doc-src/Ref/classical.tex
author oheimb
Fri, 27 Feb 1998 11:18:29 +0100
changeset 4665 ef6a546d6b69
parent 4649 89ad3eb863a1
child 4666 b7c4e4ade1aa
permissions -rw-r--r--
added minimal description of rep_cs
lcp@104
     1
%% $Id$
lcp@319
     2
\chapter{The Classical Reasoner}\label{chap:classical}
lcp@286
     3
\index{classical reasoner|(}
lcp@308
     4
\newcommand\ainfer[2]{\begin{array}{r@{\,}l}#2\\ \hline#1\end{array}}
lcp@308
     5
wenzelm@3108
     6
Although Isabelle is generic, many users will be working in some
wenzelm@3108
     7
extension of classical first-order logic.  Isabelle's set theory~{\tt
wenzelm@4398
     8
  ZF} is built upon theory~\texttt{FOL}, while {\HOL}
wenzelm@3108
     9
conceptually contains first-order logic as a fragment.
wenzelm@3108
    10
Theorem-proving in predicate logic is undecidable, but many
lcp@308
    11
researchers have developed strategies to assist in this task.
lcp@104
    12
lcp@286
    13
Isabelle's classical reasoner is an \ML{} functor that accepts certain
lcp@104
    14
information about a logic and delivers a suite of automatic tactics.  Each
lcp@104
    15
tactic takes a collection of rules and executes a simple, non-clausal proof
lcp@104
    16
procedure.  They are slow and simplistic compared with resolution theorem
lcp@104
    17
provers, but they can save considerable time and effort.  They can prove
lcp@104
    18
theorems such as Pelletier's~\cite{pelletier86} problems~40 and~41 in
lcp@104
    19
seconds:
lcp@104
    20
\[ (\exists y. \forall x. J(y,x) \bimp \neg J(x,x))  
lcp@104
    21
   \imp  \neg (\forall x. \exists y. \forall z. J(z,y) \bimp \neg J(z,x)) \]
lcp@104
    22
\[ (\forall z. \exists y. \forall x. F(x,y) \bimp F(x,z) \conj \neg F(x,x))
lcp@104
    23
   \imp \neg (\exists z. \forall x. F(x,z))  
lcp@104
    24
\]
lcp@308
    25
%
lcp@308
    26
The tactics are generic.  They are not restricted to first-order logic, and
lcp@308
    27
have been heavily used in the development of Isabelle's set theory.  Few
lcp@308
    28
interactive proof assistants provide this much automation.  The tactics can
lcp@308
    29
be traced, and their components can be called directly; in this manner,
lcp@308
    30
any proof can be viewed interactively.
lcp@104
    31
paulson@3716
    32
The simplest way to apply the classical reasoner (to subgoal~$i$) is to type
paulson@2479
    33
\begin{ttbox}
paulson@3089
    34
by (Blast_tac \(i\));
paulson@2479
    35
\end{ttbox}
paulson@3716
    36
This command quickly proves most simple formulas of the predicate calculus or
paulson@3716
    37
set theory.  To attempt to prove \emph{all} subgoals using a combination of
paulson@3716
    38
rewriting and classical reasoning, try
paulson@3224
    39
\begin{ttbox}
paulson@4507
    40
by Auto_tac;
paulson@3224
    41
\end{ttbox}
paulson@3716
    42
To do all obvious logical steps, even if they do not prove the
paulson@3720
    43
subgoal, type one of the following:
paulson@3716
    44
\begin{ttbox}
paulson@3720
    45
by (Clarify_tac \(i\));        \emph{\textrm{applies to one subgoal}}
paulson@3720
    46
by Safe_tac;               \emph{\textrm{applies to all subgoals}}
paulson@3716
    47
\end{ttbox}
paulson@3716
    48
You need to know how the classical reasoner works in order to use it
paulson@3716
    49
effectively.  There are many tactics to choose from, including {\tt
paulson@3720
    50
  Fast_tac} and \texttt{Best_tac}.
paulson@2479
    51
wenzelm@3108
    52
We shall first discuss the underlying principles, then present the
wenzelm@3108
    53
classical reasoner.  Finally, we shall see how to instantiate it for
wenzelm@3108
    54
new logics.  The logics \FOL, \ZF, {\HOL} and {\HOLCF} have it already
wenzelm@3108
    55
installed.
lcp@104
    56
lcp@104
    57
lcp@104
    58
\section{The sequent calculus}
lcp@104
    59
\index{sequent calculus}
lcp@104
    60
Isabelle supports natural deduction, which is easy to use for interactive
lcp@104
    61
proof.  But natural deduction does not easily lend itself to automation,
lcp@104
    62
and has a bias towards intuitionism.  For certain proofs in classical
lcp@104
    63
logic, it can not be called natural.  The {\bf sequent calculus}, a
lcp@104
    64
generalization of natural deduction, is easier to automate.
lcp@104
    65
lcp@104
    66
A {\bf sequent} has the form $\Gamma\turn\Delta$, where $\Gamma$
lcp@308
    67
and~$\Delta$ are sets of formulae.%
lcp@308
    68
\footnote{For first-order logic, sequents can equivalently be made from
lcp@308
    69
  lists or multisets of formulae.} The sequent
lcp@104
    70
\[ P@1,\ldots,P@m\turn Q@1,\ldots,Q@n \]
lcp@104
    71
is {\bf valid} if $P@1\conj\ldots\conj P@m$ implies $Q@1\disj\ldots\disj
lcp@104
    72
Q@n$.  Thus $P@1,\ldots,P@m$ represent assumptions, each of which is true,
lcp@104
    73
while $Q@1,\ldots,Q@n$ represent alternative goals.  A sequent is {\bf
lcp@104
    74
basic} if its left and right sides have a common formula, as in $P,Q\turn
lcp@104
    75
Q,R$; basic sequents are trivially valid.
lcp@104
    76
lcp@104
    77
Sequent rules are classified as {\bf right} or {\bf left}, indicating which
lcp@104
    78
side of the $\turn$~symbol they operate on.  Rules that operate on the
lcp@104
    79
right side are analogous to natural deduction's introduction rules, and
lcp@308
    80
left rules are analogous to elimination rules.  
lcp@308
    81
Recall the natural deduction rules for
lcp@308
    82
  first-order logic, 
lcp@308
    83
\iflabelundefined{fol-fig}{from {\it Introduction to Isabelle}}%
lcp@308
    84
                          {Fig.\ts\ref{fol-fig}}.
