - @{index_ML proofs: "int ref"} \\ - @{index_ML Thm.assume: "cterm -> thm"} \\ - @{index_ML Thm.forall_intr: "cterm -> thm -> thm"} \\ - @{index_ML Thm.forall_elim: "cterm -> thm -> thm"} \\ - @{index_ML Thm.implies_intr: "cterm -> thm -> thm"} \\ - @{index_ML Thm.implies_elim: "thm -> thm -> thm"} \\ - @{index_ML Thm.generalize: "string list * string list -> int -> thm -> thm"} \\ - @{index_ML Thm.instantiate: "(ctyp * ctyp) list * (cterm * cterm) list -> thm -> thm"} \\ - @{index_ML Thm.axiom: "theory -> string -> thm"} \\ - @{index_ML Thm.add_oracle: "bstring * ('a -> cterm) -> theory - -> (string * ('a -> thm)) * theory"} \\ - \end{mldecls} - \begin{mldecls} - @{index_ML Theory.add_axioms_i: "(binding * term) list -> theory -> theory"} \\ - @{index_ML Theory.add_deps: "string -> string * typ -> (string * typ) list -> theory -> theory"} \\ - @{index_ML Theory.add_defs_i: "bool -> bool -> (binding * term) list -> theory -> theory"} \\ - \end{mldecls} - - \begin{description} - - \item @{ML_type ctyp} and @{ML_type cterm} represent certified types - and terms, respectively. These are abstract datatypes that - guarantee that its values have passed the full well-formedness (and - well-typedness) checks, relative to the declarations of type - constructors, constants etc. in the theory. - - \item @{ML ctyp_of}~@{text "thy \"} and @{ML cterm_of}~@{text "thy - t"} explicitly checks types and terms, respectively. This also - involves some basic normalizations, such expansion of type and term - abbreviations from the theory context. - - Re-certification is relatively slow and should be avoided in tight - reasoning loops. There are separate operations to decompose - certified entities (including actual theorems). - - \item @{ML_type thm} represents proven propositions. This is an - abstract datatype that guarantees that its values have been - constructed by basic principles of the @{ML_struct Thm} module. - Every @{ML thm} value contains a sliding back-reference to the - enclosing theory, cf.\ \secref{sec:context-theory}. - - \item @{ML proofs} determines the detail of proof recording within - @{ML_type thm} values: @{ML 0} records only oracles, @{ML 1} records - oracles, axioms and named theorems, @{ML 2} records full proof - terms. - - \item @{ML Thm.assume}, @{ML Thm.forall_intr}, @{ML - Thm.forall_elim}, @{ML Thm.implies_intr}, and @{ML Thm.implies_elim} - correspond to the primitive inferences of \figref{fig:prim-rules}. - - \item @{ML Thm.generalize}~@{text "(\<^vec>\, \<^vec>x)"} - corresponds to the @{text "generalize"} rules of - \figref{fig:subst-rules}. Here collections of type and term - variables are generalized simultaneously, specified by the given - basic names. - - \item @{ML Thm.instantiate}~@{text "(\<^vec>\\<^isub>s, - \<^vec>x\<^isub>\)"} corresponds to the @{text "instantiate"} rules - of \figref{fig:subst-rules}. Type variables are substituted before - term variables. Note that the types in @{text "\<^vec>x\<^isub>\"} - refer to the instantiated versions. - - \item @{ML Thm.axiom}~@{text "thy name"} retrieves a named - axiom, cf.\ @{text "axiom"} in \figref{fig:prim-rules}. - - \item @{ML Thm.add_oracle}~@{text "(name, oracle)"} produces a named - oracle rule, essentially generating arbitrary axioms on the fly, - cf.\ @{text "axiom"} in \figref{fig:prim-rules}. - - \item @{ML Theory.add_axioms_i}~@{text "[(name, A), \]"} declares - arbitrary propositions as axioms. - - \item @{ML Theory.add_deps}~@{text "name c\<^isub>\ - \<^vec>d\<^isub>\"} declares dependencies of a named specification - for constant @{text "c\<^isub>\"}, relative to existing - specifications for constants @{text "\<^vec>d\<^isub>\"}. - - \item @{ML Theory.add_defs_i}~@{text "unchecked overloaded [(name, c - \<^vec>x \ t), \]"} states a definitional axiom for an existing - constant @{text "c"}. Dependencies are recorded (cf.\ @{ML - Theory.add_deps}), unless the @{text "unchecked"} option is set. - - \end{description} -*} - - -subsection {* Auxiliary definitions *} - -text {* - Theory @{text "Pure"} provides a few auxiliary definitions, see - \figref{fig:pure-aux}. These special constants are normally not - exposed to the user, but appear in internal encodings. - - \begin{figure}[htb] - \begin{center} - \begin{tabular}{ll} - @{text "conjunction :: prop \ prop \ prop"} & (infix @{text "&"}) \\ - @{text "\ A & B \ (\C. (A \ B \ C) \ C)"} \\[1ex] - @{text "prop :: prop \ prop"} & (prefix @{text "#"}, suppressed) \\ - @{text "#A \ A"} \\[1ex] - @{text "term :: \ \ prop"} & (prefix @{text "TERM"}) \\ - @{text "term x \ (\A. A \ A)"} \\[1ex] - @{text "TYPE :: \ itself"} & (prefix @{text "TYPE"}) \\ - @{text "(unspecified)"} \\ - \end{tabular} - \caption{Definitions of auxiliary connectives}\label{fig:pure-aux} - \end{center} - \end{figure} - - Derived conjunction rules include introduction @{text "A \ B \ A & - B"}, and destructions @{text "A & B \ A"} and @{text "A & B \ B"}. - Conjunction allows to treat simultaneous assumptions and conclusions - uniformly. For example, multiple claims are intermediately - represented as explicit conjunction, but this is refined into - separate sub-goals before the user continues the proof; the final - result is projected into a list of theorems (cf.\ - \secref{sec:tactical-goals}). - - The @{text "prop"} marker (@{text "#"}) makes arbitrarily complex - propositions appear as atomic, without changing the meaning: @{text - "\ \ A"} and @{text "\ \ #A"} are interchangeable. See - \secref{sec:tactical-goals} for specific operations. - - The @{text "term"} marker turns any well-typed term into a derivable - proposition: @{text "\ TERM t"} holds unconditionally. Although - this is logically vacuous, it allows to treat terms and proofs - uniformly, similar to a type-theoretic framework. - - The @{text "TYPE"} constructor is the canonical representative of - the unspecified type @{text "\ itself"}; it essentially injects the - language of types into that of terms. There is specific notation - @{text "TYPE(\)"} for @{text "TYPE\<^bsub>\ - itself\<^esub>"}. - Although being devoid of any particular meaning, the @{text - "TYPE(\)"} accounts for the type @{text "\"} within the term - language. In particular, @{text "TYPE(\)"} may be used as formal - argument in primitive definitions, in order to circumvent hidden - polymorphism (cf.\ \secref{sec:terms}). For example, @{text "c - TYPE(\) \ A[\]"} defines @{text "c :: \ itself \ prop"} in terms of - a proposition @{text "A"} that depends on an additional type - argument, which is essentially a predicate on types. -*} - -text %mlref {* - \begin{mldecls} - @{index_ML Conjunction.intr: "thm -> thm -> thm"} \\ - @{index_ML Conjunction.elim: "thm -> thm * thm"} \\ - @{index_ML Drule.mk_term: "cterm -> thm"} \\ - @{index_ML Drule.dest_term: "thm -> cterm"} \\ - @{index_ML Logic.mk_type: "typ -> term"} \\ - @{index_ML Logic.dest_type: "term -> typ"} \\ - \end{mldecls} - - \begin{description} - - \item @{ML Conjunction.intr} derives @{text "A & B"} from @{text - "A"} and @{text "B"}. - - \item @{ML Conjunction.elim} derives @{text "A"} and @{text "B"} - from @{text "A & B"}. - - \item @{ML Drule.mk_term} derives @{text "TERM t"}. - - \item @{ML Drule.dest_term} recovers term @{text "t"} from @{text - "TERM t"}. - - \item @{ML Logic.mk_type}~@{text "\"} produces the term @{text - "TYPE(\)"}. - - \item @{ML Logic.dest_type}~@{text "TYPE(\)"} recovers the type - @{text "\"}. - - \end{description} -*} - - -section {* Object-level rules \label{sec:obj-rules} *} - -text %FIXME {* - -FIXME - - A \emph{rule} is any Pure theorem in HHF normal form; there is a - separate calculus for rule composition, which is modeled after - Gentzen's Natural Deduction \cite{Gentzen:1935}, but allows - rules to be nested arbitrarily, similar to \cite{extensions91}. - - Normally, all theorems accessible to the user are proper rules. - Low-level inferences are occasional required internally, but the - result should be always presented in canonical form. The higher - interfaces of Isabelle/Isar will always produce proper rules. It is - important to maintain this invariant in add-on applications! - - There are two main principles of rule composition: @{text - "resolution"} (i.e.\ backchaining of rules) and @{text - "by-assumption"} (i.e.\ closing a branch); both principles are - combined in the variants of @{text "elim-resolution"} and @{text - "dest-resolution"}. Raw @{text "composition"} is occasionally - useful as well, also it is strictly speaking outside of the proper - rule calculus. - - Rules are treated modulo general higher-order unification, which is - unification modulo the equational theory of @{text "\\\"}-conversion - on @{text "\"}-terms. Moreover, propositions are understood modulo - the (derived) equivalence @{text "(A \ (\x. B x)) \ (\x. A \ B x)"}. - - This means that any operations within the rule calculus may be - subject to spontaneous @{text "\\\"}-HHF conversions. It is common - practice not to contract or expand unnecessarily. Some mechanisms - prefer an one form, others the opposite, so there is a potential - danger to produce some oscillation! - - Only few operations really work \emph{modulo} HHF conversion, but - expect a normal form: quantifiers @{text "\"} before implications - @{text "\"} at each level of nesting. - -\glossary{Hereditary Harrop Formula}{The set of propositions in HHF -format is defined inductively as @{text "H = (\x\<^sup>*. H\<^sup>* \ -A)"}, for variables @{text "x"} and atomic propositions @{text "A"}. -Any proposition may be put into HHF form by normalizing with the rule -@{text "(A \ (\x. B x)) \ (\x. A \ B x)"}. In Isabelle, the outermost -quantifier prefix is represented via \seeglossary{schematic -variables}, such that the top-level structure is merely that of a -\seeglossary{Horn Clause}}. - -\glossary{HHF}{See \seeglossary{Hereditary Harrop Formula}.} - - - \[ - \infer[@{text "(assumption)"}]{@{text "C\"}} - {@{text "(\\<^vec>x. \<^vec>H \<^vec>x \ A \<^vec>x) \ C"} & @{text "A\ = H\<^sub>i\"}~~\text{(for some~@{text i})}} - \] - - - \[ - \infer[@{text "(compose)"}]{@{text "\<^vec>A\ \ C\"}} - {@{text "\<^vec>A \ B"} & @{text "B' \ C"} & @{text "B\ = B'\"}} - \] - - - \[ - \infer[@{text "(\_lift)"}]{@{text "(\\<^vec>x. \<^vec>A (?\<^vec>a \<^vec>x)) \ (\\<^vec>x. B (?\<^vec>a \<^vec>x))"}}{@{text "\<^vec>A ?\<^vec>a \ B ?\<^vec>a"}} - \] - \[ - \infer[@{text "(\_lift)"}]{@{text "(\<^vec>H \ \<^vec>A) \ (\<^vec>H \ B)"}}{@{text "\<^vec>A \ B"}} - \] - - The @{text resolve} scheme is now acquired from @{text "\_lift"}, - @{text "\_lift"}, and @{text compose}. - - \[ - \infer[@{text "(resolution)"}] - {@{text "(\\<^vec>x. \<^vec>H \<^vec>x \ \<^vec>A (?\<^vec>a \<^vec>x))\ \ C\"}} - {\begin{tabular}{l} - @{text "\<^vec>A ?\<^vec>a \ B ?\<^vec>a"} \\ - @{text "(\\<^vec>x. \<^vec>H \<^vec>x \ B' \<^vec>x) \ C"} \\ - @{text "(\\<^vec>x. B (?\<^vec>a \<^vec>x))\ = B'\"} \\ - \end{tabular}} - \] - - - FIXME @{text "elim_resolution"}, @{text "dest_resolution"} -*} - - -end diff -r 419116f1157a -r e23770bc97c8 doc-src/IsarImplementation/Thy/prelim.thy --- a/doc-src/IsarImplementation/Thy/prelim.thy Thu Feb 26 08:44:44 2009 -0800 +++ /dev/null Thu Jan 01 00:00:00 1970 +0000 @@ -1,779 +0,0 @@ - -(* $Id$ *) - -theory prelim imports base begin - -chapter {* Preliminaries *} - -section {* Contexts \label{sec:context} *} - -text {* - A logical context represents the background that is required for - formulating statements and composing proofs. It acts as a medium to - produce formal content, depending on earlier material (declarations, - results etc.). - - For example, derivations within the Isabelle/Pure logic can be - described as a judgment @{text "\ \\<^sub>\ \"}, which means that a - proposition @{text "\"} is derivable from hypotheses @{text "\"} - within the theory @{text "\"}. There are logical reasons for - keeping @{text "\"} and @{text "\"} separate: theories can be - liberal about supporting type constructors and schematic - polymorphism of constants and axioms, while the inner calculus of - @{text "\ \ \"} is strictly limited to Simple Type Theory (with - fixed type variables in the assumptions). - - \medskip Contexts and derivations are linked by the following key - principles: - - \begin{itemize} - - \item Transfer: monotonicity of derivations admits results to be - transferred into a \emph{larger} context, i.e.\ @{text "\ \\<^sub>\ - \"} implies @{text "\' \\<^sub>\\<^sub>' \"} for contexts @{text "\' - \ \"} and @{text "\' \ \"}. - - \item Export: discharge of hypotheses admits results to be exported - into a \emph{smaller} context, i.e.\ @{text "\' \\<^sub>\ \"} - implies @{text "\ \\<^sub>\ \ \ \"} where @{text "\' \ \"} and - @{text "\ = \' - \"}. Note that @{text "\"} remains unchanged here, - only the @{text "\"} part is affected. - - \end{itemize} - - \medskip By modeling the main characteristics of the primitive - @{text "\"} and @{text "\"} above, and abstracting over any - particular logical content, we arrive at the fundamental notions of - \emph{theory context} and \emph{proof context} in Isabelle/Isar. - These implement a certain policy to manage arbitrary \emph{context - data}. There is a strongly-typed mechanism to declare new kinds of - data at compile time. - - The internal bootstrap process of Isabelle/Pure eventually reaches a - stage where certain data slots provide the logical content of @{text - "\"} and @{text "\"} sketched above, but this does not stop there! - Various additional data slots support all kinds of mechanisms that - are not necessarily part of the core logic. - - For example, there would be data for canonical introduction and - elimination rules for arbitrary operators (depending on the - object-logic and application), which enables users to perform - standard proof steps implicitly (cf.\ the @{text "rule"} method - \cite{isabelle-isar-ref}). - - \medskip Thus Isabelle/Isar is able to bring forth more and more - concepts successively. In particular, an object-logic like - Isabelle/HOL continues the Isabelle/Pure setup by adding specific - components for automated reasoning (classical reasoner, tableau - prover, structured induction etc.) and derived specification - mechanisms (inductive predicates, recursive functions etc.). All of - this is ultimately based on the generic data management by theory - and proof contexts introduced here. -*} - - -subsection {* Theory context \label{sec:context-theory} *} - -text {* - \glossary{Theory}{FIXME} - - A \emph{theory} is a data container with explicit named and unique - identifier. Theories are related by a (nominal) sub-theory - relation, which corresponds to the dependency graph of the original - construction; each theory is derived from a certain sub-graph of - ancestor theories. - - The @{text "merge"} operation produces the least upper bound of two - theories, which actually degenerates into absorption of one theory - into the other (due to the nominal sub-theory relation). - - The @{text "begin"} operation starts a new theory by importing - several parent theories and entering a special @{text "draft"} mode, - which is sustained until the final @{text "end"} operation. A draft - theory acts like a linear type, where updates invalidate earlier - versions. An invalidated draft is called ``stale''. - - The @{text "checkpoint"} operation produces an intermediate stepping - stone that will survive the next update: both the original and the - changed theory remain valid and are related by the sub-theory - relation. Checkpointing essentially recovers purely functional - theory values, at the expense of some extra internal bookkeeping. - - The @{text "copy"} operation produces an auxiliary version that has - the same data content, but is unrelated to the original: updates of - the copy do not affect the original, neither does the sub-theory - relation hold. - - \medskip The example in \figref{fig:ex-theory} below shows a theory - graph derived from @{text "Pure"}, with theory @{text "Length"} - importing @{text "Nat"} and @{text "List"}. The body of @{text - "Length"} consists of a sequence of updates, working mostly on - drafts. Intermediate checkpoints may occur as well, due to the - history mechanism provided by the Isar top-level, cf.\ - \secref{sec:isar-toplevel}. - - \begin{figure}[htb] - \begin{center} - \begin{tabular}{rcccl} - & & @{text "Pure"} \\ - & & @{text "\"} \\ - & & @{text "FOL"} \\ - & $\swarrow$ & & $\searrow$ & \\ - @{text "Nat"} & & & & @{text "List"} \\ - & $\searrow$ & & $\swarrow$ \\ - & & @{text "Length"} \\ - & & \multicolumn{3}{l}{~~@{keyword "imports"}} \\ - & & \multicolumn{3}{l}{~~@{keyword "begin"}} \\ - & & $\vdots$~~ \\ - & & @{text "\"}~~ \\ - & & $\vdots$~~ \\ - & & @{text "\"}~~ \\ - & & $\vdots$~~ \\ - & & \multicolumn{3}{l}{~~@{command "end"}} \\ - \end{tabular} - \caption{A theory definition depending on ancestors}\label{fig:ex-theory} - \end{center} - \end{figure} - - \medskip There is a separate notion of \emph{theory reference} for - maintaining a live link to an evolving theory context: updates on - drafts are propagated automatically. Dynamic updating stops after - an explicit @{text "end"} only. - - Derived entities may store a theory reference in order to indicate - the context they belong to. This implicitly assumes monotonic - reasoning, because the referenced context may become larger without - further notice. -*} - -text %mlref {* - \begin{mldecls} - @{index_ML_type theory} \\ - @{index_ML Theory.subthy: "theory * theory -> bool"} \\ - @{index_ML Theory.merge: "theory * theory -> theory"} \\ - @{index_ML Theory.checkpoint: "theory -> theory"} \\ - @{index_ML Theory.copy: "theory -> theory"} \\ - \end{mldecls} - \begin{mldecls} - @{index_ML_type theory_ref} \\ - @{index_ML Theory.deref: "theory_ref -> theory"} \\ - @{index_ML Theory.check_thy: "theory -> theory_ref"} \\ - \end{mldecls} - - \begin{description} - - \item @{ML_type theory} represents theory contexts. This is - essentially a linear type! Most operations destroy the original - version, which then becomes ``stale''. - - \item @{ML "Theory.subthy"}~@{text "(thy\<^sub>1, thy\<^sub>2)"} - compares theories according to the inherent graph structure of the - construction. This sub-theory relation is a nominal approximation - of inclusion (@{text "\"}) of the corresponding content. - - \item @{ML "Theory.merge"}~@{text "(thy\<^sub>1, thy\<^sub>2)"} - absorbs one theory into the other. This fails for unrelated - theories! - - \item @{ML "Theory.checkpoint"}~@{text "thy"} produces a safe - stepping stone in the linear development of @{text "thy"}. The next - update will result in two related, valid theories. - - \item @{ML "Theory.copy"}~@{text "thy"} produces a variant of @{text - "thy"} that holds a copy of the same data. The result is not - related to the original; the original is unchanched. - - \item @{ML_type theory_ref} represents a sliding reference to an - always valid theory; updates on the original are propagated - automatically. - - \item @{ML "Theory.deref"}~@{text "thy_ref"} turns a @{ML_type - "theory_ref"} into an @{ML_type "theory"} value. As the referenced - theory evolves monotonically over time, later invocations of @{ML - "Theory.deref"} may refer to a larger context. - - \item @{ML "Theory.check_thy"}~@{text "thy"} produces a @{ML_type - "theory_ref"} from a valid @{ML_type "theory"} value. - - \end{description} -*} - - -subsection {* Proof context \label{sec:context-proof} *} - -text {* - \glossary{Proof context}{The static context of a structured proof, - acts like a local ``theory'' of the current portion of Isar proof - text, generalizes the idea of local hypotheses @{text "\"} in - judgments @{text "\ \ \"} of natural deduction calculi. There is a - generic notion of introducing and discharging hypotheses. - Arbritrary auxiliary context data may be adjoined.} - - A proof context is a container for pure data with a back-reference - to the theory it belongs to. The @{text "init"} operation creates a - proof context from a given theory. Modifications to draft theories - are propagated to the proof context as usual, but there is also an - explicit @{text "transfer"} operation to force resynchronization - with more substantial updates to the underlying theory. The actual - context data does not require any special bookkeeping, thanks to the - lack of destructive features. - - Entities derived in a proof context need to record inherent logical - requirements explicitly, since there is no separate context - identification as for theories. For example, hypotheses used in - primitive derivations (cf.\ \secref{sec:thms}) are recorded - separately within the sequent @{text "\ \ \"}, just to make double - sure. Results could still leak into an alien proof context do to - programming errors, but Isabelle/Isar includes some extra validity - checks in critical positions, notably at the end of a sub-proof. - - Proof contexts may be manipulated arbitrarily, although the common - discipline is to follow block structure as a mental model: a given - context is extended consecutively, and results are exported back - into the original context. Note that the Isar proof states model - block-structured reasoning explicitly, using a stack of proof - contexts internally, cf.\ \secref{sec:isar-proof-state}. -*} - -text %mlref {* - \begin{mldecls} - @{index_ML_type Proof.context} \\ - @{index_ML ProofContext.init: "theory -> Proof.context"} \\ - @{index_ML ProofContext.theory_of: "Proof.context -> theory"} \\ - @{index_ML ProofContext.transfer: "theory -> Proof.context -> Proof.context"} \\ - \end{mldecls} - - \begin{description} - - \item @{ML_type Proof.context} represents proof contexts. Elements - of this type are essentially pure values, with a sliding reference - to the background theory. - - \item @{ML ProofContext.init}~@{text "thy"} produces a proof context - derived from @{text "thy"}, initializing all data. - - \item @{ML ProofContext.theory_of}~@{text "ctxt"} selects the - background theory from @{text "ctxt"}, dereferencing its internal - @{ML_type theory_ref}. - - \item @{ML ProofContext.transfer}~@{text "thy ctxt"} promotes the - background theory of @{text "ctxt"} to the super theory @{text - "thy"}. - - \end{description} -*} - - -subsection {* Generic contexts \label{sec:generic-context} *} - -text {* - A generic context is the disjoint sum of either a theory or proof - context. Occasionally, this enables uniform treatment of generic - context data, typically extra-logical information. Operations on - generic contexts include the usual injections, partial selections, - and combinators for lifting operations on either component of the - disjoint sum. - - Moreover, there are total operations @{text "theory_of"} and @{text - "proof_of"} to convert a generic context into either kind: a theory - can always be selected from the sum, while a proof context might - have to be constructed by an ad-hoc @{text "init"} operation. -*} - -text %mlref {* - \begin{mldecls} - @{index_ML_type Context.generic} \\ - @{index_ML Context.theory_of: "Context.generic -> theory"} \\ - @{index_ML Context.proof_of: "Context.generic -> Proof.context"} \\ - \end{mldecls} - - \begin{description} - - \item @{ML_type Context.generic} is the direct sum of @{ML_type - "theory"} and @{ML_type "Proof.context"}, with the datatype - constructors @{ML "Context.Theory"} and @{ML "Context.Proof"}. - - \item @{ML Context.theory_of}~@{text "context"} always produces a - theory from the generic @{text "context"}, using @{ML - "ProofContext.theory_of"} as required. - - \item @{ML Context.proof_of}~@{text "context"} always produces a - proof context from the generic @{text "context"}, using @{ML - "ProofContext.init"} as required (note that this re-initializes the - context data with each invocation). - - \end{description} -*} - - -subsection {* Context data \label{sec:context-data} *} - -text {* - The main purpose of theory and proof contexts is to manage arbitrary - data. New data types can be declared incrementally at compile time. - There are separate declaration mechanisms for any of the three kinds - of contexts: theory, proof, generic. - - \paragraph{Theory data} may refer to destructive entities, which are - maintained in direct correspondence to the linear evolution of - theory values, including explicit copies.\footnote{Most existing - instances of destructive theory data are merely historical relics - (e.g.\ the destructive theorem storage, and destructive hints for - the Simplifier and Classical rules).} A theory data declaration - needs to implement the following SML signature: - - \medskip - \begin{tabular}{ll} - @{text "\ T"} & representing type \\ - @{text "\ empty: T"} & empty default value \\ - @{text "\ copy: T \ T"} & refresh impure data \\ - @{text "\ extend: T \ T"} & re-initialize on import \\ - @{text "\ merge: T \ T \ T"} & join on import \\ - \end{tabular} - \medskip - - \noindent The @{text "empty"} value acts as initial default for - \emph{any} theory that does not declare actual data content; @{text - "copy"} maintains persistent integrity for impure data, it is just - the identity for pure values; @{text "extend"} is acts like a - unitary version of @{text "merge"}, both operations should also - include the functionality of @{text "copy"} for impure data. - - \paragraph{Proof context data} is purely functional. A declaration - needs to implement the following SML signature: - - \medskip - \begin{tabular}{ll} - @{text "\ T"} & representing type \\ - @{text "\ init: theory \ T"} & produce initial value \\ - \end{tabular} - \medskip - - \noindent The @{text "init"} operation is supposed to produce a pure - value from the given background theory. - - \paragraph{Generic data} provides a hybrid interface for both theory - and proof data. The declaration is essentially the same as for - (pure) theory data, without @{text "copy"}. The @{text "init"} - operation for proof contexts merely selects the current data value - from the background theory. - - \bigskip A data declaration of type @{text "T"} results in the - following interface: - - \medskip - \begin{tabular}{ll} - @{text "init: theory \ theory"} \\ - @{text "get: context \ T"} \\ - @{text "put: T \ context \ context"} \\ - @{text "map: (T \ T) \ context \ context"} \\ - \end{tabular} - \medskip - - \noindent Here @{text "init"} is only applicable to impure theory - data to install a fresh copy persistently (destructive update on - uninitialized has no permanent effect). The other operations provide - access for the particular kind of context (theory, proof, or generic - context). Note that this is a safe interface: there is no other way - to access the corresponding data slot of a context. By keeping - these operations private, a component may maintain abstract values - authentically, without other components interfering. -*} - -text %mlref {* - \begin{mldecls} - @{index_ML_functor TheoryDataFun} \\ - @{index_ML_functor ProofDataFun} \\ - @{index_ML_functor GenericDataFun} \\ - \end{mldecls} - - \begin{description} - - \item @{ML_functor TheoryDataFun}@{text "(spec)"} declares data for - type @{ML_type theory} according to the specification provided as - argument structure. The resulting structure provides data init and - access operations as described above. - - \item @{ML_functor ProofDataFun}@{text "(spec)"} is analogous to - @{ML_functor TheoryDataFun} for type @{ML_type Proof.context}. - - \item @{ML_functor GenericDataFun}@{text "(spec)"} is analogous to - @{ML_functor TheoryDataFun} for type @{ML_type Context.generic}. - - \end{description} -*} - - -section {* Names \label{sec:names} *} - -text {* - In principle, a name is just a string, but there are various - convention for encoding additional structure. For example, ``@{text - "Foo.bar.baz"}'' is considered as a qualified name consisting of - three basic name components. The individual constituents of a name - may have further substructure, e.g.\ the string - ``\verb,\,\verb,,'' encodes as a single symbol. -*} - - -subsection {* Strings of symbols *} - -text {* - \glossary{Symbol}{The smallest unit of text in Isabelle, subsumes - plain ASCII characters as well as an infinite collection of named - symbols (for greek, math etc.).} - - A \emph{symbol} constitutes the smallest textual unit in Isabelle - --- raw characters are normally not encountered at all. Isabelle - strings consist of a sequence of symbols, represented as a packed - string or a list of strings. Each symbol is in itself a small - string, which has either one of the following forms: - - \begin{enumerate} - - \item a single ASCII character ``@{text "c"}'', for example - ``\verb,a,'', - - \item a regular symbol ``\verb,\,\verb,<,@{text "ident"}\verb,>,'', - for example ``\verb,\,\verb,,'', - - \item a control symbol ``\verb,\,\verb,<^,@{text "ident"}\verb,>,'', - for example ``\verb,\,\verb,<^bold>,'', - - \item a raw symbol ``\verb,\,\verb,<^raw:,@{text text}\verb,>,'' - where @{text text} constists of printable characters excluding - ``\verb,.,'' and ``\verb,>,'', for example - ``\verb,\,\verb,<^raw:$\sum_{i = 1}^n$>,'', - - \item a numbered raw control symbol ``\verb,\,\verb,<^raw,@{text - n}\verb,>, where @{text n} consists of digits, for example - ``\verb,\,\verb,<^raw42>,''. - - \end{enumerate} - - \noindent The @{text "ident"} syntax for symbol names is @{text - "letter (letter | digit)\<^sup>*"}, where @{text "letter = - A..Za..z"} and @{text "digit = 0..9"}. There are infinitely many - regular symbols and control symbols, but a fixed collection of - standard symbols is treated specifically. For example, - ``\verb,\,\verb,,'' is classified as a letter, which means it - may occur within regular Isabelle identifiers. - - Since the character set underlying Isabelle symbols is 7-bit ASCII - and 8-bit characters are passed through transparently, Isabelle may - also process Unicode/UCS data in UTF-8 encoding. Unicode provides - its own collection of mathematical symbols, but there is no built-in - link to the standard collection of Isabelle. - - \medskip Output of Isabelle symbols depends on the print mode - (\secref{FIXME}). For example, the standard {\LaTeX} setup of the - Isabelle document preparation system would present - ``\verb,\,\verb,,'' as @{text "\"}, and - ``\verb,\,\verb,<^bold>,\verb,\,\verb,,'' as @{text - "\<^bold>\"}. -*} - -text %mlref {* - \begin{mldecls} - @{index_ML_type "Symbol.symbol"} \\ - @{index_ML Symbol.explode: "string -> Symbol.symbol list"} \\ - @{index_ML Symbol.is_letter: "Symbol.symbol -> bool"} \\ - @{index_ML Symbol.is_digit: "Symbol.symbol -> bool"} \\ - @{index_ML Symbol.is_quasi: "Symbol.symbol -> bool"} \\ - @{index_ML Symbol.is_blank: "Symbol.symbol -> bool"} \\ - \end{mldecls} - \begin{mldecls} - @{index_ML_type "Symbol.sym"} \\ - @{index_ML Symbol.decode: "Symbol.symbol -> Symbol.sym"} \\ - \end{mldecls} - - \begin{description} - - \item @{ML_type "Symbol.symbol"} represents individual Isabelle - symbols; this is an alias for @{ML_type "string"}. - - \item @{ML "Symbol.explode"}~@{text "str"} produces a symbol list - from the packed form. This function supercedes @{ML - "String.explode"} for virtually all purposes of manipulating text in - Isabelle! - - \item @{ML "Symbol.is_letter"}, @{ML "Symbol.is_digit"}, @{ML - "Symbol.is_quasi"}, @{ML "Symbol.is_blank"} classify standard - symbols according to fixed syntactic conventions of Isabelle, cf.\ - \cite{isabelle-isar-ref}. - - \item @{ML_type "Symbol.sym"} is a concrete datatype that represents - the different kinds of symbols explicitly, with constructors @{ML - "Symbol.Char"}, @{ML "Symbol.Sym"}, @{ML "Symbol.Ctrl"}, @{ML - "Symbol.Raw"}. - - \item @{ML "Symbol.decode"} converts the string representation of a - symbol into the datatype version. - - \end{description} -*} - - -subsection {* Basic names \label{sec:basic-names} *} - -text {* - A \emph{basic name} essentially consists of a single Isabelle - identifier. There are conventions to mark separate classes of basic - names, by attaching a suffix of underscores (@{text "_"}): one - underscore means \emph{internal name}, two underscores means - \emph{Skolem name}, three underscores means \emph{internal Skolem - name}. - - For example, the basic name @{text "foo"} has the internal version - @{text "foo_"}, with Skolem versions @{text "foo__"} and @{text - "foo___"}, respectively. - - These special versions provide copies of the basic name space, apart - from anything that normally appears in the user text. For example, - system generated variables in Isar proof contexts are usually marked - as internal, which prevents mysterious name references like @{text - "xaa"} to appear in the text. - - \medskip Manipulating binding scopes often requires on-the-fly - renamings. A \emph{name context} contains a collection of already - used names. The @{text "declare"} operation adds names to the - context. - - The @{text "invents"} operation derives a number of fresh names from - a given starting point. For example, the first three names derived - from @{text "a"} are @{text "a"}, @{text "b"}, @{text "c"}. - - The @{text "variants"} operation produces fresh names by - incrementing tentative names as base-26 numbers (with digits @{text - "a..z"}) until all clashes are resolved. For example, name @{text - "foo"} results in variants @{text "fooa"}, @{text "foob"}, @{text - "fooc"}, \dots, @{text "fooaa"}, @{text "fooab"} etc.; each renaming - step picks the next unused variant from this sequence. -*} - -text %mlref {* - \begin{mldecls} - @{index_ML Name.internal: "string -> string"} \\ - @{index_ML Name.skolem: "string -> string"} \\ - \end{mldecls} - \begin{mldecls} - @{index_ML_type Name.context} \\ - @{index_ML Name.context: Name.context} \\ - @{index_ML Name.declare: "string -> Name.context -> Name.context"} \\ - @{index_ML Name.invents: "Name.context -> string -> int -> string list"} \\ - @{index_ML Name.variants: "string list -> Name.context -> string list * Name.context"} \\ - \end{mldecls} - - \begin{description} - - \item @{ML Name.internal}~@{text "name"} produces an internal name - by adding one underscore. - - \item @{ML Name.skolem}~@{text "name"} produces a Skolem name by - adding two underscores. - - \item @{ML_type Name.context} represents the context of already used - names; the initial value is @{ML "Name.context"}. - - \item @{ML Name.declare}~@{text "name"} enters a used name into the - context. - - \item @{ML Name.invents}~@{text "context name n"} produces @{text - "n"} fresh names derived from @{text "name"}. - - \item @{ML Name.variants}~@{text "names context"} produces fresh - varians of @{text "names"}; the result is entered into the context. - - \end{description} -*} - - -subsection {* Indexed names *} - -text {* - An \emph{indexed name} (or @{text "indexname"}) is a pair of a basic - name and a natural number. This representation allows efficient - renaming by incrementing the second component only. The canonical - way to rename two collections of indexnames apart from each other is - this: determine the maximum index @{text "maxidx"} of the first - collection, then increment all indexes of the second collection by - @{text "maxidx + 1"}; the maximum index of an empty collection is - @{text "-1"}. - - Occasionally, basic names and indexed names are injected into the - same pair type: the (improper) indexname @{text "(x, -1)"} is used - to encode basic names. - - \medskip Isabelle syntax observes the following rules for - representing an indexname @{text "(x, i)"} as a packed string: - - \begin{itemize} - - \item @{text "?x"} if @{text "x"} does not end with a digit and @{text "i = 0"}, - - \item @{text "?xi"} if @{text "x"} does not end with a digit, - - \item @{text "?x.i"} otherwise. - - \end{itemize} - - Indexnames may acquire large index numbers over time. Results are - normalized towards @{text "0"} at certain checkpoints, notably at - the end of a proof. This works by producing variants of the - corresponding basic name components. For example, the collection - @{text "?x1, ?x7, ?x42"} becomes @{text "?x, ?xa, ?xb"}. -*} - -text %mlref {* - \begin{mldecls} - @{index_ML_type indexname} \\ - \end{mldecls} - - \begin{description} - - \item @{ML_type indexname} represents indexed names. This is an - abbreviation for @{ML_type "string * int"}. The second component is - usually non-negative, except for situations where @{text "(x, -1)"} - is used to embed basic names into this type. - - \end{description} -*} - - -subsection {* Qualified names and name spaces *} - -text {* - A \emph{qualified name} consists of a non-empty sequence of basic - name components. The packed representation uses a dot as separator, - as in ``@{text "A.b.c"}''. The last component is called \emph{base} - name, the remaining prefix \emph{qualifier} (which may be empty). - The idea of qualified names is to encode nested structures by - recording the access paths as qualifiers. For example, an item - named ``@{text "A.b.c"}'' may be understood as a local entity @{text - "c"}, within a local structure @{text "b"}, within a global - structure @{text "A"}. Typically, name space hierarchies consist of - 1--2 levels of qualification, but this need not be always so. - - The empty name is commonly used as an indication of unnamed - entities, whenever this makes any sense. The basic operations on - qualified names are smart enough to pass through such improper names - unchanged. - - \medskip A @{text "naming"} policy tells how to turn a name - specification into a fully qualified internal name (by the @{text - "full"} operation), and how fully qualified names may be accessed - externally. For example, the default naming policy is to prefix an - implicit path: @{text "full x"} produces @{text "path.x"}, and the - standard accesses for @{text "path.x"} include both @{text "x"} and - @{text "path.x"}. Normally, the naming is implicit in the theory or - proof context; there are separate versions of the corresponding. - - \medskip A @{text "name space"} manages a collection of fully - internalized names, together with a mapping between external names - and internal names (in both directions). The corresponding @{text - "intern"} and @{text "extern"} operations are mostly used for - parsing and printing only! The @{text "declare"} operation augments - a name space according to the accesses determined by the naming - policy. - - \medskip As a general principle, there is a separate name space for - each kind of formal entity, e.g.\ logical constant, type - constructor, type class, theorem. It is usually clear from the - occurrence in concrete syntax (or from the scope) which kind of - entity a name refers to. For example, the very same name @{text - "c"} may be used uniformly for a constant, type constructor, and - type class. - - There are common schemes to name theorems systematically, according - to the name of the main logical entity involved, e.g.\ @{text - "c.intro"} for a canonical theorem related to constant @{text "c"}. - This technique of mapping names from one space into another requires - some care in order to avoid conflicts. In particular, theorem names - derived from a type constructor or type class are better suffixed in - addition to the usual qualification, e.g.\ @{text "c_type.intro"} - and @{text "c_class.intro"} for theorems related to type @{text "c"} - and class @{text "c"}, respectively. -*} - -text %mlref {* - \begin{mldecls} - @{index_ML NameSpace.base: "string -> string"} \\ - @{index_ML NameSpace.qualifier: "string -> string"} \\ - @{index_ML NameSpace.append: "string -> string -> string"} \\ - @{index_ML NameSpace.implode: "string list -> string"} \\ - @{index_ML NameSpace.explode: "string -> string list"} \\ - \end{mldecls} - \begin{mldecls} - @{index_ML_type NameSpace.naming} \\ - @{index_ML NameSpace.default_naming: NameSpace.naming} \\ - @{index_ML NameSpace.add_path: "string -> NameSpace.naming -> NameSpace.naming"} \\ - @{index_ML NameSpace.full_name: "NameSpace.naming -> binding -> string"} \\ - \end{mldecls} - \begin{mldecls} - @{index_ML_type NameSpace.T} \\ - @{index_ML NameSpace.empty: NameSpace.T} \\ - @{index_ML NameSpace.merge: "NameSpace.T * NameSpace.T -> NameSpace.T"} \\ - @{index_ML NameSpace.declare: "NameSpace.naming -> binding -> NameSpace.T -> string * NameSpace.T"} \\ - @{index_ML NameSpace.intern: "NameSpace.T -> string -> string"} \\ - @{index_ML NameSpace.extern: "NameSpace.T -> string -> string"} \\ - \end{mldecls} - - \begin{description} - - \item @{ML NameSpace.base}~@{text "name"} returns the base name of a - qualified name. - - \item @{ML NameSpace.qualifier}~@{text "name"} returns the qualifier - of a qualified name. - - \item @{ML NameSpace.append}~@{text "name\<^isub>1 name\<^isub>2"} - appends two qualified names. - - \item @{ML NameSpace.implode}~@{text "name"} and @{ML - NameSpace.explode}~@{text "names"} convert between the packed string - representation and the explicit list form of qualified names. - - \item @{ML_type NameSpace.naming} represents the abstract concept of - a naming policy. - - \item @{ML NameSpace.default_naming} is the default naming policy. - In a theory context, this is usually augmented by a path prefix - consisting of the theory name. - - \item @{ML NameSpace.add_path}~@{text "path naming"} augments the - naming policy by extending its path component. - - \item @{ML NameSpace.full_name}@{text "naming binding"} turns a name - binding (usually a basic name) into the fully qualified - internal name, according to the given naming policy. - - \item @{ML_type NameSpace.T} represents name spaces. - - \item @{ML NameSpace.empty} and @{ML NameSpace.merge}~@{text - "(space\<^isub>1, space\<^isub>2)"} are the canonical operations for - maintaining name spaces according to theory data management - (\secref{sec:context-data}). - - \item @{ML NameSpace.declare}~@{text "naming bindings space"} enters a - name binding as fully qualified internal name into the name space, - with external accesses determined by the naming policy. - - \item @{ML NameSpace.intern}~@{text "space name"} internalizes a - (partially qualified) external name. - - This operation is mostly for parsing! Note that fully qualified - names stemming from declarations are produced via @{ML - "NameSpace.full_name"} and @{ML "NameSpace.declare"} - (or their derivatives for @{ML_type theory} and - @{ML_type Proof.context}). - - \item @{ML NameSpace.extern}~@{text "space name"} externalizes a - (fully qualified) internal name. - - This operation is mostly for printing! Note unqualified names are - produced via @{ML NameSpace.base}. - - \end{description} -*} - -end diff -r 419116f1157a -r e23770bc97c8 doc-src/IsarImplementation/Thy/proof.thy --- a/doc-src/IsarImplementation/Thy/proof.thy Thu Feb 26 08:44:44 2009 -0800 +++ /dev/null Thu Jan 01 00:00:00 1970 +0000 @@ -1,332 +0,0 @@ - -(* $Id$ *) - -theory "proof" imports base begin - -chapter {* Structured proofs *} - -section {* Variables \label{sec:variables} *} - -text {* - Any variable that is not explicitly bound by @{text "\"}-abstraction - is considered as ``free''. Logically, free variables act like - outermost universal quantification at the sequent level: @{text - "A\<^isub>1(x), \, A\<^isub>n(x) \ B(x)"} means that the result - holds \emph{for all} values of @{text "x"}. Free variables for - terms (not types) can be fully internalized into the logic: @{text - "\ B(x)"} and @{text "\ \x. B(x)"} are interchangeable, provided - that @{text "x"} does not occur elsewhere in the context. - Inspecting @{text "\ \x. B(x)"} more closely, we see that inside the - quantifier, @{text "x"} is essentially ``arbitrary, but fixed'', - while from outside it appears as a place-holder for instantiation - (thanks to @{text "\"} elimination). - - The Pure logic represents the idea of variables being either inside - or outside the current scope by providing separate syntactic - categories for \emph{fixed variables} (e.g.\ @{text "x"}) vs.\ - \emph{schematic variables} (e.g.\ @{text "?x"}). Incidently, a - universal result @{text "\ \x. B(x)"} has the HHF normal form @{text - "\ B(?x)"}, which represents its generality nicely without requiring - an explicit quantifier. The same principle works for type - variables: @{text "\ B(?\)"} represents the idea of ``@{text "\ - \\. B(\)"}'' without demanding a truly polymorphic framework. - - \medskip Additional care is required to treat type variables in a - way that facilitates type-inference. In principle, term variables - depend on type variables, which means that type variables would have - to be declared first. For example, a raw type-theoretic framework - would demand the context to be constructed in stages as follows: - @{text "\ = \: type, x: \, a: A(x\<^isub>\)"}. - - We allow a slightly less formalistic mode of operation: term - variables @{text "x"} are fixed without specifying a type yet - (essentially \emph{all} potential occurrences of some instance - @{text "x\<^isub>\"} are fixed); the first occurrence of @{text "x"} - within a specific term assigns its most general type, which is then - maintained consistently in the context. The above example becomes - @{text "\ = x: term, \: type, A(x\<^isub>\)"}, where type @{text - "\"} is fixed \emph{after} term @{text "x"}, and the constraint - @{text "x :: \"} is an implicit consequence of the occurrence of - @{text "x\<^isub>\"} in the subsequent proposition. - - This twist of dependencies is also accommodated by the reverse - operation of exporting results from a context: a type variable - @{text "\"} is considered fixed as long as it occurs in some fixed - term variable of the context. For example, exporting @{text "x: - term, \: type \ x\<^isub>\ = x\<^isub>\"} produces in the first step - @{text "x: term \ x\<^isub>\ = x\<^isub>\"} for fixed @{text "\"}, - and only in the second step @{text "\ ?x\<^isub>?\<^isub>\ = - ?x\<^isub>?\<^isub>\"} for schematic @{text "?x"} and @{text "?\"}. - - \medskip The Isabelle/Isar proof context manages the gory details of - term vs.\ type variables, with high-level principles for moving the - frontier between fixed and schematic variables. - - The @{text "add_fixes"} operation explictly declares fixed - variables; the @{text "declare_term"} operation absorbs a term into - a context by fixing new type variables and adding syntactic - constraints. - - The @{text "export"} operation is able to perform the main work of - generalizing term and type variables as sketched above, assuming - that fixing variables and terms have been declared properly. - - There @{text "import"} operation makes a generalized fact a genuine - part of the context, by inventing fixed variables for the schematic - ones. The effect can be reversed by using @{text "export"} later, - potentially with an extended context; the result is equivalent to - the original modulo renaming of schematic variables. - - The @{text "focus"} operation provides a variant of @{text "import"} - for nested propositions (with explicit quantification): @{text - "\x\<^isub>1 \ x\<^isub>n. B(x\<^isub>1, \, x\<^isub>n)"} is - decomposed by inventing fixed variables @{text "x\<^isub>1, \, - x\<^isub>n"} for the body. -*} - -text %mlref {* - \begin{mldecls} - @{index_ML Variable.add_fixes: " - string list -> Proof.context -> string list * Proof.context"} \\ - @{index_ML Variable.variant_fixes: " - string list -> Proof.context -> string list * Proof.context"} \\ - @{index_ML Variable.declare_term: "term -> Proof.context -> Proof.context"} \\ - @{index_ML Variable.declare_constraints: "term -> Proof.context -> Proof.context"} \\ - @{index_ML Variable.export: "Proof.context -> Proof.context -> thm list -> thm list"} \\ - @{index_ML Variable.polymorphic: "Proof.context -> term list -> term list"} \\ - @{index_ML Variable.import_thms: "bool -> thm list -> Proof.context -> - ((ctyp list * cterm list) * thm list) * Proof.context"} \\ - @{index_ML Variable.focus: "cterm -> Proof.context -> (cterm list * cterm) * Proof.context"} \\ - \end{mldecls} - - \begin{description} - - \item @{ML Variable.add_fixes}~@{text "xs ctxt"} fixes term - variables @{text "xs"}, returning the resulting internal names. By - default, the internal representation coincides with the external - one, which also means that the given variables must not be fixed - already. There is a different policy within a local proof body: the - given names are just hints for newly invented Skolem variables. - - \item @{ML Variable.variant_fixes} is similar to @{ML - Variable.add_fixes}, but always produces fresh variants of the given - names. - - \item @{ML Variable.declare_term}~@{text "t ctxt"} declares term - @{text "t"} to belong to the context. This automatically fixes new - type variables, but not term variables. Syntactic constraints for - type and term variables are declared uniformly, though. - - \item @{ML Variable.declare_constraints}~@{text "t ctxt"} declares - syntactic constraints from term @{text "t"}, without making it part - of the context yet. - - \item @{ML Variable.export}~@{text "inner outer thms"} generalizes - fixed type and term variables in @{text "thms"} according to the - difference of the @{text "inner"} and @{text "outer"} context, - following the principles sketched above. - - \item @{ML Variable.polymorphic}~@{text "ctxt ts"} generalizes type - variables in @{text "ts"} as far as possible, even those occurring - in fixed term variables. The default policy of type-inference is to - fix newly introduced type variables, which is essentially reversed - with @{ML Variable.polymorphic}: here the given terms are detached - from the context as far as possible. - - \item @{ML Variable.import_thms}~@{text "open thms ctxt"} invents fixed - type and term variables for the schematic ones occurring in @{text - "thms"}. The @{text "open"} flag indicates whether the fixed names - should be accessible to the user, otherwise newly introduced names - are marked as ``internal'' (\secref{sec:names}). - - \item @{ML Variable.focus}~@{text B} decomposes the outermost @{text - "\"} prefix of proposition @{text "B"}. - - \end{description} -*} - - -section {* Assumptions \label{sec:assumptions} *} - -text {* - An \emph{assumption} is a proposition that it is postulated in the - current context. Local conclusions may use assumptions as - additional facts, but this imposes implicit hypotheses that weaken - the overall statement. - - Assumptions are restricted to fixed non-schematic statements, i.e.\ - all generality needs to be expressed by explicit quantifiers. - Nevertheless, the result will be in HHF normal form with outermost - quantifiers stripped. For example, by assuming @{text "\x :: \. P - x"} we get @{text "\x :: \. P x \ P ?x"} for schematic @{text "?x"} - of fixed type @{text "\"}. Local derivations accumulate more and - more explicit references to hypotheses: @{text "A\<^isub>1, \, - A\<^isub>n \ B"} where @{text "A\<^isub>1, \, A\<^isub>n"} needs to - be covered by the assumptions of the current context. - - \medskip The @{text "add_assms"} operation augments the context by - local assumptions, which are parameterized by an arbitrary @{text - "export"} rule (see below). - - The @{text "export"} operation moves facts from a (larger) inner - context into a (smaller) outer context, by discharging the - difference of the assumptions as specified by the associated export - rules. Note that the discharged portion is determined by the - difference contexts, not the facts being exported! There is a - separate flag to indicate a goal context, where the result is meant - to refine an enclosing sub-goal of a structured proof state (cf.\ - \secref{sec:isar-proof-state}). - - \medskip The most basic export rule discharges assumptions directly - by means of the @{text "\"} introduction rule: - \[ - \infer[(@{text "\_intro"})]{@{text "\ \\ A \ A \ B"}}{@{text "\ \ B"}} - \] - - The variant for goal refinements marks the newly introduced - premises, which causes the canonical Isar goal refinement scheme to - enforce unification with local premises within the goal: - \[ - \infer[(@{text "#\_intro"})]{@{text "\ \\ A \ #A \ B"}}{@{text "\ \ B"}} - \] - - \medskip Alternative versions of assumptions may perform arbitrary - transformations on export, as long as the corresponding portion of - hypotheses is removed from the given facts. For example, a local - definition works by fixing @{text "x"} and assuming @{text "x \ t"}, - with the following export rule to reverse the effect: - \[ - \infer[(@{text "\-expand"})]{@{text "\ \\ x \ t \ B t"}}{@{text "\ \ B x"}} - \] - This works, because the assumption @{text "x \ t"} was introduced in - a context with @{text "x"} being fresh, so @{text "x"} does not - occur in @{text "\"} here. -*} - -text %mlref {* - \begin{mldecls} - @{index_ML_type Assumption.export} \\ - @{index_ML Assumption.assume: "cterm -> thm"} \\ - @{index_ML Assumption.add_assms: - "Assumption.export -> - cterm list -> Proof.context -> thm list * Proof.context"} \\ - @{index_ML Assumption.add_assumes: " - cterm list -> Proof.context -> thm list * Proof.context"} \\ - @{index_ML Assumption.export: "bool -> Proof.context -> Proof.context -> thm -> thm"} \\ - \end{mldecls} - - \begin{description} - - \item @{ML_type Assumption.export} represents arbitrary export - rules, which is any function of type @{ML_type "bool -> cterm list -> thm -> thm"}, - where the @{ML_type "bool"} indicates goal mode, and the @{ML_type - "cterm list"} the collection of assumptions to be discharged - simultaneously. - - \item @{ML Assumption.assume}~@{text "A"} turns proposition @{text - "A"} into a raw assumption @{text "A \ A'"}, where the conclusion - @{text "A'"} is in HHF normal form. - - \item @{ML Assumption.add_assms}~@{text "r As"} augments the context - by assumptions @{text "As"} with export rule @{text "r"}. The - resulting facts are hypothetical theorems as produced by the raw - @{ML Assumption.assume}. - - \item @{ML Assumption.add_assumes}~@{text "As"} is a special case of - @{ML Assumption.add_assms} where the export rule performs @{text - "\_intro"} or @{text "#\_intro"}, depending on goal mode. - - \item @{ML Assumption.export}~@{text "is_goal inner outer thm"} - exports result @{text "thm"} from the the @{text "inner"} context - back into the @{text "outer"} one; @{text "is_goal = true"} means - this is a goal context. The result is in HHF normal form. Note - that @{ML "ProofContext.export"} combines @{ML "Variable.export"} - and @{ML "Assumption.export"} in the canonical way. - - \end{description} -*} - - -section {* Results \label{sec:results} *} - -text {* - Local results are established by monotonic reasoning from facts - within a context. This allows common combinations of theorems, - e.g.\ via @{text "\/\"} elimination, resolution rules, or equational - reasoning, see \secref{sec:thms}. Unaccounted context manipulations - should be avoided, notably raw @{text "\/\"} introduction or ad-hoc - references to free variables or assumptions not present in the proof - context. - - \medskip The @{text "SUBPROOF"} combinator allows to structure a - tactical proof recursively by decomposing a selected sub-goal: - @{text "(\x. A(x) \ B(x)) \ \"} is turned into @{text "B(x) \ \"} - after fixing @{text "x"} and assuming @{text "A(x)"}. This means - the tactic needs to solve the conclusion, but may use the premise as - a local fact, for locally fixed variables. - - The @{text "prove"} operation provides an interface for structured - backwards reasoning under program control, with some explicit sanity - checks of the result. The goal context can be augmented by - additional fixed variables (cf.\ \secref{sec:variables}) and - assumptions (cf.\ \secref{sec:assumptions}), which will be available - as local facts during the proof and discharged into implications in - the result. Type and term variables are generalized as usual, - according to the context. - - The @{text "obtain"} operation produces results by eliminating - existing facts by means of a given tactic. This acts like a dual - conclusion: the proof demonstrates that the context may be augmented - by certain fixed variables and assumptions. See also - \cite{isabelle-isar-ref} for the user-level @{text "\"} and - @{text "\"} elements. Final results, which may not refer to - the parameters in the conclusion, need to exported explicitly into - the original context. -*} - -text %mlref {* - \begin{mldecls} - @{index_ML SUBPROOF: - "({context: Proof.context, schematics: ctyp list * cterm list, - params: cterm list, asms: cterm list, concl: cterm, - prems: thm list} -> tactic) -> Proof.context -> int -> tactic"} \\ - \end{mldecls} - \begin{mldecls} - @{index_ML Goal.prove: "Proof.context -> string list -> term list -> term -> - ({prems: thm list, context: Proof.context} -> tactic) -> thm"} \\ - @{index_ML Goal.prove_multi: "Proof.context -> string list -> term list -> term list -> - ({prems: thm list, context: Proof.context} -> tactic) -> thm list"} \\ - \end{mldecls} - \begin{mldecls} - @{index_ML Obtain.result: "(Proof.context -> tactic) -> - thm list -> Proof.context -> (cterm list * thm list) * Proof.context"} \\ - \end{mldecls} - - \begin{description} - - \item @{ML SUBPROOF}~@{text "tac"} decomposes the structure of a - particular sub-goal, producing an extended context and a reduced - goal, which needs to be solved by the given tactic. All schematic - parameters of the goal are imported into the context as fixed ones, - which may not be instantiated in the sub-proof. - - \item @{ML Goal.prove}~@{text "ctxt xs As C tac"} states goal @{text - "C"} in the context augmented by fixed variables @{text "xs"} and - assumptions @{text "As"}, and applies tactic @{text "tac"} to solve - it. The latter may depend on the local assumptions being presented - as facts. The result is in HHF normal form. - - \item @{ML Goal.prove_multi} is simular to @{ML Goal.prove}, but - states several conclusions simultaneously. The goal is encoded by - means of Pure conjunction; @{ML Goal.conjunction_tac} will turn this - into a collection of individual subgoals. - - \item @{ML Obtain.result}~@{text "tac thms ctxt"} eliminates the - given facts using a tactic, which results in additional fixed - variables and assumptions in the context. Final results need to be - exported explicitly. - - \end{description} -*} - -end diff -r 419116f1157a -r e23770bc97c8 doc-src/IsarImplementation/Thy/tactic.thy --- a/doc-src/IsarImplementation/Thy/tactic.thy Thu Feb 26 08:44:44 2009 -0800 +++ /dev/null Thu Jan 01 00:00:00 1970 +0000 @@ -1,420 +0,0 @@ - -(* $Id$ *) - -theory tactic imports base begin - -chapter {* Tactical reasoning *} - -text {* - Tactical reasoning works by refining the initial claim in a - backwards fashion, until a solved form is reached. A @{text "goal"} - consists of several subgoals that need to be solved in order to - achieve the main statement; zero subgoals means that the proof may - be finished. A @{text "tactic"} is a refinement operation that maps - a goal to a lazy sequence of potential successors. A @{text - "tactical"} is a combinator for composing tactics. -*} - - -section {* Goals \label{sec:tactical-goals} *} - -text {* - Isabelle/Pure represents a goal\glossary{Tactical goal}{A theorem of - \seeglossary{Horn Clause} form stating that a number of subgoals - imply the main conclusion, which is marked as a protected - proposition.