1.1 --- a/doc-src/ROOT	Thu Jul 26 16:08:16 2012 +0200
     1.2 +++ b/doc-src/ROOT	Thu Jul 26 19:59:06 2012 +0200
     1.3 @@ -1,10 +1,12 @@
     1.4 -session Classes! in "Classes/Thy" = HOL +
     1.5 -  options [browser_info = false, document = false, document_dump = document, document_dump_only]
     1.6 +session Classes! (doc) in "Classes/Thy" = HOL +
     1.7 +  options [browser_info = false, document = false,
     1.8 +    document_dump = document, document_dump_mode = "tex"]
     1.9    theories [document = false] Setup
    1.10    theories Classes
    1.11  
    1.12 -session Codegen! in "Codegen/Thy" = "HOL-Library" +
    1.13 -  options [browser_info = false, document = false, document_dump = document, document_dump_only,
    1.14 +session Codegen! (doc) in "Codegen/Thy" = "HOL-Library" +
    1.15 +  options [browser_info = false, document = false,
    1.16 +    document_dump = document, document_dump_mode = "tex",
    1.17      print_mode = "no_brackets,iff"]
    1.18    theories [document = false] Setup
    1.19    theories
    1.20 @@ -16,12 +18,14 @@
    1.21      Adaptation
    1.22      Further
    1.23  
    1.24 -session Functions! in "Functions/Thy" = HOL +
    1.25 -  options [browser_info = false, document = false, document_dump = document, document_dump_only]
    1.26 +session Functions! (doc) in "Functions/Thy" = HOL +
    1.27 +  options [browser_info = false, document = false,
    1.28 +    document_dump = document, document_dump_mode = "tex"]
    1.29    theories Functions
    1.30  
    1.31 -session IsarImplementation! in "IsarImplementation/Thy" = HOL +
    1.32 -  options [browser_info = false, document = false, document_dump = document, document_dump_only]
    1.33 +session IsarImplementation! (doc) in "IsarImplementation/Thy" = HOL +
    1.34 +  options [browser_info = false, document = false,
    1.35 +    document_dump = document, document_dump_mode = "tex"]
    1.36    theories
    1.37      Eq
    1.38      Integration
    1.39 @@ -34,8 +38,9 @@
    1.40      Syntax
    1.41      Tactic
    1.42  
    1.43 -session IsarRef in "IsarRef/Thy" = HOL +
    1.44 -  options [browser_info = false, document = false, document_dump = document, document_dump_only,
    1.45 +session IsarRef (doc) in "IsarRef/Thy" = HOL +
    1.46 +  options [browser_info = false, document = false,
    1.47 +    document_dump = document, document_dump_mode = "tex",
    1.48      quick_and_dirty]
    1.49    theories
    1.50      Preface
    1.51 @@ -54,37 +59,43 @@
    1.52      Symbols
    1.53      ML_Tactic
    1.54  
    1.55 -session IsarRef in "IsarRef/Thy" = HOLCF +
    1.56 -  options [browser_info = false, document = false, document_dump = document, document_dump_only,
    1.57 +session IsarRef (doc) in "IsarRef/Thy" = HOLCF +
    1.58 +  options [browser_info = false, document = false,
    1.59 +    document_dump = document, document_dump_mode = "tex",
    1.60      quick_and_dirty]
    1.61    theories HOLCF_Specific
    1.62  
    1.63 -session IsarRef in "IsarRef/Thy" = ZF +
    1.64 -  options [browser_info = false, document = false, document_dump = document, document_dump_only,
    1.65 +session IsarRef (doc) in "IsarRef/Thy" = ZF +
    1.66 +  options [browser_info = false, document = false,
    1.67 +    document_dump = document, document_dump_mode = "tex",
    1.68      quick_and_dirty]
    1.69    theories ZF_Specific
    1.70  
    1.71 -session LaTeXsugar! in "LaTeXsugar/Sugar" = HOL +
    1.72 -  options [browser_info = false, document = false, document_dump = document, document_dump_only,
    1.73 +session LaTeXsugar! (doc) in "LaTeXsugar/Sugar" = HOL +
    1.74 +  options [browser_info = false, document = false,
    1.75 +    document_dump = document, document_dump_mode = "tex",
    1.76      threads = 1]  (* FIXME *)
    1.77    theories [document_dump = ""]
    1.78      "~~/src/HOL/Library/LaTeXsugar"
    1.79      "~~/src/HOL/Library/OptionalSugar"
    1.80    theories Sugar
    1.81  
    1.82 -session Locales! in "Locales/Locales" = HOL +
    1.83 -  options [browser_info = false, document = false, document_dump = document, document_dump_only]
    1.84 +session Locales! (doc) in "Locales/Locales" = HOL +
    1.85 +  options [browser_info = false, document = false,
    1.86 +    document_dump = document, document_dump_mode = "tex"]
    1.87    theories
    1.88      Examples1
    1.89      Examples2
    1.90      Examples3
    1.91  
    1.92 -session Main! in "Main/Docs" = HOL +
    1.93 -  options [browser_info = false, document = false, document_dump = document, document_dump_only]
    1.94 +session Main! (doc) in "Main/Docs" = HOL +
    1.95 +  options [browser_info = false, document = false,
    1.96 +    document_dump = document, document_dump_mode = "tex"]
    1.97    theories Main_Doc
    1.98  
    1.99 -session ProgProve! in "ProgProve/Thys" = HOL +
   1.100 -  options [browser_info = false, document = false, document_dump = document, document_dump_only,
   1.101 +session ProgProve! (doc) in "ProgProve/Thys" = HOL +
   1.102 +  options [browser_info = false, document = false,
   1.103 +    document_dump = document, document_dump_mode = "tex",
   1.104      show_question_marks = false]
   1.105    theories
   1.106      Basics
   1.107 @@ -94,8 +105,9 @@
   1.108      Logic
   1.109      Isar
   1.110  
   1.111 -session System! in "System/Thy" = Pure +
   1.112 -  options [browser_info = false, document = false, document_dump = document, document_dump_only]
   1.113 +session System! (doc) in "System/Thy" = Pure +
   1.114 +  options [browser_info = false, document = false,
   1.115 +    document_dump = document, document_dump_mode = "tex"]
   1.116    theories
   1.117      Basics
   1.118      Interfaces
   1.119 @@ -103,10 +115,69 @@
   1.120      Presentation
   1.121      Misc
   1.122  
   1.123 -(* session Tutorial in "Tutorial" = HOL + FIXME *)
   1.124 +session Tutorial (doc) in "TutorialI" = HOL +
   1.125 +  options [browser_info = false, document = false,
   1.126 +    document_dump = document, document_dump_mode = "tex",
   1.127 +    print_mode = "brackets", threads = 1 (* FIXME *)]
   1.128 +  theories [thy_output_indent = 5]
   1.129 +    "ToyList/ToyList"
   1.130 +    "Ifexpr/Ifexpr"
   1.131 +    "CodeGen/CodeGen"
   1.132 +    "Trie/Trie"
   1.133 +    "Datatype/ABexpr"
   1.134 +    "Datatype/unfoldnested"
   1.135 +    "Datatype/Nested"
   1.136 +    "Datatype/Fundata"
   1.137 +    "Fun/fun0"
   1.138 +    "Advanced/simp2"
   1.139 +    "CTL/PDL"
   1.140 +    "CTL/CTL"
   1.141 +    "CTL/CTLind"
   1.142 +    "Inductive/Even"
   1.143 +    "Inductive/Mutual"
   1.144 +    "Inductive/Star"
   1.145 +    "Inductive/AB"
   1.146 +    "Inductive/Advanced"
   1.147 +    "Misc/Tree"
   1.148 +    "Misc/Tree2"
   1.149 +    "Misc/Plus"
   1.150 +    "Misc/case_exprs"
   1.151 +    "Misc/fakenat"
   1.152 +    "Misc/natsum"
   1.153 +    "Misc/pairs2"
   1.154 +    "Misc/Option2"
   1.155 +    "Misc/types"
   1.156 +    "Misc/prime_def"
   1.157 +    "Misc/simp"
   1.158 +    "Misc/Itrev"
   1.159 +    "Misc/AdvancedInd"
   1.160 +    "Misc/appendix"
   1.161 +  theories
   1.162 +    "Protocol/NS_Public"
   1.163 +    "Documents/Documents"
   1.164 +  theories [document_dump = ""]
   1.165 +    "Types/Setup"
   1.166 +  theories
   1.167 +    "Types/Numbers"
   1.168 +    "Types/Pairs"
   1.169 +    "Types/Records"
   1.170 +    "Types/Typedefs"
   1.171 +    "Types/Overloading"
   1.172 +    "Types/Axioms"
   1.173 +    "Rules/Basic"
   1.174 +    "Rules/Blast"
   1.175 +    "Rules/Force"
   1.176 +    "Rules/Forward"
   1.177 +    "Rules/Tacticals"
   1.178 +    "Rules/find2"
   1.179 +    "Sets/Examples"
   1.180 +    "Sets/Functions"
   1.181 +    "Sets/Relations"
   1.182 +    "Sets/Recur"
   1.183  
   1.184 -session examples in "ZF" = ZF +
   1.185 -  options [browser_info = false, document = false, document_dump = document, document_dump_only,
   1.186 +session examples (doc) in "ZF" = ZF +
   1.187 +  options [browser_info = false, document = false,
   1.188 +    document_dump = document, document_dump_mode = "tex",
   1.189      print_mode = "brackets"]
   1.190    theories
   1.191      IFOL_examples

     2.1 --- a/doc-src/TutorialI/Advanced/ROOT.ML	Thu Jul 26 16:08:16 2012 +0200
     2.2 +++ /dev/null	Thu Jan 01 00:00:00 1970 +0000
     2.3 @@ -1,2 +0,0 @@
     2.4 -use "../settings.ML";
     2.5 -use_thy "simp2";

     3.1 --- a/doc-src/TutorialI/Advanced/advanced.tex	Thu Jul 26 16:08:16 2012 +0200
     3.2 +++ b/doc-src/TutorialI/Advanced/advanced.tex	Thu Jul 26 19:59:06 2012 +0200
     3.3 @@ -5,13 +5,13 @@
     3.4  yet and which are worth learning. The sections of this chapter are
     3.5  independent of each other and can be read in any order.
     3.6  
     3.7 -\input{Advanced/document/simp2.tex}
     3.8 +\input{document/simp2.tex}
     3.9  
    3.10  \section{Advanced Induction Techniques}
    3.11  \label{sec:advanced-ind}
    3.12  \index{induction|(}
    3.13 -\input{Misc/document/AdvancedInd.tex}
    3.14 -\input{CTL/document/CTLind.tex}
    3.15 +\input{document/AdvancedInd.tex}
    3.16 +\input{document/CTLind.tex}
    3.17  \index{induction|)}
    3.18  
    3.19  %\section{Advanced Forms of Recursion}
    3.20 @@ -34,16 +34,16 @@
    3.21  
    3.22  %\subsection{Beyond Measure}
    3.23  %\label{sec:beyond-measure}
    3.24 -%\input{Advanced/document/WFrec.tex}
    3.25 +%\input{document/WFrec.tex}
    3.26  %
    3.27  %\subsection{Recursion Over Nested Datatypes}
    3.28  %\label{sec:nested-recdef}
    3.29 -%\input{Recdef/document/Nested0.tex}
    3.30 -%\input{Recdef/document/Nested1.tex}
    3.31 -%\input{Recdef/document/Nested2.tex}
    3.32 +%\input{document/Nested0.tex}
    3.33 +%\input{document/Nested1.tex}
    3.34 +%\input{document/Nested2.tex}
    3.35  %
    3.36  %\subsection{Partial Functions}
    3.37  %\index{functions!partial}
    3.38 -%\input{Advanced/document/Partial.tex}
    3.39 +%\input{document/Partial.tex}
    3.40  %
    3.41  %\index{recdef@\isacommand {recdef} (command)|)}

     4.1 --- a/doc-src/TutorialI/Advanced/document/Partial.tex	Thu Jul 26 16:08:16 2012 +0200
     4.2 +++ /dev/null	Thu Jan 01 00:00:00 1970 +0000
     4.3 @@ -1,352 +0,0 @@
     4.4 -%
     4.5 -\begin{isabellebody}%
     4.6 -\def\isabellecontext{Partial}%
     4.7 -%
     4.8 -\isadelimtheory
     4.9 -%
    4.10 -\endisadelimtheory
    4.11 -%
    4.12 -\isatagtheory
    4.13 -%
    4.14 -\endisatagtheory
    4.15 -{\isafoldtheory}%
    4.16 -%
    4.17 -\isadelimtheory
    4.18 -%
    4.19 -\endisadelimtheory
    4.20 -%
    4.21 -\begin{isamarkuptext}%
    4.22 -\noindent Throughout this tutorial, we have emphasized
    4.23 -that all functions in HOL are total.  We cannot hope to define
    4.24 -truly partial functions, but must make them total.  A straightforward
    4.25 -method is to lift the result type of the function from $\tau$ to
    4.26 -$\tau$~\isa{option} (see \ref{sec:option}), where \isa{None} is
    4.27 -returned if the function is applied to an argument not in its
    4.28 -domain. Function \isa{assoc} in \S\ref{sec:Trie} is a simple example.
    4.29 -We do not pursue this schema further because it should be clear
    4.30 -how it works. Its main drawback is that the result of such a lifted
    4.31 -function has to be unpacked first before it can be processed
    4.32 -further. Its main advantage is that you can distinguish if the
    4.33 -function was applied to an argument in its domain or not. If you do
    4.34 -not need to make this distinction, for example because the function is
    4.35 -never used outside its domain, it is easier to work with
    4.36 -\emph{underdefined}\index{functions!underdefined} functions: for
    4.37 -certain arguments we only know that a result exists, but we do not
    4.38 -know what it is. When defining functions that are normally considered
    4.39 -partial, underdefinedness turns out to be a very reasonable
    4.40 -alternative.
    4.41 -
    4.42 -We have already seen an instance of underdefinedness by means of
    4.43 -non-exhaustive pattern matching: the definition of \isa{last} in
    4.44 -\S\ref{sec:fun}. The same is allowed for \isacommand{primrec}%
    4.45 -\end{isamarkuptext}%
    4.46 -\isamarkuptrue%
    4.47 -\isacommand{consts}\isamarkupfalse%
    4.48 -\ hd\ {\isacharcolon}{\isacharcolon}\ {\isachardoublequoteopen}{\isacharprime}a\ list\ {\isasymRightarrow}\ {\isacharprime}a{\isachardoublequoteclose}\isanewline
    4.49 -\isacommand{primrec}\isamarkupfalse%
    4.50 -\ {\isachardoublequoteopen}hd\ {\isacharparenleft}x{\isacharhash}xs{\isacharparenright}\ {\isacharequal}\ x{\isachardoublequoteclose}%
    4.51 -\begin{isamarkuptext}%
    4.52 -\noindent
    4.53 -although it generates a warning.
