author paulson Fri, 18 May 2001 17:18:43 +0200 changeset 11309 d666f11ca2d4 parent 11308 b28bbb153603 child 11310 51e70b7bc315
minor suggestions by Tanja Vos
 doc-src/TutorialI/Datatype/ABexpr.thy file | annotate | diff | comparison | revisions doc-src/TutorialI/Datatype/Fundata.thy file | annotate | diff | comparison | revisions doc-src/TutorialI/Datatype/Nested.thy file | annotate | diff | comparison | revisions doc-src/TutorialI/Datatype/document/ABexpr.tex file | annotate | diff | comparison | revisions doc-src/TutorialI/Datatype/document/Fundata.tex file | annotate | diff | comparison | revisions doc-src/TutorialI/Datatype/document/Nested.tex file | annotate | diff | comparison | revisions doc-src/TutorialI/Misc/document/simp.tex file | annotate | diff | comparison | revisions doc-src/TutorialI/Misc/simp.thy file | annotate | diff | comparison | revisions doc-src/TutorialI/Recdef/document/termination.tex file | annotate | diff | comparison | revisions doc-src/TutorialI/Recdef/termination.thy file | annotate | diff | comparison | revisions doc-src/TutorialI/Trie/Trie.thy file | annotate | diff | comparison | revisions doc-src/TutorialI/Trie/document/Trie.tex file | annotate | diff | comparison | revisions doc-src/TutorialI/fp.tex file | annotate | diff | comparison | revisions
--- a/doc-src/TutorialI/Datatype/ABexpr.thy	Fri May 18 16:45:55 2001 +0200
+++ b/doc-src/TutorialI/Datatype/ABexpr.thy	Fri May 18 17:18:43 2001 +0200
@@ -27,8 +27,9 @@

text{*\noindent
Type @{text"aexp"} is similar to @{text"expr"} in \S\ref{sec:ExprCompiler},
-except that we have fixed the values to be of type @{typ"nat"} and that we
-have fixed the two binary operations @{text Sum} and @{term"Diff"}. Boolean
+except that we have added an @{text IF} constructor,
+fixed the values to be of type @{typ"nat"} and declared the two binary
+operations @{text Sum} and @{term"Diff"}.  Boolean
expressions can be arithmetic comparisons, conjunctions and negations.
The semantics is fixed via two evaluation functions
*}
--- a/doc-src/TutorialI/Datatype/Fundata.thy	Fri May 18 16:45:55 2001 +0200
+++ b/doc-src/TutorialI/Datatype/Fundata.thy	Fri May 18 17:18:43 2001 +0200
@@ -32,7 +32,7 @@
Isabelle because the termination proof is not as obvious since
@{term"map_bt"} is only partially applied.

-The following lemma has a canonical proof:  *}
+The following lemma has a simple proof by induction:  *}

lemma "map_bt (g o f) T = map_bt g (map_bt f T)";
apply(induct_tac T, simp_all)
--- a/doc-src/TutorialI/Datatype/Nested.thy	Fri May 18 16:45:55 2001 +0200
+++ b/doc-src/TutorialI/Datatype/Nested.thy	Fri May 18 17:18:43 2001 +0200
@@ -120,7 +120,9 @@
could derive a new induction principle as well (see
\S\ref{sec:derive-ind}), but simpler is to stop using \isacommand{primrec}
and to define functions with \isacommand{recdef} instead.
-The details are explained in \S\ref{sec:nested-recdef} below.
+Simple uses of \isacommand{recdef} are described in \S\ref{sec:recdef} below,
+and later (\S\ref{sec:nested-recdef}) we shall see how \isacommand{recdef} can
+handle nested recursion.