} as a theorem stating that the subgoals imply the main - goal: @{text "A\<^sub>1 \ \ \ A\<^sub>n \ C"}. The outermost goal - structure is that of a Horn Clause\glossary{Horn Clause}{An iterated - implication @{text "A\<^sub>1 \ \ \ A\<^sub>n \ C"}, without any - outermost quantifiers. Strictly speaking, propositions @{text - "A\<^sub>i"} need to be atomic in Horn Clauses, but Isabelle admits - arbitrary substructure here (nested @{text "\"} and @{text "\"} - connectives).}: i.e.\ an iterated implication without any - quantifiers\footnote{Recall that outermost @{text "\x. \[x]"} is - always represented via schematic variables in the body: @{text - "\[?x]"}. These variables may get instantiated during the course of - reasoning.}. For @{text "n = 0"} a goal is called ``solved''. - - The structure of each subgoal @{text "A\<^sub>i"} is that of a general - Hereditary Harrop Formula @{text "\x\<^sub>1 \ \x\<^sub>k. H\<^sub>1 \ \ \ H\<^sub>m \ B"} in - normal form. Here @{text "x\<^sub>1, \, x\<^sub>k"} are goal parameters, i.e.\ - arbitrary-but-fixed entities of certain types, and @{text "H\<^sub>1, \, - H\<^sub>m"} are goal hypotheses, i.e.\ facts that may be assumed locally. - Together, this forms the goal context of the conclusion @{text B} to - be established. The goal hypotheses may be again arbitrary - Hereditary Harrop Formulas, although the level of nesting rarely - exceeds 1--2 in practice. - - The main conclusion @{text C} is internally marked as a protected - proposition\glossary{Protected proposition}{An arbitrarily - structured proposition @{text "C"} which is forced to appear as - atomic by wrapping it into a propositional identity operator; - notation @{text "#C"}. Protecting a proposition prevents basic - inferences from entering into that structure for the time being.}, - which is represented explicitly by the notation @{text "#C"}. This - ensures that the decomposition into subgoals and main conclusion is - well-defined for arbitrarily structured claims. - - \medskip Basic goal management is performed via the following - Isabelle/Pure rules: - - \[ - \infer[@{text "(init)"}]{@{text "C \ #C"}}{} \qquad - \infer[@{text "(finish)"}]{@{text "C"}}{@{text "#C"}} - \] - - \medskip The following low-level variants admit general reasoning - with protected propositions: - - \[ - \infer[@{text "(protect)"}]{@{text "#C"}}{@{text "C"}} \qquad - \infer[@{text "(conclude)"}]{@{text "A\<^sub>1 \ \ \ A\<^sub>n \ C"}}{@{text "A\<^sub>1 \ \ \ A\<^sub>n \ #C"}} - \] -*} - -text %mlref {* - \begin{mldecls} - @{index_ML Goal.init: "cterm -> thm"} \\ - @{index_ML Goal.finish: "thm -> thm"} \\ - @{index_ML Goal.protect: "thm -> thm"} \\ - @{index_ML Goal.conclude: "thm -> thm"} \\ - \end{mldecls} - - \begin{description} - - \item @{ML "Goal.init"}~@{text C} initializes a tactical goal from - the well-formed proposition @{text C}. - - \item @{ML "Goal.finish"}~@{text "thm"} checks whether theorem - @{text "thm"} is a solved goal (no subgoals), and concludes the - result by removing the goal protection. - - \item @{ML "Goal.protect"}~@{text "thm"} protects the full statement - of theorem @{text "thm"}. - - \item @{ML "Goal.conclude"}~@{text "thm"} removes the goal - protection, even if there are pending subgoals. - - \end{description} -*} - - -section {* Tactics *} - -text {* A @{text "tactic"} is a function @{text "goal \ goal\<^sup>*\<^sup>*"} that - maps a given goal state (represented as a theorem, cf.\ - \secref{sec:tactical-goals}) to a lazy sequence of potential - successor states. The underlying sequence implementation is lazy - both in head and tail, and is purely functional in \emph{not} - supporting memoing.\footnote{The lack of memoing and the strict - nature of SML requires some care when working with low-level - sequence operations, to avoid duplicate or premature evaluation of - results.} - - An \emph{empty result sequence} means that the tactic has failed: in - a compound tactic expressions other tactics might be tried instead, - or the whole refinement step might fail outright, producing a - toplevel error message. When implementing tactics from scratch, one - should take care to observe the basic protocol of mapping regular - error conditions to an empty result; only serious faults should - emerge as exceptions. - - By enumerating \emph{multiple results}, a tactic can easily express - the potential outcome of an internal search process. There are also - combinators for building proof tools that involve search - systematically, see also \secref{sec:tacticals}. - - \medskip As explained in \secref{sec:tactical-goals}, a goal state - essentially consists of a list of subgoals that imply the main goal - (conclusion). Tactics may operate on all subgoals or on a - particularly specified subgoal, but must not change the main - conclusion (apart from instantiating schematic goal variables). - - Tactics with explicit \emph{subgoal addressing} are of the form - @{text "int \ tactic"} and may be applied to a particular subgoal - (counting from 1). If the subgoal number is out of range, the - tactic should fail with an empty result sequence, but must not raise - an exception! - - Operating on a particular subgoal means to replace it by an interval - of zero or more subgoals in the same place; other subgoals must not - be affected, apart from instantiating schematic variables ranging - over the whole goal state. - - A common pattern of composing tactics with subgoal addressing is to - try the first one, and then the second one only if the subgoal has - not been solved yet. Special care is required here to avoid bumping - into unrelated subgoals that happen to come after the original - subgoal. Assuming that there is only a single initial subgoal is a - very common error when implementing tactics! - - Tactics with internal subgoal addressing should expose the subgoal - index as @{text "int"} argument in full generality; a hardwired - subgoal 1 inappropriate. - - \medskip The main well-formedness conditions for proper tactics are - summarized as follows. - - \begin{itemize} - - \item General tactic failure is indicated by an empty result, only - serious faults may produce an exception. - - \item The main conclusion must not be changed, apart from - instantiating schematic variables. - - \item A tactic operates either uniformly on all subgoals, or - specifically on a selected subgoal (without bumping into unrelated - subgoals). - - \item Range errors in subgoal addressing produce an empty result. - - \end{itemize} - - Some of these conditions are checked by higher-level goal - infrastructure (\secref{sec:results}); others are not checked - explicitly, and violating them merely results in ill-behaved tactics - experienced by the user (e.g.\ tactics that insist in being - applicable only to singleton goals, or disallow composition with - basic tacticals). -*} - -text %mlref {* - \begin{mldecls} - @{index_ML_type tactic: "thm -> thm Seq.seq"} \\ - @{index_ML no_tac: tactic} \\ - @{index_ML all_tac: tactic} \\ - @{index_ML print_tac: "string -> tactic"} \\[1ex] - @{index_ML PRIMITIVE: "(thm -> thm) -> tactic"} \\[1ex] - @{index_ML SUBGOAL: "(term * int -> tactic) -> int -> tactic"} \\ - @{index_ML CSUBGOAL: "(cterm * int -> tactic) -> int -> tactic"} \\ - \end{mldecls} - - \begin{description} - - \item @{ML_type tactic} represents tactics. The well-formedness - conditions described above need to be observed. See also @{"file" - "~~/src/Pure/General/seq.ML"} for the underlying implementation of - lazy sequences. - - \item @{ML_type "int -> tactic"} represents tactics with explicit - subgoal addressing, with well-formedness conditions as described - above. - - \item @{ML no_tac} is a tactic that always fails, returning the - empty sequence. - - \item @{ML all_tac} is a tactic that always succeeds, returning a - singleton sequence with unchanged goal state. - - \item @{ML print_tac}~@{text "message"} is like @{ML all_tac}, but - prints a message together with the goal state on the tracing - channel. - - \item @{ML PRIMITIVE}~@{text rule} turns a primitive inference rule - into a tactic with unique result. Exception @{ML THM} is considered - a regular tactic failure and produces an empty result; other - exceptions are passed through. - - \item @{ML SUBGOAL}~@{text "(fn (subgoal, i) => tactic)"} is the - most basic form to produce a tactic with subgoal addressing. The - given abstraction over the subgoal term and subgoal number allows to - peek at the relevant information of the full goal state. The - subgoal range is checked as required above. - - \item @{ML CSUBGOAL} is similar to @{ML SUBGOAL}, but passes the - subgoal as @{ML_type cterm} instead of raw @{ML_type term}. This - avoids expensive re-certification in situations where the subgoal is - used directly for primitive inferences. - - \end{description} -*} - - -subsection {* Resolution and assumption tactics \label{sec:resolve-assume-tac} *} - -text {* \emph{Resolution} is the most basic mechanism for refining a - subgoal using a theorem as object-level rule. - \emph{Elim-resolution} is particularly suited for elimination rules: - it resolves with a rule, proves its first premise by assumption, and - finally deletes that assumption from any new subgoals. - \emph{Destruct-resolution} is like elim-resolution, but the given - destruction rules are first turned into canonical elimination - format. \emph{Forward-resolution} is like destruct-resolution, but - without deleting the selected assumption. The @{text "r/e/d/f"} - naming convention is maintained for several different kinds of - resolution rules and tactics. - - Assumption tactics close a subgoal by unifying some of its premises - against its conclusion. - - \medskip All the tactics in this section operate on a subgoal - designated by a positive integer. Other subgoals might be affected - indirectly, due to instantiation of schematic variables. - - There are various sources of non-determinism, the tactic result - sequence enumerates all possibilities of the following choices (if - applicable): - - \begin{enumerate} - - \item selecting one of the rules given as argument to the tactic; - - \item selecting a subgoal premise to eliminate, unifying it against - the first premise of the rule; - - \item unifying the conclusion of the subgoal to the conclusion of - the rule. - - \end{enumerate} - - Recall that higher-order unification may produce multiple results - that are enumerated here. -*} - -text %mlref {* - \begin{mldecls} - @{index_ML resolve_tac: "thm list -> int -> tactic"} \\ - @{index_ML eresolve_tac: "thm list -> int -> tactic"} \\ - @{index_ML dresolve_tac: "thm list -> int -> tactic"} \\ - @{index_ML forward_tac: "thm list -> int -> tactic"} \\[1ex] - @{index_ML assume_tac: "int -> tactic"} \\ - @{index_ML eq_assume_tac: "int -> tactic"} \\[1ex] - @{index_ML match_tac: "thm list -> int -> tactic"} \\ - @{index_ML ematch_tac: "thm list -> int -> tactic"} \\ - @{index_ML dmatch_tac: "thm list -> int -> tactic"} \\ - \end{mldecls} - - \begin{description} - - \item @{ML resolve_tac}~@{text "thms i"} refines the goal state - using the given theorems, which should normally be introduction - rules. The tactic resolves a rule's conclusion with subgoal @{text - i}, replacing it by the corresponding versions of the rule's - premises. - - \item @{ML eresolve_tac}~@{text "thms i"} performs elim-resolution - with the given theorems, which should normally be elimination rules. - - \item @{ML dresolve_tac}~@{text "thms i"} performs - destruct-resolution with the given theorems, which should normally - be destruction rules. This replaces an assumption by the result of - applying one of the rules. - - \item @{ML forward_tac} is like @{ML dresolve_tac} except that the - selected assumption is not deleted. It applies a rule to an - assumption, adding the result as a new assumption. - - \item @{ML assume_tac}~@{text i} attempts to solve subgoal @{text i} - by assumption (modulo higher-order unification). - - \item @{ML eq_assume_tac} is similar to @{ML assume_tac}, but checks - only for immediate @{text "\"}-convertibility instead of using - unification. It succeeds (with a unique next state) if one of the - assumptions is equal to the subgoal's conclusion. Since it does not - instantiate variables, it cannot make other subgoals unprovable. - - \item @{ML match_tac}, @{ML ematch_tac}, and @{ML dmatch_tac} are - similar to @{ML resolve_tac}, @{ML eresolve_tac}, and @{ML - dresolve_tac}, respectively, but do not instantiate schematic - variables in the goal state. - - Flexible subgoals are not updated at will, but are left alone. - Strictly speaking, matching means to treat the unknowns in the goal - state as constants; these tactics merely discard unifiers that would - update the goal state. - - \end{description} -*} - - -subsection {* Explicit instantiation within a subgoal context *} - -text {* The main resolution tactics (\secref{sec:resolve-assume-tac}) - use higher-order unification, which works well in many practical - situations despite its daunting theoretical properties. - Nonetheless, there are important problem classes where unguided - higher-order unification is not so useful. This typically involves - rules like universal elimination, existential introduction, or - equational substitution. Here the unification problem involves - fully flexible @{text "?P ?x"} schemes, which are hard to manage - without further hints. - - By providing a (small) rigid term for @{text "?x"} explicitly, the - remaining unification problem is to assign a (large) term to @{text - "?P"}, according to the shape of the given subgoal. This is - sufficiently well-behaved in most practical situations. - - \medskip Isabelle provides separate versions of the standard @{text - "r/e/d/f"} resolution tactics that allow to provide explicit - instantiations of unknowns of the given rule, wrt.\ terms that refer - to the implicit context of the selected subgoal. - - An instantiation consists of a list of pairs of the form @{text - "(?x, t)"}, where @{text ?x} is a schematic variable occurring in - the given rule, and @{text t} is a term from the current proof - context, augmented by the local goal parameters of the selected - subgoal; cf.\ the @{text "focus"} operation described in - \secref{sec:variables}. - - Entering the syntactic context of a subgoal is a brittle operation, - because its exact form is somewhat accidental, and the choice of - bound variable names depends on the presence of other local and - global names. Explicit renaming of subgoal parameters prior to - explicit instantiation might help to achieve a bit more robustness. - - Type instantiations may be given as well, via pairs like @{text - "(?'a, \)"}. Type instantiations are distinguished from term - instantiations by the syntactic form of the schematic variable. - Types are instantiated before terms are. Since term instantiation - already performs type-inference as expected, explicit type - instantiations are seldom necessary. -*} - -text %mlref {* - \begin{mldecls} - @{index_ML res_inst_tac: "Proof.context -> (indexname * string) list -> thm -> int -> tactic"} \\ - @{index_ML eres_inst_tac: "Proof.context -> (indexname * string) list -> thm -> int -> tactic"} \\ - @{index_ML dres_inst_tac: "Proof.context -> (indexname * string) list -> thm -> int -> tactic"} \\ - @{index_ML forw_inst_tac: "Proof.context -> (indexname * string) list -> thm -> int -> tactic"} \\[1ex] - @{index_ML rename_tac: "string list -> int -> tactic"} \\ - \end{mldecls} - - \begin{description} - - \item @{ML res_inst_tac}~@{text "ctxt insts thm i"} instantiates the - rule @{text thm} with the instantiations @{text insts}, as described - above, and then performs resolution on subgoal @{text i}. - - \item @{ML eres_inst_tac} is like @{ML res_inst_tac}, but performs - elim-resolution. - - \item @{ML dres_inst_tac} is like @{ML res_inst_tac}, but performs - destruct-resolution. - - \item @{ML forw_inst_tac} is like @{ML dres_inst_tac} except that - the selected assumption is not deleted. - - \item @{ML rename_tac}~@{text "names i"} renames the innermost - parameters of subgoal @{text i} according to the provided @{text - names} (which need to be distinct indentifiers). - - \end{description} -*} - - -section {* Tacticals \label{sec:tacticals} *} - -text {* - -FIXME - -\glossary{Tactical}{A functional combinator for building up complex -tactics from simpler ones. Typical tactical perform sequential -composition, disjunction (choice), iteration, or goal addressing. -Various search strategies may be expressed via tacticals.} - -*} - -end - diff -r 419116f1157a -r e23770bc97c8 doc-src/IsarImplementation/Thy/unused.thy --- a/doc-src/IsarImplementation/Thy/unused.thy Thu Feb 26 08:44:44 2009 -0800 +++ /dev/null Thu Jan 01 00:00:00 1970 +0000 @@ -1,79 +0,0 @@ - -section {* Sessions and document preparation *} - -section {* Structured output *} - -subsection {* Pretty printing *} - -text FIXME - -subsection {* Output channels *} - -text FIXME - -subsection {* Print modes \label{sec:print-mode} *} - -text FIXME - -text {* - - - \medskip The general concept supports block-structured reasoning - nicely, with arbitrary mechanisms for introducing local assumptions. - The common reasoning pattern is as follows: - - \medskip - \begin{tabular}{l} - @{text "add_assms e\<^isub>1 A\<^isub>1"} \\ - @{text "\"} \\ - @{text "add_assms e\<^isub>n A\<^isub>n"} \\ - @{text "export"} \\ - \end{tabular} - \medskip - - \noindent The final @{text "export"} will turn any fact @{text - "A\<^isub>1, \, A\<^isub>n \ B"} into some @{text "\ B'"}, by - applying the export rules @{text "e\<^isub>1, \, e\<^isub>n"} - inside-out. - - - A \emph{fixed variable} acts like a local constant in the current - context, representing some simple type @{text "\"}, or some value - @{text "x: \"} (for a fixed type expression @{text "\"}). A - \emph{schematic variable} acts like a placeholder for arbitrary - elements, similar to outermost quantification. The division between - fixed and schematic variables tells which abstract entities are - inside and outside the current context. - - - @{index_ML Variable.trade: "Proof.context -> (thm list -> thm list) -> thm list -> thm list"} \\ - - - - \item @{ML Variable.trade} composes @{ML Variable.import} and @{ML - Variable.export}, i.e.\ it provides a view on facts with all - variables being fixed in the current context. - - - In practice, super-contexts emerge either by merging existing ones, - or by adding explicit declarations. For example, new theories are - usually derived by importing existing theories from the library - @{text "\ = \\<^sub>1 + \ + \\<^isub>n"}, or - - - - The Isar toplevel works differently for interactive developments - vs.\ batch processing of theory sources. For example, diagnostic - commands produce a warning batch mode, because they are considered - alien to the final theory document being produced eventually. - Moreover, full @{text undo} with intermediate checkpoints to protect - against destroying theories accidentally are limited to interactive - mode. In batch mode there is only a single strictly linear stream - of potentially desctructive theory transformations. - - \item @{ML Toplevel.empty} is an empty transition; the Isar command - dispatcher internally applies @{ML Toplevel.name} (for the command) - name and @{ML Toplevel.position} for the source position. - -*} - diff -r 419116f1157a -r e23770bc97c8 doc-src/IsarImplementation/checkglossary --- a/doc-src/IsarImplementation/checkglossary Thu Feb 26 08:44:44 2009 -0800 +++ /dev/null Thu Jan 01 00:00:00 1970 +0000 @@ -1,28 +0,0 @@ -#!/usr/bin/env perl -# $Id$ - -use strict; - -my %defs = (); -my %refs = (); - -while () { - if (m,\\glossaryentry\{\w*\\bf *((\w|\s)+)@,) { - $defs{lc $1} = 1; - } - while (m,\\seeglossary *\{((\w|\s)+)\},g) { - $refs{lc $1} = 1; - } -} - -print "Glossary definitions:\n"; -foreach (sort(keys(%defs))) { - print " \"$_\"\n"; -} - -foreach (keys(%refs)) { - s,s$,,; - if (!defined($defs{$_})) { - print "### Undefined glossary reference: \"$_\"\n"; - } -} diff -r 419116f1157a -r e23770bc97c8 doc-src/IsarImplementation/implementation.tex --- a/doc-src/IsarImplementation/implementation.tex Thu Feb 26 08:44:44 2009 -0800 +++ b/doc-src/IsarImplementation/implementation.tex Thu Feb 26 08:48:33 2009 -0800 @@ -1,6 +1,3 @@ - -%% $Id$ - \documentclass[12pt,a4paper,fleqn]{report} \usepackage{latexsym,graphicx} \usepackage[refpage]{nomencl} @@ -23,9 +20,6 @@ and Larry Paulson } -%FIXME -%\makeglossary - \makeindex @@ -71,14 +65,13 @@ \listoffigures \clearfirst -%\input{intro.tex} -\input{Thy/document/prelim.tex} -\input{Thy/document/logic.tex} -\input{Thy/document/tactic.tex} -\input{Thy/document/proof.tex} -\input{Thy/document/isar.tex} -\input{Thy/document/locale.tex} -\input{Thy/document/integration.tex} +\input{Thy/document/Prelim.tex} +\input{Thy/document/Logic.tex} +\input{Thy/document/Tactic.tex} +\input{Thy/document/Proof.tex} +\input{Thy/document/Isar.tex} +\input{Thy/document/Local_Theory.tex} +\input{Thy/document/Integration.tex} \appendix \input{Thy/document/ML.tex} @@ -89,10 +82,6 @@ \bibliography{../manual} \endgroup -%FIXME -%\tocentry{\glossaryname} -%\printglossary - \tocentry{\indexname} \printindex diff -r 419116f1157a -r e23770bc97c8 doc-src/IsarImplementation/intro.tex --- a/doc-src/IsarImplementation/intro.tex Thu Feb 26 08:44:44 2009 -0800 +++ /dev/null Thu Jan 01 00:00:00 1970 +0000 @@ -1,13 +0,0 @@ - -%% $Id$ - -\chapter{Introduction} - -FIXME - -\nocite{Wenzel-PhD} - -%%% Local Variables: -%%% mode: latex -%%% TeX-master: "implementation" -%%% End: diff -r 419116f1157a -r e23770bc97c8 doc-src/IsarImplementation/makeglossary --- a/doc-src/IsarImplementation/makeglossary Thu Feb 26 08:44:44 2009 -0800 +++ /dev/null Thu Jan 01 00:00:00 1970 +0000 @@ -1,6 +0,0 @@ -#!/bin/sh -# $Id$ - -NAME="$1" -makeindex -s nomencl -o "${NAME}.gls" "${NAME}.glo" -./checkglossary "${NAME}.glo" diff -r 419116f1157a -r e23770bc97c8 doc-src/IsarImplementation/style.sty --- a/doc-src/IsarImplementation/style.sty Thu Feb 26 08:44:44 2009 -0800 +++ b/doc-src/IsarImplementation/style.sty Thu Feb 26 08:48:33 2009 -0800 @@ -1,6 +1,3 @@ - -%% $Id$ - %% toc \newcommand{\tocentry}[1]{\cleardoublepage\phantomsection\addcontentsline{toc}{chapter}{#1} \@mkboth{\MakeUppercase{#1}}{\MakeUppercase{#1}}} @@ -10,13 +7,6 @@ \newcommand{\chref}[1]{chapter~\ref{#1}} \newcommand{\figref}[1]{figure~\ref{#1}} -%% glossary -\renewcommand{\glossary}[2]{\nomenclature{\bf #1}{#2}} -\newcommand{\seeglossary}[1]{\emph{#1}} -\newcommand{\glossaryname}{Glossary} -\renewcommand{\nomname}{\glossaryname} -\renewcommand{\pagedeclaration}[1]{\nobreak\quad\dotfill~page~\bold{#1}} - %% index \newcommand{\indexml}[1]{\index{\emph{#1}|bold}} \newcommand{\indexmlexception}[1]{\index{\emph{#1} (exception)|bold}} @@ -27,7 +17,9 @@ %% math \newcommand{\text}[1]{\mbox{#1}} \newcommand{\isasymvartheta}{\isamath{\theta}} -\newcommand{\isactrlvec}[1]{\emph{$\overline{#1}$}} +\newcommand{\isactrlvec}[1]{\emph{$\vec{#1}$}} +\newcommand{\isactrlBG}{\isacharbackquoteopen} +\newcommand{\isactrlEN}{\isacharbackquoteclose} \setcounter{secnumdepth}{2} \setcounter{tocdepth}{2} @@ -49,6 +41,10 @@ \newcommand{\isasymtype}{\minorcmd{type}} \newcommand{\isasymval}{\minorcmd{val}} +\newcommand{\isasymFIX}{\isakeyword{fix}} +\newcommand{\isasymASSUME}{\isakeyword{assume}} +\newcommand{\isasymDEFINE}{\isakeyword{define}} +\newcommand{\isasymNOTE}{\isakeyword{note}} \newcommand{\isasymGUESS}{\isakeyword{guess}} \newcommand{\isasymOBTAIN}{\isakeyword{obtain}} \newcommand{\isasymTHEORY}{\isakeyword{theory}} @@ -61,6 +57,7 @@ \isabellestyle{it} + %%% Local Variables: %%% mode: latex %%% TeX-master: "implementation" diff -r 419116f1157a -r e23770bc97c8 doc-src/IsarOverview/Isar/document/.cvsignore --- a/doc-src/IsarOverview/Isar/document/.cvsignore Thu Feb 26 08:44:44 2009 -0800 +++ /dev/null Thu Jan 01 00:00:00 1970 +0000 @@ -1,2 +0,0 @@ -*.sty -session.tex \ No newline at end of file diff -r 419116f1157a -r e23770bc97c8 doc-src/IsarRef/IsaMakefile --- a/doc-src/IsarRef/IsaMakefile Thu Feb 26 08:44:44 2009 -0800 +++ b/doc-src/IsarRef/IsaMakefile Thu Feb 26 08:48:33 2009 -0800 @@ -22,10 +22,11 @@ HOL-IsarRef: $(LOG)/HOL-IsarRef.gz $(LOG)/HOL-IsarRef.gz: Thy/ROOT.ML ../antiquote_setup.ML \ - Thy/Inner_Syntax.thy Thy/Introduction.thy Thy/Outer_Syntax.thy \ - Thy/Spec.thy Thy/Proof.thy Thy/Misc.thy Thy/Document_Preparation.thy \ - Thy/Generic.thy Thy/HOL_Specific.thy Thy/Quick_Reference.thy \ - Thy/Symbols.thy Thy/ML_Tactic.thy + Thy/First_Order_Logic.thy Thy/Framework.thy Thy/Inner_Syntax.thy \ + Thy/Introduction.thy Thy/Outer_Syntax.thy Thy/Spec.thy Thy/Proof.thy \ + Thy/Misc.thy Thy/Document_Preparation.thy Thy/Generic.thy \ + Thy/HOL_Specific.thy Thy/Quick_Reference.thy Thy/Symbols.thy \ + Thy/ML_Tactic.thy @$(USEDIR) -s IsarRef HOL Thy diff -r 419116f1157a -r e23770bc97c8 doc-src/IsarRef/Thy/First_Order_Logic.thy --- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/doc-src/IsarRef/Thy/First_Order_Logic.thy Thu Feb 26 08:48:33 2009 -0800 @@ -0,0 +1,520 @@ + +header {* Example: First-Order Logic *} + +theory %visible First_Order_Logic +imports Pure +begin + +text {* + \noindent In order to commence a new object-logic within + Isabelle/Pure we introduce abstract syntactic categories @{text "i"} + for individuals and @{text "o"} for object-propositions. The latter + is embedded into the language of Pure propositions by means of a + separate judgment. +*} + +typedecl i +typedecl o + +judgment + Trueprop :: "o \ prop" ("_" 5) + +text {* + \noindent Note that the object-logic judgement is implicit in the + syntax: writing @{prop A} produces @{term "Trueprop A"} internally. + From the Pure perspective this means ``@{prop A} is derivable in the + object-logic''. +*} + + +subsection {* Equational reasoning \label{sec:framework-ex-equal} *} + +text {* + Equality is axiomatized as a binary predicate on individuals, with + reflexivity as introduction, and substitution as elimination + principle. Note that the latter is particularly convenient in a + framework like Isabelle, because syntactic congruences are + implicitly produced by unification of @{term "B x"} against + expressions containing occurrences of @{term x}. +*} + +axiomatization + equal :: "i \ i \ o" (infix "=" 50) +where + refl [intro]: "x = x" and + subst [elim]: "x = y \ B x \ B y" + +text {* + \noindent Substitution is very powerful, but also hard to control in + full generality. We derive some common symmetry~/ transitivity + schemes of as particular consequences. +*} + +theorem sym [sym]: + assumes "x = y" + shows "y = x" +proof - + have "x = x" .. + with `x = y` show "y = x" .. +qed + +theorem forw_subst [trans]: + assumes "y = x" and "B x" + shows "B y" +proof - + from `y = x` have "x = y" .. + from this and `B x` show "B y" .. +qed + +theorem back_subst [trans]: + assumes "B x" and "x = y" + shows "B y" +proof - + from `x = y` and `B x` + show "B y" .. +qed + +theorem trans [trans]: + assumes "x = y" and "y = z" + shows "x = z" +proof - + from `y = z` and `x = y` + show "x = z" .. +qed + + +subsection {* Basic group theory *} + +text {* + As an example for equational reasoning we consider some bits of + group theory. The subsequent locale definition postulates group + operations and axioms; we also derive some consequences of this + specification. +*} + +locale group = + fixes prod :: "i \ i \ i" (infix "\" 70) + and inv :: "i \ i" ("(_\)" [1000] 999) + and unit :: i ("1") + assumes assoc: "(x \ y) \ z = x \ (y \ z)" + and left_unit: "1 \ x = x" + and left_inv: "x\ \ x = 1" +begin + +theorem right_inv: "x \ x\ = 1" +proof - + have "x \ x\ = 1 \ (x \ x\)" by (rule left_unit [symmetric]) + also have "\ = (1 \ x) \ x\" by (rule assoc [symmetric]) + also have "1 = (x\)\ \ x\" by (rule left_inv [symmetric]) + also have "\ \ x = (x\)\ \ (x\ \ x)" by (rule assoc) + also have "x\ \ x = 1" by (rule left_inv) + also have "((x\)\ \ \) \ x\ = (x\)\ \ (1 \ x\)" by (rule assoc) + also have "1 \ x\ = x\" by (rule left_unit) + also have "(x\)\ \ \ = 1" by (rule left_inv) + finally show "x \ x\ = 1" . +qed + +theorem right_unit: "x \ 1 = x" +proof - + have "1 = x\ \ x" by (rule left_inv [symmetric]) + also have "x \ \ = (x \ x\) \ x" by (rule assoc [symmetric]) + also have "x \ x\ = 1" by (rule right_inv) + also have "\ \ x = x" by (rule left_unit) + finally show "x \ 1 = x" . +qed + +text {* + \noindent Reasoning from basic axioms is often tedious. Our proofs + work by producing various instances of the given rules (potentially + the symmetric form) using the pattern ``@{command have}~@{text + eq}~@{command "by"}~@{text "(rule r)"}'' and composing the chain of + results via @{command also}/@{command finally}. These steps may + involve any of the transitivity rules declared in + \secref{sec:framework-ex-equal}, namely @{thm trans} in combining + the first two results in @{thm right_inv} and in the final steps of + both proofs, @{thm forw_subst} in the first combination of @{thm + right_unit}, and @{thm back_subst} in all other calculational steps. + + Occasional substitutions in calculations are adequate, but should + not be over-emphasized. The other extreme is to compose a chain by + plain transitivity only, with replacements occurring always in + topmost position. For example: +*} + +(*<*) +theorem "\A. PROP A \ PROP A" +proof - + assume [symmetric, defn]: "\x y. (x \ y) \ Trueprop (x = y)" +(*>*) + have "x \ 1 = x \ (x\ \ x)" unfolding left_inv .. + also have "\ = (x \ x\) \ x" unfolding assoc .. + also have "\ = 1 \ x" unfolding right_inv .. + also have "\ = x" unfolding left_unit .. + finally have "x \ 1 = x" . +(*<*) +qed +(*>*) + +text {* + \noindent Here we have re-used the built-in mechanism for unfolding + definitions in order to normalize each equational problem. A more + realistic object-logic would include proper setup for the Simplifier + (\secref{sec:simplifier}), the main automated tool for equational + reasoning in Isabelle. Then ``@{command unfolding}~@{thm + left_inv}~@{command ".."}'' would become ``@{command "by"}~@{text + "(simp only: left_inv)"}'' etc. +*} + +end + + +subsection {* Propositional logic \label{sec:framework-ex-prop} *} + +text {* + We axiomatize basic connectives of propositional logic: implication, + disjunction, and conjunction. The associated rules are modeled + after Gentzen's system of Natural Deduction \cite{Gentzen:1935}. +*} + +axiomatization + imp :: "o \ o \ o" (infixr "\" 25) where + impI [intro]: "(A \ B) \ A \ B" and + impD [dest]: "(A \ B) \ A \ B" + +axiomatization + disj :: "o \ o \ o" (infixr "\" 30) where + disjI\<^isub>1 [intro]: "A \ A \ B" and + disjI\<^isub>2 [intro]: "B \ A \ B" and + disjE [elim]: "A \ B \ (A \ C) \ (B \ C) \ C" + +axiomatization + conj :: "o \ o \ o" (infixr "\" 35) where + conjI [intro]: "A \ B \ A \ B" and + conjD\<^isub>1: "A \ B \ A" and + conjD\<^isub>2: "A \ B \ B" + +text {* + \noindent The conjunctive destructions have the disadvantage that + decomposing @{prop "A \ B"} involves an immediate decision which + component should be projected. The more convenient simultaneous + elimination @{prop "A \ B \ (A \ B \ C) \ C"} can be derived as + follows: +*} + +theorem conjE [elim]: + assumes "A \ B" + obtains A and B +proof + from `A \ B` show A by (rule conjD\<^isub>1) + from `A \ B` show B by (rule conjD\<^isub>2) +qed + +text {* + \noindent Here is an example of swapping conjuncts with a single + intermediate elimination step: +*} + +(*<*) +lemma "\A. PROP A \ PROP A" +proof - +(*>*) + assume "A \ B" + then obtain B and A .. + then have "B \ A" .. +(*<*) +qed +(*>*) + +text {* + \noindent Note that the analogous elimination rule for disjunction + ``@{text "\ A \ B \ A \ B"}'' coincides with + the original axiomatization of @{thm disjE}. + + \medskip We continue propositional logic by introducing absurdity + with its characteristic elimination. Plain truth may then be + defined as a proposition that is trivially true. +*} + +axiomatization + false :: o ("\") where + falseE [elim]: "\ \ A" + +definition + true :: o ("\") where + "\ \ \ \ \" + +theorem trueI [intro]: \ + unfolding true_def .. + +text {* + \medskip\noindent Now negation represents an implication towards + absurdity: +*} + +definition + not :: "o \ o" ("\ _" [40] 40) where + "\ A \ A \ \" + +theorem notI [intro]: + assumes "A \ \" + shows "\ A" +unfolding not_def +proof + assume A + then show \ by (rule `A \ \`) +qed + +theorem notE [elim]: + assumes "\ A" and A + shows B +proof - + from `\ A` have "A \ \" unfolding not_def . + from `A \ \` and `A` have \ .. + then show B .. +qed + + +subsection {* Classical logic *} + +text {* + Subsequently we state the principle of classical contradiction as a + local assumption. Thus we refrain from forcing the object-logic + into the classical perspective. Within that context, we may derive + well-known consequences of the classical principle. +*} + +locale classical = + assumes classical: "(\ C \ C) \ C" +begin + +theorem double_negation: + assumes "\ \ C" + shows C +proof (rule classical) + assume "\ C" + with `\ \ C` show C .. +qed + +theorem tertium_non_datur: "C \ \ C" +proof (rule double_negation) + show "\ \ (C \ \ C)" + proof + assume "\ (C \ \ C)" + have "\ C" + proof + assume C then have "C \ \ C" .. + with `\ (C \ \ C)` show \ .. + qed + then have "C \ \ C" .. + with `\ (C \ \ C)` show \ .. + qed +qed + +text {* + \noindent These examples illustrate both classical reasoning and + non-trivial propositional proofs in general. All three rules + characterize classical logic independently, but the original rule is + already the most convenient to use, because it leaves the conclusion + unchanged. Note that @{prop "(\ C \ C) \ C"} fits again into our + format for eliminations, despite the additional twist that the + context refers to the main conclusion. So we may write @{thm + classical} as the Isar statement ``@{text "\ \ thesis"}''. + This also explains nicely how classical reasoning really works: + whatever the main @{text thesis} might be, we may always assume its + negation! +*} + +end + + +subsection {* Quantifiers \label{sec:framework-ex-quant} *} + +text {* + Representing quantifiers is easy, thanks to the higher-order nature + of the underlying framework. According to the well-known technique + introduced by Church \cite{church40}, quantifiers are operators on + predicates, which are syntactically represented as @{text "\"}-terms + of type @{typ "i \ o"}. Binder notation turns @{text "All (\x. B + x)"} into @{text "\x. B x"} etc. +*} + +axiomatization + All :: "(i \ o) \ o" (binder "\" 10) where + allI [intro]: "(\x. B x) \ \x. B x" and + allD [dest]: "(\x. B x) \ B a" + +axiomatization + Ex :: "(i \ o) \ o" (binder "\" 10) where + exI [intro]: "B a \ (\x. B x)" and + exE [elim]: "(\x. B x) \ (\x. B x \ C) \ C" + +text {* + \noindent The statement of @{thm exE} corresponds to ``@{text + "\ \x. B x \ x \ B x"}'' in Isar. In the + subsequent example we illustrate quantifier reasoning involving all + four rules: +*} + +theorem + assumes "\x. \y. R x y" + shows "\y. \x. R x y" +proof -- {* @{text "\"} introduction *} + obtain x where "\y. R x y" using `\x. \y. R x y` .. -- {* @{text "\"} elimination *} + fix y have "R x y" using `\y. R x y` .. -- {* @{text "\"} destruction *} + then show "\x. R x y" .. -- {* @{text "\"} introduction *} +qed + + +subsection {* Canonical reasoning patterns *} + +text {* + The main rules of first-order predicate logic from + \secref{sec:framework-ex-prop} and \secref{sec:framework-ex-quant} + can now be summarized as follows, using the native Isar statement + format of \secref{sec:framework-stmt}. + + \medskip + \begin{tabular}{l} + @{text "impI: \ A \ B \ A \ B"} \\ + @{text "impD: \ A \ B \ A \ B"} \\[1ex] + + @{text "disjI\<^isub>1: \ A \ A \ B"} \\ + @{text "disjI\<^isub>2: \ B \ A \ B"} \\ + @{text "disjE: \ A \ B \ A \ B"} \\[1ex] + + @{text "conjI: \ A \ B \ A \ B"} \\ + @{text "conjE: \ A \ B \ A \ B"} \\[1ex] + + @{text "falseE: \ \ \ A"} \\ + @{text "trueI: \ \"} \\[1ex] + + @{text "notI: \ A \ \ \ \ A"} \\ + @{text "notE: \ \ A \ A \ B"} \\[1ex] + + @{text "allI: \ \x. B x \ \x. B x"} \\ + @{text "allE: \ \x. B x \ B a"} \\[1ex] + + @{text "exI: \ B a \ \x. B x"} \\ + @{text "exE: \ \x. B x \ a \ B a"} + \end{tabular} + \medskip + + \noindent This essentially provides a declarative reading of Pure + rules as Isar reasoning patterns: the rule statements tells how a + canonical proof outline shall look like. Since the above rules have + already been declared as @{attribute (Pure) intro}, @{attribute + (Pure) elim}, @{attribute (Pure) dest} --- each according to its + particular shape --- we can immediately write Isar proof texts as + follows: +*} + +(*<*) +theorem "\A. PROP A \ PROP A" +proof - +(*>*) + + txt_raw {*\begin{minipage}[t]{0.4\textwidth}*}(*<*)next(*>*) + + have "A \ B" + proof + assume A + show B sorry %noproof + qed + + txt_raw {*\end{minipage}\qquad\begin{minipage}[t]{0.4\textwidth}*}(*<*)next(*>*) + + have "A \ B" and A sorry %noproof + then have B .. + + txt_raw {*\end{minipage}\\[3ex]\begin{minipage}[t]{0.4\textwidth}*}(*<*)next(*>*) + + have A sorry %noproof + then have "A \ B" .. + + have B sorry %noproof + then have "A \ B" .. + + txt_raw {*\end{minipage}\qquad\begin{minipage}[t]{0.4\textwidth}*}(*<*)next(*>*) + + have "A \ B" sorry %noproof + then have C + proof + assume A + then show C sorry %noproof + next + assume B + then show C sorry %noproof + qed + + txt_raw {*\end{minipage}\\[3ex]\begin{minipage}[t]{0.4\textwidth}*}(*<*)next(*>*) + + have A and B sorry %noproof + then have "A \ B" .. + + txt_raw {*\end{minipage}\qquad\begin{minipage}[t]{0.4\textwidth}*}(*<*)next(*>*) + + have "A \ B" sorry %noproof + then obtain A and B .. + + txt_raw {*\end{minipage}\\[3ex]\begin{minipage}[t]{0.4\textwidth}*}(*<*)next(*>*) + + have "\" sorry %noproof + then have A .. + + txt_raw {*\end{minipage}\qquad\begin{minipage}[t]{0.4\textwidth}*}(*<*)next(*>*) + + have "\" .. + + txt_raw {*\end{minipage}\\[3ex]\begin{minipage}[t]{0.4\textwidth}*}(*<*)next(*>*) + + have "\ A" + proof + assume A + then show "\" sorry %noproof + qed + + txt_raw {*\end{minipage}\qquad\begin{minipage}[t]{0.4\textwidth}*}(*<*)next(*>*) + + have "\ A" and A sorry %noproof + then have B .. + + txt_raw {*\end{minipage}\\[3ex]\begin{minipage}[t]{0.4\textwidth}*}(*<*)next(*>*) + + have "\x. B x" + proof + fix x + show "B x" sorry %noproof + qed + + txt_raw {*\end{minipage}\qquad\begin{minipage}[t]{0.4\textwidth}*}(*<*)next(*>*) + + have "\x. B x" sorry %noproof + then have "B a" .. + + txt_raw {*\end{minipage}\\[3ex]\begin{minipage}[t]{0.4\textwidth}*}(*<*)next(*>*) + + have "\x. B x" + proof + show "B a" sorry %noproof + qed + + txt_raw {*\end{minipage}\qquad\begin{minipage}[t]{0.4\textwidth}*}(*<*)next(*>*) + + have "\x. B x" sorry %noproof + then obtain a where "B a" .. + + txt_raw {*\end{minipage}*} + +(*<*) +qed +(*>*) + +text {* + \bigskip\noindent Of course, these proofs are merely examples. As + sketched in \secref{sec:framework-subproof}, there is a fair amount + of flexibility in expressing Pure deductions in Isar. Here the user + is asked to express himself adequately, aiming at proof texts of + literary quality. +*} + +end %visible diff -r 419116f1157a -r e23770bc97c8 doc-src/IsarRef/Thy/Framework.thy --- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/doc-src/IsarRef/Thy/Framework.thy Thu Feb 26 08:48:33 2009 -0800 @@ -0,0 +1,1017 @@ +theory Framework +imports Main +begin + +chapter {* The Isabelle/Isar Framework \label{ch:isar-framework} *} + +text {* + Isabelle/Isar + \cite{Wenzel:1999:TPHOL,Wenzel-PhD,Nipkow-TYPES02,Wenzel-Paulson:2006,Wenzel:2006:Festschrift} + is intended as a generic framework for developing formal + mathematical documents with full proof checking. Definitions and + proofs are organized as theories. An assembly of theory sources may + be presented as a printed document; see also + \chref{ch:document-prep}. + + The main objective of Isar is the design of a human-readable + structured proof language, which is called the ``primary proof + format'' in Isar terminology. Such a primary proof language is + somewhere in the middle between the extremes of primitive proof + objects and actual natural language. In this respect, Isar is a bit + more formalistic than Mizar + \cite{Trybulec:1993:MizarFeatures,Rudnicki:1992:MizarOverview,Wiedijk:1999:Mizar}, + using logical symbols for certain reasoning schemes where Mizar + would prefer English words; see \cite{Wenzel-Wiedijk:2002} for + further comparisons of these systems. + + So Isar challenges the traditional way of recording informal proofs + in mathematical prose, as well as the common tendency to see fully + formal proofs directly as objects of some logical calculus (e.g.\ + @{text "\"}-terms in a version of type theory). In fact, Isar is + better understood as an interpreter of a simple block-structured + language for describing the data flow of local facts and goals, + interspersed with occasional invocations of proof methods. + Everything is reduced to logical inferences internally, but these + steps are somewhat marginal compared to the overall bookkeeping of + the interpretation process. Thanks to careful design of the syntax + and semantics of Isar language elements, a formal record of Isar + instructions may later appear as an intelligible text to the + attentive reader. + + The Isar proof language has emerged from careful analysis of some + inherent virtues of the existing logical framework of Isabelle/Pure + \cite{paulson-found,paulson700}, notably composition of higher-order + natural deduction rules, which is a generalization of Gentzen's + original calculus \cite{Gentzen:1935}. The approach of generic + inference systems in Pure is continued by Isar towards actual proof + texts. + + Concrete applications require another intermediate layer: an + object-logic. Isabelle/HOL \cite{isa-tutorial} (simply-typed + set-theory) is being used most of the time; Isabelle/ZF + \cite{isabelle-ZF} is less extensively developed, although it would + probably fit better for classical mathematics. + + \medskip In order to illustrate natural deduction in Isar, we shall + refer to the background theory and library of Isabelle/HOL. This + includes common notions of predicate logic, naive set-theory etc.\ + using fairly standard mathematical notation. From the perspective + of generic natural deduction there is nothing special about the + logical connectives of HOL (@{text "\"}, @{text "\"}, @{text "\"}, + @{text "\"}, etc.), only the resulting reasoning principles are + relevant to the user. There are similar rules available for + set-theory operators (@{text "\"}, @{text "\"}, @{text "\"}, @{text + "\"}, etc.), or any other theory developed in the library (lattice + theory, topology etc.). + + Subsequently we briefly review fragments of Isar proof texts + corresponding directly to such general deduction schemes. The + examples shall refer to set-theory, to minimize the danger of + understanding connectives of predicate logic as something special. + + \medskip The following deduction performs @{text "\"}-introduction, + working forwards from assumptions towards the conclusion. We give + both the Isar text, and depict the primitive rule involved, as + determined by unification of the problem against rules that are + declared in the library context. +*} + +text_raw {*\medskip\begin{minipage}{0.6\textwidth}*} + +(*<*) +lemma True +proof +(*>*) + assume "x \ A" and "x \ B" + then have "x \ A \ B" .. +(*<*) +qed +(*>*) + +text_raw {*\end{minipage}\begin{minipage}{0.4\textwidth}*} + +text {* + \infer{@{prop "x \ A \ B"}}{@{prop "x \ A"} & @{prop "x \ B"}} +*} + +text_raw {*\end{minipage}*} + +text {* + \medskip\noindent Note that @{command assume} augments the proof + context, @{command then} indicates that the current fact shall be + used in the next step, and @{command have} states an intermediate + goal. The two dots ``@{command ".."}'' refer to a complete proof of + this claim, using the indicated facts and a canonical rule from the + context. We could have been more explicit here by spelling out the + final proof step via the @{command "by"} command: +*} + +(*<*) +lemma True +proof +(*>*) + assume "x \ A" and "x \ B" + then have "x \ A \ B" by (rule IntI) +(*<*) +qed +(*>*) + +text {* + \noindent The format of the @{text "\"}-introduction rule represents + the most basic inference, which proceeds from given premises to a + conclusion, without any nested proof context involved. + + The next example performs backwards introduction on @{term "\\"}, + the intersection of all sets within a given set. This requires a + nested proof of set membership within a local context, where @{term + A} is an arbitrary-but-fixed member of the collection: +*} + +text_raw {*\medskip\begin{minipage}{0.6\textwidth}*} + +(*<*) +lemma True +proof +(*>*) + have "x \ \\" + proof + fix A + assume "A \ \" + show "x \ A" sorry %noproof + qed +(*<*) +qed +(*>*) + +text_raw {*\end{minipage}\begin{minipage}{0.4\textwidth}*} + +text {* + \infer{@{prop "x \ \\"}}{\infer*{@{prop "x \ A"}}{@{text "[A][A \ \]"}}} +*} + +text_raw {*\end{minipage}*} + +text {* + \medskip\noindent This Isar reasoning pattern again refers to the + primitive rule depicted above. The system determines it in the + ``@{command proof}'' step, which could have been spelt out more + explicitly as ``@{command proof}~@{text "(rule InterI)"}''. Note + that the rule involves both a local parameter @{term "A"} and an + assumption @{prop "A \ \"} in the nested reasoning. This kind of + compound rule typically demands a genuine sub-proof in Isar, working + backwards rather than forwards as seen before. In the proof body we + encounter the @{command fix}-@{command assume}-@{command show} + outline of nested sub-proofs that is typical for Isar. The final + @{command show} is like @{command have} followed by an additional + refinement of the enclosing claim, using the rule derived from the + proof body. + + \medskip The next example involves @{term "\\"}, which can be + characterized as the set of all @{term "x"} such that @{prop "\A. x + \ A \ A \ \"}. The elimination rule for @{prop "x \ \\"} does + not mention @{text "\"} and @{text "\"} at all, but admits to obtain + directly a local @{term "A"} such that @{prop "x \ A"} and @{prop "A + \ \"} hold. This corresponds to the following Isar proof and + inference rule, respectively: +*} + +text_raw {*\medskip\begin{minipage}{0.6\textwidth}*} + +(*<*) +lemma True +proof +(*>*) + assume "x \ \\" + then have C + proof + fix A + assume "x \ A" and "A \ \" + show C sorry %noproof + qed +(*<*) +qed +(*>*) + +text_raw {*\end{minipage}\begin{minipage}{0.4\textwidth}*} + +text {* + \infer{@{prop "C"}}{@{prop "x \ \\"} & \infer*{@{prop "C"}~}{@{text "[A][x \ A, A \ \]"}}} +*} + +text_raw {*\end{minipage}*} + +text {* + \medskip\noindent Although the Isar proof follows the natural + deduction rule closely, the text reads not as natural as + anticipated. There is a double occurrence of an arbitrary + conclusion @{prop "C"}, which represents the final result, but is + irrelevant for now. This issue arises for any elimination rule + involving local parameters. Isar provides the derived language + element @{command obtain}, which is able to perform the same + elimination proof more conveniently: +*} + +(*<*) +lemma True +proof +(*>*) + assume "x \ \\" + then obtain A where "x \ A" and "A \ \" .. +(*<*) +qed +(*>*) + +text {* + \noindent Here we avoid to mention the final conclusion @{prop "C"} + and return to plain forward reasoning. The rule involved in the + ``@{command ".."}'' proof is the same as before. +*} + + +section {* The Pure framework \label{sec:framework-pure} *} + +text {* + The Pure logic \cite{paulson-found,paulson700} is an intuitionistic + fragment of higher-order logic \cite{church40}. In type-theoretic + parlance, there are three levels of @{text "\"}-calculus with + corresponding arrows @{text "\"}/@{text "\"}/@{text "\"}: + + \medskip + \begin{tabular}{ll} + @{text "\ \ \"} & syntactic function space (terms depending on terms) \\ + @{text "\x. B(x)"} & universal quantification (proofs depending on terms) \\ + @{text "A \ B"} & implication (proofs depending on proofs) \\ + \end{tabular} + \medskip + + \noindent Here only the types of syntactic terms, and the + propositions of proof terms have been shown. The @{text + "\"}-structure of proofs can be recorded as an optional feature of + the Pure inference kernel \cite{Berghofer-Nipkow:2000:TPHOL}, but + the formal system can never depend on them due to \emph{proof + irrelevance}. + + On top of this most primitive layer of proofs, Pure implements a + generic calculus for nested natural deduction rules, similar to + \cite{Schroeder-Heister:1984}. Here object-logic inferences are + internalized as formulae over @{text "\"} and @{text "\"}. + Combining such rule statements may involve higher-order unification + \cite{paulson-natural}. +*} + + +subsection {* Primitive inferences *} + +text {* + Term syntax provides explicit notation for abstraction @{text "\x :: + \. b(x)"} and application @{text "b a"}, while types are usually + implicit thanks to type-inference; terms of type @{text "prop"} are + called propositions. Logical statements are composed via @{text "\x + :: \. B(x)"} and @{text "A \ B"}. Primitive reasoning operates on + judgments of the form @{text "\ \ \"}, with standard introduction + and elimination rules for @{text "\"} and @{text "\"} that refer to + fixed parameters @{text "x\<^isub>1, \, x\<^isub>m"} and hypotheses + @{text "A\<^isub>1, \, A\<^isub>n"} from the context @{text "\"}; + the corresponding proof terms are left implicit. The subsequent + inference rules define @{text "\ \ \"} inductively, relative to a + collection of axioms: + + \[ + \infer{@{text "\ A"}}{(@{text "A"} \text{~axiom})} + \qquad + \infer{@{text "A \ A"}}{} + \] + + \[ + \infer{@{text "\ \ \x. B(x)"}}{@{text "\ \ B(x)"} & @{text "x \ \"}} + \qquad + \infer{@{text "\ \ B(a)"}}{@{text "\ \ \x. B(x)"}} + \] + + \[ + \infer{@{text "\ - A \ A \ B"}}{@{text "\ \ B"}} + \qquad + \infer{@{text "\\<^sub>1 \ \\<^sub>2 \ B"}}{@{text "\\<^sub>1 \ A \ B"} & @{text "\\<^sub>2 \ A"}} + \] + + Furthermore, Pure provides a built-in equality @{text "\ :: \ \ \ \ + prop"} with axioms for reflexivity, substitution, extensionality, + and @{text "\\\"}-conversion on @{text "\"}-terms. + + \medskip An object-logic introduces another layer on top of Pure, + e.g.\ with types @{text "i"} for individuals and @{text "o"} for + propositions, term constants @{text "Trueprop :: o \ prop"} as + (implicit) derivability judgment and connectives like @{text "\ :: o + \ o \ o"} or @{text "\ :: (i \ o) \ o"}, and axioms for object-level + rules such as @{text "conjI: A \ B \ A \ B"} or @{text "allI: (\x. B + x) \ \x. B x"}. Derived object rules are represented as theorems of + Pure. After the initial object-logic setup, further axiomatizations + are usually avoided; plain definitions and derived principles are + used exclusively. +*} + + +subsection {* Reasoning with rules \label{sec:framework-resolution} *} + +text {* + Primitive inferences mostly serve foundational purposes. The main + reasoning mechanisms of Pure operate on nested natural deduction + rules expressed as formulae, using @{text "\"} to bind local + parameters and @{text "\"} to express entailment. Multiple + parameters and premises are represented by repeating these + connectives in a right-associative manner. + + Since @{text "\"} and @{text "\"} commute thanks to the theorem + @{prop "(A \ (\x. B x)) \ (\x. A \ B x)"}, we may assume w.l.o.g.\ + that rule statements always observe the normal form where + quantifiers are pulled in front of implications at each level of + nesting. This means that any Pure proposition may be presented as a + \emph{Hereditary Harrop Formula} \cite{Miller:1991} which is of the + form @{text "\x\<^isub>1 \ x\<^isub>m. H\<^isub>1 \ \ H\<^isub>n \ + A"} for @{text "m, n \ 0"}, and @{text "A"} atomic, and @{text + "H\<^isub>1, \, H\<^isub>n"} being recursively of the same format. + Following the convention that outermost quantifiers are implicit, + Horn clauses @{text "A\<^isub>1 \ \ A\<^isub>n \ A"} are a special + case of this. + + For example, @{text "\"}-introduction rule encountered before is + represented as a Pure theorem as follows: + \[ + @{text "IntI:"}~@{prop "x \ A \ x \ B \ x \ A \ B"} + \] + + \noindent This is a plain Horn clause, since no further nesting on + the left is involved. The general @{text "\"}-introduction + corresponds to a Hereditary Harrop Formula with one additional level + of nesting: + \[ + @{text "InterI:"}~@{prop "(\A. A \ \ \ x \ A) \ x \ \\"} + \] + + \medskip Goals are also represented as rules: @{text "A\<^isub>1 \ + \ A\<^isub>n \ C"} states that the sub-goals @{text "A\<^isub>1, \, + A\<^isub>n"} entail the result @{text "C"}; for @{text "n = 0"} the + goal is finished. To allow @{text "C"} being a rule statement + itself, we introduce the protective marker @{text "# :: prop \ + prop"}, which is defined as identity and hidden from the user. We + initialize and finish goal states as follows: + + \[ + \begin{array}{c@ {\qquad}c} + \infer[(@{inference_def init})]{@{text "C \ #C"}}{} & + \infer[(@{inference_def finish})]{@{text C}}{@{text "#C"}} + \end{array} + \] + + \noindent Goal states are refined in intermediate proof steps until + a finished form is achieved. Here the two main reasoning principles + are @{inference resolution}, for back-chaining a rule against a + sub-goal (replacing it by zero or more sub-goals), and @{inference + assumption}, for solving a sub-goal (finding a short-circuit with + local assumptions). Below @{text "\<^vec>x"} stands for @{text + "x\<^isub>1, \, x\<^isub>n"} (@{text "n \ 0"}). + + \[ + \infer[(@{inference_def resolution})] + {@{text "(\\<^vec>x. \<^vec>H \<^vec>x \ \<^vec>A (\<^vec>a \<^vec>x))\ \ C\"}} + {\begin{tabular}{rl} + @{text "rule:"} & + @{text "\<^vec>A \<^vec>a \ B \<^vec>a"} \\ + @{text "goal:"} & + @{text "(\\<^vec>x. \<^vec>H \<^vec>x \ B' \<^vec>x) \ C"} \\ + @{text "goal unifier:"} & + @{text "(\\<^vec>x. B (\<^vec>a \<^vec>x))\ = B'\"} \\ + \end{tabular}} + \] + + \medskip + + \[ + \infer[(@{inference_def assumption})]{@{text "C\"}} + {\begin{tabular}{rl} + @{text "goal:"} & + @{text "(\\<^vec>x. \<^vec>H \<^vec>x \ A \<^vec>x) \ C"} \\ + @{text "assm unifier:"} & @{text "A\ = H\<^sub>i\"}~~\text{(for some~@{text "H\<^sub>i"})} \\ + \end{tabular}} + \] + + The following trace illustrates goal-oriented reasoning in + Isabelle/Pure: + + {\footnotesize + \medskip + \begin{tabular}{r@ {\quad}l} + @{text "(A \ B \ B \ A) \ #(A \ B \ B \ A)"} & @{text "(init)"} \\ + @{text "(A \ B \ B) \ (A \ B \ A) \ #\"} & @{text "(resolution B \ A \ B \ A)"} \\ + @{text "(A \ B \ A \ B) \ (A \ B \ A) \ #\"} & @{text "(resolution A \ B \ B)"} \\ + @{text "(A \ B \ A) \ #\"} & @{text "(assumption)"} \\ + @{text "(A \ B \ B \ A) \ #\"} & @{text "(resolution A \ B \ A)"} \\ + @{text "#\"} & @{text "(assumption)"} \\ + @{text "A \ B \ B \ A"} & @{text "(finish)"} \\ + \end{tabular} + \medskip + } + + Compositions of @{inference assumption} after @{inference + resolution} occurs quite often, typically in elimination steps. + Traditional Isabelle tactics accommodate this by a combined + @{inference_def elim_resolution} principle. In contrast, Isar uses + a slightly more refined combination, where the assumptions to be + closed are marked explicitly, using again the protective marker + @{text "#"}: + + \[ + \infer[(@{inference refinement})] + {@{text "(\\<^vec>x. \<^vec>H \<^vec>x \ \<^vec>G' (\<^vec>a \<^vec>x))\ \ C\"}} + {\begin{tabular}{rl} + @{text "sub\proof:"} & + @{text "\<^vec>G \<^vec>a \ B \<^vec>a"} \\ + @{text "goal:"} & + @{text "(\\<^vec>x. \<^vec>H \<^vec>x \ B' \<^vec>x) \ C"} \\ + @{text "goal unifier:"} & + @{text "(\\<^vec>x. B (\<^vec>a \<^vec>x))\ = B'\"} \\ + @{text "assm unifiers:"} & + @{text "(\\<^vec>x. G\<^sub>j (\<^vec>a \<^vec>x))\ = #H\<^sub>i\"} \\ + & \quad (for each marked @{text "G\<^sub>j"} some @{text "#H\<^sub>i"}) \\ + \end{tabular}} + \] + + \noindent Here the @{text "sub\proof"} rule stems from the + main @{command fix}-@{command assume}-@{command show} outline of + Isar (cf.\ \secref{sec:framework-subproof}): each assumption + indicated in the text results in a marked premise @{text "G"} above. + The marking enforces resolution against one of the sub-goal's + premises. Consequently, @{command fix}-@{command assume}-@{command + show} enables to fit the result of a sub-proof quite robustly into a + pending sub-goal, while maintaining a good measure of flexibility. +*} + + +section {* The Isar proof language \label{sec:framework-isar} *} + +text {* + Structured proofs are presented as high-level expressions for + composing entities of Pure (propositions, facts, and goals). The + Isar proof language allows to organize reasoning within the + underlying rule calculus of Pure, but Isar is not another logical + calculus! + + Isar is an exercise in sound minimalism. Approximately half of the + language is introduced as primitive, the rest defined as derived + concepts. The following grammar describes the core language + (category @{text "proof"}), which is embedded into theory + specification elements such as @{command theorem}; see also + \secref{sec:framework-stmt} for the separate category @{text + "statement"}. + + \medskip + \begin{tabular}{rcl} + @{text "theory\stmt"} & = & @{command "theorem"}~@{text "statement proof |"}~~@{command "definition"}~@{text "\ | \"} \\[1ex] + + @{text "proof"} & = & @{text "prfx\<^sup>*"}~@{command "proof"}~@{text "method\<^sup>? stmt\<^sup>*"}~@{command "qed"}~@{text "method\<^sup>?"