    4.54 -Even ordinary definitions allow underdefinedness, this time by means of
    4.55 -preconditions:%
    4.56 -\end{isamarkuptext}%
    4.57 -\isamarkuptrue%
    4.58 -\isacommand{constdefs}\isamarkupfalse%
    4.59 -\ subtract\ {\isacharcolon}{\isacharcolon}\ {\isachardoublequoteopen}nat\ {\isasymRightarrow}\ nat\ {\isasymRightarrow}\ nat{\isachardoublequoteclose}\isanewline
    4.60 -{\isachardoublequoteopen}n\ {\isasymle}\ m\ {\isasymLongrightarrow}\ subtract\ m\ n\ {\isasymequiv}\ m\ {\isacharminus}\ n{\isachardoublequoteclose}%
    4.61 -\begin{isamarkuptext}%
    4.62 -The rest of this section is devoted to the question of how to define
    4.63 -partial recursive functions by other means than non-exhaustive pattern
    4.64 -matching.%
    4.65 -\end{isamarkuptext}%
    4.66 -\isamarkuptrue%
    4.67 -%
    4.68 -\isamarkupsubsubsection{Guarded Recursion%
    4.69 -}
    4.70 -\isamarkuptrue%
    4.71 -%
    4.72 -\begin{isamarkuptext}%
    4.73 -\index{recursion!guarded}%
    4.74 -Neither \isacommand{primrec} nor \isacommand{recdef} allow to
    4.75 -prefix an equation with a condition in the way ordinary definitions do
    4.76 -(see \isa{subtract} above). Instead we have to move the condition over
    4.77 -to the right-hand side of the equation. Given a partial function $f$
    4.78 -that should satisfy the recursion equation $f(x) = t$ over its domain
    4.79 -$dom(f)$, we turn this into the \isacommand{recdef}
    4.80 -\begin{isabelle}%
    4.81 -\ \ \ \ \ f\ x\ {\isacharequal}\ {\isacharparenleft}if\ x\ {\isasymin}\ dom\ f\ then\ t\ else\ arbitrary{\isacharparenright}%
    4.82 -\end{isabelle}
    4.83 -where \isa{arbitrary} is a predeclared constant of type \isa{{\isacharprime}a}
    4.84 -which has no definition. Thus we know nothing about its value,
    4.85 -which is ideal for specifying underdefined functions on top of it.
    4.86 -
    4.87 -As a simple example we define division on \isa{nat}:%
    4.88 -\end{isamarkuptext}%
    4.89 -\isamarkuptrue%
    4.90 -\isacommand{consts}\isamarkupfalse%
    4.91 -\ divi\ {\isacharcolon}{\isacharcolon}\ {\isachardoublequoteopen}nat\ {\isasymtimes}\ nat\ {\isasymRightarrow}\ nat{\isachardoublequoteclose}\isanewline
    4.92 -\isacommand{recdef}\isamarkupfalse%
    4.93 -\ divi\ {\isachardoublequoteopen}measure{\isacharparenleft}{\isasymlambda}{\isacharparenleft}m{\isacharcomma}n{\isacharparenright}{\isachardot}\ m{\isacharparenright}{\isachardoublequoteclose}\isanewline
    4.94 -\ \ {\isachardoublequoteopen}divi{\isacharparenleft}m{\isacharcomma}{\isadigit{0}}{\isacharparenright}\ {\isacharequal}\ arbitrary{\isachardoublequoteclose}\isanewline
    4.95 -\ \ {\isachardoublequoteopen}divi{\isacharparenleft}m{\isacharcomma}n{\isacharparenright}\ {\isacharequal}\ {\isacharparenleft}if\ m\ {\isacharless}\ n\ then\ {\isadigit{0}}\ else\ divi{\isacharparenleft}m{\isacharminus}n{\isacharcomma}n{\isacharparenright}{\isacharplus}{\isadigit{1}}{\isacharparenright}{\isachardoublequoteclose}%
    4.96 -\begin{isamarkuptext}%
    4.97 -\noindent Of course we could also have defined
    4.98 -\isa{divi\ {\isacharparenleft}m{\isacharcomma}\ {\isadigit{0}}{\isacharparenright}} to be some specific number, for example 0. The
    4.99 -latter option is chosen for the predefined \isa{div} function, which
   4.100 -simplifies proofs at the expense of deviating from the
   4.101 -standard mathematical division function.
   4.102 -
   4.103 -As a more substantial example we consider the problem of searching a graph.
   4.104 -For simplicity our graph is given by a function \isa{f} of
   4.105 -type \isa{{\isacharprime}a\ {\isasymRightarrow}\ {\isacharprime}a} which
   4.106 -maps each node to its successor; the graph has out-degree 1.
   4.107 -The task is to find the end of a chain, modelled by a node pointing to
   4.108 -itself. Here is a first attempt:
   4.109 -\begin{isabelle}%
   4.110 -\ \ \ \ \ find\ {\isacharparenleft}f{\isacharcomma}\ x{\isacharparenright}\ {\isacharequal}\ {\isacharparenleft}if\ f\ x\ {\isacharequal}\ x\ then\ x\ else\ find\ {\isacharparenleft}f{\isacharcomma}\ f\ x{\isacharparenright}{\isacharparenright}%
   4.111 -\end{isabelle}
   4.112 -This may be viewed as a fixed point finder or as the second half of the well
   4.113 -known \emph{Union-Find} algorithm.
   4.114 -The snag is that it may not terminate if \isa{f} has non-trivial cycles.
   4.115 -Phrased differently, the relation%
   4.116 -\end{isamarkuptext}%
   4.117 -\isamarkuptrue%
   4.118 -\isacommand{constdefs}\isamarkupfalse%
   4.119 -\ step{\isadigit{1}}\ {\isacharcolon}{\isacharcolon}\ {\isachardoublequoteopen}{\isacharparenleft}{\isacharprime}a\ {\isasymRightarrow}\ {\isacharprime}a{\isacharparenright}\ {\isasymRightarrow}\ {\isacharparenleft}{\isacharprime}a\ {\isasymtimes}\ {\isacharprime}a{\isacharparenright}set{\isachardoublequoteclose}\isanewline
   4.120 -\ \ {\isachardoublequoteopen}step{\isadigit{1}}\ f\ {\isasymequiv}\ {\isacharbraceleft}{\isacharparenleft}y{\isacharcomma}x{\isacharparenright}{\isachardot}\ y\ {\isacharequal}\ f\ x\ {\isasymand}\ y\ {\isasymnoteq}\ x{\isacharbraceright}{\isachardoublequoteclose}%
   4.121 -\begin{isamarkuptext}%
   4.122 -\noindent
   4.123 -must be well-founded. Thus we make the following definition:%
   4.124 -\end{isamarkuptext}%
   4.125 -\isamarkuptrue%
   4.126 -\isacommand{consts}\isamarkupfalse%
   4.127 -\ find\ {\isacharcolon}{\isacharcolon}\ {\isachardoublequoteopen}{\isacharparenleft}{\isacharprime}a\ {\isasymRightarrow}\ {\isacharprime}a{\isacharparenright}\ {\isasymtimes}\ {\isacharprime}a\ {\isasymRightarrow}\ {\isacharprime}a{\isachardoublequoteclose}\isanewline
   4.128 -\isacommand{recdef}\isamarkupfalse%
   4.129 -\ find\ {\isachardoublequoteopen}same{\isacharunderscore}fst\ {\isacharparenleft}{\isasymlambda}f{\isachardot}\ wf{\isacharparenleft}step{\isadigit{1}}\ f{\isacharparenright}{\isacharparenright}\ step{\isadigit{1}}{\isachardoublequoteclose}\isanewline
   4.130 -\ \ {\isachardoublequoteopen}find{\isacharparenleft}f{\isacharcomma}x{\isacharparenright}\ {\isacharequal}\ {\isacharparenleft}if\ wf{\isacharparenleft}step{\isadigit{1}}\ f{\isacharparenright}\isanewline
   4.131 -\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ then\ if\ f\ x\ {\isacharequal}\ x\ then\ x\ else\ find{\isacharparenleft}f{\isacharcomma}\ f\ x{\isacharparenright}\isanewline
   4.132 -\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ else\ arbitrary{\isacharparenright}{\isachardoublequoteclose}\isanewline
   4.133 -{\isacharparenleft}\isakeyword{hints}\ recdef{\isacharunderscore}simp{\isacharcolon}\ step{\isadigit{1}}{\isacharunderscore}def{\isacharparenright}%
   4.134 -\begin{isamarkuptext}%
   4.135 -\noindent
   4.136 -The recursion equation itself should be clear enough: it is our aborted
   4.137 -first attempt augmented with a check that there are no non-trivial loops.
   4.138 -To express the required well-founded relation we employ the
   4.139 -predefined combinator \isa{same{\isacharunderscore}fst} of type
   4.140 -\begin{isabelle}%
   4.141 -\ \ \ \ \ {\isacharparenleft}{\isacharprime}a\ {\isasymRightarrow}\ bool{\isacharparenright}\ {\isasymRightarrow}\ {\isacharparenleft}{\isacharprime}a\ {\isasymRightarrow}\ {\isacharparenleft}{\isacharprime}b{\isasymtimes}{\isacharprime}b{\isacharparenright}set{\isacharparenright}\ {\isasymRightarrow}\ {\isacharparenleft}{\isacharparenleft}{\isacharprime}a{\isasymtimes}{\isacharprime}b{\isacharparenright}\ {\isasymtimes}\ {\isacharparenleft}{\isacharprime}a{\isasymtimes}{\isacharprime}b{\isacharparenright}{\isacharparenright}set%
   4.142 -\end{isabelle}
   4.143 -defined as
   4.144 -\begin{isabelle}%
   4.145 -\ \ \ \ \ same{\isacharunderscore}fst\ P\ R\ {\isasymequiv}\ {\isacharbraceleft}{\isacharparenleft}{\isacharparenleft}x{\isacharprime}{\isacharcomma}\ y{\isacharprime}{\isacharparenright}{\isacharcomma}\ x{\isacharcomma}\ y{\isacharparenright}{\isachardot}\ x{\isacharprime}\ {\isacharequal}\ x\ {\isasymand}\ P\ x\ {\isasymand}\ {\isacharparenleft}y{\isacharprime}{\isacharcomma}\ y{\isacharparenright}\ {\isasymin}\ R\ x{\isacharbraceright}%
   4.146 -\end{isabelle}
   4.147 -This combinator is designed for
   4.148 -recursive functions on pairs where the first component of the argument is
   4.149 -passed unchanged to all recursive calls. Given a constraint on the first
   4.150 -component and a relation on the second component, \isa{same{\isacharunderscore}fst} builds the
   4.151 -required relation on pairs.  The theorem
   4.152 -\begin{isabelle}%
   4.153 -\ \ \ \ \ {\isacharparenleft}{\isasymAnd}x{\isachardot}\ P\ x\ {\isasymLongrightarrow}\ wf\ {\isacharparenleft}R\ x{\isacharparenright}{\isacharparenright}\ {\isasymLongrightarrow}\ wf\ {\isacharparenleft}same{\isacharunderscore}fst\ P\ R{\isacharparenright}%
   4.154 -\end{isabelle}
   4.155 -is known to the well-foundedness prover of \isacommand{recdef}.  Thus
   4.156 -well-foundedness of the relation given to \isacommand{recdef} is immediate.
   4.157 -Furthermore, each recursive call descends along that relation: the first
   4.158 -argument stays unchanged and the second one descends along \isa{step{\isadigit{1}}\ f}. The proof requires unfolding the definition of \isa{step{\isadigit{1}}},
   4.159 -as specified in the \isacommand{hints} above.
   4.160 -
   4.161 -Normally you will then derive the following conditional variant from
   4.162 -the recursion equation:%
   4.163 -\end{isamarkuptext}%
   4.164 -\isamarkuptrue%
   4.165 -\isacommand{lemma}\isamarkupfalse%
   4.166 -\ {\isacharbrackleft}simp{\isacharbrackright}{\isacharcolon}\isanewline
   4.167 -\ \ {\isachardoublequoteopen}wf{\isacharparenleft}step{\isadigit{1}}\ f{\isacharparenright}\ {\isasymLongrightarrow}\ find{\isacharparenleft}f{\isacharcomma}x{\isacharparenright}\ {\isacharequal}\ {\isacharparenleft}if\ f\ x\ {\isacharequal}\ x\ then\ x\ else\ find{\isacharparenleft}f{\isacharcomma}\ f\ x{\isacharparenright}{\isacharparenright}{\isachardoublequoteclose}\isanewline
   4.168 -%
   4.169 -\isadelimproof
   4.170 -%
   4.171 -\endisadelimproof
   4.172 -%
   4.173 -\isatagproof
   4.174 -\isacommand{by}\isamarkupfalse%
   4.175 -\ simp%
   4.176 -\endisatagproof
   4.177 -{\isafoldproof}%
   4.178 -%
   4.179 -\isadelimproof
   4.180 -%
   4.181 -\endisadelimproof
   4.182 -%
   4.183 -\begin{isamarkuptext}%
   4.184 -\noindent Then you should disable the original recursion equation:%
   4.185 -\end{isamarkuptext}%
   4.186 -\isamarkuptrue%
   4.187 -\isacommand{declare}\isamarkupfalse%
   4.188 -\ find{\isachardot}simps{\isacharbrackleft}simp\ del{\isacharbrackright}%
   4.189 -\begin{isamarkuptext}%
   4.190 -Reasoning about such underdefined functions is like that for other
   4.191 -recursive functions.  Here is a simple example of recursion induction:%
   4.192 -\end{isamarkuptext}%
   4.193 -\isamarkuptrue%
   4.194 -\isacommand{lemma}\isamarkupfalse%
   4.195 -\ {\isachardoublequoteopen}wf{\isacharparenleft}step{\isadigit{1}}\ f{\isacharparenright}\ {\isasymlongrightarrow}\ f{\isacharparenleft}find{\isacharparenleft}f{\isacharcomma}x{\isacharparenright}{\isacharparenright}\ {\isacharequal}\ find{\isacharparenleft}f{\isacharcomma}x{\isacharparenright}{\isachardoublequoteclose}\isanewline
   4.196 -%
   4.197 -\isadelimproof
   4.198 -%
   4.199 -\endisadelimproof
   4.200 -%
   4.201 -\isatagproof
   4.202 -\isacommand{apply}\isamarkupfalse%
   4.203 -{\isacharparenleft}induct{\isacharunderscore}tac\ f\ x\ rule{\isacharcolon}\ find{\isachardot}induct{\isacharparenright}\isanewline
   4.204 -\isacommand{apply}\isamarkupfalse%
   4.205 -\ simp\isanewline
   4.206 -\isacommand{done}\isamarkupfalse%
   4.207 -%
   4.208 -\endisatagproof
   4.209 -{\isafoldproof}%
   4.210 -%
   4.211 -\isadelimproof
   4.212 -%
   4.213 -\endisadelimproof
   4.214 -%
   4.215 -\isamarkupsubsubsection{The {\tt\slshape while} Combinator%
   4.216 -}
   4.217 -\isamarkuptrue%
   4.218 -%
   4.219 -\begin{isamarkuptext}%
   4.220 -If the recursive function happens to be tail recursive, its
   4.221 -definition becomes a triviality if based on the predefined \cdx{while}
   4.222 -combinator.  The latter lives in the Library theory \thydx{While_Combinator}.