Of course, you may also combine mutual and nested recursion of datatypes. For example,
constructor @{text Sum} in \S\ref{sec:datatype-mut-rec} could take a list of
--- a/doc-src/TutorialI/Datatype/document/ABexpr.tex	Fri May 18 16:45:55 2001 +0200
+++ b/doc-src/TutorialI/Datatype/document/ABexpr.tex	Fri May 18 17:18:43 2001 +0200
@@ -26,8 +26,9 @@
\begin{isamarkuptext}%
\noindent
Type \isa{aexp} is similar to \isa{expr} in \S\ref{sec:ExprCompiler},
-except that we have fixed the values to be of type \isa{nat} and that we
-have fixed the two binary operations \isa{Sum} and \isa{Diff}. Boolean
+except that we have added an \isa{IF} constructor,
+fixed the values to be of type \isa{nat} and declared the two binary
+operations \isa{Sum} and \isa{Diff}.  Boolean
expressions can be arithmetic comparisons, conjunctions and negations.
The semantics is fixed via two evaluation functions%
\end{isamarkuptext}%
--- a/doc-src/TutorialI/Datatype/document/Fundata.tex	Fri May 18 16:45:55 2001 +0200
+++ b/doc-src/TutorialI/Datatype/document/Fundata.tex	Fri May 18 17:18:43 2001 +0200
@@ -33,7 +33,7 @@
Isabelle because the termination proof is not as obvious since
\isa{map{\isacharunderscore}bt} is only partially applied.

-The following lemma has a canonical proof:%
+The following lemma has a simple proof by induction:%
\end{isamarkuptext}%
\isacommand{lemma}\ {\isachardoublequote}map{\isacharunderscore}bt\ {\isacharparenleft}g\ o\ f{\isacharparenright}\ T\ {\isacharequal}\ map{\isacharunderscore}bt\ g\ {\isacharparenleft}map{\isacharunderscore}bt\ f\ T{\isacharparenright}{\isachardoublequote}\isanewline
\isacommand{apply}{\isacharparenleft}induct{\isacharunderscore}tac\ T{\isacharcomma}\ simp{\isacharunderscore}all{\isacharparenright}\isanewline
--- a/doc-src/TutorialI/Datatype/document/Nested.tex	Fri May 18 16:45:55 2001 +0200
+++ b/doc-src/TutorialI/Datatype/document/Nested.tex	Fri May 18 17:18:43 2001 +0200
@@ -118,7 +118,9 @@
could derive a new induction principle as well (see
\S\ref{sec:derive-ind}), but simpler is to stop using \isacommand{primrec}
and to define functions with \isacommand{recdef} instead.
-The details are explained in \S\ref{sec:nested-recdef} below.
+Simple uses of \isacommand{recdef} are described in \S\ref{sec:recdef} below,
+and later (\S\ref{sec:nested-recdef}) we shall see how \isacommand{recdef} can
+handle nested recursion.