} \\[1ex] + + @{text prfx} & = & @{command "using"}~@{text "facts"} \\ + & @{text "|"} & @{command "unfolding"}~@{text "facts"} \\ + + @{text stmt} & = & @{command "{"}~@{text "stmt\<^sup>*"}~@{command "}"} \\ + & @{text "|"} & @{command "next"} \\ + & @{text "|"} & @{command "note"}~@{text "name = facts"} \\ + & @{text "|"} & @{command "let"}~@{text "term = term"} \\ + & @{text "|"} & @{command "fix"}~@{text "var\<^sup>+"} \\ + & @{text "|"} & @{command assume}~@{text "\inference\ name: props"} \\ + & @{text "|"} & @{command "then"}@{text "\<^sup>?"}~@{text goal} \\ + @{text goal} & = & @{command "have"}~@{text "name: props proof"} \\ + & @{text "|"} & @{command "show"}~@{text "name: props proof"} \\ + \end{tabular} + + \medskip Simultaneous propositions or facts may be separated by the + @{keyword "and"} keyword. + + \medskip The syntax for terms and propositions is inherited from + Pure (and the object-logic). A @{text "pattern"} is a @{text + "term"} with schematic variables, to be bound by higher-order + matching. + + \medskip Facts may be referenced by name or proposition. For + example, the result of ``@{command have}~@{text "a: A \proof\"}'' + becomes available both as @{text "a"} and + \isacharbackquoteopen@{text "A"}\isacharbackquoteclose. Moreover, + fact expressions may involve attributes that modify either the + theorem or the background context. For example, the expression + ``@{text "a [OF b]"}'' refers to the composition of two facts + according to the @{inference resolution} inference of + \secref{sec:framework-resolution}, while ``@{text "a [intro]"}'' + declares a fact as introduction rule in the context. + + The special fact called ``@{fact this}'' always refers to the last + result, as produced by @{command note}, @{command assume}, @{command + have}, or @{command show}. Since @{command note} occurs + frequently together with @{command then} we provide some + abbreviations: + + \medskip + \begin{tabular}{rcl} + @{command from}~@{text a} & @{text "\"} & @{command note}~@{text a}~@{command then} \\ + @{command with}~@{text a} & @{text "\"} & @{command from}~@{text "a \ this"} \\ + \end{tabular} + \medskip + + The @{text "method"} category is essentially a parameter and may be + populated later. Methods use the facts indicated by @{command + "then"} or @{command using}, and then operate on the goal state. + Some basic methods are predefined: ``@{method "-"}'' leaves the goal + unchanged, ``@{method this}'' applies the facts as rules to the + goal, ``@{method "rule"}'' applies the facts to another rule and the + result to the goal (both ``@{method this}'' and ``@{method rule}'' + refer to @{inference resolution} of + \secref{sec:framework-resolution}). The secondary arguments to + ``@{method rule}'' may be specified explicitly as in ``@{text "(rule + a)"}'', or picked from the context. In the latter case, the system + first tries rules declared as @{attribute (Pure) elim} or + @{attribute (Pure) dest}, followed by those declared as @{attribute + (Pure) intro}. + + The default method for @{command proof} is ``@{method rule}'' + (arguments picked from the context), for @{command qed} it is + ``@{method "-"}''. Further abbreviations for terminal proof steps + are ``@{command "by"}~@{text "method\<^sub>1 method\<^sub>2"}'' for + ``@{command proof}~@{text "method\<^sub>1"}~@{command qed}~@{text + "method\<^sub>2"}'', and ``@{command ".."}'' for ``@{command + "by"}~@{method rule}, and ``@{command "."}'' for ``@{command + "by"}~@{method this}''. The @{command unfolding} element operates + directly on the current facts and goal by applying equalities. + + \medskip Block structure can be indicated explicitly by ``@{command + "{"}~@{text "\"}~@{command "}"}'', although the body of a sub-proof + already involves implicit nesting. In any case, @{command next} + jumps into the next section of a block, i.e.\ it acts like closing + an implicit block scope and opening another one; there is no direct + correspondence to subgoals here. + + The remaining elements @{command fix} and @{command assume} build up + a local context (see \secref{sec:framework-context}), while + @{command show} refines a pending sub-goal by the rule resulting + from a nested sub-proof (see \secref{sec:framework-subproof}). + Further derived concepts will support calculational reasoning (see + \secref{sec:framework-calc}). +*} + + +subsection {* Context elements \label{sec:framework-context} *} + +text {* + In judgments @{text "\ \ \"} of the primitive framework, @{text "\"} + essentially acts like a proof context. Isar elaborates this idea + towards a higher-level notion, with additional information for + type-inference, term abbreviations, local facts, hypotheses etc. + + The element @{command fix}~@{text "x :: \"} declares a local + parameter, i.e.\ an arbitrary-but-fixed entity of a given type; in + results exported from the context, @{text "x"} may become anything. + The @{command assume}~@{text "\inference\"} element provides a + general interface to hypotheses: ``@{command assume}~@{text + "\inference\ A"}'' produces @{text "A \ A"} locally, while the + included inference tells how to discharge @{text A} from results + @{text "A \ B"} later on. There is no user-syntax for @{text + "\inference\"}, i.e.\ it may only occur internally when derived + commands are defined in ML. + + At the user-level, the default inference for @{command assume} is + @{inference discharge} as given below. The additional variants + @{command presume} and @{command def} are defined as follows: + + \medskip + \begin{tabular}{rcl} + @{command presume}~@{text A} & @{text "\"} & @{command assume}~@{text "\weak\discharge\ A"} \\ + @{command def}~@{text "x \ a"} & @{text "\"} & @{command fix}~@{text x}~@{command assume}~@{text "\expansion\ x \ a"} \\ + \end{tabular} + \medskip + + \[ + \infer[(@{inference_def discharge})]{@{text "\\ - A \ #A \ B"}}{@{text "\\ \ B"}} + \] + \[ + \infer[(@{inference_def "weak\discharge"})]{@{text "\\ - A \ A \ B"}}{@{text "\\ \ B"}} + \] + \[ + \infer[(@{inference_def expansion})]{@{text "\\ - (x \ a) \ B a"}}{@{text "\\ \ B x"}} + \] + + \medskip Note that @{inference discharge} and @{inference + "weak\discharge"} differ in the marker for @{prop A}, which is + relevant when the result of a @{command fix}-@{command + assume}-@{command show} outline is composed with a pending goal, + cf.\ \secref{sec:framework-subproof}. + + The most interesting derived context element in Isar is @{command + obtain} \cite[\S5.3]{Wenzel-PhD}, which supports generalized + elimination steps in a purely forward manner. The @{command obtain} + command takes a specification of parameters @{text "\<^vec>x"} and + assumptions @{text "\<^vec>A"} to be added to the context, together + with a proof of a case rule stating that this extension is + conservative (i.e.\ may be removed from closed results later on): + + \medskip + \begin{tabular}{l} + @{text "\facts\"}~~@{command obtain}~@{text "\<^vec>x \ \<^vec>A \<^vec>x \proof\ \"} \\[0.5ex] + \quad @{command have}~@{text "case: \thesis. (\\<^vec>x. \<^vec>A \<^vec>x \ thesis) \ thesis\"} \\ + \quad @{command proof}~@{method "-"} \\ + \qquad @{command fix}~@{text thesis} \\ + \qquad @{command assume}~@{text "[intro]: \\<^vec>x. \<^vec>A \<^vec>x \ thesis"} \\ + \qquad @{command show}~@{text thesis}~@{command using}~@{text "\facts\ \proof\"} \\ + \quad @{command qed} \\ + \quad @{command fix}~@{text "\<^vec>x"}~@{command assume}~@{text "\elimination case\ \<^vec>A \<^vec>x"} \\ + \end{tabular} + \medskip + + \[ + \infer[(@{inference elimination})]{@{text "\ \ B"}}{ + \begin{tabular}{rl} + @{text "case:"} & + @{text "\ \ \thesis. (\\<^vec>x. \<^vec>A \<^vec>x \ thesis) \ thesis"} \\[0.2ex] + @{text "result:"} & + @{text "\ \ \<^vec>A \<^vec>y \ B"} \\[0.2ex] + \end{tabular}} + \] + + \noindent Here the name ``@{text thesis}'' is a specific convention + for an arbitrary-but-fixed proposition; in the primitive natural + deduction rules shown before we have occasionally used @{text C}. + The whole statement of ``@{command obtain}~@{text x}~@{keyword + "where"}~@{text "A x"}'' may be read as a claim that @{text "A x"} + may be assumed for some arbitrary-but-fixed @{text "x"}. Also note + that ``@{command obtain}~@{text "A \ B"}'' without parameters + is similar to ``@{command have}~@{text "A \ B"}'', but the + latter involves multiple sub-goals. + + \medskip The subsequent Isar proof texts explain all context + elements introduced above using the formal proof language itself. + After finishing a local proof within a block, we indicate the + exported result via @{command note}. +*} + +(*<*) +theorem True +proof +(*>*) + txt_raw {* \begin{minipage}[t]{0.4\textwidth} *} + { + fix x + have "B x" sorry %noproof + } + note `\x. B x` + txt_raw {* \end{minipage}\quad\begin{minipage}[t]{0.4\textwidth} *}(*<*)next(*>*) + { + assume A + have B sorry %noproof + } + note `A \ B` + txt_raw {* \end{minipage}\\[3ex]\begin{minipage}[t]{0.4\textwidth} *}(*<*)next(*>*) + { + def x \ a + have "B x" sorry %noproof + } + note `B a` + txt_raw {* \end{minipage}\quad\begin{minipage}[t]{0.4\textwidth} *}(*<*)next(*>*) + { + obtain x where "A x" sorry %noproof + have B sorry %noproof + } + note `B` + txt_raw {* \end{minipage} *} +(*<*) +qed +(*>*) + +text {* + \bigskip\noindent This illustrates the meaning of Isar context + elements without goals getting in between. +*} + +subsection {* Structured statements \label{sec:framework-stmt} *} + +text {* + The category @{text "statement"} of top-level theorem specifications + is defined as follows: + + \medskip + \begin{tabular}{rcl} + @{text "statement"} & @{text "\"} & @{text "name: props \ \"} \\ + & @{text "|"} & @{text "context\<^sup>* conclusion"} \\[0.5ex] + + @{text "context"} & @{text "\"} & @{text "\ vars \ \"} \\ + & @{text "|"} & @{text "\ name: props \ \"} \\ + + @{text "conclusion"} & @{text "\"} & @{text "\ name: props \ \"} \\ + & @{text "|"} & @{text "\ vars \ \ \ name: props \ \"} \\ + & & \quad @{text "\ \"} \\ + \end{tabular} + + \medskip\noindent A simple @{text "statement"} consists of named + propositions. The full form admits local context elements followed + by the actual conclusions, such as ``@{keyword "fixes"}~@{text + x}~@{keyword "assumes"}~@{text "A x"}~@{keyword "shows"}~@{text "B + x"}''. The final result emerges as a Pure rule after discharging + the context: @{prop "\x. A x \ B x"}. + + The @{keyword "obtains"} variant is another abbreviation defined + below; unlike @{command obtain} (cf.\ + \secref{sec:framework-context}) there may be several ``cases'' + separated by ``@{text "\"}'', each consisting of several + parameters (@{text "vars"}) and several premises (@{text "props"}). + This specifies multi-branch elimination rules. + + \medskip + \begin{tabular}{l} + @{text "\ \<^vec>x \ \<^vec>A \<^vec>x \ \ \"} \\[0.5ex] + \quad @{text "\ thesis"} \\ + \quad @{text "\ [intro]: \\<^vec>x. \<^vec>A \<^vec>x \ thesis \ \"} \\ + \quad @{text "\ thesis"} \\ + \end{tabular} + \medskip + + Presenting structured statements in such an ``open'' format usually + simplifies the subsequent proof, because the outer structure of the + problem is already laid out directly. E.g.\ consider the following + canonical patterns for @{text "\"} and @{text "\"}, + respectively: +*} + +text_raw {*\begin{minipage}{0.5\textwidth}*} + +theorem + fixes x and y + assumes "A x" and "B y" + shows "C x y" +proof - + from `A x` and `B y` + show "C x y" sorry %noproof +qed + +text_raw {*\end{minipage}\begin{minipage}{0.5\textwidth}*} + +theorem + obtains x and y + where "A x" and "B y" +proof - + have "A a" and "B b" sorry %noproof + then show thesis .. +qed + +text_raw {*\end{minipage}*} + +text {* + \medskip\noindent Here local facts \isacharbackquoteopen@{text "A + x"}\isacharbackquoteclose\ and \isacharbackquoteopen@{text "B + y"}\isacharbackquoteclose\ are referenced immediately; there is no + need to decompose the logical rule structure again. In the second + proof the final ``@{command then}~@{command show}~@{text + thesis}~@{command ".."}'' involves the local rule case @{text "\x + y. A x \ B y \ thesis"} for the particular instance of terms @{text + "a"} and @{text "b"} produced in the body. +*} + + +subsection {* Structured proof refinement \label{sec:framework-subproof} *} + +text {* + By breaking up the grammar for the Isar proof language, we may + understand a proof text as a linear sequence of individual proof + commands. These are interpreted as transitions of the Isar virtual + machine (Isar/VM), which operates on a block-structured + configuration in single steps. This allows users to write proof + texts in an incremental manner, and inspect intermediate + configurations for debugging. + + The basic idea is analogous to evaluating algebraic expressions on a + stack machine: @{text "(a + b) \ c"} then corresponds to a sequence + of single transitions for each symbol @{text "(, a, +, b, ), \, c"}. + In Isar the algebraic values are facts or goals, and the operations + are inferences. + + \medskip The Isar/VM state maintains a stack of nodes, each node + contains the local proof context, the linguistic mode, and a pending + goal (optional). The mode determines the type of transition that + may be performed next, it essentially alternates between forward and + backward reasoning, with an intermediate stage for chained facts + (see \figref{fig:isar-vm}). + + \begin{figure}[htb] + \begin{center} + \includegraphics[width=0.8\textwidth]{Thy/document/isar-vm} + \end{center} + \caption{Isar/VM modes}\label{fig:isar-vm} + \end{figure} + + For example, in @{text "state"} mode Isar acts like a mathematical + scratch-pad, accepting declarations like @{command fix}, @{command + assume}, and claims like @{command have}, @{command show}. A goal + statement changes the mode to @{text "prove"}, which means that we + may now refine the problem via @{command unfolding} or @{command + proof}. Then we are again in @{text "state"} mode of a proof body, + which may issue @{command show} statements to solve pending + sub-goals. A concluding @{command qed} will return to the original + @{text "state"} mode one level upwards. The subsequent Isar/VM + trace indicates block structure, linguistic mode, goal state, and + inferences: +*} + +text_raw {* \begingroup\footnotesize *} +(*<*)lemma True +proof +(*>*) + txt_raw {* \begin{minipage}[t]{0.18\textwidth} *} + have "A \ B" + proof + assume A + show B + sorry %noproof + qed + txt_raw {* \end{minipage}\quad +\begin{minipage}[t]{0.06\textwidth} +@{text "begin"} \\ +\\ +\\ +@{text "begin"} \\ +@{text "end"} \\ +@{text "end"} \\ +\end{minipage} +\begin{minipage}[t]{0.08\textwidth} +@{text "prove"} \\ +@{text "state"} \\ +@{text "state"} \\ +@{text "prove"} \\ +@{text "state"} \\ +@{text "state"} \\ +\end{minipage}\begin{minipage}[t]{0.35\textwidth} +@{text "(A \ B) \ #(A \ B)"} \\ +@{text "(A \ B) \ #(A \ B)"} \\ +\\ +\\ +@{text "#(A \ B)"} \\ +@{text "A \ B"} \\ +\end{minipage}\begin{minipage}[t]{0.4\textwidth} +@{text "(init)"} \\ +@{text "(resolution impI)"} \\ +\\ +\\ +@{text "(refinement #A \ B)"} \\ +@{text "(finish)"} \\ +\end{minipage} *} +(*<*) +qed +(*>*) +text_raw {* \endgroup *} + +text {* + \noindent Here the @{inference refinement} inference from + \secref{sec:framework-resolution} mediates composition of Isar + sub-proofs nicely. Observe that this principle incorporates some + degree of freedom in proof composition. In particular, the proof + body allows parameters and assumptions to be re-ordered, or commuted + according to Hereditary Harrop Form. Moreover, context elements + that are not used in a sub-proof may be omitted altogether. For + example: +*} + +text_raw {*\begin{minipage}{0.5\textwidth}*} + +(*<*) +lemma True +proof +(*>*) + have "\x y. A x \ B y \ C x y" + proof - + fix x and y + assume "A x" and "B y" + show "C x y" sorry %noproof + qed + +txt_raw {*\end{minipage}\begin{minipage}{0.5\textwidth}*} + +(*<*) +next +(*>*) + have "\x y. A x \ B y \ C x y" + proof - + fix x assume "A x" + fix y assume "B y" + show "C x y" sorry %noproof + qed + +txt_raw {*\end{minipage}\\[3ex]\begin{minipage}{0.5\textwidth}*} + +(*<*) +next +(*>*) + have "\x y. A x \ B y \ C x y" + proof - + fix y assume "B y" + fix x assume "A x" + show "C x y" sorry + qed + +txt_raw {*\end{minipage}\begin{minipage}{0.5\textwidth}*} +(*<*) +next +(*>*) + have "\x y. A x \ B y \ C x y" + proof - + fix y assume "B y" + fix x + show "C x y" sorry + qed +(*<*) +qed +(*>*) + +text_raw {*\end{minipage}*} + +text {* + \medskip\noindent Such ``peephole optimizations'' of Isar texts are + practically important to improve readability, by rearranging + contexts elements according to the natural flow of reasoning in the + body, while still observing the overall scoping rules. + + \medskip This illustrates the basic idea of structured proof + processing in Isar. The main mechanisms are based on natural + deduction rule composition within the Pure framework. In + particular, there are no direct operations on goal states within the + proof body. Moreover, there is no hidden automated reasoning + involved, just plain unification. +*} + + +subsection {* Calculational reasoning \label{sec:framework-calc} *} + +text {* + The existing Isar infrastructure is sufficiently flexible to support + calculational reasoning (chains of transitivity steps) as derived + concept. The generic proof elements introduced below depend on + rules declared as @{attribute trans} in the context. It is left to + the object-logic to provide a suitable rule collection for mixed + relations of @{text "="}, @{text "<"}, @{text "\"}, @{text "\"}, + @{text "\"} etc. Due to the flexibility of rule composition + (\secref{sec:framework-resolution}), substitution of equals by + equals is covered as well, even substitution of inequalities + involving monotonicity conditions; see also \cite[\S6]{Wenzel-PhD} + and \cite{Bauer-Wenzel:2001}. + + The generic calculational mechanism is based on the observation that + rules such as @{text "trans:"}~@{prop "x = y \ y = z \ x = z"} + proceed from the premises towards the conclusion in a deterministic + fashion. Thus we may reason in forward mode, feeding intermediate + results into rules selected from the context. The course of + reasoning is organized by maintaining a secondary fact called + ``@{fact calculation}'', apart from the primary ``@{fact this}'' + already provided by the Isar primitives. In the definitions below, + @{attribute OF} refers to @{inference resolution} + (\secref{sec:framework-resolution}) with multiple rule arguments, + and @{text "trans"} represents to a suitable rule from the context: + + \begin{matharray}{rcl} + @{command "also"}@{text "\<^sub>0"} & \equiv & @{command "note"}~@{text "calculation = this"} \\ + @{command "also"}@{text "\<^sub>n\<^sub>+\<^sub>1"} & \equiv & @{command "note"}~@{text "calculation = trans [OF calculation this]"} \\[0.5ex] + @{command "finally"} & \equiv & @{command "also"}~@{command "from"}~@{text calculation} \\ + \end{matharray} + + \noindent The start of a calculation is determined implicitly in the + text: here @{command also} sets @{fact calculation} to the current + result; any subsequent occurrence will update @{fact calculation} by + combination with the next result and a transitivity rule. The + calculational sequence is concluded via @{command finally}, where + the final result is exposed for use in a concluding claim. + + Here is a canonical proof pattern, using @{command have} to + establish the intermediate results: +*} + +(*<*) +lemma True +proof +(*>*) + have "a = b" sorry + also have "\ = c" sorry + also have "\ = d" sorry + finally have "a = d" . +(*<*) +qed +(*>*) + +text {* + \noindent The term ``@{text "\"}'' above is a special abbreviation + provided by the Isabelle/Isar syntax layer: it statically refers to + the right-hand side argument of the previous statement given in the + text. Thus it happens to coincide with relevant sub-expressions in + the calculational chain, but the exact correspondence is dependent + on the transitivity rules being involved. + + \medskip Symmetry rules such as @{prop "x = y \ y = x"} are like + transitivities with only one premise. Isar maintains a separate + rule collection declared via the @{attribute sym} attribute, to be + used in fact expressions ``@{text "a [symmetric]"}'', or single-step + proofs ``@{command assume}~@{text "x = y"}~@{command then}~@{command + have}~@{text "y = x"}~@{command ".."}''. +*} + +end \ No newline at end of file diff -r 419116f1157a -r e23770bc97c8 doc-src/IsarRef/Thy/Inner_Syntax.thy --- a/doc-src/IsarRef/Thy/Inner_Syntax.thy Thu Feb 26 08:44:44 2009 -0800 +++ b/doc-src/IsarRef/Thy/Inner_Syntax.thy Thu Feb 26 08:48:33 2009 -0800 @@ -1,5 +1,3 @@ -(* $Id$ *) - theory Inner_Syntax imports Main begin @@ -370,7 +368,7 @@ \end{matharray} \begin{rail} - ('notation' | 'no\_notation') target? mode? (nameref structmixfix + 'and') + ('notation' | 'no\_notation') target? mode? \\ (nameref structmixfix + 'and') ; \end{rail} @@ -525,13 +523,15 @@ & @{text "|"} & @{text "tid | tvar | "}@{verbatim "_"} \\ & @{text "|"} & @{text "tid"} @{verbatim "::"} @{text "sort | tvar "}@{verbatim "::"} @{text "sort | "}@{verbatim "_"} @{verbatim "::"} @{text "sort"} \\ & @{text "|"} & @{text "id | type\<^sup>(\<^sup>1\<^sup>0\<^sup>0\<^sup>0\<^sup>) id | "}@{verbatim "("} @{text type} @{verbatim ","} @{text "\"} @{verbatim ","} @{text type} @{verbatim ")"} @{text id} \\ - & @{text "|"} & @{text "longid | type\<^sup>(\<^sup>1\<^sup>0\<^sup>0\<^sup>0\<^sup>) longid | "}@{verbatim "("} @{text type} @{verbatim ","} @{text "\"} @{verbatim ","} @{text type} @{verbatim ")"} @{text longid} \\ + & @{text "|"} & @{text "longid | type\<^sup>(\<^sup>1\<^sup>0\<^sup>0\<^sup>0\<^sup>) longid"} \\ + & @{text "|"} & @{verbatim "("} @{text type} @{verbatim ","} @{text "\"} @{verbatim ","} @{text type} @{verbatim ")"} @{text longid} \\ & @{text "|"} & @{text "type\<^sup>(\<^sup>1\<^sup>)"} @{verbatim "=>"} @{text type} & @{text "(0)"} \\ & @{text "|"} & @{text "type\<^sup>(\<^sup>1\<^sup>)"} @{text "\"} @{text type} & @{text "(0)"} \\ & @{text "|"} & @{verbatim "["} @{text type} @{verbatim ","} @{text "\"} @{verbatim ","} @{text type} @{verbatim "]"} @{verbatim "=>"} @{text type} & @{text "(0)"} \\ & @{text "|"} & @{verbatim "["} @{text type} @{verbatim ","} @{text "\"} @{verbatim ","} @{text type} @{verbatim "]"} @{text "\"} @{text type} & @{text "(0)"} \\\\ - @{syntax_def (inner) sort} & = & @{text "id | longid | "}@{verbatim "{}"}@{text " | "}@{verbatim "{"} @{text "(id | longid)"} @{verbatim ","} @{text "\"} @{verbatim ","} @{text "(id | longid)"} @{verbatim "}"} \\ + @{syntax_def (inner) sort} & = & @{text "id | longid | "}@{verbatim "{}"} \\ + & @{text "|"} & @{verbatim "{"} @{text "(id | longid)"} @{verbatim ","} @{text "\"} @{verbatim ","} @{text "(id | longid)"} @{verbatim "}"} \\ \end{supertabular} \end{center} diff -r 419116f1157a -r e23770bc97c8 doc-src/IsarRef/Thy/Introduction.thy --- a/doc-src/IsarRef/Thy/Introduction.thy Thu Feb 26 08:44:44 2009 -0800 +++ b/doc-src/IsarRef/Thy/Introduction.thy Thu Feb 26 08:48:33 2009 -0800 @@ -1,5 +1,3 @@ -(* $Id$ *) - theory Introduction imports Main begin @@ -12,27 +10,27 @@ The \emph{Isabelle} system essentially provides a generic infrastructure for building deductive systems (programmed in Standard ML), with a special focus on interactive theorem proving in - higher-order logics. In the olden days even end-users would refer - to certain ML functions (goal commands, tactics, tacticals etc.) to - pursue their everyday theorem proving tasks - \cite{isabelle-intro,isabelle-ref}. + higher-order logics. Many years ago, even end-users would refer to + certain ML functions (goal commands, tactics, tacticals etc.) to + pursue their everyday theorem proving tasks. In contrast \emph{Isar} provides an interpreted language environment of its own, which has been specifically tailored for the needs of theory and proof development. Compared to raw ML, the Isabelle/Isar top-level provides a more robust and comfortable development - platform, with proper support for theory development graphs, - single-step transactions with unlimited undo, etc. The - Isabelle/Isar version of the \emph{Proof~General} user interface - \cite{proofgeneral,Aspinall:TACAS:2000} provides an adequate - front-end for interactive theory and proof development in this - advanced theorem proving environment. + platform, with proper support for theory development graphs, managed + transactions with unlimited undo etc. The Isabelle/Isar version of + the \emph{Proof~General} user interface + \cite{proofgeneral,Aspinall:TACAS:2000} provides a decent front-end + for interactive theory and proof development in this advanced + theorem proving environment, even though it is somewhat biased + towards old-style proof scripts. \medskip Apart from the technical advances over bare-bones ML programming, the main purpose of the Isar language is to provide a conceptually different view on machine-checked proofs - \cite{Wenzel:1999:TPHOL,Wenzel-PhD}. ``Isar'' stands for - ``Intelligible semi-automated reasoning''. Drawing from both the + \cite{Wenzel:1999:TPHOL,Wenzel-PhD}. \emph{Isar} stands for + \emph{Intelligible semi-automated reasoning}. Drawing from both the traditions of informal mathematical proof texts and high-level programming languages, Isar offers a versatile environment for structured formal proof documents. Thus properly written Isar @@ -47,12 +45,12 @@ Despite its grand design of structured proof texts, Isar is able to assimilate the old tactical style as an ``improper'' sub-language. This provides an easy upgrade path for existing tactic scripts, as - well as additional means for interactive experimentation and - debugging of structured proofs. Isabelle/Isar supports a broad - range of proof styles, both readable and unreadable ones. + well as some means for interactive experimentation and debugging of + structured proofs. Isabelle/Isar supports a broad range of proof + styles, both readable and unreadable ones. - \medskip The Isabelle/Isar framework \cite{Wenzel:2006:Festschrift} - is generic and should work reasonably well for any Isabelle + \medskip The generic Isabelle/Isar framework (see + \chref{ch:isar-framework}) works reasonably well for any Isabelle object-logic that conforms to the natural deduction view of the Isabelle/Pure framework. Specific language elements introduced by the major object-logics are described in \chref{ch:hol} @@ -72,194 +70,4 @@ context; other commands emulate old-style tactical theorem proving. *} - -section {* User interfaces *} - -subsection {* Terminal sessions *} - -text {* - The Isabelle \texttt{tty} tool provides a very interface for running - the Isar interaction loop, with some support for command line - editing. For example: -\begin{ttbox} -isabelle tty\medskip -{\out Welcome to Isabelle/HOL (Isabelle2008)}\medskip -theory Foo imports Main begin; -definition foo :: nat where "foo == 1"; -lemma "0 < foo" by (simp add: foo_def); -end; -\end{ttbox} - - Any Isabelle/Isar command may be retracted by @{command undo}. - See the Isabelle/Isar Quick Reference (\appref{ap:refcard}) for a - comprehensive overview of available commands and other language - elements. -*} - - -subsection {* Emacs Proof General *} - -text {* - Plain TTY-based interaction as above used to be quite feasible with - traditional tactic based theorem proving, but developing Isar - documents really demands some better user-interface support. The - Proof~General environment by David Aspinall - \cite{proofgeneral,Aspinall:TACAS:2000} offers a generic Emacs - interface for interactive theorem provers that organizes all the - cut-and-paste and forward-backward walk through the text in a very - neat way. In Isabelle/Isar, the current position within a partial - proof document is equally important than the actual proof state. - Thus Proof~General provides the canonical working environment for - Isabelle/Isar, both for getting acquainted (e.g.\ by replaying - existing Isar documents) and for production work. -*} - - -subsubsection{* Proof~General as default Isabelle interface *} - -text {* - The Isabelle interface wrapper script provides an easy way to invoke - Proof~General (including XEmacs or GNU Emacs). The default - configuration of Isabelle is smart enough to detect the - Proof~General distribution in several canonical places (e.g.\ - @{verbatim "$ISABELLE_HOME/contrib/ProofGeneral"}). Thus the - capital @{verbatim Isabelle} executable would already refer to the - @{verbatim "ProofGeneral/isar"} interface without further ado. The - Isabelle interface script provides several options; pass @{verbatim - "-?"} to see its usage. - - With the proper Isabelle interface setup, Isar documents may now be edited by - visiting appropriate theory files, e.g.\ -\begin{ttbox} -Isabelle \({\langle}isabellehome{\rangle}\)/src/HOL/Isar_examples/Summation.thy -\end{ttbox} - Beginners may note the tool bar for navigating forward and backward - through the text (this depends on the local Emacs installation). - Consult the Proof~General documentation \cite{proofgeneral} for - further basic command sequences, in particular ``@{verbatim "C-c C-return"}'' - and ``@{verbatim "C-c u"}''. - - \medskip Proof~General may be also configured manually by giving - Isabelle settings like this (see also \cite{isabelle-sys}): - -\begin{ttbox} -ISABELLE_INTERFACE=\$ISABELLE_HOME/contrib/ProofGeneral/isar/interface -PROOFGENERAL_OPTIONS="" -\end{ttbox} - You may have to change @{verbatim - "$ISABELLE_HOME/contrib/ProofGeneral"} to the actual installation - directory of Proof~General. - - \medskip Apart from the Isabelle command line, defaults for - interface options may be given by the @{verbatim PROOFGENERAL_OPTIONS} - setting. For example, the Emacs executable to be used may be - configured in Isabelle's settings like this: -\begin{ttbox} -PROOFGENERAL_OPTIONS="-p xemacs-mule" -\end{ttbox} - - Occasionally, a user's @{verbatim "~/.emacs"} file contains code - that is incompatible with the (X)Emacs version used by - Proof~General, causing the interface startup to fail prematurely. - Here the @{verbatim "-u false"} option helps to get the interface - process up and running. Note that additional Lisp customization - code may reside in @{verbatim "proofgeneral-settings.el"} of - @{verbatim "$ISABELLE_HOME/etc"} or @{verbatim - "$ISABELLE_HOME_USER/etc"}. -*} - - -subsubsection {* The X-Symbol package *} - -text {* - Proof~General incorporates a version of the Emacs X-Symbol package - \cite{x-symbol}, which handles proper mathematical symbols displayed - on screen. Pass option @{verbatim "-x true"} to the Isabelle - interface script, or check the appropriate Proof~General menu - setting by hand. The main challenge of getting X-Symbol to work - properly is the underlying (semi-automated) X11 font setup. - - \medskip Using proper mathematical symbols in Isabelle theories can - be very convenient for readability of large formulas. On the other - hand, the plain ASCII sources easily become somewhat unintelligible. - For example, @{text "\"} would appear as @{verbatim "\"} according - the default set of Isabelle symbols. Nevertheless, the Isabelle - document preparation system (see \chref{ch:document-prep}) will be - happy to print non-ASCII symbols properly. It is even possible to - invent additional notation beyond the display capabilities of Emacs - and X-Symbol. -*} - - -section {* Isabelle/Isar theories *} - -text {* - Isabelle/Isar offers the following main improvements over classic - Isabelle. - - \begin{enumerate} - - \item A \emph{theory format} that integrates specifications and - proofs, supporting interactive development and unlimited undo - operation. - - \item A \emph{formal proof document language} designed to support - intelligible semi-automated reasoning. Instead of putting together - unreadable tactic scripts, the author is enabled to express the - reasoning in way that is close to usual mathematical practice. The - old tactical style has been assimilated as ``improper'' language - elements. - - \item A simple document preparation system, for typesetting formal - developments together with informal text. The resulting - hyper-linked PDF documents are equally well suited for WWW - presentation and as printed copies. - - \end{enumerate} - - The Isar proof language is embedded into the new theory format as a - proper sub-language. Proof mode is entered by stating some - @{command theorem} or @{command lemma} at the theory level, and - left again with the final conclusion (e.g.\ via @{command qed}). - A few theory specification mechanisms also require some proof, such - as HOL's @{command typedef} which demands non-emptiness of the - representing sets. -*} - - -section {* How to write Isar proofs anyway? \label{sec:isar-howto} *} - -text {* - This is one of the key questions, of course. First of all, the - tactic script emulation of Isabelle/Isar essentially provides a - clarified version of the very same unstructured proof style of - classic Isabelle. Old-time users should quickly become acquainted - with that (slightly degenerative) view of Isar. - - Writing \emph{proper} Isar proof texts targeted at human readers is - quite different, though. Experienced users of the unstructured - style may even have to unlearn some of their habits to master proof - composition in Isar. In contrast, new users with less experience in - old-style tactical proving, but a good understanding of mathematical - proof in general, often get started easier. - - \medskip The present text really is only a reference manual on - Isabelle/Isar, not a tutorial. Nevertheless, we will attempt to - give some clues of how the concepts introduced here may be put into - practice. Especially note that \appref{ap:refcard} provides a quick - reference card of the most common Isabelle/Isar language elements. - - Further issues concerning the Isar concepts are covered in the - literature - \cite{Wenzel:1999:TPHOL,Wiedijk:2000:MV,Bauer-Wenzel:2000:HB,Bauer-Wenzel:2001}. - The author's PhD thesis \cite{Wenzel-PhD} presently provides the - most complete exposition of Isar foundations, techniques, and - applications. A number of example applications are distributed with - Isabelle, and available via the Isabelle WWW library (e.g.\ - \url{http://isabelle.in.tum.de/library/}). The ``Archive of Formal - Proofs'' \url{http://afp.sourceforge.net/} also provides plenty of - examples, both in proper Isar proof style and unstructured tactic - scripts. -*} - end diff -r 419116f1157a -r e23770bc97c8 doc-src/IsarRef/Thy/Outer_Syntax.thy --- a/doc-src/IsarRef/Thy/Outer_Syntax.thy Thu Feb 26 08:44:44 2009 -0800 +++ b/doc-src/IsarRef/Thy/Outer_Syntax.thy Thu Feb 26 08:48:33 2009 -0800 @@ -170,10 +170,10 @@ Isabelle as @{verbatim \}. There are infinitely many Isabelle symbols like this, although proper presentation is left to front-end tools such as {\LaTeX} or Proof~General with the X-Symbol package. - A list of standard Isabelle symbols that work well with these tools - is given in \appref{app:symbols}. Note that @{verbatim "\"} does - not belong to the @{text letter} category, since it is already used - differently in the Pure term language. + A list of predefined Isabelle symbols that work well with these + tools is given in \appref{app:symbols}. Note that @{verbatim "\"} + does not belong to the @{text letter} category, since it is already + used differently in the Pure term language. *} diff -r 419116f1157a -r e23770bc97c8 doc-src/IsarRef/Thy/Proof.thy --- a/doc-src/IsarRef/Thy/Proof.thy Thu Feb 26 08:44:44 2009 -0800 +++ b/doc-src/IsarRef/Thy/Proof.thy Thu Feb 26 08:48:33 2009 -0800 @@ -1,17 +1,15 @@ -(* $Id$ *) - theory Proof imports Main begin -chapter {* Proofs *} +chapter {* Proofs \label{ch:proofs} *} text {* Proof commands perform transitions of Isar/VM machine configurations, which are block-structured, consisting of a stack of nodes with three main components: logical proof context, current - facts, and open goals. Isar/VM transitions are \emph{typed} - according to the following three different modes of operation: + facts, and open goals. Isar/VM transitions are typed according to + the following three different modes of operation: \begin{description} @@ -32,13 +30,17 @@ \end{description} - The proof mode indicator may be read as a verb telling the writer - what kind of operation may be performed next. The corresponding - typings of proof commands restricts the shape of well-formed proof - texts to particular command sequences. So dynamic arrangements of - commands eventually turn out as static texts of a certain structure. - \Appref{ap:refcard} gives a simplified grammar of the overall - (extensible) language emerging that way. + The proof mode indicator may be understood as an instruction to the + writer, telling what kind of operation may be performed next. The + corresponding typings of proof commands restricts the shape of + well-formed proof texts to particular command sequences. So dynamic + arrangements of commands eventually turn out as static texts of a + certain structure. + + \Appref{ap:refcard} gives a simplified grammar of the (extensible) + language emerging that way from the different types of proof + commands. The main ideas of the overall Isar framework are + explained in \chref{ch:isar-framework}. *} @@ -963,7 +965,7 @@ \begin{matharray}{l} @{text "\using b\<^sub>1 \ b\<^sub>k\"}~~@{command "obtain"}~@{text "x\<^sub>1 \ x\<^sub>m \ a: \\<^sub>1 \ \\<^sub>n \proof\ \"} \\[1ex] \quad @{command "have"}~@{text "\thesis. (\x\<^sub>1 \ x\<^sub>m. \\<^sub>1 \ \ \\<^sub>n \ thesis) \ thesis"} \\ - \quad @{command "proof"}~@{text succeed} \\ + \quad @{command "proof"}~@{method succeed} \\ \qquad @{command "fix"}~@{text thesis} \\ \qquad @{command "assume"}~@{text "that [Pure.intro?]: \x\<^sub>1 \ x\<^sub>m. \\<^sub>1 \ \ \\<^sub>n \ thesis"} \\ \qquad @{command "then"}~@{command "show"}~@{text thesis} \\ diff -r 419116f1157a -r e23770bc97c8 doc-src/IsarRef/Thy/Quick_Reference.thy --- a/doc-src/IsarRef/Thy/Quick_Reference.thy Thu Feb 26 08:44:44 2009 -0800 +++ b/doc-src/IsarRef/Thy/Quick_Reference.thy Thu Feb 26 08:48:33 2009 -0800 @@ -30,7 +30,7 @@ \begin{tabular}{rcl} @{text "theory\stmt"} & = & @{command "theorem"}~@{text "name: props proof |"}~~@{command "definition"}~@{text "\ | \"} \\[1ex] - @{text "proof"} & = & @{text "prfx\<^sup>*"}~@{command "proof"}~@{text "method stmt\<^sup>*"}~@{command "qed"}~@{text method} \\ + @{text "proof"} & = & @{text "prfx\<^sup>*"}~@{command "proof"}~@{text "method\<^sup>? stmt\<^sup>*"}~@{command "qed"}~@{text "method\<^sup>?"} \\ & @{text "|"} & @{text "prfx\<^sup>*"}~@{command "done"} \\[1ex] @{text prfx} & = & @{command "apply"}~@{text method} \\ & @{text "|"} & @{command "using"}~@{text "facts"} \\ diff -r 419116f1157a -r e23770bc97c8 doc-src/IsarRef/Thy/ROOT.ML --- a/doc-src/IsarRef/Thy/ROOT.ML Thu Feb 26 08:44:44 2009 -0800 +++ b/doc-src/IsarRef/Thy/ROOT.ML Thu Feb 26 08:48:33 2009 -0800 @@ -1,10 +1,10 @@ - -(* $Id$ *) - +set quick_and_dirty; set ThyOutput.source; use "../../antiquote_setup.ML"; use_thy "Introduction"; +use_thy "Framework"; +use_thy "First_Order_Logic"; use_thy "Outer_Syntax"; use_thy "Document_Preparation"; use_thy "Spec"; diff -r 419116f1157a -r e23770bc97c8 doc-src/IsarRef/Thy/Spec.thy --- a/doc-src/IsarRef/Thy/Spec.thy Thu Feb 26 08:44:44 2009 -0800 +++ b/doc-src/IsarRef/Thy/Spec.thy Thu Feb 26 08:48:33 2009 -0800 @@ -4,6 +4,24 @@ chapter {* Theory specifications *} +text {* + The Isabelle/Isar theory format integrates specifications and + proofs, supporting interactive development with unlimited undo + operation. There is an integrated document preparation system (see + \chref{ch:document-prep}), for typesetting formal developments + together with informal text. The resulting hyper-linked PDF + documents can be used both for WWW presentation and printed copies. + + The Isar proof language (see \chref{ch:proofs}) is embedded into the + theory language as a proper sub-language. Proof mode is entered by + stating some @{command theorem} or @{command lemma} at the theory + level, and left again with the final conclusion (e.g.\ via @{command + qed}). Some theory specification mechanisms also require a proof, + such as @{command typedef} in HOL, which demands non-emptiness of + the representing sets. +*} + + section {* Defining theories \label{sec:begin-thy} *} text {* @@ -106,9 +124,9 @@ @{command (global) "end"} has a different meaning: it concludes the theory itself (\secref{sec:begin-thy}). - \item @{text "(\ c)"} given after any local theory command - specifies an immediate target, e.g.\ ``@{command - "definition"}~@{text "(\ c) \"}'' or ``@{command + \item @{text "("}@{keyword_def "in"}~@{text "c)"} given after any + local theory command specifies an immediate target, e.g.\ + ``@{command "definition"}~@{text "(\ c) \"}'' or ``@{command "theorem"}~@{text "(\ c) \"}''. This works both in a local or global theory context; the current target context will be suspended for this command only. Note that ``@{text "(\ -)"}'' will @@ -1164,7 +1182,7 @@ \end{description} - See @{"file" "~~/src/FOL/ex/IffOracle.thy"} for a worked example of + See @{"file" "~~/src/FOL/ex/Iff_Oracle.thy"} for a worked example of defining a new primitive rule as oracle, and turning it into a proof method. *} diff -r 419116f1157a -r e23770bc97c8 doc-src/IsarRef/Thy/Symbols.thy --- a/doc-src/IsarRef/Thy/Symbols.thy Thu Feb 26 08:44:44 2009 -0800 +++ b/doc-src/IsarRef/Thy/Symbols.thy Thu Feb 26 08:48:33 2009 -0800 @@ -4,7 +4,7 @@ imports Pure begin -chapter {* Standard Isabelle symbols \label{app:symbols} *} +chapter {* Predefined Isabelle symbols \label{app:symbols} *} text {* Isabelle supports an infinite number of non-ASCII symbols, which are diff -r 419116f1157a -r e23770bc97c8 doc-src/IsarRef/Thy/document/First_Order_Logic.tex --- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/doc-src/IsarRef/Thy/document/First_Order_Logic.tex Thu Feb 26 08:48:33 2009 -0800 @@ -0,0 +1,1417 @@ +% +\begin{isabellebody}% +\def\isabellecontext{First{\isacharunderscore}Order{\isacharunderscore}Logic}% +% +\isamarkupheader{Example: First-Order Logic% +} +\isamarkuptrue% +% +\isadelimvisible +% +\endisadelimvisible +% +\isatagvisible +\isacommand{theory}\isamarkupfalse% +\ First{\isacharunderscore}Order{\isacharunderscore}Logic\isanewline +\isakeyword{imports}\ Pure\isanewline +\isakeyword{begin}% +\endisatagvisible +{\isafoldvisible}% +% +\isadelimvisible +% +\endisadelimvisible +% +\begin{isamarkuptext}% +\noindent In order to commence a new object-logic within + Isabelle/Pure we introduce abstract syntactic categories \isa{{\isachardoublequote}i{\isachardoublequote}} + for individuals and \isa{{\isachardoublequote}o{\isachardoublequote}} for object-propositions. The latter + is embedded into the language of Pure propositions by means of a + separate judgment.% +\end{isamarkuptext}% +\isamarkuptrue% +\isacommand{typedecl}\isamarkupfalse% +\ i\isanewline +\isacommand{typedecl}\isamarkupfalse% +\ o\isanewline +\isanewline +\isacommand{judgment}\isamarkupfalse% +\isanewline +\ \ Trueprop\ {\isacharcolon}{\isacharcolon}\ {\isachardoublequoteopen}o\ {\isasymRightarrow}\ prop{\isachardoublequoteclose}\ \ \ \ {\isacharparenleft}{\isachardoublequoteopen}{\isacharunderscore}{\isachardoublequoteclose}\ {\isadigit{5}}{\isacharparenright}% +\begin{isamarkuptext}% +\noindent Note that the object-logic judgement is implicit in the + syntax: writing \isa{A} produces \isa{{\isachardoublequote}Trueprop\ A{\isachardoublequote}} internally. + From the Pure perspective this means ``\isa{A} is derivable in the + object-logic''.% +\end{isamarkuptext}% +\isamarkuptrue% +% +\isamarkupsubsection{Equational reasoning \label{sec:framework-ex-equal}% +} +\isamarkuptrue% +% +\begin{isamarkuptext}% +Equality is axiomatized as a binary predicate on individuals, with + reflexivity as introduction, and substitution as elimination + principle. Note that the latter is particularly convenient in a + framework like Isabelle, because syntactic congruences are + implicitly produced by unification of \isa{{\isachardoublequote}B\ x{\isachardoublequote}} against + expressions containing occurrences of \isa{x}.% +\end{isamarkuptext}% +\isamarkuptrue% +\isacommand{axiomatization}\isamarkupfalse% +\isanewline +\ \ equal\ {\isacharcolon}{\isacharcolon}\ {\isachardoublequoteopen}i\ {\isasymRightarrow}\ i\ {\isasymRightarrow}\ o{\isachardoublequoteclose}\ \ {\isacharparenleft}\isakeyword{infix}\ {\isachardoublequoteopen}{\isacharequal}{\isachardoublequoteclose}\ {\isadigit{5}}{\isadigit{0}}{\isacharparenright}\isanewline +\isakeyword{where}\isanewline +\ \ refl\ {\isacharbrackleft}intro{\isacharbrackright}{\isacharcolon}\ {\isachardoublequoteopen}x\ {\isacharequal}\ x{\isachardoublequoteclose}\ \isakeyword{and}\isanewline +\ \ subst\ {\isacharbrackleft}elim{\isacharbrackright}{\isacharcolon}\ {\isachardoublequoteopen}x\ {\isacharequal}\ y\ {\isasymLongrightarrow}\ B\ x\ {\isasymLongrightarrow}\ B\ y{\isachardoublequoteclose}% +\begin{isamarkuptext}% +\noindent Substitution is very powerful, but also hard to control in + full generality. We derive some common symmetry~/ transitivity + schemes of as particular consequences.% +\end{isamarkuptext}% +\isamarkuptrue% +\isacommand{theorem}\isamarkupfalse% +\ sym\ {\isacharbrackleft}sym{\isacharbrackright}{\isacharcolon}\isanewline +\ \ \isakeyword{assumes}\ {\isachardoublequoteopen}x\ {\isacharequal}\ y{\isachardoublequoteclose}\isanewline +\ \ \isakeyword{shows}\ {\isachardoublequoteopen}y\ {\isacharequal}\ x{\isachardoublequoteclose}\isanewline +% +\isadelimproof +% +\endisadelimproof +% +\isatagproof +\isacommand{proof}\isamarkupfalse% +\ {\isacharminus}\isanewline +\ \ \isacommand{have}\isamarkupfalse% +\ {\isachardoublequoteopen}x\ {\isacharequal}\ x{\isachardoublequoteclose}\ \isacommand{{\isachardot}{\isachardot}}\isamarkupfalse% +\isanewline +\ \ \isacommand{with}\isamarkupfalse% +\ {\isacharbackquoteopen}x\ {\isacharequal}\ y{\isacharbackquoteclose}\ \isacommand{show}\isamarkupfalse% +\ {\isachardoublequoteopen}y\ {\isacharequal}\ x{\isachardoublequoteclose}\ \isacommand{{\isachardot}{\isachardot}}\isamarkupfalse% +\isanewline +\isacommand{qed}\isamarkupfalse% +% +\endisatagproof +{\isafoldproof}% +% +\isadelimproof +\isanewline +% +\endisadelimproof +\isanewline +\isacommand{theorem}\isamarkupfalse% +\ forw{\isacharunderscore}subst\ {\isacharbrackleft}trans{\isacharbrackright}{\isacharcolon}\isanewline +\ \ \isakeyword{assumes}\ {\isachardoublequoteopen}y\ {\isacharequal}\ x{\isachardoublequoteclose}\ \isakeyword{and}\ {\isachardoublequoteopen}B\ x{\isachardoublequoteclose}\isanewline +\ \ \isakeyword{shows}\ {\isachardoublequoteopen}B\ y{\isachardoublequoteclose}\isanewline +% +\isadelimproof +% +\endisadelimproof +% +\isatagproof +\isacommand{proof}\isamarkupfalse% +\ {\isacharminus}\isanewline +\ \ \isacommand{from}\isamarkupfalse% +\ {\isacharbackquoteopen}y\ {\isacharequal}\ x{\isacharbackquoteclose}\ \isacommand{have}\isamarkupfalse% +\ {\isachardoublequoteopen}x\ {\isacharequal}\ y{\isachardoublequoteclose}\ \isacommand{{\isachardot}{\isachardot}}\isamarkupfalse% +\isanewline +\ \ \isacommand{from}\isamarkupfalse% +\ this\ \isakeyword{and}\ {\isacharbackquoteopen}B\ x{\isacharbackquoteclose}\ \isacommand{show}\isamarkupfalse% +\ {\isachardoublequoteopen}B\ y{\isachardoublequoteclose}\ \isacommand{{\isachardot}{\isachardot}}\isamarkupfalse% +\isanewline +\isacommand{qed}\isamarkupfalse% +% +\endisatagproof +{\isafoldproof}% +% +\isadelimproof +\isanewline +% +\endisadelimproof +\isanewline +\isacommand{theorem}\isamarkupfalse% +\ back{\isacharunderscore}subst\ {\isacharbrackleft}trans{\isacharbrackright}{\isacharcolon}\isanewline +\ \ \isakeyword{assumes}\ {\isachardoublequoteopen}B\ x{\isachardoublequoteclose}\ \isakeyword{and}\ {\isachardoublequoteopen}x\ {\isacharequal}\ y{\isachardoublequoteclose}\isanewline +\ \ \isakeyword{shows}\ {\isachardoublequoteopen}B\ y{\isachardoublequoteclose}\isanewline +% +\isadelimproof +% +\endisadelimproof +% +\isatagproof +\isacommand{proof}\isamarkupfalse% +\ {\isacharminus}\isanewline +\ \ \isacommand{from}\isamarkupfalse% +\ {\isacharbackquoteopen}x\ {\isacharequal}\ y{\isacharbackquoteclose}\ \isakeyword{and}\ {\isacharbackquoteopen}B\ x{\isacharbackquoteclose}\isanewline +\ \ \isacommand{show}\isamarkupfalse% +\ {\isachardoublequoteopen}B\ y{\isachardoublequoteclose}\ \isacommand{{\isachardot}{\isachardot}}\isamarkupfalse% +\isanewline +\isacommand{qed}\isamarkupfalse% +% +\endisatagproof +{\isafoldproof}% +% +\isadelimproof +\isanewline +% +\endisadelimproof +\isanewline +\isacommand{theorem}\isamarkupfalse% +\ trans\ {\isacharbrackleft}trans{\isacharbrackright}{\isacharcolon}\isanewline +\ \ \isakeyword{assumes}\ {\isachardoublequoteopen}x\ {\isacharequal}\ y{\isachardoublequoteclose}\ \isakeyword{and}\ {\isachardoublequoteopen}y\ {\isacharequal}\ z{\isachardoublequoteclose}\isanewline +\ \ \isakeyword{shows}\ {\isachardoublequoteopen}x\ {\isacharequal}\ z{\isachardoublequoteclose}\isanewline +% +\isadelimproof +% +\endisadelimproof +% +\isatagproof +\isacommand{proof}\isamarkupfalse% +\ {\isacharminus}\isanewline +\ \ \isacommand{from}\isamarkupfalse% +\ {\isacharbackquoteopen}y\ {\isacharequal}\ z{\isacharbackquoteclose}\ \isakeyword{and}\ {\isacharbackquoteopen}x\ {\isacharequal}\ y{\isacharbackquoteclose}\isanewline +\ \ \isacommand{show}\isamarkupfalse% +\ {\isachardoublequoteopen}x\ {\isacharequal}\ z{\isachardoublequoteclose}\ \isacommand{{\isachardot}{\isachardot}}\isamarkupfalse% +\isanewline +\isacommand{qed}\isamarkupfalse% +% +\endisatagproof +{\isafoldproof}% +% +\isadelimproof +% +\endisadelimproof +% +\isamarkupsubsection{Basic group theory% +} +\isamarkuptrue% +% +\begin{isamarkuptext}% +As an example for equational reasoning we consider some bits of + group theory. The subsequent locale definition postulates group + operations and axioms; we also derive some consequences of this + specification.% +\end{isamarkuptext}% +\isamarkuptrue% +\isacommand{locale}\isamarkupfalse% +\ group\ {\isacharequal}\isanewline +\ \ \isakeyword{fixes}\ prod\ {\isacharcolon}{\isacharcolon}\ {\isachardoublequoteopen}i\ {\isasymRightarrow}\ i\ {\isasymRightarrow}\ i{\isachardoublequoteclose}\ \ {\isacharparenleft}\isakeyword{infix}\ {\isachardoublequoteopen}{\isasymcirc}{\isachardoublequoteclose}\ {\isadigit{7}}{\isadigit{0}}{\isacharparenright}\isanewline +\ \ \ \ \isakeyword{and}\ inv\ {\isacharcolon}{\isacharcolon}\ {\isachardoublequoteopen}i\ {\isasymRightarrow}\ i{\isachardoublequoteclose}\ \ {\isacharparenleft}{\isachardoublequoteopen}{\isacharparenleft}{\isacharunderscore}{\isasyminverse}{\isacharparenright}{\isachardoublequoteclose}\ {\isacharbrackleft}{\isadigit{1}}{\isadigit{0}}{\isadigit{0}}{\isadigit{0}}{\isacharbrackright}\ {\isadigit{9}}{\isadigit{9}}{\isadigit{9}}{\isacharparenright}\isanewline +\ \ \ \ \isakeyword{and}\ unit\ {\isacharcolon}{\isacharcolon}\ i\ \ {\isacharparenleft}{\isachardoublequoteopen}{\isadigit{1}}{\isachardoublequoteclose}{\isacharparenright}\isanewline +\ \ \isakeyword{assumes}\ assoc{\isacharcolon}\ {\isachardoublequoteopen}{\isacharparenleft}x\ {\isasymcirc}\ y{\isacharparenright}\ {\isasymcirc}\ z\ {\isacharequal}\ x\ {\isasymcirc}\ {\isacharparenleft}y\ {\isasymcirc}\ z{\isacharparenright}{\isachardoublequoteclose}\isanewline +\ \ \ \ \isakeyword{and}\ left{\isacharunderscore}unit{\isacharcolon}\ \ {\isachardoublequoteopen}{\isadigit{1}}\ {\isasymcirc}\ x\ {\isacharequal}\ x{\isachardoublequoteclose}\isanewline +\ \ \ \ \isakeyword{and}\ left{\isacharunderscore}inv{\isacharcolon}\ {\isachardoublequoteopen}x{\isasyminverse}\ {\isasymcirc}\ x\ {\isacharequal}\ {\isadigit{1}}{\isachardoublequoteclose}\isanewline +\isakeyword{begin}\isanewline +\isanewline +\isacommand{theorem}\isamarkupfalse% +\ right{\isacharunderscore}inv{\isacharcolon}\ {\isachardoublequoteopen}x\ {\isasymcirc}\ x{\isasyminverse}\ {\isacharequal}\ {\isadigit{1}}{\isachardoublequoteclose}\isanewline +% +\isadelimproof +% +\endisadelimproof +% +\isatagproof +\isacommand{proof}\isamarkupfalse% +\ {\isacharminus}\isanewline +\ \ \isacommand{have}\isamarkupfalse% +\ {\isachardoublequoteopen}x\ {\isasymcirc}\ x{\isasyminverse}\ {\isacharequal}\ {\isadigit{1}}\ {\isasymcirc}\ {\isacharparenleft}x\ {\isasymcirc}\ x{\isasyminverse}{\isacharparenright}{\isachardoublequoteclose}\ \isacommand{by}\isamarkupfalse% +\ {\isacharparenleft}rule\ left{\isacharunderscore}unit\ {\isacharbrackleft}symmetric{\isacharbrackright}{\isacharparenright}\isanewline +\ \ \isacommand{also}\isamarkupfalse% +\ \isacommand{have}\isamarkupfalse% +\ {\isachardoublequoteopen}{\isasymdots}\ {\isacharequal}\ {\isacharparenleft}{\isadigit{1}}\ {\isasymcirc}\ x{\isacharparenright}\ {\isasymcirc}\ x{\isasyminverse}{\isachardoublequoteclose}\ \isacommand{by}\isamarkupfalse% +\ {\isacharparenleft}rule\ assoc\ {\isacharbrackleft}symmetric{\isacharbrackright}{\isacharparenright}\isanewline +\ \ \isacommand{also}\isamarkupfalse% +\ \isacommand{have}\isamarkupfalse% +\ {\isachardoublequoteopen}{\isadigit{1}}\ {\isacharequal}\ {\isacharparenleft}x{\isasyminverse}{\isacharparenright}{\isasyminverse}\ {\isasymcirc}\ x{\isasyminverse}{\isachardoublequoteclose}\ \isacommand{by}\isamarkupfalse% +\ {\isacharparenleft}rule\ left{\isacharunderscore}inv\ {\isacharbrackleft}symmetric{\isacharbrackright}{\isacharparenright}\isanewline +\ \ \isacommand{also}\isamarkupfalse% +\ \isacommand{have}\isamarkupfalse% +\ {\isachardoublequoteopen}{\isasymdots}\ {\isasymcirc}\ x\ {\isacharequal}\ {\isacharparenleft}x{\isasyminverse}{\isacharparenright}{\isasyminverse}\ {\isasymcirc}\ {\isacharparenleft}x{\isasyminverse}\ {\isasymcirc}\ x{\isacharparenright}{\isachardoublequoteclose}\ \isacommand{by}\isamarkupfalse% +\ {\isacharparenleft}rule\ assoc{\isacharparenright}\isanewline +\ \ \isacommand{also}\isamarkupfalse% +\ \isacommand{have}\isamarkupfalse% +\ {\isachardoublequoteopen}x{\isasyminverse}\ {\isasymcirc}\ x\ {\isacharequal}\ {\isadigit{1}}{\isachardoublequoteclose}\ \isacommand{by}\isamarkupfalse% +\ {\isacharparenleft}rule\ left{\isacharunderscore}inv{\isacharparenright}\isanewline +\ \ \isacommand{also}\isamarkupfalse% +\ \isacommand{have}\isamarkupfalse% +\ {\isachardoublequoteopen}{\isacharparenleft}{\isacharparenleft}x{\isasyminverse}{\isacharparenright}{\isasyminverse}\ {\isasymcirc}\ {\isasymdots}{\isacharparenright}\ {\isasymcirc}\ x{\isasyminverse}\ {\isacharequal}\ {\isacharparenleft}x{\isasyminverse}{\isacharparenright}{\isasyminverse}\ {\isasymcirc}\ {\isacharparenleft}{\isadigit{1}}\ {\isasymcirc}\ x{\isasyminverse}{\isacharparenright}{\isachardoublequoteclose}\ \isacommand{by}\isamarkupfalse% +\ {\isacharparenleft}rule\ assoc{\isacharparenright}\isanewline +\ \ \isacommand{also}\isamarkupfalse% +\ \isacommand{have}\isamarkupfalse% +\ {\isachardoublequoteopen}{\isadigit{1}}\ {\isasymcirc}\ x{\isasyminverse}\ {\isacharequal}\ x{\isasyminverse}{\isachardoublequoteclose}\ \isacommand{by}\isamarkupfalse% +\ {\isacharparenleft}rule\ left{\isacharunderscore}unit{\isacharparenright}\isanewline +\ \ \isacommand{also}\isamarkupfalse% +\ \isacommand{have}\isamarkupfalse% +\ {\isachardoublequoteopen}{\isacharparenleft}x{\isasyminverse}{\isacharparenright}{\isasyminverse}\ {\isasymcirc}\ {\isasymdots}\ {\isacharequal}\ {\isadigit{1}}{\isachardoublequoteclose}\ \isacommand{by}\isamarkupfalse% +\ {\isacharparenleft}rule\ left{\isacharunderscore}inv{\isacharparenright}\isanewline +\ \ \isacommand{finally}\isamarkupfalse% +\ \isacommand{show}\isamarkupfalse% +\ {\isachardoublequoteopen}x\ {\isasymcirc}\ x{\isasyminverse}\ {\isacharequal}\ {\isadigit{1}}{\isachardoublequoteclose}\ \isacommand{{\isachardot}}\isamarkupfalse% +\isanewline +\isacommand{qed}\isamarkupfalse% +% +\endisatagproof +{\isafoldproof}% +% +\isadelimproof +\isanewline +% +\endisadelimproof +\isanewline +\isacommand{theorem}\isamarkupfalse% +\ right{\isacharunderscore}unit{\isacharcolon}\ {\isachardoublequoteopen}x\ {\isasymcirc}\ {\isadigit{1}}\ {\isacharequal}\ x{\isachardoublequoteclose}\isanewline +% +\isadelimproof +% +\endisadelimproof +% +\isatagproof +\isacommand{proof}\isamarkupfalse% +\ {\isacharminus}\isanewline +\ \ \isacommand{have}\isamarkupfalse% +\ {\isachardoublequoteopen}{\isadigit{1}}\ {\isacharequal}\ x{\isasyminverse}\ {\isasymcirc}\ x{\isachardoublequoteclose}\ \isacommand{by}\isamarkupfalse% +\ {\isacharparenleft}rule\ left{\isacharunderscore}inv\ {\isacharbrackleft}symmetric{\isacharbrackright}{\isacharparenright}\isanewline +\ \ \isacommand{also}\isamarkupfalse% +\ \isacommand{have}\isamarkupfalse% +\ {\isachardoublequoteopen}x\ {\isasymcirc}\ {\isasymdots}\ {\isacharequal}\ {\isacharparenleft}x\ {\isasymcirc}\ x{\isasyminverse}{\isacharparenright}\ {\isasymcirc}\ x{\isachardoublequoteclose}\ \isacommand{by}\isamarkupfalse% +\ {\isacharparenleft}rule\ assoc\ {\isacharbrackleft}symmetric{\isacharbrackright}{\isacharparenright}\isanewline +\ \ \isacommand{also}\isamarkupfalse% +\ \isacommand{have}\isamarkupfalse% +\ {\isachardoublequoteopen}x\ {\isasymcirc}\ x{\isasyminverse}\ {\isacharequal}\ {\isadigit{1}}{\isachardoublequoteclose}\ \isacommand{by}\isamarkupfalse% +\ {\isacharparenleft}rule\ right{\isacharunderscore}inv{\isacharparenright}\isanewline +\ \ \isacommand{also}\isamarkupfalse% +\ \isacommand{have}\isamarkupfalse% +\ {\isachardoublequoteopen}{\isasymdots}\ {\isasymcirc}\ x\ {\isacharequal}\ x{\isachardoublequoteclose}\ \isacommand{by}\isamarkupfalse% +\ {\isacharparenleft}rule\ left{\isacharunderscore}unit{\isacharparenright}\isanewline +\ \ \isacommand{finally}\isamarkupfalse% +\ \isacommand{show}\isamarkupfalse% +\ {\isachardoublequoteopen}x\ {\isasymcirc}\ {\isadigit{1}}\ {\isacharequal}\ x{\isachardoublequoteclose}\ \isacommand{{\isachardot}}\isamarkupfalse% +\isanewline +\isacommand{qed}\isamarkupfalse% +% +\endisatagproof +{\isafoldproof}% +% +\isadelimproof +% +\endisadelimproof +% +\begin{isamarkuptext}% +\noindent Reasoning from basic axioms is often tedious. Our proofs + work by producing various instances of the given rules (potentially + the symmetric form) using the pattern ``\hyperlink{command.have}{\mbox{\isa{\isacommand{have}}}}~\isa{eq}~\hyperlink{command.by}{\mbox{\isa{\isacommand{by}}}}~\isa{{\isachardoublequote}{\isacharparenleft}rule\ r{\isacharparenright}{\isachardoublequote}}'' and composing the chain of + results via \hyperlink{command.also}{\mbox{\isa{\isacommand{also}}}}/\hyperlink{command.finally}{\mbox{\isa{\isacommand{finally}}}}. These steps may + involve any of the transitivity rules declared in + \secref{sec:framework-ex-equal}, namely \isa{trans} in combining + the first two results in \isa{right{\isacharunderscore}inv} and in the final steps of + both proofs, \isa{forw{\isacharunderscore}subst} in the first combination of \isa{right{\isacharunderscore}unit}, and \isa{back{\isacharunderscore}subst} in all other calculational steps. + + Occasional substitutions in calculations are adequate, but should + not be over-emphasized. The other extreme is to compose a chain by + plain transitivity only, with replacements occurring always in + topmost position. For example:% +\end{isamarkuptext}% +\isamarkuptrue% +% +\isadelimproof +% +\endisadelimproof +% +\isatagproof +\ \ \isacommand{have}\isamarkupfalse% +\ {\isachardoublequoteopen}x\ {\isasymcirc}\ {\isadigit{1}}\ {\isacharequal}\ x\ {\isasymcirc}\ {\isacharparenleft}x{\isasyminverse}\ {\isasymcirc}\ x{\isacharparenright}{\isachardoublequoteclose}\ \isacommand{unfolding}\isamarkupfalse% +\ left{\isacharunderscore}inv\ \isacommand{{\isachardot}{\isachardot}}\isamarkupfalse% +\isanewline +\ \ \isacommand{also}\isamarkupfalse% +\ \isacommand{have}\isamarkupfalse% +\ {\isachardoublequoteopen}{\isasymdots}\ {\isacharequal}\ {\isacharparenleft}x\ {\isasymcirc}\ x{\isasyminverse}{\isacharparenright}\ {\isasymcirc}\ x{\isachardoublequoteclose}\ \isacommand{unfolding}\isamarkupfalse% +\ assoc\ \isacommand{{\isachardot}{\isachardot}}\isamarkupfalse% +\isanewline +\ \ \isacommand{also}\isamarkupfalse% +\ \isacommand{have}\isamarkupfalse% +\ {\isachardoublequoteopen}{\isasymdots}\ {\isacharequal}\ {\isadigit{1}}\ {\isasymcirc}\ x{\isachardoublequoteclose}\ \isacommand{unfolding}\isamarkupfalse% +\ right{\isacharunderscore}inv\ \isacommand{{\isachardot}{\isachardot}}\isamarkupfalse% +\isanewline +\ \ \isacommand{also}\isamarkupfalse% +\ \isacommand{have}\isamarkupfalse% +\ {\isachardoublequoteopen}{\isasymdots}\ {\isacharequal}\ x{\isachardoublequoteclose}\ \isacommand{unfolding}\isamarkupfalse% +\ left{\isacharunderscore}unit\ \isacommand{{\isachardot}{\isachardot}}\isamarkupfalse% +\isanewline +\ \ \isacommand{finally}\isamarkupfalse% +\ \isacommand{have}\isamarkupfalse% +\ {\isachardoublequoteopen}x\ {\isasymcirc}\ {\isadigit{1}}\ {\isacharequal}\ x{\isachardoublequoteclose}\ \isacommand{{\isachardot}}\isamarkupfalse% +% +\endisatagproof +{\isafoldproof}% +% +\isadelimproof +% +\endisadelimproof +% +\begin{isamarkuptext}% +\noindent Here we have re-used the built-in mechanism for unfolding + definitions in order to normalize each equational problem. A more + realistic object-logic would include proper setup for the Simplifier + (\secref{sec:simplifier}), the main automated tool for equational + reasoning in Isabelle. Then ``\hyperlink{command.unfolding}{\mbox{\isa{\isacommand{unfolding}}}}~\isa{left{\isacharunderscore}inv}~\hyperlink{command.ddot}{\mbox{\isa{\isacommand{{\isachardot}{\isachardot}}}}}'' would become ``\hyperlink{command.by}{\mbox{\isa{\isacommand{by}}}}~\isa{{\isachardoublequote}{\isacharparenleft}simp\ only{\isacharcolon}\ left{\isacharunderscore}inv{\isacharparenright}{\isachardoublequote}}'' etc.