doc-src/Ref/classical.tex
author paulson
Thu, 05 Feb 1998 10:26:59 +0100
changeset 4597 a0bdee64194c
parent 4561 19f1a01570bf
child 4649 89ad3eb863a1
permissions -rw-r--r--
Fixed a lot of overfull and underfull lines (hboxes)
lcp@104
     1
%% $Id$
lcp@319
     2
\chapter{The Classical Reasoner}\label{chap:classical}
lcp@286
     3
\index{classical reasoner|(}
lcp@308
     4
\newcommand\ainfer[2]{\begin{array}{r@{\,}l}#2\\ \hline#1\end{array}}
lcp@308
     5
wenzelm@3108
     6
Although Isabelle is generic, many users will be working in some
wenzelm@3108
     7
extension of classical first-order logic.  Isabelle's set theory~{\tt
wenzelm@4398
     8
  ZF} is built upon theory~\texttt{FOL}, while {\HOL}
wenzelm@3108
     9
conceptually contains first-order logic as a fragment.
wenzelm@3108
    10
Theorem-proving in predicate logic is undecidable, but many
lcp@308
    11
researchers have developed strategies to assist in this task.
lcp@104
    12
lcp@286
    13
Isabelle's classical reasoner is an \ML{} functor that accepts certain
lcp@104
    14
information about a logic and delivers a suite of automatic tactics.  Each
lcp@104
    15
tactic takes a collection of rules and executes a simple, non-clausal proof
lcp@104
    16
procedure.  They are slow and simplistic compared with resolution theorem
lcp@104
    17
provers, but they can save considerable time and effort.  They can prove
lcp@104
    18
theorems such as Pelletier's~\cite{pelletier86} problems~40 and~41 in
lcp@104
    19
seconds:
lcp@104
    20
\[ (\exists y. \forall x. J(y,x) \bimp \neg J(x,x))  
lcp@104
    21
   \imp  \neg (\forall x. \exists y. \forall z. J(z,y) \bimp \neg J(z,x)) \]
lcp@104
    22
\[ (\forall z. \exists y. \forall x. F(x,y) \bimp F(x,z) \conj \neg F(x,x))
lcp@104
    23
   \imp \neg (\exists z. \forall x. F(x,z))  
lcp@104
    24
\]
lcp@308
    25
%
lcp@308
    26
The tactics are generic.  They are not restricted to first-order logic, and
lcp@308
    27
have been heavily used in the development of Isabelle's set theory.  Few
lcp@308
    28
interactive proof assistants provide this much automation.  The tactics can
lcp@308
    29
be traced, and their components can be called directly; in this manner,
lcp@308
    30
any proof can be viewed interactively.
lcp@104
    31
paulson@3716
    32
The simplest way to apply the classical reasoner (to subgoal~$i$) is to type
paulson@2479
    33
\begin{ttbox}
paulson@3089
    34
by (Blast_tac \(i\));
paulson@2479
    35
\end{ttbox}
paulson@3716
    36
This command quickly proves most simple formulas of the predicate calculus or
paulson@3716
    37
set theory.  To attempt to prove \emph{all} subgoals using a combination of
paulson@3716
    38
rewriting and classical reasoning, try
paulson@3224
    39
\begin{ttbox}
paulson@4507
    40
by Auto_tac;
paulson@3224
    41
\end{ttbox}
paulson@3716
    42
To do all obvious logical steps, even if they do not prove the
paulson@3720
    43
subgoal, type one of the following:
paulson@3716
    44
\begin{ttbox}
paulson@3720
    45
by (Clarify_tac \(i\));        \emph{\textrm{applies to one subgoal}}
paulson@3720
    46
by Safe_tac;               \emph{\textrm{applies to all subgoals}}
paulson@3716
    47
\end{ttbox}
paulson@3716
    48
You need to know how the classical reasoner works in order to use it
paulson@3716
    49
effectively.  There are many tactics to choose from, including {\tt
paulson@3720
    50
  Fast_tac} and \texttt{Best_tac}.
paulson@2479
    51
wenzelm@3108
    52
We shall first discuss the underlying principles, then present the
wenzelm@3108
    53
classical reasoner.  Finally, we shall see how to instantiate it for
wenzelm@3108
    54
new logics.  The logics \FOL, \ZF, {\HOL} and {\HOLCF} have it already
wenzelm@3108
    55
installed.
lcp@104
    56
lcp@104
    57
lcp@104
    58
\section{The sequent calculus}
lcp@104
    59
\index{sequent calculus}
lcp@104
    60
Isabelle supports natural deduction, which is easy to use for interactive
lcp@104
    61
proof.  But natural deduction does not easily lend itself to automation,
lcp@104
    62
and has a bias towards intuitionism.  For certain proofs in classical
lcp@104
    63
logic, it can not be called natural.  The {\bf sequent calculus}, a
lcp@104
    64
generalization of natural deduction, is easier to automate.
lcp@104
    65
lcp@104
    66
A {\bf sequent} has the form $\Gamma\turn\Delta$, where $\Gamma$
lcp@308
    67
and~$\Delta$ are sets of formulae.%
lcp@308
    68
\footnote{For first-order logic, sequents can equivalently be made from
lcp@308
    69
  lists or multisets of formulae.} The sequent
lcp@104
    70
\[ P@1,\ldots,P@m\turn Q@1,\ldots,Q@n \]
lcp@104
    71
is {\bf valid} if $P@1\conj\ldots\conj P@m$ implies $Q@1\disj\ldots\disj
lcp@104
    72
Q@n$.  Thus $P@1,\ldots,P@m$ represent assumptions, each of which is true,
lcp@104
    73
while $Q@1,\ldots,Q@n$ represent alternative goals.  A sequent is {\bf
lcp@104
    74
basic} if its left and right sides have a common formula, as in $P,Q\turn
lcp@104
    75
Q,R$; basic sequents are trivially valid.
lcp@104
    76
lcp@104
    77
Sequent rules are classified as {\bf right} or {\bf left}, indicating which
lcp@104
    78
side of the $\turn$~symbol they operate on.  Rules that operate on the
lcp@104
    79
right side are analogous to natural deduction's introduction rules, and
lcp@308
    80
left rules are analogous to elimination rules.  
lcp@308
    81
Recall the natural deduction rules for
lcp@308
    82
  first-order logic, 
lcp@308
    83
\iflabelundefined{fol-fig}{from {\it Introduction to Isabelle}}%
lcp@308
    84
                          {Fig.\ts\ref{fol-fig}}.