Of course, you may also combine mutual and nested recursion of datatypes. For example,
constructor \isa{Sum} in \S\ref{sec:datatype-mut-rec} could take a list of
--- a/doc-src/TutorialI/Misc/document/simp.tex	Fri May 18 16:45:55 2001 +0200
+++ b/doc-src/TutorialI/Misc/document/simp.tex	Fri May 18 17:18:43 2001 +0200
@@ -25,13 +25,16 @@
\isacommand{declare} \textit{theorem-name}\isa{{\isacharbrackleft}simp{\isacharbrackright}}\\
\isacommand{declare} \textit{theorem-name}\isa{{\isacharbrackleft}simp\ del{\isacharbrackright}}
\end{quote}
-As a rule of thumb, equations that really simplify (like \isa{rev\ {\isacharparenleft}rev\ xs{\isacharparenright}\ {\isacharequal}\ xs} and \isa{xs\ {\isacharat}\ {\isacharbrackleft}{\isacharbrackright}\ {\isacharequal}\ xs}) should be made simplification
-rules.  Those of a more specific nature (e.g.\ distributivity laws, which
-alter the structure of terms considerably) should only be used selectively,
-i.e.\ they should not be default simplification rules.  Conversely, it may
-also happen that a simplification rule needs to be disabled in certain
-proofs.  Frequent changes in the simplification status of a theorem may
+Only equations that really simplify, like \isa{rev\
+{\isacharparenleft}rev\ xs{\isacharparenright}\ {\isacharequal}\ xs} and
+\isa{xs\ {\isacharat}\ {\isacharbrackleft}{\isacharbrackright}\
+{\isacharequal}\ xs}, should be declared as default simplification rules.
+More specific ones should only be used selectively and should
+not be made default.  Distributivity laws, for example, alter
+the structure of terms and can produce an exponential blow-up instead of
+simplification.  A default simplification rule may
+need to be disabled in certain proofs.  Frequent changes in the simplification
+status of a theorem may indicate an unwise use of defaults.
\begin{warn}
Simplification may run forever, for example if both $f(x) = g(x)$ and
$g(x) = f(x)$ are simplification rules. It is the user's responsibility not
@@ -50,7 +53,8 @@
\isa{simp} \textit{list of modifiers}
\end{quote}
where the list of \emph{modifiers} fine tunes the behaviour and may
-be empty. Most if not all of the proofs seen so far could have been performed
+be empty. Specific modifiers are discussed below.  Most if not all of the
+proofs seen so far could have been performed
with \isa{simp} instead of \isa{auto}, except that \isa{simp} attacks
only the first subgoal and may thus need to be repeated --- use
\isaindex{simp_all} to simplify all subgoals.
@@ -73,6 +77,11 @@
others:
\begin{quote}
\isa{only{\isacharcolon}} \textit{list of theorem names}
+\end{quote}
+In this example, we invoke the simplifier, adding two distributive
+laws:
+\begin{quote}
\end{quote}%
\end{isamarkuptext}%
%
@@ -123,7 +132,7 @@
Both \isa{{\isacharparenleft}no{\isacharunderscore}asm{\isacharunderscore}simp{\isacharparenright}} and \isa{{\isacharparenleft}no{\isacharunderscore}asm{\isacharunderscore}use{\isacharparenright}} run forever on
the problematic subgoal above.
Note that only one of the modifiers is allowed, and it must precede all
-other arguments.
+other modifiers.

\begin{warn}
Assumptions are simplified in a left-to-right fashion. If an
@@ -259,7 +268,8 @@
simplifier performs it automatically. Try \isacommand{apply}\isa{{\isacharparenleft}simp{\isacharparenright}}
on the initial goal above.

-This splitting idea generalizes from \isa{if} to \isaindex{case}:%
+This splitting idea generalizes from \isa{if} to \isaindex{case}.
+Let us simplify a case analysis over lists:%
\end{isamarkuptxt}%
\isacommand{lemma}\ {\isachardoublequote}{\isacharparenleft}case\ xs\ of\ {\isacharbrackleft}{\isacharbrackright}\ {\isasymRightarrow}\ zs\ {\isacharbar}\ y{\isacharhash}ys\ {\isasymRightarrow}\ y{\isacharhash}{\isacharparenleft}ys{\isacharat}zs{\isacharparenright}{\isacharparenright}\ {\isacharequal}\ xs{\isacharat}zs{\isachardoublequote}\isanewline
\isacommand{apply}{\isacharparenleft}split\ list{\isachardot}split{\isacharparenright}%
@@ -386,7 +396,13 @@
[a] = [] == False
\end{ttbox}