% +\end{isamarkuptext}% +\isamarkuptrue% +\isacommand{end}\isamarkupfalse% +% +\isamarkupsubsection{Propositional logic \label{sec:framework-ex-prop}% +} +\isamarkuptrue% +% +\begin{isamarkuptext}% +We axiomatize basic connectives of propositional logic: implication, + disjunction, and conjunction. The associated rules are modeled + after Gentzen's system of Natural Deduction \cite{Gentzen:1935}.% +\end{isamarkuptext}% +\isamarkuptrue% +\isacommand{axiomatization}\isamarkupfalse% +\isanewline +\ \ imp\ {\isacharcolon}{\isacharcolon}\ {\isachardoublequoteopen}o\ {\isasymRightarrow}\ o\ {\isasymRightarrow}\ o{\isachardoublequoteclose}\ \ {\isacharparenleft}\isakeyword{infixr}\ {\isachardoublequoteopen}{\isasymlongrightarrow}{\isachardoublequoteclose}\ {\isadigit{2}}{\isadigit{5}}{\isacharparenright}\ \isakeyword{where}\isanewline +\ \ impI\ {\isacharbrackleft}intro{\isacharbrackright}{\isacharcolon}\ {\isachardoublequoteopen}{\isacharparenleft}A\ {\isasymLongrightarrow}\ B{\isacharparenright}\ {\isasymLongrightarrow}\ A\ {\isasymlongrightarrow}\ B{\isachardoublequoteclose}\ \isakeyword{and}\isanewline +\ \ impD\ {\isacharbrackleft}dest{\isacharbrackright}{\isacharcolon}\ {\isachardoublequoteopen}{\isacharparenleft}A\ {\isasymlongrightarrow}\ B{\isacharparenright}\ {\isasymLongrightarrow}\ A\ {\isasymLongrightarrow}\ B{\isachardoublequoteclose}\isanewline +\isanewline +\isacommand{axiomatization}\isamarkupfalse% +\isanewline +\ \ disj\ {\isacharcolon}{\isacharcolon}\ {\isachardoublequoteopen}o\ {\isasymRightarrow}\ o\ {\isasymRightarrow}\ o{\isachardoublequoteclose}\ \ {\isacharparenleft}\isakeyword{infixr}\ {\isachardoublequoteopen}{\isasymor}{\isachardoublequoteclose}\ {\isadigit{3}}{\isadigit{0}}{\isacharparenright}\ \isakeyword{where}\isanewline +\ \ disjI\isactrlisub {\isadigit{1}}\ {\isacharbrackleft}intro{\isacharbrackright}{\isacharcolon}\ {\isachardoublequoteopen}A\ {\isasymLongrightarrow}\ A\ {\isasymor}\ B{\isachardoublequoteclose}\ \isakeyword{and}\isanewline +\ \ disjI\isactrlisub {\isadigit{2}}\ {\isacharbrackleft}intro{\isacharbrackright}{\isacharcolon}\ {\isachardoublequoteopen}B\ {\isasymLongrightarrow}\ A\ {\isasymor}\ B{\isachardoublequoteclose}\ \isakeyword{and}\isanewline +\ \ disjE\ {\isacharbrackleft}elim{\isacharbrackright}{\isacharcolon}\ {\isachardoublequoteopen}A\ {\isasymor}\ B\ {\isasymLongrightarrow}\ {\isacharparenleft}A\ {\isasymLongrightarrow}\ C{\isacharparenright}\ {\isasymLongrightarrow}\ {\isacharparenleft}B\ {\isasymLongrightarrow}\ C{\isacharparenright}\ {\isasymLongrightarrow}\ C{\isachardoublequoteclose}\isanewline +\isanewline +\isacommand{axiomatization}\isamarkupfalse% +\isanewline +\ \ conj\ {\isacharcolon}{\isacharcolon}\ {\isachardoublequoteopen}o\ {\isasymRightarrow}\ o\ {\isasymRightarrow}\ o{\isachardoublequoteclose}\ \ {\isacharparenleft}\isakeyword{infixr}\ {\isachardoublequoteopen}{\isasymand}{\isachardoublequoteclose}\ {\isadigit{3}}{\isadigit{5}}{\isacharparenright}\ \isakeyword{where}\isanewline +\ \ conjI\ {\isacharbrackleft}intro{\isacharbrackright}{\isacharcolon}\ {\isachardoublequoteopen}A\ {\isasymLongrightarrow}\ B\ {\isasymLongrightarrow}\ A\ {\isasymand}\ B{\isachardoublequoteclose}\ \isakeyword{and}\isanewline +\ \ conjD\isactrlisub {\isadigit{1}}{\isacharcolon}\ {\isachardoublequoteopen}A\ {\isasymand}\ B\ {\isasymLongrightarrow}\ A{\isachardoublequoteclose}\ \isakeyword{and}\isanewline +\ \ conjD\isactrlisub {\isadigit{2}}{\isacharcolon}\ {\isachardoublequoteopen}A\ {\isasymand}\ B\ {\isasymLongrightarrow}\ B{\isachardoublequoteclose}% +\begin{isamarkuptext}% +\noindent The conjunctive destructions have the disadvantage that + decomposing \isa{{\isachardoublequote}A\ {\isasymand}\ B{\isachardoublequote}} involves an immediate decision which + component should be projected. The more convenient simultaneous + elimination \isa{{\isachardoublequote}A\ {\isasymand}\ B\ {\isasymLongrightarrow}\ {\isacharparenleft}A\ {\isasymLongrightarrow}\ B\ {\isasymLongrightarrow}\ C{\isacharparenright}\ {\isasymLongrightarrow}\ C{\isachardoublequote}} can be derived as + follows:% +\end{isamarkuptext}% +\isamarkuptrue% +\isacommand{theorem}\isamarkupfalse% +\ conjE\ {\isacharbrackleft}elim{\isacharbrackright}{\isacharcolon}\isanewline +\ \ \isakeyword{assumes}\ {\isachardoublequoteopen}A\ {\isasymand}\ B{\isachardoublequoteclose}\isanewline +\ \ \isakeyword{obtains}\ A\ \isakeyword{and}\ B\isanewline +% +\isadelimproof +% +\endisadelimproof +% +\isatagproof +\isacommand{proof}\isamarkupfalse% +\isanewline +\ \ \isacommand{from}\isamarkupfalse% +\ {\isacharbackquoteopen}A\ {\isasymand}\ B{\isacharbackquoteclose}\ \isacommand{show}\isamarkupfalse% +\ A\ \isacommand{by}\isamarkupfalse% +\ {\isacharparenleft}rule\ conjD\isactrlisub {\isadigit{1}}{\isacharparenright}\isanewline +\ \ \isacommand{from}\isamarkupfalse% +\ {\isacharbackquoteopen}A\ {\isasymand}\ B{\isacharbackquoteclose}\ \isacommand{show}\isamarkupfalse% +\ B\ \isacommand{by}\isamarkupfalse% +\ {\isacharparenleft}rule\ conjD\isactrlisub {\isadigit{2}}{\isacharparenright}\isanewline +\isacommand{qed}\isamarkupfalse% +% +\endisatagproof +{\isafoldproof}% +% +\isadelimproof +% +\endisadelimproof +% +\begin{isamarkuptext}% +\noindent Here is an example of swapping conjuncts with a single + intermediate elimination step:% +\end{isamarkuptext}% +\isamarkuptrue% +% +\isadelimproof +% +\endisadelimproof +% +\isatagproof +\ \ \isacommand{assume}\isamarkupfalse% +\ {\isachardoublequoteopen}A\ {\isasymand}\ B{\isachardoublequoteclose}\isanewline +\ \ \isacommand{then}\isamarkupfalse% +\ \isacommand{obtain}\isamarkupfalse% +\ B\ \isakeyword{and}\ A\ \isacommand{{\isachardot}{\isachardot}}\isamarkupfalse% +\isanewline +\ \ \isacommand{then}\isamarkupfalse% +\ \isacommand{have}\isamarkupfalse% +\ {\isachardoublequoteopen}B\ {\isasymand}\ A{\isachardoublequoteclose}\ \isacommand{{\isachardot}{\isachardot}}\isamarkupfalse% +% +\endisatagproof +{\isafoldproof}% +% +\isadelimproof +% +\endisadelimproof +% +\begin{isamarkuptext}% +\noindent Note that the analogous elimination rule for disjunction + ``\isa{{\isachardoublequote}{\isasymASSUMES}\ A\ {\isasymor}\ B\ {\isasymOBTAINS}\ A\ {\isasymBBAR}\ B{\isachardoublequote}}'' coincides with + the original axiomatization of \isa{disjE}. + + \medskip We continue propositional logic by introducing absurdity + with its characteristic elimination. Plain truth may then be + defined as a proposition that is trivially true.% +\end{isamarkuptext}% +\isamarkuptrue% +\isacommand{axiomatization}\isamarkupfalse% +\isanewline +\ \ false\ {\isacharcolon}{\isacharcolon}\ o\ \ {\isacharparenleft}{\isachardoublequoteopen}{\isasymbottom}{\isachardoublequoteclose}{\isacharparenright}\ \isakeyword{where}\isanewline +\ \ falseE\ {\isacharbrackleft}elim{\isacharbrackright}{\isacharcolon}\ {\isachardoublequoteopen}{\isasymbottom}\ {\isasymLongrightarrow}\ A{\isachardoublequoteclose}\isanewline +\isanewline +\isacommand{definition}\isamarkupfalse% +\isanewline +\ \ true\ {\isacharcolon}{\isacharcolon}\ o\ \ {\isacharparenleft}{\isachardoublequoteopen}{\isasymtop}{\isachardoublequoteclose}{\isacharparenright}\ \isakeyword{where}\isanewline +\ \ {\isachardoublequoteopen}{\isasymtop}\ {\isasymequiv}\ {\isasymbottom}\ {\isasymlongrightarrow}\ {\isasymbottom}{\isachardoublequoteclose}\isanewline +\isanewline +\isacommand{theorem}\isamarkupfalse% +\ trueI\ {\isacharbrackleft}intro{\isacharbrackright}{\isacharcolon}\ {\isasymtop}\isanewline +% +\isadelimproof +\ \ % +\endisadelimproof +% +\isatagproof +\isacommand{unfolding}\isamarkupfalse% +\ true{\isacharunderscore}def\ \isacommand{{\isachardot}{\isachardot}}\isamarkupfalse% +% +\endisatagproof +{\isafoldproof}% +% +\isadelimproof +% +\endisadelimproof +% +\begin{isamarkuptext}% +\medskip\noindent Now negation represents an implication towards + absurdity:% +\end{isamarkuptext}% +\isamarkuptrue% +\isacommand{definition}\isamarkupfalse% +\isanewline +\ \ not\ {\isacharcolon}{\isacharcolon}\ {\isachardoublequoteopen}o\ {\isasymRightarrow}\ o{\isachardoublequoteclose}\ \ {\isacharparenleft}{\isachardoublequoteopen}{\isasymnot}\ {\isacharunderscore}{\isachardoublequoteclose}\ {\isacharbrackleft}{\isadigit{4}}{\isadigit{0}}{\isacharbrackright}\ {\isadigit{4}}{\isadigit{0}}{\isacharparenright}\ \isakeyword{where}\isanewline +\ \ {\isachardoublequoteopen}{\isasymnot}\ A\ {\isasymequiv}\ A\ {\isasymlongrightarrow}\ {\isasymbottom}{\isachardoublequoteclose}\isanewline +\isanewline +\isacommand{theorem}\isamarkupfalse% +\ notI\ {\isacharbrackleft}intro{\isacharbrackright}{\isacharcolon}\isanewline +\ \ \isakeyword{assumes}\ {\isachardoublequoteopen}A\ {\isasymLongrightarrow}\ {\isasymbottom}{\isachardoublequoteclose}\isanewline +\ \ \isakeyword{shows}\ {\isachardoublequoteopen}{\isasymnot}\ A{\isachardoublequoteclose}\isanewline +% +\isadelimproof +% +\endisadelimproof +% +\isatagproof +\isacommand{unfolding}\isamarkupfalse% +\ not{\isacharunderscore}def\isanewline +\isacommand{proof}\isamarkupfalse% +\isanewline +\ \ \isacommand{assume}\isamarkupfalse% +\ A\isanewline +\ \ \isacommand{then}\isamarkupfalse% +\ \isacommand{show}\isamarkupfalse% +\ {\isasymbottom}\ \isacommand{by}\isamarkupfalse% +\ {\isacharparenleft}rule\ {\isacharbackquoteopen}A\ {\isasymLongrightarrow}\ {\isasymbottom}{\isacharbackquoteclose}{\isacharparenright}\isanewline +\isacommand{qed}\isamarkupfalse% +% +\endisatagproof +{\isafoldproof}% +% +\isadelimproof +\isanewline +% +\endisadelimproof +\isanewline +\isacommand{theorem}\isamarkupfalse% +\ notE\ {\isacharbrackleft}elim{\isacharbrackright}{\isacharcolon}\isanewline +\ \ \isakeyword{assumes}\ {\isachardoublequoteopen}{\isasymnot}\ A{\isachardoublequoteclose}\ \isakeyword{and}\ A\isanewline +\ \ \isakeyword{shows}\ B\isanewline +% +\isadelimproof +% +\endisadelimproof +% +\isatagproof +\isacommand{proof}\isamarkupfalse% +\ {\isacharminus}\isanewline +\ \ \isacommand{from}\isamarkupfalse% +\ {\isacharbackquoteopen}{\isasymnot}\ A{\isacharbackquoteclose}\ \isacommand{have}\isamarkupfalse% +\ {\isachardoublequoteopen}A\ {\isasymlongrightarrow}\ {\isasymbottom}{\isachardoublequoteclose}\ \isacommand{unfolding}\isamarkupfalse% +\ not{\isacharunderscore}def\ \isacommand{{\isachardot}}\isamarkupfalse% +\isanewline +\ \ \isacommand{from}\isamarkupfalse% +\ {\isacharbackquoteopen}A\ {\isasymlongrightarrow}\ {\isasymbottom}{\isacharbackquoteclose}\ \isakeyword{and}\ {\isacharbackquoteopen}A{\isacharbackquoteclose}\ \isacommand{have}\isamarkupfalse% +\ {\isasymbottom}\ \isacommand{{\isachardot}{\isachardot}}\isamarkupfalse% +\isanewline +\ \ \isacommand{then}\isamarkupfalse% +\ \isacommand{show}\isamarkupfalse% +\ B\ \isacommand{{\isachardot}{\isachardot}}\isamarkupfalse% +\isanewline +\isacommand{qed}\isamarkupfalse% +% +\endisatagproof +{\isafoldproof}% +% +\isadelimproof +% +\endisadelimproof +% +\isamarkupsubsection{Classical logic% +} +\isamarkuptrue% +% +\begin{isamarkuptext}% +Subsequently we state the principle of classical contradiction as a + local assumption. Thus we refrain from forcing the object-logic + into the classical perspective. Within that context, we may derive + well-known consequences of the classical principle.% +\end{isamarkuptext}% +\isamarkuptrue% +\isacommand{locale}\isamarkupfalse% +\ classical\ {\isacharequal}\isanewline +\ \ \isakeyword{assumes}\ classical{\isacharcolon}\ {\isachardoublequoteopen}{\isacharparenleft}{\isasymnot}\ C\ {\isasymLongrightarrow}\ C{\isacharparenright}\ {\isasymLongrightarrow}\ C{\isachardoublequoteclose}\isanewline +\isakeyword{begin}\isanewline +\isanewline +\isacommand{theorem}\isamarkupfalse% +\ double{\isacharunderscore}negation{\isacharcolon}\isanewline +\ \ \isakeyword{assumes}\ {\isachardoublequoteopen}{\isasymnot}\ {\isasymnot}\ C{\isachardoublequoteclose}\isanewline +\ \ \isakeyword{shows}\ C\isanewline +% +\isadelimproof +% +\endisadelimproof +% +\isatagproof +\isacommand{proof}\isamarkupfalse% +\ {\isacharparenleft}rule\ classical{\isacharparenright}\isanewline +\ \ \isacommand{assume}\isamarkupfalse% +\ {\isachardoublequoteopen}{\isasymnot}\ C{\isachardoublequoteclose}\isanewline +\ \ \isacommand{with}\isamarkupfalse% +\ {\isacharbackquoteopen}{\isasymnot}\ {\isasymnot}\ C{\isacharbackquoteclose}\ \isacommand{show}\isamarkupfalse% +\ C\ \isacommand{{\isachardot}{\isachardot}}\isamarkupfalse% +\isanewline +\isacommand{qed}\isamarkupfalse% +% +\endisatagproof +{\isafoldproof}% +% +\isadelimproof +\isanewline +% +\endisadelimproof +\isanewline +\isacommand{theorem}\isamarkupfalse% +\ tertium{\isacharunderscore}non{\isacharunderscore}datur{\isacharcolon}\ {\isachardoublequoteopen}C\ {\isasymor}\ {\isasymnot}\ C{\isachardoublequoteclose}\isanewline +% +\isadelimproof +% +\endisadelimproof +% +\isatagproof +\isacommand{proof}\isamarkupfalse% +\ {\isacharparenleft}rule\ double{\isacharunderscore}negation{\isacharparenright}\isanewline +\ \ \isacommand{show}\isamarkupfalse% +\ {\isachardoublequoteopen}{\isasymnot}\ {\isasymnot}\ {\isacharparenleft}C\ {\isasymor}\ {\isasymnot}\ C{\isacharparenright}{\isachardoublequoteclose}\isanewline +\ \ \isacommand{proof}\isamarkupfalse% +\isanewline +\ \ \ \ \isacommand{assume}\isamarkupfalse% +\ {\isachardoublequoteopen}{\isasymnot}\ {\isacharparenleft}C\ {\isasymor}\ {\isasymnot}\ C{\isacharparenright}{\isachardoublequoteclose}\isanewline +\ \ \ \ \isacommand{have}\isamarkupfalse% +\ {\isachardoublequoteopen}{\isasymnot}\ C{\isachardoublequoteclose}\isanewline +\ \ \ \ \isacommand{proof}\isamarkupfalse% +\isanewline +\ \ \ \ \ \ \isacommand{assume}\isamarkupfalse% +\ C\ \isacommand{then}\isamarkupfalse% +\ \isacommand{have}\isamarkupfalse% +\ {\isachardoublequoteopen}C\ {\isasymor}\ {\isasymnot}\ C{\isachardoublequoteclose}\ \isacommand{{\isachardot}{\isachardot}}\isamarkupfalse% +\isanewline +\ \ \ \ \ \ \isacommand{with}\isamarkupfalse% +\ {\isacharbackquoteopen}{\isasymnot}\ {\isacharparenleft}C\ {\isasymor}\ {\isasymnot}\ C{\isacharparenright}{\isacharbackquoteclose}\ \isacommand{show}\isamarkupfalse% +\ {\isasymbottom}\ \isacommand{{\isachardot}{\isachardot}}\isamarkupfalse% +\isanewline +\ \ \ \ \isacommand{qed}\isamarkupfalse% +\isanewline +\ \ \ \ \isacommand{then}\isamarkupfalse% +\ \isacommand{have}\isamarkupfalse% +\ {\isachardoublequoteopen}C\ {\isasymor}\ {\isasymnot}\ C{\isachardoublequoteclose}\ \isacommand{{\isachardot}{\isachardot}}\isamarkupfalse% +\isanewline +\ \ \ \ \isacommand{with}\isamarkupfalse% +\ {\isacharbackquoteopen}{\isasymnot}\ {\isacharparenleft}C\ {\isasymor}\ {\isasymnot}\ C{\isacharparenright}{\isacharbackquoteclose}\ \isacommand{show}\isamarkupfalse% +\ {\isasymbottom}\ \isacommand{{\isachardot}{\isachardot}}\isamarkupfalse% +\isanewline +\ \ \isacommand{qed}\isamarkupfalse% +\isanewline +\isacommand{qed}\isamarkupfalse% +% +\endisatagproof +{\isafoldproof}% +% +\isadelimproof +% +\endisadelimproof +% +\begin{isamarkuptext}% +\noindent These examples illustrate both classical reasoning and + non-trivial propositional proofs in general. All three rules + characterize classical logic independently, but the original rule is + already the most convenient to use, because it leaves the conclusion + unchanged. Note that \isa{{\isachardoublequote}{\isacharparenleft}{\isasymnot}\ C\ {\isasymLongrightarrow}\ C{\isacharparenright}\ {\isasymLongrightarrow}\ C{\isachardoublequote}} fits again into our + format for eliminations, despite the additional twist that the + context refers to the main conclusion. So we may write \isa{classical} as the Isar statement ``\isa{{\isachardoublequote}{\isasymOBTAINS}\ {\isasymnot}\ thesis{\isachardoublequote}}''. + This also explains nicely how classical reasoning really works: + whatever the main \isa{thesis} might be, we may always assume its + negation!% +\end{isamarkuptext}% +\isamarkuptrue% +\isacommand{end}\isamarkupfalse% +% +\isamarkupsubsection{Quantifiers \label{sec:framework-ex-quant}% +} +\isamarkuptrue% +% +\begin{isamarkuptext}% +Representing quantifiers is easy, thanks to the higher-order nature + of the underlying framework. According to the well-known technique + introduced by Church \cite{church40}, quantifiers are operators on + predicates, which are syntactically represented as \isa{{\isachardoublequote}{\isasymlambda}{\isachardoublequote}}-terms + of type \isa{{\isachardoublequote}i\ {\isasymRightarrow}\ o{\isachardoublequote}}. Binder notation turns \isa{{\isachardoublequote}All\ {\isacharparenleft}{\isasymlambda}x{\isachardot}\ B\ x{\isacharparenright}{\isachardoublequote}} into \isa{{\isachardoublequote}{\isasymforall}x{\isachardot}\ B\ x{\isachardoublequote}} etc.% +\end{isamarkuptext}% +\isamarkuptrue% +\isacommand{axiomatization}\isamarkupfalse% +\isanewline +\ \ All\ {\isacharcolon}{\isacharcolon}\ {\isachardoublequoteopen}{\isacharparenleft}i\ {\isasymRightarrow}\ o{\isacharparenright}\ {\isasymRightarrow}\ o{\isachardoublequoteclose}\ \ {\isacharparenleft}\isakeyword{binder}\ {\isachardoublequoteopen}{\isasymforall}{\isachardoublequoteclose}\ {\isadigit{1}}{\isadigit{0}}{\isacharparenright}\ \isakeyword{where}\isanewline +\ \ allI\ {\isacharbrackleft}intro{\isacharbrackright}{\isacharcolon}\ {\isachardoublequoteopen}{\isacharparenleft}{\isasymAnd}x{\isachardot}\ B\ x{\isacharparenright}\ {\isasymLongrightarrow}\ {\isasymforall}x{\isachardot}\ B\ x{\isachardoublequoteclose}\ \isakeyword{and}\isanewline +\ \ allD\ {\isacharbrackleft}dest{\isacharbrackright}{\isacharcolon}\ {\isachardoublequoteopen}{\isacharparenleft}{\isasymforall}x{\isachardot}\ B\ x{\isacharparenright}\ {\isasymLongrightarrow}\ B\ a{\isachardoublequoteclose}\isanewline +\isanewline +\isacommand{axiomatization}\isamarkupfalse% +\isanewline +\ \ Ex\ {\isacharcolon}{\isacharcolon}\ {\isachardoublequoteopen}{\isacharparenleft}i\ {\isasymRightarrow}\ o{\isacharparenright}\ {\isasymRightarrow}\ o{\isachardoublequoteclose}\ \ {\isacharparenleft}\isakeyword{binder}\ {\isachardoublequoteopen}{\isasymexists}{\isachardoublequoteclose}\ {\isadigit{1}}{\isadigit{0}}{\isacharparenright}\ \isakeyword{where}\isanewline +\ \ exI\ {\isacharbrackleft}intro{\isacharbrackright}{\isacharcolon}\ {\isachardoublequoteopen}B\ a\ {\isasymLongrightarrow}\ {\isacharparenleft}{\isasymexists}x{\isachardot}\ B\ x{\isacharparenright}{\isachardoublequoteclose}\ \isakeyword{and}\isanewline +\ \ exE\ {\isacharbrackleft}elim{\isacharbrackright}{\isacharcolon}\ {\isachardoublequoteopen}{\isacharparenleft}{\isasymexists}x{\isachardot}\ B\ x{\isacharparenright}\ {\isasymLongrightarrow}\ {\isacharparenleft}{\isasymAnd}x{\isachardot}\ B\ x\ {\isasymLongrightarrow}\ C{\isacharparenright}\ {\isasymLongrightarrow}\ C{\isachardoublequoteclose}% +\begin{isamarkuptext}% +\noindent The statement of \isa{exE} corresponds to ``\isa{{\isachardoublequote}{\isasymASSUMES}\ {\isasymexists}x{\isachardot}\ B\ x\ {\isasymOBTAINS}\ x\ {\isasymWHERE}\ B\ x{\isachardoublequote}}'' in Isar. In the + subsequent example we illustrate quantifier reasoning involving all + four rules:% +\end{isamarkuptext}% +\isamarkuptrue% +\isacommand{theorem}\isamarkupfalse% +\isanewline +\ \ \isakeyword{assumes}\ {\isachardoublequoteopen}{\isasymexists}x{\isachardot}\ {\isasymforall}y{\isachardot}\ R\ x\ y{\isachardoublequoteclose}\isanewline +\ \ \isakeyword{shows}\ {\isachardoublequoteopen}{\isasymforall}y{\isachardot}\ {\isasymexists}x{\isachardot}\ R\ x\ y{\isachardoublequoteclose}\isanewline +% +\isadelimproof +% +\endisadelimproof +% +\isatagproof +\isacommand{proof}\isamarkupfalse% +\ \ \ \ % +\isamarkupcmt{\isa{{\isachardoublequote}{\isasymforall}{\isachardoublequote}} introduction% +} +\isanewline +\ \ \isacommand{obtain}\isamarkupfalse% +\ x\ \isakeyword{where}\ {\isachardoublequoteopen}{\isasymforall}y{\isachardot}\ R\ x\ y{\isachardoublequoteclose}\ \isacommand{using}\isamarkupfalse% +\ {\isacharbackquoteopen}{\isasymexists}x{\isachardot}\ {\isasymforall}y{\isachardot}\ R\ x\ y{\isacharbackquoteclose}\ \isacommand{{\isachardot}{\isachardot}}\isamarkupfalse% +\ \ \ \ % +\isamarkupcmt{\isa{{\isachardoublequote}{\isasymexists}{\isachardoublequote}} elimination% +} +\isanewline +\ \ \isacommand{fix}\isamarkupfalse% +\ y\ \isacommand{have}\isamarkupfalse% +\ {\isachardoublequoteopen}R\ x\ y{\isachardoublequoteclose}\ \isacommand{using}\isamarkupfalse% +\ {\isacharbackquoteopen}{\isasymforall}y{\isachardot}\ R\ x\ y{\isacharbackquoteclose}\ \isacommand{{\isachardot}{\isachardot}}\isamarkupfalse% +\ \ \ \ % +\isamarkupcmt{\isa{{\isachardoublequote}{\isasymforall}{\isachardoublequote}} destruction% +} +\isanewline +\ \ \isacommand{then}\isamarkupfalse% +\ \isacommand{show}\isamarkupfalse% +\ {\isachardoublequoteopen}{\isasymexists}x{\isachardot}\ R\ x\ y{\isachardoublequoteclose}\ \isacommand{{\isachardot}{\isachardot}}\isamarkupfalse% +\ \ \ \ % +\isamarkupcmt{\isa{{\isachardoublequote}{\isasymexists}{\isachardoublequote}} introduction% +} +\isanewline +\isacommand{qed}\isamarkupfalse% +% +\endisatagproof +{\isafoldproof}% +% +\isadelimproof +% +\endisadelimproof +% +\isamarkupsubsection{Canonical reasoning patterns% +} +\isamarkuptrue% +% +\begin{isamarkuptext}% +The main rules of first-order predicate logic from + \secref{sec:framework-ex-prop} and \secref{sec:framework-ex-quant} + can now be summarized as follows, using the native Isar statement + format of \secref{sec:framework-stmt}. + + \medskip + \begin{tabular}{l} + \isa{{\isachardoublequote}impI{\isacharcolon}\ {\isasymASSUMES}\ A\ {\isasymLongrightarrow}\ B\ {\isasymSHOWS}\ A\ {\isasymlongrightarrow}\ B{\isachardoublequote}} \\ + \isa{{\isachardoublequote}impD{\isacharcolon}\ {\isasymASSUMES}\ A\ {\isasymlongrightarrow}\ B\ {\isasymAND}\ A\ {\isasymSHOWS}\ B{\isachardoublequote}} \\[1ex] + + \isa{{\isachardoublequote}disjI\isactrlisub {\isadigit{1}}{\isacharcolon}\ {\isasymASSUMES}\ A\ {\isasymSHOWS}\ A\ {\isasymor}\ B{\isachardoublequote}} \\ + \isa{{\isachardoublequote}disjI\isactrlisub {\isadigit{2}}{\isacharcolon}\ {\isasymASSUMES}\ B\ {\isasymSHOWS}\ A\ {\isasymor}\ B{\isachardoublequote}} \\ + \isa{{\isachardoublequote}disjE{\isacharcolon}\ {\isasymASSUMES}\ A\ {\isasymor}\ B\ {\isasymOBTAINS}\ A\ {\isasymBBAR}\ B{\isachardoublequote}} \\[1ex] + + \isa{{\isachardoublequote}conjI{\isacharcolon}\ {\isasymASSUMES}\ A\ {\isasymAND}\ B\ {\isasymSHOWS}\ A\ {\isasymand}\ B{\isachardoublequote}} \\ + \isa{{\isachardoublequote}conjE{\isacharcolon}\ {\isasymASSUMES}\ A\ {\isasymand}\ B\ {\isasymOBTAINS}\ A\ {\isasymAND}\ B{\isachardoublequote}} \\[1ex] + + \isa{{\isachardoublequote}falseE{\isacharcolon}\ {\isasymASSUMES}\ {\isasymbottom}\ {\isasymSHOWS}\ A{\isachardoublequote}} \\ + \isa{{\isachardoublequote}trueI{\isacharcolon}\ {\isasymSHOWS}\ {\isasymtop}{\isachardoublequote}} \\[1ex] + + \isa{{\isachardoublequote}notI{\isacharcolon}\ {\isasymASSUMES}\ A\ {\isasymLongrightarrow}\ {\isasymbottom}\ {\isasymSHOWS}\ {\isasymnot}\ A{\isachardoublequote}} \\ + \isa{{\isachardoublequote}notE{\isacharcolon}\ {\isasymASSUMES}\ {\isasymnot}\ A\ {\isasymAND}\ A\ {\isasymSHOWS}\ B{\isachardoublequote}} \\[1ex] + + \isa{{\isachardoublequote}allI{\isacharcolon}\ {\isasymASSUMES}\ {\isasymAnd}x{\isachardot}\ B\ x\ {\isasymSHOWS}\ {\isasymforall}x{\isachardot}\ B\ x{\isachardoublequote}} \\ + \isa{{\isachardoublequote}allE{\isacharcolon}\ {\isasymASSUMES}\ {\isasymforall}x{\isachardot}\ B\ x\ {\isasymSHOWS}\ B\ a{\isachardoublequote}} \\[1ex] + + \isa{{\isachardoublequote}exI{\isacharcolon}\ {\isasymASSUMES}\ B\ a\ {\isasymSHOWS}\ {\isasymexists}x{\isachardot}\ B\ x{\isachardoublequote}} \\ + \isa{{\isachardoublequote}exE{\isacharcolon}\ {\isasymASSUMES}\ {\isasymexists}x{\isachardot}\ B\ x\ {\isasymOBTAINS}\ a\ {\isasymWHERE}\ B\ a{\isachardoublequote}} + \end{tabular} + \medskip + + \noindent This essentially provides a declarative reading of Pure + rules as Isar reasoning patterns: the rule statements tells how a + canonical proof outline shall look like. Since the above rules have + already been declared as \hyperlink{attribute.Pure.intro}{\mbox{\isa{intro}}}, \hyperlink{attribute.Pure.elim}{\mbox{\isa{elim}}}, \hyperlink{attribute.Pure.dest}{\mbox{\isa{dest}}} --- each according to its + particular shape --- we can immediately write Isar proof texts as + follows:% +\end{isamarkuptext}% +\isamarkuptrue% +% +\isadelimproof +% +\endisadelimproof +% +\isatagproof +% +\begin{minipage}[t]{0.4\textwidth} +\isanewline +\ \ \isacommand{have}\isamarkupfalse% +\ {\isachardoublequoteopen}A\ {\isasymlongrightarrow}\ B{\isachardoublequoteclose}\isanewline +\ \ \isacommand{proof}\isamarkupfalse% +\isanewline +\ \ \ \ \isacommand{assume}\isamarkupfalse% +\ A\isanewline +\ \ \ \ \isacommand{show}\isamarkupfalse% +\ B% +\endisatagproof +{\isafoldproof}% +% +\isadelimproof +% +\endisadelimproof +% +\isadelimnoproof +\ % +\endisadelimnoproof +% +\isatagnoproof +\isacommand{sorry}\isamarkupfalse% +% +\endisatagnoproof +{\isafoldnoproof}% +% +\isadelimnoproof +\isanewline +% +\endisadelimnoproof +% +\isadelimproof +\ \ % +\endisadelimproof +% +\isatagproof +\isacommand{qed}\isamarkupfalse% +% +\end{minipage}\qquad\begin{minipage}[t]{0.4\textwidth} +\isanewline +\ \ \isacommand{have}\isamarkupfalse% +\ {\isachardoublequoteopen}A\ {\isasymlongrightarrow}\ B{\isachardoublequoteclose}\ \isakeyword{and}\ A% +\endisatagproof +{\isafoldproof}% +% +\isadelimproof +% +\endisadelimproof +% +\isadelimnoproof +\ % +\endisadelimnoproof +% +\isatagnoproof +\isacommand{sorry}\isamarkupfalse% +% +\endisatagnoproof +{\isafoldnoproof}% +% +\isadelimnoproof +\isanewline +% +\endisadelimnoproof +% +\isadelimproof +\ \ % +\endisadelimproof +% +\isatagproof +\isacommand{then}\isamarkupfalse% +\ \isacommand{have}\isamarkupfalse% +\ B\ \isacommand{{\isachardot}{\isachardot}}\isamarkupfalse% +% +\end{minipage}\\[3ex]\begin{minipage}[t]{0.4\textwidth} +\isanewline +\ \ \isacommand{have}\isamarkupfalse% +\ A% +\endisatagproof +{\isafoldproof}% +% +\isadelimproof +% +\endisadelimproof +% +\isadelimnoproof +\ % +\endisadelimnoproof +% +\isatagnoproof +\isacommand{sorry}\isamarkupfalse% +% +\endisatagnoproof +{\isafoldnoproof}% +% +\isadelimnoproof +\isanewline +% +\endisadelimnoproof +% +\isadelimproof +\ \ % +\endisadelimproof +% +\isatagproof +\isacommand{then}\isamarkupfalse% +\ \isacommand{have}\isamarkupfalse% +\ {\isachardoublequoteopen}A\ {\isasymor}\ B{\isachardoublequoteclose}\ \isacommand{{\isachardot}{\isachardot}}\isamarkupfalse% +\isanewline +\isanewline +\ \ \isacommand{have}\isamarkupfalse% +\ B% +\endisatagproof +{\isafoldproof}% +% +\isadelimproof +% +\endisadelimproof +% +\isadelimnoproof +\ % +\endisadelimnoproof +% +\isatagnoproof +\isacommand{sorry}\isamarkupfalse% +% +\endisatagnoproof +{\isafoldnoproof}% +% +\isadelimnoproof +\isanewline +% +\endisadelimnoproof +% +\isadelimproof +\ \ % +\endisadelimproof +% +\isatagproof +\isacommand{then}\isamarkupfalse% +\ \isacommand{have}\isamarkupfalse% +\ {\isachardoublequoteopen}A\ {\isasymor}\ B{\isachardoublequoteclose}\ \isacommand{{\isachardot}{\isachardot}}\isamarkupfalse% +% +\end{minipage}\qquad\begin{minipage}[t]{0.4\textwidth} +\isanewline +\ \ \isacommand{have}\isamarkupfalse% +\ {\isachardoublequoteopen}A\ {\isasymor}\ B{\isachardoublequoteclose}% +\endisatagproof +{\isafoldproof}% +% +\isadelimproof +% +\endisadelimproof +% +\isadelimnoproof +\ % +\endisadelimnoproof +% +\isatagnoproof +\isacommand{sorry}\isamarkupfalse% +% +\endisatagnoproof +{\isafoldnoproof}% +% +\isadelimnoproof +\isanewline +% +\endisadelimnoproof +% +\isadelimproof +\ \ % +\endisadelimproof +% +\isatagproof +\isacommand{then}\isamarkupfalse% +\ \isacommand{have}\isamarkupfalse% +\ C\isanewline +\ \ \isacommand{proof}\isamarkupfalse% +\isanewline +\ \ \ \ \isacommand{assume}\isamarkupfalse% +\ A\isanewline +\ \ \ \ \isacommand{then}\isamarkupfalse% +\ \isacommand{show}\isamarkupfalse% +\ C% +\endisatagproof +{\isafoldproof}% +% +\isadelimproof +% +\endisadelimproof +% +\isadelimnoproof +\ % +\endisadelimnoproof +% +\isatagnoproof +\isacommand{sorry}\isamarkupfalse% +% +\endisatagnoproof +{\isafoldnoproof}% +% +\isadelimnoproof +\isanewline +% +\endisadelimnoproof +% +\isadelimproof +\ \ % +\endisadelimproof +% +\isatagproof +\isacommand{next}\isamarkupfalse% +\isanewline +\ \ \ \ \isacommand{assume}\isamarkupfalse% +\ B\isanewline +\ \ \ \ \isacommand{then}\isamarkupfalse% +\ \isacommand{show}\isamarkupfalse% +\ C% +\endisatagproof +{\isafoldproof}% +% +\isadelimproof +% +\endisadelimproof +% +\isadelimnoproof +\ % +\endisadelimnoproof +% +\isatagnoproof +\isacommand{sorry}\isamarkupfalse% +% +\endisatagnoproof +{\isafoldnoproof}% +% +\isadelimnoproof +\isanewline +% +\endisadelimnoproof +% +\isadelimproof +\ \ % +\endisadelimproof +% +\isatagproof +\isacommand{qed}\isamarkupfalse% +% +\end{minipage}\\[3ex]\begin{minipage}[t]{0.4\textwidth} +\isanewline +\ \ \isacommand{have}\isamarkupfalse% +\ A\ \isakeyword{and}\ B% +\endisatagproof +{\isafoldproof}% +% +\isadelimproof +% +\endisadelimproof +% +\isadelimnoproof +\ % +\endisadelimnoproof +% +\isatagnoproof +\isacommand{sorry}\isamarkupfalse% +% +\endisatagnoproof +{\isafoldnoproof}% +% +\isadelimnoproof +\isanewline +% +\endisadelimnoproof +% +\isadelimproof +\ \ % +\endisadelimproof +% +\isatagproof +\isacommand{then}\isamarkupfalse% +\ \isacommand{have}\isamarkupfalse% +\ {\isachardoublequoteopen}A\ {\isasymand}\ B{\isachardoublequoteclose}\ \isacommand{{\isachardot}{\isachardot}}\isamarkupfalse% +% +\end{minipage}\qquad\begin{minipage}[t]{0.4\textwidth} +\isanewline +\ \ \isacommand{have}\isamarkupfalse% +\ {\isachardoublequoteopen}A\ {\isasymand}\ B{\isachardoublequoteclose}% +\endisatagproof +{\isafoldproof}% +% +\isadelimproof +% +\endisadelimproof +% +\isadelimnoproof +\ % +\endisadelimnoproof +% +\isatagnoproof +\isacommand{sorry}\isamarkupfalse% +% +\endisatagnoproof +{\isafoldnoproof}% +% +\isadelimnoproof +\isanewline +% +\endisadelimnoproof +% +\isadelimproof +\ \ % +\endisadelimproof +% +\isatagproof +\isacommand{then}\isamarkupfalse% +\ \isacommand{obtain}\isamarkupfalse% +\ A\ \isakeyword{and}\ B\ \isacommand{{\isachardot}{\isachardot}}\isamarkupfalse% +% +\end{minipage}\\[3ex]\begin{minipage}[t]{0.4\textwidth} +\isanewline +\ \ \isacommand{have}\isamarkupfalse% +\ {\isachardoublequoteopen}{\isasymbottom}{\isachardoublequoteclose}% +\endisatagproof +{\isafoldproof}% +% +\isadelimproof +% +\endisadelimproof +% +\isadelimnoproof +\ % +\endisadelimnoproof +% +\isatagnoproof +\isacommand{sorry}\isamarkupfalse% +% +\endisatagnoproof +{\isafoldnoproof}% +% +\isadelimnoproof +\isanewline +% +\endisadelimnoproof +% +\isadelimproof +\ \ % +\endisadelimproof +% +\isatagproof +\isacommand{then}\isamarkupfalse% +\ \isacommand{have}\isamarkupfalse% +\ A\ \isacommand{{\isachardot}{\isachardot}}\isamarkupfalse% +% +\end{minipage}\qquad\begin{minipage}[t]{0.4\textwidth} +\isanewline +\ \ \isacommand{have}\isamarkupfalse% +\ {\isachardoublequoteopen}{\isasymtop}{\isachardoublequoteclose}\ \isacommand{{\isachardot}{\isachardot}}\isamarkupfalse% +% +\end{minipage}\\[3ex]\begin{minipage}[t]{0.4\textwidth} +\isanewline +\ \ \isacommand{have}\isamarkupfalse% +\ {\isachardoublequoteopen}{\isasymnot}\ A{\isachardoublequoteclose}\isanewline +\ \ \isacommand{proof}\isamarkupfalse% +\isanewline +\ \ \ \ \isacommand{assume}\isamarkupfalse% +\ A\isanewline +\ \ \ \ \isacommand{then}\isamarkupfalse% +\ \isacommand{show}\isamarkupfalse% +\ {\isachardoublequoteopen}{\isasymbottom}{\isachardoublequoteclose}% +\endisatagproof +{\isafoldproof}% +% +\isadelimproof +% +\endisadelimproof +% +\isadelimnoproof +\ % +\endisadelimnoproof +% +\isatagnoproof +\isacommand{sorry}\isamarkupfalse% +% +\endisatagnoproof +{\isafoldnoproof}% +% +\isadelimnoproof +\isanewline +% +\endisadelimnoproof +% +\isadelimproof +\ \ % +\endisadelimproof +% +\isatagproof +\isacommand{qed}\isamarkupfalse% +% +\end{minipage}\qquad\begin{minipage}[t]{0.4\textwidth} +\isanewline +\ \ \isacommand{have}\isamarkupfalse% +\ {\isachardoublequoteopen}{\isasymnot}\ A{\isachardoublequoteclose}\ \isakeyword{and}\ A% +\endisatagproof +{\isafoldproof}% +% +\isadelimproof +% +\endisadelimproof +% +\isadelimnoproof +\ % +\endisadelimnoproof +% +\isatagnoproof +\isacommand{sorry}\isamarkupfalse% +% +\endisatagnoproof +{\isafoldnoproof}% +% +\isadelimnoproof +\isanewline +% +\endisadelimnoproof +% +\isadelimproof +\ \ % +\endisadelimproof +% +\isatagproof +\isacommand{then}\isamarkupfalse% +\ \isacommand{have}\isamarkupfalse% +\ B\ \isacommand{{\isachardot}{\isachardot}}\isamarkupfalse% +% +\end{minipage}\\[3ex]\begin{minipage}[t]{0.4\textwidth} +\isanewline +\ \ \isacommand{have}\isamarkupfalse% +\ {\isachardoublequoteopen}{\isasymforall}x{\isachardot}\ B\ x{\isachardoublequoteclose}\isanewline +\ \ \isacommand{proof}\isamarkupfalse% +\isanewline +\ \ \ \ \isacommand{fix}\isamarkupfalse% +\ x\isanewline +\ \ \ \ \isacommand{show}\isamarkupfalse% +\ {\isachardoublequoteopen}B\ x{\isachardoublequoteclose}% +\endisatagproof +{\isafoldproof}% +% +\isadelimproof +% +\endisadelimproof +% +\isadelimnoproof +\ % +\endisadelimnoproof +% +\isatagnoproof +\isacommand{sorry}\isamarkupfalse% +% +\endisatagnoproof +{\isafoldnoproof}% +% +\isadelimnoproof +\isanewline +% +\endisadelimnoproof +% +\isadelimproof +\ \ % +\endisadelimproof +% +\isatagproof +\isacommand{qed}\isamarkupfalse% +% +\end{minipage}\qquad\begin{minipage}[t]{0.4\textwidth} +\isanewline +\ \ \isacommand{have}\isamarkupfalse% +\ {\isachardoublequoteopen}{\isasymforall}x{\isachardot}\ B\ x{\isachardoublequoteclose}% +\endisatagproof +{\isafoldproof}% +% +\isadelimproof +% +\endisadelimproof +% +\isadelimnoproof +\ % +\endisadelimnoproof +% +\isatagnoproof +\isacommand{sorry}\isamarkupfalse% +% +\endisatagnoproof +{\isafoldnoproof}% +% +\isadelimnoproof +\isanewline +% +\endisadelimnoproof +% +\isadelimproof +\ \ % +\endisadelimproof +% +\isatagproof +\isacommand{then}\isamarkupfalse% +\ \isacommand{have}\isamarkupfalse% +\ {\isachardoublequoteopen}B\ a{\isachardoublequoteclose}\ \isacommand{{\isachardot}{\isachardot}}\isamarkupfalse% +% +\end{minipage}\\[3ex]\begin{minipage}[t]{0.4\textwidth} +\isanewline +\ \ \isacommand{have}\isamarkupfalse% +\ {\isachardoublequoteopen}{\isasymexists}x{\isachardot}\ B\ x{\isachardoublequoteclose}\isanewline +\ \ \isacommand{proof}\isamarkupfalse% +\isanewline +\ \ \ \ \isacommand{show}\isamarkupfalse% +\ {\isachardoublequoteopen}B\ a{\isachardoublequoteclose}% +\endisatagproof +{\isafoldproof}% +% +\isadelimproof +% +\endisadelimproof +% +\isadelimnoproof +\ % +\endisadelimnoproof +% +\isatagnoproof +\isacommand{sorry}\isamarkupfalse% +% +\endisatagnoproof +{\isafoldnoproof}% +% +\isadelimnoproof +\isanewline +% +\endisadelimnoproof +% +\isadelimproof +\ \ % +\endisadelimproof +% +\isatagproof +\isacommand{qed}\isamarkupfalse% +% +\end{minipage}\qquad\begin{minipage}[t]{0.4\textwidth} +\isanewline +\ \ \isacommand{have}\isamarkupfalse% +\ {\isachardoublequoteopen}{\isasymexists}x{\isachardot}\ B\ x{\isachardoublequoteclose}% +\endisatagproof +{\isafoldproof}% +% +\isadelimproof +% +\endisadelimproof +% +\isadelimnoproof +\ % +\endisadelimnoproof +% +\isatagnoproof +\isacommand{sorry}\isamarkupfalse% +% +\endisatagnoproof +{\isafoldnoproof}% +% +\isadelimnoproof +\isanewline +% +\endisadelimnoproof +% +\isadelimproof +\ \ % +\endisadelimproof +% +\isatagproof +\isacommand{then}\isamarkupfalse% +\ \isacommand{obtain}\isamarkupfalse% +\ a\ \isakeyword{where}\ {\isachardoublequoteopen}B\ a{\isachardoublequoteclose}\ \isacommand{{\isachardot}{\isachardot}}\isamarkupfalse% +% +\end{minipage} +% +\endisatagproof +{\isafoldproof}% +% +\isadelimproof +% +\endisadelimproof +% +\begin{isamarkuptext}% +\bigskip\noindent Of course, these proofs are merely examples. As + sketched in \secref{sec:framework-subproof}, there is a fair amount + of flexibility in expressing Pure deductions in Isar. Here the user + is asked to express himself adequately, aiming at proof texts of + literary quality.% +\end{isamarkuptext}% +\isamarkuptrue% +% +\isadelimvisible +% +\endisadelimvisible +% +\isatagvisible +\isacommand{end}\isamarkupfalse% +% +\endisatagvisible +{\isafoldvisible}% +% +\isadelimvisible +% +\endisadelimvisible +\isanewline +\end{isabellebody}% +%%% Local Variables: +%%% mode: latex +%%% TeX-master: "root" +%%% End: diff -r 419116f1157a -r e23770bc97c8 doc-src/IsarRef/Thy/document/Framework.tex --- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/doc-src/IsarRef/Thy/document/Framework.tex Thu Feb 26 08:48:33 2009 -0800 @@ -0,0 +1,1518 @@ +% +\begin{isabellebody}% +\def\isabellecontext{Framework}% +% +\isadelimtheory +% +\endisadelimtheory +% +\isatagtheory +\isacommand{theory}\isamarkupfalse% +\ Framework\isanewline +\isakeyword{imports}\ Main\isanewline +\isakeyword{begin}% +\endisatagtheory +{\isafoldtheory}% +% +\isadelimtheory +% +\endisadelimtheory +% +\isamarkupchapter{The Isabelle/Isar Framework \label{ch:isar-framework}% +} +\isamarkuptrue% +% +\begin{isamarkuptext}% +Isabelle/Isar + \cite{Wenzel:1999:TPHOL,Wenzel-PhD,Nipkow-TYPES02,Wenzel-Paulson:2006,Wenzel:2006:Festschrift} + is intended as a generic framework for developing formal + mathematical documents with full proof checking. Definitions and + proofs are organized as theories. An assembly of theory sources may + be presented as a printed document; see also + \chref{ch:document-prep}. + + The main objective of Isar is the design of a human-readable + structured proof language, which is called the ``primary proof + format'' in Isar terminology. Such a primary proof language is + somewhere in the middle between the extremes of primitive proof + objects and actual natural language. In this respect, Isar is a bit + more formalistic than Mizar + \cite{Trybulec:1993:MizarFeatures,Rudnicki:1992:MizarOverview,Wiedijk:1999:Mizar}, + using logical symbols for certain reasoning schemes where Mizar + would prefer English words; see \cite{Wenzel-Wiedijk:2002} for + further comparisons of these systems. + + So Isar challenges the traditional way of recording informal proofs + in mathematical prose, as well as the common tendency to see fully + formal proofs directly as objects of some logical calculus (e.g.\ + \isa{{\isachardoublequote}{\isasymlambda}{\isachardoublequote}}-terms in a version of type theory). In fact, Isar is + better understood as an interpreter of a simple block-structured + language for describing the data flow of local facts and goals, + interspersed with occasional invocations of proof methods. + Everything is reduced to logical inferences internally, but these + steps are somewhat marginal compared to the overall bookkeeping of + the interpretation process. Thanks to careful design of the syntax + and semantics of Isar language elements, a formal record of Isar + instructions may later appear as an intelligible text to the + attentive reader. + + The Isar proof language has emerged from careful analysis of some + inherent virtues of the existing logical framework of Isabelle/Pure + \cite{paulson-found,paulson700}, notably composition of higher-order + natural deduction rules, which is a generalization of Gentzen's + original calculus \cite{Gentzen:1935}. The approach of generic + inference systems in Pure is continued by Isar towards actual proof + texts. + + Concrete applications require another intermediate layer: an + object-logic. Isabelle/HOL \cite{isa-tutorial} (simply-typed + set-theory) is being used most of the time; Isabelle/ZF + \cite{isabelle-ZF} is less extensively developed, although it would + probably fit better for classical mathematics. + + \medskip In order to illustrate natural deduction in Isar, we shall + refer to the background theory and library of Isabelle/HOL. This + includes common notions of predicate logic, naive set-theory etc.\ + using fairly standard mathematical notation. From the perspective + of generic natural deduction there is nothing special about the + logical connectives of HOL (\isa{{\isachardoublequote}{\isasymand}{\isachardoublequote}}, \isa{{\isachardoublequote}{\isasymor}{\isachardoublequote}}, \isa{{\isachardoublequote}{\isasymforall}{\isachardoublequote}}, + \isa{{\isachardoublequote}{\isasymexists}{\isachardoublequote}}, etc.), only the resulting reasoning principles are + relevant to the user. There are similar rules available for + set-theory operators (\isa{{\isachardoublequote}{\isasyminter}{\isachardoublequote}}, \isa{{\isachardoublequote}{\isasymunion}{\isachardoublequote}}, \isa{{\isachardoublequote}{\isasymInter}{\isachardoublequote}}, \isa{{\isachardoublequote}{\isasymUnion}{\isachardoublequote}}, etc.), or any other theory developed in the library (lattice + theory, topology etc.). + + Subsequently we briefly review fragments of Isar proof texts + corresponding directly to such general deduction schemes. The + examples shall refer to set-theory, to minimize the danger of + understanding connectives of predicate logic as something special. + + \medskip The following deduction performs \isa{{\isachardoublequote}{\isasyminter}{\isachardoublequote}}-introduction, + working forwards from assumptions towards the conclusion. We give + both the Isar text, and depict the primitive rule involved, as + determined by unification of the problem against rules that are + declared in the library context.% +\end{isamarkuptext}% +\isamarkuptrue% +% +\medskip\begin{minipage}{0.6\textwidth} +% +\isadelimproof +% +\endisadelimproof +% +\isatagproof +\ \ \ \ \isacommand{assume}\isamarkupfalse% +\ {\isachardoublequoteopen}x\ {\isasymin}\ A{\isachardoublequoteclose}\ \isakeyword{and}\ {\isachardoublequoteopen}x\ {\isasymin}\ B{\isachardoublequoteclose}\isanewline +\ \ \ \ \isacommand{then}\isamarkupfalse% +\ \isacommand{have}\isamarkupfalse% +\ {\isachardoublequoteopen}x\ {\isasymin}\ A\ {\isasyminter}\ B{\isachardoublequoteclose}\ \isacommand{{\isachardot}{\isachardot}}\isamarkupfalse% +% +\endisatagproof +{\isafoldproof}% +% +\isadelimproof +% +\endisadelimproof +% +\end{minipage}\begin{minipage}{0.4\textwidth} +% +\begin{isamarkuptext}% +\infer{\isa{{\isachardoublequote}x\ {\isasymin}\ A\ {\isasyminter}\ B{\isachardoublequote}}}{\isa{{\isachardoublequote}x\ {\isasymin}\ A{\isachardoublequote}} & \isa{{\isachardoublequote}x\ {\isasymin}\ B{\isachardoublequote}}}% +\end{isamarkuptext}% +\isamarkuptrue% +% +\end{minipage} +% +\begin{isamarkuptext}% +\medskip\noindent Note that \hyperlink{command.assume}{\mbox{\isa{\isacommand{assume}}}} augments the proof + context, \hyperlink{command.then}{\mbox{\isa{\isacommand{then}}}} indicates that the current fact shall be + used in the next step, and \hyperlink{command.have}{\mbox{\isa{\isacommand{have}}}} states an intermediate + goal. The two dots ``\hyperlink{command.ddot}{\mbox{\isa{\isacommand{{\isachardot}{\isachardot}}}}}'' refer to a complete proof of + this claim, using the indicated facts and a canonical rule from the + context. We could have been more explicit here by spelling out the + final proof step via the \hyperlink{command.by}{\mbox{\isa{\isacommand{by}}}} command:% +\end{isamarkuptext}% +\isamarkuptrue% +% +\isadelimproof +% +\endisadelimproof +% +\isatagproof +\ \ \ \ \isacommand{assume}\isamarkupfalse% +\ {\isachardoublequoteopen}x\ {\isasymin}\ A{\isachardoublequoteclose}\ \isakeyword{and}\ {\isachardoublequoteopen}x\ {\isasymin}\ B{\isachardoublequoteclose}\isanewline +\ \ \ \ \isacommand{then}\isamarkupfalse% +\ \isacommand{have}\isamarkupfalse% +\ {\isachardoublequoteopen}x\ {\isasymin}\ A\ {\isasyminter}\ B{\isachardoublequoteclose}\ \isacommand{by}\isamarkupfalse% +\ {\isacharparenleft}rule\ IntI{\isacharparenright}% +\endisatagproof +{\isafoldproof}% +% +\isadelimproof +% +\endisadelimproof +% +\begin{isamarkuptext}% +\noindent The format of the \isa{{\isachardoublequote}{\isasyminter}{\isachardoublequote}}-introduction rule represents + the most basic inference, which proceeds from given premises to a + conclusion, without any nested proof context involved. + + The next example performs backwards introduction on \isa{{\isachardoublequote}{\isasymInter}{\isasymA}{\isachardoublequote}}, + the intersection of all sets within a given set. This requires a + nested proof of set membership within a local context, where \isa{A} is an arbitrary-but-fixed member of the collection:% +\end{isamarkuptext}% +\isamarkuptrue% +% +\medskip\begin{minipage}{0.6\textwidth} +% +\isadelimproof +% +\endisadelimproof +% +\isatagproof +\ \ \ \ \isacommand{have}\isamarkupfalse% +\ {\isachardoublequoteopen}x\ {\isasymin}\ {\isasymInter}{\isasymA}{\isachardoublequoteclose}\isanewline +\ \ \ \ \isacommand{proof}\isamarkupfalse% +\isanewline +\ \ \ \ \ \ \isacommand{fix}\isamarkupfalse% +\ A\isanewline +\ \ \ \ \ \ \isacommand{assume}\isamarkupfalse% +\ {\isachardoublequoteopen}A\ {\isasymin}\ {\isasymA}{\isachardoublequoteclose}\isanewline +\ \ \ \ \ \ \isacommand{show}\isamarkupfalse% +\ {\isachardoublequoteopen}x\ {\isasymin}\ A{\isachardoublequoteclose}% +\endisatagproof +{\isafoldproof}% +% +\isadelimproof +% +\endisadelimproof +% +\isadelimnoproof +\ % +\endisadelimnoproof +% +\isatagnoproof +\isacommand{sorry}\isamarkupfalse% +% +\endisatagnoproof +{\isafoldnoproof}% +% +\isadelimnoproof +\isanewline +% +\endisadelimnoproof +% +\isadelimproof +\ \ \ \ % +\endisadelimproof +% +\isatagproof +\isacommand{qed}\isamarkupfalse% +% +\endisatagproof +{\isafoldproof}% +% +\isadelimproof +% +\endisadelimproof +% +\end{minipage}\begin{minipage}{0.4\textwidth} +% +\begin{isamarkuptext}% +\infer{\isa{{\isachardoublequote}x\ {\isasymin}\ {\isasymInter}{\isasymA}{\isachardoublequote}}}{\infer*{\isa{{\isachardoublequote}x\ {\isasymin}\ A{\isachardoublequote}}}{\isa{{\isachardoublequote}{\isacharbrackleft}A{\isacharbrackright}{\isacharbrackleft}A\ {\isasymin}\ {\isasymA}{\isacharbrackright}{\isachardoublequote}}}}% +\end{isamarkuptext}% +\isamarkuptrue% +% +\end{minipage} +% +\begin{isamarkuptext}% +\medskip\noindent This Isar reasoning pattern again refers to the + primitive rule depicted above. The system determines it in the + ``\hyperlink{command.proof}{\mbox{\isa{\isacommand{proof}}}}'' step, which could have been spelt out more + explicitly as ``\hyperlink{command.proof}{\mbox{\isa{\isacommand{proof}}}}~\isa{{\isachardoublequote}{\isacharparenleft}rule\ InterI{\isacharparenright}{\isachardoublequote}}''. Note + that the rule involves both a local parameter \isa{{\isachardoublequote}A{\isachardoublequote}} and an + assumption \isa{{\isachardoublequote}A\ {\isasymin}\ {\isasymA}{\isachardoublequote}} in the nested reasoning. This kind of + compound rule typically demands a genuine sub-proof in Isar, working + backwards rather than forwards as seen before. In the proof body we + encounter the \hyperlink{command.fix}{\mbox{\isa{\isacommand{fix}}}}-\hyperlink{command.assume}{\mbox{\isa{\isacommand{assume}}}}-\hyperlink{command.show}{\mbox{\isa{\isacommand{show}}}} + outline of nested sub-proofs that is typical for Isar. The final + \hyperlink{command.show}{\mbox{\isa{\isacommand{show}}}} is like \hyperlink{command.have}{\mbox{\isa{\isacommand{have}}}} followed by an additional + refinement of the enclosing claim, using the rule derived from the + proof body. + + \medskip The next example involves \isa{{\isachardoublequote}{\isasymUnion}{\isasymA}{\isachardoublequote}}, which can be + characterized as the set of all \isa{{\isachardoublequote}x{\isachardoublequote}} such that \isa{{\isachardoublequote}{\isasymexists}A{\isachardot}\ x\ {\isasymin}\ A\ {\isasymand}\ A\ {\isasymin}\ {\isasymA}{\isachardoublequote}}. The elimination rule for \isa{{\isachardoublequote}x\ {\isasymin}\ {\isasymUnion}{\isasymA}{\isachardoublequote}} does + not mention \isa{{\isachardoublequote}{\isasymexists}{\isachardoublequote}} and \isa{{\isachardoublequote}{\isasymand}{\isachardoublequote}} at all, but admits to obtain + directly a local \isa{{\isachardoublequote}A{\isachardoublequote}} such that \isa{{\isachardoublequote}x\ {\isasymin}\ A{\isachardoublequote}} and \isa{{\isachardoublequote}A\ {\isasymin}\ {\isasymA}{\isachardoublequote}} hold. This corresponds to the following Isar proof and + inference rule, respectively:% +\end{isamarkuptext}% +\isamarkuptrue% +% +\medskip\begin{minipage}{0.6\textwidth} +% +\isadelimproof +% +\endisadelimproof +% +\isatagproof +\ \ \ \ \isacommand{assume}\isamarkupfalse% +\ {\isachardoublequoteopen}x\ {\isasymin}\ {\isasymUnion}{\isasymA}{\isachardoublequoteclose}\isanewline +\ \ \ \ \isacommand{then}\isamarkupfalse% +\ \isacommand{have}\isamarkupfalse% +\ C\isanewline +\ \ \ \ \isacommand{proof}\isamarkupfalse% +\isanewline +\ \ \ \ \ \ \isacommand{fix}\isamarkupfalse% +\ A\isanewline +\ \ \ \ \ \ \isacommand{assume}\isamarkupfalse% +\ {\isachardoublequoteopen}x\ {\isasymin}\ A{\isachardoublequoteclose}\ \isakeyword{and}\ {\isachardoublequoteopen}A\ {\isasymin}\ {\isasymA}{\isachardoublequoteclose}\isanewline +\ \ \ \ \ \ \isacommand{show}\isamarkupfalse% +\ C% +\endisatagproof +{\isafoldproof}% +% +\isadelimproof +% +\endisadelimproof +% +\isadelimnoproof +\ % +\endisadelimnoproof +% +\isatagnoproof +\isacommand{sorry}\isamarkupfalse% +% +\endisatagnoproof +{\isafoldnoproof}% +% +\isadelimnoproof +\isanewline +% +\endisadelimnoproof +% +\isadelimproof +\ \ \ \ % +\endisadelimproof +% +\isatagproof +\isacommand{qed}\isamarkupfalse% +% +\endisatagproof +{\isafoldproof}% +% +\isadelimproof +% +\endisadelimproof +% +\end{minipage}\begin{minipage}{0.4\textwidth} +% +\begin{isamarkuptext}% +\infer{\isa{{\isachardoublequote}C{\isachardoublequote}}}{\isa{{\isachardoublequote}x\ {\isasymin}\ {\isasymUnion}{\isasymA}{\isachardoublequote}} & \infer*{\isa{{\isachardoublequote}C{\isachardoublequote}}~}{\isa{{\isachardoublequote}{\isacharbrackleft}A{\isacharbrackright}{\isacharbrackleft}x\ {\isasymin}\ A{\isacharcomma}\ A\ {\isasymin}\ {\isasymA}{\isacharbrackright}{\isachardoublequote}}}}% +\end{isamarkuptext}% +\isamarkuptrue% +% +\end{minipage} +% +\begin{isamarkuptext}% +\medskip\noindent Although the Isar proof follows the natural + deduction rule closely, the text reads not as natural as + anticipated. There is a double occurrence of an arbitrary + conclusion \isa{{\isachardoublequote}C{\isachardoublequote}}, which represents the final result, but is + irrelevant for now. This issue arises for any elimination rule + involving local parameters. Isar provides the derived language + element \hyperlink{command.obtain}{\mbox{\isa{\isacommand{obtain}}}}, which is able to perform the same + elimination proof more conveniently:% +\end{isamarkuptext}% +\isamarkuptrue% +% +\isadelimproof +% +\endisadelimproof +% +\isatagproof +\ \ \ \ \isacommand{assume}\isamarkupfalse% +\ {\isachardoublequoteopen}x\ {\isasymin}\ {\isasymUnion}{\isasymA}{\isachardoublequoteclose}\isanewline +\ \ \ \ \isacommand{then}\isamarkupfalse% +\ \isacommand{obtain}\isamarkupfalse% +\ A\ \isakeyword{where}\ {\isachardoublequoteopen}x\ {\isasymin}\ A{\isachardoublequoteclose}\ \isakeyword{and}\ {\isachardoublequoteopen}A\ {\isasymin}\ {\isasymA}{\isachardoublequoteclose}\ \isacommand{{\isachardot}{\isachardot}}\isamarkupfalse% +% +\endisatagproof +{\isafoldproof}% +% +\isadelimproof +% +\endisadelimproof +% +\begin{isamarkuptext}% +\noindent Here we avoid to mention the final conclusion \isa{{\isachardoublequote}C{\isachardoublequote}} + and return to plain forward reasoning. The rule involved in the + ``\hyperlink{command.ddot}{\mbox{\isa{\isacommand{{\isachardot}{\isachardot}}}}}'' proof is the same as before.% +\end{isamarkuptext}% +\isamarkuptrue% +% +\isamarkupsection{The Pure framework \label{sec:framework-pure}% +} +\isamarkuptrue% +% +\begin{isamarkuptext}% +The Pure logic \cite{paulson-found,paulson700} is an intuitionistic + fragment of higher-order logic \cite{church40}. In type-theoretic + parlance, there are three levels of \isa{{\isachardoublequote}{\isasymlambda}{\isachardoublequote}}-calculus with + corresponding arrows \isa{{\isachardoublequote}{\isasymRightarrow}{\isachardoublequote}}/\isa{{\isachardoublequote}{\isasymAnd}{\isachardoublequote}}/\isa{{\isachardoublequote}{\isasymLongrightarrow}{\isachardoublequote}}: + + \medskip + \begin{tabular}{ll} + \isa{{\isachardoublequote}{\isasymalpha}\ {\isasymRightarrow}\ {\isasymbeta}{\isachardoublequote}} & syntactic function space (terms depending on terms) \\ + \isa{{\isachardoublequote}{\isasymAnd}x{\isachardot}\ B{\isacharparenleft}x{\isacharparenright}{\isachardoublequote}} & universal quantification (proofs depending on terms) \\ + \isa{{\isachardoublequote}A\ {\isasymLongrightarrow}\ B{\isachardoublequote}} & implication (proofs depending on proofs) \\ + \end{tabular} + \medskip + + \noindent Here only the types of syntactic terms, and the + propositions of proof terms have been shown. The \isa{{\isachardoublequote}{\isasymlambda}{\isachardoublequote}}-structure of proofs can be recorded as an optional feature of + the Pure inference kernel \cite{Berghofer-Nipkow:2000:TPHOL}, but + the formal system can never depend on them due to \emph{proof + irrelevance}. + + On top of this most primitive layer of proofs, Pure implements a + generic calculus for nested natural deduction rules, similar to + \cite{Schroeder-Heister:1984}. Here object-logic inferences are + internalized as formulae over \isa{{\isachardoublequote}{\isasymAnd}{\isachardoublequote}} and \isa{{\isachardoublequote}{\isasymLongrightarrow}{\isachardoublequote}}. + Combining such rule statements may involve higher-order unification + \cite{paulson-natural}.