lcp@308
    85
The sequent calculus analogue of~$({\imp}I)$ is the rule
wenzelm@3108
    86
$$
wenzelm@3108
    87
\ainfer{\Gamma &\turn \Delta, P\imp Q}{P,\Gamma &\turn \Delta,Q}
wenzelm@3108
    88
\eqno({\imp}R)
wenzelm@3108
    89
$$
lcp@104
    90
This breaks down some implication on the right side of a sequent; $\Gamma$
lcp@104
    91
and $\Delta$ stand for the sets of formulae that are unaffected by the
lcp@104
    92
inference.  The analogue of the pair~$({\disj}I1)$ and~$({\disj}I2)$ is the
lcp@104
    93
single rule 
wenzelm@3108
    94
$$
wenzelm@3108
    95
\ainfer{\Gamma &\turn \Delta, P\disj Q}{\Gamma &\turn \Delta,P,Q}
wenzelm@3108
    96
\eqno({\disj}R)
wenzelm@3108
    97
$$
lcp@104
    98
This breaks down some disjunction on the right side, replacing it by both
lcp@104
    99
disjuncts.  Thus, the sequent calculus is a kind of multiple-conclusion logic.
lcp@104
   100
lcp@104
   101
To illustrate the use of multiple formulae on the right, let us prove
lcp@104
   102
the classical theorem $(P\imp Q)\disj(Q\imp P)$.  Working backwards, we
lcp@104
   103
reduce this formula to a basic sequent:
lcp@104
   104
\[ \infer[(\disj)R]{\turn(P\imp Q)\disj(Q\imp P)}
lcp@104
   105
   {\infer[(\imp)R]{\turn(P\imp Q), (Q\imp P)\;}
lcp@104
   106
    {\infer[(\imp)R]{P \turn Q, (Q\imp P)\qquad}
lcp@104
   107
                    {P, Q \turn Q, P\qquad\qquad}}}
lcp@104
   108
\]
lcp@104
   109
This example is typical of the sequent calculus: start with the desired
lcp@104
   110
theorem and apply rules backwards in a fairly arbitrary manner.  This yields a
lcp@104
   111
surprisingly effective proof procedure.  Quantifiers add few complications,
lcp@104
   112
since Isabelle handles parameters and schematic variables.  See Chapter~10
lcp@104
   113
of {\em ML for the Working Programmer}~\cite{paulson91} for further
lcp@104
   114
discussion.
lcp@104
   115
lcp@104
   116
lcp@104
   117
\section{Simulating sequents by natural deduction}
paulson@3720
   118
Isabelle can represent sequents directly, as in the object-logic~\texttt{LK}\@.
lcp@104
   119
But natural deduction is easier to work with, and most object-logics employ
lcp@104
   120
it.  Fortunately, we can simulate the sequent $P@1,\ldots,P@m\turn
lcp@104
   121
Q@1,\ldots,Q@n$ by the Isabelle formula
lcp@104
   122
\[ \List{P@1;\ldots;P@m; \neg Q@2;\ldots; \neg Q@n}\Imp Q@1, \]
lcp@104
   123
where the order of the assumptions and the choice of~$Q@1$ are arbitrary.
lcp@104
   124
Elim-resolution plays a key role in simulating sequent proofs.
lcp@104
   125
lcp@104
   126
We can easily handle reasoning on the left.
lcp@308
   127
As discussed in
lcp@308
   128
\iflabelundefined{destruct}{{\it Introduction to Isabelle}}{\S\ref{destruct}}, 
lcp@104
   129
elim-resolution with the rules $(\disj E)$, $(\bot E)$ and $(\exists E)$
lcp@104
   130
achieves a similar effect as the corresponding sequent rules.  For the
lcp@104
   131
other connectives, we use sequent-style elimination rules instead of
lcp@308
   132
destruction rules such as $({\conj}E1,2)$ and $(\forall E)$.  But note that
lcp@308
   133
the rule $(\neg L)$ has no effect under our representation of sequents!
wenzelm@3108
   134
$$
wenzelm@3108
   135
\ainfer{\neg P,\Gamma &\turn \Delta}{\Gamma &\turn \Delta,P}\eqno({\neg}L)
wenzelm@3108
   136
$$
lcp@104
   137
What about reasoning on the right?  Introduction rules can only affect the
lcp@308
   138
formula in the conclusion, namely~$Q@1$.  The other right-side formulae are
lcp@319
   139
represented as negated assumptions, $\neg Q@2$, \ldots,~$\neg Q@n$.  
lcp@319
   140
\index{assumptions!negated}
lcp@319
   141
In order to operate on one of these, it must first be exchanged with~$Q@1$.
lcp@104
   142
Elim-resolution with the {\bf swap} rule has this effect:
wenzelm@3108
   143
$$ \List{\neg P; \; \neg R\Imp P} \Imp R   \eqno(swap)  $$
lcp@104
   144
To ensure that swaps occur only when necessary, each introduction rule is
lcp@104
   145
converted into a swapped form: it is resolved with the second premise
lcp@104
   146
of~$(swap)$.  The swapped form of~$({\conj}I)$, which might be
lcp@104
   147
called~$({\neg\conj}E)$, is
lcp@104
   148
\[ \List{\neg(P\conj Q); \; \neg R\Imp P; \; \neg R\Imp Q} \Imp R. \]
lcp@104
   149
Similarly, the swapped form of~$({\imp}I)$ is
lcp@104
   150
\[ \List{\neg(P\imp Q); \; \List{\neg R;P}\Imp Q} \Imp R  \]
lcp@104
   151
Swapped introduction rules are applied using elim-resolution, which deletes
lcp@104
   152
the negated formula.  Our representation of sequents also requires the use
lcp@104
   153
of ordinary introduction rules.  If we had no regard for readability, we
lcp@104
   154
could treat the right side more uniformly by representing sequents as
lcp@104
   155
\[ \List{P@1;\ldots;P@m; \neg Q@1;\ldots; \neg Q@n}\Imp \bot. \]
lcp@104
   156
lcp@104
   157
lcp@104
   158
\section{Extra rules for the sequent calculus}
lcp@104
   159
As mentioned, destruction rules such as $({\conj}E1,2)$ and $(\forall E)$
lcp@104
   160
must be replaced by sequent-style elimination rules.  In addition, we need
lcp@104
   161
rules to embody the classical equivalence between $P\imp Q$ and $\neg P\disj
lcp@104
   162
Q$.  The introduction rules~$({\disj}I1,2)$ are replaced by a rule that
lcp@104
   163
simulates $({\disj}R)$:
lcp@104
   164
\[ (\neg Q\Imp P) \Imp P\disj Q \]
lcp@104
   165
The destruction rule $({\imp}E)$ is replaced by
lcp@332
   166
\[ \List{P\imp Q;\; \neg P\Imp R;\; Q\Imp R} \Imp R. \]
lcp@104
   167
Quantifier replication also requires special rules.  In classical logic,
lcp@308
   168
$\exists x{.}P$ is equivalent to $\neg\forall x{.}\neg P$; the rules
lcp@308
   169
$(\exists R)$ and $(\forall L)$ are dual:
lcp@104
   170
\[ \ainfer{\Gamma &\turn \Delta, \exists x{.}P}
lcp@104
   171
          {\Gamma &\turn \Delta, \exists x{.}P, P[t/x]} \; (\exists R)
lcp@104
   172
   \qquad
lcp@104
   173
   \ainfer{\forall x{.}P, \Gamma &\turn \Delta}
lcp@104
   174
          {P[t/x], \forall x{.}P, \Gamma &\turn \Delta} \; (\forall L)
lcp@104
   175
\]
lcp@104
   176
Thus both kinds of quantifier may be replicated.  Theorems requiring
lcp@104
   177
multiple uses of a universal formula are easy to invent; consider 
lcp@308
   178
\[ (\forall x.P(x)\imp P(f(x))) \conj P(a) \imp P(f^n(a)), \]
lcp@308
   179
for any~$n>1$.  Natural examples of the multiple use of an existential
lcp@308
   180
formula are rare; a standard one is $\exists x.\forall y. P(x)\imp P(y)$.