-In more complicated cases, the trace can be quite lenghty, especially since
+The trace lists each rule being applied, both in its general form and the
+instance being used.  For conditional rules, the trace lists the rule
+it is trying to rewrite and gives the result of attempting to prove
+each of the rule's conditions.  Many other hints about the simplifier's
+actions will appear.
+
+In more complicated cases, the trace can be quite lengthy, especially since
invocations of the simplifier are often nested (e.g.\ when solving conditions
of rewrite rules). Thus it is advisable to reset it:%
\end{isamarkuptext}%
--- a/doc-src/TutorialI/Misc/simp.thy	Fri May 18 16:45:55 2001 +0200
+++ b/doc-src/TutorialI/Misc/simp.thy	Fri May 18 17:18:43 2001 +0200
@@ -23,14 +23,16 @@
\isacommand{declare} \textit{theorem-name}@{text"[simp]"}\\
\isacommand{declare} \textit{theorem-name}@{text"[simp del]"}
\end{quote}
-As a rule of thumb, equations that really simplify (like @{prop"rev(rev xs) =
- xs"} and @{prop"xs @ [] = xs"}) should be made simplification
-rules.  Those of a more specific nature (e.g.\ distributivity laws, which
-alter the structure of terms considerably) should only be used selectively,
-i.e.\ they should not be default simplification rules.  Conversely, it may
-also happen that a simplification rule needs to be disabled in certain
-proofs.  Frequent changes in the simplification status of a theorem may
+Only equations that really simplify, like \isa{rev\
+{\isacharparenleft}rev\ xs{\isacharparenright}\ {\isacharequal}\ xs} and
+\isa{xs\ {\isacharat}\ {\isacharbrackleft}{\isacharbrackright}\
+{\isacharequal}\ xs}, should be declared as default simplification rules.
+More specific ones should only be used selectively and should
+not be made default.  Distributivity laws, for example, alter
+the structure of terms and can produce an exponential blow-up instead of
+simplification.  A default simplification rule may
+need to be disabled in certain proofs.  Frequent changes in the simplification
+status of a theorem may indicate an unwise use of defaults.
\begin{warn}
Simplification may run forever, for example if both $f(x) = g(x)$ and
$g(x) = f(x)$ are simplification rules. It is the user's responsibility not
@@ -47,7 +49,8 @@
@{text simp} \textit{list of modifiers}
\end{quote}
where the list of \emph{modifiers} fine tunes the behaviour and may
-be empty. Most if not all of the proofs seen so far could have been performed
+be empty. Specific modifiers are discussed below.  Most if not all of the
+proofs seen so far could have been performed
with @{text simp} instead of \isa{auto}, except that @{text simp} attacks
only the first subgoal and may thus need to be repeated --- use
\isaindex{simp_all} to simplify all subgoals.
@@ -70,6 +73,11 @@
\begin{quote}
@{text"only:"} \textit{list of theorem names}
\end{quote}
+In this example, we invoke the simplifier, adding two distributive
+laws:
+\begin{quote}
+\end{quote}
*}

subsection{*Assumptions*}
@@ -120,7 +128,7 @@
Both @{text"(no_asm_simp)"} and @{text"(no_asm_use)"} run forever on
the problematic subgoal above.
Note that only one of the modifiers is allowed, and it must precede all
-other arguments.
+other modifiers.

\begin{warn}
Assumptions are simplified in a left-to-right fashion. If an
@@ -258,11 +266,12 @@
simplifier performs it automatically. Try \isacommand{apply}@{text"(simp)"}
on the initial goal above.

-This splitting idea generalizes from @{text"if"} to \isaindex{case}:
+This splitting idea generalizes from @{text"if"} to \isaindex{case}.
+Let us simplify a case analysis over lists:
*}(*<*)by simp(*>*)
lemma "(case xs of [] \<Rightarrow> zs | y#ys \<Rightarrow> y#(ys@zs)) = xs@zs";
apply(split list.split);
-
+
txt{*
@{subgoals[display,indent=0]}
In contrast to @{text"if"}-expressions, the simplifier does not split
@@ -396,7 +405,13 @@
[a] = [] == False
\end{ttbox}

-In more complicated cases, the trace can be quite lenghty, especially since
+The trace lists each rule being applied, both in its general form and the
+instance being used.  For conditional rules, the trace lists the rule
+it is trying to rewrite and gives the result of attempting to prove
+each of the rule's conditions.  Many other hints about the simplifier's
+actions will appear.
+
+In more complicated cases, the trace can be quite lengthy, especially since
invocations of the simplifier are often nested (e.g.\ when solving conditions
of rewrite rules). Thus it is advisable to reset it:
*}
--- a/doc-src/TutorialI/Recdef/document/termination.tex	Fri May 18 16:45:55 2001 +0200
+++ b/doc-src/TutorialI/Recdef/document/termination.tex	Fri May 18 17:18:43 2001 +0200
@@ -3,10 +3,10 @@
\def\isabellecontext{termination}%
%
\begin{isamarkuptext}%
-When a function is defined via \isacommand{recdef}, Isabelle tries to prove
-its termination with the help of the user-supplied measure.  All of the above
-examples are simple enough that Isabelle can prove automatically that the
-measure of the argument goes down in each recursive call. As a result,
+When a function~$f$ is defined via \isacommand{recdef}, Isabelle tries to prove
+its termination with the help of the user-supplied measure.  Each of the examples
+above is simple enough that Isabelle can automatically prove that the
+argument's measure decreases in each recursive call. As a result,
$f$\isa{{\isachardot}simps} will contain the defining equations (or variants derived
from them) as theorems. For example, look (via \isacommand{thm}) at
\isa{sep{\isachardot}simps} and \isa{sep{\isadigit{1}}{\isachardot}simps} to see that they define
--- a/doc-src/TutorialI/Recdef/termination.thy	Fri May 18 16:45:55 2001 +0200
+++ b/doc-src/TutorialI/Recdef/termination.thy	Fri May 18 17:18:43 2001 +0200
@@ -3,10 +3,10 @@
(*>*)