   4.223 -% which is not part of {text Main} but needs to
   4.224 -% be included explicitly among the ancestor theories.
   4.225 -
   4.226 -Constant \isa{while} is of type \isa{{\isacharparenleft}{\isacharprime}a\ {\isasymRightarrow}\ bool{\isacharparenright}\ {\isasymRightarrow}\ {\isacharparenleft}{\isacharprime}a\ {\isasymRightarrow}\ {\isacharprime}a{\isacharparenright}\ {\isasymRightarrow}\ {\isacharprime}a}
   4.227 -and satisfies the recursion equation \begin{isabelle}%
   4.228 -\ \ \ \ \ while\ b\ c\ s\ {\isacharequal}\ {\isacharparenleft}if\ b\ s\ then\ while\ b\ c\ {\isacharparenleft}c\ s{\isacharparenright}\ else\ s{\isacharparenright}%
   4.229 -\end{isabelle}
   4.230 -That is, \isa{while\ b\ c\ s} is equivalent to the imperative program
   4.231 -\begin{verbatim}
   4.232 -     x := s; while b(x) do x := c(x); return x
   4.233 -\end{verbatim}
   4.234 -In general, \isa{s} will be a tuple or record.  As an example
   4.235 -consider the following definition of function \isa{find}:%
   4.236 -\end{isamarkuptext}%
   4.237 -\isamarkuptrue%
   4.238 -\isacommand{constdefs}\isamarkupfalse%
   4.239 -\ find{\isadigit{2}}\ {\isacharcolon}{\isacharcolon}\ {\isachardoublequoteopen}{\isacharparenleft}{\isacharprime}a\ {\isasymRightarrow}\ {\isacharprime}a{\isacharparenright}\ {\isasymRightarrow}\ {\isacharprime}a\ {\isasymRightarrow}\ {\isacharprime}a{\isachardoublequoteclose}\isanewline
   4.240 -\ \ {\isachardoublequoteopen}find{\isadigit{2}}\ f\ x\ {\isasymequiv}\isanewline
   4.241 -\ \ \ fst{\isacharparenleft}while\ {\isacharparenleft}{\isasymlambda}{\isacharparenleft}x{\isacharcomma}x{\isacharprime}{\isacharparenright}{\isachardot}\ x{\isacharprime}\ {\isasymnoteq}\ x{\isacharparenright}\ {\isacharparenleft}{\isasymlambda}{\isacharparenleft}x{\isacharcomma}x{\isacharprime}{\isacharparenright}{\isachardot}\ {\isacharparenleft}x{\isacharprime}{\isacharcomma}f\ x{\isacharprime}{\isacharparenright}{\isacharparenright}\ {\isacharparenleft}x{\isacharcomma}f\ x{\isacharparenright}{\isacharparenright}{\isachardoublequoteclose}%
   4.242 -\begin{isamarkuptext}%
   4.243 -\noindent
   4.244 -The loop operates on two ``local variables'' \isa{x} and \isa{x{\isacharprime}}
   4.245 -containing the ``current'' and the ``next'' value of function \isa{f}.
   4.246 -They are initialized with the global \isa{x} and \isa{f\ x}. At the
   4.247 -end \isa{fst} selects the local \isa{x}.
   4.248 -
   4.249 -Although the definition of tail recursive functions via \isa{while} avoids
   4.250 -termination proofs, there is no free lunch. When proving properties of
   4.251 -functions defined by \isa{while}, termination rears its ugly head
   4.252 -again. Here is \tdx{while_rule}, the well known proof rule for total
   4.253 -correctness of loops expressed with \isa{while}:
   4.254 -\begin{isabelle}%
   4.255 -\ \ \ \ \ {\isasymlbrakk}P\ s{\isacharsemicolon}\ {\isasymAnd}s{\isachardot}\ {\isasymlbrakk}P\ s{\isacharsemicolon}\ b\ s{\isasymrbrakk}\ {\isasymLongrightarrow}\ P\ {\isacharparenleft}c\ s{\isacharparenright}{\isacharsemicolon}\isanewline
   4.256 -\isaindent{\ \ \ \ \ \ }{\isasymAnd}s{\isachardot}\ {\isasymlbrakk}P\ s{\isacharsemicolon}\ {\isasymnot}\ b\ s{\isasymrbrakk}\ {\isasymLongrightarrow}\ Q\ s{\isacharsemicolon}\ wf\ r{\isacharsemicolon}\isanewline
   4.257 -\isaindent{\ \ \ \ \ \ }{\isasymAnd}s{\isachardot}\ {\isasymlbrakk}P\ s{\isacharsemicolon}\ b\ s{\isasymrbrakk}\ {\isasymLongrightarrow}\ {\isacharparenleft}c\ s{\isacharcomma}\ s{\isacharparenright}\ {\isasymin}\ r{\isasymrbrakk}\isanewline
   4.258 -\isaindent{\ \ \ \ \ }{\isasymLongrightarrow}\ Q\ {\isacharparenleft}while\ b\ c\ s{\isacharparenright}%
   4.259 -\end{isabelle} \isa{P} needs to be true of
   4.260 -the initial state \isa{s} and invariant under \isa{c} (premises 1
   4.261 -and~2). The post-condition \isa{Q} must become true when leaving the loop
   4.262 -(premise~3). And each loop iteration must descend along a well-founded
   4.263 -relation \isa{r} (premises 4 and~5).
   4.264 -
   4.265 -Let us now prove that \isa{find{\isadigit{2}}} does indeed find a fixed point. Instead
   4.266 -of induction we apply the above while rule, suitably instantiated.
   4.267 -Only the final premise of \isa{while{\isacharunderscore}rule} is left unproved
   4.268 -by \isa{auto} but falls to \isa{simp}:%
   4.269 -\end{isamarkuptext}%
   4.270 -\isamarkuptrue%
   4.271 -\isacommand{lemma}\isamarkupfalse%
   4.272 -\ lem{\isacharcolon}\ {\isachardoublequoteopen}wf{\isacharparenleft}step{\isadigit{1}}\ f{\isacharparenright}\ {\isasymLongrightarrow}\isanewline
   4.273 -\ \ {\isasymexists}y{\isachardot}\ while\ {\isacharparenleft}{\isasymlambda}{\isacharparenleft}x{\isacharcomma}x{\isacharprime}{\isacharparenright}{\isachardot}\ x{\isacharprime}\ {\isasymnoteq}\ x{\isacharparenright}\ {\isacharparenleft}{\isasymlambda}{\isacharparenleft}x{\isacharcomma}x{\isacharprime}{\isacharparenright}{\isachardot}\ {\isacharparenleft}x{\isacharprime}{\isacharcomma}f\ x{\isacharprime}{\isacharparenright}{\isacharparenright}\ {\isacharparenleft}x{\isacharcomma}f\ x{\isacharparenright}\ {\isacharequal}\ {\isacharparenleft}y{\isacharcomma}y{\isacharparenright}\ {\isasymand}\isanewline
   4.274 -\ \ \ \ \ \ \ f\ y\ {\isacharequal}\ y{\isachardoublequoteclose}\isanewline
   4.275 -%
   4.276 -\isadelimproof
   4.277 -%
   4.278 -\endisadelimproof
   4.279 -%
   4.280 -\isatagproof
   4.281 -\isacommand{apply}\isamarkupfalse%
   4.282 -{\isacharparenleft}rule{\isacharunderscore}tac\ P\ {\isacharequal}\ {\isachardoublequoteopen}{\isasymlambda}{\isacharparenleft}x{\isacharcomma}x{\isacharprime}{\isacharparenright}{\isachardot}\ x{\isacharprime}\ {\isacharequal}\ f\ x{\isachardoublequoteclose}\ \isakeyword{and}\isanewline
   4.283 -\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ r\ {\isacharequal}\ {\isachardoublequoteopen}inv{\isacharunderscore}image\ {\isacharparenleft}step{\isadigit{1}}\ f{\isacharparenright}\ fst{\isachardoublequoteclose}\ \isakeyword{in}\ while{\isacharunderscore}rule{\isacharparenright}\isanewline
   4.284 -\isacommand{apply}\isamarkupfalse%
   4.285 -\ auto\isanewline
   4.286 -\isacommand{apply}\isamarkupfalse%
   4.287 -{\isacharparenleft}simp\ add{\isacharcolon}\ inv{\isacharunderscore}image{\isacharunderscore}def\ step{\isadigit{1}}{\isacharunderscore}def{\isacharparenright}\isanewline
   4.288 -\isacommand{done}\isamarkupfalse%
   4.289 -%
   4.290 -\endisatagproof
   4.291 -{\isafoldproof}%
   4.292 -%
   4.293 -\isadelimproof
   4.294 -%
   4.295 -\endisadelimproof
   4.296 -%
   4.297 -\begin{isamarkuptext}%
   4.298 -The theorem itself is a simple consequence of this lemma:%
   4.299 -\end{isamarkuptext}%
   4.300 -\isamarkuptrue%
   4.301 -\isacommand{theorem}\isamarkupfalse%
   4.302 -\ {\isachardoublequoteopen}wf{\isacharparenleft}step{\isadigit{1}}\ f{\isacharparenright}\ {\isasymLongrightarrow}\ f{\isacharparenleft}find{\isadigit{2}}\ f\ x{\isacharparenright}\ {\isacharequal}\ find{\isadigit{2}}\ f\ x{\isachardoublequoteclose}\isanewline
   4.303 -%
   4.304 -\isadelimproof
   4.305 -%
   4.306 -\endisadelimproof
   4.307 -%
   4.308 -\isatagproof
   4.309 -\isacommand{apply}\isamarkupfalse%
   4.310 -{\isacharparenleft}drule{\isacharunderscore}tac\ x\ {\isacharequal}\ x\ \isakeyword{in}\ lem{\isacharparenright}\isanewline
   4.311 -\isacommand{apply}\isamarkupfalse%
   4.312 -{\isacharparenleft}auto\ simp\ add{\isacharcolon}\ find{\isadigit{2}}{\isacharunderscore}def{\isacharparenright}\isanewline
   4.313 -\isacommand{done}\isamarkupfalse%
   4.314 -%
   4.315 -\endisatagproof
   4.316 -{\isafoldproof}%
   4.317 -%
   4.318 -\isadelimproof
   4.319 -%
   4.320 -\endisadelimproof
   4.321 -%
   4.322 -\begin{isamarkuptext}%
   4.323 -Let us conclude this section on partial functions by a
   4.324 -discussion of the merits of the \isa{while} combinator. We have
   4.325 -already seen that the advantage of not having to
   4.326 -provide a termination argument when defining a function via \isa{while} merely puts off the evil hour. On top of that, tail recursive
   4.327 -functions tend to be more complicated to reason about. So why use
   4.328 -\isa{while} at all? The only reason is executability: the recursion
   4.329 -equation for \isa{while} is a directly executable functional
   4.330 -program. This is in stark contrast to guarded recursion as introduced
   4.331 -above which requires an explicit test \isa{x\ {\isasymin}\ dom\ f} in the
   4.332 -function body.  Unless \isa{dom} is trivial, this leads to a
   4.333 -definition that is impossible to execute or prohibitively slow.
   4.334 -Thus, if you are aiming for an efficiently executable definition
   4.335 -of a partial function, you are likely to need \isa{while}.%
   4.336 -\end{isamarkuptext}%
   4.337 -\isamarkuptrue%
   4.338 -%
   4.339 -\isadelimtheory
   4.340 -%
   4.341 -\endisadelimtheory
   4.342 -%
   4.343 -\isatagtheory
   4.344 -%
   4.345 -\endisatagtheory
   4.346 -{\isafoldtheory}%
   4.347 -%
   4.348 -\isadelimtheory
   4.349 -%
   4.350 -\endisadelimtheory
   4.351 -\end{isabellebody}%
   4.352 -%%% Local Variables:
   4.353 -%%% mode: latex
   4.354 -%%% TeX-master: "root"
   4.355 -%%% End:

     5.1 --- a/doc-src/TutorialI/Advanced/document/WFrec.tex	Thu Jul 26 16:08:16 2012 +0200
     5.2 +++ /dev/null	Thu Jan 01 00:00:00 1970 +0000
     5.3 @@ -1,169 +0,0 @@
     5.4 -%
     5.5 -\begin{isabellebody}%
     5.6 -\def\isabellecontext{WFrec}%
     5.7 -%
     5.8 -\isadelimtheory
     5.9 -%
    5.10 -\endisadelimtheory
    5.11 -%
    5.12 -\isatagtheory
    5.13 -%
    5.14 -\endisatagtheory
    5.15 -{\isafoldtheory}%
    5.16 -%
    5.17 -\isadelimtheory
    5.18 -%
    5.19 -\endisadelimtheory
    5.20 -%
    5.21 -\begin{isamarkuptext}%
    5.22 -\noindent
    5.23 -So far, all recursive definitions were shown to terminate via measure
    5.24 -functions. Sometimes this can be inconvenient or
    5.25 -impossible. Fortunately, \isacommand{recdef} supports much more
    5.26 -general definitions. For example, termination of Ackermann's function
    5.27 -can be shown by means of the \rmindex{lexicographic product} \isa{{\isacharless}{\isacharasterisk}lex{\isacharasterisk}{\isachargreater}}:%
    5.28 -\end{isamarkuptext}%
    5.29 -\isamarkuptrue%
    5.30 -\isacommand{consts}\isamarkupfalse%
    5.31 -\ ack\ {\isacharcolon}{\isacharcolon}\ {\isachardoublequoteopen}nat{\isasymtimes}nat\ {\isasymRightarrow}\ nat{\isachardoublequoteclose}\isanewline
    5.32 -\isacommand{recdef}\isamarkupfalse%
    5.33 -\ ack\ {\isachardoublequoteopen}measure{\isacharparenleft}{\isasymlambda}m{\isachardot}\ m{\isacharparenright}\ {\isacharless}{\isacharasterisk}lex{\isacharasterisk}{\isachargreater}\ measure{\isacharparenleft}{\isasymlambda}n{\isachardot}\ n{\isacharparenright}{\isachardoublequoteclose}\isanewline
    5.34 -\ \ {\isachardoublequoteopen}ack{\isacharparenleft}{\isadigit{0}}{\isacharcomma}n{\isacharparenright}\ \ \ \ \ \ \ \ \ {\isacharequal}\ Suc\ n{\isachardoublequoteclose}\isanewline
    5.35 -\ \ {\isachardoublequoteopen}ack{\isacharparenleft}Suc\ m{\isacharcomma}{\isadigit{0}}{\isacharparenright}\ \ \ \ \ {\isacharequal}\ ack{\isacharparenleft}m{\isacharcomma}\ {\isadigit{1}}{\isacharparenright}{\isachardoublequoteclose}\isanewline
    5.36 -\ \ {\isachardoublequoteopen}ack{\isacharparenleft}Suc\ m{\isacharcomma}Suc\ n{\isacharparenright}\ {\isacharequal}\ ack{\isacharparenleft}m{\isacharcomma}ack{\isacharparenleft}Suc\ m{\isacharcomma}n{\isacharparenright}{\isacharparenright}{\isachardoublequoteclose}%
    5.37 -\begin{isamarkuptext}%
    5.38 -\noindent
    5.39 -The lexicographic product decreases if either its first component
    5.40 -decreases (as in the second equation and in the outer call in the
    5.41 -third equation) or its first component stays the same and the second
    5.42 -component decreases (as in the inner call in the third equation).