lcp@104
   181
lcp@104
   182
Forgoing quantifier replication loses completeness, but gains decidability,
lcp@104
   183
since the search space becomes finite.  Many useful theorems can be proved
lcp@104
   184
without replication, and the search generally delivers its verdict in a
lcp@104
   185
reasonable time.  To adopt this approach, represent the sequent rules
lcp@104
   186
$(\exists R)$, $(\exists L)$ and $(\forall R)$ by $(\exists I)$, $(\exists
lcp@104
   187
E)$ and $(\forall I)$, respectively, and put $(\forall E)$ into elimination
lcp@104
   188
form:
lcp@104
   189
$$ \List{\forall x{.}P(x); P(t)\Imp Q} \Imp Q    \eqno(\forall E@2) $$
lcp@104
   190
Elim-resolution with this rule will delete the universal formula after a
lcp@104
   191
single use.  To replicate universal quantifiers, replace the rule by
wenzelm@3108
   192
$$
wenzelm@3108
   193
\List{\forall x{.}P(x);\; \List{P(t); \forall x{.}P(x)}\Imp Q} \Imp Q.
wenzelm@3108
   194
\eqno(\forall E@3)
wenzelm@3108
   195
$$
lcp@104
   196
To replicate existential quantifiers, replace $(\exists I)$ by
lcp@332
   197
\[ \List{\neg(\exists x{.}P(x)) \Imp P(t)} \Imp \exists x{.}P(x). \]
lcp@104
   198
All introduction rules mentioned above are also useful in swapped form.
lcp@104
   199
lcp@104
   200
Replication makes the search space infinite; we must apply the rules with
lcp@286
   201
care.  The classical reasoner distinguishes between safe and unsafe
lcp@104
   202
rules, applying the latter only when there is no alternative.  Depth-first
lcp@104
   203
search may well go down a blind alley; best-first search is better behaved
lcp@104
   204
in an infinite search space.  However, quantifier replication is too
lcp@104
   205
expensive to prove any but the simplest theorems.
lcp@104
   206
lcp@104
   207
lcp@104
   208
\section{Classical rule sets}
lcp@319
   209
\index{classical sets}
lcp@319
   210
Each automatic tactic takes a {\bf classical set} --- a collection of
lcp@104
   211
rules, classified as introduction or elimination and as {\bf safe} or {\bf
lcp@104
   212
unsafe}.  In general, safe rules can be attempted blindly, while unsafe
lcp@104
   213
rules must be used with care.  A safe rule must never reduce a provable
lcp@308
   214
goal to an unprovable set of subgoals.  
lcp@104
   215
lcp@308
   216
The rule~$({\disj}I1)$ is unsafe because it reduces $P\disj Q$ to~$P$.  Any
lcp@308
   217
rule is unsafe whose premises contain new unknowns.  The elimination
lcp@308
   218
rule~$(\forall E@2)$ is unsafe, since it is applied via elim-resolution,
lcp@308
   219
which discards the assumption $\forall x{.}P(x)$ and replaces it by the
lcp@308
   220
weaker assumption~$P(\Var{t})$.  The rule $({\exists}I)$ is unsafe for
lcp@308
   221
similar reasons.  The rule~$(\forall E@3)$ is unsafe in a different sense:
lcp@308
   222
since it keeps the assumption $\forall x{.}P(x)$, it is prone to looping.
lcp@308
   223
In classical first-order logic, all rules are safe except those mentioned
lcp@308
   224
above.
lcp@104
   225
lcp@104
   226
The safe/unsafe distinction is vague, and may be regarded merely as a way
lcp@104
   227
of giving some rules priority over others.  One could argue that
lcp@104
   228
$({\disj}E)$ is unsafe, because repeated application of it could generate
lcp@104
   229
exponentially many subgoals.  Induction rules are unsafe because inductive
lcp@104
   230
proofs are difficult to set up automatically.  Any inference is unsafe that
lcp@104
   231
instantiates an unknown in the proof state --- thus \ttindex{match_tac}
lcp@104
   232
must be used, rather than \ttindex{resolve_tac}.  Even proof by assumption
lcp@104
   233
is unsafe if it instantiates unknowns shared with other subgoals --- thus
lcp@104
   234
\ttindex{eq_assume_tac} must be used, rather than \ttindex{assume_tac}.
lcp@104
   235
lcp@1099
   236
\subsection{Adding rules to classical sets}
lcp@319
   237
Classical rule sets belong to the abstract type \mltydx{claset}, which
lcp@286
   238
supports the following operations (provided the classical reasoner is
lcp@104
   239
installed!):
lcp@104
   240
\begin{ttbox} 
lcp@1099
   241
empty_cs    : claset
lcp@1099
   242
print_cs    : claset -> unit
lcp@1099
   243
addSIs      : claset * thm list -> claset                 \hfill{\bf infix 4}
lcp@1099
   244
addSEs      : claset * thm list -> claset                 \hfill{\bf infix 4}
lcp@1099
   245
addSDs      : claset * thm list -> claset                 \hfill{\bf infix 4}
lcp@1099
   246
addIs       : claset * thm list -> claset                 \hfill{\bf infix 4}
lcp@1099
   247
addEs       : claset * thm list -> claset                 \hfill{\bf infix 4}
lcp@1099
   248
addDs       : claset * thm list -> claset                 \hfill{\bf infix 4}
berghofe@1869
   249
delrules    : claset * thm list -> claset                 \hfill{\bf infix 4}
lcp@104
   250
\end{ttbox}
paulson@3089
   251
The add operations ignore any rule already present in the claset with the same
paulson@3089
   252
classification (such as Safe Introduction).  They print a warning if the rule
paulson@3089
   253
has already been added with some other classification, but add the rule
paulson@3720
   254
anyway.  Calling \texttt{delrules} deletes all occurrences of a rule from the
paulson@3089
   255
claset, but see the warning below concerning destruction rules.