text{*
-When a function is defined via \isacommand{recdef}, Isabelle tries to prove
-its termination with the help of the user-supplied measure.  All of the above
-examples are simple enough that Isabelle can prove automatically that the
-measure of the argument goes down in each recursive call. As a result,
+When a function~$f$ is defined via \isacommand{recdef}, Isabelle tries to prove
+its termination with the help of the user-supplied measure.  Each of the examples
+above is simple enough that Isabelle can automatically prove that the
+argument's measure decreases in each recursive call. As a result,
$f$@{text".simps"} will contain the defining equations (or variants derived
from them) as theorems. For example, look (via \isacommand{thm}) at
@{thm[source]sep.simps} and @{thm[source]sep1.simps} to see that they define
--- a/doc-src/TutorialI/Trie/Trie.thy	Fri May 18 16:45:55 2001 +0200
+++ b/doc-src/TutorialI/Trie/Trie.thy	Fri May 18 17:18:43 2001 +0200
@@ -24,7 +24,8 @@
primrec "alist(Trie ov al) = al";

text{*\noindent
-Association lists come with a generic lookup function:
+Association lists come with a generic lookup function.  Its result
+involves type @{text option} because a lookup can fail:
*};

consts   assoc :: "('key * 'val)list \<Rightarrow> 'key \<Rightarrow> 'val option";
--- a/doc-src/TutorialI/Trie/document/Trie.tex	Fri May 18 16:45:55 2001 +0200
+++ b/doc-src/TutorialI/Trie/document/Trie.tex	Fri May 18 17:18:43 2001 +0200
@@ -23,7 +23,8 @@
\isacommand{primrec}\ {\isachardoublequote}alist{\isacharparenleft}Trie\ ov\ al{\isacharparenright}\ {\isacharequal}\ al{\isachardoublequote}%
\begin{isamarkuptext}%
\noindent
-Association lists come with a generic lookup function:%
+Association lists come with a generic lookup function.  Its result
+involves type \isa{option} because a lookup can fail:%
\end{isamarkuptext}%
\isacommand{consts}\ \ \ assoc\ {\isacharcolon}{\isacharcolon}\ {\isachardoublequote}{\isacharparenleft}{\isacharprime}key\ {\isacharasterisk}\ {\isacharprime}val{\isacharparenright}list\ {\isasymRightarrow}\ {\isacharprime}key\ {\isasymRightarrow}\ {\isacharprime}val\ option{\isachardoublequote}\isanewline
\isacommand{primrec}\ {\isachardoublequote}assoc\ {\isacharbrackleft}{\isacharbrackright}\ x\ {\isacharequal}\ None{\isachardoublequote}\isanewline
--- a/doc-src/TutorialI/fp.tex	Fri May 18 16:45:55 2001 +0200
+++ b/doc-src/TutorialI/fp.tex	Fri May 18 17:18:43 2001 +0200
@@ -1,54 +1,4 @@
-\chapter{Functional Programming in HOL}
-
-Although on the surface this chapter is mainly concerned with how to write
-functional programs in HOL and how to verify them, most of the constructs and
-proof procedures introduced are general purpose and recur in any specification
-or verification task. In fact, we really should speak of functional
-\emph{modelling} rather than \emph{programming}: our primary aim is not
-to write programs but to design abstract models of systems.  HOL is
-a specification language that goes well beyond what can be expressed as a
-program. However, for the time being we concentrate on the computable.
-
-The dedicated functional programmer should be warned: HOL offers only
-\emph{total functional programming} --- all functions in HOL must be total,
-i.e.\ they must terminate for all inputs; lazy data structures are not
-directly available.
-
-\section{An Introductory Theory}
-\label{sec:intro-theory}
-
-Functional programming needs datatypes and functions. Both of them can be
-defined in a theory with a syntax reminiscent of languages like ML or
-Haskell. As an example consider the theory in figure~\ref{fig:ToyList}.
-We will now examine it line by line.
-
-\begin{figure}[htbp]
-\begin{ttbox}\makeatother
-\input{ToyList2/ToyList1}\end{ttbox}
-\caption{A theory of lists}
-\label{fig:ToyList}
-\end{figure}
-
-{\makeatother\input{ToyList/document/ToyList.tex}}
-
-The complete proof script is shown in Fig.\ts\ref{fig:ToyList-proofs}. The
-concatenation of Figs.\ts\ref{fig:ToyList} and~\ref{fig:ToyList-proofs}
-constitutes the complete theory \texttt{ToyList} and should reside in file
-\texttt{ToyList.thy}. It is good practice to present all declarations and
-definitions at the beginning of a theory to facilitate browsing.
-
-\begin{figure}[htbp]
-\begin{ttbox}\makeatother
-\input{ToyList2/ToyList2}\end{ttbox}
-\label{fig:ToyList-proofs}
-\end{figure}
-
-\subsubsection*{Review}
-
-This is the end of our toy proof. It should have familiarized you with
-\begin{itemize}
-\item the standard theorem proving procedure:
+\chapter{Functional Programming in HOL}