lcp@308
    85
The sequent calculus analogue of~$({\imp}I)$ is the rule
wenzelm@3108
    86
$$
wenzelm@3108
    87
\ainfer{\Gamma &\turn \Delta, P\imp Q}{P,\Gamma &\turn \Delta,Q}
wenzelm@3108
    88
\eqno({\imp}R)
wenzelm@3108
    89
$$
lcp@104
    90
This breaks down some implication on the right side of a sequent; $\Gamma$
lcp@104
    91
and $\Delta$ stand for the sets of formulae that are unaffected by the
lcp@104
    92
inference.  The analogue of the pair~$({\disj}I1)$ and~$({\disj}I2)$ is the
lcp@104
    93
single rule 
wenzelm@3108
    94
$$
wenzelm@3108
    95
\ainfer{\Gamma &\turn \Delta, P\disj Q}{\Gamma &\turn \Delta,P,Q}
wenzelm@3108
    96
\eqno({\disj}R)
wenzelm@3108
    97
$$
lcp@104
    98
This breaks down some disjunction on the right side, replacing it by both
lcp@104
    99
disjuncts.  Thus, the sequent calculus is a kind of multiple-conclusion logic.
lcp@104
   100
lcp@104
   101
To illustrate the use of multiple formulae on the right, let us prove
lcp@104
   102
the classical theorem $(P\imp Q)\disj(Q\imp P)$.  Working backwards, we
lcp@104
   103
reduce this formula to a basic sequent:
lcp@104
   104
\[ \infer[(\disj)R]{\turn(P\imp Q)\disj(Q\imp P)}
lcp@104
   105
   {\infer[(\imp)R]{\turn(P\imp Q), (Q\imp P)\;}
lcp@104
   106
    {\infer[(\imp)R]{P \turn Q, (Q\imp P)\qquad}
lcp@104
   107
                    {P, Q \turn Q, P\qquad\qquad}}}
lcp@104
   108
\]
lcp@104
   109
This example is typical of the sequent calculus: start with the desired
lcp@104
   110
theorem and apply rules backwards in a fairly arbitrary manner.  This yields a
lcp@104
   111
surprisingly effective proof procedure.  Quantifiers add few complications,
lcp@104
   112
since Isabelle handles parameters and schematic variables.  See Chapter~10
lcp@104
   113
of {\em ML for the Working Programmer}~\cite{paulson91} for further
lcp@104
   114
discussion.
lcp@104
   115
lcp@104
   116
lcp@104
   117
\section{Simulating sequents by natural deduction}
paulson@3720
   118
Isabelle can represent sequents directly, as in the object-logic~\texttt{LK}\@.
lcp@104
   119
But natural deduction is easier to work with, and most object-logics employ
lcp@104
   120
it.  Fortunately, we can simulate the sequent $P@1,\ldots,P@m\turn
lcp@104
   121
Q@1,\ldots,Q@n$ by the Isabelle formula
lcp@104
   122
\[ \List{P@1;\ldots;P@m; \neg Q@2;\ldots; \neg Q@n}\Imp Q@1, \]
lcp@104
   123
where the order of the assumptions and the choice of~$Q@1$ are arbitrary.
lcp@104
   124
Elim-resolution plays a key role in simulating sequent proofs.
lcp@104
   125
lcp@104
   126
We can easily handle reasoning on the left.
lcp@308
   127
As discussed in
lcp@308
   128
\iflabelundefined{destruct}{{\it Introduction to Isabelle}}{\S\ref{destruct}}, 
lcp@104
   129
elim-resolution with the rules $(\disj E)$, $(\bot E)$ and $(\exists E)$
lcp@104
   130
achieves a similar effect as the corresponding sequent rules.  For the
lcp@104
   131
other connectives, we use sequent-style elimination rules instead of
lcp@308
   132
destruction rules such as $({\conj}E1,2)$ and $(\forall E)$.  But note that
lcp@308
   133
the rule $(\neg L)$ has no effect under our representation of sequents!
wenzelm@3108
   134
$$
wenzelm@3108
   135
\ainfer{\neg P,\Gamma &\turn \Delta}{\Gamma &\turn \Delta,P}\eqno({\neg}L)
wenzelm@3108
   136
$$
lcp@104
   137
What about reasoning on the right?  Introduction rules can only affect the
lcp@308
   138
formula in the conclusion, namely~$Q@1$.  The other right-side formulae are
lcp@319
   139
represented as negated assumptions, $\neg Q@2$, \ldots,~$\neg Q@n$.  
lcp@319
   140
\index{assumptions!negated}
lcp@319
   141
In order to operate on one of these, it must first be exchanged with~$Q@1$.
lcp@104
   142
Elim-resolution with the {\bf swap} rule has this effect:
wenzelm@3108
   143
$$ \List{\neg P; \; \neg R\Imp P} \Imp R   \eqno(swap)  $$
lcp@104
   144
To ensure that swaps occur only when necessary, each introduction rule is
lcp@104
   145
converted into a swapped form: it is resolved with the second premise
lcp@104
   146
of~$(swap)$.  The swapped form of~$({\conj}I)$, which might be
lcp@104
   147
called~$({\neg\conj}E)$, is
lcp@104
   148
\[ \List{\neg(P\conj Q); \; \neg R\Imp P; \; \neg R\Imp Q} \Imp R. \]
lcp@104
   149
Similarly, the swapped form of~$({\imp}I)$ is
lcp@104
   150
\[ \List{\neg(P\imp Q); \; \List{\neg R;P}\Imp Q} \Imp R  \]
lcp@104
   151
Swapped introduction rules are applied using elim-resolution, which deletes
lcp@104
   152
the negated formula.  Our representation of sequents also requires the use
lcp@104
   153
of ordinary introduction rules.  If we had no regard for readability, we
lcp@104
   154
could treat the right side more uniformly by representing sequents as
lcp@104
   155
\[ \List{P@1;\ldots;P@m; \neg Q@1;\ldots; \neg Q@n}\Imp \bot. \]
lcp@104
   156
lcp@104
   157
lcp@104
   158
\section{Extra rules for the sequent calculus}
lcp@104
   159
As mentioned, destruction rules such as $({\conj}E1,2)$ and $(\forall E)$
lcp@104
   160
must be replaced by sequent-style elimination rules.  In addition, we need
lcp@104
   161
rules to embody the classical equivalence between $P\imp Q$ and $\neg P\disj
lcp@104
   162
Q$.  The introduction rules~$({\disj}I1,2)$ are replaced by a rule that
lcp@104
   163
simulates $({\disj}R)$:
lcp@104
   164
\[ (\neg Q\Imp P) \Imp P\disj Q \]
lcp@104
   165
The destruction rule $({\imp}E)$ is replaced by
lcp@332
   166
\[ \List{P\imp Q;\; \neg P\Imp R;\; Q\Imp R} \Imp R. \]
lcp@104
   167
Quantifier replication also requires special rules.  In classical logic,
lcp@308
   168
$\exists x{.}P$ is equivalent to $\neg\forall x{.}\neg P$; the rules
lcp@308
   169
$(\exists R)$ and $(\forall L)$ are dual:
lcp@104
   170
\[ \ainfer{\Gamma &\turn \Delta, \exists x{.}P}
lcp@104
   171
          {\Gamma &\turn \Delta, \exists x{.}P, P[t/x]} \; (\exists R)
lcp@104
   172
   \qquad
lcp@104
   173
   \ainfer{\forall x{.}P, \Gamma &\turn \Delta}
lcp@104
   174
          {P[t/x], \forall x{.}P, \Gamma &\turn \Delta} \; (\forall L)
lcp@104
   175
\]
lcp@104
   176
Thus both kinds of quantifier may be replicated.  Theorems requiring
lcp@104
   177
multiple uses of a universal formula are easy to invent; consider 
lcp@308
   178
\[ (\forall x.P(x)\imp P(f(x))) \conj P(a) \imp P(f^n(a)), \]
lcp@308
   179
for any~$n>1$.  Natural examples of the multiple use of an existential
lcp@308
   180
formula are rare; a standard one is $\exists x.\forall y. P(x)\imp P(y)$.