lcp@308
   256
\begin{ttdescription}
lcp@104
   257
\item[\ttindexbold{empty_cs}] is the empty classical set.
lcp@104
   258
lcp@1099
   259
\item[\ttindexbold{print_cs} $cs$] prints the rules of~$cs$.
lcp@1099
   260
lcp@308
   261
\item[$cs$ addSIs $rules$] \indexbold{*addSIs}
lcp@308
   262
adds safe introduction~$rules$ to~$cs$.
lcp@104
   263
lcp@308
   264
\item[$cs$ addSEs $rules$] \indexbold{*addSEs}
lcp@308
   265
adds safe elimination~$rules$ to~$cs$.
lcp@104
   266
lcp@308
   267
\item[$cs$ addSDs $rules$] \indexbold{*addSDs}
lcp@308
   268
adds safe destruction~$rules$ to~$cs$.
lcp@104
   269
lcp@308
   270
\item[$cs$ addIs $rules$] \indexbold{*addIs}
lcp@308
   271
adds unsafe introduction~$rules$ to~$cs$.
lcp@104
   272
lcp@308
   273
\item[$cs$ addEs $rules$] \indexbold{*addEs}
lcp@308
   274
adds unsafe elimination~$rules$ to~$cs$.
lcp@104
   275
lcp@308
   276
\item[$cs$ addDs $rules$] \indexbold{*addDs}
lcp@308
   277
adds unsafe destruction~$rules$ to~$cs$.
berghofe@1869
   278
berghofe@1869
   279
\item[$cs$ delrules $rules$] \indexbold{*delrules}
paulson@3089
   280
deletes~$rules$ from~$cs$.  It prints a warning for those rules that are not
paulson@3089
   281
in~$cs$.
lcp@308
   282
\end{ttdescription}
lcp@308
   283
paulson@3089
   284
\begin{warn}
paulson@3720
   285
  If you added $rule$ using \texttt{addSDs} or \texttt{addDs}, then you must delete
paulson@3089
   286
  it as follows:
paulson@3089
   287
\begin{ttbox}
paulson@3089
   288
\(cs\) delrules [make_elim \(rule\)]
paulson@3089
   289
\end{ttbox}
paulson@3089
   290
\par\noindent
paulson@3720
   291
This is necessary because the operators \texttt{addSDs} and \texttt{addDs} convert
paulson@3089
   292
the destruction rules to elimination rules by applying \ttindex{make_elim},
paulson@3720
   293
and then insert them using \texttt{addSEs} and \texttt{addEs}, respectively.
paulson@3089
   294
\end{warn}
paulson@3089
   295
lcp@104
   296
Introduction rules are those that can be applied using ordinary resolution.
lcp@104
   297
The classical set automatically generates their swapped forms, which will
lcp@104
   298
be applied using elim-resolution.  Elimination rules are applied using
lcp@286
   299
elim-resolution.  In a classical set, rules are sorted by the number of new
lcp@286
   300
subgoals they will yield; rules that generate the fewest subgoals will be
lcp@286
   301
tried first (see \S\ref{biresolve_tac}).
lcp@104
   302
lcp@1099
   303
lcp@1099
   304
\subsection{Modifying the search step}
paulson@3716
   305
For a given classical set, the proof strategy is simple.  Perform as many safe
paulson@3716
   306
inferences as possible; or else, apply certain safe rules, allowing
paulson@3716
   307
instantiation of unknowns; or else, apply an unsafe rule.  The tactics also
paulson@3716
   308
eliminate assumptions of the form $x=t$ by substitution if they have been set
paulson@3720
   309
up to do so (see \texttt{hyp_subst_tacs} in~\S\ref{sec:classical-setup} below).
paulson@3716
   310
They may perform a form of Modus Ponens: if there are assumptions $P\imp Q$
paulson@3716
   311
and~$P$, then replace $P\imp Q$ by~$Q$.
lcp@104
   312
paulson@3720
   313
The classical reasoning tactics --- except \texttt{blast_tac}! --- allow
wenzelm@3108
   314
you to modify this basic proof strategy by applying two arbitrary {\bf
paulson@3485
   315
  wrapper tacticals} to it.  This affects each step of the search.
wenzelm@3108
   316
Usually they are the identity tacticals, but they could apply another
paulson@3485
   317
tactic before or after the step tactic.  The first one, which is
wenzelm@3108
   318
considered to be safe, affects \ttindex{safe_step_tac} and all the
paulson@3485
   319
tactics that call it.  The the second one, which may be unsafe, affects
wenzelm@3108
   320
\ttindex{step_tac}, \ttindex{slow_step_tac} and the tactics that call
wenzelm@3108
   321
them.
lcp@1099
   322
lcp@1099
   323
\begin{ttbox} 
oheimb@2632
   324
addss        : claset * simpset -> claset                 \hfill{\bf infix 4}
oheimb@2632
   325
addSbefore   : claset *  (int -> tactic)  -> claset       \hfill{\bf infix 4}
oheimb@2632
   326
addSaltern   : claset *  (int -> tactic)  -> claset       \hfill{\bf infix 4}
oheimb@2632
   327
setSWrapper  : claset * ((int -> tactic) -> 
oheimb@2632
   328
                         (int -> tactic)) -> claset       \hfill{\bf infix 4}
oheimb@2632
   329
compSWrapper : claset * ((int -> tactic) -> 
oheimb@2632
   330
                         (int -> tactic)) -> claset       \hfill{\bf infix 4}
oheimb@2632
   331
addbefore    : claset *  (int -> tactic)  -> claset       \hfill{\bf infix 4}
oheimb@2632
   332
addaltern    : claset *  (int -> tactic)  -> claset       \hfill{\bf infix 4}
oheimb@2632
   333
setWrapper   : claset * ((int -> tactic) -> 
oheimb@2632
   334
                         (int -> tactic)) -> claset       \hfill{\bf infix 4}
oheimb@2632
   335
compWrapper  : claset * ((int -> tactic) -> 
oheimb@2632
   336
                         (int -> tactic)) -> claset       \hfill{\bf infix 4}
lcp@1099
   337
\end{ttbox}
lcp@1099
   338
%
wenzelm@3108
   339
\index{simplification!from classical reasoner} The wrapper tacticals
wenzelm@3108
   340
underly the operator addss, which combines each search step by
paulson@3720
   341
simplification.  Strictly speaking, \texttt{addss} is not part of the
paulson@4597
   342
classical reasoner.  It should be defined when the simplifier is
paulson@4597
   343
installed:
paulson@4597
   344
\begin{ttbox}
paulson@4597
   345
infix 4 addss;
paulson@4597
   346
fun cs addss  ss = cs  addbefore  asm_full_simp_tac ss;
paulson@4597
   347
\end{ttbox}
lcp@1099
   348
lcp@1099
   349
\begin{ttdescription}
lcp@1099
   350
\item[$cs$ addss $ss$] \indexbold{*addss}
paulson@3485
   351
adds the simpset~$ss$ to the classical set.  The assumptions and goal will be
oheimb@2631
   352
simplified, in a safe way, after the safe steps of the search.