    5.43 -
    5.44 -In general, \isacommand{recdef} supports termination proofs based on
    5.45 -arbitrary well-founded relations as introduced in \S\ref{sec:Well-founded}.
    5.46 -This is called \textbf{well-founded
    5.47 -recursion}\indexbold{recursion!well-founded}.  A function definition
    5.48 -is total if and only if the set of 
    5.49 -all pairs $(r,l)$, where $l$ is the argument on the
    5.50 -left-hand side of an equation and $r$ the argument of some recursive call on
    5.51 -the corresponding right-hand side, induces a well-founded relation.  For a
    5.52 -systematic account of termination proofs via well-founded relations see, for
    5.53 -example, Baader and Nipkow~\cite{Baader-Nipkow}.
    5.54 -
    5.55 -Each \isacommand{recdef} definition should be accompanied (after the function's
    5.56 -name) by a well-founded relation on the function's argument type.  
    5.57 -Isabelle/HOL formalizes some of the most important
    5.58 -constructions of well-founded relations (see \S\ref{sec:Well-founded}). For
    5.59 -example, \isa{measure\ f} is always well-founded.   The lexicographic
    5.60 -product of two well-founded relations is again well-founded, which we relied
    5.61 -on when defining Ackermann's function above.
    5.62 -Of course the lexicographic product can also be iterated:%
    5.63 -\end{isamarkuptext}%
    5.64 -\isamarkuptrue%
    5.65 -\isacommand{consts}\isamarkupfalse%
    5.66 -\ contrived\ {\isacharcolon}{\isacharcolon}\ {\isachardoublequoteopen}nat\ {\isasymtimes}\ nat\ {\isasymtimes}\ nat\ {\isasymRightarrow}\ nat{\isachardoublequoteclose}\isanewline
    5.67 -\isacommand{recdef}\isamarkupfalse%
    5.68 -\ contrived\isanewline
    5.69 -\ \ {\isachardoublequoteopen}measure{\isacharparenleft}{\isasymlambda}i{\isachardot}\ i{\isacharparenright}\ {\isacharless}{\isacharasterisk}lex{\isacharasterisk}{\isachargreater}\ measure{\isacharparenleft}{\isasymlambda}j{\isachardot}\ j{\isacharparenright}\ {\isacharless}{\isacharasterisk}lex{\isacharasterisk}{\isachargreater}\ measure{\isacharparenleft}{\isasymlambda}k{\isachardot}\ k{\isacharparenright}{\isachardoublequoteclose}\isanewline
    5.70 -{\isachardoublequoteopen}contrived{\isacharparenleft}i{\isacharcomma}j{\isacharcomma}Suc\ k{\isacharparenright}\ {\isacharequal}\ contrived{\isacharparenleft}i{\isacharcomma}j{\isacharcomma}k{\isacharparenright}{\isachardoublequoteclose}\isanewline
    5.71 -{\isachardoublequoteopen}contrived{\isacharparenleft}i{\isacharcomma}Suc\ j{\isacharcomma}{\isadigit{0}}{\isacharparenright}\ {\isacharequal}\ contrived{\isacharparenleft}i{\isacharcomma}j{\isacharcomma}j{\isacharparenright}{\isachardoublequoteclose}\isanewline
    5.72 -{\isachardoublequoteopen}contrived{\isacharparenleft}Suc\ i{\isacharcomma}{\isadigit{0}}{\isacharcomma}{\isadigit{0}}{\isacharparenright}\ {\isacharequal}\ contrived{\isacharparenleft}i{\isacharcomma}i{\isacharcomma}i{\isacharparenright}{\isachardoublequoteclose}\isanewline
    5.73 -{\isachardoublequoteopen}contrived{\isacharparenleft}{\isadigit{0}}{\isacharcomma}{\isadigit{0}}{\isacharcomma}{\isadigit{0}}{\isacharparenright}\ \ \ \ \ {\isacharequal}\ {\isadigit{0}}{\isachardoublequoteclose}%
    5.74 -\begin{isamarkuptext}%
    5.75 -Lexicographic products of measure functions already go a long
    5.76 -way. Furthermore, you may embed a type in an
    5.77 -existing well-founded relation via the inverse image construction \isa{inv{\isacharunderscore}image}. All these constructions are known to \isacommand{recdef}. Thus you
    5.78 -will never have to prove well-foundedness of any relation composed
    5.79 -solely of these building blocks. But of course the proof of
    5.80 -termination of your function definition --- that the arguments
    5.81 -decrease with every recursive call --- may still require you to provide
    5.82 -additional lemmas.
    5.83 -
    5.84 -It is also possible to use your own well-founded relations with
    5.85 -\isacommand{recdef}.  For example, the greater-than relation can be made
    5.86 -well-founded by cutting it off at a certain point.  Here is an example
    5.87 -of a recursive function that calls itself with increasing values up to ten:%
    5.88 -\end{isamarkuptext}%
    5.89 -\isamarkuptrue%
    5.90 -\isacommand{consts}\isamarkupfalse%
    5.91 -\ f\ {\isacharcolon}{\isacharcolon}\ {\isachardoublequoteopen}nat\ {\isasymRightarrow}\ nat{\isachardoublequoteclose}\isanewline
    5.92 -\isacommand{recdef}\isamarkupfalse%
    5.93 -\ f\ {\isachardoublequoteopen}{\isacharbraceleft}{\isacharparenleft}i{\isacharcomma}j{\isacharparenright}{\isachardot}\ j{\isacharless}i\ {\isasymand}\ i\ {\isasymle}\ {\isacharparenleft}{\isadigit{1}}{\isadigit{0}}{\isacharcolon}{\isacharcolon}nat{\isacharparenright}{\isacharbraceright}{\isachardoublequoteclose}\isanewline
    5.94 -{\isachardoublequoteopen}f\ i\ {\isacharequal}\ {\isacharparenleft}if\ {\isadigit{1}}{\isadigit{0}}\ {\isasymle}\ i\ then\ {\isadigit{0}}\ else\ i\ {\isacharasterisk}\ f{\isacharparenleft}Suc\ i{\isacharparenright}{\isacharparenright}{\isachardoublequoteclose}%
    5.95 -\begin{isamarkuptext}%
    5.96 -\noindent
    5.97 -Since \isacommand{recdef} is not prepared for the relation supplied above,
    5.98 -Isabelle rejects the definition.  We should first have proved that
    5.99 -our relation was well-founded:%
   5.100 -\end{isamarkuptext}%
   5.101 -\isamarkuptrue%
   5.102 -\isacommand{lemma}\isamarkupfalse%
   5.103 -\ wf{\isacharunderscore}greater{\isacharcolon}\ {\isachardoublequoteopen}wf\ {\isacharbraceleft}{\isacharparenleft}i{\isacharcomma}j{\isacharparenright}{\isachardot}\ j{\isacharless}i\ {\isasymand}\ i\ {\isasymle}\ {\isacharparenleft}N{\isacharcolon}{\isacharcolon}nat{\isacharparenright}{\isacharbraceright}{\isachardoublequoteclose}%
   5.104 -\isadelimproof
   5.105 -%
   5.106 -\endisadelimproof
   5.107 -%
   5.108 -\isatagproof
   5.109 -%
   5.110 -\begin{isamarkuptxt}%
   5.111 -\noindent
   5.112 -The proof is by showing that our relation is a subset of another well-founded
   5.113 -relation: one given by a measure function.\index{*wf_subset (theorem)}%
   5.114 -\end{isamarkuptxt}%
   5.115 -\isamarkuptrue%
   5.116 -\isacommand{apply}\isamarkupfalse%
   5.117 -\ {\isacharparenleft}rule\ wf{\isacharunderscore}subset\ {\isacharbrackleft}of\ {\isachardoublequoteopen}measure\ {\isacharparenleft}{\isasymlambda}k{\isacharcolon}{\isacharcolon}nat{\isachardot}\ N{\isacharminus}k{\isacharparenright}{\isachardoublequoteclose}{\isacharbrackright}{\isacharcomma}\ blast{\isacharparenright}%
   5.118 -\begin{isamarkuptxt}%
   5.119 -\begin{isabelle}%
   5.120 -\ {\isadigit{1}}{\isachardot}\ {\isacharbraceleft}{\isacharparenleft}i{\isacharcomma}\ j{\isacharparenright}{\isachardot}\ j\ {\isacharless}\ i\ {\isasymand}\ i\ {\isasymle}\ N{\isacharbraceright}\ {\isasymsubseteq}\ measure\ {\isacharparenleft}op\ {\isacharminus}\ N{\isacharparenright}%
   5.121 -\end{isabelle}
   5.122 -
   5.123 -\noindent
   5.124 -The inclusion remains to be proved. After unfolding some definitions, 
   5.125 -we are left with simple arithmetic that is dispatched automatically.%
   5.126 -\end{isamarkuptxt}%
   5.127 -\isamarkuptrue%
   5.128 -\isacommand{by}\isamarkupfalse%
   5.129 -\ {\isacharparenleft}clarify{\isacharcomma}\ simp\ add{\isacharcolon}\ measure{\isacharunderscore}def\ inv{\isacharunderscore}image{\isacharunderscore}def{\isacharparenright}%
   5.130 -\endisatagproof
   5.131 -{\isafoldproof}%
   5.132 -%
   5.133 -\isadelimproof
   5.134 -%
   5.135 -\endisadelimproof
   5.136 -%
   5.137 -\begin{isamarkuptext}%
   5.138 -\noindent
   5.139 -
   5.140 -Armed with this lemma, we use the \attrdx{recdef_wf} attribute to attach a
   5.141 -crucial hint\cmmdx{hints} to our definition:%
   5.142 -\end{isamarkuptext}%
   5.143 -\isamarkuptrue%
   5.144 -{\isacharparenleft}\isakeyword{hints}\ recdef{\isacharunderscore}wf{\isacharcolon}\ wf{\isacharunderscore}greater{\isacharparenright}%
   5.145 -\begin{isamarkuptext}%
   5.146 -\noindent
   5.147 -Alternatively, we could have given \isa{measure\ {\isacharparenleft}{\isasymlambda}k{\isacharcolon}{\isacharcolon}nat{\isachardot}\ {\isadigit{1}}{\isadigit{0}}{\isacharminus}k{\isacharparenright}} for the
   5.148 -well-founded relation in our \isacommand{recdef}.  However, the arithmetic
   5.149 -goal in the lemma above would have arisen instead in the \isacommand{recdef}
   5.150 -termination proof, where we have less control.  A tailor-made termination
   5.151 -relation makes even more sense when it can be used in several function
   5.152 -declarations.%
   5.153 -\end{isamarkuptext}%
   5.154 -\isamarkuptrue%
   5.155 -%
   5.156 -\isadelimtheory
   5.157 -%
   5.158 -\endisadelimtheory
   5.159 -%
   5.160 -\isatagtheory
   5.161 -%
   5.162 -\endisatagtheory
   5.163 -{\isafoldtheory}%
   5.164 -%
   5.165 -\isadelimtheory
   5.166 -%
   5.167 -\endisadelimtheory
   5.168 -\end{isabellebody}%
   5.169 -%%% Local Variables:
   5.170 -%%% mode: latex
   5.171 -%%% TeX-master: "root"
   5.172 -%%% End:

     6.1 --- a/doc-src/TutorialI/Advanced/document/simp2.tex	Thu Jul 26 16:08:16 2012 +0200
     6.2 +++ /dev/null	Thu Jan 01 00:00:00 1970 +0000
     6.3 @@ -1,249 +0,0 @@
     6.4 -%
     6.5 -\begin{isabellebody}%
     6.6 -\def\isabellecontext{simp{\isadigit{2}}}%
     6.7 -%
     6.8 -\isadelimtheory
     6.9 -%
    6.10 -\endisadelimtheory
    6.11 -%
    6.12 -\isatagtheory
    6.13 -%
    6.14 -\endisatagtheory
    6.15 -{\isafoldtheory}%
    6.16 -%
    6.17 -\isadelimtheory
    6.18 -%
    6.19 -\endisadelimtheory
    6.20 -%
    6.21 -\isamarkupsection{Simplification%
    6.22 -}
    6.23 -\isamarkuptrue%
    6.24 -%
    6.25 -\begin{isamarkuptext}%
    6.26 -\label{sec:simplification-II}\index{simplification|(}
    6.27 -This section describes features not covered until now.  It also
    6.28 -outlines the simplification process itself, which can be helpful
    6.29 -when the simplifier does not do what you expect of it.%
    6.30 -\end{isamarkuptext}%
    6.31 -\isamarkuptrue%
    6.32 -%
    6.33 -\isamarkupsubsection{Advanced Features%
    6.34 -}
    6.35 -\isamarkuptrue%
    6.36 -%
    6.37 -\isamarkupsubsubsection{Congruence Rules%
    6.38 -}
    6.39 -\isamarkuptrue%
    6.40 -%
    6.41 -\begin{isamarkuptext}%
    6.42 -\label{sec:simp-cong}
    6.43 -While simplifying the conclusion $Q$
    6.44 -of $P \Imp Q$, it is legal to use the assumption $P$.
    6.45 -For $\Imp$ this policy is hardwired, but 
    6.46 -contextual information can also be made available for other
    6.47 -operators. For example, \isa{xs\ {\isaliteral{3D}{\isacharequal}}\ {\isaliteral{5B}{\isacharbrackleft}}{\isaliteral{5D}{\isacharbrackright}}\ {\isaliteral{5C3C6C6F6E6772696768746172726F773E}{\isasymlongrightarrow}}\ xs\ {\isaliteral{40}{\isacharat}}\ xs\ {\isaliteral{3D}{\isacharequal}}\ xs} simplifies to \isa{True} because we may use \isa{xs\ {\isaliteral{3D}{\isacharequal}}\ {\isaliteral{5B}{\isacharbrackleft}}{\isaliteral{5D}{\isacharbrackright}}} when simplifying \isa{xs\ {\isaliteral{40}{\isacharat}}\ xs\ {\isaliteral{3D}{\isacharequal}}\ xs}. The generation of contextual information during simplification is
    6.48 -controlled by so-called \bfindex{congruence rules}. This is the one for
    6.49 -\isa{{\isaliteral{5C3C6C6F6E6772696768746172726F773E}{\isasymlongrightarrow}}}:
    6.50 -\begin{isabelle}%
    6.51 -\ \ \ \ \ {\isaliteral{5C3C6C6272616B6B3E}{\isasymlbrakk}}P\ {\isaliteral{3D}{\isacharequal}}\ P{\isaliteral{27}{\isacharprime}}{\isaliteral{3B}{\isacharsemicolon}}\ P{\isaliteral{27}{\isacharprime}}\ {\isaliteral{5C3C4C6F6E6772696768746172726F773E}{\isasymLongrightarrow}}\ Q\ {\isaliteral{3D}{\isacharequal}}\ Q{\isaliteral{27}{\isacharprime}}{\isaliteral{5C3C726272616B6B3E}{\isasymrbrakk}}\ {\isaliteral{5C3C4C6F6E6772696768746172726F773E}{\isasymLongrightarrow}}\ {\isaliteral{28}{\isacharparenleft}}P\ {\isaliteral{5C3C6C6F6E6772696768746172726F773E}{\isasymlongrightarrow}}\ Q{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{3D}{\isacharequal}}\ {\isaliteral{28}{\isacharparenleft}}P{\isaliteral{27}{\isacharprime}}\ {\isaliteral{5C3C6C6F6E6772696768746172726F773E}{\isasymlongrightarrow}}\ Q{\isaliteral{27}{\isacharprime}}{\isaliteral{29}{\isacharparenright}}%
    6.52 -\end{isabelle}
    6.53 -It should be read as follows:
    6.54 -In order to simplify \isa{P\ {\isaliteral{5C3C6C6F6E6772696768746172726F773E}{\isasymlongrightarrow}}\ Q} to \isa{P{\isaliteral{27}{\isacharprime}}\ {\isaliteral{5C3C6C6F6E6772696768746172726F773E}{\isasymlongrightarrow}}\ Q{\isaliteral{27}{\isacharprime}}},
    6.55 -simplify \isa{P} to \isa{P{\isaliteral{27}{\isacharprime}}}
    6.56 -and assume \isa{P{\isaliteral{27}{\isacharprime}}} when simplifying \isa{Q} to \isa{Q{\isaliteral{27}{\isacharprime}}}.