lcp@104
   181
lcp@104
   182
Forgoing quantifier replication loses completeness, but gains decidability,
lcp@104
   183
since the search space becomes finite.  Many useful theorems can be proved
lcp@104
   184
without replication, and the search generally delivers its verdict in a
lcp@104
   185
reasonable time.  To adopt this approach, represent the sequent rules
lcp@104
   186
$(\exists R)$, $(\exists L)$ and $(\forall R)$ by $(\exists I)$, $(\exists
lcp@104
   187
E)$ and $(\forall I)$, respectively, and put $(\forall E)$ into elimination
lcp@104
   188
form:
lcp@104
   189
$$ \List{\forall x{.}P(x); P(t)\Imp Q} \Imp Q    \eqno(\forall E@2) $$
lcp@104
   190
Elim-resolution with this rule will delete the universal formula after a
lcp@104
   191
single use.  To replicate universal quantifiers, replace the rule by
wenzelm@3108
   192
$$
wenzelm@3108
   193
\List{\forall x{.}P(x);\; \List{P(t); \forall x{.}P(x)}\Imp Q} \Imp Q.
wenzelm@3108
   194
\eqno(\forall E@3)
wenzelm@3108
   195
$$
lcp@104
   196
To replicate existential quantifiers, replace $(\exists I)$ by
lcp@332
   197
\[ \List{\neg(\exists x{.}P(x)) \Imp P(t)} \Imp \exists x{.}P(x). \]
lcp@104
   198
All introduction rules mentioned above are also useful in swapped form.
lcp@104
   199
lcp@104
   200
Replication makes the search space infinite; we must apply the rules with
lcp@286
   201
care.  The classical reasoner distinguishes between safe and unsafe
lcp@104
   202
rules, applying the latter only when there is no alternative.  Depth-first
lcp@104
   203
search may well go down a blind alley; best-first search is better behaved
lcp@104
   204
in an infinite search space.  However, quantifier replication is too
lcp@104
   205
expensive to prove any but the simplest theorems.
lcp@104
   206
lcp@104
   207
lcp@104
   208
\section{Classical rule sets}
lcp@319
   209
\index{classical sets}
lcp@319
   210
Each automatic tactic takes a {\bf classical set} --- a collection of
lcp@104
   211
rules, classified as introduction or elimination and as {\bf safe} or {\bf
lcp@104
   212
unsafe}.  In general, safe rules can be attempted blindly, while unsafe
lcp@104
   213
rules must be used with care.  A safe rule must never reduce a provable
lcp@308
   214
goal to an unprovable set of subgoals.  
lcp@104
   215
lcp@308
   216
The rule~$({\disj}I1)$ is unsafe because it reduces $P\disj Q$ to~$P$.  Any
lcp@308
   217
rule is unsafe whose premises contain new unknowns.  The elimination
lcp@308
   218
rule~$(\forall E@2)$ is unsafe, since it is applied via elim-resolution,
lcp@308
   219
which discards the assumption $\forall x{.}P(x)$ and replaces it by the
lcp@308
   220
weaker assumption~$P(\Var{t})$.  The rule $({\exists}I)$ is unsafe for
lcp@308
   221
similar reasons.  The rule~$(\forall E@3)$ is unsafe in a different sense:
lcp@308
   222
since it keeps the assumption $\forall x{.}P(x)$, it is prone to looping.
lcp@308
   223
In classical first-order logic, all rules are safe except those mentioned
lcp@308
   224
above.
lcp@104
   225
lcp@104
   226
The safe/unsafe distinction is vague, and may be regarded merely as a way
lcp@104
   227
of giving some rules priority over others.  One could argue that
lcp@104
   228
$({\disj}E)$ is unsafe, because repeated application of it could generate
lcp@104
   229
exponentially many subgoals.  Induction rules are unsafe because inductive
lcp@104
   230
proofs are difficult to set up automatically.  Any inference is unsafe that
lcp@104
   231
instantiates an unknown in the proof state --- thus \ttindex{match_tac}
lcp@104
   232
must be used, rather than \ttindex{resolve_tac}.  Even proof by assumption
lcp@104
   233
is unsafe if it instantiates unknowns shared with other subgoals --- thus
lcp@104
   234
\ttindex{eq_assume_tac} must be used, rather than \ttindex{assume_tac}.
lcp@104
   235
lcp@1099
   236
\subsection{Adding rules to classical sets}
lcp@319
   237
Classical rule sets belong to the abstract type \mltydx{claset}, which
lcp@286
   238
supports the following operations (provided the classical reasoner is
lcp@104
   239
installed!):
lcp@104
   240
\begin{ttbox} 
lcp@1099
   241
empty_cs    : claset
lcp@1099
   242
print_cs    : claset -> unit
oheimb@4665
   243
rep_cs      : claset -> {safeEs: thm list, safeIs: thm list,
oheimb@4665
   244
                         hazEs: thm list,  hazIs: thm list, 
oheimb@4665
   245
                         swrappers: (string * wrapper) list, 
oheimb@4665
   246
                         uwrappers: (string * wrapper) list,
oheimb@4665
   247
                         safe0_netpair: netpair, safep_netpair: netpair,
oheimb@4665
   248
                           haz_netpair: netpair,   dup_netpair: netpair}
lcp@1099
   249
addSIs      : claset * thm list -> claset                 \hfill{\bf infix 4}
lcp@1099
   250
addSEs      : claset * thm list -> claset                 \hfill{\bf infix 4}
lcp@1099
   251
addSDs      : claset * thm list -> claset                 \hfill{\bf infix 4}
lcp@1099
   252
addIs       : claset * thm list -> claset                 \hfill{\bf infix 4}
lcp@1099
   253
addEs       : claset * thm list -> claset                 \hfill{\bf infix 4}
lcp@1099
   254
addDs       : claset * thm list -> claset                 \hfill{\bf infix 4}
berghofe@1869
   255
delrules    : claset * thm list -> claset                 \hfill{\bf infix 4}
lcp@104
   256
\end{ttbox}
paulson@3089
   257
The add operations ignore any rule already present in the claset with the same
paulson@3089
   258
classification (such as Safe Introduction).  They print a warning if the rule
paulson@3089
   259
has already been added with some other classification, but add the rule
paulson@3720
   260
anyway.  Calling \texttt{delrules} deletes all occurrences of a rule from the
paulson@3089
   261
claset, but see the warning below concerning destruction rules.