oheimb@2631
   353
oheimb@2631
   354
\item[$cs$ addSbefore $tac$] \indexbold{*addSbefore}
oheimb@2631
   355
changes the safe wrapper tactical to apply the given tactic {\em before}
oheimb@2631
   356
each safe step of the search.
oheimb@2631
   357
oheimb@2631
   358
\item[$cs$ addSaltern $tac$] \indexbold{*addSaltern}
oheimb@2631
   359
changes the safe wrapper tactical to apply the given tactic when a safe step 
oheimb@2631
   360
of the search would fail.
oheimb@2631
   361
oheimb@2631
   362
\item[$cs$ setSWrapper $tactical$] \indexbold{*setSWrapper}
oheimb@2631
   363
specifies a new safe wrapper tactical.  
oheimb@2631
   364
oheimb@2631
   365
\item[$cs$ compSWrapper $tactical$] \indexbold{*compSWrapper}
oheimb@2631
   366
composes the $tactical$ with the existing safe wrapper tactical, 
oheimb@2631
   367
to combine their effects. 
lcp@1099
   368
lcp@1099
   369
\item[$cs$ addbefore $tac$] \indexbold{*addbefore}
oheimb@2631
   370
changes the (unsafe) wrapper tactical to apply the given tactic, which should
oheimb@2631
   371
be safe, {\em before} each step of the search.
lcp@1099
   372
oheimb@2631
   373
\item[$cs$ addaltern $tac$] \indexbold{*addaltern}
oheimb@2631
   374
changes the (unsafe) wrapper tactical to apply the given tactic 
oheimb@2631
   375
{\em alternatively} after each step of the search.
lcp@1099
   376
oheimb@2631
   377
\item[$cs$ setWrapper $tactical$] \indexbold{*setWrapper}
oheimb@2631
   378
specifies a new (unsafe) wrapper tactical.  
lcp@1099
   379
oheimb@2631
   380
\item[$cs$ compWrapper $tactical$] \indexbold{*compWrapper}
oheimb@2631
   381
composes the $tactical$ with the existing (unsafe) wrapper tactical, 
oheimb@2631
   382
to combine their effects. 
lcp@1099
   383
\end{ttdescription}
lcp@1099
   384
lcp@104
   385
lcp@104
   386
\section{The classical tactics}
paulson@3716
   387
\index{classical reasoner!tactics} If installed, the classical module provides
paulson@3716
   388
powerful theorem-proving tactics.  Most of them have capitalized analogues
paulson@3716
   389
that use the default claset; see \S\ref{sec:current-claset}.
paulson@3716
   390
paulson@3716
   391
\subsection{Semi-automatic tactics}
paulson@3716
   392
\begin{ttbox} 
paulson@3716
   393
clarify_tac      : claset -> int -> tactic
paulson@3716
   394
clarify_step_tac : claset -> int -> tactic
paulson@3716
   395
\end{ttbox}
paulson@3716
   396
Use these when the automatic tactics fail.  They perform all the obvious
paulson@3716
   397
logical inferences that do not split the subgoal.  The result is a
paulson@3716
   398
simpler subgoal that can be tackled by other means, such as by
paulson@3716
   399
instantiating quantifiers yourself.
paulson@3716
   400
\begin{ttdescription}
paulson@3716
   401
\item[\ttindexbold{clarify_tac} $cs$ $i$] performs a series of safe steps on
paulson@4597
   402
subgoal~$i$ by repeatedly calling \texttt{clarify_step_tac}.
paulson@3716
   403
paulson@3716
   404
\item[\ttindexbold{clarify_step_tac} $cs$ $i$] performs a safe step on
paulson@3716
   405
  subgoal~$i$.  No splitting step is applied; for example, the subgoal $A\conj
paulson@3716
   406
  B$ is left as a conjunction.  Proof by assumption, Modus Ponens, etc., may be
paulson@3716
   407
  performed provided they do not instantiate unknowns.  Assumptions of the
paulson@3716
   408
  form $x=t$ may be eliminated.  The user-supplied safe wrapper tactical is
paulson@3716
   409
  applied.
paulson@3716
   410
\end{ttdescription}
paulson@3716
   411
lcp@104
   412
paulson@3224
   413
\subsection{The tableau prover}
paulson@3720
   414
The tactic \texttt{blast_tac} searches for a proof using a fast tableau prover,
paulson@3224
   415
coded directly in \ML.  It then reconstructs the proof using Isabelle
paulson@3224
   416
tactics.  It is faster and more powerful than the other classical
paulson@3224
   417
reasoning tactics, but has major limitations too.
paulson@3089
   418
\begin{itemize}
paulson@3089
   419
\item It does not use the wrapper tacticals described above, such as
paulson@3089
   420
  \ttindex{addss}.
paulson@3089
   421
\item It ignores types, which can cause problems in \HOL.  If it applies a rule
paulson@3089
   422
  whose types are inappropriate, then proof reconstruction will fail.
paulson@3089
   423
\item It does not perform higher-order unification, as needed by the rule {\tt
paulson@3720
   424
    rangeI} in {\HOL} and \texttt{RepFunI} in {\ZF}.  There are often
paulson@3089
   425
    alternatives to such rules, for example {\tt
paulson@3720
   426
    range_eqI} and \texttt{RepFun_eqI}.
paulson@3089
   427
\item The message {\small\tt Function Var's argument not a bound variable\ }
paulson@3089
   428
relates to the lack of higher-order unification.  Function variables
paulson@3089
   429
may only be applied to parameters of the subgoal.