Although on the surface this chapter is mainly concerned with how to write
functional programs in HOL and how to verify them, most of the constructs and
proof procedures introduced are general purpose and recur in any specification
or verification task. In fact, we really should speak of functional
\emph{modelling} rather than \emph{programming}: our primary aim is not
to write programs but to design abstract models of systems.  HOL is
a specification language that goes well beyond what can be expressed as a
program. However, for the time being we concentrate on the computable.

The dedicated functional programmer should be warned: HOL offers only
\emph{total functional programming} --- all functions in HOL must be total,
i.e.\ they must terminate for all inputs; lazy data structures are not
directly available.

\section{An Introductory Theory}
\label{sec:intro-theory}

Functional programming needs datatypes and functions. Both of them can be
defined in a theory with a syntax reminiscent of languages like ML or
Haskell. As an example consider the theory in figure~\ref{fig:ToyList}.
We will now examine it line by line.

\begin{figure}[htbp]
\begin{ttbox}\makeatother
\input{ToyList2/ToyList1}\end{ttbox}
\caption{A theory of lists}
\label{fig:ToyList}
\end{figure}

{\makeatother\input{ToyList/document/ToyList.tex}}

The complete proof script is shown in Fig.\ts\ref{fig:ToyList-proofs}. The
concatenation of Figs.\ts\ref{fig:ToyList} and~\ref{fig:ToyList-proofs}
constitutes the complete theory \texttt{ToyList} and should reside in file
\texttt{ToyList.thy}. It is good practice to present all declarations and
definitions at the beginning of a theory to facilitate browsing.

\begin{figure}[htbp]
\begin{ttbox}\makeatother
\input{ToyList2/ToyList2}\end{ttbox}
\label{fig:ToyList-proofs}
\end{figure}

\subsubsection*{Review}

This is the end of our toy proof. It should have familiarized you with
\begin{itemize}
\item the standard theorem proving procedure:
state a goal (lemma or theorem); proceed with proof until a separate lemma is
required; prove that lemma; come back to the original goal.
\item a specific procedure that works well for functional programs:
@@ -374,58 +324,7 @@
{\makeatother\input{Datatype/document/Nested.tex}}