lcp@308
   262
\begin{ttdescription}
lcp@104
   263
\item[\ttindexbold{empty_cs}] is the empty classical set.
lcp@104
   264
oheimb@4665
   265
\item[\ttindexbold{print_cs} $cs$] displays the printable contents of~$cs$,
oheimb@4665
   266
  which is the rules. All other parts are non-printable.
oheimb@4665
   267
oheimb@4665
   268
\item[\ttindexbold{rep_cs} $cs$] decomposes $cs$ as a record of its internal 
oheimb@4665
   269
  components, namely the safe intruduction and elimination rules, the unsafe
oheimb@4665
   270
  intruduction and elimination rules, the lists of safe and unsafe wrappers
oheimb@4665
   271
  (see \ref{sec:modifying-search}),
oheimb@4665
   272
  and the internal representation of the rules.
lcp@1099
   273
lcp@308
   274
\item[$cs$ addSIs $rules$] \indexbold{*addSIs}
lcp@308
   275
adds safe introduction~$rules$ to~$cs$.
lcp@104
   276
lcp@308
   277
\item[$cs$ addSEs $rules$] \indexbold{*addSEs}
lcp@308
   278
adds safe elimination~$rules$ to~$cs$.
lcp@104
   279
lcp@308
   280
\item[$cs$ addSDs $rules$] \indexbold{*addSDs}
lcp@308
   281
adds safe destruction~$rules$ to~$cs$.
lcp@104
   282
lcp@308
   283
\item[$cs$ addIs $rules$] \indexbold{*addIs}
lcp@308
   284
adds unsafe introduction~$rules$ to~$cs$.
lcp@104
   285
lcp@308
   286
\item[$cs$ addEs $rules$] \indexbold{*addEs}
lcp@308
   287
adds unsafe elimination~$rules$ to~$cs$.
lcp@104
   288
lcp@308
   289
\item[$cs$ addDs $rules$] \indexbold{*addDs}
lcp@308
   290
adds unsafe destruction~$rules$ to~$cs$.
berghofe@1869
   291
berghofe@1869
   292
\item[$cs$ delrules $rules$] \indexbold{*delrules}
paulson@3089
   293
deletes~$rules$ from~$cs$.  It prints a warning for those rules that are not
paulson@3089
   294
in~$cs$.
lcp@308
   295
\end{ttdescription}
lcp@308
   296
paulson@3089
   297
\begin{warn}
paulson@3720
   298
  If you added $rule$ using \texttt{addSDs} or \texttt{addDs}, then you must delete
paulson@3089
   299
  it as follows:
paulson@3089
   300
\begin{ttbox}
paulson@3089
   301
\(cs\) delrules [make_elim \(rule\)]
paulson@3089
   302
\end{ttbox}
paulson@3089
   303
\par\noindent
paulson@3720
   304
This is necessary because the operators \texttt{addSDs} and \texttt{addDs} convert
paulson@3089
   305
the destruction rules to elimination rules by applying \ttindex{make_elim},
paulson@3720
   306
and then insert them using \texttt{addSEs} and \texttt{addEs}, respectively.
paulson@3089
   307
\end{warn}
paulson@3089
   308
lcp@104
   309
Introduction rules are those that can be applied using ordinary resolution.
lcp@104
   310
The classical set automatically generates their swapped forms, which will
lcp@104
   311
be applied using elim-resolution.  Elimination rules are applied using
lcp@286
   312
elim-resolution.  In a classical set, rules are sorted by the number of new
lcp@286
   313
subgoals they will yield; rules that generate the fewest subgoals will be
lcp@286
   314
tried first (see \S\ref{biresolve_tac}).
lcp@104
   315
lcp@1099
   316
lcp@1099
   317
\subsection{Modifying the search step}
oheimb@4665
   318
\label{sec:modifying-search}
paulson@3716
   319
For a given classical set, the proof strategy is simple.  Perform as many safe
paulson@3716
   320
inferences as possible; or else, apply certain safe rules, allowing
paulson@3716
   321
instantiation of unknowns; or else, apply an unsafe rule.  The tactics also
paulson@3716
   322
eliminate assumptions of the form $x=t$ by substitution if they have been set
paulson@3720
   323
up to do so (see \texttt{hyp_subst_tacs} in~\S\ref{sec:classical-setup} below).
paulson@3716
   324
They may perform a form of Modus Ponens: if there are assumptions $P\imp Q$
paulson@3716
   325
and~$P$, then replace $P\imp Q$ by~$Q$.
lcp@104
   326
paulson@3720
   327
The classical reasoning tactics --- except \texttt{blast_tac}! --- allow
oheimb@4649
   328
you to modify this basic proof strategy by applying two lists of arbitrary 
oheimb@4649
   329
{\bf wrapper tacticals} to it. 
oheimb@4649
   330
The first wrapper list, which is considered to contain safe wrappers only, 
oheimb@4649
   331
affects \ttindex{safe_step_tac} and all the tactics that call it.  
oheimb@4649
   332
The second one, which may contain unsafe wrappers, affects \ttindex{step_tac}, 
oheimb@4649
   333
\ttindex{slow_step_tac} and the tactics that call them.
oheimb@4649
   334
A wrapper transforms each step of the search, for example 
oheimb@4649
   335
by invoking other tactics before or alternatively to the original step tactic. 
oheimb@4649
   336
All members of a wrapper list are applied in turn to the respective step tactic.
oheimb@4649
   337
oheimb@4649
   338
Initially the two wrapper lists are empty, which means no modification of the
oheimb@4649
   339
step tactics. Safe and unsafe wrappers are added to a claset 
oheimb@4649
   340
with the functions given below, supplying them with wrapper names. 
oheimb@4649
   341
These names may be used to selectively delete wrappers.