paulson@3720
   430
\item Its proof strategy is more general than \texttt{fast_tac}'s but can be
paulson@3720
   431
  slower.  If \texttt{blast_tac} fails or seems to be running forever, try {\tt
paulson@3089
   432
  fast_tac} and the other tactics described below.
paulson@3089
   433
\end{itemize}
paulson@3089
   434
%
paulson@3089
   435
\begin{ttbox} 
paulson@3089
   436
blast_tac        : claset -> int -> tactic
paulson@3089
   437
Blast.depth_tac  : claset -> int -> int -> tactic
paulson@3089
   438
Blast.trace      : bool ref \hfill{\bf initially false}
paulson@3089
   439
\end{ttbox}
paulson@3089
   440
The two tactics differ on how they bound the number of unsafe steps used in a
paulson@3720
   441
proof.  While \texttt{blast_tac} starts with a bound of zero and increases it
paulson@3720
   442
successively to~20, \texttt{Blast.depth_tac} applies a user-supplied search bound.
paulson@3089
   443
\begin{ttdescription}
paulson@3089
   444
\item[\ttindexbold{blast_tac} $cs$ $i$] tries to prove
paulson@3089
   445
  subgoal~$i$ using iterative deepening to increase the search bound.
paulson@3089
   446
  
paulson@3089
   447
\item[\ttindexbold{Blast.depth_tac} $cs$ $lim$ $i$] tries
paulson@3089
   448
  to prove subgoal~$i$ using a search bound of $lim$.  Often a slow
paulson@3720
   449
  proof using \texttt{blast_tac} can be made much faster by supplying the
paulson@3089
   450
  successful search bound to this tactic instead.
paulson@3089
   451
  
wenzelm@4317
   452
\item[set \ttindexbold{Blast.trace};] \index{tracing!of classical prover}
paulson@3089
   453
  causes the tableau prover to print a trace of its search.  At each step it
paulson@3089
   454
  displays the formula currently being examined and reports whether the branch
paulson@3089
   455
  has been closed, extended or split.
paulson@3089
   456
\end{ttdescription}
paulson@3089
   457
paulson@3224
   458
paulson@3224
   459
\subsection{An automatic tactic}
paulson@3224
   460
\begin{ttbox} 
paulson@3224
   461
auto_tac      : claset * simpset -> tactic
paulson@3224
   462
auto          : unit -> unit
paulson@3224
   463
\end{ttbox}
paulson@3224
   464
The auto-tactic attempts to prove all subgoals using a combination of
paulson@3224
   465
simplification and classical reasoning.  It is intended for situations where
paulson@3224
   466
there are a lot of mostly trivial subgoals; it proves all the easy ones,
paulson@3224
   467
leaving the ones it cannot prove.  (Unfortunately, attempting to prove the
paulson@3224
   468
hard ones may take a long time.)  It must be supplied both a simpset and a
paulson@3224
   469
claset; therefore it is most easily called as \texttt{Auto_tac}, which uses
paulson@3224
   470
the default claset and simpset (see \S\ref{sec:current-claset} below).  For
paulson@3224
   471
interactive use, the shorthand \texttt{auto();} abbreviates 
paulson@3224
   472
\begin{ttbox}
paulson@4507
   473
by Auto_tac;
paulson@3224
   474
\end{ttbox}
paulson@3224
   475
paulson@3224
   476
\subsection{Other classical tactics}
lcp@332
   477
\begin{ttbox} 
lcp@875
   478
fast_tac      : claset -> int -> tactic
lcp@875
   479
best_tac      : claset -> int -> tactic
lcp@875
   480
slow_tac      : claset -> int -> tactic
lcp@875
   481
slow_best_tac : claset -> int -> tactic
lcp@332
   482
\end{ttbox}
paulson@3224
   483
These tactics attempt to prove a subgoal using sequent-style reasoning.
paulson@3224
   484
Unlike \texttt{blast_tac}, they construct proofs directly in Isabelle.  Their
paulson@3720
   485
effect is restricted (by \texttt{SELECT_GOAL}) to one subgoal; they either prove
paulson@3720
   486
this subgoal or fail.  The \texttt{slow_} versions conduct a broader
paulson@3224
   487
search.%
paulson@3224
   488
\footnote{They may, when backtracking from a failed proof attempt, undo even
paulson@3224
   489
  the step of proving a subgoal by assumption.}
lcp@875
   490
lcp@875
   491
The best-first tactics are guided by a heuristic function: typically, the
lcp@875
   492
total size of the proof state.  This function is supplied in the functor call
lcp@875
   493
that sets up the classical reasoner.
lcp@332
   494
\begin{ttdescription}
paulson@3720
   495
\item[\ttindexbold{fast_tac} $cs$ $i$] applies \texttt{step_tac} using
paulson@3089
   496
depth-first search, to prove subgoal~$i$.
lcp@332
   497
paulson@3720
   498
\item[\ttindexbold{best_tac} $cs$ $i$] applies \texttt{step_tac} using
paulson@3089
   499
best-first search, to prove subgoal~$i$.
lcp@875
   500
paulson@3720
   501
\item[\ttindexbold{slow_tac} $cs$ $i$] applies \texttt{slow_step_tac} using
paulson@3089
   502
depth-first search, to prove subgoal~$i$.
lcp@875
   503
paulson@3720
   504
\item[\ttindexbold{slow_best_tac} $cs$ $i$] applies \texttt{slow_step_tac} using
paulson@3089
   505
best-first search, to prove subgoal~$i$.
lcp@875
   506
\end{ttdescription}
lcp@875
   507
lcp@875
   508
paulson@3716
   509
\subsection{Depth-limited automatic tactics}
lcp@875
   510
\begin{ttbox} 
lcp@875
   511
depth_tac  : claset -> int -> int -> tactic
lcp@875
   512
deepen_tac : claset -> int -> int -> tactic
lcp@875
   513
\end{ttbox}
lcp@875
   514
These work by exhaustive search up to a specified depth.  Unsafe rules are
lcp@875
   515
modified to preserve the formula they act on, so that it be used repeatedly.
paulson@3720
   516
They can prove more goals than \texttt{fast_tac} can but are much
lcp@875
   517
slower, for example if the assumptions have many universal quantifiers.
lcp@875
   518
lcp@875
   519
The depth limits the number of unsafe steps.  If you can estimate the minimum
lcp@875
   520
number of unsafe steps needed, supply this value as~$m$ to save time.