% +\end{isamarkuptext}% +\isamarkuptrue% +% +\isamarkupsubsection{Primitive inferences% +} +\isamarkuptrue% +% +\begin{isamarkuptext}% +Term syntax provides explicit notation for abstraction \isa{{\isachardoublequote}{\isasymlambda}x\ {\isacharcolon}{\isacharcolon}\ {\isasymalpha}{\isachardot}\ b{\isacharparenleft}x{\isacharparenright}{\isachardoublequote}} and application \isa{{\isachardoublequote}b\ a{\isachardoublequote}}, while types are usually + implicit thanks to type-inference; terms of type \isa{{\isachardoublequote}prop{\isachardoublequote}} are + called propositions. Logical statements are composed via \isa{{\isachardoublequote}{\isasymAnd}x\ {\isacharcolon}{\isacharcolon}\ {\isasymalpha}{\isachardot}\ B{\isacharparenleft}x{\isacharparenright}{\isachardoublequote}} and \isa{{\isachardoublequote}A\ {\isasymLongrightarrow}\ B{\isachardoublequote}}. Primitive reasoning operates on + judgments of the form \isa{{\isachardoublequote}{\isasymGamma}\ {\isasymturnstile}\ {\isasymphi}{\isachardoublequote}}, with standard introduction + and elimination rules for \isa{{\isachardoublequote}{\isasymAnd}{\isachardoublequote}} and \isa{{\isachardoublequote}{\isasymLongrightarrow}{\isachardoublequote}} that refer to + fixed parameters \isa{{\isachardoublequote}x\isactrlisub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ x\isactrlisub m{\isachardoublequote}} and hypotheses + \isa{{\isachardoublequote}A\isactrlisub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ A\isactrlisub n{\isachardoublequote}} from the context \isa{{\isachardoublequote}{\isasymGamma}{\isachardoublequote}}; + the corresponding proof terms are left implicit. The subsequent + inference rules define \isa{{\isachardoublequote}{\isasymGamma}\ {\isasymturnstile}\ {\isasymphi}{\isachardoublequote}} inductively, relative to a + collection of axioms: + + \[ + \infer{\isa{{\isachardoublequote}{\isasymturnstile}\ A{\isachardoublequote}}}{(\isa{{\isachardoublequote}A{\isachardoublequote}} \text{~axiom})} + \qquad + \infer{\isa{{\isachardoublequote}A\ {\isasymturnstile}\ A{\isachardoublequote}}}{} + \] + + \[ + \infer{\isa{{\isachardoublequote}{\isasymGamma}\ {\isasymturnstile}\ {\isasymAnd}x{\isachardot}\ B{\isacharparenleft}x{\isacharparenright}{\isachardoublequote}}}{\isa{{\isachardoublequote}{\isasymGamma}\ {\isasymturnstile}\ B{\isacharparenleft}x{\isacharparenright}{\isachardoublequote}} & \isa{{\isachardoublequote}x\ {\isasymnotin}\ {\isasymGamma}{\isachardoublequote}}} + \qquad + \infer{\isa{{\isachardoublequote}{\isasymGamma}\ {\isasymturnstile}\ B{\isacharparenleft}a{\isacharparenright}{\isachardoublequote}}}{\isa{{\isachardoublequote}{\isasymGamma}\ {\isasymturnstile}\ {\isasymAnd}x{\isachardot}\ B{\isacharparenleft}x{\isacharparenright}{\isachardoublequote}}} + \] + + \[ + \infer{\isa{{\isachardoublequote}{\isasymGamma}\ {\isacharminus}\ A\ {\isasymturnstile}\ A\ {\isasymLongrightarrow}\ B{\isachardoublequote}}}{\isa{{\isachardoublequote}{\isasymGamma}\ {\isasymturnstile}\ B{\isachardoublequote}}} + \qquad + \infer{\isa{{\isachardoublequote}{\isasymGamma}\isactrlsub {\isadigit{1}}\ {\isasymunion}\ {\isasymGamma}\isactrlsub {\isadigit{2}}\ {\isasymturnstile}\ B{\isachardoublequote}}}{\isa{{\isachardoublequote}{\isasymGamma}\isactrlsub {\isadigit{1}}\ {\isasymturnstile}\ A\ {\isasymLongrightarrow}\ B{\isachardoublequote}} & \isa{{\isachardoublequote}{\isasymGamma}\isactrlsub {\isadigit{2}}\ {\isasymturnstile}\ A{\isachardoublequote}}} + \] + + Furthermore, Pure provides a built-in equality \isa{{\isachardoublequote}{\isasymequiv}\ {\isacharcolon}{\isacharcolon}\ {\isasymalpha}\ {\isasymRightarrow}\ {\isasymalpha}\ {\isasymRightarrow}\ prop{\isachardoublequote}} with axioms for reflexivity, substitution, extensionality, + and \isa{{\isachardoublequote}{\isasymalpha}{\isasymbeta}{\isasymeta}{\isachardoublequote}}-conversion on \isa{{\isachardoublequote}{\isasymlambda}{\isachardoublequote}}-terms. + + \medskip An object-logic introduces another layer on top of Pure, + e.g.\ with types \isa{{\isachardoublequote}i{\isachardoublequote}} for individuals and \isa{{\isachardoublequote}o{\isachardoublequote}} for + propositions, term constants \isa{{\isachardoublequote}Trueprop\ {\isacharcolon}{\isacharcolon}\ o\ {\isasymRightarrow}\ prop{\isachardoublequote}} as + (implicit) derivability judgment and connectives like \isa{{\isachardoublequote}{\isasymand}\ {\isacharcolon}{\isacharcolon}\ o\ {\isasymRightarrow}\ o\ {\isasymRightarrow}\ o{\isachardoublequote}} or \isa{{\isachardoublequote}{\isasymforall}\ {\isacharcolon}{\isacharcolon}\ {\isacharparenleft}i\ {\isasymRightarrow}\ o{\isacharparenright}\ {\isasymRightarrow}\ o{\isachardoublequote}}, and axioms for object-level + rules such as \isa{{\isachardoublequote}conjI{\isacharcolon}\ A\ {\isasymLongrightarrow}\ B\ {\isasymLongrightarrow}\ A\ {\isasymand}\ B{\isachardoublequote}} or \isa{{\isachardoublequote}allI{\isacharcolon}\ {\isacharparenleft}{\isasymAnd}x{\isachardot}\ B\ x{\isacharparenright}\ {\isasymLongrightarrow}\ {\isasymforall}x{\isachardot}\ B\ x{\isachardoublequote}}. Derived object rules are represented as theorems of + Pure. After the initial object-logic setup, further axiomatizations + are usually avoided; plain definitions and derived principles are + used exclusively.% +\end{isamarkuptext}% +\isamarkuptrue% +% +\isamarkupsubsection{Reasoning with rules \label{sec:framework-resolution}% +} +\isamarkuptrue% +% +\begin{isamarkuptext}% +Primitive inferences mostly serve foundational purposes. The main + reasoning mechanisms of Pure operate on nested natural deduction + rules expressed as formulae, using \isa{{\isachardoublequote}{\isasymAnd}{\isachardoublequote}} to bind local + parameters and \isa{{\isachardoublequote}{\isasymLongrightarrow}{\isachardoublequote}} to express entailment. Multiple + parameters and premises are represented by repeating these + connectives in a right-associative manner. + + Since \isa{{\isachardoublequote}{\isasymAnd}{\isachardoublequote}} and \isa{{\isachardoublequote}{\isasymLongrightarrow}{\isachardoublequote}} commute thanks to the theorem + \isa{{\isachardoublequote}{\isacharparenleft}A\ {\isasymLongrightarrow}\ {\isacharparenleft}{\isasymAnd}x{\isachardot}\ B\ x{\isacharparenright}{\isacharparenright}\ {\isasymequiv}\ {\isacharparenleft}{\isasymAnd}x{\isachardot}\ A\ {\isasymLongrightarrow}\ B\ x{\isacharparenright}{\isachardoublequote}}, we may assume w.l.o.g.\ + that rule statements always observe the normal form where + quantifiers are pulled in front of implications at each level of + nesting. This means that any Pure proposition may be presented as a + \emph{Hereditary Harrop Formula} \cite{Miller:1991} which is of the + form \isa{{\isachardoublequote}{\isasymAnd}x\isactrlisub {\isadigit{1}}\ {\isasymdots}\ x\isactrlisub m{\isachardot}\ H\isactrlisub {\isadigit{1}}\ {\isasymLongrightarrow}\ {\isasymdots}\ H\isactrlisub n\ {\isasymLongrightarrow}\ A{\isachardoublequote}} for \isa{{\isachardoublequote}m{\isacharcomma}\ n\ {\isasymge}\ {\isadigit{0}}{\isachardoublequote}}, and \isa{{\isachardoublequote}A{\isachardoublequote}} atomic, and \isa{{\isachardoublequote}H\isactrlisub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ H\isactrlisub n{\isachardoublequote}} being recursively of the same format. + Following the convention that outermost quantifiers are implicit, + Horn clauses \isa{{\isachardoublequote}A\isactrlisub {\isadigit{1}}\ {\isasymLongrightarrow}\ {\isasymdots}\ A\isactrlisub n\ {\isasymLongrightarrow}\ A{\isachardoublequote}} are a special + case of this. + + For example, \isa{{\isachardoublequote}{\isasyminter}{\isachardoublequote}}-introduction rule encountered before is + represented as a Pure theorem as follows: + \[ + \isa{{\isachardoublequote}IntI{\isacharcolon}{\isachardoublequote}}~\isa{{\isachardoublequote}x\ {\isasymin}\ A\ {\isasymLongrightarrow}\ x\ {\isasymin}\ B\ {\isasymLongrightarrow}\ x\ {\isasymin}\ A\ {\isasyminter}\ B{\isachardoublequote}} + \] + + \noindent This is a plain Horn clause, since no further nesting on + the left is involved. The general \isa{{\isachardoublequote}{\isasymInter}{\isachardoublequote}}-introduction + corresponds to a Hereditary Harrop Formula with one additional level + of nesting: + \[ + \isa{{\isachardoublequote}InterI{\isacharcolon}{\isachardoublequote}}~\isa{{\isachardoublequote}{\isacharparenleft}{\isasymAnd}A{\isachardot}\ A\ {\isasymin}\ {\isasymA}\ {\isasymLongrightarrow}\ x\ {\isasymin}\ A{\isacharparenright}\ {\isasymLongrightarrow}\ x\ {\isasymin}\ {\isasymInter}{\isasymA}{\isachardoublequote}} + \] + + \medskip Goals are also represented as rules: \isa{{\isachardoublequote}A\isactrlisub {\isadigit{1}}\ {\isasymLongrightarrow}\ {\isasymdots}\ A\isactrlisub n\ {\isasymLongrightarrow}\ C{\isachardoublequote}} states that the sub-goals \isa{{\isachardoublequote}A\isactrlisub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ A\isactrlisub n{\isachardoublequote}} entail the result \isa{{\isachardoublequote}C{\isachardoublequote}}; for \isa{{\isachardoublequote}n\ {\isacharequal}\ {\isadigit{0}}{\isachardoublequote}} the + goal is finished. To allow \isa{{\isachardoublequote}C{\isachardoublequote}} being a rule statement + itself, we introduce the protective marker \isa{{\isachardoublequote}{\isacharhash}\ {\isacharcolon}{\isacharcolon}\ prop\ {\isasymRightarrow}\ prop{\isachardoublequote}}, which is defined as identity and hidden from the user. We + initialize and finish goal states as follows: + + \[ + \begin{array}{c@ {\qquad}c} + \infer[(\indexdef{}{inference}{init}\hypertarget{inference.init}{\hyperlink{inference.init}{\mbox{\isa{init}}}})]{\isa{{\isachardoublequote}C\ {\isasymLongrightarrow}\ {\isacharhash}C{\isachardoublequote}}}{} & + \infer[(\indexdef{}{inference}{finish}\hypertarget{inference.finish}{\hyperlink{inference.finish}{\mbox{\isa{finish}}}})]{\isa{C}}{\isa{{\isachardoublequote}{\isacharhash}C{\isachardoublequote}}} + \end{array} + \] + + \noindent Goal states are refined in intermediate proof steps until + a finished form is achieved. Here the two main reasoning principles + are \hyperlink{inference.resolution}{\mbox{\isa{resolution}}}, for back-chaining a rule against a + sub-goal (replacing it by zero or more sub-goals), and \hyperlink{inference.assumption}{\mbox{\isa{assumption}}}, for solving a sub-goal (finding a short-circuit with + local assumptions). Below \isa{{\isachardoublequote}\isactrlvec x{\isachardoublequote}} stands for \isa{{\isachardoublequote}x\isactrlisub {\isadigit{1}}{\isacharcomma}\ {\isasymdots}{\isacharcomma}\ x\isactrlisub n{\isachardoublequote}} (\isa{{\isachardoublequote}n\ {\isasymge}\ {\isadigit{0}}{\isachardoublequote}}). + + \[ + \infer[(\indexdef{}{inference}{resolution}\hypertarget{inference.resolution}{\hyperlink{inference.resolution}{\mbox{\isa{resolution}}}})] + {\isa{{\isachardoublequote}{\isacharparenleft}{\isasymAnd}\isactrlvec x{\isachardot}\ \isactrlvec H\ \isactrlvec x\ {\isasymLongrightarrow}\ \isactrlvec A\ {\isacharparenleft}\isactrlvec a\ \isactrlvec x{\isacharparenright}{\isacharparenright}{\isasymvartheta}\ {\isasymLongrightarrow}\ C{\isasymvartheta}{\isachardoublequote}}} + {\begin{tabular}{rl} + \isa{{\isachardoublequote}rule{\isacharcolon}{\isachardoublequote}} & + \isa{{\isachardoublequote}\isactrlvec A\ \isactrlvec a\ {\isasymLongrightarrow}\ B\ \isactrlvec a{\isachardoublequote}} \\ + \isa{{\isachardoublequote}goal{\isacharcolon}{\isachardoublequote}} & + \isa{{\isachardoublequote}{\isacharparenleft}{\isasymAnd}\isactrlvec x{\isachardot}\ \isactrlvec H\ \isactrlvec x\ {\isasymLongrightarrow}\ B{\isacharprime}\ \isactrlvec x{\isacharparenright}\ {\isasymLongrightarrow}\ C{\isachardoublequote}} \\ + \isa{{\isachardoublequote}goal\ unifier{\isacharcolon}{\isachardoublequote}} & + \isa{{\isachardoublequote}{\isacharparenleft}{\isasymlambda}\isactrlvec x{\isachardot}\ B\ {\isacharparenleft}\isactrlvec a\ \isactrlvec x{\isacharparenright}{\isacharparenright}{\isasymvartheta}\ {\isacharequal}\ B{\isacharprime}{\isasymvartheta}{\isachardoublequote}} \\ + \end{tabular}} + \] + + \medskip + + \[ + \infer[(\indexdef{}{inference}{assumption}\hypertarget{inference.assumption}{\hyperlink{inference.assumption}{\mbox{\isa{assumption}}}})]{\isa{{\isachardoublequote}C{\isasymvartheta}{\isachardoublequote}}} + {\begin{tabular}{rl} + \isa{{\isachardoublequote}goal{\isacharcolon}{\isachardoublequote}} & + \isa{{\isachardoublequote}{\isacharparenleft}{\isasymAnd}\isactrlvec x{\isachardot}\ \isactrlvec H\ \isactrlvec x\ {\isasymLongrightarrow}\ A\ \isactrlvec x{\isacharparenright}\ {\isasymLongrightarrow}\ C{\isachardoublequote}} \\ + \isa{{\isachardoublequote}assm\ unifier{\isacharcolon}{\isachardoublequote}} & \isa{{\isachardoublequote}A{\isasymvartheta}\ {\isacharequal}\ H\isactrlsub i{\isasymvartheta}{\isachardoublequote}}~~\text{(for some~\isa{{\isachardoublequote}H\isactrlsub i{\isachardoublequote}})} \\ + \end{tabular}} + \] + + The following trace illustrates goal-oriented reasoning in + Isabelle/Pure: + + {\footnotesize + \medskip + \begin{tabular}{r@ {\quad}l} + \isa{{\isachardoublequote}{\isacharparenleft}A\ {\isasymand}\ B\ {\isasymLongrightarrow}\ B\ {\isasymand}\ A{\isacharparenright}\ {\isasymLongrightarrow}\ {\isacharhash}{\isacharparenleft}A\ {\isasymand}\ B\ {\isasymLongrightarrow}\ B\ {\isasymand}\ A{\isacharparenright}{\isachardoublequote}} & \isa{{\isachardoublequote}{\isacharparenleft}init{\isacharparenright}{\isachardoublequote}} \\ + \isa{{\isachardoublequote}{\isacharparenleft}A\ {\isasymand}\ B\ {\isasymLongrightarrow}\ B{\isacharparenright}\ {\isasymLongrightarrow}\ {\isacharparenleft}A\ {\isasymand}\ B\ {\isasymLongrightarrow}\ A{\isacharparenright}\ {\isasymLongrightarrow}\ {\isacharhash}{\isasymdots}{\isachardoublequote}} & \isa{{\isachardoublequote}{\isacharparenleft}resolution\ B\ {\isasymLongrightarrow}\ A\ {\isasymLongrightarrow}\ B\ {\isasymand}\ A{\isacharparenright}{\isachardoublequote}} \\ + \isa{{\isachardoublequote}{\isacharparenleft}A\ {\isasymand}\ B\ {\isasymLongrightarrow}\ A\ {\isasymand}\ B{\isacharparenright}\ {\isasymLongrightarrow}\ {\isacharparenleft}A\ {\isasymand}\ B\ {\isasymLongrightarrow}\ A{\isacharparenright}\ {\isasymLongrightarrow}\ {\isacharhash}{\isasymdots}{\isachardoublequote}} & \isa{{\isachardoublequote}{\isacharparenleft}resolution\ A\ {\isasymand}\ B\ {\isasymLongrightarrow}\ B{\isacharparenright}{\isachardoublequote}} \\ + \isa{{\isachardoublequote}{\isacharparenleft}A\ {\isasymand}\ B\ {\isasymLongrightarrow}\ A{\isacharparenright}\ {\isasymLongrightarrow}\ {\isacharhash}{\isasymdots}{\isachardoublequote}} & \isa{{\isachardoublequote}{\isacharparenleft}assumption{\isacharparenright}{\isachardoublequote}} \\ + \isa{{\isachardoublequote}{\isacharparenleft}A\ {\isasymand}\ B\ {\isasymLongrightarrow}\ B\ {\isasymand}\ A{\isacharparenright}\ {\isasymLongrightarrow}\ {\isacharhash}{\isasymdots}{\isachardoublequote}} & \isa{{\isachardoublequote}{\isacharparenleft}resolution\ A\ {\isasymand}\ B\ {\isasymLongrightarrow}\ A{\isacharparenright}{\isachardoublequote}} \\ + \isa{{\isachardoublequote}{\isacharhash}{\isasymdots}{\isachardoublequote}} & \isa{{\isachardoublequote}{\isacharparenleft}assumption{\isacharparenright}{\isachardoublequote}} \\ + \isa{{\isachardoublequote}A\ {\isasymand}\ B\ {\isasymLongrightarrow}\ B\ {\isasymand}\ A{\isachardoublequote}} & \isa{{\isachardoublequote}{\isacharparenleft}finish{\isacharparenright}{\isachardoublequote}} \\ + \end{tabular} + \medskip + } + + Compositions of \hyperlink{inference.assumption}{\mbox{\isa{assumption}}} after \hyperlink{inference.resolution}{\mbox{\isa{resolution}}} occurs quite often, typically in elimination steps. + Traditional Isabelle tactics accommodate this by a combined + \indexdef{}{inference}{elim\_resolution}\hypertarget{inference.elim-resolution}{\hyperlink{inference.elim-resolution}{\mbox{\isa{elim{\isacharunderscore}resolution}}}} principle. In contrast, Isar uses + a slightly more refined combination, where the assumptions to be + closed are marked explicitly, using again the protective marker + \isa{{\isachardoublequote}{\isacharhash}{\isachardoublequote}}: + + \[ + \infer[(\hyperlink{inference.refinement}{\mbox{\isa{refinement}}})] + {\isa{{\isachardoublequote}{\isacharparenleft}{\isasymAnd}\isactrlvec x{\isachardot}\ \isactrlvec H\ \isactrlvec x\ {\isasymLongrightarrow}\ \isactrlvec G{\isacharprime}\ {\isacharparenleft}\isactrlvec a\ \isactrlvec x{\isacharparenright}{\isacharparenright}{\isasymvartheta}\ {\isasymLongrightarrow}\ C{\isasymvartheta}{\isachardoublequote}}} + {\begin{tabular}{rl} + \isa{{\isachardoublequote}sub{\isasymdash}proof{\isacharcolon}{\isachardoublequote}} & + \isa{{\isachardoublequote}\isactrlvec G\ \isactrlvec a\ {\isasymLongrightarrow}\ B\ \isactrlvec a{\isachardoublequote}} \\ + \isa{{\isachardoublequote}goal{\isacharcolon}{\isachardoublequote}} & + \isa{{\isachardoublequote}{\isacharparenleft}{\isasymAnd}\isactrlvec x{\isachardot}\ \isactrlvec H\ \isactrlvec x\ {\isasymLongrightarrow}\ B{\isacharprime}\ \isactrlvec x{\isacharparenright}\ {\isasymLongrightarrow}\ C{\isachardoublequote}} \\ + \isa{{\isachardoublequote}goal\ unifier{\isacharcolon}{\isachardoublequote}} & + \isa{{\isachardoublequote}{\isacharparenleft}{\isasymlambda}\isactrlvec x{\isachardot}\ B\ {\isacharparenleft}\isactrlvec a\ \isactrlvec x{\isacharparenright}{\isacharparenright}{\isasymvartheta}\ {\isacharequal}\ B{\isacharprime}{\isasymvartheta}{\isachardoublequote}} \\ + \isa{{\isachardoublequote}assm\ unifiers{\isacharcolon}{\isachardoublequote}} & + \isa{{\isachardoublequote}{\isacharparenleft}{\isasymlambda}\isactrlvec x{\isachardot}\ G\isactrlsub j\ {\isacharparenleft}\isactrlvec a\ \isactrlvec x{\isacharparenright}{\isacharparenright}{\isasymvartheta}\ {\isacharequal}\ {\isacharhash}H\isactrlsub i{\isasymvartheta}{\isachardoublequote}} \\ + & \quad (for each marked \isa{{\isachardoublequote}G\isactrlsub j{\isachardoublequote}} some \isa{{\isachardoublequote}{\isacharhash}H\isactrlsub i{\isachardoublequote}}) \\ + \end{tabular}} + \] + + \noindent Here the \isa{{\isachardoublequote}sub{\isasymdash}proof{\isachardoublequote}} rule stems from the + main \hyperlink{command.fix}{\mbox{\isa{\isacommand{fix}}}}-\hyperlink{command.assume}{\mbox{\isa{\isacommand{assume}}}}-\hyperlink{command.show}{\mbox{\isa{\isacommand{show}}}} outline of + Isar (cf.\ \secref{sec:framework-subproof}): each assumption + indicated in the text results in a marked premise \isa{{\isachardoublequote}G{\isachardoublequote}} above. + The marking enforces resolution against one of the sub-goal's + premises. Consequently, \hyperlink{command.fix}{\mbox{\isa{\isacommand{fix}}}}-\hyperlink{command.assume}{\mbox{\isa{\isacommand{assume}}}}-\hyperlink{command.show}{\mbox{\isa{\isacommand{show}}}} enables to fit the result of a sub-proof quite robustly into a + pending sub-goal, while maintaining a good measure of flexibility.% +\end{isamarkuptext}% +\isamarkuptrue% +% +\isamarkupsection{The Isar proof language \label{sec:framework-isar}% +} +\isamarkuptrue% +% +\begin{isamarkuptext}% +Structured proofs are presented as high-level expressions for + composing entities of Pure (propositions, facts, and goals). The + Isar proof language allows to organize reasoning within the + underlying rule calculus of Pure, but Isar is not another logical + calculus! + + Isar is an exercise in sound minimalism. Approximately half of the + language is introduced as primitive, the rest defined as derived + concepts. The following grammar describes the core language + (category \isa{{\isachardoublequote}proof{\isachardoublequote}}), which is embedded into theory + specification elements such as \hyperlink{command.theorem}{\mbox{\isa{\isacommand{theorem}}}}; see also + \secref{sec:framework-stmt} for the separate category \isa{{\isachardoublequote}statement{\isachardoublequote}}. + + \medskip + \begin{tabular}{rcl} + \isa{{\isachardoublequote}theory{\isasymdash}stmt{\isachardoublequote}} & = & \hyperlink{command.theorem}{\mbox{\isa{\isacommand{theorem}}}}~\isa{{\isachardoublequote}statement\ proof\ \ {\isacharbar}{\isachardoublequote}}~~\hyperlink{command.definition}{\mbox{\isa{\isacommand{definition}}}}~\isa{{\isachardoublequote}{\isasymdots}\ \ {\isacharbar}\ \ {\isasymdots}{\isachardoublequote}} \\[1ex] + + \isa{{\isachardoublequote}proof{\isachardoublequote}} & = & \isa{{\isachardoublequote}prfx\isactrlsup {\isacharasterisk}{\isachardoublequote}}~\hyperlink{command.proof}{\mbox{\isa{\isacommand{proof}}}}~\isa{{\isachardoublequote}method\isactrlsup {\isacharquery}\ stmt\isactrlsup {\isacharasterisk}{\isachardoublequote}}~\hyperlink{command.qed}{\mbox{\isa{\isacommand{qed}}}}~\isa{{\isachardoublequote}method\isactrlsup {\isacharquery}{\isachardoublequote}} \\[1ex] + + \isa{prfx} & = & \hyperlink{command.using}{\mbox{\isa{\isacommand{using}}}}~\isa{{\isachardoublequote}facts{\isachardoublequote}} \\ + & \isa{{\isachardoublequote}{\isacharbar}{\isachardoublequote}} & \hyperlink{command.unfolding}{\mbox{\isa{\isacommand{unfolding}}}}~\isa{{\isachardoublequote}facts{\isachardoublequote}} \\ + + \isa{stmt} & = & \hyperlink{command.braceleft}{\mbox{\isa{\isacommand{{\isacharbraceleft}}}}}~\isa{{\isachardoublequote}stmt\isactrlsup {\isacharasterisk}{\isachardoublequote}}~\hyperlink{command.braceright}{\mbox{\isa{\isacommand{{\isacharbraceright}}}}} \\ + & \isa{{\isachardoublequote}{\isacharbar}{\isachardoublequote}} & \hyperlink{command.next}{\mbox{\isa{\isacommand{next}}}} \\ + & \isa{{\isachardoublequote}{\isacharbar}{\isachardoublequote}} & \hyperlink{command.note}{\mbox{\isa{\isacommand{note}}}}~\isa{{\isachardoublequote}name\ {\isacharequal}\ facts{\isachardoublequote}} \\ + & \isa{{\isachardoublequote}{\isacharbar}{\isachardoublequote}} & \hyperlink{command.let}{\mbox{\isa{\isacommand{let}}}}~\isa{{\isachardoublequote}term\ {\isacharequal}\ term{\isachardoublequote}} \\ + & \isa{{\isachardoublequote}{\isacharbar}{\isachardoublequote}} & \hyperlink{command.fix}{\mbox{\isa{\isacommand{fix}}}}~\isa{{\isachardoublequote}var\isactrlsup {\isacharplus}{\isachardoublequote}} \\ + & \isa{{\isachardoublequote}{\isacharbar}{\isachardoublequote}} & \hyperlink{command.assume}{\mbox{\isa{\isacommand{assume}}}}~\isa{{\isachardoublequote}{\isasymguillemotleft}inference{\isasymguillemotright}\ name{\isacharcolon}\ props{\isachardoublequote}} \\ + & \isa{{\isachardoublequote}{\isacharbar}{\isachardoublequote}} & \hyperlink{command.then}{\mbox{\isa{\isacommand{then}}}}\isa{{\isachardoublequote}\isactrlsup {\isacharquery}{\isachardoublequote}}~\isa{goal} \\ + \isa{goal} & = & \hyperlink{command.have}{\mbox{\isa{\isacommand{have}}}}~\isa{{\isachardoublequote}name{\isacharcolon}\ props\ proof{\isachardoublequote}} \\ + & \isa{{\isachardoublequote}{\isacharbar}{\isachardoublequote}} & \hyperlink{command.show}{\mbox{\isa{\isacommand{show}}}}~\isa{{\isachardoublequote}name{\isacharcolon}\ props\ proof{\isachardoublequote}} \\ + \end{tabular} + + \medskip Simultaneous propositions or facts may be separated by the + \hyperlink{keyword.and}{\mbox{\isa{\isakeyword{and}}}} keyword. + + \medskip The syntax for terms and propositions is inherited from + Pure (and the object-logic). A \isa{{\isachardoublequote}pattern{\isachardoublequote}} is a \isa{{\isachardoublequote}term{\isachardoublequote}} with schematic variables, to be bound by higher-order + matching. + + \medskip Facts may be referenced by name or proposition. For + example, the result of ``\hyperlink{command.have}{\mbox{\isa{\isacommand{have}}}}~\isa{{\isachardoublequote}a{\isacharcolon}\ A\ {\isasymlangle}proof{\isasymrangle}{\isachardoublequote}}'' + becomes available both as \isa{{\isachardoublequote}a{\isachardoublequote}} and + \isacharbackquoteopen\isa{{\isachardoublequote}A{\isachardoublequote}}\isacharbackquoteclose. Moreover, + fact expressions may involve attributes that modify either the + theorem or the background context. For example, the expression + ``\isa{{\isachardoublequote}a\ {\isacharbrackleft}OF\ b{\isacharbrackright}{\isachardoublequote}}'' refers to the composition of two facts + according to the \hyperlink{inference.resolution}{\mbox{\isa{resolution}}} inference of + \secref{sec:framework-resolution}, while ``\isa{{\isachardoublequote}a\ {\isacharbrackleft}intro{\isacharbrackright}{\isachardoublequote}}'' + declares a fact as introduction rule in the context. + + The special fact called ``\hyperlink{fact.this}{\mbox{\isa{this}}}'' always refers to the last + result, as produced by \hyperlink{command.note}{\mbox{\isa{\isacommand{note}}}}, \hyperlink{command.assume}{\mbox{\isa{\isacommand{assume}}}}, \hyperlink{command.have}{\mbox{\isa{\isacommand{have}}}}, or \hyperlink{command.show}{\mbox{\isa{\isacommand{show}}}}. Since \hyperlink{command.note}{\mbox{\isa{\isacommand{note}}}} occurs + frequently together with \hyperlink{command.then}{\mbox{\isa{\isacommand{then}}}} we provide some + abbreviations: + + \medskip + \begin{tabular}{rcl} + \hyperlink{command.from}{\mbox{\isa{\isacommand{from}}}}~\isa{a} & \isa{{\isachardoublequote}{\isasymequiv}{\isachardoublequote}} & \hyperlink{command.note}{\mbox{\isa{\isacommand{note}}}}~\isa{a}~\hyperlink{command.then}{\mbox{\isa{\isacommand{then}}}} \\ + \hyperlink{command.with}{\mbox{\isa{\isacommand{with}}}}~\isa{a} & \isa{{\isachardoublequote}{\isasymequiv}{\isachardoublequote}} & \hyperlink{command.from}{\mbox{\isa{\isacommand{from}}}}~\isa{{\isachardoublequote}a\ {\isasymAND}\ this{\isachardoublequote}} \\ + \end{tabular} + \medskip + + The \isa{{\isachardoublequote}method{\isachardoublequote}} category is essentially a parameter and may be + populated later. Methods use the facts indicated by \hyperlink{command.then}{\mbox{\isa{\isacommand{then}}}} or \hyperlink{command.using}{\mbox{\isa{\isacommand{using}}}}, and then operate on the goal state. + Some basic methods are predefined: ``\hyperlink{method.-}{\mbox{\isa{{\isacharminus}}}}'' leaves the goal + unchanged, ``\hyperlink{method.this}{\mbox{\isa{this}}}'' applies the facts as rules to the + goal, ``\hyperlink{method.rule}{\mbox{\isa{rule}}}'' applies the facts to another rule and the + result to the goal (both ``\hyperlink{method.this}{\mbox{\isa{this}}}'' and ``\hyperlink{method.rule}{\mbox{\isa{rule}}}'' + refer to \hyperlink{inference.resolution}{\mbox{\isa{resolution}}} of + \secref{sec:framework-resolution}). The secondary arguments to + ``\hyperlink{method.rule}{\mbox{\isa{rule}}}'' may be specified explicitly as in ``\isa{{\isachardoublequote}{\isacharparenleft}rule\ a{\isacharparenright}{\isachardoublequote}}'', or picked from the context. In the latter case, the system + first tries rules declared as \hyperlink{attribute.Pure.elim}{\mbox{\isa{elim}}} or + \hyperlink{attribute.Pure.dest}{\mbox{\isa{dest}}}, followed by those declared as \hyperlink{attribute.Pure.intro}{\mbox{\isa{intro}}}. + + The default method for \hyperlink{command.proof}{\mbox{\isa{\isacommand{proof}}}} is ``\hyperlink{method.rule}{\mbox{\isa{rule}}}'' + (arguments picked from the context), for \hyperlink{command.qed}{\mbox{\isa{\isacommand{qed}}}} it is + ``\hyperlink{method.-}{\mbox{\isa{{\isacharminus}}}}''. Further abbreviations for terminal proof steps + are ``\hyperlink{command.by}{\mbox{\isa{\isacommand{by}}}}~\isa{{\isachardoublequote}method\isactrlsub {\isadigit{1}}\ method\isactrlsub {\isadigit{2}}{\isachardoublequote}}'' for + ``\hyperlink{command.proof}{\mbox{\isa{\isacommand{proof}}}}~\isa{{\isachardoublequote}method\isactrlsub {\isadigit{1}}{\isachardoublequote}}~\hyperlink{command.qed}{\mbox{\isa{\isacommand{qed}}}}~\isa{{\isachardoublequote}method\isactrlsub {\isadigit{2}}{\isachardoublequote}}'', and ``\hyperlink{command.ddot}{\mbox{\isa{\isacommand{{\isachardot}{\isachardot}}}}}'' for ``\hyperlink{command.by}{\mbox{\isa{\isacommand{by}}}}~\hyperlink{method.rule}{\mbox{\isa{rule}}}, and ``\hyperlink{command.dot}{\mbox{\isa{\isacommand{{\isachardot}}}}}'' for ``\hyperlink{command.by}{\mbox{\isa{\isacommand{by}}}}~\hyperlink{method.this}{\mbox{\isa{this}}}''. The \hyperlink{command.unfolding}{\mbox{\isa{\isacommand{unfolding}}}} element operates + directly on the current facts and goal by applying equalities. + + \medskip Block structure can be indicated explicitly by ``\hyperlink{command.braceleft}{\mbox{\isa{\isacommand{{\isacharbraceleft}}}}}~\isa{{\isachardoublequote}{\isasymdots}{\isachardoublequote}}~\hyperlink{command.braceright}{\mbox{\isa{\isacommand{{\isacharbraceright}}}}}'', although the body of a sub-proof + already involves implicit nesting. In any case, \hyperlink{command.next}{\mbox{\isa{\isacommand{next}}}} + jumps into the next section of a block, i.e.\ it acts like closing + an implicit block scope and opening another one; there is no direct + correspondence to subgoals here. + + The remaining elements \hyperlink{command.fix}{\mbox{\isa{\isacommand{fix}}}} and \hyperlink{command.assume}{\mbox{\isa{\isacommand{assume}}}} build up + a local context (see \secref{sec:framework-context}), while + \hyperlink{command.show}{\mbox{\isa{\isacommand{show}}}} refines a pending sub-goal by the rule resulting + from a nested sub-proof (see \secref{sec:framework-subproof}). + Further derived concepts will support calculational reasoning (see + \secref{sec:framework-calc}).% +\end{isamarkuptext}% +\isamarkuptrue% +% +\isamarkupsubsection{Context elements \label{sec:framework-context}% +} +\isamarkuptrue% +% +\begin{isamarkuptext}% +In judgments \isa{{\isachardoublequote}{\isasymGamma}\ {\isasymturnstile}\ {\isasymphi}{\isachardoublequote}} of the primitive framework, \isa{{\isachardoublequote}{\isasymGamma}{\isachardoublequote}} + essentially acts like a proof context. Isar elaborates this idea + towards a higher-level notion, with additional information for + type-inference, term abbreviations, local facts, hypotheses etc. + + The element \hyperlink{command.fix}{\mbox{\isa{\isacommand{fix}}}}~\isa{{\isachardoublequote}x\ {\isacharcolon}{\isacharcolon}\ {\isasymalpha}{\isachardoublequote}} declares a local + parameter, i.e.\ an arbitrary-but-fixed entity of a given type; in + results exported from the context, \isa{{\isachardoublequote}x{\isachardoublequote}} may become anything. + The \hyperlink{command.assume}{\mbox{\isa{\isacommand{assume}}}}~\isa{{\isachardoublequote}{\isasymguillemotleft}inference{\isasymguillemotright}{\isachardoublequote}} element provides a + general interface to hypotheses: ``\hyperlink{command.assume}{\mbox{\isa{\isacommand{assume}}}}~\isa{{\isachardoublequote}{\isasymguillemotleft}inference{\isasymguillemotright}\ A{\isachardoublequote}}'' produces \isa{{\isachardoublequote}A\ {\isasymturnstile}\ A{\isachardoublequote}} locally, while the + included inference tells how to discharge \isa{A} from results + \isa{{\isachardoublequote}A\ {\isasymturnstile}\ B{\isachardoublequote}} later on. There is no user-syntax for \isa{{\isachardoublequote}{\isasymguillemotleft}inference{\isasymguillemotright}{\isachardoublequote}}, i.e.\ it may only occur internally when derived + commands are defined in ML. + + At the user-level, the default inference for \hyperlink{command.assume}{\mbox{\isa{\isacommand{assume}}}} is + \hyperlink{inference.discharge}{\mbox{\isa{discharge}}} as given below. The additional variants + \hyperlink{command.presume}{\mbox{\isa{\isacommand{presume}}}} and \hyperlink{command.def}{\mbox{\isa{\isacommand{def}}}} are defined as follows: + + \medskip + \begin{tabular}{rcl} + \hyperlink{command.presume}{\mbox{\isa{\isacommand{presume}}}}~\isa{A} & \isa{{\isachardoublequote}{\isasymequiv}{\isachardoublequote}} & \hyperlink{command.assume}{\mbox{\isa{\isacommand{assume}}}}~\isa{{\isachardoublequote}{\isasymguillemotleft}weak{\isasymdash}discharge{\isasymguillemotright}\ A{\isachardoublequote}} \\ + \hyperlink{command.def}{\mbox{\isa{\isacommand{def}}}}~\isa{{\isachardoublequote}x\ {\isasymequiv}\ a{\isachardoublequote}} & \isa{{\isachardoublequote}{\isasymequiv}{\isachardoublequote}} & \hyperlink{command.fix}{\mbox{\isa{\isacommand{fix}}}}~\isa{x}~\hyperlink{command.assume}{\mbox{\isa{\isacommand{assume}}}}~\isa{{\isachardoublequote}{\isasymguillemotleft}expansion{\isasymguillemotright}\ x\ {\isasymequiv}\ a{\isachardoublequote}} \\ + \end{tabular} + \medskip + + \[ + \infer[(\indexdef{}{inference}{discharge}\hypertarget{inference.discharge}{\hyperlink{inference.discharge}{\mbox{\isa{discharge}}}})]{\isa{{\isachardoublequote}{\isasymstrut}{\isasymGamma}\ {\isacharminus}\ A\ {\isasymturnstile}\ {\isacharhash}A\ {\isasymLongrightarrow}\ B{\isachardoublequote}}}{\isa{{\isachardoublequote}{\isasymstrut}{\isasymGamma}\ {\isasymturnstile}\ B{\isachardoublequote}}} + \] + \[ + \infer[(\indexdef{}{inference}{weak-discharge}\hypertarget{inference.weak-discharge}{\hyperlink{inference.weak-discharge}{\mbox{\isa{weak{\isasymdash}discharge}}}})]{\isa{{\isachardoublequote}{\isasymstrut}{\isasymGamma}\ {\isacharminus}\ A\ {\isasymturnstile}\ A\ {\isasymLongrightarrow}\ B{\isachardoublequote}}}{\isa{{\isachardoublequote}{\isasymstrut}{\isasymGamma}\ {\isasymturnstile}\ B{\isachardoublequote}}} + \] + \[ + \infer[(\indexdef{}{inference}{expansion}\hypertarget{inference.expansion}{\hyperlink{inference.expansion}{\mbox{\isa{expansion}}}})]{\isa{{\isachardoublequote}{\isasymstrut}{\isasymGamma}\ {\isacharminus}\ {\isacharparenleft}x\ {\isasymequiv}\ a{\isacharparenright}\ {\isasymturnstile}\ B\ a{\isachardoublequote}}}{\isa{{\isachardoublequote}{\isasymstrut}{\isasymGamma}\ {\isasymturnstile}\ B\ x{\isachardoublequote}}} + \] + + \medskip Note that \hyperlink{inference.discharge}{\mbox{\isa{discharge}}} and \hyperlink{inference.weak-discharge}{\mbox{\isa{weak{\isasymdash}discharge}}} differ in the marker for \isa{A}, which is + relevant when the result of a \hyperlink{command.fix}{\mbox{\isa{\isacommand{fix}}}}-\hyperlink{command.assume}{\mbox{\isa{\isacommand{assume}}}}-\hyperlink{command.show}{\mbox{\isa{\isacommand{show}}}} outline is composed with a pending goal, + cf.\ \secref{sec:framework-subproof}. + + The most interesting derived context element in Isar is \hyperlink{command.obtain}{\mbox{\isa{\isacommand{obtain}}}} \cite[\S5.3]{Wenzel-PhD}, which supports generalized + elimination steps in a purely forward manner. The \hyperlink{command.obtain}{\mbox{\isa{\isacommand{obtain}}}} + command takes a specification of parameters \isa{{\isachardoublequote}\isactrlvec x{\isachardoublequote}} and + assumptions \isa{{\isachardoublequote}\isactrlvec A{\isachardoublequote}} to be added to the context, together + with a proof of a case rule stating that this extension is + conservative (i.e.\ may be removed from closed results later on): + + \medskip + \begin{tabular}{l} + \isa{{\isachardoublequote}{\isasymlangle}facts{\isasymrangle}{\isachardoublequote}}~~\hyperlink{command.obtain}{\mbox{\isa{\isacommand{obtain}}}}~\isa{{\isachardoublequote}\isactrlvec x\ {\isasymWHERE}\ \isactrlvec A\ \isactrlvec x\ \ {\isasymlangle}proof{\isasymrangle}\ {\isasymequiv}{\isachardoublequote}} \\[0.5ex] + \quad \hyperlink{command.have}{\mbox{\isa{\isacommand{have}}}}~\isa{{\isachardoublequote}case{\isacharcolon}\ {\isasymAnd}thesis{\isachardot}\ {\isacharparenleft}{\isasymAnd}\isactrlvec x{\isachardot}\ \isactrlvec A\ \isactrlvec x\ {\isasymLongrightarrow}\ thesis{\isacharparenright}\ {\isasymLongrightarrow}\ thesis{\isasymrangle}{\isachardoublequote}} \\ + \quad \hyperlink{command.proof}{\mbox{\isa{\isacommand{proof}}}}~\hyperlink{method.-}{\mbox{\isa{{\isacharminus}}}} \\ + \qquad \hyperlink{command.fix}{\mbox{\isa{\isacommand{fix}}}}~\isa{thesis} \\ + \qquad \hyperlink{command.assume}{\mbox{\isa{\isacommand{assume}}}}~\isa{{\isachardoublequote}{\isacharbrackleft}intro{\isacharbrackright}{\isacharcolon}\ {\isasymAnd}\isactrlvec x{\isachardot}\ \isactrlvec A\ \isactrlvec x\ {\isasymLongrightarrow}\ thesis{\isachardoublequote}} \\ + \qquad \hyperlink{command.show}{\mbox{\isa{\isacommand{show}}}}~\isa{thesis}~\hyperlink{command.using}{\mbox{\isa{\isacommand{using}}}}~\isa{{\isachardoublequote}{\isasymlangle}facts{\isasymrangle}\ {\isasymlangle}proof{\isasymrangle}{\isachardoublequote}} \\ + \quad \hyperlink{command.qed}{\mbox{\isa{\isacommand{qed}}}} \\ + \quad \hyperlink{command.fix}{\mbox{\isa{\isacommand{fix}}}}~\isa{{\isachardoublequote}\isactrlvec x{\isachardoublequote}}~\hyperlink{command.assume}{\mbox{\isa{\isacommand{assume}}}}~\isa{{\isachardoublequote}{\isasymguillemotleft}elimination\ case{\isasymguillemotright}\ \isactrlvec A\ \isactrlvec x{\isachardoublequote}} \\ + \end{tabular} + \medskip + + \[ + \infer[(\hyperlink{inference.elimination}{\mbox{\isa{elimination}}})]{\isa{{\isachardoublequote}{\isasymGamma}\ {\isasymturnstile}\ B{\isachardoublequote}}}{ + \begin{tabular}{rl} + \isa{{\isachardoublequote}case{\isacharcolon}{\isachardoublequote}} & + \isa{{\isachardoublequote}{\isasymGamma}\ {\isasymturnstile}\ {\isasymAnd}thesis{\isachardot}\ {\isacharparenleft}{\isasymAnd}\isactrlvec x{\isachardot}\ \isactrlvec A\ \isactrlvec x\ {\isasymLongrightarrow}\ thesis{\isacharparenright}\ {\isasymLongrightarrow}\ thesis{\isachardoublequote}} \\[0.2ex] + \isa{{\isachardoublequote}result{\isacharcolon}{\isachardoublequote}} & + \isa{{\isachardoublequote}{\isasymGamma}\ {\isasymunion}\ \isactrlvec A\ \isactrlvec y\ {\isasymturnstile}\ B{\isachardoublequote}} \\[0.2ex] + \end{tabular}} + \] + + \noindent Here the name ``\isa{thesis}'' is a specific convention + for an arbitrary-but-fixed proposition; in the primitive natural + deduction rules shown before we have occasionally used \isa{C}. + The whole statement of ``\hyperlink{command.obtain}{\mbox{\isa{\isacommand{obtain}}}}~\isa{x}~\hyperlink{keyword.where}{\mbox{\isa{\isakeyword{where}}}}~\isa{{\isachardoublequote}A\ x{\isachardoublequote}}'' may be read as a claim that \isa{{\isachardoublequote}A\ x{\isachardoublequote}} + may be assumed for some arbitrary-but-fixed \isa{{\isachardoublequote}x{\isachardoublequote}}. Also note + that ``\hyperlink{command.obtain}{\mbox{\isa{\isacommand{obtain}}}}~\isa{{\isachardoublequote}A\ {\isasymAND}\ B{\isachardoublequote}}'' without parameters + is similar to ``\hyperlink{command.have}{\mbox{\isa{\isacommand{have}}}}~\isa{{\isachardoublequote}A\ {\isasymAND}\ B{\isachardoublequote}}'', but the + latter involves multiple sub-goals. + + \medskip The subsequent Isar proof texts explain all context + elements introduced above using the formal proof language itself. + After finishing a local proof within a block, we indicate the + exported result via \hyperlink{command.note}{\mbox{\isa{\isacommand{note}}}}.% +\end{isamarkuptext}% +\isamarkuptrue% +% +\isadelimproof +% +\endisadelimproof +% +\isatagproof +% +\begin{minipage}[t]{0.4\textwidth} +\ \ \isacommand{{\isacharbraceleft}}\isamarkupfalse% +\isanewline +\ \ \ \ \isacommand{fix}\isamarkupfalse% +\ x\isanewline +\ \ \ \ \isacommand{have}\isamarkupfalse% +\ {\isachardoublequoteopen}B\ x{\isachardoublequoteclose}% +\endisatagproof +{\isafoldproof}% +% +\isadelimproof +% +\endisadelimproof +% +\isadelimnoproof +\ % +\endisadelimnoproof +% +\isatagnoproof +\isacommand{sorry}\isamarkupfalse% +% +\endisatagnoproof +{\isafoldnoproof}% +% +\isadelimnoproof +\isanewline +% +\endisadelimnoproof +% +\isadelimproof +\ \ % +\endisadelimproof +% +\isatagproof +\isacommand{{\isacharbraceright}}\isamarkupfalse% +\isanewline +\ \ \isacommand{note}\isamarkupfalse% +\ {\isacharbackquoteopen}{\isasymAnd}x{\isachardot}\ B\ x{\isacharbackquoteclose}% +\end{minipage}\quad\begin{minipage}[t]{0.4\textwidth} +\ \ \isacommand{{\isacharbraceleft}}\isamarkupfalse% +\isanewline +\ \ \ \ \isacommand{assume}\isamarkupfalse% +\ A\isanewline +\ \ \ \ \isacommand{have}\isamarkupfalse% +\ B% +\endisatagproof +{\isafoldproof}% +% +\isadelimproof +% +\endisadelimproof +% +\isadelimnoproof +\ % +\endisadelimnoproof +% +\isatagnoproof +\isacommand{sorry}\isamarkupfalse% +% +\endisatagnoproof +{\isafoldnoproof}% +% +\isadelimnoproof +\isanewline +% +\endisadelimnoproof +% +\isadelimproof +\ \ % +\endisadelimproof +% +\isatagproof +\isacommand{{\isacharbraceright}}\isamarkupfalse% +\isanewline +\ \ \isacommand{note}\isamarkupfalse% +\ {\isacharbackquoteopen}A\ {\isasymLongrightarrow}\ B{\isacharbackquoteclose}% +\end{minipage}\\[3ex]\begin{minipage}[t]{0.4\textwidth} +\ \ \isacommand{{\isacharbraceleft}}\isamarkupfalse% +\isanewline +\ \ \ \ \isacommand{def}\isamarkupfalse% +\ x\ {\isasymequiv}\ a\isanewline +\ \ \ \ \isacommand{have}\isamarkupfalse% +\ {\isachardoublequoteopen}B\ x{\isachardoublequoteclose}% +\endisatagproof +{\isafoldproof}% +% +\isadelimproof +% +\endisadelimproof +% +\isadelimnoproof +\ % +\endisadelimnoproof +% +\isatagnoproof +\isacommand{sorry}\isamarkupfalse% +% +\endisatagnoproof +{\isafoldnoproof}% +% +\isadelimnoproof +\isanewline +% +\endisadelimnoproof +% +\isadelimproof +\ \ % +\endisadelimproof +% +\isatagproof +\isacommand{{\isacharbraceright}}\isamarkupfalse% +\isanewline +\ \ \isacommand{note}\isamarkupfalse% +\ {\isacharbackquoteopen}B\ a{\isacharbackquoteclose}% +\end{minipage}\quad\begin{minipage}[t]{0.4\textwidth} +\ \ \isacommand{{\isacharbraceleft}}\isamarkupfalse% +\isanewline +\ \ \ \ \isacommand{obtain}\isamarkupfalse% +\ x\ \isakeyword{where}\ {\isachardoublequoteopen}A\ x{\isachardoublequoteclose}% +\endisatagproof +{\isafoldproof}% +% +\isadelimproof +% +\endisadelimproof +% +\isadelimnoproof +\ % +\endisadelimnoproof +% +\isatagnoproof +\isacommand{sorry}\isamarkupfalse% +% +\endisatagnoproof +{\isafoldnoproof}% +% +\isadelimnoproof +\isanewline +% +\endisadelimnoproof +% +\isadelimproof +\ \ \ \ % +\endisadelimproof +% +\isatagproof +\isacommand{have}\isamarkupfalse% +\ B% +\endisatagproof +{\isafoldproof}% +% +\isadelimproof +% +\endisadelimproof +% +\isadelimnoproof +\ % +\endisadelimnoproof +% +\isatagnoproof +\isacommand{sorry}\isamarkupfalse% +% +\endisatagnoproof +{\isafoldnoproof}% +% +\isadelimnoproof +\isanewline +% +\endisadelimnoproof +% +\isadelimproof +\ \ % +\endisadelimproof +% +\isatagproof +\isacommand{{\isacharbraceright}}\isamarkupfalse% +\isanewline +\ \ \isacommand{note}\isamarkupfalse% +\ {\isacharbackquoteopen}B{\isacharbackquoteclose}% +\end{minipage} +% +\endisatagproof +{\isafoldproof}% +% +\isadelimproof +% +\endisadelimproof +% +\begin{isamarkuptext}% +\bigskip\noindent This illustrates the meaning of Isar context + elements without goals getting in between.% +\end{isamarkuptext}% +\isamarkuptrue% +% +\isamarkupsubsection{Structured statements \label{sec:framework-stmt}% +} +\isamarkuptrue% +% +\begin{isamarkuptext}% +The category \isa{{\isachardoublequote}statement{\isachardoublequote}} of top-level theorem specifications + is defined as follows: + + \medskip + \begin{tabular}{rcl} + \isa{{\isachardoublequote}statement{\isachardoublequote}} & \isa{{\isachardoublequote}{\isasymequiv}{\isachardoublequote}} & \isa{{\isachardoublequote}name{\isacharcolon}\ props\ {\isasymAND}\ {\isasymdots}{\isachardoublequote}} \\ + & \isa{{\isachardoublequote}{\isacharbar}{\isachardoublequote}} & \isa{{\isachardoublequote}context\isactrlsup {\isacharasterisk}\ conclusion{\isachardoublequote}} \\[0.5ex] + + \isa{{\isachardoublequote}context{\isachardoublequote}} & \isa{{\isachardoublequote}{\isasymequiv}{\isachardoublequote}} & \isa{{\isachardoublequote}{\isasymFIXES}\ vars\ {\isasymAND}\ {\isasymdots}{\isachardoublequote}} \\ + & \isa{{\isachardoublequote}{\isacharbar}{\isachardoublequote}} & \isa{{\isachardoublequote}{\isasymASSUMES}\ name{\isacharcolon}\ props\ {\isasymAND}\ {\isasymdots}{\isachardoublequote}} \\ + + \isa{{\isachardoublequote}conclusion{\isachardoublequote}} & \isa{{\isachardoublequote}{\isasymequiv}{\isachardoublequote}} & \isa{{\isachardoublequote}{\isasymSHOWS}\ name{\isacharcolon}\ props\ {\isasymAND}\ {\isasymdots}{\isachardoublequote}} \\ + & \isa{{\isachardoublequote}{\isacharbar}{\isachardoublequote}} & \isa{{\isachardoublequote}{\isasymOBTAINS}\ vars\ {\isasymAND}\ {\isasymdots}\ {\isasymWHERE}\ name{\isacharcolon}\ props\ {\isasymAND}\ {\isasymdots}{\isachardoublequote}} \\ + & & \quad \isa{{\isachardoublequote}{\isasymBBAR}\ {\isasymdots}{\isachardoublequote}} \\ + \end{tabular} + + \medskip\noindent A simple \isa{{\isachardoublequote}statement{\isachardoublequote}} consists of named + propositions. The full form admits local context elements followed + by the actual conclusions, such as ``\hyperlink{keyword.fixes}{\mbox{\isa{\isakeyword{fixes}}}}~\isa{x}~\hyperlink{keyword.assumes}{\mbox{\isa{\isakeyword{assumes}}}}~\isa{{\isachardoublequote}A\ x{\isachardoublequote}}~\hyperlink{keyword.shows}{\mbox{\isa{\isakeyword{shows}}}}~\isa{{\isachardoublequote}B\ x{\isachardoublequote}}''. The final result emerges as a Pure rule after discharging + the context: \isa{{\isachardoublequote}{\isasymAnd}x{\isachardot}\ A\ x\ {\isasymLongrightarrow}\ B\ x{\isachardoublequote}}. + + The \hyperlink{keyword.obtains}{\mbox{\isa{\isakeyword{obtains}}}} variant is another abbreviation defined + below; unlike \hyperlink{command.obtain}{\mbox{\isa{\isacommand{obtain}}}} (cf.\ + \secref{sec:framework-context}) there may be several ``cases'' + separated by ``\isa{{\isachardoublequote}{\isasymBBAR}{\isachardoublequote}}'', each consisting of several + parameters (\isa{{\isachardoublequote}vars{\isachardoublequote}}) and several premises (\isa{{\isachardoublequote}props{\isachardoublequote}}). + This specifies multi-branch elimination rules. + + \medskip + \begin{tabular}{l} + \isa{{\isachardoublequote}{\isasymOBTAINS}\ \isactrlvec x\ {\isasymWHERE}\ \isactrlvec A\ \isactrlvec x\ \ \ {\isasymBBAR}\ \ \ {\isasymdots}\ \ \ {\isasymequiv}{\isachardoublequote}} \\[0.5ex] + \quad \isa{{\isachardoublequote}{\isasymFIXES}\ thesis{\isachardoublequote}} \\ + \quad \isa{{\isachardoublequote}{\isasymASSUMES}\ {\isacharbrackleft}intro{\isacharbrackright}{\isacharcolon}\ {\isasymAnd}\isactrlvec x{\isachardot}\ \isactrlvec A\ \isactrlvec x\ {\isasymLongrightarrow}\ thesis\ \ {\isasymAND}\ \ {\isasymdots}{\isachardoublequote}} \\ + \quad \isa{{\isachardoublequote}{\isasymSHOWS}\ thesis{\isachardoublequote}} \\ + \end{tabular} + \medskip + + Presenting structured statements in such an ``open'' format usually + simplifies the subsequent proof, because the outer structure of the + problem is already laid out directly. E.g.\ consider the following + canonical patterns for \isa{{\isachardoublequote}{\isasymSHOWS}{\isachardoublequote}} and \isa{{\isachardoublequote}{\isasymOBTAINS}{\isachardoublequote}}, + respectively:% +\end{isamarkuptext}% +\isamarkuptrue% +% +\begin{minipage}{0.5\textwidth} +\isacommand{theorem}\isamarkupfalse% +\isanewline +\ \ \isakeyword{fixes}\ x\ \isakeyword{and}\ y\isanewline +\ \ \isakeyword{assumes}\ {\isachardoublequoteopen}A\ x{\isachardoublequoteclose}\ \isakeyword{and}\ {\isachardoublequoteopen}B\ y{\isachardoublequoteclose}\isanewline +\ \ \isakeyword{shows}\ {\isachardoublequoteopen}C\ x\ y{\isachardoublequoteclose}\isanewline +% +\isadelimproof +% +\endisadelimproof +% +\isatagproof +\isacommand{proof}\isamarkupfalse% +\ {\isacharminus}\isanewline +\ \ \isacommand{from}\isamarkupfalse% +\ {\isacharbackquoteopen}A\ x{\isacharbackquoteclose}\ \isakeyword{and}\ {\isacharbackquoteopen}B\ y{\isacharbackquoteclose}\isanewline +\ \ \isacommand{show}\isamarkupfalse% +\ {\isachardoublequoteopen}C\ x\ y{\isachardoublequoteclose}% +\endisatagproof +{\isafoldproof}% +% +\isadelimproof +% +\endisadelimproof +% +\isadelimnoproof +\ % +\endisadelimnoproof +% +\isatagnoproof +\isacommand{sorry}\isamarkupfalse% +% +\endisatagnoproof +{\isafoldnoproof}% +% +\isadelimnoproof +\isanewline +% +\endisadelimnoproof +% +\isadelimproof +% +\endisadelimproof +% +\isatagproof +\isacommand{qed}\isamarkupfalse% +% +\endisatagproof +{\isafoldproof}% +% +\isadelimproof +% +\endisadelimproof +% +\end{minipage}\begin{minipage}{0.5\textwidth} +\isacommand{theorem}\isamarkupfalse% +\isanewline +\ \ \isakeyword{obtains}\ x\ \isakeyword{and}\ y\isanewline +\ \ \isakeyword{where}\ {\isachardoublequoteopen}A\ x{\isachardoublequoteclose}\ \isakeyword{and}\ {\isachardoublequoteopen}B\ y{\isachardoublequoteclose}\isanewline +% +\isadelimproof +% +\endisadelimproof +% +\isatagproof +\isacommand{proof}\isamarkupfalse% +\ {\isacharminus}\isanewline +\ \ \isacommand{have}\isamarkupfalse% +\ {\isachardoublequoteopen}A\ a{\isachardoublequoteclose}\ \isakeyword{and}\ {\isachardoublequoteopen}B\ b{\isachardoublequoteclose}% +\endisatagproof +{\isafoldproof}% +% +\isadelimproof +% +\endisadelimproof +% +\isadelimnoproof +\ % +\endisadelimnoproof +% +\isatagnoproof +\isacommand{sorry}\isamarkupfalse% +% +\endisatagnoproof +{\isafoldnoproof}% +% +\isadelimnoproof +\isanewline +% +\endisadelimnoproof +% +\isadelimproof +\ \ % +\endisadelimproof +% +\isatagproof +\isacommand{then}\isamarkupfalse% +\ \isacommand{show}\isamarkupfalse% +\ thesis\ \isacommand{{\isachardot}{\isachardot}}\isamarkupfalse% +\isanewline +\isacommand{qed}\isamarkupfalse% +% +\endisatagproof +{\isafoldproof}% +% +\isadelimproof +% +\endisadelimproof +% +\end{minipage} +% +\begin{isamarkuptext}% +\medskip\noindent Here local facts \isacharbackquoteopen\isa{{\isachardoublequote}A\ x{\isachardoublequote}}\isacharbackquoteclose\ and \isacharbackquoteopen\isa{{\isachardoublequote}B\ y{\isachardoublequote}}\isacharbackquoteclose\ are referenced immediately; there is no + need to decompose the logical rule structure again. In the second + proof the final ``\hyperlink{command.then}{\mbox{\isa{\isacommand{then}}}}~\hyperlink{command.show}{\mbox{\isa{\isacommand{show}}}}~\isa{thesis}~\hyperlink{command.ddot}{\mbox{\isa{\isacommand{{\isachardot}{\isachardot}}}}}'' involves the local rule case \isa{{\isachardoublequote}{\isasymAnd}x\ y{\isachardot}\ A\ x\ {\isasymLongrightarrow}\ B\ y\ {\isasymLongrightarrow}\ thesis{\isachardoublequote}} for the particular instance of terms \isa{{\isachardoublequote}a{\isachardoublequote}} and \isa{{\isachardoublequote}b{\isachardoublequote}} produced in the body.% +\end{isamarkuptext}% +\isamarkuptrue% +% +\isamarkupsubsection{Structured proof refinement \label{sec:framework-subproof}% +} +\isamarkuptrue% +% +\begin{isamarkuptext}% +By breaking up the grammar for the Isar proof language, we may + understand a proof text as a linear sequence of individual proof + commands. These are interpreted as transitions of the Isar virtual + machine (Isar/VM), which operates on a block-structured + configuration in single steps. This allows users to write proof + texts in an incremental manner, and inspect intermediate + configurations for debugging. + + The basic idea is analogous to evaluating algebraic expressions on a + stack machine: \isa{{\isachardoublequote}{\isacharparenleft}a\ {\isacharplus}\ b{\isacharparenright}\ {\isasymcdot}\ c{\isachardoublequote}} then corresponds to a sequence + of single transitions for each symbol \isa{{\isachardoublequote}{\isacharparenleft}{\isacharcomma}\ a{\isacharcomma}\ {\isacharplus}{\isacharcomma}\ b{\isacharcomma}\ {\isacharparenright}{\isacharcomma}\ {\isasymcdot}{\isacharcomma}\ c{\isachardoublequote}}. + In Isar the algebraic values are facts or goals, and the operations + are inferences. + + \medskip The Isar/VM state maintains a stack of nodes, each node + contains the local proof context, the linguistic mode, and a pending + goal (optional). The mode determines the type of transition that + may be performed next, it essentially alternates between forward and + backward reasoning, with an intermediate stage for chained facts + (see \figref{fig:isar-vm}). + + \begin{figure}[htb] + \begin{center} + \includegraphics[width=0.8\textwidth]{Thy/document/isar-vm} + \end{center} + \caption{Isar/VM modes}\label{fig:isar-vm} + \end{figure} + + For example, in \isa{{\isachardoublequote}state{\isachardoublequote}} mode Isar acts like a mathematical + scratch-pad, accepting declarations like \hyperlink{command.fix}{\mbox{\isa{\isacommand{fix}}}}, \hyperlink{command.assume}{\mbox{\isa{\isacommand{assume}}}}, and claims like \hyperlink{command.have}{\mbox{\isa{\isacommand{have}}}}, \hyperlink{command.show}{\mbox{\isa{\isacommand{show}}}}. A goal + statement changes the mode to \isa{{\isachardoublequote}prove{\isachardoublequote}}, which means that we + may now refine the problem via \hyperlink{command.unfolding}{\mbox{\isa{\isacommand{unfolding}}}} or \hyperlink{command.proof}{\mbox{\isa{\isacommand{proof}}}}. Then we are again in \isa{{\isachardoublequote}state{\isachardoublequote}} mode of a proof body, + which may issue \hyperlink{command.show}{\mbox{\isa{\isacommand{show}}}} statements to solve pending + sub-goals. A concluding \hyperlink{command.qed}{\mbox{\isa{\isacommand{qed}}}} will return to the original + \isa{{\isachardoublequote}state{\isachardoublequote}} mode one level upwards. The subsequent Isar/VM + trace indicates block structure, linguistic mode, goal state, and + inferences:% +\end{isamarkuptext}% +\isamarkuptrue% +% +\begingroup\footnotesize +% +\isadelimproof +% +\endisadelimproof +% +\isatagproof +% +\begin{minipage}[t]{0.18\textwidth} +\ \ \isacommand{have}\isamarkupfalse% +\ {\isachardoublequoteopen}A\ {\isasymlongrightarrow}\ B{\isachardoublequoteclose}\isanewline +\ \ \isacommand{proof}\isamarkupfalse% +\isanewline +\ \ \ \ \isacommand{assume}\isamarkupfalse% +\ A\isanewline +\ \ \ \ \isacommand{show}\isamarkupfalse% +\ B% +\endisatagproof +{\isafoldproof}% +% +\isadelimproof +\isanewline +% +\endisadelimproof +% +\isadelimnoproof +\ \ \ \ \ \ % +\endisadelimnoproof +% +\isatagnoproof +\isacommand{sorry}\isamarkupfalse% +% +\endisatagnoproof +{\isafoldnoproof}% +% +\isadelimnoproof +\isanewline +% +\endisadelimnoproof +% +\isadelimproof +\ \ % +\endisadelimproof +% +\isatagproof +\isacommand{qed}\isamarkupfalse% +% +\end{minipage}\quad +\begin{minipage}[t]{0.06\textwidth} +\isa{{\isachardoublequote}begin{\isachardoublequote}} \\ +\\ +\\ +\isa{{\isachardoublequote}begin{\isachardoublequote}} \\ +\isa{{\isachardoublequote}end{\isachardoublequote}} \\ +\isa{{\isachardoublequote}end{\isachardoublequote}} \\ +\end{minipage} +\begin{minipage}[t]{0.08\textwidth} +\isa{{\isachardoublequote}prove{\isachardoublequote}} \\ +\isa{{\isachardoublequote}state{\isachardoublequote}} \\ +\isa{{\isachardoublequote}state{\isachardoublequote}} \\ +\isa{{\isachardoublequote}prove{\isachardoublequote}} \\ +\isa{{\isachardoublequote}state{\isachardoublequote}} \\ +\isa{{\isachardoublequote}state{\isachardoublequote}} \\ +\end{minipage}\begin{minipage}[t]{0.35\textwidth} +\isa{{\isachardoublequote}{\isacharparenleft}A\ {\isasymlongrightarrow}\ B{\isacharparenright}\ {\isasymLongrightarrow}\ {\isacharhash}{\isacharparenleft}A\ {\isasymlongrightarrow}\ B{\isacharparenright}{\isachardoublequote}} \\ +\isa{{\isachardoublequote}{\isacharparenleft}A\ {\isasymLongrightarrow}\ B{\isacharparenright}\ {\isasymLongrightarrow}\ {\isacharhash}{\isacharparenleft}A\ {\isasymlongrightarrow}\ B{\isacharparenright}{\isachardoublequote}} \\ +\\ +\\ +\isa{{\isachardoublequote}{\isacharhash}{\isacharparenleft}A\ {\isasymlongrightarrow}\ B{\isacharparenright}{\isachardoublequote}} \\ +\isa{{\isachardoublequote}A\ {\isasymlongrightarrow}\ B{\isachardoublequote}} \\ +\end{minipage}\begin{minipage}[t]{0.4\textwidth} +\isa{{\isachardoublequote}{\isacharparenleft}init{\isacharparenright}{\isachardoublequote}} \\ +\isa{{\isachardoublequote}{\isacharparenleft}resolution\ impI{\isacharparenright}{\isachardoublequote}} \\ +\\ +\\ +\isa{{\isachardoublequote}{\isacharparenleft}refinement\ {\isacharhash}A\ {\isasymLongrightarrow}\ B{\isacharparenright}{\isachardoublequote}} \\ +\isa{{\isachardoublequote}{\isacharparenleft}finish{\isacharparenright}{\isachardoublequote}} \\ +\end{minipage} +% +\endisatagproof +{\isafoldproof}% +% +\isadelimproof +% +\endisadelimproof +% +\endgroup +% +\begin{isamarkuptext}% +\noindent Here the \hyperlink{inference.refinement}{\mbox{\isa{refinement}}} inference from + \secref{sec:framework-resolution} mediates composition of Isar + sub-proofs nicely. Observe that this principle incorporates some + degree of freedom in proof composition. In particular, the proof + body allows parameters and assumptions to be re-ordered, or commuted + according to Hereditary Harrop Form. Moreover, context elements + that are not used in a sub-proof may be omitted altogether. For + example:% +\end{isamarkuptext}% +\isamarkuptrue% +% +\begin{minipage}{0.5\textwidth} +% +\isadelimproof +% +\endisadelimproof +% +\isatagproof +\ \ \isacommand{have}\isamarkupfalse% +\ {\isachardoublequoteopen}{\isasymAnd}x\ y{\isachardot}\ A\ x\ {\isasymLongrightarrow}\ B\ y\ {\isasymLongrightarrow}\ C\ x\ y{\isachardoublequoteclose}\isanewline +\ \ \isacommand{proof}\isamarkupfalse% +\ {\isacharminus}\isanewline +\ \ \ \ \isacommand{fix}\isamarkupfalse% +\ x\ \isakeyword{and}\ y\isanewline +\ \ \ \ \isacommand{assume}\isamarkupfalse% +\ {\isachardoublequoteopen}A\ x{\isachardoublequoteclose}\ \isakeyword{and}\ {\isachardoublequoteopen}B\ y{\isachardoublequoteclose}\isanewline +\ \ \ \ \isacommand{show}\isamarkupfalse% +\ {\isachardoublequoteopen}C\ x\ y{\isachardoublequoteclose}% +\endisatagproof +{\isafoldproof}% +% +\isadelimproof +% +\endisadelimproof +% +\isadelimnoproof +\ % +\endisadelimnoproof +% +\isatagnoproof +\isacommand{sorry}\isamarkupfalse% +% +\endisatagnoproof +{\isafoldnoproof}% +% +\isadelimnoproof +\isanewline +% +\endisadelimnoproof +% +\isadelimproof +\ \ % +\endisadelimproof +% +\isatagproof +\isacommand{qed}\isamarkupfalse% +% +\end{minipage}\begin{minipage}{0.5\textwidth} +\ \ \isacommand{have}\isamarkupfalse% +\ {\isachardoublequoteopen}{\isasymAnd}x\ y{\isachardot}\ A\ x\ {\isasymLongrightarrow}\ B\ y\ {\isasymLongrightarrow}\ C\ x\ y{\isachardoublequoteclose}\isanewline +\ \ \isacommand{proof}\isamarkupfalse% +\ {\isacharminus}\isanewline +\ \ \ \ \isacommand{fix}\isamarkupfalse% +\ x\ \isacommand{assume}\isamarkupfalse% +\ {\isachardoublequoteopen}A\ x{\isachardoublequoteclose}\isanewline +\ \ \ \ \isacommand{fix}\isamarkupfalse% +\ y\ \isacommand{assume}\isamarkupfalse% +\ {\isachardoublequoteopen}B\ y{\isachardoublequoteclose}\isanewline +\ \ \ \ \isacommand{show}\isamarkupfalse% +\ {\isachardoublequoteopen}C\ x\ y{\isachardoublequoteclose}% +\endisatagproof +{\isafoldproof}% +% +\isadelimproof +% +\endisadelimproof +% +\isadelimnoproof +\ % +\endisadelimnoproof +% +\isatagnoproof +\isacommand{sorry}\isamarkupfalse% +% +\endisatagnoproof +{\isafoldnoproof}% +% +\isadelimnoproof +\isanewline +% +\endisadelimnoproof +% +\isadelimproof +\ \ % +\endisadelimproof +% +\isatagproof +\isacommand{qed}\isamarkupfalse% +% +\end{minipage}\\[3ex]\begin{minipage}{0.5\textwidth} +\ \ \isacommand{have}\isamarkupfalse% +\ {\isachardoublequoteopen}{\isasymAnd}x\ y{\isachardot}\ A\ x\ {\isasymLongrightarrow}\ B\ y\ {\isasymLongrightarrow}\ C\ x\ y{\isachardoublequoteclose}\isanewline +\ \ \isacommand{proof}\isamarkupfalse% +\ {\isacharminus}\isanewline +\ \ \ \ \isacommand{fix}\isamarkupfalse% +\ y\ \isacommand{assume}\isamarkupfalse% +\ {\isachardoublequoteopen}B\ y{\isachardoublequoteclose}\isanewline +\ \ \ \ \isacommand{fix}\isamarkupfalse% +\ x\ \isacommand{assume}\isamarkupfalse% +\ {\isachardoublequoteopen}A\ x{\isachardoublequoteclose}\isanewline +\ \ \ \ \isacommand{show}\isamarkupfalse% +\ {\isachardoublequoteopen}C\ x\ y{\isachardoublequoteclose}\ \isacommand{sorry}\isamarkupfalse% +\isanewline +\ \ \isacommand{qed}\isamarkupfalse% +% +\end{minipage}\begin{minipage}{0.5\textwidth} +\ \ \isacommand{have}\isamarkupfalse% +\ {\isachardoublequoteopen}{\isasymAnd}x\ y{\isachardot}\ A\ x\ {\isasymLongrightarrow}\ B\ y\ {\isasymLongrightarrow}\ C\ x\ y{\isachardoublequoteclose}\isanewline +\ \ \isacommand{proof}\isamarkupfalse% +\ {\isacharminus}\isanewline +\ \ \ \ \isacommand{fix}\isamarkupfalse% +\ y\ \isacommand{assume}\isamarkupfalse% +\ {\isachardoublequoteopen}B\ y{\isachardoublequoteclose}\isanewline +\ \ \ \ \isacommand{fix}\isamarkupfalse% +\ x\isanewline +\ \ \ \ \isacommand{show}\isamarkupfalse% +\ {\isachardoublequoteopen}C\ x\ y{\isachardoublequoteclose}\ \isacommand{sorry}\isamarkupfalse% +\isanewline +\ \ \isacommand{qed}\isamarkupfalse% +% +\endisatagproof +{\isafoldproof}% +% +\isadelimproof +% +\endisadelimproof +% +\end{minipage} +% +\begin{isamarkuptext}% +\medskip\noindent Such ``peephole optimizations'' of Isar texts are + practically important to improve readability, by rearranging + contexts elements according to the natural flow of reasoning in the + body, while still observing the overall scoping rules. + + \medskip This illustrates the basic idea of structured proof + processing in Isar. The main mechanisms are based on natural + deduction rule composition within the Pure framework. In + particular, there are no direct operations on goal states within the + proof body. Moreover, there is no hidden automated reasoning + involved, just plain unification.