lcp@1099
   342
lcp@1099
   343
\begin{ttbox} 
oheimb@4649
   344
type wrapper = (int -> tactic) -> (int -> tactic);
oheimb@4649
   345
addSbefore   : claset * (string * (int -> tactic)) -> claset \hfill{\bf infix 4}
oheimb@4649
   346
addSaltern   : claset * (string * (int -> tactic)) -> claset \hfill{\bf infix 4}
oheimb@4649
   347
addSWrapper  : claset * (string * wrapper        ) -> claset \hfill{\bf infix 4}
oheimb@4649
   348
delSWrapper  : claset *  string                    -> claset \hfill{\bf infix 4}
oheimb@4649
   349
addbefore    : claset * (string * (int -> tactic)) -> claset \hfill{\bf infix 4}
oheimb@4649
   350
addaltern    : claset * (string * (int -> tactic)) -> claset \hfill{\bf infix 4}
oheimb@4649
   351
addWrapper   : claset * (string * wrapper        ) -> claset \hfill{\bf infix 4}
oheimb@4649
   352
delWrapper   : claset *  string                    -> claset \hfill{\bf infix 4}
oheimb@4649
   353
oheimb@2632
   354
addss        : claset * simpset -> claset                 \hfill{\bf infix 4}
lcp@1099
   355
\end{ttbox}
lcp@1099
   356
%
wenzelm@3108
   357
\index{simplification!from classical reasoner} The wrapper tacticals
wenzelm@3108
   358
underly the operator addss, which combines each search step by
paulson@3720
   359
simplification.  Strictly speaking, \texttt{addss} is not part of the
paulson@4597
   360
classical reasoner.  It should be defined when the simplifier is
paulson@4597
   361
installed:
paulson@4597
   362
\begin{ttbox}
paulson@4597
   363
infix 4 addss;
oheimb@4649
   364
fun cs addss ss = cs addbefore asm_full_simp_tac ss;
paulson@4597
   365
\end{ttbox}
lcp@1099
   366
lcp@1099
   367
\begin{ttdescription}
lcp@1099
   368
\item[$cs$ addss $ss$] \indexbold{*addss}
paulson@3485
   369
adds the simpset~$ss$ to the classical set.  The assumptions and goal will be
oheimb@2631
   370
simplified, in a safe way, after the safe steps of the search.
oheimb@2631
   371
oheimb@2631
   372
\item[$cs$ addSbefore $tac$] \indexbold{*addSbefore}
oheimb@2631
   373
changes the safe wrapper tactical to apply the given tactic {\em before}
oheimb@2631
   374
each safe step of the search.
oheimb@2631
   375
oheimb@2631
   376
\item[$cs$ addSaltern $tac$] \indexbold{*addSaltern}
oheimb@2631
   377
changes the safe wrapper tactical to apply the given tactic when a safe step 
oheimb@2631
   378
of the search would fail.
oheimb@2631
   379
oheimb@2631
   380
\item[$cs$ setSWrapper $tactical$] \indexbold{*setSWrapper}
oheimb@2631
   381
specifies a new safe wrapper tactical.  
oheimb@2631
   382
oheimb@2631
   383
\item[$cs$ compSWrapper $tactical$] \indexbold{*compSWrapper}
oheimb@2631
   384
composes the $tactical$ with the existing safe wrapper tactical, 
oheimb@2631
   385
to combine their effects. 
lcp@1099
   386
lcp@1099
   387
\item[$cs$ addbefore $tac$] \indexbold{*addbefore}
oheimb@2631
   388
changes the (unsafe) wrapper tactical to apply the given tactic, which should
oheimb@2631
   389
be safe, {\em before} each step of the search.
lcp@1099
   390
oheimb@2631
   391
\item[$cs$ addaltern $tac$] \indexbold{*addaltern}
oheimb@2631
   392
changes the (unsafe) wrapper tactical to apply the given tactic 
oheimb@2631
   393
{\em alternatively} after each step of the search.
lcp@1099
   394
oheimb@2631
   395
\item[$cs$ setWrapper $tactical$] \indexbold{*setWrapper}
oheimb@2631
   396
specifies a new (unsafe) wrapper tactical.  
lcp@1099
   397
oheimb@2631
   398
\item[$cs$ compWrapper $tactical$] \indexbold{*compWrapper}
oheimb@2631
   399
composes the $tactical$ with the existing (unsafe) wrapper tactical, 
oheimb@2631
   400
to combine their effects. 
lcp@1099
   401
\end{ttdescription}
lcp@1099
   402
lcp@104
   403
lcp@104
   404
\section{The classical tactics}
paulson@3716
   405
\index{classical reasoner!tactics} If installed, the classical module provides
paulson@3716
   406
powerful theorem-proving tactics.  Most of them have capitalized analogues
paulson@3716
   407
that use the default claset; see \S\ref{sec:current-claset}.
paulson@3716
   408
paulson@3716
   409
\subsection{Semi-automatic tactics}
paulson@3716
   410
\begin{ttbox} 
paulson@3716
   411
clarify_tac      : claset -> int -> tactic
paulson@3716
   412
clarify_step_tac : claset -> int -> tactic
paulson@3716
   413
\end{ttbox}
paulson@3716
   414
Use these when the automatic tactics fail.  They perform all the obvious
paulson@3716
   415
logical inferences that do not split the subgoal.  The result is a
paulson@3716
   416
simpler subgoal that can be tackled by other means, such as by
paulson@3716
   417
instantiating quantifiers yourself.
paulson@3716
   418
\begin{ttdescription}
paulson@3716
   419
\item[\ttindexbold{clarify_tac} $cs$ $i$] performs a series of safe steps on
paulson@4597
   420
subgoal~$i$ by repeatedly calling \texttt{clarify_step_tac}.
paulson@3716
   421
paulson@3716
   422
\item[\ttindexbold{clarify_step_tac} $cs$ $i$] performs a safe step on
paulson@3716
   423
  subgoal~$i$.  No splitting step is applied; for example, the subgoal $A\conj
paulson@3716
   424
  B$ is left as a conjunction.  Proof by assumption, Modus Ponens, etc., may be
paulson@3716
   425
  performed provided they do not instantiate unknowns.  Assumptions of the
paulson@3716
   426
  form $x=t$ may be eliminated.  The user-supplied safe wrapper tactical is
paulson@3716
   427
  applied.
paulson@3716
   428
\end{ttdescription}
paulson@3716
   429
lcp@104
   430
paulson@3224
   431
\subsection{The tableau prover}
paulson@3720
   432
The tactic \texttt{blast_tac} searches for a proof using a fast tableau prover,
paulson@3224
   433
coded directly in \ML.  It then reconstructs the proof using Isabelle
paulson@3224
   434
tactics.  It is faster and more powerful than the other classical
paulson@3224
   435
reasoning tactics, but has major limitations too.
paulson@3089
   436
\begin{itemize}
paulson@3089
   437
\item It does not use the wrapper tacticals described above, such as
paulson@3089
   438
  \ttindex{addss}.
paulson@3089
   439
\item It ignores types, which can cause problems in \HOL.  If it applies a rule
paulson@3089
   440
  whose types are inappropriate, then proof reconstruction will fail.