-\subsection{The Limits of Nested Recursion}
-
-How far can we push nested recursion? By the unfolding argument above, we can
-reduce nested to mutual recursion provided the nested recursion only involves
-previously defined datatypes. This does not include functions:
-\begin{isabelle}
-\isacommand{datatype} t = C "t \isasymRightarrow\ bool"
-\end{isabelle}
-This declaration is a real can of worms.
-In HOL it must be ruled out because it requires a type
-\isa{t} such that \isa{t} and its power set \isa{t \isasymFun\ bool} have the
-same cardinality --- an impossibility. For the same reason it is not possible
-to allow recursion involving the type \isa{set}, which is isomorphic to
-\isa{t \isasymFun\ bool}.
-
-Fortunately, a limited form of recursion
-involving function spaces is permitted: the recursive type may occur on the
-right of a function arrow, but never on the left. Hence the above can of worms
-is ruled out but the following example of a potentially infinitely branching tree is
-accepted:
-\smallskip
-
-\input{Datatype/document/Fundata.tex}
-\bigskip
-
-If you need nested recursion on the left of a function arrow, there are
-alternatives to pure HOL: LCF~\cite{paulson87} is a logic where types like
-\begin{isabelle}
-\isacommand{datatype} lam = C "lam \isasymrightarrow\ lam"
-\end{isabelle}
-do indeed make sense.  Note the different arrow,
-expressing the type of \emph{continuous} functions.
-There is even a version of LCF on top of HOL,
-called HOLCF~\cite{MuellerNvOS99}.
-
-\index{*primrec|)}
-\index{*datatype|)}
-
-\subsection{Case Study: Tries}
-\label{sec:Trie}
-
-Tries are a classic search tree data structure~\cite{Knuth3-75} for fast
-indexing with strings. Figure~\ref{fig:trie} gives a graphical example of a
-trie containing the words all'', an'', ape'', can'', car'' and
-cat''.  When searching a string in a trie, the letters of the string are
-examined sequentially. Each letter determines which subtrie to search next.
-In this case study we model tries as a datatype, define a lookup and an
-update function, and prove that they behave as expected.
-
-\begin{figure}[htbp]
-\begin{center}
+\subsection{The Limits of Nested Recursion}

How far can we push nested recursion? By the unfolding argument above, we can
reduce nested to mutual recursion provided the nested recursion only involves
previously defined datatypes. This does not include functions:
\begin{isabelle}
\isacommand{datatype} t = C "t \isasymRightarrow\ bool"
\end{isabelle}
This declaration is a real can of worms.
In HOL it must be ruled out because it requires a type
\isa{t} such that \isa{t} and its power set \isa{t \isasymFun\ bool} have the
same cardinality --- an impossibility. For the same reason it is not possible
to allow recursion involving the type \isa{set}, which is isomorphic to
\isa{t \isasymFun\ bool}.

Fortunately, a limited form of recursion
involving function spaces is permitted: the recursive type may occur on the
right of a function arrow, but never on the left. Hence the above can of worms
is ruled out but the following example of a potentially infinitely branching tree is
accepted:
\smallskip

\input{Datatype/document/Fundata.tex}
\bigskip

If you need nested recursion on the left of a function arrow, there are
alternatives to pure HOL\@.  In the Logic for Computable Functions
(LCF), types like
\begin{isabelle}
\isacommand{datatype} lam = C "lam \isasymrightarrow\ lam"
\end{isabelle}
do indeed make sense~\cite{paulson87}.  Note the different arrow,
expressing the type of \emph{continuous} functions.
There is even a version of LCF on top of HOL,
called HOLCF~\cite{MuellerNvOS99}.

\index{*primrec|)}
\index{*datatype|)}

\subsection{Case Study: Tries}
\label{sec:Trie}

Tries are a classic search tree data structure~\cite{Knuth3-75} for fast
indexing with strings. Figure~\ref{fig:trie} gives a graphical example of a
trie containing the words all'', an'', ape'', can'', car'' and
cat''.  When searching a string in a trie, the letters of the string are
examined sequentially. Each letter determines which subtrie to search next.
In this case study we model tries as a datatype, define a lookup and an
update function, and prove that they behave as expected.