lcp@875
   521
\begin{ttdescription}
lcp@875
   522
\item[\ttindexbold{depth_tac} $cs$ $m$ $i$] 
paulson@3089
   523
tries to prove subgoal~$i$ by exhaustive search up to depth~$m$.
lcp@875
   524
lcp@875
   525
\item[\ttindexbold{deepen_tac} $cs$ $m$ $i$] 
paulson@3720
   526
tries to prove subgoal~$i$ by iterative deepening.  It calls \texttt{depth_tac}
lcp@875
   527
repeatedly with increasing depths, starting with~$m$.
lcp@332
   528
\end{ttdescription}
lcp@332
   529
lcp@332
   530
lcp@104
   531
\subsection{Single-step tactics}
lcp@104
   532
\begin{ttbox} 
lcp@104
   533
safe_step_tac : claset -> int -> tactic
lcp@104
   534
safe_tac      : claset        -> tactic
lcp@104
   535
inst_step_tac : claset -> int -> tactic
lcp@104
   536
step_tac      : claset -> int -> tactic
lcp@104
   537
slow_step_tac : claset -> int -> tactic
lcp@104
   538
\end{ttbox}
lcp@104
   539
The automatic proof procedures call these tactics.  By calling them
lcp@104
   540
yourself, you can execute these procedures one step at a time.
lcp@308
   541
\begin{ttdescription}
lcp@104
   542
\item[\ttindexbold{safe_step_tac} $cs$ $i$] performs a safe step on
paulson@3716
   543
  subgoal~$i$.  The safe wrapper tactical is applied to a tactic that may
paulson@3716
   544
  include proof by assumption or Modus Ponens (taking care not to instantiate
paulson@3716
   545
  unknowns), or substitution.
lcp@104
   546
lcp@104
   547
\item[\ttindexbold{safe_tac} $cs$] repeatedly performs safe steps on all 
paulson@3716
   548
subgoals.  It is deterministic, with at most one outcome.  
lcp@104
   549
paulson@3720
   550
\item[\ttindexbold{inst_step_tac} $cs$ $i$] is like \texttt{safe_step_tac},
lcp@104
   551
but allows unknowns to be instantiated.
lcp@104
   552
lcp@1099
   553
\item[\ttindexbold{step_tac} $cs$ $i$] is the basic step of the proof
oheimb@2631
   554
  procedure.  The (unsafe) wrapper tactical is applied to a tactic that tries
paulson@3720
   555
 \texttt{safe_tac}, \texttt{inst_step_tac}, or applies an unsafe rule from~$cs$.
lcp@104
   556
lcp@104
   557
\item[\ttindexbold{slow_step_tac}] 
paulson@3720
   558
  resembles \texttt{step_tac}, but allows backtracking between using safe
paulson@3720
   559
  rules with instantiation (\texttt{inst_step_tac}) and using unsafe rules.
lcp@875
   560
  The resulting search space is larger.
lcp@308
   561
\end{ttdescription}
lcp@104
   562
paulson@3224
   563
\subsection{The current claset}\label{sec:current-claset}
wenzelm@4561
   564
wenzelm@4561
   565
Each theory is equipped with an implicit \emph{current
wenzelm@4561
   566
  claset}\index{claset!current}.  This is a default set of classical
wenzelm@4561
   567
rules.  The underlying idea is quite similar to that of a current
wenzelm@4561
   568
simpset described in \S\ref{sec:simp-for-dummies}; please read that
wenzelm@4561
   569
section, including its warnings.  The implicit claset can be accessed
wenzelm@4561
   570
as follows:
wenzelm@4561
   571
\begin{ttbox}
wenzelm@4561
   572
claset        : unit -> claset
wenzelm@4561
   573
claset_ref    : unit -> claset ref
wenzelm@4561
   574
claset_of     : theory -> claset
wenzelm@4561
   575
claset_ref_of : theory -> claset ref
wenzelm@4561
   576
print_claset  : theory -> unit
wenzelm@4561
   577
\end{ttbox}
wenzelm@4561
   578
wenzelm@4561
   579
The tactics
berghofe@1869
   580
\begin{ttbox}
paulson@3716
   581
Blast_tac        : int -> tactic
paulson@4507
   582
Auto_tac         :        tactic
paulson@3716
   583
Fast_tac         : int -> tactic
paulson@3716
   584
Best_tac         : int -> tactic
paulson@3716
   585
Deepen_tac       : int -> int -> tactic
paulson@3716
   586
Clarify_tac      : int -> tactic
paulson@3716
   587
Clarify_step_tac : int -> tactic
paulson@3720
   588
Safe_tac         :        tactic
paulson@3720
   589
Safe_step_tac    : int -> tactic
paulson@3716
   590
Step_tac         : int -> tactic
berghofe@1869
   591
\end{ttbox}
paulson@3224
   592
\indexbold{*Blast_tac}\indexbold{*Auto_tac}
paulson@3224
   593
\indexbold{*Best_tac}\indexbold{*Fast_tac}%
paulson@3720
   594
\indexbold{*Deepen_tac}
paulson@3720
   595
\indexbold{*Clarify_tac}\indexbold{*Clarify_step_tac}
paulson@3720
   596
\indexbold{*Safe_tac}\indexbold{*Safe_step_tac}
paulson@3720
   597
\indexbold{*Step_tac}
paulson@3720
   598
make use of the current claset.  For example, \texttt{Blast_tac} is defined as 
berghofe@1869
   599
\begin{ttbox}
wenzelm@4561
   600
fun Blast_tac i st = blast_tac (claset()) i st;
berghofe@1869
   601
\end{ttbox}
wenzelm@4561
   602
and gets the current claset, only after it is applied to a proof
wenzelm@4561
   603
state.  The functions
berghofe@1869
   604
\begin{ttbox}
berghofe@1869
   605
AddSIs, AddSEs, AddSDs, AddIs, AddEs, AddDs: thm list -> unit
berghofe@1869
   606
\end{ttbox}
berghofe@1869
   607
\indexbold{*AddSIs} \indexbold{*AddSEs} \indexbold{*AddSDs}
berghofe@1869
   608
\indexbold{*AddIs} \indexbold{*AddEs} \indexbold{*AddDs}
paulson@3485
   609
are used to add rules to the current claset.  They work exactly like their
paulson@3720
   610
lower case counterparts, such as \texttt{addSIs}.  Calling
berghofe@1869
   611
\begin{ttbox}
berghofe@1869
   612
Delrules : thm list -> unit
berghofe@1869
   613
\end{ttbox}
paulson@3224
   614
deletes rules from the current claset. 