paulson@3089
   441
\item It does not perform higher-order unification, as needed by the rule {\tt
paulson@3720
   442
    rangeI} in {\HOL} and \texttt{RepFunI} in {\ZF}.  There are often
paulson@3089
   443
    alternatives to such rules, for example {\tt
paulson@3720
   444
    range_eqI} and \texttt{RepFun_eqI}.
paulson@3089
   445
\item The message {\small\tt Function Var's argument not a bound variable\ }
paulson@3089
   446
relates to the lack of higher-order unification.  Function variables
paulson@3089
   447
may only be applied to parameters of the subgoal.
paulson@3720
   448
\item Its proof strategy is more general than \texttt{fast_tac}'s but can be
paulson@3720
   449
  slower.  If \texttt{blast_tac} fails or seems to be running forever, try {\tt
paulson@3089
   450
  fast_tac} and the other tactics described below.
paulson@3089
   451
\end{itemize}
paulson@3089
   452
%
paulson@3089
   453
\begin{ttbox} 
paulson@3089
   454
blast_tac        : claset -> int -> tactic
paulson@3089
   455
Blast.depth_tac  : claset -> int -> int -> tactic
paulson@3089
   456
Blast.trace      : bool ref \hfill{\bf initially false}
paulson@3089
   457
\end{ttbox}
paulson@3089
   458
The two tactics differ on how they bound the number of unsafe steps used in a
paulson@3720
   459
proof.  While \texttt{blast_tac} starts with a bound of zero and increases it
paulson@3720
   460
successively to~20, \texttt{Blast.depth_tac} applies a user-supplied search bound.
paulson@3089
   461
\begin{ttdescription}
paulson@3089
   462
\item[\ttindexbold{blast_tac} $cs$ $i$] tries to prove
paulson@3089
   463
  subgoal~$i$ using iterative deepening to increase the search bound.
paulson@3089
   464
  
paulson@3089
   465
\item[\ttindexbold{Blast.depth_tac} $cs$ $lim$ $i$] tries
paulson@3089
   466
  to prove subgoal~$i$ using a search bound of $lim$.  Often a slow
paulson@3720
   467
  proof using \texttt{blast_tac} can be made much faster by supplying the
paulson@3089
   468
  successful search bound to this tactic instead.
paulson@3089
   469
  
wenzelm@4317
   470
\item[set \ttindexbold{Blast.trace};] \index{tracing!of classical prover}
paulson@3089
   471
  causes the tableau prover to print a trace of its search.  At each step it
paulson@3089
   472
  displays the formula currently being examined and reports whether the branch
paulson@3089
   473
  has been closed, extended or split.
paulson@3089
   474
\end{ttdescription}
paulson@3089
   475
paulson@3224
   476
paulson@3224
   477
\subsection{An automatic tactic}
paulson@3224
   478
\begin{ttbox} 
paulson@3224
   479
auto_tac      : claset * simpset -> tactic
paulson@3224
   480
auto          : unit -> unit
paulson@3224
   481
\end{ttbox}
paulson@3224
   482
The auto-tactic attempts to prove all subgoals using a combination of
paulson@3224
   483
simplification and classical reasoning.  It is intended for situations where
paulson@3224
   484
there are a lot of mostly trivial subgoals; it proves all the easy ones,
paulson@3224
   485
leaving the ones it cannot prove.  (Unfortunately, attempting to prove the
paulson@3224
   486
hard ones may take a long time.)  It must be supplied both a simpset and a
paulson@3224
   487
claset; therefore it is most easily called as \texttt{Auto_tac}, which uses
paulson@3224
   488
the default claset and simpset (see \S\ref{sec:current-claset} below).  For
paulson@3224
   489
interactive use, the shorthand \texttt{auto();} abbreviates 
paulson@3224
   490
\begin{ttbox}
paulson@4507
   491
by Auto_tac;
paulson@3224
   492
\end{ttbox}
paulson@3224
   493
paulson@3224
   494
\subsection{Other classical tactics}
lcp@332
   495
\begin{ttbox} 
lcp@875
   496
fast_tac      : claset -> int -> tactic
lcp@875
   497
best_tac      : claset -> int -> tactic
lcp@875
   498
slow_tac      : claset -> int -> tactic
lcp@875
   499
slow_best_tac : claset -> int -> tactic
lcp@332
   500
\end{ttbox}
paulson@3224
   501
These tactics attempt to prove a subgoal using sequent-style reasoning.
paulson@3224
   502
Unlike \texttt{blast_tac}, they construct proofs directly in Isabelle.  Their
paulson@3720
   503
effect is restricted (by \texttt{SELECT_GOAL}) to one subgoal; they either prove
paulson@3720
   504
this subgoal or fail.  The \texttt{slow_} versions conduct a broader
paulson@3224
   505
search.%
paulson@3224
   506
\footnote{They may, when backtracking from a failed proof attempt, undo even
paulson@3224
   507
  the step of proving a subgoal by assumption.}
lcp@875
   508
lcp@875
   509
The best-first tactics are guided by a heuristic function: typically, the
lcp@875
   510
total size of the proof state.  This function is supplied in the functor call
lcp@875
   511
that sets up the classical reasoner.
lcp@332
   512
\begin{ttdescription}
paulson@3720
   513
\item[\ttindexbold{fast_tac} $cs$ $i$] applies \texttt{step_tac} using
paulson@3089
   514
depth-first search, to prove subgoal~$i$.
lcp@332
   515
paulson@3720
   516
\item[\ttindexbold{best_tac} $cs$ $i$] applies \texttt{step_tac} using
paulson@3089
   517
best-first search, to prove subgoal~$i$.
lcp@875
   518
paulson@3720
   519
\item[\ttindexbold{slow_tac} $cs$ $i$] applies \texttt{slow_step_tac} using
paulson@3089
   520
depth-first search, to prove subgoal~$i$.
lcp@875
   521
paulson@3720
   522
\item[\ttindexbold{slow_best_tac} $cs$ $i$] applies \texttt{slow_step_tac} using
paulson@3089
   523
best-first search, to prove subgoal~$i$.
lcp@875
   524
\end{ttdescription}
lcp@875
   525
lcp@875
   526
paulson@3716
   527
\subsection{Depth-limited automatic tactics}
lcp@875
   528
\begin{ttbox} 
lcp@875
   529
depth_tac  : claset -> int -> int -> tactic
lcp@875
   530
deepen_tac : claset -> int -> int -> tactic
lcp@875
   531
\end{ttbox}
lcp@875
   532
These work by exhaustive search up to a specified depth.  Unsafe rules are
lcp@875
   533
modified to preserve the formula they act on, so that it be used repeatedly.
paulson@3720
   534
They can prove more goals than \texttt{fast_tac} can but are much
lcp@875
   535
slower, for example if the assumptions have many universal quantifiers.