% +\end{isamarkuptext}% +\isamarkuptrue% +% +\isamarkupsubsection{Calculational reasoning \label{sec:framework-calc}% +} +\isamarkuptrue% +% +\begin{isamarkuptext}% +The existing Isar infrastructure is sufficiently flexible to support + calculational reasoning (chains of transitivity steps) as derived + concept. The generic proof elements introduced below depend on + rules declared as \hyperlink{attribute.trans}{\mbox{\isa{trans}}} in the context. It is left to + the object-logic to provide a suitable rule collection for mixed + relations of \isa{{\isachardoublequote}{\isacharequal}{\isachardoublequote}}, \isa{{\isachardoublequote}{\isacharless}{\isachardoublequote}}, \isa{{\isachardoublequote}{\isasymle}{\isachardoublequote}}, \isa{{\isachardoublequote}{\isasymsubset}{\isachardoublequote}}, + \isa{{\isachardoublequote}{\isasymsubseteq}{\isachardoublequote}} etc. Due to the flexibility of rule composition + (\secref{sec:framework-resolution}), substitution of equals by + equals is covered as well, even substitution of inequalities + involving monotonicity conditions; see also \cite[\S6]{Wenzel-PhD} + and \cite{Bauer-Wenzel:2001}. + + The generic calculational mechanism is based on the observation that + rules such as \isa{{\isachardoublequote}trans{\isacharcolon}{\isachardoublequote}}~\isa{{\isachardoublequote}x\ {\isacharequal}\ y\ {\isasymLongrightarrow}\ y\ {\isacharequal}\ z\ {\isasymLongrightarrow}\ x\ {\isacharequal}\ z{\isachardoublequote}} + proceed from the premises towards the conclusion in a deterministic + fashion. Thus we may reason in forward mode, feeding intermediate + results into rules selected from the context. The course of + reasoning is organized by maintaining a secondary fact called + ``\hyperlink{fact.calculation}{\mbox{\isa{calculation}}}'', apart from the primary ``\hyperlink{fact.this}{\mbox{\isa{this}}}'' + already provided by the Isar primitives. In the definitions below, + \hyperlink{attribute.OF}{\mbox{\isa{OF}}} refers to \hyperlink{inference.resolution}{\mbox{\isa{resolution}}} + (\secref{sec:framework-resolution}) with multiple rule arguments, + and \isa{{\isachardoublequote}trans{\isachardoublequote}} represents to a suitable rule from the context: + + \begin{matharray}{rcl} + \hyperlink{command.also}{\mbox{\isa{\isacommand{also}}}}\isa{{\isachardoublequote}\isactrlsub {\isadigit{0}}{\isachardoublequote}} & \equiv & \hyperlink{command.note}{\mbox{\isa{\isacommand{note}}}}~\isa{{\isachardoublequote}calculation\ {\isacharequal}\ this{\isachardoublequote}} \\ + \hyperlink{command.also}{\mbox{\isa{\isacommand{also}}}}\isa{{\isachardoublequote}\isactrlsub n\isactrlsub {\isacharplus}\isactrlsub {\isadigit{1}}{\isachardoublequote}} & \equiv & \hyperlink{command.note}{\mbox{\isa{\isacommand{note}}}}~\isa{{\isachardoublequote}calculation\ {\isacharequal}\ trans\ {\isacharbrackleft}OF\ calculation\ this{\isacharbrackright}{\isachardoublequote}} \\[0.5ex] + \hyperlink{command.finally}{\mbox{\isa{\isacommand{finally}}}} & \equiv & \hyperlink{command.also}{\mbox{\isa{\isacommand{also}}}}~\hyperlink{command.from}{\mbox{\isa{\isacommand{from}}}}~\isa{calculation} \\ + \end{matharray} + + \noindent The start of a calculation is determined implicitly in the + text: here \hyperlink{command.also}{\mbox{\isa{\isacommand{also}}}} sets \hyperlink{fact.calculation}{\mbox{\isa{calculation}}} to the current + result; any subsequent occurrence will update \hyperlink{fact.calculation}{\mbox{\isa{calculation}}} by + combination with the next result and a transitivity rule. The + calculational sequence is concluded via \hyperlink{command.finally}{\mbox{\isa{\isacommand{finally}}}}, where + the final result is exposed for use in a concluding claim. + + Here is a canonical proof pattern, using \hyperlink{command.have}{\mbox{\isa{\isacommand{have}}}} to + establish the intermediate results:% +\end{isamarkuptext}% +\isamarkuptrue% +% +\isadelimproof +% +\endisadelimproof +% +\isatagproof +\ \ \isacommand{have}\isamarkupfalse% +\ {\isachardoublequoteopen}a\ {\isacharequal}\ b{\isachardoublequoteclose}\ \isacommand{sorry}\isamarkupfalse% +\isanewline +\ \ \isacommand{also}\isamarkupfalse% +\ \isacommand{have}\isamarkupfalse% +\ {\isachardoublequoteopen}{\isasymdots}\ {\isacharequal}\ c{\isachardoublequoteclose}\ \isacommand{sorry}\isamarkupfalse% +\isanewline +\ \ \isacommand{also}\isamarkupfalse% +\ \isacommand{have}\isamarkupfalse% +\ {\isachardoublequoteopen}{\isasymdots}\ {\isacharequal}\ d{\isachardoublequoteclose}\ \isacommand{sorry}\isamarkupfalse% +\isanewline +\ \ \isacommand{finally}\isamarkupfalse% +\ \isacommand{have}\isamarkupfalse% +\ {\isachardoublequoteopen}a\ {\isacharequal}\ d{\isachardoublequoteclose}\ \isacommand{{\isachardot}}\isamarkupfalse% +% +\endisatagproof +{\isafoldproof}% +% +\isadelimproof +% +\endisadelimproof +% +\begin{isamarkuptext}% +\noindent The term ``\isa{{\isachardoublequote}{\isasymdots}{\isachardoublequote}}'' above is a special abbreviation + provided by the Isabelle/Isar syntax layer: it statically refers to + the right-hand side argument of the previous statement given in the + text. Thus it happens to coincide with relevant sub-expressions in + the calculational chain, but the exact correspondence is dependent + on the transitivity rules being involved. + + \medskip Symmetry rules such as \isa{{\isachardoublequote}x\ {\isacharequal}\ y\ {\isasymLongrightarrow}\ y\ {\isacharequal}\ x{\isachardoublequote}} are like + transitivities with only one premise. Isar maintains a separate + rule collection declared via the \hyperlink{attribute.sym}{\mbox{\isa{sym}}} attribute, to be + used in fact expressions ``\isa{{\isachardoublequote}a\ {\isacharbrackleft}symmetric{\isacharbrackright}{\isachardoublequote}}'', or single-step + proofs ``\hyperlink{command.assume}{\mbox{\isa{\isacommand{assume}}}}~\isa{{\isachardoublequote}x\ {\isacharequal}\ y{\isachardoublequote}}~\hyperlink{command.then}{\mbox{\isa{\isacommand{then}}}}~\hyperlink{command.have}{\mbox{\isa{\isacommand{have}}}}~\isa{{\isachardoublequote}y\ {\isacharequal}\ x{\isachardoublequote}}~\hyperlink{command.ddot}{\mbox{\isa{\isacommand{{\isachardot}{\isachardot}}}}}''.% +\end{isamarkuptext}% +\isamarkuptrue% +% +\isadelimtheory +% +\endisadelimtheory +% +\isatagtheory +\isacommand{end}\isamarkupfalse% +% +\endisatagtheory +{\isafoldtheory}% +% +\isadelimtheory +% +\endisadelimtheory +\end{isabellebody}% +%%% Local Variables: +%%% mode: latex +%%% TeX-master: "root" +%%% End: diff -r 419116f1157a -r e23770bc97c8 doc-src/IsarRef/Thy/document/Inner_Syntax.tex --- a/doc-src/IsarRef/Thy/document/Inner_Syntax.tex Thu Feb 26 08:44:44 2009 -0800 +++ b/doc-src/IsarRef/Thy/document/Inner_Syntax.tex Thu Feb 26 08:48:33 2009 -0800 @@ -3,8 +3,6 @@ \def\isabellecontext{Inner{\isacharunderscore}Syntax}% % \isadelimtheory -\isanewline -\isanewline % \endisadelimtheory % @@ -392,7 +390,7 @@ \end{matharray} \begin{rail} - ('notation' | 'no\_notation') target? mode? (nameref structmixfix + 'and') + ('notation' | 'no\_notation') target? mode? \\ (nameref structmixfix + 'and') ; \end{rail} @@ -551,13 +549,15 @@ & \isa{{\isachardoublequote}{\isacharbar}{\isachardoublequote}} & \isa{{\isachardoublequote}tid\ \ {\isacharbar}\ \ tvar\ \ {\isacharbar}\ \ {\isachardoublequote}}\verb|_| \\ & \isa{{\isachardoublequote}{\isacharbar}{\isachardoublequote}} & \isa{{\isachardoublequote}tid{\isachardoublequote}} \verb|::| \isa{{\isachardoublequote}sort\ \ {\isacharbar}\ \ tvar\ \ {\isachardoublequote}}\verb|::| \isa{{\isachardoublequote}sort\ \ {\isacharbar}\ \ {\isachardoublequote}}\verb|_| \verb|::| \isa{{\isachardoublequote}sort{\isachardoublequote}} \\ & \isa{{\isachardoublequote}{\isacharbar}{\isachardoublequote}} & \isa{{\isachardoublequote}id\ \ {\isacharbar}\ \ type\isactrlsup {\isacharparenleft}\isactrlsup {\isadigit{1}}\isactrlsup {\isadigit{0}}\isactrlsup {\isadigit{0}}\isactrlsup {\isadigit{0}}\isactrlsup {\isacharparenright}\ id\ \ {\isacharbar}\ \ {\isachardoublequote}}\verb|(| \isa{type} \verb|,| \isa{{\isachardoublequote}{\isasymdots}{\isachardoublequote}} \verb|,| \isa{type} \verb|)| \isa{id} \\ - & \isa{{\isachardoublequote}{\isacharbar}{\isachardoublequote}} & \isa{{\isachardoublequote}longid\ \ {\isacharbar}\ \ type\isactrlsup {\isacharparenleft}\isactrlsup {\isadigit{1}}\isactrlsup {\isadigit{0}}\isactrlsup {\isadigit{0}}\isactrlsup {\isadigit{0}}\isactrlsup {\isacharparenright}\ longid\ \ {\isacharbar}\ \ {\isachardoublequote}}\verb|(| \isa{type} \verb|,| \isa{{\isachardoublequote}{\isasymdots}{\isachardoublequote}} \verb|,| \isa{type} \verb|)| \isa{longid} \\ + & \isa{{\isachardoublequote}{\isacharbar}{\isachardoublequote}} & \isa{{\isachardoublequote}longid\ \ {\isacharbar}\ \ type\isactrlsup {\isacharparenleft}\isactrlsup {\isadigit{1}}\isactrlsup {\isadigit{0}}\isactrlsup {\isadigit{0}}\isactrlsup {\isadigit{0}}\isactrlsup {\isacharparenright}\ longid{\isachardoublequote}} \\ + & \isa{{\isachardoublequote}{\isacharbar}{\isachardoublequote}} & \verb|(| \isa{type} \verb|,| \isa{{\isachardoublequote}{\isasymdots}{\isachardoublequote}} \verb|,| \isa{type} \verb|)| \isa{longid} \\ & \isa{{\isachardoublequote}{\isacharbar}{\isachardoublequote}} & \isa{{\isachardoublequote}type\isactrlsup {\isacharparenleft}\isactrlsup {\isadigit{1}}\isactrlsup {\isacharparenright}{\isachardoublequote}} \verb|=>| \isa{type} & \isa{{\isachardoublequote}{\isacharparenleft}{\isadigit{0}}{\isacharparenright}{\isachardoublequote}} \\ & \isa{{\isachardoublequote}{\isacharbar}{\isachardoublequote}} & \isa{{\isachardoublequote}type\isactrlsup {\isacharparenleft}\isactrlsup {\isadigit{1}}\isactrlsup {\isacharparenright}{\isachardoublequote}} \isa{{\isachardoublequote}{\isasymRightarrow}{\isachardoublequote}} \isa{type} & \isa{{\isachardoublequote}{\isacharparenleft}{\isadigit{0}}{\isacharparenright}{\isachardoublequote}} \\ & \isa{{\isachardoublequote}{\isacharbar}{\isachardoublequote}} & \verb|[| \isa{type} \verb|,| \isa{{\isachardoublequote}{\isasymdots}{\isachardoublequote}} \verb|,| \isa{type} \verb|]| \verb|=>| \isa{type} & \isa{{\isachardoublequote}{\isacharparenleft}{\isadigit{0}}{\isacharparenright}{\isachardoublequote}} \\ & \isa{{\isachardoublequote}{\isacharbar}{\isachardoublequote}} & \verb|[| \isa{type} \verb|,| \isa{{\isachardoublequote}{\isasymdots}{\isachardoublequote}} \verb|,| \isa{type} \verb|]| \isa{{\isachardoublequote}{\isasymRightarrow}{\isachardoublequote}} \isa{type} & \isa{{\isachardoublequote}{\isacharparenleft}{\isadigit{0}}{\isacharparenright}{\isachardoublequote}} \\\\ - \indexdef{inner}{syntax}{sort}\hypertarget{syntax.inner.sort}{\hyperlink{syntax.inner.sort}{\mbox{\isa{sort}}}} & = & \isa{{\isachardoublequote}id\ \ {\isacharbar}\ \ longid\ \ {\isacharbar}\ \ {\isachardoublequote}}\verb|{}|\isa{{\isachardoublequote}\ \ {\isacharbar}\ \ {\isachardoublequote}}\verb|{| \isa{{\isachardoublequote}{\isacharparenleft}id\ {\isacharbar}\ longid{\isacharparenright}{\isachardoublequote}} \verb|,| \isa{{\isachardoublequote}{\isasymdots}{\isachardoublequote}} \verb|,| \isa{{\isachardoublequote}{\isacharparenleft}id\ {\isacharbar}\ longid{\isacharparenright}{\isachardoublequote}} \verb|}| \\ + \indexdef{inner}{syntax}{sort}\hypertarget{syntax.inner.sort}{\hyperlink{syntax.inner.sort}{\mbox{\isa{sort}}}} & = & \isa{{\isachardoublequote}id\ \ {\isacharbar}\ \ longid\ \ {\isacharbar}\ \ {\isachardoublequote}}\verb|{}| \\ + & \isa{{\isachardoublequote}{\isacharbar}{\isachardoublequote}} & \verb|{| \isa{{\isachardoublequote}{\isacharparenleft}id\ {\isacharbar}\ longid{\isacharparenright}{\isachardoublequote}} \verb|,| \isa{{\isachardoublequote}{\isasymdots}{\isachardoublequote}} \verb|,| \isa{{\isachardoublequote}{\isacharparenleft}id\ {\isacharbar}\ longid{\isacharparenright}{\isachardoublequote}} \verb|}| \\ \end{supertabular} \end{center} diff -r 419116f1157a -r e23770bc97c8 doc-src/IsarRef/Thy/document/Introduction.tex --- a/doc-src/IsarRef/Thy/document/Introduction.tex Thu Feb 26 08:44:44 2009 -0800 +++ b/doc-src/IsarRef/Thy/document/Introduction.tex Thu Feb 26 08:48:33 2009 -0800 @@ -3,8 +3,6 @@ \def\isabellecontext{Introduction}% % \isadelimtheory -\isanewline -\isanewline % \endisadelimtheory % @@ -32,27 +30,27 @@ The \emph{Isabelle} system essentially provides a generic infrastructure for building deductive systems (programmed in Standard ML), with a special focus on interactive theorem proving in - higher-order logics. In the olden days even end-users would refer - to certain ML functions (goal commands, tactics, tacticals etc.) to - pursue their everyday theorem proving tasks - \cite{isabelle-intro,isabelle-ref}. + higher-order logics. Many years ago, even end-users would refer to + certain ML functions (goal commands, tactics, tacticals etc.) to + pursue their everyday theorem proving tasks. In contrast \emph{Isar} provides an interpreted language environment of its own, which has been specifically tailored for the needs of theory and proof development. Compared to raw ML, the Isabelle/Isar top-level provides a more robust and comfortable development - platform, with proper support for theory development graphs, - single-step transactions with unlimited undo, etc. The - Isabelle/Isar version of the \emph{Proof~General} user interface - \cite{proofgeneral,Aspinall:TACAS:2000} provides an adequate - front-end for interactive theory and proof development in this - advanced theorem proving environment. + platform, with proper support for theory development graphs, managed + transactions with unlimited undo etc. The Isabelle/Isar version of + the \emph{Proof~General} user interface + \cite{proofgeneral,Aspinall:TACAS:2000} provides a decent front-end + for interactive theory and proof development in this advanced + theorem proving environment, even though it is somewhat biased + towards old-style proof scripts. \medskip Apart from the technical advances over bare-bones ML programming, the main purpose of the Isar language is to provide a conceptually different view on machine-checked proofs - \cite{Wenzel:1999:TPHOL,Wenzel-PhD}. ``Isar'' stands for - ``Intelligible semi-automated reasoning''. Drawing from both the + \cite{Wenzel:1999:TPHOL,Wenzel-PhD}. \emph{Isar} stands for + \emph{Intelligible semi-automated reasoning}. Drawing from both the traditions of informal mathematical proof texts and high-level programming languages, Isar offers a versatile environment for structured formal proof documents. Thus properly written Isar @@ -67,12 +65,12 @@ Despite its grand design of structured proof texts, Isar is able to assimilate the old tactical style as an ``improper'' sub-language. This provides an easy upgrade path for existing tactic scripts, as - well as additional means for interactive experimentation and - debugging of structured proofs. Isabelle/Isar supports a broad - range of proof styles, both readable and unreadable ones. + well as some means for interactive experimentation and debugging of + structured proofs. Isabelle/Isar supports a broad range of proof + styles, both readable and unreadable ones. - \medskip The Isabelle/Isar framework \cite{Wenzel:2006:Festschrift} - is generic and should work reasonably well for any Isabelle + \medskip The generic Isabelle/Isar framework (see + \chref{ch:isar-framework}) works reasonably well for any Isabelle object-logic that conforms to the natural deduction view of the Isabelle/Pure framework. Specific language elements introduced by the major object-logics are described in \chref{ch:hol} @@ -92,207 +90,6 @@ \end{isamarkuptext}% \isamarkuptrue% % -\isamarkupsection{User interfaces% -} -\isamarkuptrue% -% -\isamarkupsubsection{Terminal sessions% -} -\isamarkuptrue% -% -\begin{isamarkuptext}% -The Isabelle \texttt{tty} tool provides a very interface for running - the Isar interaction loop, with some support for command line - editing. For example: -\begin{ttbox} -isabelle tty\medskip -{\out Welcome to Isabelle/HOL (Isabelle2008)}\medskip -theory Foo imports Main begin; -definition foo :: nat where "foo == 1"; -lemma "0 < foo" by (simp add: foo_def); -end; -\end{ttbox} - - Any Isabelle/Isar command may be retracted by \hyperlink{command.undo}{\mbox{\isa{\isacommand{undo}}}}. - See the Isabelle/Isar Quick Reference (\appref{ap:refcard}) for a - comprehensive overview of available commands and other language - elements.% -\end{isamarkuptext}% -\isamarkuptrue% -% -\isamarkupsubsection{Emacs Proof General% -} -\isamarkuptrue% -% -\begin{isamarkuptext}% -Plain TTY-based interaction as above used to be quite feasible with - traditional tactic based theorem proving, but developing Isar - documents really demands some better user-interface support. The - Proof~General environment by David Aspinall - \cite{proofgeneral,Aspinall:TACAS:2000} offers a generic Emacs - interface for interactive theorem provers that organizes all the - cut-and-paste and forward-backward walk through the text in a very - neat way. In Isabelle/Isar, the current position within a partial - proof document is equally important than the actual proof state. - Thus Proof~General provides the canonical working environment for - Isabelle/Isar, both for getting acquainted (e.g.\ by replaying - existing Isar documents) and for production work.% -\end{isamarkuptext}% -\isamarkuptrue% -% -\isamarkupsubsubsection{Proof~General as default Isabelle interface% -} -\isamarkuptrue% -% -\begin{isamarkuptext}% -The Isabelle interface wrapper script provides an easy way to invoke - Proof~General (including XEmacs or GNU Emacs). The default - configuration of Isabelle is smart enough to detect the - Proof~General distribution in several canonical places (e.g.\ - \verb|$ISABELLE_HOME/contrib/ProofGeneral|). Thus the - capital \verb|Isabelle| executable would already refer to the - \verb|ProofGeneral/isar| interface without further ado. The - Isabelle interface script provides several options; pass \verb|-?| to see its usage. - - With the proper Isabelle interface setup, Isar documents may now be edited by - visiting appropriate theory files, e.g.\ -\begin{ttbox} -Isabelle \({\langle}isabellehome{\rangle}\)/src/HOL/Isar_examples/Summation.thy -\end{ttbox} - Beginners may note the tool bar for navigating forward and backward - through the text (this depends on the local Emacs installation). - Consult the Proof~General documentation \cite{proofgeneral} for - further basic command sequences, in particular ``\verb|C-c C-return|'' - and ``\verb|C-c u|''. - - \medskip Proof~General may be also configured manually by giving - Isabelle settings like this (see also \cite{isabelle-sys}): - -\begin{ttbox} -ISABELLE_INTERFACE=\$ISABELLE_HOME/contrib/ProofGeneral/isar/interface -PROOFGENERAL_OPTIONS="" -\end{ttbox} - You may have to change \verb|$ISABELLE_HOME/contrib/ProofGeneral| to the actual installation - directory of Proof~General. - - \medskip Apart from the Isabelle command line, defaults for - interface options may be given by the \verb|PROOFGENERAL_OPTIONS| - setting. For example, the Emacs executable to be used may be - configured in Isabelle's settings like this: -\begin{ttbox} -PROOFGENERAL_OPTIONS="-p xemacs-mule" -\end{ttbox} - - Occasionally, a user's \verb|~/.emacs| file contains code - that is incompatible with the (X)Emacs version used by - Proof~General, causing the interface startup to fail prematurely. - Here the \verb|-u false| option helps to get the interface - process up and running. Note that additional Lisp customization - code may reside in \verb|proofgeneral-settings.el| of - \verb|$ISABELLE_HOME/etc| or \verb|$ISABELLE_HOME_USER/etc|.% -\end{isamarkuptext}% -\isamarkuptrue% -% -\isamarkupsubsubsection{The X-Symbol package% -} -\isamarkuptrue% -% -\begin{isamarkuptext}% -Proof~General incorporates a version of the Emacs X-Symbol package - \cite{x-symbol}, which handles proper mathematical symbols displayed - on screen. Pass option \verb|-x true| to the Isabelle - interface script, or check the appropriate Proof~General menu - setting by hand. The main challenge of getting X-Symbol to work - properly is the underlying (semi-automated) X11 font setup. - - \medskip Using proper mathematical symbols in Isabelle theories can - be very convenient for readability of large formulas. On the other - hand, the plain ASCII sources easily become somewhat unintelligible. - For example, \isa{{\isachardoublequote}{\isasymLongrightarrow}{\isachardoublequote}} would appear as \verb|\| according - the default set of Isabelle symbols. Nevertheless, the Isabelle - document preparation system (see \chref{ch:document-prep}) will be - happy to print non-ASCII symbols properly. It is even possible to - invent additional notation beyond the display capabilities of Emacs - and X-Symbol.% -\end{isamarkuptext}% -\isamarkuptrue% -% -\isamarkupsection{Isabelle/Isar theories% -} -\isamarkuptrue% -% -\begin{isamarkuptext}% -Isabelle/Isar offers the following main improvements over classic - Isabelle. - - \begin{enumerate} - - \item A \emph{theory format} that integrates specifications and - proofs, supporting interactive development and unlimited undo - operation. - - \item A \emph{formal proof document language} designed to support - intelligible semi-automated reasoning. Instead of putting together - unreadable tactic scripts, the author is enabled to express the - reasoning in way that is close to usual mathematical practice. The - old tactical style has been assimilated as ``improper'' language - elements. - - \item A simple document preparation system, for typesetting formal - developments together with informal text. The resulting - hyper-linked PDF documents are equally well suited for WWW - presentation and as printed copies. - - \end{enumerate} - - The Isar proof language is embedded into the new theory format as a - proper sub-language. Proof mode is entered by stating some - \hyperlink{command.theorem}{\mbox{\isa{\isacommand{theorem}}}} or \hyperlink{command.lemma}{\mbox{\isa{\isacommand{lemma}}}} at the theory level, and - left again with the final conclusion (e.g.\ via \hyperlink{command.qed}{\mbox{\isa{\isacommand{qed}}}}). - A few theory specification mechanisms also require some proof, such - as HOL's \hyperlink{command.typedef}{\mbox{\isa{\isacommand{typedef}}}} which demands non-emptiness of the - representing sets.% -\end{isamarkuptext}% -\isamarkuptrue% -% -\isamarkupsection{How to write Isar proofs anyway? \label{sec:isar-howto}% -} -\isamarkuptrue% -% -\begin{isamarkuptext}% -This is one of the key questions, of course. First of all, the - tactic script emulation of Isabelle/Isar essentially provides a - clarified version of the very same unstructured proof style of - classic Isabelle. Old-time users should quickly become acquainted - with that (slightly degenerative) view of Isar. - - Writing \emph{proper} Isar proof texts targeted at human readers is - quite different, though. Experienced users of the unstructured - style may even have to unlearn some of their habits to master proof - composition in Isar. In contrast, new users with less experience in - old-style tactical proving, but a good understanding of mathematical - proof in general, often get started easier. - - \medskip The present text really is only a reference manual on - Isabelle/Isar, not a tutorial. Nevertheless, we will attempt to - give some clues of how the concepts introduced here may be put into - practice. Especially note that \appref{ap:refcard} provides a quick - reference card of the most common Isabelle/Isar language elements. - - Further issues concerning the Isar concepts are covered in the - literature - \cite{Wenzel:1999:TPHOL,Wiedijk:2000:MV,Bauer-Wenzel:2000:HB,Bauer-Wenzel:2001}. - The author's PhD thesis \cite{Wenzel-PhD} presently provides the - most complete exposition of Isar foundations, techniques, and - applications. A number of example applications are distributed with - Isabelle, and available via the Isabelle WWW library (e.g.\ - \url{http://isabelle.in.tum.de/library/}). The ``Archive of Formal - Proofs'' \url{http://afp.sourceforge.net/} also provides plenty of - examples, both in proper Isar proof style and unstructured tactic - scripts.% -\end{isamarkuptext}% -\isamarkuptrue% -% \isadelimtheory % \endisadelimtheory diff -r 419116f1157a -r e23770bc97c8 doc-src/IsarRef/Thy/document/Outer_Syntax.tex --- a/doc-src/IsarRef/Thy/document/Outer_Syntax.tex Thu Feb 26 08:44:44 2009 -0800 +++ b/doc-src/IsarRef/Thy/document/Outer_Syntax.tex Thu Feb 26 08:48:33 2009 -0800 @@ -185,10 +185,10 @@ Isabelle as \verb|\|. There are infinitely many Isabelle symbols like this, although proper presentation is left to front-end tools such as {\LaTeX} or Proof~General with the X-Symbol package. - A list of standard Isabelle symbols that work well with these tools - is given in \appref{app:symbols}. Note that \verb|\| does - not belong to the \isa{letter} category, since it is already used - differently in the Pure term language.% + A list of predefined Isabelle symbols that work well with these + tools is given in \appref{app:symbols}. Note that \verb|\| + does not belong to the \isa{letter} category, since it is already + used differently in the Pure term language.% \end{isamarkuptext}% \isamarkuptrue% % diff -r 419116f1157a -r e23770bc97c8 doc-src/IsarRef/Thy/document/Proof.tex --- a/doc-src/IsarRef/Thy/document/Proof.tex Thu Feb 26 08:44:44 2009 -0800 +++ b/doc-src/IsarRef/Thy/document/Proof.tex Thu Feb 26 08:48:33 2009 -0800 @@ -3,8 +3,6 @@ \def\isabellecontext{Proof}% % \isadelimtheory -\isanewline -\isanewline % \endisadelimtheory % @@ -20,7 +18,7 @@ % \endisadelimtheory % -\isamarkupchapter{Proofs% +\isamarkupchapter{Proofs \label{ch:proofs}% } \isamarkuptrue% % @@ -28,8 +26,8 @@ Proof commands perform transitions of Isar/VM machine configurations, which are block-structured, consisting of a stack of nodes with three main components: logical proof context, current - facts, and open goals. Isar/VM transitions are \emph{typed} - according to the following three different modes of operation: + facts, and open goals. Isar/VM transitions are typed according to + the following three different modes of operation: \begin{description} @@ -49,13 +47,17 @@ \end{description} - The proof mode indicator may be read as a verb telling the writer - what kind of operation may be performed next. The corresponding - typings of proof commands restricts the shape of well-formed proof - texts to particular command sequences. So dynamic arrangements of - commands eventually turn out as static texts of a certain structure. - \Appref{ap:refcard} gives a simplified grammar of the overall - (extensible) language emerging that way.% + The proof mode indicator may be understood as an instruction to the + writer, telling what kind of operation may be performed next. The + corresponding typings of proof commands restricts the shape of + well-formed proof texts to particular command sequences. So dynamic + arrangements of commands eventually turn out as static texts of a + certain structure. + + \Appref{ap:refcard} gives a simplified grammar of the (extensible) + language emerging that way from the different types of proof + commands. The main ideas of the overall Isar framework are + explained in \chref{ch:isar-framework}.% \end{isamarkuptext}% \isamarkuptrue% % @@ -966,7 +968,7 @@ \begin{matharray}{l} \isa{{\isachardoublequote}{\isasymlangle}using\ b\isactrlsub {\isadigit{1}}\ {\isasymdots}\ b\isactrlsub k{\isasymrangle}{\isachardoublequote}}~~\hyperlink{command.obtain}{\mbox{\isa{\isacommand{obtain}}}}~\isa{{\isachardoublequote}x\isactrlsub {\isadigit{1}}\ {\isasymdots}\ x\isactrlsub m\ {\isasymWHERE}\ a{\isacharcolon}\ {\isasymphi}\isactrlsub {\isadigit{1}}\ {\isasymdots}\ {\isasymphi}\isactrlsub n\ \ {\isasymlangle}proof{\isasymrangle}\ {\isasymequiv}{\isachardoublequote}} \\[1ex] \quad \hyperlink{command.have}{\mbox{\isa{\isacommand{have}}}}~\isa{{\isachardoublequote}{\isasymAnd}thesis{\isachardot}\ {\isacharparenleft}{\isasymAnd}x\isactrlsub {\isadigit{1}}\ {\isasymdots}\ x\isactrlsub m{\isachardot}\ {\isasymphi}\isactrlsub {\isadigit{1}}\ {\isasymLongrightarrow}\ {\isasymdots}\ {\isasymphi}\isactrlsub n\ {\isasymLongrightarrow}\ thesis{\isacharparenright}\ {\isasymLongrightarrow}\ thesis{\isachardoublequote}} \\ - \quad \hyperlink{command.proof}{\mbox{\isa{\isacommand{proof}}}}~\isa{succeed} \\ + \quad \hyperlink{command.proof}{\mbox{\isa{\isacommand{proof}}}}~\hyperlink{method.succeed}{\mbox{\isa{succeed}}} \\ \qquad \hyperlink{command.fix}{\mbox{\isa{\isacommand{fix}}}}~\isa{thesis} \\ \qquad \hyperlink{command.assume}{\mbox{\isa{\isacommand{assume}}}}~\isa{{\isachardoublequote}that\ {\isacharbrackleft}Pure{\isachardot}intro{\isacharquery}{\isacharbrackright}{\isacharcolon}\ {\isasymAnd}x\isactrlsub {\isadigit{1}}\ {\isasymdots}\ x\isactrlsub m{\isachardot}\ {\isasymphi}\isactrlsub {\isadigit{1}}\ {\isasymLongrightarrow}\ {\isasymdots}\ {\isasymphi}\isactrlsub n\ {\isasymLongrightarrow}\ thesis{\isachardoublequote}} \\ \qquad \hyperlink{command.then}{\mbox{\isa{\isacommand{then}}}}~\hyperlink{command.show}{\mbox{\isa{\isacommand{show}}}}~\isa{thesis} \\ diff -r 419116f1157a -r e23770bc97c8 doc-src/IsarRef/Thy/document/Quick_Reference.tex --- a/doc-src/IsarRef/Thy/document/Quick_Reference.tex Thu Feb 26 08:44:44 2009 -0800 +++ b/doc-src/IsarRef/Thy/document/Quick_Reference.tex Thu Feb 26 08:48:33 2009 -0800 @@ -52,7 +52,7 @@ \begin{tabular}{rcl} \isa{{\isachardoublequote}theory{\isasymdash}stmt{\isachardoublequote}} & = & \hyperlink{command.theorem}{\mbox{\isa{\isacommand{theorem}}}}~\isa{{\isachardoublequote}name{\isacharcolon}\ props\ proof\ \ {\isacharbar}{\isachardoublequote}}~~\hyperlink{command.definition}{\mbox{\isa{\isacommand{definition}}}}~\isa{{\isachardoublequote}{\isasymdots}\ \ {\isacharbar}\ \ {\isasymdots}{\isachardoublequote}} \\[1ex] - \isa{{\isachardoublequote}proof{\isachardoublequote}} & = & \isa{{\isachardoublequote}prfx\isactrlsup {\isacharasterisk}{\isachardoublequote}}~\hyperlink{command.proof}{\mbox{\isa{\isacommand{proof}}}}~\isa{{\isachardoublequote}method\ stmt\isactrlsup {\isacharasterisk}{\isachardoublequote}}~\hyperlink{command.qed}{\mbox{\isa{\isacommand{qed}}}}~\isa{method} \\ + \isa{{\isachardoublequote}proof{\isachardoublequote}} & = & \isa{{\isachardoublequote}prfx\isactrlsup {\isacharasterisk}{\isachardoublequote}}~\hyperlink{command.proof}{\mbox{\isa{\isacommand{proof}}}}~\isa{{\isachardoublequote}method\isactrlsup {\isacharquery}\ stmt\isactrlsup {\isacharasterisk}{\isachardoublequote}}~\hyperlink{command.qed}{\mbox{\isa{\isacommand{qed}}}}~\isa{{\isachardoublequote}method\isactrlsup {\isacharquery}{\isachardoublequote}} \\ & \isa{{\isachardoublequote}{\isacharbar}{\isachardoublequote}} & \isa{{\isachardoublequote}prfx\isactrlsup {\isacharasterisk}{\isachardoublequote}}~\hyperlink{command.done}{\mbox{\isa{\isacommand{done}}}} \\[1ex] \isa{prfx} & = & \hyperlink{command.apply}{\mbox{\isa{\isacommand{apply}}}}~\isa{method} \\ & \isa{{\isachardoublequote}{\isacharbar}{\isachardoublequote}} & \hyperlink{command.using}{\mbox{\isa{\isacommand{using}}}}~\isa{{\isachardoublequote}facts{\isachardoublequote}} \\ diff -r 419116f1157a -r e23770bc97c8 doc-src/IsarRef/Thy/document/Spec.tex --- a/doc-src/IsarRef/Thy/document/Spec.tex Thu Feb 26 08:44:44 2009 -0800 +++ b/doc-src/IsarRef/Thy/document/Spec.tex Thu Feb 26 08:48:33 2009 -0800 @@ -22,6 +22,23 @@ } \isamarkuptrue% % +\begin{isamarkuptext}% +The Isabelle/Isar theory format integrates specifications and + proofs, supporting interactive development with unlimited undo + operation. There is an integrated document preparation system (see + \chref{ch:document-prep}), for typesetting formal developments + together with informal text. The resulting hyper-linked PDF + documents can be used both for WWW presentation and printed copies. + + The Isar proof language (see \chref{ch:proofs}) is embedded into the + theory language as a proper sub-language. Proof mode is entered by + stating some \hyperlink{command.theorem}{\mbox{\isa{\isacommand{theorem}}}} or \hyperlink{command.lemma}{\mbox{\isa{\isacommand{lemma}}}} at the theory + level, and left again with the final conclusion (e.g.\ via \hyperlink{command.qed}{\mbox{\isa{\isacommand{qed}}}}). Some theory specification mechanisms also require a proof, + such as \hyperlink{command.typedef}{\mbox{\isa{\isacommand{typedef}}}} in HOL, which demands non-emptiness of + the representing sets.% +\end{isamarkuptext}% +\isamarkuptrue% +% \isamarkupsection{Defining theories \label{sec:begin-thy}% } \isamarkuptrue% @@ -127,8 +144,9 @@ \hyperlink{command.global.end}{\mbox{\isa{\isacommand{end}}}} has a different meaning: it concludes the theory itself (\secref{sec:begin-thy}). - \item \isa{{\isachardoublequote}{\isacharparenleft}{\isasymIN}\ c{\isacharparenright}{\isachardoublequote}} given after any local theory command - specifies an immediate target, e.g.\ ``\hyperlink{command.definition}{\mbox{\isa{\isacommand{definition}}}}~\isa{{\isachardoublequote}{\isacharparenleft}{\isasymIN}\ c{\isacharparenright}\ {\isasymdots}{\isachardoublequote}}'' or ``\hyperlink{command.theorem}{\mbox{\isa{\isacommand{theorem}}}}~\isa{{\isachardoublequote}{\isacharparenleft}{\isasymIN}\ c{\isacharparenright}\ {\isasymdots}{\isachardoublequote}}''. This works both in a local or + \item \isa{{\isachardoublequote}{\isacharparenleft}{\isachardoublequote}}\indexdef{}{keyword}{in}\hypertarget{keyword.in}{\hyperlink{keyword.in}{\mbox{\isa{\isakeyword{in}}}}}~\isa{{\isachardoublequote}c{\isacharparenright}{\isachardoublequote}} given after any + local theory command specifies an immediate target, e.g.\ + ``\hyperlink{command.definition}{\mbox{\isa{\isacommand{definition}}}}~\isa{{\isachardoublequote}{\isacharparenleft}{\isasymIN}\ c{\isacharparenright}\ {\isasymdots}{\isachardoublequote}}'' or ``\hyperlink{command.theorem}{\mbox{\isa{\isacommand{theorem}}}}~\isa{{\isachardoublequote}{\isacharparenleft}{\isasymIN}\ c{\isacharparenright}\ {\isasymdots}{\isachardoublequote}}''. This works both in a local or global theory context; the current target context will be suspended for this command only. Note that ``\isa{{\isachardoublequote}{\isacharparenleft}{\isasymIN}\ {\isacharminus}{\isacharparenright}{\isachardoublequote}}'' will always produce a global result independently of the current target @@ -1178,7 +1196,7 @@ \end{description} - See \hyperlink{file.~~/src/FOL/ex/IffOracle.thy}{\mbox{\isa{\isatt{{\isachartilde}{\isachartilde}{\isacharslash}src{\isacharslash}FOL{\isacharslash}ex{\isacharslash}IffOracle{\isachardot}thy}}}} for a worked example of + See \hyperlink{file.~~/src/FOL/ex/Iff-Oracle.thy}{\mbox{\isa{\isatt{{\isachartilde}{\isachartilde}{\isacharslash}src{\isacharslash}FOL{\isacharslash}ex{\isacharslash}Iff{\isacharunderscore}Oracle{\isachardot}thy}}}} for a worked example of defining a new primitive rule as oracle, and turning it into a proof method.% \end{isamarkuptext}% diff -r 419116f1157a -r e23770bc97c8 doc-src/IsarRef/Thy/document/Symbols.tex --- a/doc-src/IsarRef/Thy/document/Symbols.tex Thu Feb 26 08:44:44 2009 -0800 +++ b/doc-src/IsarRef/Thy/document/Symbols.tex Thu Feb 26 08:48:33 2009 -0800 @@ -20,7 +20,7 @@ % \endisadelimtheory % -\isamarkupchapter{Standard Isabelle symbols \label{app:symbols}% +\isamarkupchapter{Predefined Isabelle symbols \label{app:symbols}% } \isamarkuptrue% % diff -r 419116f1157a -r e23770bc97c8 doc-src/IsarRef/Thy/document/isar-vm.eps --- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/doc-src/IsarRef/Thy/document/isar-vm.eps Thu Feb 26 08:48:33 2009 -0800 @@ -0,0 +1,2694 @@ +%!PS-Adobe-3.0 EPSF-3.0 +%%Creator: inkscape 0.46 +%%Pages: 1 +%%Orientation: Portrait +%%BoundingBox: 0 0 435 173 +%%HiResBoundingBox: 0 0 435 173 +%%EndComments +%%BeginSetup +%%EndSetup +%%Page: 1 1 +0 173 translate +0.8 -0.8 scale +0 0 0 setrgbcolor +[] 0 setdash +1 setlinewidth +0 setlinejoin +0 setlinecap +gsave [1 0 0 1 0 0] concat +gsave [1 0 0 1 -44.641342 -76.87234] concat +gsave [1 0 0 1 70.838012 79.725562] concat +0 0 0 setrgbcolor +[] 0 setdash +0.99921262 setlinewidth +1 setlinejoin +1 setlinecap +newpath +229.77649 131.52507 moveto +265.28729 131.52507 lineto +275.08072 131.52507 282.96496 139.40931 282.96496 149.20274 curveto +282.96496 166.99701 lineto +282.96496 176.79043 275.08072 184.67467 265.28729 184.67467 curveto +229.77649 184.67467 lineto +219.98306 184.67467 212.09882 176.79043 212.09882 166.99701 curveto +212.09882 149.20274 lineto +212.09882 139.40931 219.98306 131.52507 229.77649 131.52507 curveto +closepath +stroke +gsave +0 0 0 setrgbcolor +newpath +231.92252 155.58815 moveto +231.92252 157.8694 lineto +231.5423 157.60899 231.15949 157.41628 230.77408 157.29128 curveto +230.39386 157.16628 229.99803 157.10378 229.58658 157.10378 curveto +228.80532 157.10378 228.19595 157.33295 227.75845 157.79128 curveto +227.32616 158.24441 227.11001 158.87982 227.11002 159.69753 curveto +227.11001 160.51524 227.32616 161.15326 227.75845 161.61159 curveto +228.19595 162.06471 228.80532 162.29128 229.58658 162.29128 curveto +230.02407 162.29128 230.43813 162.22617 230.82877 162.09596 curveto +231.22459 161.96576 231.58917 161.77305 231.92252 161.51784 curveto +231.92252 163.8069 lineto +231.48501 163.96836 231.0397 164.08815 230.58658 164.16628 curveto +230.13866 164.24961 229.68813 164.29127 229.23502 164.29128 curveto +227.65689 164.29127 226.42251 163.88763 225.53189 163.08034 curveto +224.64126 162.26784 224.19595 161.14024 224.19595 159.69753 curveto +224.19595 158.25482 224.64126 157.12982 225.53189 156.32253 curveto +226.42251 155.51003 227.65689 155.10378 229.23502 155.10378 curveto +229.69334 155.10378 230.14386 155.14545 230.58658 155.22878 curveto +231.03449 155.30691 231.4798 155.4267 231.92252 155.58815 curveto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +243.14908 158.73659 moveto +243.14908 164.06471 lineto +240.33658 164.06471 lineto +240.33658 163.19753 lineto +240.33658 160.00221 lineto +240.33657 159.23659 240.31834 158.71055 240.28189 158.42409 curveto +240.25063 158.13764 240.19334 157.9267 240.11002 157.79128 curveto +240.00063 157.60899 239.8522 157.46836 239.6647 157.3694 curveto +239.4772 157.26524 239.26366 157.21316 239.02408 157.21315 curveto +238.44074 157.21316 237.98241 157.43972 237.64908 157.89284 curveto +237.31574 158.34076 237.14907 158.96316 237.14908 159.76003 curveto +237.14908 164.06471 lineto +234.3522 164.06471 lineto +234.3522 151.90846 lineto +237.14908 151.90846 lineto +237.14908 156.59596 lineto +237.57095 156.08555 238.01887 155.71055 238.49283 155.47096 curveto +238.96678 155.22618 239.49022 155.10378 240.06314 155.10378 curveto +241.07355 155.10378 241.83917 155.41368 242.36002 156.03346 curveto +242.88605 156.65326 243.14907 157.5543 243.14908 158.73659 curveto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +249.68033 160.12721 moveto +249.09699 160.12722 248.65689 160.22617 248.36002 160.42409 curveto +248.06835 160.62201 247.92251 160.91367 247.92252 161.29909 curveto +247.92251 161.65326 248.0397 161.9319 248.27408 162.13503 curveto +248.51366 162.33294 248.84439 162.4319 249.26627 162.4319 curveto +249.7923 162.4319 250.23501 162.2444 250.59439 161.8694 curveto +250.95376 161.48919 251.13345 161.01524 251.13345 160.44753 curveto +251.13345 160.12721 lineto +249.68033 160.12721 lineto +253.95377 159.07253 moveto +253.95377 164.06471 lineto +251.13345 164.06471 lineto +251.13345 162.76784 lineto +250.75845 163.29909 250.33657 163.68711 249.86783 163.9319 curveto +249.39907 164.17148 248.82876 164.29127 248.15689 164.29128 curveto +247.25064 164.29127 246.51366 164.02825 245.94595 163.50221 curveto +245.38345 162.97096 245.1022 162.28346 245.1022 161.43971 curveto +245.1022 160.41367 245.45376 159.66107 246.15689 159.1819 curveto +246.86522 158.70274 247.9746 158.46316 249.48502 158.46315 curveto +251.13345 158.46315 lineto +251.13345 158.2444 lineto +251.13345 157.8017 250.95897 157.47878 250.61002 157.27565 curveto +250.26105 157.06732 249.71678 156.96316 248.9772 156.96315 curveto +248.37824 156.96316 247.82095 157.02305 247.30533 157.14284 curveto +246.7897 157.26264 246.31053 157.44232 245.86783 157.6819 curveto +245.86783 155.54909 lineto +246.46678 155.40326 247.06835 155.29389 247.67252 155.22096 curveto +248.27668 155.14285 248.88084 155.10378 249.48502 155.10378 curveto +251.06313 155.10378 252.20115 155.41628 252.89908 156.04128 curveto +253.60219 156.66107 253.95376 157.67149 253.95377 159.07253 curveto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +256.57095 155.31471 moveto +259.36783 155.31471 lineto +259.36783 164.06471 lineto +256.57095 164.06471 lineto +256.57095 155.31471 lineto +256.57095 151.90846 moveto +259.36783 151.90846 lineto +259.36783 154.18971 lineto +256.57095 154.18971 lineto +256.57095 151.90846 lineto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +270.86783 158.73659 moveto +270.86783 164.06471 lineto +268.05533 164.06471 lineto +268.05533 163.19753 lineto +268.05533 159.98659 lineto +268.05532 159.23138 268.03709 158.71055 268.00064 158.42409 curveto +267.96938 158.13764 267.91209 157.9267 267.82877 157.79128 curveto +267.71938 157.60899 267.57095 157.46836 267.38345 157.3694 curveto +267.19595 157.26524 266.98241 157.21316 266.74283 157.21315 curveto +266.15949 157.21316 265.70116 157.43972 265.36783 157.89284 curveto +265.03449 158.34076 264.86782 158.96316 264.86783 159.76003 curveto +264.86783 164.06471 lineto +262.07095 164.06471 lineto +262.07095 155.31471 lineto +264.86783 155.31471 lineto +264.86783 156.59596 lineto +265.2897 156.08555 265.73762 155.71055 266.21158 155.47096 curveto +266.68553 155.22618 267.20897 155.10378 267.78189 155.10378 curveto +268.7923 155.10378 269.55792 155.41368 270.07877 156.03346 curveto +270.6048 156.65326 270.86782 157.5543 270.86783 158.73659 curveto +fill +grestore +grestore +0 0 0 setrgbcolor +[] 0 setdash +0.99921262 setlinewidth +0 setlinejoin +0 setlinecap +newpath +424.72469 236.82544 moveto +356.83209 236.82544 lineto +356.83209 236.82544 lineto +stroke +gsave [-0.39968505 4.8945685e-17 -4.8945685e-17 -0.39968505 356.83209 236.82544] concat +gsave +0 0 0 setrgbcolor +newpath +5.77 0 moveto +-2.88 5 lineto +-2.88 -5 lineto +5.77 0 lineto +closepath +eofill +grestore +0 0 0 setrgbcolor +[] 0 setdash +1.25 setlinewidth +0 setlinejoin +0 setlinecap +newpath +5.77 0 moveto +-2.88 5 lineto +-2.88 -5 lineto +5.77 0 lineto +closepath +stroke +grestore +0 0 0 setrgbcolor +[] 0 setdash +0.99921268 setlinewidth +0 setlinejoin +0 setlinecap +newpath +282.35183 236.82544 moveto +215.11403 236.82544 lineto +215.11403 236.82544 lineto +stroke +gsave [-0.39968507 4.8945688e-17 -4.8945688e-17 -0.39968507 215.11403 236.82544] concat +gsave +0 0 0 setrgbcolor +newpath +5.77 0 moveto +-2.88 5 lineto +-2.88 -5 lineto +5.77 0 lineto +closepath +eofill +grestore +0 0 0 setrgbcolor +[] 0 setdash +1.25 setlinewidth +0 setlinejoin +0 setlinecap +newpath +5.77 0 moveto +-2.88 5 lineto +-2.88 -5 lineto +5.77 0 lineto +closepath +stroke +grestore +0 0 0 setrgbcolor +[] 0 setdash +0.99999994 setlinewidth +0 setlinejoin +0 setlinecap +newpath +424.69726 192.5341 moveto +215.13005 192.5341 lineto +stroke +gsave [-0.39999998 4.8984251e-17 -4.8984251e-17 -0.39999998 215.13005 192.5341] concat +gsave +0 0 0 setrgbcolor +newpath +5.77 0 moveto +-2.88 5 lineto +-2.88 -5 lineto +5.77 0 lineto +closepath +eofill +grestore +0 0 0 setrgbcolor +[] 0 setdash +1.25 setlinewidth +0 setlinejoin +0 setlinecap +newpath +5.77 0 moveto +-2.88 5 lineto +-2.88 -5 lineto +5.77 0 lineto +closepath +stroke +grestore +0 0 0 setrgbcolor +[] 0 setdash +1 setlinewidth +0 setlinejoin +0 setlinecap +newpath +211.98429 148.24276 moveto +422.13162 148.24276 lineto +stroke +gsave [0.4 0 0 0.4 422.13162 148.24276] concat +gsave +0 0 0 setrgbcolor +newpath +5.77 0 moveto +-2.88 5 lineto +-2.88 -5 lineto +5.77 0 lineto +closepath +eofill +grestore +0 0 0 setrgbcolor +[] 0 setdash +1.25 setlinewidth +0 setlinejoin +0 setlinecap +newpath +5.77 0 moveto +-2.88 5 lineto +-2.88 -5 lineto +5.77 0 lineto +closepath +stroke +grestore +gsave [1 0 0 1 70.866146 78.725567] concat +0 0 0 setrgbcolor +[] 0 setdash +0.99921262 setlinewidth +1 setlinejoin +1 setlinecap +newpath +88.044201 42.942394 moveto +123.555 42.942394 lineto +133.34843 42.942394 141.23267 50.826635 141.23267 60.620064 curveto +141.23267 166.99701 lineto +141.23267 176.79044 133.34843 184.67468 123.555 184.67468 curveto +88.044201 184.67468 lineto +78.250772 184.67468 70.366531 176.79044 70.366531 166.99701 curveto +70.366531 60.620064 lineto +70.366531 50.826635 78.250772 42.942394 88.044201 42.942394 curveto +closepath +stroke +gsave +0 0 0 setrgbcolor +newpath +83.823044 115.35931 moveto +83.823044 119.95306 lineto +81.026169 119.95306 lineto +81.026169 107.87494 lineto +83.823044 107.87494 lineto +83.823044 109.15619 lineto +84.208456 108.64578 84.635539 108.27078 85.104294 108.03119 curveto +85.573038 107.78641 86.1121 107.66401 86.721481 107.664 curveto +87.799598 107.66401 88.685014 108.0937 89.377731 108.95306 curveto +90.070429 109.80724 90.416783 110.9088 90.416794 112.25775 curveto +90.416783 113.60671 90.070429 114.71088 89.377731 115.57025 curveto +88.685014 116.42442 87.799598 116.8515 86.721481 116.8515 curveto +86.1121 116.8515 85.573038 116.73171 85.104294 116.49213 curveto +84.635539 116.24734 84.208456 115.86973 83.823044 115.35931 curveto +85.682419 109.69525 moveto +85.083455 109.69526 84.622518 109.91661 84.299606 110.35931 curveto +83.981894 110.79682 83.82304 111.42963 83.823044 112.25775 curveto +83.82304 113.08588 83.981894 113.7213 84.299606 114.164 curveto +84.622518 114.6015 85.083455 114.82025 85.682419 114.82025 curveto +86.281371 114.82025 86.737099 114.6015 87.049606 114.164 curveto +87.367307 113.7265 87.526161 113.09109 87.526169 112.25775 curveto +87.526161 111.42442 87.367307 110.78901 87.049606 110.3515 curveto +86.737099 109.91401 86.281371 109.69526 85.682419 109.69525 curveto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +98.994919 110.25775 moveto +98.75012 110.14317 98.505328 110.05984 98.260544 110.00775 curveto +98.020954 109.95047 97.778766 109.92182 97.533981 109.92181 curveto +96.815226 109.92182 96.260539 110.15359 95.869919 110.61713 curveto +95.484498 111.07547 95.29179 111.73432 95.291794 112.59369 curveto +95.291794 116.62494 lineto +92.494919 116.62494 lineto +92.494919 107.87494 lineto +95.291794 107.87494 lineto +95.291794 109.31244 lineto +95.651164 108.73953 96.062622 108.32286 96.526169 108.06244 curveto +96.994913 107.79682 97.554808 107.66401 98.205856 107.664 curveto +98.299599 107.66401 98.401162 107.66922 98.510544 107.67963 curveto +98.619911 107.68484 98.778765 107.70047 98.987106 107.7265 curveto +98.994919 110.25775 lineto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +104.56523 109.664 moveto +103.94543 109.66401 103.47148 109.88797 103.14336 110.33588 curveto +102.82044 110.77859 102.65898 111.41922 102.65898 112.25775 curveto +102.65898 113.0963 102.82044 113.73953 103.14336 114.18744 curveto +103.47148 114.63015 103.94543 114.8515 104.56523 114.8515 curveto +105.1746 114.8515 105.64075 114.63015 105.96367 114.18744 curveto +106.28658 113.73953 106.44804 113.0963 106.44804 112.25775 curveto +106.44804 111.41922 106.28658 110.77859 105.96367 110.33588 curveto +105.64075 109.88797 105.1746 109.66401 104.56523 109.664 curveto +104.56523 107.664 moveto +106.07043 107.66401 107.24491 108.07026 108.08867 108.88275 curveto +108.93762 109.69526 109.3621 110.82026 109.36211 112.25775 curveto +109.3621 113.69525 108.93762 114.82025 108.08867 115.63275 curveto +107.24491 116.44525 106.07043 116.8515 104.56523 116.8515 curveto +103.05481 116.8515 101.87252 116.44525 101.01836 115.63275 curveto +100.1694 114.82025 99.744918 113.69525 99.744919 112.25775 curveto +99.744918 110.82026 100.1694 109.69526 101.01836 108.88275 curveto +101.87252 108.07026 103.05481 107.66401 104.56523 107.664 curveto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +110.29961 107.87494 moveto +113.09648 107.87494 lineto +115.27617 113.92181 lineto +117.44804 107.87494 lineto +120.25273 107.87494 lineto +116.80742 116.62494 lineto +113.73711 116.62494 lineto +110.29961 107.87494 lineto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +130.57304 112.2265 moveto +130.57304 113.02338 lineto +124.03398 113.02338 lineto +124.10169 113.67963 124.33866 114.17182 124.74492 114.49994 curveto +125.15116 114.82807 125.71887 114.99213 126.44804 114.99213 curveto +127.03658 114.99213 127.63814 114.90619 128.25273 114.73431 curveto +128.87251 114.55723 129.50793 114.29161 130.15898 113.93744 curveto +130.15898 116.09369 lineto +129.49751 116.34369 128.83606 116.53119 128.17461 116.65619 curveto +127.51314 116.7864 126.85168 116.8515 126.19023 116.8515 curveto +124.60689 116.8515 123.37512 116.45046 122.49492 115.64838 curveto +121.61992 114.84109 121.18242 113.71088 121.18242 112.25775 curveto +121.18242 110.83067 121.61211 109.70828 122.47148 108.89056 curveto +123.33606 108.07286 124.52356 107.66401 126.03398 107.664 curveto +127.40897 107.66401 128.50793 108.07807 129.33086 108.90619 curveto +130.15897 109.73432 130.57303 110.84109 130.57304 112.2265 curveto +127.69804 111.29681 moveto +127.69804 110.76557 127.54179 110.33849 127.22929 110.01556 curveto +126.922 109.68745 126.51835 109.52338 126.01836 109.52338 curveto +125.47668 109.52338 125.03658 109.67703 124.69804 109.98431 curveto +124.3595 110.2864 124.14856 110.7239 124.06523 111.29681 curveto +127.69804 111.29681 lineto +fill +grestore +grestore +0 0 0 setrgbcolor +[] 0 setdash +1 setlinewidth +0 setlinejoin +0 setlinecap +newpath +176.66575 92.035445 moveto +176.66575 118.61025 lineto +stroke +gsave [2.4492127e-17 0.4 -0.4 2.4492127e-17 176.66575 118.61025] concat +gsave +0 0 0 setrgbcolor +newpath +5.77 0 moveto +-2.88 5 lineto +-2.88 -5 lineto +5.77 0 lineto +closepath +eofill +grestore +0 0 0 setrgbcolor +[] 0 setdash +1.25 setlinewidth +0 setlinejoin +0 setlinecap +newpath +5.77 0 moveto +-2.88 5 lineto +-2.88 -5 lineto +5.77 0 lineto +closepath +stroke +grestore +gsave [0.2378166 0 0 -0.2269133 90.621413 253.06251] concat +0 0 0 setrgbcolor +[] 0 setdash +4.3013706 setlinewidth +1 setlinejoin +1 setlinecap +newpath +208.65508 282.05865 moveto +193.86388 310.15339 141.95677 326.09523 92.790977 317.64312 curveto +43.625187 309.19101 15.726964 279.5298 30.518156 251.43506 curveto +45.309349 223.34033 97.216466 207.39848 146.38226 215.85059 curveto +177.29043 221.16403 199.42278 233.82562 208.68579 251.49353 curveto +stroke +gsave [0.79891445 1.5238182 -1.5238182 0.79891445 208.68579 251.49353] concat +gsave +0 0 0 setrgbcolor +newpath +5.77 0 moveto +-2.88 5 lineto +-2.88 -5 lineto +5.77 0 lineto +closepath +eofill +grestore +0 0 0 setrgbcolor +[] 0 setdash +1.25 setlinewidth +0 setlinejoin +0 setlinecap +newpath +5.77 0 moveto +-2.88 5 lineto +-2.88 -5 lineto +5.77 0 lineto +closepath +stroke +grestore +grestore +gsave [1 0 0 1 70.866151 78.725565] concat +0 0 0 setrgbcolor +[] 0 setdash +0.99921262 setlinewidth +1 setlinejoin +1 setlinecap +newpath +371.50879 42.942394 moveto +407.01959 42.942394 lineto +416.81302 42.942394 424.69726 50.826635 424.69726 60.620064 curveto +424.69726 166.99701 lineto +424.69726 176.79044 416.81302 184.67468 407.01959 184.67468 curveto +371.50879 184.67468 lineto +361.71536 184.67468 353.83112 176.79044 353.83112 166.99701 curveto +353.83112 60.620064 lineto +353.83112 50.826635 361.71536 42.942394 371.50879 42.942394 curveto +closepath +stroke +gsave +0 0 0 setrgbcolor +newpath +374.16263 110.83588 moveto +374.16263 112.96088 lineto +373.56366 112.71088 372.98554 112.52338 372.42825 112.39838 curveto +371.87096 112.27338 371.34491 112.21088 370.85013 112.21088 curveto +370.31887 112.21088 369.92304 112.27859 369.66263 112.414 curveto +369.40742 112.54422 369.27981 112.74734 369.27982 113.02338 curveto +369.27981 113.24734 369.37617 113.41922 369.56888 113.539 curveto +369.76679 113.6588 370.11835 113.74734 370.62357 113.80463 curveto +371.11575 113.87494 lineto +372.54804 114.05724 373.51158 114.35671 374.00638 114.77338 curveto +374.50116 115.19005 374.74856 115.84369 374.74857 116.73431 curveto +374.74856 117.66661 374.40481 118.36713 373.71732 118.83588 curveto +373.02981 119.30463 372.00377 119.539 370.63919 119.539 curveto +370.06106 119.539 369.4621 119.49213 368.84232 119.39838 curveto +368.22773 119.30983 367.59492 119.17442 366.94388 118.99213 curveto +366.94388 116.86713 lineto +367.50117 117.13796 368.07148 117.34109 368.65482 117.4765 curveto +369.24335 117.61192 369.83971 117.67963 370.44388 117.67963 curveto +370.99075 117.67963 371.40221 117.60411 371.67825 117.45306 curveto +371.95429 117.30202 372.09231 117.07807 372.09232 116.78119 curveto +372.09231 116.53119 371.99596 116.3463 371.80325 116.2265 curveto +371.61575 116.1015 371.23814 116.00515 370.67044 115.93744 curveto +370.17825 115.87494 lineto +368.93346 115.71869 368.06106 115.42963 367.56107 115.00775 curveto +367.06106 114.58588 366.81106 113.94526 366.81107 113.08588 curveto +366.81106 112.1588 367.12877 111.4713 367.76419 111.02338 curveto +368.3996 110.57547 369.37356 110.35151 370.68607 110.3515 curveto +371.20169 110.35151 371.74335 110.39057 372.31107 110.46869 curveto +372.87877 110.54682 373.49595 110.66922 374.16263 110.83588 curveto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +379.91263 108.07806 moveto +379.91263 110.56244 lineto +382.79544 110.56244 lineto +382.79544 112.56244 lineto +379.91263 112.56244 lineto +379.91263 116.27338 lineto +379.91262 116.67963 379.99335 116.95567 380.15482 117.1015 curveto +380.31627 117.24213 380.63658 117.31244 381.11575 117.31244 curveto +382.55325 117.31244 lineto +382.55325 119.31244 lineto +380.15482 119.31244 lineto +379.05065 119.31244 378.26679 119.08327 377.80325 118.62494 curveto +377.34492 118.1614 377.11575 117.37755 377.11575 116.27338 curveto +377.11575 112.56244 lineto +375.72513 112.56244 lineto +375.72513 110.56244 lineto +377.11575 110.56244 lineto +377.11575 108.07806 lineto +379.91263 108.07806 lineto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +388.43607 115.37494 moveto +387.85273 115.37494 387.41262 115.4739 387.11575 115.67181 curveto +386.82408 115.86973 386.67825 116.1614 386.67825 116.54681 curveto +386.67825 116.90098 386.79544 117.17963 387.02982 117.38275 curveto +387.26939 117.58067 387.60012 117.67963 388.022 117.67963 curveto +388.54804 117.67963 388.99075 117.49213 389.35013 117.11713 curveto +389.7095 116.73692 389.88918 116.26296 389.88919 115.69525 curveto +389.88919 115.37494 lineto +388.43607 115.37494 lineto +392.7095 114.32025 moveto +392.7095 119.31244 lineto +389.88919 119.31244 lineto +389.88919 118.01556 lineto +389.51418 118.54681 389.09231 118.93484 388.62357 119.17963 curveto +388.15481 119.41921 387.5845 119.539 386.91263 119.539 curveto +386.00638 119.539 385.2694 119.27598 384.70169 118.74994 curveto +384.13919 118.21869 383.85794 117.53119 383.85794 116.68744 curveto +383.85794 115.6614 384.2095 114.9088 384.91263 114.42963 curveto +385.62096 113.95047 386.73033 113.71088 388.24075 113.71088 curveto +389.88919 113.71088 lineto +389.88919 113.49213 lineto +389.88918 113.04942 389.7147 112.72651 389.36575 112.52338 curveto +389.01679 112.31505 388.47252 112.21088 387.73294 112.21088 curveto +387.13398 112.21088 386.57669 112.27078 386.06107 112.39056 curveto +385.54544 112.51036 385.06627 112.69005 384.62357 112.92963 curveto +384.62357 110.79681 lineto +385.22252 110.65099 385.82408 110.54161 386.42825 110.46869 curveto +387.03242 110.39057 387.63658 110.35151 388.24075 110.3515 curveto +389.81887 110.35151 390.95689 110.66401 391.65482 111.289 curveto +392.35793 111.9088 392.70949 112.91922 392.7095 114.32025 curveto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +398.38138 108.07806 moveto +398.38138 110.56244 lineto +401.26419 110.56244 lineto +401.26419 112.56244 lineto +398.38138 112.56244 lineto +398.38138 116.27338 lineto +398.38137 116.67963 398.4621 116.95567 398.62357 117.1015 curveto +398.78502 117.24213 399.10533 117.31244 399.5845 117.31244 curveto +401.022 117.31244 lineto +401.022 119.31244 lineto +398.62357 119.31244 lineto +397.5194 119.31244 396.73554 119.08327 396.272 118.62494 curveto +395.81367 118.1614 395.5845 117.37755 395.5845 116.27338 curveto +395.5845 112.56244 lineto +394.19388 112.56244 lineto +394.19388 110.56244 lineto +395.5845 110.56244 lineto +395.5845 108.07806 lineto +398.38138 108.07806 lineto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +411.71732 114.914 moveto +411.71732 115.71088 lineto +405.17825 115.71088 lineto +405.24596 116.36713 405.48294 116.85932 405.88919 117.18744 curveto +406.29544 117.51557 406.86314 117.67963 407.59232 117.67963 curveto +408.18085 117.67963 408.78241 117.59369 409.397 117.42181 curveto +410.01679 117.24473 410.6522 116.97911 411.30325 116.62494 curveto +411.30325 118.78119 lineto +410.64179 119.03119 409.98033 119.21869 409.31888 119.34369 curveto +408.65741 119.4739 407.99596 119.539 407.3345 119.539 curveto +405.75117 119.539 404.5194 119.13796 403.63919 118.33588 curveto +402.76419 117.52859 