    6.57 -
    6.58 -Here are some more examples.  The congruence rules for bounded
    6.59 -quantifiers supply contextual information about the bound variable:
    6.60 -\begin{isabelle}%
    6.61 -\ \ \ \ \ {\isaliteral{5C3C6C6272616B6B3E}{\isasymlbrakk}}A\ {\isaliteral{3D}{\isacharequal}}\ B{\isaliteral{3B}{\isacharsemicolon}}\ {\isaliteral{5C3C416E643E}{\isasymAnd}}x{\isaliteral{2E}{\isachardot}}\ x\ {\isaliteral{5C3C696E3E}{\isasymin}}\ B\ {\isaliteral{5C3C4C6F6E6772696768746172726F773E}{\isasymLongrightarrow}}\ P\ x\ {\isaliteral{3D}{\isacharequal}}\ Q\ x{\isaliteral{5C3C726272616B6B3E}{\isasymrbrakk}}\isanewline
    6.62 -\isaindent{\ \ \ \ \ }{\isaliteral{5C3C4C6F6E6772696768746172726F773E}{\isasymLongrightarrow}}\ {\isaliteral{28}{\isacharparenleft}}{\isaliteral{5C3C666F72616C6C3E}{\isasymforall}}x{\isaliteral{5C3C696E3E}{\isasymin}}A{\isaliteral{2E}{\isachardot}}\ P\ x{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{3D}{\isacharequal}}\ {\isaliteral{28}{\isacharparenleft}}{\isaliteral{5C3C666F72616C6C3E}{\isasymforall}}x{\isaliteral{5C3C696E3E}{\isasymin}}B{\isaliteral{2E}{\isachardot}}\ Q\ x{\isaliteral{29}{\isacharparenright}}%
    6.63 -\end{isabelle}
    6.64 -One congruence rule for conditional expressions supplies contextual
    6.65 -information for simplifying the \isa{then} and \isa{else} cases:
    6.66 -\begin{isabelle}%
    6.67 -\ \ \ \ \ {\isaliteral{5C3C6C6272616B6B3E}{\isasymlbrakk}}b\ {\isaliteral{3D}{\isacharequal}}\ c{\isaliteral{3B}{\isacharsemicolon}}\ c\ {\isaliteral{5C3C4C6F6E6772696768746172726F773E}{\isasymLongrightarrow}}\ x\ {\isaliteral{3D}{\isacharequal}}\ u{\isaliteral{3B}{\isacharsemicolon}}\ {\isaliteral{5C3C6E6F743E}{\isasymnot}}\ c\ {\isaliteral{5C3C4C6F6E6772696768746172726F773E}{\isasymLongrightarrow}}\ y\ {\isaliteral{3D}{\isacharequal}}\ v{\isaliteral{5C3C726272616B6B3E}{\isasymrbrakk}}\isanewline
    6.68 -\isaindent{\ \ \ \ \ }{\isaliteral{5C3C4C6F6E6772696768746172726F773E}{\isasymLongrightarrow}}\ {\isaliteral{28}{\isacharparenleft}}if\ b\ then\ x\ else\ y{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{3D}{\isacharequal}}\ {\isaliteral{28}{\isacharparenleft}}if\ c\ then\ u\ else\ v{\isaliteral{29}{\isacharparenright}}%
    6.69 -\end{isabelle}
    6.70 -An alternative congruence rule for conditional expressions
    6.71 -actually \emph{prevents} simplification of some arguments:
    6.72 -\begin{isabelle}%
    6.73 -\ \ \ \ \ b\ {\isaliteral{3D}{\isacharequal}}\ c\ {\isaliteral{5C3C4C6F6E6772696768746172726F773E}{\isasymLongrightarrow}}\ {\isaliteral{28}{\isacharparenleft}}if\ b\ then\ x\ else\ y{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{3D}{\isacharequal}}\ {\isaliteral{28}{\isacharparenleft}}if\ c\ then\ x\ else\ y{\isaliteral{29}{\isacharparenright}}%
    6.74 -\end{isabelle}
    6.75 -Only the first argument is simplified; the others remain unchanged.
    6.76 -This makes simplification much faster and is faithful to the evaluation
    6.77 -strategy in programming languages, which is why this is the default
    6.78 -congruence rule for \isa{if}. Analogous rules control the evaluation of
    6.79 -\isa{case} expressions.
    6.80 -
    6.81 -You can declare your own congruence rules with the attribute \attrdx{cong},
    6.82 -either globally, in the usual manner,
    6.83 -\begin{quote}
    6.84 -\isacommand{declare} \textit{theorem-name} \isa{{\isaliteral{5B}{\isacharbrackleft}}cong{\isaliteral{5D}{\isacharbrackright}}}
    6.85 -\end{quote}
    6.86 -or locally in a \isa{simp} call by adding the modifier
    6.87 -\begin{quote}
    6.88 -\isa{cong{\isaliteral{3A}{\isacharcolon}}} \textit{list of theorem names}
    6.89 -\end{quote}
    6.90 -The effect is reversed by \isa{cong\ del} instead of \isa{cong}.
    6.91 -
    6.92 -\begin{warn}
    6.93 -The congruence rule \isa{conj{\isaliteral{5F}{\isacharunderscore}}cong}
    6.94 -\begin{isabelle}%
    6.95 -\ \ \ \ \ {\isaliteral{5C3C6C6272616B6B3E}{\isasymlbrakk}}P\ {\isaliteral{3D}{\isacharequal}}\ P{\isaliteral{27}{\isacharprime}}{\isaliteral{3B}{\isacharsemicolon}}\ P{\isaliteral{27}{\isacharprime}}\ {\isaliteral{5C3C4C6F6E6772696768746172726F773E}{\isasymLongrightarrow}}\ Q\ {\isaliteral{3D}{\isacharequal}}\ Q{\isaliteral{27}{\isacharprime}}{\isaliteral{5C3C726272616B6B3E}{\isasymrbrakk}}\ {\isaliteral{5C3C4C6F6E6772696768746172726F773E}{\isasymLongrightarrow}}\ {\isaliteral{28}{\isacharparenleft}}P\ {\isaliteral{5C3C616E643E}{\isasymand}}\ Q{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{3D}{\isacharequal}}\ {\isaliteral{28}{\isacharparenleft}}P{\isaliteral{27}{\isacharprime}}\ {\isaliteral{5C3C616E643E}{\isasymand}}\ Q{\isaliteral{27}{\isacharprime}}{\isaliteral{29}{\isacharparenright}}%
    6.96 -\end{isabelle}
    6.97 -\par\noindent
    6.98 -is occasionally useful but is not a default rule; you have to declare it explicitly.
    6.99 -\end{warn}%
   6.100 -\end{isamarkuptext}%
   6.101 -\isamarkuptrue%
   6.102 -%
   6.103 -\isamarkupsubsubsection{Permutative Rewrite Rules%
   6.104 -}
   6.105 -\isamarkuptrue%
   6.106 -%
   6.107 -\begin{isamarkuptext}%
   6.108 -\index{rewrite rules!permutative|bold}%
   6.109 -An equation is a \textbf{permutative rewrite rule} if the left-hand
   6.110 -side and right-hand side are the same up to renaming of variables.  The most
   6.111 -common permutative rule is commutativity: \isa{x\ {\isaliteral{2B}{\isacharplus}}\ y\ {\isaliteral{3D}{\isacharequal}}\ y\ {\isaliteral{2B}{\isacharplus}}\ x}.  Other examples
   6.112 -include \isa{x\ {\isaliteral{2D}{\isacharminus}}\ y\ {\isaliteral{2D}{\isacharminus}}\ z\ {\isaliteral{3D}{\isacharequal}}\ x\ {\isaliteral{2D}{\isacharminus}}\ z\ {\isaliteral{2D}{\isacharminus}}\ y} in arithmetic and \isa{insert\ x\ {\isaliteral{28}{\isacharparenleft}}insert\ y\ A{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{3D}{\isacharequal}}\ insert\ y\ {\isaliteral{28}{\isacharparenleft}}insert\ x\ A{\isaliteral{29}{\isacharparenright}}} for sets. Such rules are problematic because
   6.113 -once they apply, they can be used forever. The simplifier is aware of this
   6.114 -danger and treats permutative rules by means of a special strategy, called
   6.115 -\bfindex{ordered rewriting}: a permutative rewrite
   6.116 -rule is only applied if the term becomes smaller with respect to a fixed
   6.117 -lexicographic ordering on terms. For example, commutativity rewrites
   6.118 -\isa{b\ {\isaliteral{2B}{\isacharplus}}\ a} to \isa{a\ {\isaliteral{2B}{\isacharplus}}\ b}, but then stops because \isa{a\ {\isaliteral{2B}{\isacharplus}}\ b} is strictly
   6.119 -smaller than \isa{b\ {\isaliteral{2B}{\isacharplus}}\ a}.  Permutative rewrite rules can be turned into
   6.120 -simplification rules in the usual manner via the \isa{simp} attribute; the
   6.121 -simplifier recognizes their special status automatically.
   6.122 -
   6.123 -Permutative rewrite rules are most effective in the case of
   6.124 -associative-commutative functions.  (Associativity by itself is not
   6.125 -permutative.)  When dealing with an AC-function~$f$, keep the
   6.126 -following points in mind:
   6.127 -\begin{itemize}\index{associative-commutative function}
   6.128 -  
   6.129 -\item The associative law must always be oriented from left to right,
   6.130 -  namely $f(f(x,y),z) = f(x,f(y,z))$.  The opposite orientation, if
   6.131 -  used with commutativity, can lead to nontermination.
   6.132 -
   6.133 -\item To complete your set of rewrite rules, you must add not just
   6.134 -  associativity~(A) and commutativity~(C) but also a derived rule, {\bf
   6.135 -    left-com\-mut\-ativ\-ity} (LC): $f(x,f(y,z)) = f(y,f(x,z))$.
   6.136 -\end{itemize}
   6.137 -Ordered rewriting with the combination of A, C, and LC sorts a term
   6.138 -lexicographically:
   6.139 -\[\def\maps#1{~\stackrel{#1}{\leadsto}~}
   6.140 - f(f(b,c),a) \maps{A} f(b,f(c,a)) \maps{C} f(b,f(a,c)) \maps{LC} f(a,f(b,c)) \]
   6.141 -
   6.142 -Note that ordered rewriting for \isa{{\isaliteral{2B}{\isacharplus}}} and \isa{{\isaliteral{2A}{\isacharasterisk}}} on numbers is rarely
   6.143 -necessary because the built-in arithmetic prover often succeeds without
   6.144 -such tricks.%
   6.145 -\end{isamarkuptext}%
   6.146 -\isamarkuptrue%
   6.147 -%
   6.148 -\isamarkupsubsection{How the Simplifier Works%
   6.149 -}
   6.150 -\isamarkuptrue%
   6.151 -%
   6.152 -\begin{isamarkuptext}%
   6.153 -\label{sec:SimpHow}
   6.154 -Roughly speaking, the simplifier proceeds bottom-up: subterms are simplified
   6.155 -first.  A conditional equation is only applied if its condition can be
   6.156 -proved, again by simplification.  Below we explain some special features of
   6.157 -the rewriting process.%
   6.158 -\end{isamarkuptext}%
   6.159 -\isamarkuptrue%
   6.160 -%
   6.161 -\isamarkupsubsubsection{Higher-Order Patterns%
   6.162 -}
   6.163 -\isamarkuptrue%
   6.164 -%
   6.165 -\begin{isamarkuptext}%
   6.166 -\index{simplification rule|(}
   6.167 -So far we have pretended the simplifier can deal with arbitrary
   6.168 -rewrite rules. This is not quite true.  For reasons of feasibility,
   6.169 -the simplifier expects the
   6.170 -left-hand side of each rule to be a so-called \emph{higher-order
   6.171 -pattern}~\cite{nipkow-patterns}\indexbold{patterns!higher-order}. 
   6.172 -This restricts where
   6.173 -unknowns may occur.  Higher-order patterns are terms in $\beta$-normal
   6.174 -form.  (This means there are no subterms of the form $(\lambda x. M)(N)$.)  
   6.175 -Each occurrence of an unknown is of the form
   6.176 -$\Var{f}~x@1~\dots~x@n$, where the $x@i$ are distinct bound
   6.177 -variables. Thus all ordinary rewrite rules, where all unknowns are
   6.178 -of base type, for example \isa{{\isaliteral{3F}{\isacharquery}}a\ {\isaliteral{2B}{\isacharplus}}\ {\isaliteral{3F}{\isacharquery}}b\ {\isaliteral{2B}{\isacharplus}}\ {\isaliteral{3F}{\isacharquery}}c\ {\isaliteral{3D}{\isacharequal}}\ {\isaliteral{3F}{\isacharquery}}a\ {\isaliteral{2B}{\isacharplus}}\ {\isaliteral{28}{\isacharparenleft}}{\isaliteral{3F}{\isacharquery}}b\ {\isaliteral{2B}{\isacharplus}}\ {\isaliteral{3F}{\isacharquery}}c{\isaliteral{29}{\isacharparenright}}}, are acceptable: if an unknown is
   6.179 -of base type, it cannot have any arguments. Additionally, the rule
   6.180 -\isa{{\isaliteral{28}{\isacharparenleft}}{\isaliteral{5C3C666F72616C6C3E}{\isasymforall}}x{\isaliteral{2E}{\isachardot}}\ {\isaliteral{3F}{\isacharquery}}P\ x\ {\isaliteral{5C3C616E643E}{\isasymand}}\ {\isaliteral{3F}{\isacharquery}}Q\ x{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{3D}{\isacharequal}}\ {\isaliteral{28}{\isacharparenleft}}{\isaliteral{28}{\isacharparenleft}}{\isaliteral{5C3C666F72616C6C3E}{\isasymforall}}x{\isaliteral{2E}{\isachardot}}\ {\isaliteral{3F}{\isacharquery}}P\ x{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C616E643E}{\isasymand}}\ {\isaliteral{28}{\isacharparenleft}}{\isaliteral{5C3C666F72616C6C3E}{\isasymforall}}x{\isaliteral{2E}{\isachardot}}\ {\isaliteral{3F}{\isacharquery}}Q\ x{\isaliteral{29}{\isacharparenright}}{\isaliteral{29}{\isacharparenright}}} is also acceptable, in
   6.181 -both directions: all arguments of the unknowns \isa{{\isaliteral{3F}{\isacharquery}}P} and
   6.182 -\isa{{\isaliteral{3F}{\isacharquery}}Q} are distinct bound variables.