lcp@875
   536
lcp@875
   537
The depth limits the number of unsafe steps.  If you can estimate the minimum
lcp@875
   538
number of unsafe steps needed, supply this value as~$m$ to save time.
lcp@875
   539
\begin{ttdescription}
lcp@875
   540
\item[\ttindexbold{depth_tac} $cs$ $m$ $i$] 
paulson@3089
   541
tries to prove subgoal~$i$ by exhaustive search up to depth~$m$.
lcp@875
   542
lcp@875
   543
\item[\ttindexbold{deepen_tac} $cs$ $m$ $i$] 
paulson@3720
   544
tries to prove subgoal~$i$ by iterative deepening.  It calls \texttt{depth_tac}
lcp@875
   545
repeatedly with increasing depths, starting with~$m$.
lcp@332
   546
\end{ttdescription}
lcp@332
   547
lcp@332
   548
lcp@104
   549
\subsection{Single-step tactics}
lcp@104
   550
\begin{ttbox} 
lcp@104
   551
safe_step_tac : claset -> int -> tactic
lcp@104
   552
safe_tac      : claset        -> tactic
lcp@104
   553
inst_step_tac : claset -> int -> tactic
lcp@104
   554
step_tac      : claset -> int -> tactic
lcp@104
   555
slow_step_tac : claset -> int -> tactic
lcp@104
   556
\end{ttbox}
lcp@104
   557
The automatic proof procedures call these tactics.  By calling them
lcp@104
   558
yourself, you can execute these procedures one step at a time.
lcp@308
   559
\begin{ttdescription}
lcp@104
   560
\item[\ttindexbold{safe_step_tac} $cs$ $i$] performs a safe step on
paulson@3716
   561
  subgoal~$i$.  The safe wrapper tactical is applied to a tactic that may
paulson@3716
   562
  include proof by assumption or Modus Ponens (taking care not to instantiate
paulson@3716
   563
  unknowns), or substitution.
lcp@104
   564
lcp@104
   565
\item[\ttindexbold{safe_tac} $cs$] repeatedly performs safe steps on all 
paulson@3716
   566
subgoals.  It is deterministic, with at most one outcome.  
lcp@104
   567
paulson@3720
   568
\item[\ttindexbold{inst_step_tac} $cs$ $i$] is like \texttt{safe_step_tac},
lcp@104
   569
but allows unknowns to be instantiated.
lcp@104
   570
lcp@1099
   571
\item[\ttindexbold{step_tac} $cs$ $i$] is the basic step of the proof
oheimb@2631
   572
  procedure.  The (unsafe) wrapper tactical is applied to a tactic that tries
paulson@3720
   573
 \texttt{safe_tac}, \texttt{inst_step_tac}, or applies an unsafe rule from~$cs$.
lcp@104
   574
lcp@104
   575
\item[\ttindexbold{slow_step_tac}] 
paulson@3720
   576
  resembles \texttt{step_tac}, but allows backtracking between using safe
paulson@3720
   577
  rules with instantiation (\texttt{inst_step_tac}) and using unsafe rules.
lcp@875
   578
  The resulting search space is larger.
lcp@308
   579
\end{ttdescription}
lcp@104
   580
paulson@3224
   581
\subsection{The current claset}\label{sec:current-claset}
wenzelm@4561
   582
wenzelm@4561
   583
Each theory is equipped with an implicit \emph{current
wenzelm@4561
   584
  claset}\index{claset!current}.  This is a default set of classical
wenzelm@4561
   585
rules.  The underlying idea is quite similar to that of a current
wenzelm@4561
   586
simpset described in \S\ref{sec:simp-for-dummies}; please read that
wenzelm@4561
   587
section, including its warnings.  The implicit claset can be accessed
wenzelm@4561
   588
as follows:
wenzelm@4561
   589
\begin{ttbox}
wenzelm@4561
   590
claset        : unit -> claset
wenzelm@4561
   591
claset_ref    : unit -> claset ref
wenzelm@4561
   592
claset_of     : theory -> claset
wenzelm@4561
   593
claset_ref_of : theory -> claset ref
wenzelm@4561
   594
print_claset  : theory -> unit
wenzelm@4561
   595
\end{ttbox}
wenzelm@4561
   596
wenzelm@4561
   597
The tactics
berghofe@1869
   598
\begin{ttbox}
paulson@3716
   599
Blast_tac        : int -> tactic
paulson@4507
   600
Auto_tac         :        tactic
paulson@3716
   601
Fast_tac         : int -> tactic
paulson@3716
   602
Best_tac         : int -> tactic
paulson@3716
   603
Deepen_tac       : int -> int -> tactic
paulson@3716
   604
Clarify_tac      : int -> tactic
paulson@3716
   605
Clarify_step_tac : int -> tactic
paulson@3720
   606
Safe_tac         :        tactic
paulson@3720
   607
Safe_step_tac    : int -> tactic
paulson@3716
   608
Step_tac         : int -> tactic
berghofe@1869
   609
\end{ttbox}
paulson@3224
   610
\indexbold{*Blast_tac}\indexbold{*Auto_tac}
paulson@3224
   611
\indexbold{*Best_tac}\indexbold{*Fast_tac}%
paulson@3720
   612
\indexbold{*Deepen_tac}
paulson@3720
   613
\indexbold{*Clarify_tac}\indexbold{*Clarify_step_tac}
paulson@3720
   614
\indexbold{*Safe_tac}\indexbold{*Safe_step_tac}
paulson@3720
   615
\indexbold{*Step_tac}
paulson@3720
   616
make use of the current claset.  For example, \texttt{Blast_tac} is defined as 
berghofe@1869
   617
\begin{ttbox}
wenzelm@4561
   618
fun Blast_tac i st = blast_tac (claset()) i st;
berghofe@1869
   619
\end{ttbox}
wenzelm@4561
   620
and gets the current claset, only after it is applied to a proof
wenzelm@4561
   621
state.  The functions
berghofe@1869
   622
\begin{ttbox}
berghofe@1869
   623
AddSIs, AddSEs, AddSDs, AddIs, AddEs, AddDs: thm list -> unit
berghofe@1869
   624
\end{ttbox}
berghofe@1869
   625
\indexbold{*AddSIs} \indexbold{*AddSEs} \indexbold{*AddSDs}
berghofe@1869
   626
\indexbold{*AddIs} \indexbold{*AddEs} \indexbold{*AddDs}
paulson@3485
   627
are used to add rules to the current claset.  They work exactly like their
paulson@3720
   628
lower case counterparts, such as \texttt{addSIs}.  Calling
berghofe@1869
   629
\begin{ttbox}
berghofe@1869
   630
Delrules : thm list -> unit
berghofe@1869
   631
\end{ttbox}
paulson@3224
   632
deletes rules from the current claset. 