402.32669 116.39838 402.32669 114.94525 curveto +402.32669 113.51817 402.75638 112.39578 403.61575 111.57806 curveto +404.48033 110.76036 405.66783 110.35151 407.17825 110.3515 curveto +408.55325 110.35151 409.6522 110.76557 410.47513 111.59369 curveto +411.30324 112.42182 411.71731 113.52859 411.71732 114.914 curveto +408.84232 113.98431 moveto +408.84231 113.45307 408.68606 113.02599 408.37357 112.70306 curveto +408.06627 112.37495 407.66262 112.21088 407.16263 112.21088 curveto +406.62096 112.21088 406.18085 112.36453 405.84232 112.67181 curveto +405.50377 112.9739 405.29283 113.4114 405.2095 113.98431 curveto +408.84232 113.98431 lineto +fill +grestore +grestore +0 0 0 setrgbcolor +[] 0 setdash +1 setlinewidth +0 setlinejoin +0 setlinecap +newpath +460.13031 263.40024 moveto +460.13031 289.97505 lineto +stroke +gsave [2.4492127e-17 0.4 -0.4 2.4492127e-17 460.13031 289.97505] concat +gsave +0 0 0 setrgbcolor +newpath +5.77 0 moveto +-2.88 5 lineto +-2.88 -5 lineto +5.77 0 lineto +closepath +eofill +grestore +0 0 0 setrgbcolor +[] 0 setdash +1.25 setlinewidth +0 setlinejoin +0 setlinecap +newpath +5.77 0 moveto +-2.88 5 lineto +-2.88 -5 lineto +5.77 0 lineto +closepath +stroke +grestore +gsave [-0.2378166 0 0 0.2269133 546.17466 132.00569] concat +0 0 0 setrgbcolor +[] 0 setdash +4.3013706 setlinewidth +1 setlinejoin +1 setlinecap +newpath +208.65508 282.05865 moveto +193.86388 310.15339 141.95677 326.09523 92.790977 317.64312 curveto +43.625187 309.19101 15.726964 279.5298 30.518156 251.43506 curveto +45.309349 223.34033 97.216466 207.39848 146.38226 215.85059 curveto +177.29043 221.16403 199.42278 233.82562 208.68579 251.49353 curveto +stroke +gsave [0.79891445 1.5238182 -1.5238182 0.79891445 208.68579 251.49353] concat +gsave +0 0 0 setrgbcolor +newpath +5.77 0 moveto +-2.88 5 lineto +-2.88 -5 lineto +5.77 0 lineto +closepath +eofill +grestore +0 0 0 setrgbcolor +[] 0 setdash +1.25 setlinewidth +0 setlinejoin +0 setlinecap +newpath +5.77 0 moveto +-2.88 5 lineto +-2.88 -5 lineto +5.77 0 lineto +closepath +stroke +grestore +grestore +gsave [-0.2378166 0 0 0.2269133 546.17465 87.714359] concat +0 0 0 setrgbcolor +[] 0 setdash +4.3013706 setlinewidth +2 setlinejoin +1 setlinecap +newpath +208.65508 282.05865 moveto +193.86388 310.15339 141.95677 326.09523 92.790977 317.64312 curveto +43.625187 309.19101 15.726964 279.5298 30.518156 251.43506 curveto +45.309349 223.34033 97.216466 207.39848 146.38226 215.85059 curveto +177.29043 221.16403 199.42278 233.82562 208.68579 251.49353 curveto +stroke +gsave [0.79891445 1.5238182 -1.5238182 0.79891445 208.68579 251.49353] concat +gsave +0 0 0 setrgbcolor +newpath +5.77 0 moveto +-2.88 5 lineto +-2.88 -5 lineto +5.77 0 lineto +closepath +eofill +grestore +0 0 0 setrgbcolor +[] 0 setdash +1.25 setlinewidth +0 setlinejoin +0 setlinecap +newpath +5.77 0 moveto +-2.88 5 lineto +-2.88 -5 lineto +5.77 0 lineto +closepath +stroke +grestore +grestore +gsave [-0.2378166 0 0 0.2269133 546.17465 176.29703] concat +0 0 0 setrgbcolor +[] 0 setdash +4.3013706 setlinewidth +1 setlinejoin +1 setlinecap +newpath +208.65508 282.05865 moveto +193.86388 310.15339 141.95677 326.09523 92.790977 317.64312 curveto +43.625187 309.19101 15.726964 279.5298 30.518156 251.43506 curveto +45.309349 223.34033 97.216466 207.39848 146.38226 215.85059 curveto +177.29043 221.16403 199.42278 233.82562 208.68579 251.49353 curveto +stroke +gsave [0.79891445 1.5238182 -1.5238182 0.79891445 208.68579 251.49353] concat +gsave +0 0 0 setrgbcolor +newpath +5.77 0 moveto +-2.88 5 lineto +-2.88 -5 lineto +5.77 0 lineto +closepath +eofill +grestore +0 0 0 setrgbcolor +[] 0 setdash +1.25 setlinewidth +0 setlinejoin +0 setlinecap +newpath +5.77 0 moveto +-2.88 5 lineto +-2.88 -5 lineto +5.77 0 lineto +closepath +stroke +grestore +grestore +gsave [0 0.2378166 0.2269133 0 399.60191 71.056696] concat +0 0 0 setrgbcolor +[] 0 setdash +4.3013706 setlinewidth +1 setlinejoin +1 setlinecap +newpath +208.65508 282.05865 moveto +193.86388 310.15339 141.95677 326.09523 92.790977 317.64312 curveto +43.625187 309.19101 15.726964 279.5298 30.518156 251.43506 curveto +45.309349 223.34033 97.216466 207.39848 146.38226 215.85059 curveto +177.29043 221.16403 199.42278 233.82562 208.68579 251.49353 curveto +stroke +gsave [0.79891445 1.5238182 -1.5238182 0.79891445 208.68579 251.49353] concat +gsave +0 0 0 setrgbcolor +newpath +5.77 0 moveto +-2.88 5 lineto +-2.88 -5 lineto +5.77 0 lineto +closepath +eofill +grestore +0 0 0 setrgbcolor +[] 0 setdash +1.25 setlinewidth +0 setlinejoin +0 setlinecap +newpath +5.77 0 moveto +-2.88 5 lineto +-2.88 -5 lineto +5.77 0 lineto +closepath +stroke +grestore +grestore +gsave [1 0 0 1 17.216929 6.5104864] concat +grestore +gsave +0 0 0 setrgbcolor +newpath +187.35507 103.05839 moveto +187.35507 104.61112 lineto +189.20566 104.61112 lineto +189.20566 105.30936 lineto +187.35507 105.30936 lineto +187.35507 108.27811 lineto +187.35507 108.72408 187.41529 109.01054 187.53574 109.13749 curveto +187.65943 109.26444 187.90846 109.32792 188.28281 109.32792 curveto +189.20566 109.32792 lineto +189.20566 110.07987 lineto +188.28281 110.07987 lineto +187.58944 110.07987 187.11093 109.95129 186.84726 109.69413 curveto +186.58359 109.43371 186.45175 108.96171 186.45175 108.27811 curveto +186.45175 105.30936 lineto +185.79257 105.30936 lineto +185.79257 104.61112 lineto +186.45175 104.61112 lineto +186.45175 103.05839 lineto +187.35507 103.05839 lineto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +194.93808 106.77909 moveto +194.93808 110.07987 lineto +194.03964 110.07987 lineto +194.03964 106.80839 lineto +194.03964 106.29081 193.93873 105.90344 193.73691 105.64628 curveto +193.53508 105.38912 193.23235 105.26054 192.8287 105.26054 curveto +192.34368 105.26054 191.96119 105.41516 191.68124 105.7244 curveto +191.40129 106.03365 191.26132 106.4552 191.26132 106.98905 curveto +191.26132 110.07987 lineto +190.358 110.07987 lineto +190.358 102.48222 lineto +191.26132 102.48222 lineto +191.26132 105.46073 lineto +191.47616 105.13196 191.72844 104.88619 192.01816 104.72343 curveto +192.31112 104.56067 192.64804 104.47929 193.0289 104.47929 curveto +193.65715 104.47929 194.13241 104.6746 194.45468 105.06522 curveto +194.77694 105.4526 194.93807 106.02389 194.93808 106.77909 curveto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +201.41757 107.12089 moveto +201.41757 107.56034 lineto +197.28671 107.56034 lineto +197.32577 108.17883 197.51132 108.65084 197.84335 108.97636 curveto +198.17864 109.29862 198.64413 109.45976 199.23984 109.45975 curveto +199.58489 109.45976 199.91854 109.41744 200.24081 109.3328 curveto +200.56633 109.24817 200.8886 109.12121 201.20761 108.95194 curveto +201.20761 109.80155 lineto +200.88534 109.93827 200.55494 110.04244 200.2164 110.11405 curveto +199.87785 110.18567 199.53443 110.22147 199.18613 110.22147 curveto +198.31373 110.22147 197.622 109.96757 197.11093 109.45975 curveto +196.60312 108.95194 196.34921 108.2651 196.34921 107.39921 curveto +196.34921 106.50403 196.5901 105.79439 197.07187 105.2703 curveto +197.55689 104.74296 198.20956 104.47929 199.02988 104.47929 curveto +199.76555 104.47929 200.3466 104.71692 200.77304 105.19218 curveto +201.20272 105.66419 201.41757 106.30709 201.41757 107.12089 curveto +200.51913 106.85722 moveto +200.51262 106.36568 200.37427 105.97343 200.1041 105.68046 curveto +199.83716 105.38749 199.48235 105.24101 199.03964 105.241 curveto +198.53834 105.24101 198.13632 105.38261 197.83359 105.66581 curveto +197.53411 105.94902 197.36158 106.34778 197.31601 106.8621 curveto +200.51913 106.85722 lineto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +205.01132 105.241 moveto +204.52955 105.24101 204.14869 105.42981 203.86874 105.80741 curveto +203.58879 106.18176 203.44882 106.69609 203.44882 107.35038 curveto +203.44882 108.00468 203.58717 108.52063 203.86386 108.89823 curveto +204.14381 109.27258 204.52629 109.45976 205.01132 109.45975 curveto +205.48983 109.45976 205.86907 109.27095 206.14902 108.89335 curveto +206.42896 108.51575 206.56893 108.00142 206.56894 107.35038 curveto +206.56893 106.7026 206.42896 106.1899 206.14902 105.81229 curveto +205.86907 105.43144 205.48983 105.24101 205.01132 105.241 curveto +205.01132 104.47929 moveto +205.79257 104.47929 206.40617 104.7332 206.85214 105.241 curveto +207.2981 105.74882 207.52108 106.45195 207.52109 107.35038 curveto +207.52108 108.24556 207.2981 108.94869 206.85214 109.45975 curveto +206.40617 109.96757 205.79257 110.22147 205.01132 110.22147 curveto +204.22681 110.22147 203.61158 109.96757 203.16562 109.45975 curveto +202.72291 108.94869 202.50156 108.24556 202.50156 107.35038 curveto +202.50156 106.45195 202.72291 105.74882 203.16562 105.241 curveto +203.61158 104.7332 204.22681 104.47929 205.01132 104.47929 curveto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +212.17441 105.45097 moveto +212.07349 105.39238 211.96282 105.35006 211.84238 105.32401 curveto +211.72519 105.29472 211.59498 105.28007 211.45175 105.28007 curveto +210.94394 105.28007 210.55331 105.44609 210.27988 105.77811 curveto +210.00969 106.10689 209.8746 106.58053 209.8746 107.19901 curveto +209.8746 110.07987 lineto +208.97128 110.07987 lineto +208.97128 104.61112 lineto +209.8746 104.61112 lineto +209.8746 105.46073 lineto +210.0634 105.12871 210.30917 104.88294 210.61191 104.72343 curveto +210.91464 104.56067 211.28248 104.47929 211.71542 104.47929 curveto +211.77727 104.47929 211.84563 104.48417 211.9205 104.49393 curveto +211.99537 104.50045 212.07838 104.51184 212.16953 104.52811 curveto +212.17441 105.45097 lineto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +217.58945 107.12089 moveto +217.58945 107.56034 lineto +213.45859 107.56034 lineto +213.49765 108.17883 213.6832 108.65084 214.01523 108.97636 curveto +214.35051 109.29862 214.81601 109.45976 215.41171 109.45975 curveto +215.75676 109.45976 216.09042 109.41744 216.41269 109.3328 curveto +216.73821 109.24817 217.06047 109.12121 217.37949 108.95194 curveto +217.37949 109.80155 lineto +217.05722 109.93827 216.72681 110.04244 216.38828 110.11405 curveto +216.04973 110.18567 215.70631 110.22147 215.358 110.22147 curveto +214.4856 110.22147 213.79387 109.96757 213.28281 109.45975 curveto +212.77499 108.95194 212.52109 108.2651 212.52109 107.39921 curveto +212.52109 106.50403 212.76197 105.79439 213.24374 105.2703 curveto +213.72877 104.74296 214.38144 104.47929 215.20175 104.47929 curveto +215.93742 104.47929 216.51848 104.71692 216.94492 105.19218 curveto +217.3746 105.66419 217.58944 106.30709 217.58945 107.12089 curveto +216.69101 106.85722 moveto +216.68449 106.36568 216.54615 105.97343 216.27597 105.68046 curveto +216.00904 105.38749 215.65422 105.24101 215.21152 105.241 curveto +214.71021 105.24101 214.30819 105.38261 214.00546 105.66581 curveto +213.70598 105.94902 213.53346 106.34778 213.48788 106.8621 curveto +216.69101 106.85722 lineto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +223.32187 105.66093 moveto +223.54647 105.25729 223.81503 104.95943 224.12753 104.76737 curveto +224.44003 104.57532 224.80786 104.47929 225.23105 104.47929 curveto +225.8007 104.47929 226.24016 104.67949 226.54941 105.07987 curveto +226.85864 105.47701 227.01327 106.04342 227.01328 106.77909 curveto +227.01328 110.07987 lineto +226.10995 110.07987 lineto +226.10995 106.80839 lineto +226.10995 106.2843 226.01717 105.89531 225.83163 105.6414 curveto +225.64608 105.38749 225.36288 105.26054 224.98203 105.26054 curveto +224.51652 105.26054 224.14869 105.41516 223.87851 105.7244 curveto +223.60832 106.03365 223.47323 106.4552 223.47324 106.98905 curveto +223.47324 110.07987 lineto +222.56992 110.07987 lineto +222.56992 106.80839 lineto +222.56991 106.28105 222.47714 105.89205 222.2916 105.6414 curveto +222.10604 105.38749 221.81959 105.26054 221.43222 105.26054 curveto +220.97323 105.26054 220.60865 105.41679 220.33847 105.72929 curveto +220.06829 106.03854 219.9332 106.45846 219.9332 106.98905 curveto +219.9332 110.07987 lineto +219.02988 110.07987 lineto +219.02988 104.61112 lineto +219.9332 104.61112 lineto +219.9332 105.46073 lineto +220.13827 105.12545 220.38404 104.87805 220.6705 104.71854 curveto +220.95696 104.55904 221.29713 104.47929 221.69101 104.47929 curveto +222.08814 104.47929 222.42505 104.5802 222.70175 104.78202 curveto +222.98169 104.98385 223.1884 105.27682 223.32187 105.66093 curveto +fill +grestore +gsave [1 0 0 1 17.216929 6.5104864] concat +grestore +gsave +0 0 0 setrgbcolor +newpath +470.46808 277.74594 moveto +470.46808 278.40675 470.60317 278.92596 470.87335 279.30356 curveto +471.14679 279.67791 471.52114 279.86508 471.9964 279.86508 curveto +472.47166 279.86508 472.846 279.67791 473.11945 279.30356 curveto +473.39288 278.92596 473.5296 278.40675 473.5296 277.74594 curveto +473.5296 277.08514 473.39288 276.56756 473.11945 276.19321 curveto +472.846 275.81561 472.47166 275.62681 471.9964 275.6268 curveto +471.52114 275.62681 471.14679 275.81561 470.87335 276.19321 curveto +470.60317 276.56756 470.46808 277.08514 470.46808 277.74594 curveto +473.5296 279.65512 moveto +473.3408 279.98064 473.10154 280.22315 472.81183 280.38266 curveto +472.52537 280.53891 472.18032 280.61703 471.77667 280.61703 curveto +471.11586 280.61703 470.57713 280.35336 470.16046 279.82602 curveto +469.74705 279.29868 469.54034 278.60532 469.54034 277.74594 curveto +469.54034 276.88657 469.74705 276.19321 470.16046 275.66586 curveto +470.57713 275.13852 471.11586 274.87485 471.77667 274.87485 curveto +472.18032 274.87485 472.52537 274.95461 472.81183 275.11411 curveto +473.10154 275.27036 473.3408 275.51125 473.5296 275.83676 curveto +473.5296 275.00668 lineto +474.42804 275.00668 lineto +474.42804 282.55551 lineto +473.5296 282.55551 lineto +473.5296 279.65512 lineto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +480.95636 277.51645 moveto +480.95636 277.9559 lineto +476.8255 277.9559 lineto +476.86456 278.57439 477.05011 279.0464 477.38214 279.37192 curveto +477.71743 279.69418 478.18292 279.85532 478.77863 279.85532 curveto +479.12367 279.85532 479.45733 279.813 479.7796 279.72836 curveto +480.10512 279.64373 480.42738 279.51678 480.7464 279.3475 curveto +480.7464 280.19711 lineto +480.42413 280.33383 480.09372 280.438 479.75519 280.50961 curveto +479.41664 280.58123 479.07322 280.61703 478.72491 280.61703 curveto +477.85252 280.61703 477.16079 280.36313 476.64972 279.85532 curveto +476.14191 279.3475 475.888 278.66066 475.888 277.79477 curveto +475.888 276.89959 476.12889 276.18996 476.61066 275.66586 curveto +477.09568 275.13852 477.74835 274.87485 478.56866 274.87485 curveto +479.30434 274.87485 479.88539 275.11248 480.31183 275.58774 curveto +480.74151 276.05975 480.95635 276.70265 480.95636 277.51645 curveto +480.05792 277.25278 moveto +480.05141 276.76124 479.91306 276.36899 479.64288 276.07602 curveto +479.37595 275.78306 479.02113 275.63657 478.57843 275.63657 curveto +478.07713 275.63657 477.67511 275.77817 477.37238 276.06137 curveto +477.07289 276.34458 476.90037 276.74334 476.8548 277.25766 curveto +480.05792 277.25278 lineto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +486.0296 275.83676 moveto +486.0296 272.87778 lineto +486.92804 272.87778 lineto +486.92804 280.47543 lineto +486.0296 280.47543 lineto +486.0296 279.65512 lineto +485.8408 279.98064 485.60154 280.22315 485.31183 280.38266 curveto +485.02537 280.53891 484.68032 280.61703 484.27667 280.61703 curveto +483.61586 280.61703 483.07713 280.35336 482.66046 279.82602 curveto +482.24705 279.29868 482.04034 278.60532 482.04034 277.74594 curveto +482.04034 276.88657 482.24705 276.19321 482.66046 275.66586 curveto +483.07713 275.13852 483.61586 274.87485 484.27667 274.87485 curveto +484.68032 274.87485 485.02537 274.95461 485.31183 275.11411 curveto +485.60154 275.27036 485.8408 275.51125 486.0296 275.83676 curveto +482.96808 277.74594 moveto +482.96808 278.40675 483.10317 278.92596 483.37335 279.30356 curveto +483.64679 279.67791 484.02114 279.86508 484.4964 279.86508 curveto +484.97166 279.86508 485.346 279.67791 485.61945 279.30356 curveto +485.89288 278.92596 486.0296 278.40675 486.0296 277.74594 curveto +486.0296 277.08514 485.89288 276.56756 485.61945 276.19321 curveto +485.346 275.81561 484.97166 275.62681 484.4964 275.6268 curveto +484.02114 275.62681 483.64679 275.81561 483.37335 276.19321 curveto +483.10317 276.56756 482.96808 277.08514 482.96808 277.74594 curveto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +550.54895 236.85474 moveto +550.54895 237.51555 550.68404 238.03475 550.95422 238.41235 curveto +551.22766 238.7867 551.60201 238.97388 552.07727 238.97388 curveto +552.55253 238.97388 552.92688 238.7867 553.20032 238.41235 curveto +553.47375 238.03475 553.61047 237.51555 553.61047 236.85474 curveto +553.61047 236.19393 553.47375 235.67635 553.20032 235.302 curveto +552.92688 234.9244 552.55253 234.7356 552.07727 234.7356 curveto +551.60201 234.7356 551.22766 234.9244 550.95422 235.302 curveto +550.68404 235.67635 550.54895 236.19393 550.54895 236.85474 curveto +553.61047 238.76392 moveto +553.42167 239.08944 553.18241 239.33195 552.8927 239.49146 curveto +552.60624 239.64771 552.26119 239.72583 551.85754 239.72583 curveto +551.19673 239.72583 550.658 239.46216 550.24133 238.93481 curveto +549.82792 238.40747 549.62122 237.71411 549.62122 236.85474 curveto +549.62122 235.99536 549.82792 235.30201 550.24133 234.77466 curveto +550.658 234.24732 551.19673 233.98365 551.85754 233.98364 curveto +552.26119 233.98365 552.60624 234.0634 552.8927 234.2229 curveto +553.18241 234.37916 553.42167 234.62004 553.61047 234.94556 curveto +553.61047 234.11548 lineto +554.50891 234.11548 lineto +554.50891 241.66431 lineto +553.61047 241.66431 lineto +553.61047 238.76392 lineto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +561.03723 236.62524 moveto +561.03723 237.0647 lineto +556.90637 237.0647 lineto +556.94543 237.68319 557.13098 238.15519 557.46301 238.48071 curveto +557.7983 238.80298 558.26379 238.96411 558.8595 238.96411 curveto +559.20455 238.96411 559.5382 238.92179 559.86047 238.83716 curveto +560.18599 238.75252 560.50825 238.62557 560.82727 238.4563 curveto +560.82727 239.30591 lineto +560.505 239.44263 560.1746 239.54679 559.83606 239.61841 curveto +559.49751 239.69002 559.15409 239.72583 558.80579 239.72583 curveto +557.93339 239.72583 557.24166 239.47192 556.73059 238.96411 curveto +556.22278 238.4563 555.96887 237.76945 555.96887 236.90356 curveto +555.96887 236.00839 556.20976 235.29875 556.69153 234.77466 curveto +557.17655 234.24732 557.82922 233.98365 558.64954 233.98364 curveto +559.38521 233.98365 559.96626 234.22128 560.3927 234.69653 curveto +560.82238 235.16854 561.03723 235.81145 561.03723 236.62524 curveto +560.13879 236.36157 moveto +560.13228 235.87004 559.99393 235.47779 559.72375 235.18481 curveto +559.45682 234.89185 559.10201 234.74537 558.6593 234.74536 curveto +558.158 234.74537 557.75598 234.88697 557.45325 235.17017 curveto +557.15377 235.45337 556.98124 235.85214 556.93567 236.36646 curveto +560.13879 236.36157 lineto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +566.11047 234.94556 moveto +566.11047 231.98657 lineto +567.00891 231.98657 lineto +567.00891 239.58423 lineto +566.11047 239.58423 lineto +566.11047 238.76392 lineto +565.92167 239.08944 565.68241 239.33195 565.3927 239.49146 curveto +565.10624 239.64771 564.76119 239.72583 564.35754 239.72583 curveto +563.69673 239.72583 563.158 239.46216 562.74133 238.93481 curveto +562.32792 238.40747 562.12122 237.71411 562.12122 236.85474 curveto +562.12122 235.99536 562.32792 235.30201 562.74133 234.77466 curveto +563.158 234.24732 563.69673 233.98365 564.35754 233.98364 curveto +564.76119 233.98365 565.10624 234.0634 565.3927 234.2229 curveto +565.68241 234.37916 565.92167 234.62004 566.11047 234.94556 curveto +563.04895 236.85474 moveto +563.04895 237.51555 563.18404 238.03475 563.45422 238.41235 curveto +563.72766 238.7867 564.10201 238.97388 564.57727 238.97388 curveto +565.05253 238.97388 565.42688 238.7867 565.70032 238.41235 curveto +565.97375 238.03475 566.11047 237.51555 566.11047 236.85474 curveto +566.11047 236.19393 565.97375 235.67635 565.70032 235.302 curveto +565.42688 234.9244 565.05253 234.7356 564.57727 234.7356 curveto +564.10201 234.7356 563.72766 234.9244 563.45422 235.302 curveto +563.18404 235.67635 563.04895 236.19393 563.04895 236.85474 curveto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +553.10266 183.66447 moveto +553.10266 184.41154 lineto +552.24329 184.41154 lineto +551.92102 184.41155 551.69641 184.47666 551.56946 184.60686 curveto +551.44576 184.73707 551.38391 184.97145 551.38391 185.30998 curveto +551.38391 185.79338 lineto +552.8634 185.79338 lineto +552.8634 186.49162 lineto +551.38391 186.49162 lineto +551.38391 191.26213 lineto +550.48059 191.26213 lineto +550.48059 186.49162 lineto +549.62122 186.49162 lineto +549.62122 185.79338 lineto +550.48059 185.79338 lineto +550.48059 185.41252 lineto +550.48059 184.8038 550.62219 184.3611 550.9054 184.0844 curveto +551.1886 183.80446 551.63782 183.66448 552.25305 183.66447 curveto +553.10266 183.66447 lineto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +553.84973 185.79338 moveto +554.74817 185.79338 lineto +554.74817 191.26213 lineto +553.84973 191.26213 lineto +553.84973 185.79338 lineto +553.84973 183.66447 moveto +554.74817 183.66447 lineto +554.74817 184.80217 lineto +553.84973 184.80217 lineto +553.84973 183.66447 lineto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +561.16907 185.79338 moveto +559.19153 188.45451 lineto +561.27161 191.26213 lineto +560.21204 191.26213 lineto +558.62024 189.11369 lineto +557.02844 191.26213 lineto +555.96887 191.26213 lineto +558.0929 188.4008 lineto +556.14954 185.79338 lineto +557.20911 185.79338 lineto +558.6593 187.74162 lineto +560.1095 185.79338 lineto +561.16907 185.79338 lineto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +552.81946 198.51311 moveto +552.09354 198.51311 551.59061 198.59612 551.31067 198.76213 curveto +551.03072 198.92815 550.89075 199.21135 550.89075 199.61174 curveto +550.89075 199.93075 550.99491 200.18466 551.20325 200.37346 curveto +551.41483 200.55901 551.70129 200.65178 552.06262 200.65178 curveto +552.56067 200.65178 552.95943 200.476 553.25891 200.12444 curveto +553.56164 199.76962 553.71301 199.29924 553.71301 198.7133 curveto +553.71301 198.51311 lineto +552.81946 198.51311 lineto +554.61145 198.14201 moveto +554.61145 201.26213 lineto +553.71301 201.26213 lineto +553.71301 200.43205 lineto +553.50793 200.76408 553.2524 201.00985 552.94641 201.16936 curveto +552.64042 201.32561 552.26607 201.40373 551.82336 201.40373 curveto +551.26347 201.40373 550.8175 201.24748 550.48547 200.93498 curveto +550.1567 200.61923 549.99231 200.19768 549.99231 199.67033 curveto +549.99231 199.0551 550.19739 198.59123 550.60754 198.27873 curveto +551.02095 197.96624 551.63619 197.80999 552.45325 197.80998 curveto +553.71301 197.80998 lineto +553.71301 197.72209 lineto +553.71301 197.30868 553.57629 196.98967 553.30286 196.76506 curveto +553.03267 196.5372 552.65181 196.42327 552.16028 196.42326 curveto +551.84778 196.42327 551.54341 196.4607 551.24719 196.53557 curveto +550.95097 196.61044 550.66614 196.72275 550.3927 196.87248 curveto +550.3927 196.0424 lineto +550.72147 195.91546 551.04049 195.82106 551.34973 195.7592 curveto +551.65897 195.6941 551.96008 195.66155 552.25305 195.66154 curveto +553.04406 195.66155 553.63488 195.86663 554.02551 196.27678 curveto +554.41613 196.68694 554.61144 197.30868 554.61145 198.14201 curveto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +559.95325 195.95451 moveto +559.95325 196.80412 lineto +559.69934 196.67392 559.43567 196.57626 559.16223 196.51115 curveto +558.88879 196.44605 558.60559 196.4135 558.31262 196.4135 curveto +557.86666 196.4135 557.53137 196.48186 557.30676 196.61858 curveto +557.08541 196.7553 556.97473 196.96038 556.97473 197.23381 curveto +556.97473 197.44215 557.05448 197.60654 557.21399 197.72697 curveto +557.37349 197.84417 557.69413 197.95647 558.1759 198.06389 curveto +558.48352 198.13225 lineto +559.12154 198.26897 559.57401 198.46265 559.84094 198.7133 curveto +560.11112 198.9607 560.24621 199.30738 560.24622 199.75334 curveto +560.24621 200.26116 560.04439 200.66317 559.64075 200.9594 curveto +559.24035 201.25562 558.6886 201.40373 557.98547 201.40373 curveto +557.6925 201.40373 557.38651 201.37444 557.0675 201.31584 curveto +556.75175 201.2605 556.41809 201.17587 556.06653 201.06194 curveto +556.06653 200.1342 lineto +556.39856 200.30673 556.72571 200.43694 557.04797 200.52483 curveto +557.37024 200.60946 557.68925 200.65178 558.005 200.65178 curveto +558.42818 200.65178 558.7537 200.58017 558.98157 200.43694 curveto +559.20943 200.29045 559.32336 200.08537 559.32336 199.8217 curveto +559.32336 199.57756 559.24035 199.39039 559.07434 199.26018 curveto +558.91158 199.12997 558.55188 199.00465 557.99524 198.8842 curveto +557.68274 198.81096 lineto +557.1261 198.69377 556.72408 198.51474 556.47668 198.27385 curveto +556.22929 198.02971 556.10559 197.69605 556.10559 197.27287 curveto +556.10559 196.75855 556.28788 196.36142 556.65247 196.08147 curveto +557.01705 195.80152 557.53463 195.66155 558.2052 195.66154 curveto +558.53723 195.66155 558.84973 195.68596 559.1427 195.73479 curveto +559.43567 195.78362 559.70585 195.85686 559.95325 195.95451 curveto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +565.16809 195.95451 moveto +565.16809 196.80412 lineto +564.91418 196.67392 564.65051 196.57626 564.37708 196.51115 curveto +564.10363 196.44605 563.82043 196.4135 563.52747 196.4135 curveto +563.0815 196.4135 562.74621 196.48186 562.52161 196.61858 curveto +562.30025 196.7553 562.18957 196.96038 562.18958 197.23381 curveto +562.18957 197.44215 562.26933 197.60654 562.42883 197.72697 curveto +562.58834 197.84417 562.90897 197.95647 563.39075 198.06389 curveto +563.69836 198.13225 lineto +564.33638 198.26897 564.78886 198.46265 565.05579 198.7133 curveto +565.32596 198.9607 565.46105 199.30738 565.46106 199.75334 curveto +565.46105 200.26116 565.25923 200.66317 564.85559 200.9594 curveto +564.4552 201.25562 563.90344 201.40373 563.20032 201.40373 curveto +562.90735 201.40373 562.60136 201.37444 562.28235 201.31584 curveto +561.96659 201.2605 561.63293 201.17587 561.28137 201.06194 curveto +561.28137 200.1342 lineto +561.6134 200.30673 561.94055 200.43694 562.26282 200.52483 curveto +562.58508 200.60946 562.90409 200.65178 563.21985 200.65178 curveto +563.64302 200.65178 563.96854 200.58017 564.19641 200.43694 curveto +564.42427 200.29045 564.5382 200.08537 564.53821 199.8217 curveto +564.5382 199.57756 564.4552 199.39039 564.28918 199.26018 curveto +564.12642 199.12997 563.76672 199.00465 563.21008 198.8842 curveto +562.89758 198.81096 lineto +562.34094 198.69377 561.93892 198.51474 561.69153 198.27385 curveto +561.44413 198.02971 561.32043 197.69605 561.32043 197.27287 curveto +561.32043 196.75855 561.50273 196.36142 561.86731 196.08147 curveto +562.23189 195.80152 562.74947 195.66155 563.42004 195.66154 curveto +563.75207 195.66155 564.06457 195.68596 564.35754 195.73479 curveto +564.65051 195.78362 564.92069 195.85686 565.16809 195.95451 curveto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +566.80383 199.10393 moveto +566.80383 195.79338 lineto +567.70227 195.79338 lineto +567.70227 199.06975 lineto +567.70227 199.58733 567.80318 199.97632 568.005 200.23674 curveto +568.20683 200.4939 568.50956 200.62248 568.91321 200.62248 curveto +569.39823 200.62248 569.78072 200.46786 570.06067 200.15862 curveto +570.34387 199.84937 570.48547 199.42782 570.48547 198.89397 curveto +570.48547 195.79338 lineto +571.38391 195.79338 lineto +571.38391 201.26213 lineto +570.48547 201.26213 lineto +570.48547 200.42229 lineto +570.26737 200.75432 570.01346 201.00171 569.72375 201.16447 curveto +569.43729 201.32398 569.10363 201.40373 568.72278 201.40373 curveto +568.09452 201.40373 567.61763 201.20842 567.29211 200.81779 curveto +566.96659 200.42717 566.80383 199.85588 566.80383 199.10393 curveto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +577.50208 196.84319 moveto +577.72668 196.43954 577.99523 196.14169 578.30774 195.94963 curveto +578.62023 195.75758 578.98807 195.66155 579.41125 195.66154 curveto +579.98091 195.66155 580.42036 195.86175 580.72961 196.26213 curveto +581.03885 196.65927 581.19347 197.22568 581.19348 197.96135 curveto +581.19348 201.26213 lineto +580.29016 201.26213 lineto +580.29016 197.99065 lineto +580.29015 197.46656 580.19738 197.07756 580.01184 196.82365 curveto +579.82629 196.56975 579.54308 196.4428 579.16223 196.44279 curveto +578.69673 196.4428 578.32889 196.59742 578.05872 196.90666 curveto +577.78853 197.21591 577.65344 197.63746 577.65344 198.17131 curveto +577.65344 201.26213 lineto +576.75012 201.26213 lineto +576.75012 197.99065 lineto +576.75012 197.46331 576.65734 197.07431 576.4718 196.82365 curveto +576.28625 196.56975 575.99979 196.4428 575.61243 196.44279 curveto +575.15344 196.4428 574.78886 196.59905 574.51868 196.91154 curveto +574.24849 197.22079 574.1134 197.64072 574.1134 198.17131 curveto +574.1134 201.26213 lineto +573.21008 201.26213 lineto +573.21008 195.79338 lineto +574.1134 195.79338 lineto +574.1134 196.64299 lineto +574.31848 196.30771 574.56425 196.06031 574.85071 195.9008 curveto +575.13716 195.7413 575.47733 195.66155 575.87122 195.66154 curveto +576.26835 195.66155 576.60526 195.76246 576.88196 195.96428 curveto +577.1619 196.16611 577.36861 196.45908 577.50208 196.84319 curveto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +587.66809 198.30315 moveto +587.66809 198.7426 lineto +583.53723 198.7426 lineto +583.57629 199.36109 583.76184 199.8331 584.09387 200.15862 curveto +584.42916 200.48088 584.89465 200.64201 585.49036 200.64201 curveto +585.8354 200.64201 586.16906 200.5997 586.49133 200.51506 curveto +586.81685 200.43043 587.13911 200.30347 587.45813 200.1342 curveto +587.45813 200.98381 lineto +587.13586 201.12053 586.80546 201.2247 586.46692 201.29631 curveto +586.12837 201.36792 585.78495 201.40373 585.43665 201.40373 curveto +584.56425 201.40373 583.87252 201.14983 583.36145 200.64201 curveto +582.85364 200.1342 582.59973 199.44735 582.59973 198.58147 curveto +582.59973 197.68629 582.84062 196.97665 583.32239 196.45256 curveto +583.80741 195.92522 584.46008 195.66155 585.2804 195.66154 curveto +586.01607 195.66155 586.59712 195.89918 587.02356 196.37444 curveto +587.45324 196.84645 587.66809 197.48935 587.66809 198.30315 curveto +586.76965 198.03947 moveto +586.76314 197.54794 586.62479 197.15569 586.35461 196.86272 curveto +586.08768 196.56975 585.73287 196.42327 585.29016 196.42326 curveto +584.78886 196.42327 584.38684 196.56487 584.08411 196.84807 curveto +583.78463 197.13128 583.6121 197.53004 583.56653 198.04436 curveto +586.76965 198.03947 lineto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +553.82532 147.89853 moveto +553.82532 148.60165 lineto +553.52258 148.60165 lineto +552.71203 148.60165 552.16841 148.48121 551.89172 148.24033 curveto +551.61828 147.99944 551.48156 147.5193 551.48157 146.7999 curveto +551.48157 145.6329 lineto +551.48156 145.14137 551.39367 144.8012 551.2179 144.6124 curveto +551.04211 144.4236 550.7231 144.3292 550.26086 144.32919 curveto +549.96301 144.32919 lineto +549.96301 143.63095 lineto +550.26086 143.63095 lineto +550.72636 143.63095 551.04537 143.53818 551.2179 143.35263 curveto +551.39367 143.16383 551.48156 142.82692 551.48157 142.34189 curveto +551.48157 141.17001 lineto +551.48156 140.45062 551.61828 139.9721 551.89172 139.73447 curveto +552.16841 139.49359 552.71203 139.37315 553.52258 139.37314 curveto +553.82532 139.37314 lineto +553.82532 140.07138 lineto +553.49329 140.07138 lineto +553.0343 140.07139 552.73482 140.143 552.59485 140.28622 curveto +552.45487 140.42946 552.38488 140.73057 552.38489 141.18954 curveto +552.38489 142.40048 lineto +552.38488 142.91155 552.31001 143.28265 552.16028 143.51376 curveto +552.01379 143.74489 551.76151 143.90114 551.40344 143.98251 curveto +551.76477 144.07041 552.01867 144.22991 552.16516 144.46103 curveto +552.31164 144.69215 552.38488 145.06162 552.38489 145.56943 curveto +552.38489 146.78036 lineto +552.38488 147.23935 552.45487 147.54046 552.59485 147.68369 curveto +552.73482 147.82691 553.0343 147.89853 553.49329 147.89853 curveto +553.82532 147.89853 lineto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +559.51379 147.89853 moveto +559.85559 147.89853 lineto +560.31132 147.89853 560.60754 147.82854 560.74426 147.68857 curveto +560.88423 147.54859 560.95422 147.24586 560.95422 146.78036 curveto +560.95422 145.56943 lineto +560.95422 145.06162 561.02746 144.69215 561.17395 144.46103 curveto +561.32043 144.22991 561.57434 144.07041 561.93567 143.98251 curveto +561.57434 143.90114 561.32043 143.74489 561.17395 143.51376 curveto +561.02746 143.28265 560.95422 142.91155 560.95422 142.40048 curveto +560.95422 141.18954 lineto +560.95422 140.72731 560.88423 140.4262 560.74426 140.28622 curveto +560.60754 140.143 560.31132 140.07139 559.85559 140.07138 curveto +559.51379 140.07138 lineto +559.51379 139.37314 lineto +559.82141 139.37314 lineto +560.63196 139.37315 561.17232 139.49359 561.4425 139.73447 curveto +561.71594 139.9721 561.85266 140.45062 561.85266 141.17001 curveto +561.85266 142.34189 lineto +561.85266 142.82692 561.94055 143.16383 562.11633 143.35263 curveto +562.29211 143.53818 562.61112 143.63095 563.07336 143.63095 curveto +563.3761 143.63095 lineto +563.3761 144.32919 lineto +563.07336 144.32919 lineto +562.61112 144.3292 562.29211 144.4236 562.11633 144.6124 curveto +561.94055 144.8012 561.85266 145.14137 561.85266 145.6329 curveto +561.85266 146.7999 lineto +561.85266 147.5193 561.71594 147.99944 561.4425 148.24033 curveto +561.17232 148.48121 560.63196 148.60165 559.82141 148.60165 curveto +559.51379 148.60165 lineto +559.51379 147.89853 lineto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +554.20129 153.67001 moveto +554.20129 156.97079 lineto +553.30286 156.97079 lineto +553.30286 153.69931 lineto +553.30285 153.18174 553.20194 152.79437 553.00012 152.5372 curveto +552.7983 152.28004 552.49556 152.15146 552.09192 152.15146 curveto +551.60689 152.15146 551.2244 152.30609 550.94446 152.61533 curveto +550.66451 152.92457 550.52453 153.34612 550.52454 153.87997 curveto +550.52454 156.97079 lineto +549.62122 156.97079 lineto +549.62122 151.50204 lineto +550.52454 151.50204 lineto +550.52454 152.35165 lineto +550.73938 152.02288 550.99166 151.77711 551.28137 151.61435 curveto +551.57434 151.45159 551.91125 151.37021 552.29211 151.37021 curveto +552.92037 151.37021 553.39563 151.56553 553.7179 151.95615 curveto +554.04016 152.34352 554.20129 152.91481 554.20129 153.67001 curveto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +560.68079 154.01181 moveto +560.68079 154.45126 lineto +556.54993 154.45126 lineto +556.58899 155.06975 556.77453 155.54176 557.10657 155.86728 curveto +557.44185 156.18955 557.90735 156.35068 558.50305 156.35068 curveto +558.8481 156.35068 559.18176 156.30836 559.50403 156.22372 curveto +559.82954 156.13909 560.15181 156.01214 560.47083 155.84286 curveto +560.47083 156.69247 lineto +560.14855 156.82919 559.81815 156.93336 559.47961 157.00497 curveto +559.14107 157.07659 558.79764 157.1124 558.44934 157.1124 curveto +557.57694 157.1124 556.88521 156.85849 556.37415 156.35068 curveto +555.86633 155.84287 555.61243 155.15602 555.61243 154.29013 curveto +555.61243 153.39495 555.85331 152.68532 556.33508 152.16122 curveto +556.82011 151.63389 557.47278 151.37021 558.29309 151.37021 curveto +559.02876 151.37021 559.60982 151.60784 560.03625 152.0831 curveto +560.46594 152.55511 560.68078 153.19801 560.68079 154.01181 curveto +559.78235 153.74814 moveto +559.77583 153.25661 559.63749 152.86435 559.36731 152.57138 curveto +559.10038 152.27842 558.74556 152.13193 558.30286 152.13193 curveto +557.80155 152.13193 557.39953 152.27353 557.0968 152.55673 curveto +556.79732 152.83994 556.62479 153.2387 556.57922 153.75302 curveto +559.78235 153.74814 lineto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +566.52551 151.50204 moveto +564.54797 154.16318 lineto +566.62805 156.97079 lineto +565.56848 156.97079 lineto +563.97668 154.82236 lineto +562.38489 156.97079 lineto +561.32532 156.97079 lineto +563.44934 154.10947 lineto +561.50598 151.50204 lineto +562.56555 151.50204 lineto +564.01575 153.45029 lineto +565.46594 151.50204 lineto +566.52551 151.50204 lineto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +568.78625 149.94931 moveto +568.78625 151.50204 lineto +570.63684 151.50204 lineto +570.63684 152.20029 lineto +568.78625 152.20029 lineto +568.78625 155.16904 lineto +568.78625 155.615 568.84647 155.90146 568.96692 156.02841 curveto +569.09061 156.15537 569.33964 156.21884 569.71399 156.21884 curveto +570.63684 156.21884 lineto +570.63684 156.97079 lineto +569.71399 156.97079 lineto +569.02063 156.97079 568.54211 156.84221 568.27844 156.58505 curveto +568.01477 156.32464 567.88293 155.85263 567.88293 155.16904 curveto +567.88293 152.20029 lineto +567.22375 152.20029 lineto +567.22375 151.50204 lineto +567.88293 151.50204 lineto +567.88293 149.94931 lineto +568.78625 149.94931 lineto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +483.33514 94.963516 moveto +483.33514 98.264297 lineto +482.43671 98.264297 lineto +482.43671 94.992813 lineto +482.4367 94.475239 482.33579 94.087869 482.13397 93.830704 curveto +481.93215 93.573547 481.62941 93.444966 481.22577 93.444962 curveto +480.74074 93.444966 480.35825 93.599589 480.07831 93.908829 curveto +479.79836 94.218078 479.65838 94.639627 479.65839 95.173477 curveto +479.65839 98.264297 lineto +478.75507 98.264297 lineto +478.75507 92.795547 lineto +479.65839 92.795547 lineto +479.65839 93.645157 lineto +479.87323 93.316386 480.12551 93.070618 480.41522 92.907852 curveto +480.70819 92.745097 481.0451 92.663717 481.42596 92.663712 curveto +482.05422 92.663717 482.52948 92.859029 482.85175 93.249649 curveto +483.17401 93.637023 483.33514 94.208312 483.33514 94.963516 curveto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +487.25604 93.42543 moveto +486.77427 93.425435 486.39341 93.614237 486.11346 93.991837 curveto +485.83351 94.366189 485.69354 94.880512 485.69354 95.534805 curveto +485.69354 96.189104 485.83189 96.705054 486.10858 97.082657 curveto +486.38853 97.457007 486.77101 97.644181 487.25604 97.64418 curveto +487.73455 97.644181 488.11379 97.455379 488.39374 97.077774 curveto +488.67368 96.700171 488.81366 96.185849 488.81366 95.534805 curveto +488.81366 94.887022 488.67368 94.374327 488.39374 93.996719 curveto +488.11379 93.615865 487.73455 93.425435 487.25604 93.42543 curveto +487.25604 92.663712 moveto +488.03729 92.663717 488.65089 92.917623 489.09686 93.42543 curveto +489.54282 93.933247 489.7658 94.636371 489.76581 95.534805 curveto +489.7658 96.429989 489.54282 97.133114 489.09686 97.64418 curveto +488.65089 98.151993 488.03729 98.405899 487.25604 98.405899 curveto +486.47153 98.405899 485.8563 98.151993 485.41034 97.64418 curveto +484.96763 97.133114 484.74628 96.429989 484.74628 95.534805 curveto +484.74628 94.636371 484.96763 93.933247 485.41034 93.42543 curveto +485.8563 92.917623 486.47153 92.663717 487.25604 92.663712 curveto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +492.13885 91.242813 moveto +492.13885 92.795547 lineto +493.98944 92.795547 lineto +493.98944 93.49379 lineto +492.13885 93.49379 lineto +492.13885 96.46254 lineto +492.13885 96.908505 492.19907 97.194963 492.31952 97.321915 curveto +492.44321 97.448869 492.69224 97.512345 493.06659 97.512344 curveto +493.98944 97.512344 lineto +493.98944 98.264297 lineto +493.06659 98.264297 lineto +492.37323 98.264297 491.89471 98.135717 491.63104 97.878555 curveto +491.36737 97.618139 491.23553 97.146135 491.23553 96.46254 curveto +491.23553 93.49379 lineto +490.57635 93.49379 lineto +490.57635 92.795547 lineto +491.23553 92.795547 lineto +491.23553 91.242813 lineto +492.13885 91.242813 lineto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +499.8537 95.305313 moveto +499.8537 95.744766 lineto +495.72284 95.744766 lineto +495.7619 96.363258 495.94745 96.835262 496.27948 97.160782 curveto +496.61476 97.483048 497.08026 97.644181 497.67596 97.64418 curveto +498.02101 97.644181 498.35467 97.601863 498.67694 97.517227 curveto +499.00246 97.432593 499.32472 97.30564 499.64374 97.136368 curveto +499.64374 97.985977 lineto +499.32147 98.122696 498.99106 98.226863 498.65253 98.298477 curveto +498.31398 98.370092 497.97056 98.405899 497.62225 98.405899 curveto +496.74986 98.405899 496.05812 98.151993 495.54706 97.64418 curveto +495.03924 97.136369 494.78534 96.449521 494.78534 95.583633 curveto +494.78534 94.688455 495.02622 93.97882 495.508 93.454727 curveto +495.99302 92.927389 496.64569 92.663717 497.466 92.663712 curveto +498.20168 92.663717 498.78273 92.901347 499.20917 93.376602 curveto +499.63885 93.848612 499.85369 94.491515 499.8537 95.305313 curveto +498.95526 95.041641 moveto +498.94875 94.550108 498.8104 94.157856 498.54022 93.864883 curveto +498.27329 93.571919 497.91847 93.425435 497.47577 93.42543 curveto +496.97446 93.425435 496.57245 93.567037 496.26971 93.850235 curveto +495.97023 94.133442 495.79771 94.532205 495.75214 95.046524 curveto +498.95526 95.041641 lineto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +478.78925 100.66664 moveto +479.68768 100.66664 lineto +479.68768 108.2643 lineto +478.78925 108.2643 lineto +478.78925 100.66664 lineto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +486.24042 105.30531 moveto +486.24042 105.74477 lineto +482.10956 105.74477 lineto +482.14862 106.36326 482.33417 106.83526 482.6662 107.16078 curveto +483.00148 107.48305 483.46698 107.64418 484.06268 107.64418 curveto +484.40773 107.64418 484.74139 107.60186 485.06366 107.51723 curveto +485.38918 107.43259 485.71144 107.30564 486.03046 107.13637 curveto +486.03046 107.98598 lineto +485.70819 108.1227 485.37778 108.22686 485.03925 108.29848 curveto +484.7007 108.37009 484.35728 108.4059 484.00897 108.4059 curveto +483.13657 108.4059 482.44484 108.15199 481.93378 107.64418 curveto +481.42596 107.13637 481.17206 106.44952 481.17206 105.58363 curveto +481.17206 104.68845 481.41294 103.97882 481.89471 103.45473 curveto +482.37974 102.92739 483.03241 102.66372 483.85272 102.66371 curveto +484.5884 102.66372 485.16945 102.90135 485.59589 103.3766 curveto +486.02557 103.84861 486.24041 104.49151 486.24042 105.30531 curveto +485.34198 105.04164 moveto +485.33546 104.55011 485.19712 104.15786 484.92694 103.86488 curveto +484.66001 103.57192 484.30519 103.42544 483.86249 103.42543 curveto +483.36118 103.42544 482.95917 103.56704 482.65643 103.85023 curveto +482.35695 104.13344 482.18443 104.5322 482.13885 105.04652 curveto +485.34198 105.04164 lineto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +488.6037 101.24281 moveto +488.6037 102.79555 lineto +490.45428 102.79555 lineto +490.45428 103.49379 lineto +488.6037 103.49379 lineto +488.6037 106.46254 lineto +488.6037 106.9085 488.66392 107.19496 488.78436 107.32191 curveto +488.90806 107.44887 489.15708 107.51235 489.53143 107.51234 curveto +490.45428 107.51234 lineto +490.45428 108.2643 lineto +489.53143 108.2643 lineto +488.83807 108.2643 488.35956 108.13572 488.09589 107.87856 curveto +487.83221 107.61814 487.70038 107.14613 487.70038 106.46254 curveto +487.70038 103.49379 lineto +487.0412 103.49379 lineto +487.0412 102.79555 lineto +487.70038 102.79555 lineto +487.70038 101.24281 lineto +488.6037 101.24281 lineto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +44.641342 188.13469 moveto +44.641342 184.82414 lineto +45.53978 184.82414 lineto +45.53978 188.10051 lineto +45.539778 188.61809 45.640689 189.00709 45.842514 189.2675 curveto +46.044335 189.52466 46.347069 189.65324 46.750717 189.65324 curveto +47.23574 189.65324 47.618226 189.49862 47.898178 189.18938 curveto +48.181377 188.88013 48.322978 188.45858 48.322983 187.92473 curveto +48.322983 184.82414 lineto +49.22142 184.82414 lineto +49.22142 190.29289 lineto +48.322983 190.29289 lineto +48.322983 189.45305 lineto +48.10488 189.78508 47.850974 190.03248 47.561264 190.19524 curveto +47.274802 190.35474 46.941144 190.43449 46.560287 190.43449 curveto +45.93203 190.43449 45.455143 190.23918 45.129623 189.84856 curveto +44.804102 189.45793 44.641341 188.88664 44.641342 188.13469 curveto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +54.5681 184.98528 moveto +54.5681 185.83488 lineto +54.31419 185.70468 54.050518 185.60702 53.777084 185.54192 curveto +53.503643 185.47682 53.220441 185.44426 52.927475 185.44426 curveto +52.481509 185.44426 52.146223 185.51262 51.921616 185.64934 curveto +51.70026 185.78606 51.589583 185.99114 51.589584 186.26457 curveto +51.589583 186.47291 51.669335 186.6373 51.828842 186.75774 curveto +51.988346 186.87493 52.308983 186.98723 52.790756 187.09465 curveto +53.098373 187.16301 lineto +53.736391 187.29973 54.188864 187.49342 54.455795 187.74406 curveto +54.725973 187.99146 54.861064 188.33814 54.861069 188.7841 curveto +54.861064 189.29192 54.659241 189.69393 54.2556 189.99016 curveto +53.855206 190.28638 53.303448 190.43449 52.600327 190.43449 curveto +52.307356 190.43449 52.001366 190.4052 51.682358 190.3466 curveto +51.366601 190.29126 51.032943 190.20663 50.681381 190.0927 curveto +50.681381 189.16496 lineto +51.013412 189.33749 51.34056 189.4677 51.662827 189.55559 curveto +51.98509 189.64022 52.3041 189.68254 52.619858 189.68254 curveto +53.043032 189.68254 53.368552 189.61093 53.59642 189.4677 curveto +53.824281 189.32121 53.938213 189.11614 53.938217 188.85246 curveto +53.938213 188.60832 53.855206 188.42115 53.689194 188.29094 curveto +53.52643 188.16073 53.16673 188.03541 52.610092 187.91496 curveto +52.297592 187.84172 lineto +51.74095 187.72454 51.338932 187.5455 51.091537 187.30461 curveto +50.844141 187.06047 50.720443 186.72682 50.720444 186.30363 curveto +50.720443 185.78932 50.902735 185.39218 51.267319 185.11223 curveto +51.631901 184.83229 52.149478 184.69231 52.820053 184.69231 curveto +53.152081 184.69231 53.464581 184.71673 53.757553 184.76555 curveto +54.050518 184.81438 54.3207 184.88762 54.5681 184.98528 curveto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +56.296616 184.82414 moveto +57.195053 184.82414 lineto +57.195053 190.29289 lineto +56.296616 190.29289 lineto +56.296616 184.82414 lineto +56.296616 182.69524 moveto +57.195053 182.69524 lineto +57.195053 183.83293 lineto +56.296616 183.83293 lineto +56.296616 182.69524 lineto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +63.615952 186.99211 moveto +63.615952 190.29289 lineto +62.717514 190.29289 lineto +62.717514 187.02141 lineto +62.717509 186.50383 62.616598 186.11646 62.41478 185.8593 curveto +62.212953 185.60214 61.910219 185.47356 61.506577 185.47356 curveto +61.021548 185.47356 60.639061 185.62818 60.359116 185.93742 curveto +60.079166 186.24667 59.939192 186.66822 59.939194 187.20207 curveto +59.939194 190.29289 lineto +59.035873 190.29289 lineto +59.035873 184.82414 lineto +59.939194 184.82414 lineto +59.939194 185.67375 lineto +60.154035 185.34498 60.406314 185.09921 60.69603 184.93645 curveto +60.988996 184.77369 61.325909 184.69231 61.706772 184.69231 curveto +62.335023 184.69231 62.810283 184.88762 63.132553 185.27824 curveto +63.454813 185.66562 63.615946 186.23691 63.615952 186.99211 curveto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +69.016342 187.49504 moveto +69.016338 186.844 68.881247 186.33945 68.611069 185.98137 curveto +68.344138 185.6233 67.968162 185.44426 67.483139 185.44426 curveto +67.001366 185.44426 66.625389 185.6233 66.355209 185.98137 curveto +66.088281 186.33945 65.954817 186.844 65.954819 187.49504 curveto +65.954817 188.14283 66.088281 188.64576 66.355209 189.00383 curveto +66.625389 189.3619 67.001366 189.54094 67.483139 189.54094 curveto +67.968162 189.54094 68.344138 189.3619 68.611069 189.00383 curveto +68.881247 188.64576 69.016338 188.14283 69.016342 187.49504 curveto +69.91478 189.61418 moveto +69.914774 190.54517 69.708069 191.2369 69.294662 191.68938 curveto +68.881247 192.1451 68.248109 192.37297 67.395248 192.37297 curveto +67.079491 192.37297 66.781639 192.34855 66.501694 192.29973 curveto +66.221744 192.25415 65.949934 192.18254 65.686264 192.08488 curveto +65.686264 191.21086 lineto +65.949934 191.35409 66.210351 191.45988 66.467514 191.52824 curveto +66.724673 191.5966 66.986717 191.63078 67.253647 191.63078 curveto +67.842836 191.63078 68.283916 191.47616 68.576889 191.16692 curveto +68.869853 190.86093 69.016338 190.39706 69.016342 189.77531 curveto +69.016342 189.33098 lineto +68.830791 189.65324 68.593161 189.89413 68.303452 190.05363 curveto +68.013734 190.21314 67.667055 190.29289 67.263412 190.29289 curveto +66.592837 190.29289 66.052473 190.03736 65.642319 189.52629 curveto +65.232162 189.01522 65.027084 188.33814 65.027084 187.49504 curveto +65.027084 186.64869 65.232162 185.96998 65.642319 185.45891 curveto +66.052473 184.94785 66.592837 184.69231 67.263412 184.69231 curveto +67.667055 184.69231 68.013734 184.77206 68.303452 184.93156 curveto +68.593161 185.09107 68.830791 185.33196 69.016342 185.65422 curveto +69.016342 184.82414 lineto +69.91478 184.82414 lineto +69.91478 189.61418 lineto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +44.641342 198.13469 moveto +44.641342 194.82414 lineto +45.53978 194.82414 lineto +45.53978 198.10051 lineto +45.539778 198.61809 45.640689 199.00709 45.842514 199.2675 curveto +46.044335 199.52466 46.347069 199.65324 46.750717 199.65324 curveto +47.23574 199.65324 47.618226 199.49862 47.898178 199.18938 curveto +48.181377 198.88013 48.322978 198.45858 48.322983 197.92473 curveto +48.322983 194.82414 lineto +49.22142 194.82414 lineto +49.22142 200.29289 lineto +48.322983 200.29289 lineto +48.322983 199.45305 lineto +48.10488 199.78508 47.850974 200.03248 47.561264 200.19524 curveto +47.274802 200.35474 46.941144 200.43449 46.560287 200.43449 curveto +45.93203 200.43449 45.455143 200.23918 45.129623 199.84856 curveto +44.804102 199.45793 44.641341 198.88664 44.641342 198.13469 curveto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +55.62767 196.99211 moveto +55.62767 200.29289 lineto +54.729233 200.29289 lineto +54.729233 197.02141 lineto +54.729228 196.50383 54.628317 196.11646 54.426498 195.8593 curveto +54.224671 195.60214 53.921937 195.47356 53.518295 195.47356 curveto +53.033266 195.47356 52.65078 195.62818 52.370834 195.93742 curveto +52.090884 196.24667 51.950911 196.66822 51.950912 197.20207 curveto +51.950912 200.29289 lineto +51.047592 200.29289 lineto +51.047592 194.82414 lineto +51.950912 194.82414 lineto +51.950912 195.67375 lineto +52.165754 195.34498 52.418033 195.09921 52.707748 194.93645 curveto +53.000714 194.77369 53.337628 194.69231 53.718491 194.69231 curveto +54.346742 194.69231 54.822002 194.88762 55.144272 195.27824 curveto +55.466532 195.66562 55.627665 196.23691 55.62767 196.99211 curveto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +60.197983 192.69524 moveto +60.197983 193.44231 lineto +59.338608 193.44231 lineto +59.01634 193.44231 58.79173 193.50742 58.66478 193.63762 curveto +58.54108 193.76783 58.479231 194.00221 58.479233 194.34074 curveto +58.479233 194.82414 lineto +59.958725 194.82414 lineto +59.958725 195.52238 lineto +58.479233 195.52238 lineto +58.479233 200.29289 lineto +57.575912 200.29289 lineto +57.575912 195.52238 lineto +56.716537 195.52238 lineto +56.716537 194.82414 lineto +57.575912 194.82414 lineto +57.575912 194.44328 lineto +57.575911 193.83457 57.717513 193.39186 58.000717 193.11516 curveto +58.283918 192.83522 58.733137 192.69524 59.348373 192.69524 curveto +60.197983 192.69524 lineto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +63.064194 195.45403 moveto +62.58242 195.45403 62.201561 195.64283 61.921616 196.02043 curveto +61.641666 196.39478 61.501692 196.90911 61.501694 197.5634 curveto +61.501692 198.2177 61.640038 198.73365 61.916733 199.11125 curveto +62.196679 199.4856 62.579165 199.67278 63.064194 199.67278 curveto +63.542706 199.67278 63.921937 199.48397 64.201889 199.10637 curveto +64.481832 198.72877 64.621806 198.21444 64.621811 197.5634 curveto +64.621806 196.91562 64.481832 196.40292 64.201889 196.02531 curveto +63.921937 195.64446 63.542706 195.45403 63.064194 195.45403 curveto +63.064194 194.69231 moveto +63.84544 194.69231 64.459046 194.94622 64.905014 195.45403 curveto +65.350972 195.96184 65.573954 196.66497 65.573959 197.5634 curveto +65.573954 198.45858 65.350972 199.16171 64.905014 199.67278 curveto +64.459046 200.18059 63.84544 200.43449 63.064194 200.43449 curveto +62.279686 200.43449 61.664452 200.18059 61.218491 199.67278 curveto +60.775781 199.16171 60.554428 198.45858 60.554428 197.5634 curveto +60.554428 196.66497 60.775781 195.96184 61.218491 195.45403 curveto +61.664452 194.94622 62.279686 194.69231 63.064194 194.69231 curveto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +67.058334 192.69524 moveto +67.956772 192.69524 lineto +67.956772 200.29289 lineto +67.058334 200.29289 lineto +67.058334 192.69524 lineto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +73.430405 195.65422 moveto +73.430405 192.69524 lineto +74.328842 192.69524 lineto +74.328842 200.29289 lineto +73.430405 200.29289 lineto +73.430405 199.47258 lineto +73.241598 199.7981 73.002341 200.04061 72.712631 200.20012 curveto +72.426169 200.35637 72.081118 200.43449 71.677475 200.43449 curveto +71.016666 200.43449 70.477929 200.17082 70.061264 199.64348 curveto +69.647852 199.11614 69.441146 198.42278 69.441147 197.5634 curveto +69.441146 196.70403 69.647852 196.01067 70.061264 195.48332 curveto +70.477929 194.95598 71.016666 194.69231 71.677475 194.69231 curveto +72.081118 194.69231 72.426169 194.77206 72.712631 194.93156 curveto +73.002341 195.08782 73.241598 195.3287 73.430405 195.65422 curveto +70.368881 197.5634 moveto +70.36888 198.22421 70.503971 198.74341 70.774155 199.12102 curveto +71.04759 199.49537 71.421939 199.68254 71.897202 199.68254 curveto +72.372458 199.68254 72.746807 199.49537 73.020248 199.12102 curveto +73.293682 198.74341 73.4304 198.22421 73.430405 197.5634 curveto +73.4304 196.9026 73.293682 196.38502 73.020248 196.01067 curveto +72.746807 195.63307 72.372458 195.44426 71.897202 195.44426 curveto +71.421939 195.44426 71.04759 195.63307 70.774155 196.01067 curveto +70.503971 196.38502 70.36888 196.9026 70.368881 197.5634 curveto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +76.179428 194.82414 moveto +77.077866 194.82414 lineto +77.077866 200.29289 lineto +76.179428 200.29289 lineto +76.179428 194.82414 lineto +76.179428 192.69524 moveto +77.077866 192.69524 lineto +77.077866 193.83293 lineto +76.179428 193.83293 lineto +76.179428 192.69524 lineto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +83.498764 196.99211 moveto +83.498764 200.29289 lineto +82.600327 200.29289 lineto +82.600327 197.02141 lineto +82.600322 196.50383 82.499411 196.11646 82.297592 195.8593 curveto +82.095765 195.60214 81.793031 195.47356 81.389389 195.47356 curveto +80.90436 195.47356 80.521874 195.62818 80.241928 195.93742 curveto +79.961978 196.24667 79.822004 196.66822 79.822006 197.20207 curveto +79.822006 200.29289 lineto +78.918686 200.29289 lineto +78.918686 194.82414 lineto +79.822006 194.82414 lineto +79.822006 195.67375 lineto +80.036848 195.34498 80.289126 195.09921 80.578842 194.93645 curveto +80.871808 194.77369 81.208722 194.69231 81.589584 194.69231 curveto +82.217835 194.69231 82.693095 194.88762 83.015366 195.27824 curveto +83.337626 195.66562 83.498759 196.23691 83.498764 196.99211 curveto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +88.899155 197.49504 moveto +88.89915 196.844 88.764059 196.33945 88.493881 195.98137 curveto +88.22695 195.6233 87.850974 195.44426 87.365952 195.44426 curveto +86.884178 195.44426 86.508202 195.6233 86.238022 195.98137 curveto +85.971093 196.33945 85.83763 196.844 85.837631 197.49504 curveto +85.83763 198.14283 85.971093 198.64576 86.238022 199.00383 curveto +86.508202 199.3619 86.884178 199.54094 87.365952 199.54094 curveto +87.850974 199.54094 88.22695 199.3619 88.493881 199.00383 curveto +88.764059 198.64576 88.89915 198.14283 88.899155 197.49504 curveto +89.797592 199.61418 moveto +89.797587 200.54517 89.590881 201.2369 89.177475 201.68938 curveto +88.764059 202.1451 88.130922 202.37297 87.278061 202.37297 curveto +86.962303 202.37297 86.664452 202.34855 86.384506 202.29973 curveto +86.104557 202.25415 85.832747 202.18254 85.569077 202.08488 curveto +85.569077 201.21086 lineto +85.832747 201.35409 86.093163 201.45988 86.350327 201.52824 curveto +86.607486 201.5966 86.86953 201.63078 87.136459 201.63078 curveto +87.725649 201.63078 88.166729 201.47616 88.459702 201.16692 curveto +88.752666 200.86093 88.89915 200.39706 88.899155 199.77531 curveto +88.899155 199.33098 lineto +88.713603 199.65324 88.475973 199.89413 88.186264 200.05363 curveto +87.896547 200.21314 87.549868 200.29289 87.146225 200.29289 curveto +86.47565 200.29289 85.935286 200.03736 85.525131 199.52629 curveto +85.114974 199.01522 84.909896 198.33814 84.909897 197.49504 curveto +84.909896 196.64869 85.114974 195.96998 85.525131 195.45891 curveto +85.935286 194.94785 86.47565 194.69231 87.146225 194.69231 curveto +87.549868 194.69231 87.896547 194.77206 88.186264 194.93156 curveto +88.475973 195.09107 88.713603 195.33196 88.899155 195.65422 curveto +88.899155 194.82414 lineto +89.797592 194.82414 lineto +89.797592 199.61418 lineto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +380.48996 223.50369 moveto +380.48996 225.05643 lineto +382.34055 225.05643 lineto +382.34055 225.75467 lineto +380.48996 225.75467 lineto +380.48996 228.72342 lineto +380.48996 229.16938 380.55018 229.45584 380.67062 229.58279 curveto +380.79432 229.70975 381.04334 229.77322 381.41769 229.77322 curveto +382.34055 229.77322 lineto +382.34055 230.52518 lineto +381.41769 230.52518 lineto +380.72433 230.52518 380.24582 230.3966 379.98215 230.13943 curveto +379.71847 229.87902 379.58664 229.40701 379.58664 228.72342 curveto +379.58664 225.75467 lineto +378.92746 225.75467 lineto +378.92746 225.05643 lineto +379.58664 225.05643 lineto +379.58664 223.50369 lineto +380.48996 223.50369 lineto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +388.07297 227.2244 moveto +388.07297 230.52518 lineto +387.17453 230.52518 lineto +387.17453 227.25369 lineto +387.17453 226.73612 387.07361 226.34875 386.8718 226.09158 curveto +386.66997 225.83443 386.36723 225.70585 385.96359 225.70584 curveto +385.47856 225.70585 385.09608 225.86047 384.81613 226.16971 curveto +384.53618 226.47896 384.39621 226.90051 384.39621 227.43436 curveto +384.39621 230.52518 lineto +383.49289 230.52518 lineto +383.49289 222.92752 lineto +384.39621 222.92752 lineto +384.39621 225.90604 lineto +384.61105 225.57727 384.86333 225.3315 385.15305 225.16873 curveto +385.44601 225.00598 385.78293 224.9246 386.16379 224.92459 curveto +386.79204 224.9246 387.2673 225.11991 387.58957 225.51053 curveto +387.91183 225.8979 388.07296 226.46919 388.07297 227.2244 curveto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +394.55246 227.56619 moveto +394.55246 228.00565 lineto +390.4216 228.00565 lineto +390.46066 228.62414 390.64621 229.09614 390.97824 229.42166 curveto +391.31353 229.74393 391.77902 229.90506 392.37473 229.90506 curveto +392.71977 229.90506 393.05343 229.86274 393.3757 229.77811 curveto +393.70122 229.69347 394.02348 229.56652 394.3425 229.39725 curveto +394.3425 230.24686 lineto +394.02023 230.38358 393.68982 230.48774 393.35129 230.55936 curveto +393.01274 230.63097 392.66932 230.66678 392.32101 230.66678 curveto +391.44862 230.66678 390.75688 230.41287 390.24582 229.90506 curveto +389.73801 229.39725 389.4841 228.7104 389.4841 227.84451 curveto +389.4841 226.94933 389.72498 226.2397 390.20676 225.71561 curveto +390.69178 225.18827 391.34445 224.9246 392.16476 224.92459 curveto +392.90044 224.9246 393.48149 225.16223 393.90793 225.63748 curveto +394.33761 226.10949 394.55245 226.75239 394.55246 227.56619 curveto +393.65402 227.30252 moveto +393.64751 226.81099 393.50916 226.41874 393.23898 226.12576 curveto +392.97205 225.8328 392.61723 225.68631 392.17453 225.68631 curveto +391.67323 225.68631 391.27121 225.82792 390.96848 226.11111 curveto +390.66899 226.39432 390.49647 226.79308 390.4509 227.3074 curveto +393.65402 227.30252 lineto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +400.57297 227.2244 moveto +400.57297 230.52518 lineto +399.67453 230.52518 lineto +399.67453 227.25369 lineto +399.67453 226.73612 399.57361 226.34875 399.3718 226.09158 curveto +399.16997 225.83443 398.86723 225.70585 398.46359 225.70584 curveto +397.97856 225.70585 397.59608 225.86047 397.31613 226.16971 curveto +397.03618 226.47896 396.89621 226.90051 396.89621 227.43436 curveto +396.89621 230.52518 lineto +395.99289 230.52518 lineto +395.99289 225.05643 lineto +396.89621 225.05643 lineto +396.89621 225.90604 lineto +397.11105 225.57727 397.36333 225.3315 397.65305 225.16873 curveto +397.94601 225.00598 398.28293 224.9246 398.66379 224.92459 curveto +399.29204 224.9246 399.7673 225.11991 400.08957 225.51053 curveto +400.41183 225.8979 400.57296 226.46919 400.57297 227.2244 curveto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +239.47623 229.75269 moveto +239.47623 233.05347 lineto +238.57779 233.05347 lineto +238.57779 229.78198 lineto +238.57778 229.26441 238.47687 228.87704 238.27505 228.61987 curveto +238.07323 228.36272 237.77049 228.23414 237.36685 228.23413 curveto +236.88182 228.23414 236.49934 228.38876 236.21939 228.698 curveto +235.93944 229.00725 235.79947 229.4288 235.79947 229.96265 curveto +235.79947 233.05347 lineto +234.89615 233.05347 lineto +234.89615 225.45581 lineto +235.79947 225.45581 lineto +235.79947 228.43433 lineto +236.01431 228.10556 236.26659 227.85979 236.5563 227.69702 curveto +236.84927 227.53427 237.18618 227.45289 237.56705 227.45288 curveto +238.1953 227.45289 238.67056 227.6482 238.99283 228.03882 curveto +239.31509 228.42619 239.47622 228.99748 239.47623 229.75269 curveto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +243.76334 230.30444 moveto +243.03742 230.30445 242.53449 230.38745 242.25455 230.55347 curveto +241.9746 230.71948 241.83462 231.00269 241.83463 231.40308 curveto +241.83462 231.72209 241.93879 231.97599 242.14713 232.16479 curveto +242.35871 232.35034 242.64517 232.44312 243.0065 232.44312 curveto +243.50454 232.44312 243.90331 232.26733 244.20279 231.91577 curveto +244.50552 231.56096 244.65689 231.09058 244.65689 230.50464 curveto +244.65689 230.30444 lineto +243.76334 230.30444 lineto +245.55533 229.93335 moveto +245.55533 233.05347 lineto +244.65689 233.05347 lineto +244.65689 232.22339 lineto +244.45181 232.55542 244.19628 232.80119 243.89029 232.96069 curveto +243.5843 233.11694 243.20995 233.19507 242.76724 233.19507 curveto +242.20734 233.19507 241.76138 233.03882 241.42935 232.72632 curveto +241.10057 232.41056 240.93619 231.98901 240.93619 231.46167 curveto +240.93619 230.84644 241.14127 230.38257 241.55142 230.07007 curveto +241.96483 229.75757 242.58007 229.60132 243.39713 229.60132 curveto +244.65689 229.60132 lineto +244.65689 229.51343 lineto +244.65689 229.10002 244.52017 228.78101 244.24673 228.5564 curveto +243.97655 228.32854 243.59569 228.2146 243.10416 228.2146 curveto +242.79165 228.2146 242.48729 228.25204 242.19107 228.3269 curveto +241.89485 228.40178 241.61001 228.51408 241.33658 228.66382 curveto +241.33658 227.83374 lineto +241.66535 227.70679 241.98436 227.61239 242.29361 227.55054 curveto +242.60285 227.48544 242.90396 227.45289 243.19693 227.45288 curveto +243.98794 227.45289 244.57876 227.65796 244.96939 228.06812 curveto +245.36001 228.47828 245.55532 229.10002 245.55533 229.93335 curveto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +246.76627 227.58472 moveto +247.71841 227.58472 lineto +249.4274 232.17456 lineto +251.13638 227.58472 lineto +252.08853 227.58472 lineto +250.03775 233.05347 lineto +248.81705 233.05347 lineto +246.76627 227.58472 lineto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +258.0065 230.09448 moveto +258.0065 230.53394 lineto +253.87564 230.53394 lineto +253.9147 231.15243 254.10025 231.62443 254.43228 231.94995 curveto +254.76757 232.27222 255.23306 232.43335 255.82877 232.43335 curveto +256.17381 232.43335 256.50747 232.39103 256.82974 232.3064 curveto +257.15526 232.22176 257.47752 232.09481 257.79654 231.92554 curveto +257.79654 232.77515 lineto +257.47427 232.91187 257.14387 233.01603 256.80533 233.08765 curveto +256.46678 233.15926 256.12336 233.19507 255.77505 233.19507 curveto +254.90266 233.19507 254.21093 232.94116 253.69986 232.43335 curveto +253.19205 231.92554 252.93814 231.23869 252.93814 230.3728 curveto +252.93814 229.47762 253.17903 228.76799 253.6608 228.2439 curveto +254.14582 227.71656 254.79849 227.45289 255.6188 227.45288 curveto +256.35448 227.45289 256.93553 227.69052 257.36197 228.16577 curveto +257.79165 228.63778 258.00649 229.28068 258.0065 230.09448 curveto +257.10806 229.83081 moveto +257.10155 229.33928 256.9632 228.94703 256.69302 228.65405 curveto +256.42609 228.36109 256.07128 228.2146 255.62857 228.2146 curveto +255.12727 228.2146 254.72525 228.35621 254.42252 228.6394 curveto +254.12303 228.92261 253.95051 229.32137 253.90494 229.83569 curveto +257.10806 229.83081 lineto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +238.41666 242.74585 moveto +238.41666 243.59546 lineto +238.16275 243.46526 237.89907 243.3676 237.62564 243.30249 curveto +237.3522 243.23739 237.069 243.20484 236.77603 243.20483 curveto +236.33007 243.20484 235.99478 243.2732 235.77017 243.40991 curveto +235.54882 243.54664 235.43814 243.75171 235.43814 244.02515 curveto +235.43814 244.23348 235.51789 244.39787 235.6774 244.51831 curveto +235.8369 244.6355 236.15754 244.74781 236.63931 244.85522 curveto +236.94693 244.92358 lineto +237.58495 245.06031 238.03742 245.25399 238.30435 245.50464 curveto +238.57453 245.75204 238.70962 246.09872 238.70963 246.54468 curveto +238.70962 247.05249 238.5078 247.45451 238.10416 247.75073 curveto +237.70376 248.04696 237.152 248.19507 236.44888 248.19507 curveto +236.15591 248.19507 235.84992 248.16577 235.53091 248.10718 curveto +235.21516 248.05184 234.8815 247.9672 234.52994 247.85327 curveto +234.52994 246.92554 lineto +234.86197 247.09806 235.18912 247.22827 235.51138 247.31616 curveto +235.83365 247.4008 236.15266 247.44312 236.46841 247.44312 curveto +236.89159 247.44312 237.21711 247.3715 237.44498 247.22827 curveto +237.67284 247.08179 237.78677 246.87671 237.78677 246.61304 curveto +237.78677 246.3689 237.70376 246.18172 237.53775 246.05151 curveto +237.37499 245.92131 237.01529 245.79598 236.45865 245.67554 curveto +236.14615 245.60229 lineto +235.58951 245.48511 235.18749 245.30607 234.94009 245.06519 curveto +234.6927 244.82105 234.569 244.48739 234.569 244.06421 curveto +234.569 243.54989 234.75129 243.15276 235.11588 242.8728 curveto +235.48046 242.59286 235.99803 242.45289 236.66861 242.45288 curveto +237.00064 242.45289 237.31314 242.4773 237.60611 242.52612 curveto +237.89907 242.57496 238.16926 242.6482 238.41666 242.74585 curveto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +244.69107 244.75269 moveto +244.69107 248.05347 lineto +243.79263 248.05347 lineto +243.79263 244.78198 lineto +243.79263 244.26441 243.69172 243.87704 243.4899 243.61987 curveto +243.28807 243.36272 242.98534 243.23414 242.5817 243.23413 curveto +242.09667 243.23414 241.71418 243.38876 241.43423 243.698 curveto +241.15428 244.00725 241.01431 244.4288 241.01431 244.96265 curveto +241.01431 248.05347 lineto +240.11099 248.05347 lineto +240.11099 240.45581 lineto +241.01431 240.45581 lineto +241.01431 243.43433 lineto +241.22915 243.10556 241.48143 242.85979 241.77115 242.69702 curveto +242.06411 242.53427 242.40103 242.45289 242.78189 242.45288 curveto +243.41014 242.45289 243.8854 242.6482 244.20767 243.03882 curveto +244.52993 243.42619 244.69107 243.99748 244.69107 244.75269 curveto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +248.61197 243.2146 moveto +248.1302 243.2146 247.74934 243.40341 247.46939 243.78101 curveto +247.18944 244.15536 247.04947 244.66968 247.04947 245.32397 curveto +247.04947 245.97827 247.18781 246.49422 247.46451 246.87183 curveto +247.74445 247.24618 248.12694 247.43335 248.61197 247.43335 curveto +249.09048 247.43335 249.46971 247.24455 249.74966 246.86694 curveto +250.02961 246.48934 250.16958 245.97502 250.16959 245.32397 curveto +250.16958 244.67619 250.02961 244.1635 249.74966 243.78589 curveto +249.46971 243.40503 249.09048 243.2146 248.61197 243.2146 curveto +248.61197 242.45288 moveto +249.39322 242.45289 250.00682 242.70679 250.45279 243.2146 curveto +250.89875 243.72242 251.12173 244.42554 251.12173 245.32397 curveto +251.12173 246.21916 250.89875 246.92228 250.45279 247.43335 curveto +250.00682 247.94116 249.39322 248.19507 248.61197 248.19507 curveto +247.82746 248.19507 247.21223 247.94116 246.76627 247.43335 curveto +246.32356 246.92228 246.1022 246.21916 246.1022 245.32397 curveto +246.1022 244.42554 246.32356 243.72242 246.76627 243.2146 curveto +247.21223 242.70679 247.82746 242.45289 248.61197 242.45288 curveto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +252.08365 242.58472 moveto +252.98209 242.58472 lineto +254.10513 246.85229 lineto +255.2233 242.58472 lineto +256.28287 242.58472 lineto +257.40591 246.85229 lineto +258.52408 242.58472 lineto +259.42252 242.58472 lineto +257.99185 248.05347 lineto +256.93228 248.05347 lineto +255.75552 243.57104 lineto +254.57388 248.05347 lineto +253.51431 248.05347 lineto +252.08365 242.58472 lineto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +311.38464 185.46135 moveto +311.38464 188.76213 lineto +310.48621 188.76213 lineto +310.48621 185.49065 lineto +310.4862 184.97307 310.38529 184.5857 310.18347 184.32854 curveto +309.98164 184.07138 309.67891 183.9428 309.27527 183.94279 curveto +308.79024 183.9428 308.40775 184.09742 308.12781 184.40666 curveto +307.84786 184.71591 307.70788 185.13746 307.70789 185.67131 curveto +307.70789 188.76213 lineto +306.80457 188.76213 lineto +306.80457 181.16447 lineto +307.70789 181.16447 lineto +307.70789 184.14299 lineto +307.92273 183.81422 308.17501 183.56845 308.46472 183.40569 curveto +308.75769 183.24293 309.0946 183.16155 309.47546 183.16154 curveto +310.10371 183.16155 310.57897 183.35686 310.90125 183.74748 curveto +311.22351 184.13486 311.38464 184.70615 311.38464 185.46135 curveto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +315.67175 186.01311 moveto +314.94584 186.01311 314.44291 186.09612 314.16296 186.26213 curveto +313.88301 186.42815 313.74304 186.71135 313.74304 187.11174 curveto +313.74304 187.43075 313.84721 187.68466 314.05554 187.87346 curveto +314.26713 188.05901 314.55359 188.15178 314.91492 188.15178 curveto +315.41296 188.15178 315.81172 187.976 316.11121 187.62444 curveto +316.41394 187.26962 316.5653 186.79924 316.56531 186.2133 curveto +316.56531 186.01311 lineto +315.67175 186.01311 lineto +317.46375 185.64201 moveto +317.46375 188.76213 lineto +316.56531 188.76213 lineto +316.56531 187.93205 lineto +316.36023 188.26408 316.10469 188.50985 315.79871 188.66936 curveto +315.49271 188.82561 315.11836 188.90373 314.67566 188.90373 curveto +314.11576 188.90373 313.6698 188.74748 313.33777 188.43498 curveto +313.00899 188.11923 312.8446 187.69768 312.8446 187.17033 curveto +312.8446 186.5551 313.04968 186.09123 313.45984 185.77873 curveto +313.87325 185.46624 314.48848 185.30999 315.30554 185.30998 curveto +316.56531 185.30998 lineto +316.56531 185.22209 lineto +316.5653 184.80868 316.42858 184.48967 316.15515 184.26506 curveto +315.88497 184.0372 315.50411 183.92327 315.01257 183.92326 curveto +314.70007 183.92327 314.39571 183.9607 314.09949 184.03557 curveto +313.80326 184.11044 313.51843 184.22275 313.245 184.37248 curveto +313.245 183.5424 lineto +313.57377 183.41546 313.89278 183.32106 314.20203 183.2592 curveto +314.51127 183.1941 314.81238 183.16155 315.10535 183.16154 curveto +315.89636 183.16155 316.48718 183.36663 316.87781 183.77678 curveto +317.26843 184.18694 317.46374 184.80868 317.46375 185.64201 curveto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +318.67468 183.29338 moveto +319.62683 183.29338 lineto +321.33582 187.88322 lineto +323.0448 183.29338 lineto +323.99695 183.29338 lineto +321.94617 188.76213 lineto +320.72546 188.76213 lineto +318.67468 183.29338 lineto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +329.91492 185.80315 moveto +329.91492 186.2426 lineto +325.78406 186.2426 lineto +325.82312 186.86109 326.00867 187.3331 326.3407 187.65862 curveto +326.67598 187.98088 327.14148 188.14201 327.73718 188.14201 curveto +328.08223 188.14201 328.41589 188.0997 328.73816 188.01506 curveto +329.06368 187.93043 329.38594 187.80347 329.70496 187.6342 curveto +329.70496 188.48381 lineto +329.38269 188.62053 329.05228 188.7247 328.71375 188.79631 curveto +328.3752 188.86792 328.03178 188.90373 327.68347 188.90373 curveto +326.81107 188.90373 326.11934 188.64983 325.60828 188.14201 curveto +325.10046 187.6342 324.84656 186.94735 324.84656 186.08147 curveto +324.84656 185.18629 325.08744 184.47665 325.56921 183.95256 curveto +326.05424 183.42522 326.70691 183.16155 327.52722 183.16154 curveto +328.26289 183.16155 328.84395 183.39918 329.27039 183.87444 curveto +329.70007 184.34645 329.91491 184.98935 329.91492 185.80315 curveto +329.01648 185.53947 moveto +329.00996 185.04794 328.87162 184.65569 328.60144 184.36272 curveto +328.33451 184.06975 327.97969 183.92327 327.53699 183.92326 curveto +327.03568 183.92327 326.63366 184.06487 326.33093 184.34807 curveto +326.03145 184.63128 325.85893 185.03004 325.81335 185.54436 curveto +329.01648 185.53947 lineto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +310.32507 198.45451 moveto +310.32507 199.30412 lineto +310.07116 199.17392 309.80749 199.07626 309.53406 199.01115 curveto +309.26062 198.94605 308.97741 198.9135 308.68445 198.9135 curveto +308.23848 198.9135 307.9032 198.98186 307.67859 199.11858 curveto +307.45723 199.2553 307.34656 199.46038 307.34656 199.73381 curveto +307.34656 199.94215 307.42631 200.10654 307.58582 200.22697 curveto +307.74532 200.34417 308.06596 200.45647 308.54773 200.56389 curveto +308.85535 200.63225 lineto +309.49336 200.76897 309.94584 200.96265 310.21277 201.2133 curveto +310.48295 201.4607 310.61804 201.80738 310.61804 202.25334 curveto +310.61804 202.76116 310.41621 203.16317 310.01257 203.4594 curveto +309.61218 203.75562 309.06042 203.90373 308.3573 203.90373 curveto +308.06433 203.90373 307.75834 203.87444 307.43933 203.81584 curveto +307.12357 203.7605 306.78992 203.67587 306.43835 203.56194 curveto +306.43835 202.6342 lineto +306.77038 202.80673 307.09753 202.93694 307.4198 203.02483 curveto +307.74206 203.10946 308.06107 203.15178 308.37683 203.15178 curveto +308.80001 203.15178 309.12553 203.08017 309.35339 202.93694 curveto +309.58125 202.79045 309.69519 202.58537 309.69519 202.3217 curveto +309.69519 202.07756 309.61218 201.89039 309.44617 201.76018 curveto +309.2834 201.62997 308.9237 201.50465 308.36707 201.3842 curveto +308.05457 201.31096 lineto +307.49792 201.19377 307.09591 201.01474 306.84851 200.77385 curveto +306.60111 200.52971 306.47742 200.19605 306.47742 199.77287 curveto +306.47742 199.25855 306.65971 198.86142 307.02429 198.58147 curveto +307.38887 198.30152 307.90645 198.16155 308.57703 198.16154 curveto +308.90905 198.16155 309.22155 198.18596 309.51453 198.23479 curveto +309.80749 198.28362 310.07767 198.35686 310.32507 198.45451 curveto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +316.59949 200.46135 moveto +316.59949 203.76213 lineto +315.70105 203.76213 lineto +315.70105 200.49065 lineto +315.70105 199.97307 315.60013 199.5857 315.39832 199.32854 curveto +315.19649 199.07138 314.89375 198.9428 314.49011 198.94279 curveto +314.00508 198.9428 313.6226 199.09742 313.34265 199.40666 curveto +313.0627 199.71591 312.92273 200.13746 312.92273 200.67131 curveto +312.92273 203.76213 lineto +312.01941 203.76213 lineto +312.01941 196.16447 lineto +312.92273 196.16447 lineto +312.92273 199.14299 lineto +313.13757 198.81422 313.38985 198.56845 313.67957 198.40569 curveto +313.97253 198.24293 314.30945 198.16155 314.69031 198.16154 curveto +315.31856 198.16155 315.79382 198.35686 316.11609 198.74748 curveto +316.43835 199.13486 316.59948 199.70615 316.59949 200.46135 curveto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +320.52039 198.92326 moveto +320.03861 198.92327 319.65775 199.11207 319.37781 199.48967 curveto +319.09786 199.86402 318.95788 200.37835 318.95789 201.03264 curveto +318.95788 201.68694 319.09623 202.20289 319.37292 202.58049 curveto +319.65287 202.95484 320.03536 203.14201 320.52039 203.14201 curveto +320.9989 203.14201 321.37813 202.95321 321.65808 202.57561 curveto +321.93802 202.198 322.078 201.68368 322.078 201.03264 curveto +322.078 200.38486 321.93802 199.87216 321.65808 199.49455 curveto +321.37813 199.1137 320.9989 198.92327 320.52039 198.92326 curveto +320.52039 198.16154 moveto +321.30163 198.16155 321.91524 198.41546 322.36121 198.92326 curveto +322.80716 199.43108 323.03015 200.1342 323.03015 201.03264 curveto +323.03015 201.92782 322.80716 202.63095 322.36121 203.14201 curveto +321.91524 203.64983 321.30163 203.90373 320.52039 203.90373 curveto +319.73588 203.90373 319.12064 203.64983 318.67468 203.14201 curveto +318.23197 202.63095 318.01062 201.92782 318.01062 201.03264 curveto +318.01062 200.1342 318.23197 199.43108 318.67468 198.92326 curveto +319.12064 198.41546 319.73588 198.16155 320.52039 198.16154 curveto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +323.99207 198.29338 moveto +324.8905 198.29338 lineto +326.01355 202.56096 lineto +327.13171 198.29338 lineto +328.19128 198.29338 lineto +329.31433 202.56096 lineto +330.4325 198.29338 lineto +331.33093 198.29338 lineto +329.90027 203.76213 lineto +328.8407 203.76213 lineto +327.66394 199.27971 lineto +326.4823 203.76213 lineto +325.42273 203.76213 lineto +323.99207 198.29338 lineto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +305.63477 140.25864 moveto +305.63477 143.15903 lineto +304.73145 143.15903 lineto +304.73145 135.6102 lineto +305.63477 135.6102 lineto +305.63477 136.44028 lineto +305.82357 136.11476 306.0612 135.87388 306.34766 135.71762 curveto +306.63737 135.55812 306.98242 135.47837 307.38281 135.47836 curveto +308.04687 135.47837 308.58561 135.74204 308.99902 136.26938 curveto +309.41568 136.79673 309.62402 137.49009 309.62402 138.34946 curveto +309.62402 139.20883 309.41568 139.90219 308.99902 140.42953 curveto +308.58561 140.95688 308.04687 141.22055 307.38281 141.22055 curveto +306.98242 141.22055 306.63737 141.14243 306.34766 140.98618 curveto +306.0612 140.82667 305.82357 140.58416 305.63477 140.25864 curveto +308.69141 138.34946 moveto +308.6914 137.68865 308.55468 137.17108 308.28125 136.79672 curveto +308.01106 136.41912 307.63834 136.23032 307.16309 136.23032 curveto +306.68782 136.23032 306.31347 136.41912 306.04004 136.79672 curveto +305.76985 137.17108 305.63476 137.68865 305.63477 138.34946 curveto +305.63476 139.01027 305.76985 139.52947 306.04004 139.90707 curveto +306.31347 140.28142 306.68782 140.4686 307.16309 140.4686 curveto +307.63834 140.4686 308.01106 140.28142 308.28125 139.90707 curveto +308.55468 139.52947 308.6914 139.01027 308.69141 138.34946 curveto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +314.28223 136.45004 moveto +314.18131 136.39145 314.07063 136.34914 313.9502 136.32309 curveto +313.833 136.2938 313.7028 136.27915 313.55957 136.27914 curveto +313.05175 136.27915 312.66113 136.44516 312.3877 136.77719 curveto +312.11751 137.10597 311.98242 137.5796 311.98242 138.19809 curveto +311.98242 141.07895 lineto +311.0791 141.07895 lineto +311.0791 135.6102 lineto +311.98242 135.6102 lineto +311.98242 136.45981 lineto +312.17122 136.12778 312.41699 135.88201 312.71973 135.7225 curveto +313.02246 135.55975 313.3903 135.47837 313.82324 135.47836 curveto +313.88509 135.47837 313.95345 135.48325 314.02832 135.49301 curveto +314.10319 135.49953 314.18619 135.51092 314.27734 135.52719 curveto +314.28223 136.45004 lineto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +317.13867 136.24008 moveto +316.6569 136.24009 316.27604 136.42889 315.99609 136.80649 curveto +315.71614 137.18084 315.57617 137.69516 315.57617 138.34946 curveto +315.57617 139.00376 315.71452 139.51971 315.99121 139.89731 curveto +316.27116 140.27166 316.65364 140.45883 317.13867 140.45883 curveto +317.61718 140.45883 317.99642 140.27003 318.27637 139.89243 curveto +318.55631 139.51482 318.69628 139.0005 318.69629 138.34946 curveto +318.69628 137.70167 318.55631 137.18898 318.27637 136.81137 curveto +317.99642 136.43052 317.61718 136.24009 317.13867 136.24008 curveto +317.13867 135.47836 moveto +317.91992 135.47837 318.53352 135.73227 318.97949 136.24008 curveto +319.42545 136.7479 319.64843 137.45102 319.64844 138.34946 curveto +319.64843 139.24464 319.42545 139.94777 318.97949 140.45883 curveto +318.53352 140.96664 317.91992 141.22055 317.13867 141.22055 curveto +316.35416 141.22055 315.73893 140.96664 315.29297 140.45883 curveto +314.85026 139.94777 314.62891 139.24464 314.62891 138.34946 curveto +314.62891 137.45102 314.85026 136.7479 315.29297 136.24008 curveto +315.73893 135.73227 316.35416 135.47837 317.13867 135.47836 curveto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +323.25195 136.24008 moveto +322.77018 136.24009 322.38932 136.42889 322.10938 136.80649 curveto +321.82943 137.18084 321.68945 137.69516 321.68945 138.34946 curveto +321.68945 139.00376 321.8278 139.51971 322.10449 139.89731 curveto +322.38444 140.27166 322.76692 140.45883 323.25195 140.45883 curveto +323.73047 140.45883 324.1097 140.27003 324.38965 139.89243 curveto +324.66959 139.51482 324.80957 139.0005 324.80957 138.34946 curveto +324.80957 137.70167 324.66959 137.18898 324.38965 136.81137 curveto +324.1097 136.43052 323.73047 136.24009 323.25195 136.24008 curveto +323.25195 135.47836 moveto +324.0332 135.47837 324.64681 135.73227 325.09277 136.24008 curveto +325.53873 136.7479 325.76171 137.45102 325.76172 138.34946 curveto +325.76171 139.24464 325.53873 139.94777 325.09277 140.45883 curveto +324.64681 140.96664 324.0332 141.22055 323.25195 141.22055 curveto +322.46745 141.22055 321.85221 140.96664 321.40625 140.45883 curveto +320.96354 139.94777 320.74219 139.24464 320.74219 138.34946 curveto +320.74219 137.45102 320.96354 136.7479 321.40625 136.24008 curveto +321.85221 135.73227 322.46745 135.47837 323.25195 135.47836 curveto +fill +grestore +gsave +0 0 0 setrgbcolor +newpath +330.01465 133.48129 moveto +330.01465 134.22836 lineto +329.15527 134.22836 lineto +328.83301 134.22837 328.6084 134.29347 328.48145 134.42368 curveto +328.35775 134.55389 328.2959 134.78827 328.2959 135.1268 curveto +328.2959 135.6102 lineto +329.77539 135.6102 lineto +329.77539 136.30844 lineto +328.2959 136.30844 lineto +328.2959 141.07895 lineto +327.39258 141.07895 lineto +327.39258 136.30844 lineto +326.5332 136.30844 lineto +326.5332 135.6102 lineto +327.39258 135.6102 lineto +327.39258 135.22934 lineto +327.39258 134.62062 327.53418 134.17791 327.81738 133.90121 curveto +328.10058 133.62127 328.5498 133.4813 329.16504 133.48129 curveto +330.01465 133.48129 lineto +fill +grestore +grestore +grestore +showpage +%%EOF diff -r 419116f1157a -r e23770bc97c8 doc-src/IsarRef/Thy/document/isar-vm.pdf Binary file doc-src/IsarRef/Thy/document/isar-vm.pdf has changed diff -r 419116f1157a -r e23770bc97c8 doc-src/IsarRef/Thy/document/isar-vm.svg --- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/doc-src/IsarRef/Thy/document/isar-vm.svg Thu Feb 26 08:48:33 2009 -0800 @@ -0,0 +1,460 @@ + + + + + + + + + + + + + + + + + + + + + + + + + image/svg+xml + + + + + + + + chain + + + + + + + + prove + + + + + + state + + + + + + + + theorem + + qed + qed + fixassume + { }next + notelet + usingunfolding + then + haveshow + haveshow + proof + + diff -r 419116f1157a -r e23770bc97c8 doc-src/IsarRef/isar-ref.tex --- a/doc-src/IsarRef/isar-ref.tex Thu Feb 26 08:44:44 2009 -0800 +++ b/doc-src/IsarRef/isar-ref.tex Thu Feb 26 08:48:33 2009 -0800 @@ -1,6 +1,3 @@ - -%% $Id$ - \documentclass[12pt,a4paper,fleqn]{report} \usepackage{amssymb} \usepackage[greek,english]{babel} @@ -82,7 +79,11 @@ \pagenumbering{roman} \tableofcontents \clearfirst +\part{Basic Concepts} \input{Thy/document/Introduction.tex} +\input{Thy/document/Framework.tex} +\input{Thy/document/First_Order_Logic.tex} +\part{General Language Elements} \input{Thy/document/Outer_Syntax.tex} \input{Thy/document/Document_Preparation.tex} \input{Thy/document/Spec.tex} @@ -90,10 +91,12 @@ \input{Thy/document/Inner_Syntax.tex} \input{Thy/document/Misc.tex} \input{Thy/document/Generic.tex} +\part{Object-Logics} \input{Thy/document/HOL_Specific.tex} \input{Thy/document/HOLCF_Specific.tex} \input{Thy/document/ZF_Specific.tex} +\part{Appendix} \appendix \input{Thy/document/Quick_Reference.tex} \let\int\intorig diff -r 419116f1157a -r e23770bc97c8 doc-src/IsarRef/style.sty --- a/doc-src/IsarRef/style.sty Thu Feb 26 08:44:44 2009 -0800 +++ b/doc-src/IsarRef/style.sty Thu Feb 26 08:48:33 2009 -0800 @@ -1,6 +1,3 @@ - -%% $Id$ - %% toc \newcommand{\tocentry}[1]{\cleardoublepage\phantomsection\addcontentsline{toc}{chapter}{#1} \@mkboth{\MakeUppercase{#1}}{\MakeUppercase{#1}}} @@ -20,10 +17,16 @@ \newenvironment{mldecls}{\par\noindent\begingroup\def\isanewline{\\}\begin{tabular}{ll}}{\end{tabular}\medskip\endgroup} \newcommand{\indexml}[1]{\index{#1 (ML value)|bold}} +%% Isar +\newcommand{\isasymBBAR}{{\,\newdimen{\tmpheight}\settoheight\tmpheight{\isacharbar}\rule{1pt}{\tmpheight}\,}} +\isafoldtag{noproof}\def\isafoldnoproof{~\isafold{proof}} + %% math +\newcommand{\isasymstrut}{\isamath{\mathstrut}} +\newcommand{\isasymvartheta}{\isamath{\,\theta}} \newcommand{\isactrlvec}[1]{\emph{$\overline{#1}$}} \renewcommand{\isadigit}[1]{\isamath{#1}} - +\newcommand{\text}[1]{\mbox{#1}} %% global style options \pagestyle{headings} diff -r 419116f1157a -r e23770bc97c8 doc-src/Locales/.cvsignore --- a/doc-src/Locales/.cvsignore Thu Feb 26 08:44:44 2009 -0800 +++ /dev/null Thu Jan 01 00:00:00 1970 +0000 @@ -1,2 +0,0 @@ -locales.out -locales.pdf diff -r 419116f1157a -r e23770bc97c8 doc-src/System/Thy/Presentation.thy --- a/doc-src/System/Thy/Presentation.thy Thu Feb 26 08:44:44 2009 -0800 +++ b/doc-src/System/Thy/Presentation.thy Thu Feb 26 08:48:33 2009 -0800 @@ -654,7 +654,7 @@ "-"}@{text foo}'' to drop, and ``@{verbatim "/"}@{text foo}'' to fold text tagged as @{text foo}. The builtin default is equivalent to the tag specification ``@{verbatim - "/theory,/proof,/ML,+visible,-invisible"}''; see also the {\LaTeX} + "+theory,+proof,+ML,+visible,-invisible"}''; see also the {\LaTeX} macros @{verbatim "\\isakeeptag"}, @{verbatim "\\isadroptag"}, and @{verbatim "\\isafoldtag"}, in @{"file" "~~/lib/texinputs/isabelle.sty"}. diff -r 419116f1157a -r e23770bc97c8 doc-src/System/Thy/document/Presentation.tex --- a/doc-src/System/Thy/document/Presentation.tex Thu Feb 26 08:44:44 2009 -0800 +++ b/doc-src/System/Thy/document/Presentation.tex Thu Feb 26 08:48:33 2009 -0800 @@ -668,7 +668,7 @@ tagged Isabelle command regions. Tags are specified as a comma separated list of modifier/name pairs: ``\verb|+|\isa{foo}'' (or just ``\isa{foo}'') means to keep, ``\verb|-|\isa{foo}'' to drop, and ``\verb|/|\isa{foo}'' to fold text tagged as \isa{foo}. The builtin default is equivalent - to the tag specification ``\verb|/theory,/proof,/ML,+visible,-invisible|''; see also the {\LaTeX} + to the tag specification ``\verb|+theory,+proof,+ML,+visible,-invisible|''; see also the {\LaTeX} macros \verb|\isakeeptag|, \verb|\isadroptag|, and \verb|\isafoldtag|, in \hyperlink{file.~~/lib/texinputs/isabelle.sty}{\mbox{\isa{\isatt{{\isachartilde}{\isachartilde}{\isacharslash}lib{\isacharslash}texinputs{\isacharslash}isabelle{\isachardot}sty}}}}. diff -r 419116f1157a -r e23770bc97c8 doc-src/antiquote_setup.ML --- a/doc-src/antiquote_setup.ML Thu Feb 26 08:44:44 2009 -0800 +++ b/doc-src/antiquote_setup.ML Thu Feb 26 08:48:33 2009 -0800 @@ -1,5 +1,4 @@ (* Title: Doc/antiquote_setup.ML - ID: $Id$ Author: Makarius Auxiliary antiquotations for the Isabelle manuals. @@ -13,13 +12,16 @@ (* misc utils *) -val clean_string = translate_string +fun translate f = Symbol.explode #> map f #> implode; + +val clean_string = translate (fn "_" => "\\_" | "<" => "$<$" | ">" => "$>$" | "#" => "\\#" | "{" => "\\{" | "}" => "\\}" + | "\\" => "-" | c => c); fun clean_name "\\" = "dots" @@ -28,7 +30,7 @@ | clean_name "_" = "underscore" | clean_name "{" = "braceleft" | clean_name "}" = "braceright" - | clean_name s = s |> translate_string (fn "_" => "-" | c => c); + | clean_name s = s |> translate (fn "_" => "-" | "\\" => "-" | c => c); (* verbatim text *) @@ -193,6 +195,7 @@ entity_antiqs no_check "" "case" @ entity_antiqs (K ThyOutput.defined_command) "" "antiquotation" @ entity_antiqs (fn _ => fn name => is_some (OS.Process.getEnv name)) "isatt" "setting" @ + entity_antiqs no_check "" "inference" @ entity_antiqs no_check "isatt" "executable" @ entity_antiqs (K check_tool) "isatt" "tool" @ entity_antiqs (K (File.exists o Path.explode)) "isatt" "file" @ diff -r 419116f1157a -r e23770bc97c8 doc-src/isar.sty --- a/doc-src/isar.sty Thu Feb 26 08:44:44 2009 -0800 +++ b/doc-src/isar.sty Thu Feb 26 08:48:33 2009 -0800 @@ -1,6 +1,3 @@ - -%% $Id$ - \usepackage{ifthen} \newcommand{\indexdef}[3]% @@ -20,3 +17,9 @@ \newcommand{\isasymIMPORTS}{\isakeyword{imports}} \newcommand{\isasymIN}{\isakeyword{in}} \newcommand{\isasymSTRUCTURE}{\isakeyword{structure}} +\newcommand{\isasymFIXES}{\isakeyword{fixes}} +\newcommand{\isasymASSUMES}{\isakeyword{assumes}} +\newcommand{\isasymSHOWS}{\isakeyword{shows}} +\newcommand{\isasymOBTAINS}{\isakeyword{obtains}} + +\newcommand{\isasymASSM}{\isacommand{assm}} diff -r 419116f1157a -r e23770bc97c8 doc-src/manual.bib --- a/doc-src/manual.bib Thu Feb 26 08:44:44 2009 -0800 +++ b/doc-src/manual.bib Thu Feb 26 08:48:33 2009 -0800 @@ -1,6 +1,4 @@ % BibTeX database for the Isabelle documentation -% -% Lawrence C Paulson $Id$ %publishers @string{AP="Academic Press"} @@ -669,6 +667,16 @@ pages = {341-386}, crossref = {birtwistle89}} +@Article{Miller:1991, + author = {Dale Miller}, + title = {A Logic Programming Language with Lambda-Abstraction, Function Variables, + and Simple Unification}, + journal = {Journal of Logic and Computation}, + year = 1991, + volume = 1, + number = 4 +} + @Article{miller-mixed, Author = {Dale Miller}, Title = {Unification Under a Mixed Prefix}, @@ -1198,6 +1206,15 @@ pages = {578-596}, crossref = {fme93}} +@Article{Schroeder-Heister:1984, + author = {Peter Schroeder-Heister}, + title = {A Natural Extension of Natural Deduction}, + journal = {Journal of Symbolic Logic}, + year = 1984, + volume = 49, + number = 4 +} + @inproceedings{slind-tfl, author = {Konrad Slind}, title = {Function Definition in Higher Order Logic}, @@ -1331,6 +1348,24 @@ year=2002, note = {\url{http://tumb1.biblio.tu-muenchen.de/publ/diss/in/2002/wenzel.html}}} +@Article{Wenzel-Wiedijk:2002, + author = {Freek Wiedijk and Markus Wenzel}, + title = {A comparison of the mathematical proof languages {Mizar} and {Isar}.}, + journal = {Journal of Automated Reasoning}, + year = 2002, + volume = 29, + number = {3-4} +} + +@InCollection{Wenzel-Paulson:2006, + author = {Markus Wenzel and Lawrence C. Paulson}, + title = {{Isabelle/Isar}}, + booktitle = {The Seventeen Provers of the World}, + year = 2006, + editor = {F. Wiedijk}, + series = {LNAI 3600} +} + @InCollection{Wenzel:2006:Festschrift, author = {Makarius Wenzel}, title = {{Isabelle/Isar} --- a generic framework for human-readable proof documents}, diff -r 419116f1157a -r e23770bc97c8 doc/Contents --- a/doc/Contents Thu Feb 26 08:44:44 2009 -0800 +++ b/doc/Contents Thu Feb 26 08:48:33 2009 -0800 @@ -6,13 +6,16 @@ functions Tutorial on Function Definitions codegen Tutorial on Code Generation sugar LaTeX sugar for proof documents - ind-defs (Co)Inductive Definitions in ZF Reference Manuals isar-ref The Isabelle/Isar Reference Manual implementation The Isabelle/Isar Implementation Manual system The Isabelle System Manual + +Old Manuals (outdated!) + intro Introduction to Isabelle ref The Isabelle Reference Manual logics Isabelle's Logics: overview and misc logics logics-HOL Isabelle's Logics: HOL logics-ZF Isabelle's Logics: FOL and ZF + ind-defs (Co)Inductive Definitions in ZF diff -r 419116f1157a -r e23770bc97c8 lib/browser/.cvsignore --- a/lib/browser/.cvsignore Thu Feb 26 08:44:44 2009 -0800 +++ /dev/null Thu Jan 01 00:00:00 1970 +0000 @@ -1,1 +0,0 @@ -GraphBrowser.jar diff -r 419116f1157a -r e23770bc97c8 lib/browser/GraphBrowser/.cvsignore --- a/lib/browser/GraphBrowser/.cvsignore Thu Feb 26 08:44:44 2009 -0800 +++ /dev/null Thu Jan 01 00:00:00 1970 +0000 @@ -1,1 +0,0 @@ -*.class diff -r 419116f1157a -r e23770bc97c8 lib/browser/awtUtilities/.cvsignore --- a/lib/browser/awtUtilities/.cvsignore Thu Feb 26 08:44:44 2009 -0800 +++ /dev/null Thu Jan 01 00:00:00 1970 +0000 @@ -1,1 +0,0 @@ -*.class diff -r 419116f1157a -r e23770bc97c8 src/FOL/IsaMakefile --- a/src/FOL/IsaMakefile Thu Feb 26 08:44:44 2009 -0800 +++ b/src/FOL/IsaMakefile Thu Feb 26 08:48:33 2009 -0800 @@ -46,12 +46,12 @@ FOL-ex: FOL $(LOG)/FOL-ex.gz $(LOG)/FOL-ex.gz: $(OUT)/FOL ex/First_Order_Logic.thy ex/If.thy \ - ex/IffOracle.thy ex/Nat.thy ex/Natural_Numbers.thy \ - ex/LocaleTest.thy \ - ex/Miniscope.thy ex/Prolog.thy ex/ROOT.ML ex/Classical.thy \ - ex/document/root.tex ex/Foundation.thy ex/Intuitionistic.thy \ - ex/Intro.thy ex/Propositional_Int.thy ex/Propositional_Cla.thy \ - ex/Quantifiers_Int.thy ex/Quantifiers_Cla.thy + ex/Iff_Oracle.thy ex/Nat.thy ex/Nat_Class.thy ex/Natural_Numbers.thy \ + ex/LocaleTest.thy ex/Miniscope.thy ex/Prolog.thy ex/ROOT.ML \ + ex/Classical.thy ex/document/root.tex ex/Foundation.thy \ + ex/Intuitionistic.thy ex/Intro.thy ex/Propositional_Int.thy \ + ex/Propositional_Cla.thy ex/Quantifiers_Int.thy \ + ex/Quantifiers_Cla.thy @$(ISABELLE_TOOL) usedir $(OUT)/FOL ex diff -r 419116f1157a -r e23770bc97c8 src/FOL/ex/IffOracle.thy --- a/src/FOL/ex/IffOracle.thy Thu Feb 26 08:44:44 2009 -0800 +++ /dev/null Thu Jan 01 00:00:00 1970 +0000 @@ -1,77 +0,0 @@ -(* Title: FOL/ex/IffOracle.thy - ID: $Id$ - Author: Lawrence C Paulson, Cambridge University Computer Laboratory - Copyright 1996 University of Cambridge -*) - -header {* Example of Declaring an Oracle *} - -theory IffOracle -imports FOL -begin - -subsection {* Oracle declaration *} - -text {* - This oracle makes tautologies of the form @{text "P <-> P <-> P <-> P"}. - The length is specified by an integer, which is checked to be even - and positive. -*} - -oracle iff_oracle = {* - let - fun mk_iff 1 = Var (("P", 0), @{typ o}) - | mk_iff n = FOLogic.iff $ Var (("P", 0), @{typ o}) $ mk_iff (n - 1); - in - fn (thy, n) => - if n > 0 andalso n mod 2 = 0 - then Thm.cterm_of thy (FOLogic.mk_Trueprop (mk_iff n)) - else raise Fail ("iff_oracle: " ^ string_of_int n) - end -*} - - -subsection {* Oracle as low-level rule *} - -ML {* iff_oracle (@{theory}, 2) *} -ML {* iff_oracle (@{theory}, 10) *} -ML {* Thm.proof_of (iff_oracle (@{theory}, 10)) *} - -text {* These oracle calls had better fail. *} - -ML {* - (iff_oracle (@{theory}, 5); error "?") - handle Fail _ => warning "Oracle failed, as expected" -*} - -ML {* - (iff_oracle (@{theory}, 1); error "?") - handle Fail _ => warning "Oracle failed, as expected" -*} - - -subsection {* Oracle as proof method *} - -method_setup iff = {* - Method.simple_args OuterParse.nat (fn n => fn ctxt => - Method.SIMPLE_METHOD - (HEADGOAL (Tactic.rtac (iff_oracle (ProofContext.theory_of ctxt, n))) - handle Fail _ => no_tac)) -*} "iff oracle" - - -lemma "A <-> A" - by (iff 2) - -lemma "A <-> A <-> A <-> A <-> A <-> A <-> A <-> A <-> A <-> A" - by (iff 10) - -lemma "A <-> A <-> A <-> A <-> A" - apply (iff 5)? - oops - -lemma A - apply (iff 1)? - oops - -end diff -r 419116f1157a -r e23770bc97c8 src/FOL/ex/Iff_Oracle.thy --- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/src/FOL/ex/Iff_Oracle.thy Thu Feb 26 08:48:33 2009 -0800 @@ -0,0 +1,76 @@ +(* Title: FOL/ex/Iff_Oracle.thy + Author: Lawrence C Paulson, Cambridge University Computer Laboratory + Copyright 1996 University of Cambridge +*) + +header {* Example of Declaring an Oracle *} + +theory Iff_Oracle +imports FOL +begin + +subsection {* Oracle declaration *} + +text {* + This oracle makes tautologies of the form @{text "P <-> P <-> P <-> P"}. + The length is specified by an integer, which is checked to be even + and positive. +*} + +oracle iff_oracle = {* + let + fun mk_iff 1 = Var (("P", 0), @{typ o}) + | mk_iff n = FOLogic.iff $ Var (("P", 0), @{typ o}) $ mk_iff (n - 1); + in + fn (thy, n) => + if n > 0 andalso n mod 2 = 0 + then Thm.cterm_of thy (FOLogic.mk_Trueprop (mk_iff n)) + else raise Fail ("iff_oracle: " ^ string_of_int n) + end +*} + + +subsection {* Oracle as low-level rule *} + +ML {* iff_oracle (@{theory}, 2) *} +ML {* iff_oracle (@{theory}, 10) *} +ML {* Thm.proof_of (iff_oracle (@{theory}, 10)) *} + +text {* These oracle calls had better fail. *} + +ML {* + (iff_oracle (@{theory}, 5); error "?") + handle Fail _ => warning "Oracle failed, as expected" +*} + +ML {* + (iff_oracle (@{theory}, 1); error "?") + handle Fail _ => warning "Oracle failed, as expected" +*} + + +subsection {* Oracle as proof method *} + +method_setup iff = {* + Method.simple_args OuterParse.nat (fn n => fn ctxt => + Method.SIMPLE_METHOD + (HEADGOAL (Tactic.rtac (iff_oracle (ProofContext.theory_of ctxt, n))) + handle Fail _ => no_tac)) +*} "iff oracle" + + +lemma "A <-> A" + by (iff 2) + +lemma "A <-> A <-> A <-> A <-> A <-> A <-> A <-> A <-> A <-> A" + by (iff 10) + +lemma "A <-> A <-> A <-> A <-> A" + apply (iff 5)? + oops + +lemma A + apply (iff 1)? + oops + +end diff -r 419116f1157a -r e23770bc97c8 src/FOL/ex/NatClass.thy --- a/src/FOL/ex/NatClass.thy Thu Feb 26 08:44:44 2009 -0800 +++ /dev/null Thu Jan 01 00:00:00 1970 +0000 @@ -1,90 +0,0 @@ -(* Title: FOL/ex/NatClass.thy - ID: $Id$ - Author: Markus Wenzel, TU Muenchen -*) - -theory NatClass -imports FOL -begin - -text {* - This is an abstract version of theory @{text "Nat"}. Instead of - axiomatizing a single type @{text nat} we define the class of all - these types (up to isomorphism). - - Note: The @{text rec} operator had to be made \emph{monomorphic}, - because class axioms may not contain more than one type variable. -*} - -consts - 0 :: 'a ("0") - Suc :: "'a => 'a" - rec :: "['a, 'a, ['a, 'a] => 'a] => 'a" - -axclass - nat < "term" - induct: "[| P(0); !!x. P(x) ==> P(Suc(x)) |] ==> P(n)" - Suc_inject: "Suc(m) = Suc(n) ==> m = n" - Suc_neq_0: "Suc(m) = 0 ==> R" - rec_0: "rec(0, a, f) = a" - rec_Suc: "rec(Suc(m), a, f) = f(m, rec(m, a, f))" - -definition - add :: "['a::nat, 'a] => 'a" (infixl "+" 60) where - "m + n = rec(m, n, %x y. Suc(y))" - -lemma Suc_n_not_n: "Suc(k) ~= (k::'a::nat)" -apply (rule_tac n = k in induct) -apply (rule notI) -apply (erule Suc_neq_0) -apply (rule notI) -apply (erule notE) -apply (erule Suc_inject) -done - -lemma "(k+m)+n = k+(m+n)" -apply (rule induct) -back -back -back -back -back -back -oops - -lemma add_0 [simp]: "0+n = n" -apply (unfold add_def) -apply (rule rec_0) -done - -lemma add_Suc [simp]: "Suc(m)+n = Suc(m+n)" -apply (unfold add_def) -apply (rule rec_Suc) -done - -lemma add_assoc: "(k+m)+n = k+(m+n)" -apply (rule_tac n = k in induct) -apply simp -apply simp -done - -lemma add_0_right: "m+0 = m" -apply (rule_tac n = m in induct) -apply simp -apply simp -done - -lemma add_Suc_right: "m+Suc(n) = Suc(m+n)" -apply (rule_tac n = m in induct) -apply simp_all -done - -lemma - assumes prem: "!!n. f(Suc(n)) = Suc(f(n))" - shows "f(i+j) = i+f(j)" -apply (rule_tac n = i in induct) -apply simp -apply (simp add: prem) -done - -end diff -r 419116f1157a -r e23770bc97c8 src/FOL/ex/Nat_Class.thy --- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/src/FOL/ex/Nat_Class.thy Thu Feb 26 08:48:33 2009 -0800 @@ -0,0 +1,88 @@ +(* Title: FOL/ex/Nat_Class.thy + Author: Markus Wenzel, TU Muenchen +*) + +theory Nat_Class +imports FOL +begin + +text {* + This is an abstract version of theory @{text Nat}. Instead of + axiomatizing a single type @{text nat} we define the class of all + these types (up to isomorphism). + + Note: The @{text rec} operator had to be made \emph{monomorphic}, + because class axioms may not contain more than one type variable. +*} + +class nat = + fixes Zero :: 'a ("0") + and Suc :: "'a \ 'a" + and rec :: "'a \ 'a \ ('a \ 'a \ 'a) \ 'a" + assumes induct: "P(0) \ (\x. P(x) \ P(Suc(x))) \ P(n)" + and Suc_inject: "Suc(m) = Suc(n) \ m = n" + and Suc_neq_Zero: "Suc(m) = 0 \ R" + and rec_Zero: "rec(0, a, f) = a" + and rec_Suc: "rec(Suc(m), a, f) = f(m, rec(m, a, f))" +begin + +definition + add :: "'a \ 'a \ 'a" (infixl "+" 60) where + "m + n = rec(m, n, \x y. Suc(y))" + +lemma Suc_n_not_n: "Suc(k) \ (k::'a)" + apply (rule_tac n = k in induct) + apply (rule notI) + apply (erule Suc_neq_Zero) + apply (rule notI) + apply (erule notE) + apply (erule Suc_inject) + done + +lemma "(k + m) + n = k + (m + n)" + apply (rule induct) + back + back + back + back + back + oops + +lemma add_Zero [simp]: "0 + n = n" + apply (unfold add_def) + apply (rule rec_Zero) + done + +lemma add_Suc [simp]: "Suc(m) + n = Suc(m + n)" + apply (unfold add_def) + apply (rule rec_Suc) + done + +lemma add_assoc: "(k + m) + n = k + (m + n)" + apply (rule_tac n = k in induct) + apply simp + apply simp + done + +lemma add_Zero_right: "m + 0 = m" + apply (rule_tac n = m in induct) + apply simp + apply simp + done + +lemma add_Suc_right: "m + Suc(n) = Suc(m + n)" + apply (rule_tac n = m in induct) + apply simp_all + done + +lemma + assumes prem: "\n. f(Suc(n)) = Suc(f(n))" + shows "f(i + j) = i + f(j)" + apply (rule_tac n = i in induct) + apply simp + apply (simp add: prem) + done + +end + +end diff -r 419116f1157a -r e23770bc97c8 src/FOL/ex/ROOT.ML --- a/src/FOL/ex/ROOT.ML Thu Feb 26 08:44:44 2009 -0800 +++ b/src/FOL/ex/ROOT.ML Thu Feb 26 08:48:33 2009 -0800 @@ -1,7 +1,4 @@ (* Title: FOL/ex/ROOT.ML - ID: $Id$ - Author: Lawrence C Paulson, Cambridge University Computer Laboratory - Copyright 1992 University of Cambridge Examples for First-Order Logic. *) @@ -11,23 +8,19 @@ "Natural_Numbers", "Intro", "Nat", + "Nat_Class", "Foundation", "Prolog", - "Intuitionistic", "Propositional_Int", "Quantifiers_Int", - "Classical", "Propositional_Cla", "Quantifiers_Cla", "Miniscope", "If", - - "NatClass", - "IffOracle" + "Iff_Oracle" ]; (*regression test for locales -- sets several global flags!*) no_document use_thy "LocaleTest"; - diff -r 419116f1157a -r e23770bc97c8 src/HOL/AxClasses/Group.thy --- a/src/HOL/AxClasses/Group.thy Thu Feb 26 08:44:44 2009 -0800 +++ /dev/null Thu Jan 01 00:00:00 1970 +0000 @@ -1,124 +0,0 @@ -(* Title: HOL/AxClasses/Group.thy - ID: $Id$ - Author: Markus Wenzel, TU Muenchen -*) - -theory Group imports Main begin - -subsection {* Monoids and Groups *} - -consts - times :: "'a => 'a => 'a" (infixl "[*]" 70) - invers :: "'a => 'a" - one :: 'a - - -axclass monoid < type - assoc: "(x [*] y) [*] z = x [*] (y [*] z)" - left_unit: "one [*] x = x" - right_unit: "x [*] one = x" - -axclass semigroup < type - assoc: "(x [*] y) [*] z = x [*] (y [*] z)" - -axclass group < semigroup - left_unit: "one [*] x = x" - left_inverse: "invers x [*] x = one" - -axclass agroup < group - commute: "x [*] y = y [*] x" - - -subsection {* Abstract reasoning *} - -theorem group_right_inverse: "x [*] invers x = (one::'a::group)" -proof - - have "x [*] invers x = one [*] (x [*] invers x)" - by (simp only: group_class.left_unit) - also have "... = one [*] x [*] invers x" - by (simp only: semigroup_class.assoc) - also have "... = invers (invers x) [*] invers x [*] x [*] invers x" - by (simp only: group_class.left_inverse) - also have "... = invers (invers x) [*] (invers x [*] x) [*] invers x" - by (simp only: semigroup_class.assoc) - also have "... = invers (invers x) [*] one [*] invers x" - by (simp only: group_class.left_inverse) - also have "... = invers (invers x) [*] (one [*] invers x)" - by (simp only: semigroup_class.assoc) - also have "... = invers (invers x) [*] invers x" - by (simp only: group_class.left_unit) - also have "... = one" - by (simp only: group_class.left_inverse) - finally show ?thesis . -qed - -theorem group_right_unit: "x [*] one = (x::'a::group)" -proof - - have "x [*] one = x [*] (invers x [*] x)" - by (simp only: group_class.left_inverse) - also have "... = x [*] invers x [*] x" - by (simp only: semigroup_class.assoc) - also have "... = one [*] x" - by (simp only: group_right_inverse) - also have "... = x" - by (simp only: group_class.left_unit) - finally show ?thesis . -qed - - -subsection {* Abstract instantiation *} - -instance monoid < semigroup -proof intro_classes - fix x y z :: "'a::monoid" - show "x [*] y [*] z = x [*] (y [*] z)" - by (rule monoid_class.assoc) -qed - -instance group < monoid -proof intro_classes - fix x y z :: "'a::group" - show "x [*] y [*] z = x [*] (y [*] z)" - by (rule semigroup_class.assoc) - show "one [*] x = x" - by (rule group_class.left_unit) - show "x [*] one = x" - by (rule group_right_unit) -qed - - -subsection {* Concrete instantiation *} - -defs (overloaded) - times_bool_def: "x [*] y == x ~= (y::bool)" - inverse_bool_def: "invers x == x::bool" - unit_bool_def: "one == False" - -instance bool :: agroup -proof (intro_classes, - unfold times_bool_def inverse_bool_def unit_bool_def) - fix x y z - show "((x ~= y) ~= z) = (x ~= (y ~= z))" by blast - show "(False ~= x) = x" by blast - show "(x ~= x) = False" by blast - show "(x ~= y) = (y ~= x)" by blast -qed - - -subsection {* Lifting and Functors *} - -defs (overloaded) - times_prod_def: "p [*] q == (fst p [*] fst q, snd p [*] snd q)" - -instance * :: (semigroup, semigroup) semigroup -proof (intro_classes, unfold times_prod_def) - fix p q r :: "'a::semigroup * 'b::semigroup" - show - "(fst (fst p [*] fst q, snd p [*] snd q) [*] fst r, - snd (fst p [*] fst q, snd p [*] snd q) [*] snd r) = - (fst p [*] fst (fst q [*] fst r, snd q [*] snd r), - snd p [*] snd (fst q [*] fst r, snd q [*] snd r))" - by (simp add: semigroup_class.assoc) -qed - -end diff -r 419116f1157a -r e23770bc97c8 src/HOL/AxClasses/Lattice/OrdInsts.thy --- a/src/HOL/AxClasses/Lattice/OrdInsts.thy Thu Feb 26 08:44:44 2009 -0800 +++ /dev/null Thu Jan 01 00:00:00 1970 +0000 @@ -1,43 +0,0 @@ -(* Title: OrdInsts.thy - ID: $Id$ - Author: Markus Wenzel, TU Muenchen - -Some order instantiations. -*) - -OrdInsts = OrdDefs + - - -(* binary / general products of quasi_orders / orders *) - -instance - "*" :: (quasi_order, quasi_order) quasi_order (le_prod_refl, le_prod_trans) - -instance - "*" :: (partial_order, partial_order) partial_order (le_prod_antisym) - - -instance - fun :: (term, quasi_order) quasi_order (le_fun_refl, le_fun_trans) - -instance - fun :: (term, partial_order) partial_order (le_fun_antisym) - - -(* duals of quasi orders / partial orders / linear orders *) - -instance - dual :: (quasi_order) quasi_order (le_dual_refl, le_dual_trans) - -instance - dual :: (partial_order) partial_order (le_dual_antisym) - - -(*FIXME: had to be moved to LatInsts.thy due to some unpleasant - 'feature' in Pure/type.ML - -instance - dual :: (linear_order) linear_order (le_dual_lin) -*) - -end diff -r 419116f1157a -r e23770bc97c8 src/HOL/AxClasses/Product.thy --- a/src/HOL/AxClasses/Product.thy Thu Feb 26 08:44:44 2009 -0800 +++ /dev/null Thu Jan 01 00:00:00 1970 +0000 @@ -1,20 +0,0 @@ -(* Title: HOL/AxClasses/Product.thy - ID: $Id$ - Author: Markus Wenzel, TU Muenchen -*) - -theory Product imports Main begin - -axclass product < type - -consts - product :: "'a::product => 'a => 'a" (infixl "[*]" 70) - - -instance bool :: product - by intro_classes - -defs (overloaded) - product_bool_def: "x [*] y == x & y" - -end diff -r 419116f1157a -r e23770bc97c8 src/HOL/AxClasses/README.html --- a/src/HOL/AxClasses/README.html Thu Feb 26 08:44:44 2009 -0800 +++ /dev/null Thu Jan 01 00:00:00 1970 +0000 @@ -1,20 +0,0 @@ - - - - - - - - - HOL/AxClasses - - - -

HOL/AxClasses

- -These are the HOL examples of the tutorial Using Axiomatic Type -Classes in Isabelle. See also FOL/ex/NatClass for the natural -number example. - - diff -r 419116f1157a -r e23770bc97c8 src/HOL/AxClasses/ROOT.ML --- a/src/HOL/AxClasses/ROOT.ML Thu Feb 26 08:44:44 2009 -0800 +++ /dev/null Thu Jan 01 00:00:00 1970 +0000 @@ -1,3 +0,0 @@ -(* $Id$ *) - -use_thys ["Semigroups", "Group", "Product"]; diff -r 419116f1157a -r e23770bc97c8 src/HOL/AxClasses/Semigroups.thy --- a/src/HOL/AxClasses/Semigroups.thy Thu Feb 26 08:44:44 2009 -0800 +++ /dev/null Thu Jan 01 00:00:00 1970 +0000 @@ -1,21 +0,0 @@ -(* Title: HOL/AxClasses/Semigroups.thy - ID: $Id$ - Author: Markus Wenzel, TU Muenchen -*) - -theory Semigroups imports Main begin - -consts - times :: "'a => 'a => 'a" (infixl "[*]" 70) - -axclass semigroup < type - assoc: "(x [*] y) [*] z = x [*] (y [*] z)" - - -consts - plus :: "'a => 'a => 'a" (infixl "[+]" 70) - -axclass plus_semigroup < type - assoc: "(x [+] y) [+] z = x [+] (y [+] z)" - -end diff -r 419116f1157a -r e23770bc97c8 src/HOL/IsaMakefile --- a/src/HOL/IsaMakefile Thu Feb 26 08:44:44 2009 -0800 +++ b/src/HOL/IsaMakefile Thu Feb 26 08:48:33 2009 -0800 @@ -13,7 +13,6 @@ HOL-Library \ HOL-ex \ HOL-Auth \ - HOL-AxClasses \ HOL-Bali \ HOL-Decision_Procs \ HOL-Extraction \ @@ -796,15 +795,6 @@ @$(ISABELLE_TOOL) usedir $(OUT)/HOL IOA -## HOL-AxClasses - -HOL-AxClasses: HOL $(LOG)/HOL-AxClasses.gz - -$(LOG)/HOL-AxClasses.gz: $(OUT)/HOL AxClasses/Group.thy \ - AxClasses/Product.thy AxClasses/ROOT.ML AxClasses/Semigroups.thy - @$(ISABELLE_TOOL) usedir $(OUT)/HOL AxClasses - - ## HOL-Lattice HOL-Lattice: HOL $(LOG)/HOL-Lattice.gz @@ -1068,22 +1058,22 @@ ## clean clean: - @rm -f $(OUT)/HOL-Plain $(OUT)/HOL-Main $(OUT)/HOL $(OUT)/HOL-Nominal $(OUT)/TLA \ - $(LOG)/HOL.gz $(LOG)/TLA.gz \ - $(LOG)/HOL-Isar_examples.gz $(LOG)/HOL-Induct.gz \ - $(LOG)/HOL-ex.gz $(LOG)/HOL-Subst.gz $(LOG)/HOL-IMP.gz \ - $(LOG)/HOL-IMPP.gz $(LOG)/HOL-Hoare.gz \ - $(LOG)/HOL-HoareParallel.gz \ - $(LOG)/HOL-Lex.gz $(LOG)/HOL-Algebra.gz \ - $(LOG)/HOL-Auth.gz $(LOG)/HOL-UNITY.gz \ - $(LOG)/HOL-Modelcheck.gz $(LOG)/HOL-Lambda.gz \ - $(LOG)/HOL-Bali.gz \ - $(LOG)/HOL-MicroJava.gz $(LOG)/HOL-NanoJava.gz \ - $(LOG)/HOL-Nominal-Examples.gz \ - $(LOG)/HOL-IOA.gz $(LOG)/HOL-AxClasses \ - $(LOG)/HOL-Lattice $(LOG)/HOL-Matrix \ - $(LOG)/HOL-HahnBanach.gz $(LOG)/HOL-SET-Protocol.gz \ - $(LOG)/TLA-Inc.gz $(LOG)/TLA-Buffer.gz $(LOG)/TLA-Memory.gz \ - $(LOG)/HOL-Library.gz $(LOG)/HOL-Unix.gz \ - $(OUT)/HOL-Word $(LOG)/HOL-Word.gz $(LOG)/HOL-Word-Examples.gz \ - $(OUT)/HOL-NSA $(LOG)/HOL-NSA.gz $(LOG)/HOL-NSA-Examples.gz + @rm -f $(OUT)/HOL-Plain $(OUT)/HOL-Main $(OUT)/HOL \ + $(OUT)/HOL-Nominal $(OUT)/TLA $(LOG)/HOL.gz \ + $(LOG)/TLA.gz $(LOG)/HOL-Isar_examples.gz \ + $(LOG)/HOL-Induct.gz $(LOG)/HOL-ex.gz \ + $(LOG)/HOL-Subst.gz $(LOG)/HOL-IMP.gz \ + $(LOG)/HOL-IMPP.gz $(LOG)/HOL-Hoare.gz \ + $(LOG)/HOL-HoareParallel.gz $(LOG)/HOL-Lex.gz \ + $(LOG)/HOL-Algebra.gz $(LOG)/HOL-Auth.gz \ + $(LOG)/HOL-UNITY.gz $(LOG)/HOL-Modelcheck.gz \ + $(LOG)/HOL-Lambda.gz $(LOG)/HOL-Bali.gz \ + $(LOG)/HOL-MicroJava.gz $(LOG)/HOL-NanoJava.gz \ + $(LOG)/HOL-Nominal-Examples.gz $(LOG)/HOL-IOA.gz \ + $(LOG)/HOL-Lattice $(LOG)/HOL-Matrix \ + $(LOG)/HOL-HahnBanach.gz $(LOG)/HOL-SET-Protocol.gz \ + $(LOG)/TLA-Inc.gz $(LOG)/TLA-Buffer.gz \ + $(LOG)/TLA-Memory.gz $(LOG)/HOL-Library.gz \ + $(LOG)/HOL-Unix.gz $(OUT)/HOL-Word $(LOG)/HOL-Word.gz \ + $(LOG)/HOL-Word-Examples.gz $(OUT)/HOL-NSA \ + $(LOG)/HOL-NSA.gz $(LOG)/HOL-NSA-Examples.gz diff -r 419116f1157a -r e23770bc97c8 src/HOL/Nominal/Nominal.thy --- a/src/HOL/Nominal/Nominal.thy Thu Feb 26 08:44:44 2009 -0800 +++ b/src/HOL/Nominal/Nominal.thy Thu Feb 26 08:48:33 2009 -0800 @@ -397,6 +397,25 @@ lemmas fresh_star_prod = fresh_star_prod_list fresh_star_prod_set +lemma fresh_star_set_eq: "set xs \* c = xs \* c" + by (simp add: fresh_star_def) + +lemma fresh_star_Un_elim: + "((S \ T) \* c \ PROP C) \ (S \* c \ T \* c \ PROP C)" + apply rule + apply (simp_all add: fresh_star_def) + apply (erule meta_mp) + apply blast + done + +lemma fresh_star_insert_elim: + "(insert x S \* c \ PROP C) \ (x \ c \ S \* c \ PROP C)" + by rule (simp_all add: fresh_star_def) + +lemma fresh_star_empty_elim: + "({} \* c \ PROP C) \ PROP C" + by (simp add: fresh_star_def) + text {* Normalization of freshness results; cf.\ @{text nominal_induct} *} lemma fresh_star_unit_elim: diff -r 419116f1157a -r e23770bc97c8 src/HOL/Nominal/nominal_inductive2.ML --- a/src/HOL/Nominal/nominal_inductive2.ML Thu Feb 26 08:44:44 2009 -0800 +++ b/src/HOL/Nominal/nominal_inductive2.ML Thu Feb 26 08:48:33 2009 -0800 @@ -28,6 +28,11 @@ fun atomize_induct ctxt = Conv.fconv_rule (Conv.prems_conv ~1 (Conv.params_conv ~1 (K (Conv.prems_conv ~1 atomize_conv)) ctxt)); +val fresh_postprocess = + Simplifier.full_simplify (HOL_basic_ss addsimps + [@{thm fresh_star_set_eq}, @{thm fresh_star_Un_elim}, + @{thm fresh_star_insert_elim}, @{thm fresh_star_empty_elim}]); + fun preds_of ps t = gen_inter (op = o apfst dest_Free) (ps, Term.add_frees t []); val perm_bool = mk_meta_eq (thm "perm_bool"); @@ -192,12 +197,15 @@ handle TERM _ => error ("Expression " ^ quote s ^ " to be avoided in case " ^ quote name ^ " is not a set type"); - val ps = map mk sets + fun add_set p [] = [p] + | add_set (t, T) ((u, U) :: ps) = + if T = U then + let val S = HOLogic.mk_setT T + in (Const (@{const_name "op Un"}, S --> S --> S) $ u $ t, T) :: ps + end + else (u, U) :: add_set (t, T) ps in - case duplicates op = (map snd ps) of - [] => ps - | Ts => error ("More than one set in case " ^ quote name ^ - " for type(s) " ^ commas_quote (map (Syntax.string_of_typ ctxt') Ts)) + fold (mk #> add_set) sets [] end; val prems = map (fn (prem, name) => @@ -436,7 +444,9 @@ REPEAT (REPEAT (resolve_tac [conjI, impI] 1) THEN etac impE 1 THEN atac 1 THEN REPEAT (etac @{thm allE_Nil} 1) THEN asm_full_simp_tac (simpset_of thy) 1) - end) |> singleton (ProofContext.export ctxt' ctxt); + end) |> + fresh_postprocess |> + singleton (ProofContext.export ctxt' ctxt); in ctxt'' |> diff -r 419116f1157a -r e23770bc97c8 src/HOL/Orderings.thy --- a/src/HOL/Orderings.thy Thu Feb 26 08:44:44 2009 -0800 +++ b/src/HOL/Orderings.thy Thu Feb 26 08:48:33 2009 -0800 @@ -331,7 +331,7 @@ fun struct_tac ((s, [eq, le, less]), thms) prems = let - fun decomp thy (Trueprop $ t) = + fun decomp thy (@{const Trueprop} $ t) = let fun excluded t = (* exclude numeric types: linear arithmetic subsumes transitivity *) @@ -350,7 +350,8 @@ of NONE => NONE | SOME (t1, rel, t2) => SOME (t1, "~" ^ rel, t2)) | dec x = rel x; - in dec t end; + in dec t end + | decomp thy _ = NONE; in case s of "order" => Order_Tac.partial_tac decomp thms prems diff -r 419116f1157a -r e23770bc97c8 src/HOL/Transitive_Closure.thy --- a/src/HOL/Transitive_Closure.thy Thu Feb 26 08:44:44 2009 -0800 +++ b/src/HOL/Transitive_Closure.thy Thu Feb 26 08:48:33 2009 -0800 @@ -646,7 +646,7 @@ val trancl_rtrancl_trancl = @{thm trancl_rtrancl_trancl}; val rtrancl_trans = @{thm rtrancl_trans}; - fun decomp (Trueprop $ t) = + fun decomp (@{const Trueprop} $ t) = let fun dec (Const ("op :", _) $ (Const ("Pair", _) $ a $ b) $ rel ) = let fun decr (Const ("Transitive_Closure.rtrancl", _ ) $ r) = (r,"r*") | decr (Const ("Transitive_Closure.trancl", _ ) $ r) = (r,"r+") @@ -654,7 +654,8 @@ val (rel,r) = decr (Envir.beta_eta_contract rel); in SOME (a,b,rel,r) end | dec _ = NONE - in dec t end; + in dec t end + | decomp _ = NONE; end); @@ -669,7 +670,7 @@ val trancl_rtrancl_trancl = @{thm tranclp_rtranclp_tranclp}; val rtrancl_trans = @{thm rtranclp_trans}; - fun decomp (Trueprop $ t) = + fun decomp (@{const Trueprop} $ t) = let fun dec (rel $ a $ b) = let fun decr (Const ("Transitive_Closure.rtranclp", _ ) $ r) = (r,"r*") | decr (Const ("Transitive_Closure.tranclp", _ ) $ r) = (r,"r+") @@ -677,7 +678,8 @@ val (rel,r) = decr rel; in SOME (a, b, rel, r) end | dec _ = NONE - in dec t end; + in dec t end + | decomp _ = NONE; end); *} diff -r 419116f1157a -r e23770bc97c8 src/Pure/General/swing.scala --- a/src/Pure/General/swing.scala Thu Feb 26 08:44:44 2009 -0800 +++ b/src/Pure/General/swing.scala Thu Feb 26 08:48:33 2009 -0800 @@ -10,9 +10,11 @@ object Swing { - def now(body: => Unit) { - if (SwingUtilities.isEventDispatchThread) body - else SwingUtilities.invokeAndWait(new Runnable { def run = body }) + def now[A](body: => A): A = { + var result: Option[A] = None + if (SwingUtilities.isEventDispatchThread) { result = Some(body) } + else SwingUtilities.invokeAndWait(new Runnable { def run = { result = Some(body) } }) + result.get } def later(body: => Unit) {