\begin{figure}[htbp]
\begin{center}
\unitlength1mm
\begin{picture}(60,30)
\put( 5, 0){\makebox(0,0)[b]{l}}
@@ -442,58 +341,7 @@
%
\put( 5,10){\makebox(0,0)[b]{l}}
\put(15,10){\makebox(0,0)[b]{n}}
-\put(25,10){\makebox(0,0)[b]{p}}
-\put(45,10){\makebox(0,0)[b]{a}}
-%
-\put(14,19){\line(-3,-2){9}}
-\put(15,19){\line(0,-1){5}}
-\put(16,19){\line(3,-2){9}}
-\put(45,19){\line(0,-1){5}}
-%
-\put(15,20){\makebox(0,0)[b]{a}}
-\put(45,20){\makebox(0,0)[b]{c}}
-%
-\put(30,30){\line(-3,-2){13}}
-\put(30,30){\line(3,-2){13}}
-\end{picture}
-\end{center}
-\caption{A sample trie}
-\label{fig:trie}
-\end{figure}
-
-Proper tries associate some value with each string. Since the
-information is stored only in the final node associated with the string, many
-nodes do not carry any value. This distinction is modeled with the help
-of the predefined datatype \isa{option} (see {\S}\ref{sec:option}).
-\input{Trie/document/Trie.tex}
-
-\section{Total Recursive Functions}
-\label{sec:recdef}
-\index{*recdef|(}
-
-Although many total functions have a natural primitive recursive definition,
-this is not always the case. Arbitrary total recursive functions can be
-defined by means of \isacommand{recdef}: you can use full pattern-matching,
-recursion need not involve datatypes, and termination is proved by showing
-that the arguments of all recursive calls are smaller in a suitable (user
-supplied) sense. In this section we restrict ourselves to measure functions;
-more advanced termination proofs are discussed in {\S}\ref{sec:beyond-measure}.
-
-\subsection{Defining Recursive Functions}
-\label{sec:recdef-examples}
-\input{Recdef/document/examples.tex}
-
-\subsection{Proving Termination}
-
-\input{Recdef/document/termination.tex}
-
-\subsection{Simplification with Recdef}
-\label{sec:recdef-simplification}
-
-\input{Recdef/document/simplification.tex}
-
-\subsection{Induction}
-\index{induction!recursion|(}
+\put(25,10){\makebox(0,0)[b]{p}}
\put(45,10){\makebox(0,0)[b]{a}}
%
\put(14,19){\line(-3,-2){9}}
\put(15,19){\line(0,-1){5}}
\put(16,19){\line(3,-2){9}}
\put(45,19){\line(0,-1){5}}
%
\put(15,20){\makebox(0,0)[b]{a}}
\put(45,20){\makebox(0,0)[b]{c}}
%
\put(30,30){\line(-3,-2){13}}
\put(30,30){\line(3,-2){13}}
\end{picture}
\end{center}
\caption{A sample trie}
\label{fig:trie}
\end{figure}

Proper tries associate some value with each string. Since the
information is stored only in the final node associated with the string, many
nodes do not carry any value. This distinction is modeled with the help
of the predefined datatype \isa{option} (see {\S}\ref{sec:option}).
\input{Trie/document/Trie.tex}

\section{Total Recursive Functions}
\label{sec:recdef}
\index{*recdef|(}

Although many total functions have a natural primitive recursive definition,
this is not always the case. Arbitrary total recursive functions can be
defined by means of \isacommand{recdef}: you can use full pattern-matching,
recursion need not involve datatypes, and termination is proved by showing
that the arguments of all recursive calls are smaller in a suitable (user
supplied) sense. In this section we restrict ourselves to measure functions;
more advanced termination proofs are discussed in {\S}\ref{sec:beyond-measure}.

\subsection{Defining Recursive Functions}
\label{sec:recdef-examples}
\input{Recdef/document/examples.tex}

\subsection{Proving Termination}

\input{Recdef/document/termination.tex}

\subsection{Simplification with Recdef}
\label{sec:recdef-simplification}

\input{Recdef/document/simplification.tex}

\subsection{Induction}
\index{induction!recursion|(}
\index{recursion induction|(}

\input{Recdef/document/Induction.tex}