lcp@104
   633
lcp@104
   634
\subsection{Other useful tactics}
lcp@319
   635
\index{tactics!for contradiction}
lcp@319
   636
\index{tactics!for Modus Ponens}
lcp@104
   637
\begin{ttbox} 
lcp@104
   638
contr_tac    :             int -> tactic
lcp@104
   639
mp_tac       :             int -> tactic
lcp@104
   640
eq_mp_tac    :             int -> tactic
lcp@104
   641
swap_res_tac : thm list -> int -> tactic
lcp@104
   642
\end{ttbox}
lcp@104
   643
These can be used in the body of a specialized search.
lcp@308
   644
\begin{ttdescription}
lcp@319
   645
\item[\ttindexbold{contr_tac} {\it i}]\index{assumptions!contradictory}
lcp@319
   646
  solves subgoal~$i$ by detecting a contradiction among two assumptions of
lcp@319
   647
  the form $P$ and~$\neg P$, or fail.  It may instantiate unknowns.  The
lcp@319
   648
  tactic can produce multiple outcomes, enumerating all possible
lcp@319
   649
  contradictions.
lcp@104
   650
lcp@104
   651
\item[\ttindexbold{mp_tac} {\it i}] 
paulson@3720
   652
is like \texttt{contr_tac}, but also attempts to perform Modus Ponens in
lcp@104
   653
subgoal~$i$.  If there are assumptions $P\imp Q$ and~$P$, then it replaces
lcp@104
   654
$P\imp Q$ by~$Q$.  It may instantiate unknowns.  It fails if it can do
lcp@104
   655
nothing.
lcp@104
   656
lcp@104
   657
\item[\ttindexbold{eq_mp_tac} {\it i}] 
paulson@3720
   658
is like \texttt{mp_tac} {\it i}, but may not instantiate unknowns --- thus, it
lcp@104
   659
is safe.
lcp@104
   660
lcp@104
   661
\item[\ttindexbold{swap_res_tac} {\it thms} {\it i}] refines subgoal~$i$ of
lcp@104
   662
the proof state using {\it thms}, which should be a list of introduction
paulson@3720
   663
rules.  First, it attempts to prove the goal using \texttt{assume_tac} or
paulson@3720
   664
\texttt{contr_tac}.  It then attempts to apply each rule in turn, attempting
lcp@104
   665
resolution and also elim-resolution with the swapped form.
lcp@308
   666
\end{ttdescription}
lcp@104
   667
lcp@104
   668
\subsection{Creating swapped rules}
lcp@104
   669
\begin{ttbox} 
lcp@104
   670
swapify   : thm list -> thm list
lcp@104
   671
joinrules : thm list * thm list -> (bool * thm) list
lcp@104
   672
\end{ttbox}
lcp@308
   673
\begin{ttdescription}
lcp@104
   674
\item[\ttindexbold{swapify} {\it thms}] returns a list consisting of the
lcp@104
   675
swapped versions of~{\it thms}, regarded as introduction rules.
lcp@104
   676
lcp@308
   677
\item[\ttindexbold{joinrules} ({\it intrs}, {\it elims})]
lcp@104
   678
joins introduction rules, their swapped versions, and elimination rules for
paulson@3720
   679
use with \ttindex{biresolve_tac}.  Each rule is paired with~\texttt{false}
paulson@3720
   680
(indicating ordinary resolution) or~\texttt{true} (indicating
lcp@104
   681
elim-resolution).
lcp@308
   682
\end{ttdescription}
lcp@104
   683
lcp@104
   684
paulson@3716
   685
\section{Setting up the classical reasoner}\label{sec:classical-setup}
lcp@319
   686
\index{classical reasoner!setting up}
paulson@3720
   687
Isabelle's classical object-logics, including \texttt{FOL} and \texttt{HOL}, have
lcp@286
   688
the classical reasoner already set up.  When defining a new classical logic,
lcp@286
   689
you should set up the reasoner yourself.  It consists of the \ML{} functor
lcp@104
   690
\ttindex{ClassicalFun}, which takes the argument
paulson@3720
   691
signature \texttt{
paulson@3720
   692
                  CLASSICAL_DATA}:
lcp@104
   693
\begin{ttbox} 
lcp@104
   694
signature CLASSICAL_DATA =
lcp@104
   695
  sig
lcp@104
   696
  val mp             : thm
lcp@104
   697
  val not_elim       : thm
lcp@104
   698
  val swap           : thm
lcp@104
   699
  val sizef          : thm -> int
lcp@104
   700
  val hyp_subst_tacs : (int -> tactic) list
lcp@104
   701
  end;
lcp@104
   702
\end{ttbox}
lcp@104
   703
Thus, the functor requires the following items:
lcp@308
   704
\begin{ttdescription}
lcp@319
   705
\item[\tdxbold{mp}] should be the Modus Ponens rule
lcp@104
   706
$\List{\Var{P}\imp\Var{Q};\; \Var{P}} \Imp \Var{Q}$.
lcp@104
   707
lcp@319
   708
\item[\tdxbold{not_elim}] should be the contradiction rule
lcp@104
   709
$\List{\neg\Var{P};\; \Var{P}} \Imp \Var{R}$.
lcp@104
   710
lcp@319
   711
\item[\tdxbold{swap}] should be the swap rule
lcp@104
   712
$\List{\neg \Var{P}; \; \neg \Var{R}\Imp \Var{P}} \Imp \Var{R}$.
lcp@104
   713
lcp@104
   714
\item[\ttindexbold{sizef}] is the heuristic function used for best-first
lcp@104
   715
search.  It should estimate the size of the remaining subgoals.  A good
lcp@104
   716
heuristic function is \ttindex{size_of_thm}, which measures the size of the
lcp@104
   717
proof state.  Another size function might ignore certain subgoals (say,
lcp@104
   718
those concerned with type checking).  A heuristic function might simply
lcp@104
   719
count the subgoals.
lcp@104
   720
lcp@319
   721
\item[\ttindexbold{hyp_subst_tacs}] is a list of tactics for substitution in
lcp@104
   722
the hypotheses, typically created by \ttindex{HypsubstFun} (see
lcp@104
   723
Chapter~\ref{substitution}).  This list can, of course, be empty.  The
lcp@104
   724
tactics are assumed to be safe!
lcp@308
   725
\end{ttdescription}
lcp@104
   726
The functor is not at all sensitive to the formalization of the
wenzelm@3108
   727
object-logic.  It does not even examine the rules, but merely applies
wenzelm@3108
   728
them according to its fixed strategy.  The functor resides in {\tt
wenzelm@3108
   729
  Provers/classical.ML} in the Isabelle sources.
lcp@104
   730
lcp@319
   731
\index{classical reasoner|)}