lcp@104
   615
lcp@104
   616
\subsection{Other useful tactics}
lcp@319
   617
\index{tactics!for contradiction}
lcp@319
   618
\index{tactics!for Modus Ponens}
lcp@104
   619
\begin{ttbox} 
lcp@104
   620
contr_tac    :             int -> tactic
lcp@104
   621
mp_tac       :             int -> tactic
lcp@104
   622
eq_mp_tac    :             int -> tactic
lcp@104
   623
swap_res_tac : thm list -> int -> tactic
lcp@104
   624
\end{ttbox}
lcp@104
   625
These can be used in the body of a specialized search.
lcp@308
   626
\begin{ttdescription}
lcp@319
   627
\item[\ttindexbold{contr_tac} {\it i}]\index{assumptions!contradictory}
lcp@319
   628
  solves subgoal~$i$ by detecting a contradiction among two assumptions of
lcp@319
   629
  the form $P$ and~$\neg P$, or fail.  It may instantiate unknowns.  The
lcp@319
   630
  tactic can produce multiple outcomes, enumerating all possible
lcp@319
   631
  contradictions.
lcp@104
   632
lcp@104
   633
\item[\ttindexbold{mp_tac} {\it i}] 
paulson@3720
   634
is like \texttt{contr_tac}, but also attempts to perform Modus Ponens in
lcp@104
   635
subgoal~$i$.  If there are assumptions $P\imp Q$ and~$P$, then it replaces
lcp@104
   636
$P\imp Q$ by~$Q$.  It may instantiate unknowns.  It fails if it can do
lcp@104
   637
nothing.
lcp@104
   638
lcp@104
   639
\item[\ttindexbold{eq_mp_tac} {\it i}] 
paulson@3720
   640
is like \texttt{mp_tac} {\it i}, but may not instantiate unknowns --- thus, it
lcp@104
   641
is safe.
lcp@104
   642
lcp@104
   643
\item[\ttindexbold{swap_res_tac} {\it thms} {\it i}] refines subgoal~$i$ of
lcp@104
   644
the proof state using {\it thms}, which should be a list of introduction
paulson@3720
   645
rules.  First, it attempts to prove the goal using \texttt{assume_tac} or
paulson@3720
   646
\texttt{contr_tac}.  It then attempts to apply each rule in turn, attempting
lcp@104
   647
resolution and also elim-resolution with the swapped form.
lcp@308
   648
\end{ttdescription}
lcp@104
   649
lcp@104
   650
\subsection{Creating swapped rules}
lcp@104
   651
\begin{ttbox} 
lcp@104
   652
swapify   : thm list -> thm list
lcp@104
   653
joinrules : thm list * thm list -> (bool * thm) list
lcp@104
   654
\end{ttbox}
lcp@308
   655
\begin{ttdescription}
lcp@104
   656
\item[\ttindexbold{swapify} {\it thms}] returns a list consisting of the
lcp@104
   657
swapped versions of~{\it thms}, regarded as introduction rules.
lcp@104
   658
lcp@308
   659
\item[\ttindexbold{joinrules} ({\it intrs}, {\it elims})]
lcp@104
   660
joins introduction rules, their swapped versions, and elimination rules for
paulson@3720
   661
use with \ttindex{biresolve_tac}.  Each rule is paired with~\texttt{false}
paulson@3720
   662
(indicating ordinary resolution) or~\texttt{true} (indicating
lcp@104
   663
elim-resolution).
lcp@308
   664
\end{ttdescription}
lcp@104
   665
lcp@104
   666
paulson@3716
   667
\section{Setting up the classical reasoner}\label{sec:classical-setup}
lcp@319
   668
\index{classical reasoner!setting up}
paulson@3720
   669
Isabelle's classical object-logics, including \texttt{FOL} and \texttt{HOL}, have
lcp@286
   670
the classical reasoner already set up.  When defining a new classical logic,
lcp@286
   671
you should set up the reasoner yourself.  It consists of the \ML{} functor
lcp@104
   672
\ttindex{ClassicalFun}, which takes the argument
paulson@3720
   673
signature \texttt{
paulson@3720
   674
                  CLASSICAL_DATA}:
lcp@104
   675
\begin{ttbox} 
lcp@104
   676
signature CLASSICAL_DATA =
lcp@104
   677
  sig
lcp@104
   678
  val mp             : thm
lcp@104
   679
  val not_elim       : thm
lcp@104
   680
  val swap           : thm
lcp@104
   681
  val sizef          : thm -> int
lcp@104
   682
  val hyp_subst_tacs : (int -> tactic) list
lcp@104
   683
  end;
lcp@104
   684
\end{ttbox}
lcp@104
   685
Thus, the functor requires the following items:
lcp@308
   686
\begin{ttdescription}
lcp@319
   687
\item[\tdxbold{mp}] should be the Modus Ponens rule
lcp@104
   688
$\List{\Var{P}\imp\Var{Q};\; \Var{P}} \Imp \Var{Q}$.
lcp@104
   689
lcp@319
   690
\item[\tdxbold{not_elim}] should be the contradiction rule
lcp@104
   691
$\List{\neg\Var{P};\; \Var{P}} \Imp \Var{R}$.
lcp@104
   692
lcp@319
   693
\item[\tdxbold{swap}] should be the swap rule
lcp@104
   694
$\List{\neg \Var{P}; \; \neg \Var{R}\Imp \Var{P}} \Imp \Var{R}$.
lcp@104
   695
lcp@104
   696
\item[\ttindexbold{sizef}] is the heuristic function used for best-first
lcp@104
   697
search.  It should estimate the size of the remaining subgoals.  A good
lcp@104
   698
heuristic function is \ttindex{size_of_thm}, which measures the size of the
lcp@104
   699
proof state.  Another size function might ignore certain subgoals (say,
lcp@104
   700
those concerned with type checking).  A heuristic function might simply
lcp@104
   701
count the subgoals.
lcp@104
   702
lcp@319
   703
\item[\ttindexbold{hyp_subst_tacs}] is a list of tactics for substitution in
lcp@104
   704
the hypotheses, typically created by \ttindex{HypsubstFun} (see
lcp@104
   705
Chapter~\ref{substitution}).  This list can, of course, be empty.  The
lcp@104
   706
tactics are assumed to be safe!
lcp@308
   707
\end{ttdescription}
lcp@104
   708
The functor is not at all sensitive to the formalization of the
wenzelm@3108
   709
object-logic.  It does not even examine the rules, but merely applies
wenzelm@3108
   710
them according to its fixed strategy.  The functor resides in {\tt
wenzelm@3108
   711
  Provers/classical.ML} in the Isabelle sources.
lcp@104
   712
lcp@319
   713
\index{classical reasoner|)}