   6.183 -
   6.184 -If the left-hand side is not a higher-order pattern, all is not lost.
   6.185 -The simplifier will still try to apply the rule provided it
   6.186 -matches directly: without much $\lambda$-calculus hocus
   6.187 -pocus.  For example, \isa{{\isaliteral{28}{\isacharparenleft}}{\isaliteral{3F}{\isacharquery}}f\ {\isaliteral{3F}{\isacharquery}}x\ {\isaliteral{5C3C696E3E}{\isasymin}}\ range\ {\isaliteral{3F}{\isacharquery}}f{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{3D}{\isacharequal}}\ True} rewrites
   6.188 -\isa{g\ a\ {\isaliteral{5C3C696E3E}{\isasymin}}\ range\ g} to \isa{True}, but will fail to match
   6.189 -\isa{g{\isaliteral{28}{\isacharparenleft}}h\ b{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C696E3E}{\isasymin}}\ range{\isaliteral{28}{\isacharparenleft}}{\isaliteral{5C3C6C616D6264613E}{\isasymlambda}}x{\isaliteral{2E}{\isachardot}}\ g{\isaliteral{28}{\isacharparenleft}}h\ x{\isaliteral{29}{\isacharparenright}}{\isaliteral{29}{\isacharparenright}}}.  However, you can
   6.190 -eliminate the offending subterms --- those that are not patterns ---
   6.191 -by adding new variables and conditions.
   6.192 -In our example, we eliminate \isa{{\isaliteral{3F}{\isacharquery}}f\ {\isaliteral{3F}{\isacharquery}}x} and obtain
   6.193 - \isa{{\isaliteral{3F}{\isacharquery}}y\ {\isaliteral{3D}{\isacharequal}}\ {\isaliteral{3F}{\isacharquery}}f\ {\isaliteral{3F}{\isacharquery}}x\ {\isaliteral{5C3C4C6F6E6772696768746172726F773E}{\isasymLongrightarrow}}\ {\isaliteral{28}{\isacharparenleft}}{\isaliteral{3F}{\isacharquery}}y\ {\isaliteral{5C3C696E3E}{\isasymin}}\ range\ {\isaliteral{3F}{\isacharquery}}f{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{3D}{\isacharequal}}\ True}, which is fine
   6.194 -as a conditional rewrite rule since conditions can be arbitrary
   6.195 -terms.  However, this trick is not a panacea because the newly
   6.196 -introduced conditions may be hard to solve.
   6.197 -  
   6.198 -There is no restriction on the form of the right-hand
   6.199 -sides.  They may not contain extraneous term or type variables, though.%
   6.200 -\end{isamarkuptext}%
   6.201 -\isamarkuptrue%
   6.202 -%
   6.203 -\isamarkupsubsubsection{The Preprocessor%
   6.204 -}
   6.205 -\isamarkuptrue%
   6.206 -%
   6.207 -\begin{isamarkuptext}%
   6.208 -\label{sec:simp-preprocessor}
   6.209 -When a theorem is declared a simplification rule, it need not be a
   6.210 -conditional equation already.  The simplifier will turn it into a set of
   6.211 -conditional equations automatically.  For example, \isa{f\ x\ {\isaliteral{3D}{\isacharequal}}\ g\ x\ {\isaliteral{5C3C616E643E}{\isasymand}}\ h\ x\ {\isaliteral{3D}{\isacharequal}}\ k\ x} becomes the two separate
   6.212 -simplification rules \isa{f\ x\ {\isaliteral{3D}{\isacharequal}}\ g\ x} and \isa{h\ x\ {\isaliteral{3D}{\isacharequal}}\ k\ x}. In
   6.213 -general, the input theorem is converted as follows:
   6.214 -\begin{eqnarray}
   6.215 -\neg P &\mapsto& P = \hbox{\isa{False}} \nonumber\\
   6.216 -P \longrightarrow Q &\mapsto& P \Longrightarrow Q \nonumber\\
   6.217 -P \land Q &\mapsto& P,\ Q \nonumber\\
   6.218 -\forall x.~P~x &\mapsto& P~\Var{x}\nonumber\\
   6.219 -\forall x \in A.\ P~x &\mapsto& \Var{x} \in A \Longrightarrow P~\Var{x} \nonumber\\
   6.220 -\isa{if}\ P\ \isa{then}\ Q\ \isa{else}\ R &\mapsto&
   6.221 - P \Longrightarrow Q,\ \neg P \Longrightarrow R \nonumber
   6.222 -\end{eqnarray}
   6.223 -Once this conversion process is finished, all remaining non-equations
   6.224 -$P$ are turned into trivial equations $P =\isa{True}$.
   6.225 -For example, the formula 
   6.226 -\begin{center}\isa{{\isaliteral{28}{\isacharparenleft}}p\ {\isaliteral{5C3C6C6F6E6772696768746172726F773E}{\isasymlongrightarrow}}\ t\ {\isaliteral{3D}{\isacharequal}}\ u\ {\isaliteral{5C3C616E643E}{\isasymand}}\ {\isaliteral{5C3C6E6F743E}{\isasymnot}}\ r{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C616E643E}{\isasymand}}\ s}\end{center}
   6.227 -is converted into the three rules
   6.228 -\begin{center}
   6.229 -\isa{p\ {\isaliteral{5C3C4C6F6E6772696768746172726F773E}{\isasymLongrightarrow}}\ t\ {\isaliteral{3D}{\isacharequal}}\ u},\quad  \isa{p\ {\isaliteral{5C3C4C6F6E6772696768746172726F773E}{\isasymLongrightarrow}}\ r\ {\isaliteral{3D}{\isacharequal}}\ False},\quad  \isa{s\ {\isaliteral{3D}{\isacharequal}}\ True}.
   6.230 -\end{center}
   6.231 -\index{simplification rule|)}
   6.232 -\index{simplification|)}%
   6.233 -\end{isamarkuptext}%
   6.234 -\isamarkuptrue%
   6.235 -%
   6.236 -\isadelimtheory
   6.237 -%
   6.238 -\endisadelimtheory
   6.239 -%
   6.240 -\isatagtheory
   6.241 -%
   6.242 -\endisatagtheory
   6.243 -{\isafoldtheory}%
   6.244 -%
   6.245 -\isadelimtheory
   6.246 -%
   6.247 -\endisadelimtheory
   6.248 -\end{isabellebody}%
   6.249 -%%% Local Variables:
   6.250 -%%% mode: latex
   6.251 -%%% TeX-master: "root"
   6.252 -%%% End:

     7.1 --- a/doc-src/TutorialI/CTL/ROOT.ML	Thu Jul 26 16:08:16 2012 +0200
     7.2 +++ /dev/null	Thu Jan 01 00:00:00 1970 +0000
     7.3 @@ -1,4 +0,0 @@
     7.4 -use "../settings.ML";
     7.5 -use_thy "PDL";
     7.6 -use_thy "CTL";
     7.7 -use_thy "CTLind";

     8.1 --- a/doc-src/TutorialI/CTL/ctl.tex	Thu Jul 26 16:08:16 2012 +0200
     8.2 +++ b/doc-src/TutorialI/CTL/ctl.tex	Thu Jul 26 19:59:06 2012 +0200
     8.3 @@ -1,6 +1,6 @@
     8.4  \index{model checking example|(}%
     8.5  \index{lfp@{\texttt{lfp}}!applications of|see{CTL}}
     8.6 -\input{CTL/document/Base.tex}
     8.7 -\input{CTL/document/PDL.tex}
     8.8 -\input{CTL/document/CTL.tex}
     8.9 +\input{document/Base.tex}
    8.10 +\input{document/PDL.tex}
    8.11 +\input{document/CTL.tex}
    8.12  \index{model checking example|)}

     9.1 --- a/doc-src/TutorialI/CTL/document/Base.tex	Thu Jul 26 16:08:16 2012 +0200
     9.2 +++ /dev/null	Thu Jan 01 00:00:00 1970 +0000
     9.3 @@ -1,130 +0,0 @@
     9.4 -%
     9.5 -\begin{isabellebody}%
     9.6 -\def\isabellecontext{Base}%
     9.7 -%
     9.8 -\isadelimtheory
     9.9 -%
    9.10 -\endisadelimtheory
    9.11 -%
    9.12 -\isatagtheory
    9.13 -%
    9.14 -\endisatagtheory
    9.15 -{\isafoldtheory}%
    9.16 -%
    9.17 -\isadelimtheory
    9.18 -%
    9.19 -\endisadelimtheory
    9.20 -%
    9.21 -\isamarkupsection{Case Study: Verified Model Checking%
    9.22 -}
    9.23 -\isamarkuptrue%
    9.24 -%
    9.25 -\begin{isamarkuptext}%
    9.26 -\label{sec:VMC}
    9.27 -This chapter ends with a case study concerning model checking for 
    9.28 -Computation Tree Logic (CTL), a temporal logic.
    9.29 -Model checking is a popular technique for the verification of finite
    9.30 -state systems (implementations) with respect to temporal logic formulae
    9.31 -(specifications) \cite{ClarkeGP-book,Huth-Ryan-book}. Its foundations are set theoretic
    9.32 -and this section will explore them in HOL\@. This is done in two steps.  First
    9.33 -we consider a simple modal logic called propositional dynamic
    9.34 -logic (PDL)\@.  We then proceed to the temporal logic CTL, which is
    9.35 -used in many real
    9.36 -model checkers. In each case we give both a traditional semantics (\isa{{\isaliteral{5C3C5475726E7374696C653E}{\isasymTurnstile}}}) and a
    9.37 -recursive function \isa{mc} that maps a formula into the set of all states of
    9.38 -the system where the formula is valid. If the system has a finite number of
    9.39 -states, \isa{mc} is directly executable: it is a model checker, albeit an
    9.40 -inefficient one. The main proof obligation is to show that the semantics
    9.41 -and the model checker agree.
    9.42 -
    9.43 -\underscoreon
    9.44 -
    9.45 -Our models are \emph{transition systems}:\index{transition systems}
    9.46 -sets of \emph{states} with
    9.47 -transitions between them.  Here is a simple example:
    9.48 -\begin{center}
    9.49 -\unitlength.5mm
    9.50 -\thicklines
    9.51 -\begin{picture}(100,60)
    9.52 -\put(50,50){\circle{20}}
    9.53 -\put(50,50){\makebox(0,0){$p,q$}}
    9.54 -\put(61,55){\makebox(0,0)[l]{$s_0$}}
    9.55 -\put(44,42){\vector(-1,-1){26}}
    9.56 -\put(16,18){\vector(1,1){26}}
    9.57 -\put(57,43){\vector(1,-1){26}}
    9.58 -\put(10,10){\circle{20}}
    9.59 -\put(10,10){\makebox(0,0){$q,r$}}
    9.60 -\put(-1,15){\makebox(0,0)[r]{$s_1$}}
    9.61 -\put(20,10){\vector(1,0){60}}
    9.62 -\put(90,10){\circle{20}}
    9.63 -\put(90,10){\makebox(0,0){$r$}}
    9.64 -\put(98, 5){\line(1,0){10}}
    9.65 -\put(108, 5){\line(0,1){10}}
    9.66 -\put(108,15){\vector(-1,0){10}}
    9.67 -\put(91,21){\makebox(0,0)[bl]{$s_2$}}
    9.68 -\end{picture}
    9.69 -\end{center}
    9.70 -Each state has a unique name or number ($s_0,s_1,s_2$), and in each state
    9.71 -certain \emph{atomic propositions} ($p,q,r$) hold.  The aim of temporal logic
    9.72 -is to formalize statements such as ``there is no path starting from $s_2$
    9.73 -leading to a state where $p$ or $q$ holds,'' which is true, and ``on all paths
    9.74 -starting from $s_0$, $q$ always holds,'' which is false.
    9.75 -
    9.76 -Abstracting from this concrete example, we assume there is a type of
    9.77 -states:%
    9.78 -\end{isamarkuptext}%
    9.79 -\isamarkuptrue%
    9.80 -\isacommand{typedecl}\isamarkupfalse%
    9.81 -\ state%
    9.82 -\begin{isamarkuptext}%
    9.83 -\noindent
    9.84 -Command \commdx{typedecl} merely declares a new type but without
    9.85 -defining it (see \S\ref{sec:typedecl}). Thus we know nothing
    9.86 -about the type other than its existence. That is exactly what we need
    9.87 -because \isa{state} really is an implicit parameter of our model.  Of
    9.88 -course it would have been more generic to make \isa{state} a type
    9.89 -parameter of everything but declaring \isa{state} globally as above
    9.90 -reduces clutter.  Similarly we declare an arbitrary but fixed
    9.91 -transition system, i.e.\ a relation between states:%
    9.92 -\end{isamarkuptext}%
    9.93 -\isamarkuptrue%
    9.94 -\isacommand{consts}\isamarkupfalse%
    9.95 -\ M\ {\isaliteral{3A}{\isacharcolon}}{\isaliteral{3A}{\isacharcolon}}\ {\isaliteral{22}{\isachardoublequoteopen}}{\isaliteral{28}{\isacharparenleft}}state\ {\isaliteral{5C3C74696D65733E}{\isasymtimes}}\ state{\isaliteral{29}{\isacharparenright}}set{\isaliteral{22}{\isachardoublequoteclose}}%
    9.96 -\begin{isamarkuptext}%
    9.97 -\noindent
    9.98 -This is Isabelle's way of declaring a constant without defining it.
    9.99 -Finally we introduce a type of atomic propositions%
   9.100 -\end{isamarkuptext}%
   9.101 -\isamarkuptrue%
   9.102 -\isacommand{typedecl}\isamarkupfalse%
   9.103 -\ {\isaliteral{22}{\isachardoublequoteopen}}atom{\isaliteral{22}{\isachardoublequoteclose}}%
   9.104 -\begin{isamarkuptext}%
   9.105 -\noindent
   9.106 -and a \emph{labelling function}%
   9.107 -\end{isamarkuptext}%
   9.108 -\isamarkuptrue%
   9.109 -\isacommand{consts}\isamarkupfalse%
   9.110 -\ L\ {\isaliteral{3A}{\isacharcolon}}{\isaliteral{3A}{\isacharcolon}}\ {\isaliteral{22}{\isachardoublequoteopen}}state\ {\isaliteral{5C3C52696768746172726F773E}{\isasymRightarrow}}\ atom\ set{\isaliteral{22}{\isachardoublequoteclose}}%
   9.111 -\begin{isamarkuptext}%
   9.112 -\noindent
   9.113 -telling us which atomic propositions are true in each state.%
   9.114 -\end{isamarkuptext}%
   9.115 -\isamarkuptrue%
   9.116 -%
   9.117 -\isadelimtheory
   9.118 -%
   9.119 -\endisadelimtheory
   9.120 -%
   9.121 -\isatagtheory
   9.122 -%
   9.123 -\endisatagtheory
   9.124 -{\isafoldtheory}%
   9.125 -%
   9.126 -\isadelimtheory
   9.127 -%
   9.128 -\endisadelimtheory
   9.129 -\end{isabellebody}%
   9.130 -%%% Local Variables:
   9.131 -%%% mode: latex
   9.132 -%%% TeX-master: "root"
   9.133 -%%% End:

    10.1 --- a/doc-src/TutorialI/CTL/document/CTL.tex	Thu Jul 26 16:08:16 2012 +0200
    10.2 +++ /dev/null	Thu Jan 01 00:00:00 1970 +0000
    10.3 @@ -1,575 +0,0 @@
    10.4 -%
    10.5 -\begin{isabellebody}%
    10.6 -\def\isabellecontext{CTL}%
    10.7 -%
    10.8 -\isadelimtheory
    10.9 -%
   10.10 -\endisadelimtheory
   10.11 -%
   10.12 -\isatagtheory
   10.13 -%
   10.14 -\endisatagtheory
   10.15 -{\isafoldtheory}%
   10.16 -%
   10.17 -\isadelimtheory
   10.18 -%
   10.19 -\endisadelimtheory
   10.20 -%
   10.21 -\isamarkupsubsection{Computation Tree Logic --- CTL%
   10.22 -}
   10.23 -\isamarkuptrue%
   10.24 -%
   10.25 -\begin{isamarkuptext}%
   10.26 -\label{sec:CTL}
   10.27 -\index{CTL|(}%
   10.28 -The semantics of PDL only needs reflexive transitive closure.
   10.29 -Let us be adventurous and introduce a more expressive temporal operator.
   10.30 -We extend the datatype
   10.31 -\isa{formula} by a new constructor%
   10.32 -\end{isamarkuptext}%
   10.33 -\isamarkuptrue%
   10.34 -\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ {\isaliteral{7C}{\isacharbar}}\ AF\ formula%
   10.35 -\begin{isamarkuptext}%
   10.36 -\noindent
   10.37 -which stands for ``\emph{A}lways in the \emph{F}uture'':
   10.38 -on all infinite paths, at some point the formula holds.
   10.39 -Formalizing the notion of an infinite path is easy
   10.40 -in HOL: it is simply a function from \isa{nat} to \isa{state}.%
   10.41 -\end{isamarkuptext}%
   10.42 -\isamarkuptrue%
   10.43 -\isacommand{definition}\isamarkupfalse%
   10.44 -\ Paths\ {\isaliteral{3A}{\isacharcolon}}{\isaliteral{3A}{\isacharcolon}}\ {\isaliteral{22}{\isachardoublequoteopen}}state\ {\isaliteral{5C3C52696768746172726F773E}{\isasymRightarrow}}\ {\isaliteral{28}{\isacharparenleft}}nat\ {\isaliteral{5C3C52696768746172726F773E}{\isasymRightarrow}}\ state{\isaliteral{29}{\isacharparenright}}set{\isaliteral{22}{\isachardoublequoteclose}}\ \isakeyword{where}\isanewline
   10.45 -{\isaliteral{22}{\isachardoublequoteopen}}Paths\ s\ {\isaliteral{5C3C65717569763E}{\isasymequiv}}\ {\isaliteral{7B}{\isacharbraceleft}}p{\isaliteral{2E}{\isachardot}}\ s\ {\isaliteral{3D}{\isacharequal}}\ p\ {\isadigit{0}}\ {\isaliteral{5C3C616E643E}{\isasymand}}\ {\isaliteral{28}{\isacharparenleft}}{\isaliteral{5C3C666F72616C6C3E}{\isasymforall}}i{\isaliteral{2E}{\isachardot}}\ {\isaliteral{28}{\isacharparenleft}}p\ i{\isaliteral{2C}{\isacharcomma}}\ p{\isaliteral{28}{\isacharparenleft}}i{\isaliteral{2B}{\isacharplus}}{\isadigit{1}}{\isaliteral{29}{\isacharparenright}}{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C696E3E}{\isasymin}}\ M{\isaliteral{29}{\isacharparenright}}{\isaliteral{7D}{\isacharbraceright}}{\isaliteral{22}{\isachardoublequoteclose}}%
   10.46 -\begin{isamarkuptext}%
   10.47 -\noindent
   10.48 -This definition allows a succinct statement of the semantics of \isa{AF}:
   10.49 -\footnote{Do not be misled: neither datatypes nor recursive functions can be
   10.50 -extended by new constructors or equations. This is just a trick of the
   10.51 -presentation (see \S\ref{sec:doc-prep-suppress}). In reality one has to define
   10.52 -a new datatype and a new function.}%
   10.53 -\end{isamarkuptext}%
   10.54 -\isamarkuptrue%
   10.55 -{\isaliteral{22}{\isachardoublequoteopen}}s\ {\isaliteral{5C3C5475726E7374696C653E}{\isasymTurnstile}}\ AF\ f\ \ \ \ {\isaliteral{3D}{\isacharequal}}\ {\isaliteral{28}{\isacharparenleft}}{\isaliteral{5C3C666F72616C6C3E}{\isasymforall}}p\ {\isaliteral{5C3C696E3E}{\isasymin}}\ Paths\ s{\isaliteral{2E}{\isachardot}}\ {\isaliteral{5C3C6578697374733E}{\isasymexists}}i{\isaliteral{2E}{\isachardot}}\ p\ i\ {\isaliteral{5C3C5475726E7374696C653E}{\isasymTurnstile}}\ f{\isaliteral{29}{\isacharparenright}}{\isaliteral{22}{\isachardoublequoteclose}}%
   10.56 -\begin{isamarkuptext}%
   10.57 -\noindent
   10.58 -Model checking \isa{AF} involves a function which
   10.59 -is just complicated enough to warrant a separate definition:%
   10.60 -\end{isamarkuptext}%
   10.61 -\isamarkuptrue%
   10.62 -\isacommand{definition}\isamarkupfalse%
   10.63 -\ af\ {\isaliteral{3A}{\isacharcolon}}{\isaliteral{3A}{\isacharcolon}}\ {\isaliteral{22}{\isachardoublequoteopen}}state\ set\ {\isaliteral{5C3C52696768746172726F773E}{\isasymRightarrow}}\ state\ set\ {\isaliteral{5C3C52696768746172726F773E}{\isasymRightarrow}}\ state\ set{\isaliteral{22}{\isachardoublequoteclose}}\ \isakeyword{where}\isanewline
   10.64 -{\isaliteral{22}{\isachardoublequoteopen}}af\ A\ T\ {\isaliteral{5C3C65717569763E}{\isasymequiv}}\ A\ {\isaliteral{5C3C756E696F6E3E}{\isasymunion}}\ {\isaliteral{7B}{\isacharbraceleft}}s{\isaliteral{2E}{\isachardot}}\ {\isaliteral{5C3C666F72616C6C3E}{\isasymforall}}t{\isaliteral{2E}{\isachardot}}\ {\isaliteral{28}{\isacharparenleft}}s{\isaliteral{2C}{\isacharcomma}}\ t{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C696E3E}{\isasymin}}\ M\ {\isaliteral{5C3C6C6F6E6772696768746172726F773E}{\isasymlongrightarrow}}\ t\ {\isaliteral{5C3C696E3E}{\isasymin}}\ T{\isaliteral{7D}{\isacharbraceright}}{\isaliteral{22}{\isachardoublequoteclose}}%
   10.65 -\begin{isamarkuptext}%
   10.66 -\noindent
   10.67 -Now we define \isa{mc\ {\isaliteral{28}{\isacharparenleft}}AF\ f{\isaliteral{29}{\isacharparenright}}} as the least set \isa{T} that includes
   10.68 -\isa{mc\ f} and all states all of whose direct successors are in \isa{T}:%
   10.69 -\end{isamarkuptext}%
   10.70 -\isamarkuptrue%
   10.71 -{\isaliteral{22}{\isachardoublequoteopen}}mc{\isaliteral{28}{\isacharparenleft}}AF\ f{\isaliteral{29}{\isacharparenright}}\ \ \ \ {\isaliteral{3D}{\isacharequal}}\ lfp{\isaliteral{28}{\isacharparenleft}}af{\isaliteral{28}{\isacharparenleft}}mc\ f{\isaliteral{29}{\isacharparenright}}{\isaliteral{29}{\isacharparenright}}{\isaliteral{22}{\isachardoublequoteclose}}%
   10.72 -\begin{isamarkuptext}%
   10.73 -\noindent
   10.74 -Because \isa{af} is monotone in its second argument (and also its first, but
   10.75 -that is irrelevant), \isa{af\ A} has a least fixed point:%
   10.76 -\end{isamarkuptext}%
   10.77 -\isamarkuptrue%
   10.78 -\isacommand{lemma}\isamarkupfalse%
   10.79 -\ mono{\isaliteral{5F}{\isacharunderscore}}af{\isaliteral{3A}{\isacharcolon}}\ {\isaliteral{22}{\isachardoublequoteopen}}mono{\isaliteral{28}{\isacharparenleft}}af\ A{\isaliteral{29}{\isacharparenright}}{\isaliteral{22}{\isachardoublequoteclose}}\isanewline
   10.80 -%
   10.81 -\isadelimproof
   10.82 -%
   10.83 -\endisadelimproof
   10.84 -%
   10.85 -\isatagproof
   10.86 -\isacommand{apply}\isamarkupfalse%
   10.87 -{\isaliteral{28}{\isacharparenleft}}simp\ add{\isaliteral{3A}{\isacharcolon}}\ mono{\isaliteral{5F}{\isacharunderscore}}def\ af{\isaliteral{5F}{\isacharunderscore}}def{\isaliteral{29}{\isacharparenright}}\isanewline
   10.88 -\isacommand{apply}\isamarkupfalse%
   10.89 -\ blast\isanewline
   10.90 -\isacommand{done}\isamarkupfalse%
   10.91 -%
   10.92 -\endisatagproof
   10.93 -{\isafoldproof}%
   10.94 -%
   10.95 -\isadelimproof
   10.96 -%
   10.97 -\endisadelimproof
   10.98 -%
   10.99 -\isadelimproof
  10.100 -%
  10.101 -\endisadelimproof
  10.102 -%
  10.103 -\isatagproof
  10.104 -%
  10.105 -\endisatagproof
  10.106 -{\isafoldproof}%
  10.107 -%
  10.108 -\isadelimproof
  10.109 -%
  10.110 -\endisadelimproof
  10.111 -%
  10.112 -\isadelimproof
  10.113 -%
  10.114 -\endisadelimproof
  10.115 -%
  10.116 -\isatagproof
  10.117 -%
  10.118 -\endisatagproof
  10.119 -{\isafoldproof}%
  10.120 -%
  10.121 -\isadelimproof
  10.122 -%
  10.123 -\endisadelimproof
  10.124 -%
  10.125 -\begin{isamarkuptext}%
  10.126 -All we need to prove now is  \isa{mc\ {\isaliteral{28}{\isacharparenleft}}AF\ f{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{3D}{\isacharequal}}\ {\isaliteral{7B}{\isacharbraceleft}}s{\isaliteral{2E}{\isachardot}}\ s\ {\isaliteral{5C3C5475726E7374696C653E}{\isasymTurnstile}}\ AF\ f{\isaliteral{7D}{\isacharbraceright}}}, which states
  10.127 -that \isa{mc} and \isa{{\isaliteral{5C3C5475726E7374696C653E}{\isasymTurnstile}}} agree for \isa{AF}\@.
  10.128 -This time we prove the two inclusions separately, starting
  10.129 -with the easy one:%
  10.130 -\end{isamarkuptext}%
  10.131 -\isamarkuptrue%
  10.132 -\isacommand{theorem}\isamarkupfalse%
  10.133 -\ AF{\isaliteral{5F}{\isacharunderscore}}lemma{\isadigit{1}}{\isaliteral{3A}{\isacharcolon}}\ {\isaliteral{22}{\isachardoublequoteopen}}lfp{\isaliteral{28}{\isacharparenleft}}af\ A{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C73756273657465713E}{\isasymsubseteq}}\ {\isaliteral{7B}{\isacharbraceleft}}s{\isaliteral{2E}{\isachardot}}\ {\isaliteral{5C3C666F72616C6C3E}{\isasymforall}}p\ {\isaliteral{5C3C696E3E}{\isasymin}}\ Paths\ s{\isaliteral{2E}{\isachardot}}\ {\isaliteral{5C3C6578697374733E}{\isasymexists}}i{\isaliteral{2E}{\isachardot}}\ p\ i\ {\isaliteral{5C3C696E3E}{\isasymin}}\ A{\isaliteral{7D}{\isacharbraceright}}{\isaliteral{22}{\isachardoublequoteclose}}%
  10.134 -\isadelimproof
  10.135 -%
  10.136 -\endisadelimproof
  10.137 -%
  10.138 -\isatagproof
  10.139 -%
  10.140 -\begin{isamarkuptxt}%
  10.141 -\noindent
  10.142 -In contrast to the analogous proof for \isa{EF}, and just
  10.143 -for a change, we do not use fixed point induction.  Park-induction,
  10.144 -named after David Park, is weaker but sufficient for this proof:
  10.145 -\begin{center}
  10.146 -\isa{f\ S\ {\isaliteral{5C3C6C653E}{\isasymle}}\ S\ {\isaliteral{5C3C4C6F6E6772696768746172726F773E}{\isasymLongrightarrow}}\ lfp\ f\ {\isaliteral{5C3C6C653E}{\isasymle}}\ S} \hfill (\isa{lfp{\isaliteral{5F}{\isacharunderscore}}lowerbound})
  10.147 -\end{center}
  10.148 -The instance of the premise \isa{f\ S\ {\isaliteral{5C3C73756273657465713E}{\isasymsubseteq}}\ S} is proved pointwise,
  10.149 -a decision that \isa{auto} takes for us:%
  10.150 -\end{isamarkuptxt}%
  10.151 -\isamarkuptrue%
  10.152 -\isacommand{apply}\isamarkupfalse%
  10.153 -{\isaliteral{28}{\isacharparenleft}}rule\ lfp{\isaliteral{5F}{\isacharunderscore}}lowerbound{\isaliteral{29}{\isacharparenright}}\isanewline
  10.154 -\isacommand{apply}\isamarkupfalse%
  10.155 -{\isaliteral{28}{\isacharparenleft}}auto\ simp\ add{\isaliteral{3A}{\isacharcolon}}\ af{\isaliteral{5F}{\isacharunderscore}}def\ Paths{\isaliteral{5F}{\isacharunderscore}}def{\isaliteral{29}{\isacharparenright}}%
  10.156 -\begin{isamarkuptxt}%
  10.157 -\begin{isabelle}%
  10.158 -\ {\isadigit{1}}{\isaliteral{2E}{\isachardot}}\ {\isaliteral{5C3C416E643E}{\isasymAnd}}p{\isaliteral{2E}{\isachardot}}\ {\isaliteral{5C3C6C6272616B6B3E}{\isasymlbrakk}}{\isaliteral{5C3C666F72616C6C3E}{\isasymforall}}t{\isaliteral{2E}{\isachardot}}\ {\isaliteral{28}{\isacharparenleft}}p\ {\isadigit{0}}{\isaliteral{2C}{\isacharcomma}}\ t{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C696E3E}{\isasymin}}\ M\ {\isaliteral{5C3C6C6F6E6772696768746172726F773E}{\isasymlongrightarrow}}\isanewline
  10.159 -\isaindent{\ {\isadigit{1}}{\isaliteral{2E}{\isachardot}}\ {\isaliteral{5C3C416E643E}{\isasymAnd}}p{\isaliteral{2E}{\isachardot}}\ {\isaliteral{5C3C6C6272616B6B3E}{\isasymlbrakk}}{\isaliteral{5C3C666F72616C6C3E}{\isasymforall}}t{\isaliteral{2E}{\isachardot}}\ }{\isaliteral{28}{\isacharparenleft}}{\isaliteral{5C3C666F72616C6C3E}{\isasymforall}}p{\isaliteral{2E}{\isachardot}}\ t\ {\isaliteral{3D}{\isacharequal}}\ p\ {\isadigit{0}}\ {\isaliteral{5C3C616E643E}{\isasymand}}\ {\isaliteral{28}{\isacharparenleft}}{\isaliteral{5C3C666F72616C6C3E}{\isasymforall}}i{\isaliteral{2E}{\isachardot}}\ {\isaliteral{28}{\isacharparenleft}}p\ i{\isaliteral{2C}{\isacharcomma}}\ p\ {\isaliteral{28}{\isacharparenleft}}Suc\ i{\isaliteral{29}{\isacharparenright}}{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C696E3E}{\isasymin}}\ M{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C6C6F6E6772696768746172726F773E}{\isasymlongrightarrow}}\isanewline
  10.160 -\isaindent{\ {\isadigit{1}}{\isaliteral{2E}{\isachardot}}\ {\isaliteral{5C3C416E643E}{\isasymAnd}}p{\isaliteral{2E}{\isachardot}}\ {\isaliteral{5C3C6C6272616B6B3E}{\isasymlbrakk}}{\isaliteral{5C3C666F72616C6C3E}{\isasymforall}}t{\isaliteral{2E}{\isachardot}}\ {\isaliteral{28}{\isacharparenleft}}{\isaliteral{5C3C666F72616C6C3E}{\isasymforall}}p{\isaliteral{2E}{\isachardot}}\ }{\isaliteral{28}{\isacharparenleft}}{\isaliteral{5C3C6578697374733E}{\isasymexists}}i{\isaliteral{2E}{\isachardot}}\ p\ i\ {\isaliteral{5C3C696E3E}{\isasymin}}\ A{\isaliteral{29}{\isacharparenright}}{\isaliteral{29}{\isacharparenright}}{\isaliteral{3B}{\isacharsemicolon}}\isanewline
  10.161 -\isaindent{\ {\isadigit{1}}{\isaliteral{2E}{\isachardot}}\ {\isaliteral{5C3C416E643E}{\isasymAnd}}p{\isaliteral{2E}{\isachardot}}\ \ }{\isaliteral{5C3C666F72616C6C3E}{\isasymforall}}i{\isaliteral{2E}{\isachardot}}\ {\isaliteral{28}{\isacharparenleft}}p\ i{\isaliteral{2C}{\isacharcomma}}\ p\ {\isaliteral{28}{\isacharparenleft}}Suc\ i{\isaliteral{29}{\isacharparenright}}{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C696E3E}{\isasymin}}\ M{\isaliteral{5C3C726272616B6B3E}{\isasymrbrakk}}\isanewline
  10.162 -\isaindent{\ {\isadigit{1}}{\isaliteral{2E}{\isachardot}}\ {\isaliteral{5C3C416E643E}{\isasymAnd}}p{\isaliteral{2E}{\isachardot}}\ }{\isaliteral{5C3C4C6F6E6772696768746172726F773E}{\isasymLongrightarrow}}\ {\isaliteral{5C3C6578697374733E}{\isasymexists}}i{\isaliteral{2E}{\isachardot}}\ p\ i\ {\isaliteral{5C3C696E3E}{\isasymin}}\ A%
  10.163 -\end{isabelle}
  10.164 -In this remaining case, we set \isa{t} to \isa{p\ {\isadigit{1}}}.
  10.165 -The rest is automatic, which is surprising because it involves
  10.166 -finding the instantiation \isa{{\isaliteral{5C3C6C616D6264613E}{\isasymlambda}}i{\isaliteral{2E}{\isachardot}}\ p\ {\isaliteral{28}{\isacharparenleft}}i\ {\isaliteral{2B}{\isacharplus}}\ {\isadigit{1}}{\isaliteral{29}{\isacharparenright}}}
  10.167 -for \isa{{\isaliteral{5C3C666F72616C6C3E}{\isasymforall}}p}.%
  10.168 -\end{isamarkuptxt}%
  10.169 -\isamarkuptrue%
  10.170 -\isacommand{apply}\isamarkupfalse%
  10.171 -{\isaliteral{28}{\isacharparenleft}}erule{\isaliteral{5F}{\isacharunderscore}}tac\ x\ {\isaliteral{3D}{\isacharequal}}\ {\isaliteral{22}{\isachardoublequoteopen}}p\ {\isadigit{1}}{\isaliteral{22}{\isachardoublequoteclose}}\ \isakeyword{in}\ allE{\isaliteral{29}{\isacharparenright}}\isanewline
  10.172 -\isacommand{apply}\isamarkupfalse%
  10.173 -{\isaliteral{28}{\isacharparenleft}}auto{\isaliteral{29}{\isacharparenright}}\isanewline
  10.174 -\isacommand{done}\isamarkupfalse%
  10.175 -%
  10.176 -\endisatagproof
  10.177 -{\isafoldproof}%
  10.178 -%
  10.179 -\isadelimproof
  10.180 -%
  10.181 -\endisadelimproof
  10.182 -%
  10.183 -\begin{isamarkuptext}%
  10.184 -The opposite inclusion is proved by contradiction: if some state
  10.185 -\isa{s} is not in \isa{lfp\ {\isaliteral{28}{\isacharparenleft}}af\ A{\isaliteral{29}{\isacharparenright}}}, then we can construct an
  10.186 -infinite \isa{A}-avoiding path starting from~\isa{s}. The reason is
  10.187 -that by unfolding \isa{lfp} we find that if \isa{s} is not in
  10.188 -\isa{lfp\ {\isaliteral{28}{\isacharparenleft}}af\ A{\isaliteral{29}{\isacharparenright}}}, then \isa{s} is not in \isa{A} and there is a
  10.189 -direct successor of \isa{s} that is again not in \mbox{\isa{lfp\ {\isaliteral{28}{\isacharparenleft}}af\ A{\isaliteral{29}{\isacharparenright}}}}. Iterating this argument yields the promised infinite
  10.190 -\isa{A}-avoiding path. Let us formalize this sketch.
  10.191 -
  10.192 -The one-step argument in the sketch above
  10.193 -is proved by a variant of contraposition:%
  10.194 -\end{isamarkuptext}%
  10.195 -\isamarkuptrue%
  10.196 -\isacommand{lemma}\isamarkupfalse%
  10.197 -\ not{\isaliteral{5F}{\isacharunderscore}}in{\isaliteral{5F}{\isacharunderscore}}lfp{\isaliteral{5F}{\isacharunderscore}}afD{\isaliteral{3A}{\isacharcolon}}\isanewline
  10.198 -\ {\isaliteral{22}{\isachardoublequoteopen}}s\ {\isaliteral{5C3C6E6F74696E3E}{\isasymnotin}}\ lfp{\isaliteral{28}{\isacharparenleft}}af\ A{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C4C6F6E6772696768746172726F773E}{\isasymLongrightarrow}}\ s\ {\isaliteral{5C3C6E6F74696E3E}{\isasymnotin}}\ A\ {\isaliteral{5C3C616E643E}{\isasymand}}\ {\isaliteral{28}{\isacharparenleft}}{\isaliteral{5C3C6578697374733E}{\isasymexists}}\ t{\isaliteral{2E}{\isachardot}}\ {\isaliteral{28}{\isacharparenleft}}s{\isaliteral{2C}{\isacharcomma}}t{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C696E3E}{\isasymin}}\ M\ {\isaliteral{5C3C616E643E}{\isasymand}}\ t\ {\isaliteral{5C3C6E6F74696E3E}{\isasymnotin}}\ lfp{\isaliteral{28}{\isacharparenleft}}af\ A{\isaliteral{29}{\isacharparenright}}{\isaliteral{29}{\isacharparenright}}{\isaliteral{22}{\isachardoublequoteclose}}\isanewline
  10.199 -%
  10.200 -\isadelimproof
  10.201 -%
  10.202 -\endisadelimproof
  10.203 -%
  10.204 -\isatagproof
  10.205 -\isacommand{apply}\isamarkupfalse%
  10.206 -{\isaliteral{28}{\isacharparenleft}}erule\ contrapos{\isaliteral{5F}{\isacharunderscore}}np{\isaliteral{29}{\isacharparenright}}\isanewline
  10.207 -\isacommand{apply}\isamarkupfalse%
  10.208 -{\isaliteral{28}{\isacharparenleft}}subst\ lfp{\isaliteral{5F}{\isacharunderscore}}unfold{\isaliteral{5B}{\isacharbrackleft}}OF\ mono{\isaliteral{5F}{\isacharunderscore}}af{\isaliteral{5D}{\isacharbrackright}}{\isaliteral{29}{\isacharparenright}}\isanewline
  10.209 -\isacommand{apply}\isamarkupfalse%
  10.210 -{\isaliteral{28}{\isacharparenleft}}simp\ add{\isaliteral{3A}{\isacharcolon}}\ af{\isaliteral{5F}{\isacharunderscore}}def{\isaliteral{29}{\isacharparenright}}\isanewline
  10.211 -\isacommand{done}\isamarkupfalse%
  10.212 -%
  10.213 -\endisatagproof
  10.214 -{\isafoldproof}%
  10.215 -%
  10.216 -\isadelimproof
  10.217 -%
  10.218 -\endisadelimproof
  10.219 -%
  10.220 -\begin{isamarkuptext}%
  10.221 -\noindent
  10.222 -We assume the negation of the conclusion and prove \isa{s\ {\isaliteral{5C3C696E3E}{\isasymin}}\ lfp\ {\isaliteral{28}{\isacharparenleft}}af\ A{\isaliteral{29}{\isacharparenright}}}.
  10.223 -Unfolding \isa{lfp} once and
  10.224 -simplifying with the definition of \isa{af} finishes the proof.
  10.225 -
  10.226 -Now we iterate this process. The following construction of the desired
  10.227 -path is parameterized by a predicate \isa{Q} that should hold along the path:%
  10.228 -\end{isamarkuptext}%
  10.229 -\isamarkuptrue%
  10.230 -\isacommand{primrec}\isamarkupfalse%
  10.231 -\ path\ {\isaliteral{3A}{\isacharcolon}}{\isaliteral{3A}{\isacharcolon}}\ {\isaliteral{22}{\isachardoublequoteopen}}state\ {\isaliteral{5C3C52696768746172726F773E}{\isasymRightarrow}}\ {\isaliteral{28}{\isacharparenleft}}state\ {\isaliteral{5C3C52696768746172726F773E}{\isasymRightarrow}}\ bool{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C52696768746172726F773E}{\isasymRightarrow}}\ {\isaliteral{28}{\isacharparenleft}}nat\ {\isaliteral{5C3C52696768746172726F773E}{\isasymRightarrow}}\ state{\isaliteral{29}{\isacharparenright}}{\isaliteral{22}{\isachardoublequoteclose}}\ \isakeyword{where}\isanewline
  10.232 -{\isaliteral{22}{\isachardoublequoteopen}}path\ s\ Q\ {\isadigit{0}}\ {\isaliteral{3D}{\isacharequal}}\ s{\isaliteral{22}{\isachardoublequoteclose}}\ {\isaliteral{7C}{\isacharbar}}\isanewline
  10.233 -{\isaliteral{22}{\isachardoublequoteopen}}path\ s\ Q\ {\isaliteral{28}{\isacharparenleft}}Suc\ n{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{3D}{\isacharequal}}\ {\isaliteral{28}{\isacharparenleft}}SOME\ t{\isaliteral{2E}{\isachardot}}\ {\isaliteral{28}{\isacharparenleft}}path\ s\ Q\ n{\isaliteral{2C}{\isacharcomma}}t{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C696E3E}{\isasymin}}\ M\ {\isaliteral{5C3C616E643E}{\isasymand}}\ Q\ t{\isaliteral{29}{\isacharparenright}}{\isaliteral{22}{\isachardoublequoteclose}}%
  10.234 -\begin{isamarkuptext}%
  10.235 -\noindent
  10.236 -Element \isa{n\ {\isaliteral{2B}{\isacharplus}}\ {\isadigit{1}}} on this path is some arbitrary successor
  10.237 -\isa{t} of element \isa{n} such that \isa{Q\ t} holds.  Remember that \isa{SOME\ t{\isaliteral{2E}{\isachardot}}\ R\ t}
  10.238 -is some arbitrary but fixed \isa{t} such that \isa{R\ t} holds (see \S\ref{sec:SOME}). Of
  10.239 -course, such a \isa{t} need not exist, but that is of no
  10.240 -concern to us since we will only use \isa{path} when a
  10.241 -suitable \isa{t} does exist.
  10.242 -
  10.243 -Let us show that if each state \isa{s} that satisfies \isa{Q}
  10.244 -has a successor that again satisfies \isa{Q}, then there exists an infinite \isa{Q}-path:%
  10.245 -\end{isamarkuptext}%
  10.246 -\isamarkuptrue%
  10.247 -\isacommand{lemma}\isamarkupfalse%
  10.248 -\ infinity{\isaliteral{5F}{\isacharunderscore}}lemma{\isaliteral{3A}{\isacharcolon}}\isanewline
  10.249 -\ \ {\isaliteral{22}{\isachardoublequoteopen}}{\isaliteral{5C3C6C6272616B6B3E}{\isasymlbrakk}}\ Q\ s{\isaliteral{3B}{\isacharsemicolon}}\ {\isaliteral{5C3C666F72616C6C3E}{\isasymforall}}s{\isaliteral{2E}{\isachardot}}\ Q\ s\ {\isaliteral{5C3C6C6F6E6772696768746172726F773E}{\isasymlongrightarrow}}\ {\isaliteral{28}{\isacharparenleft}}{\isaliteral{5C3C6578697374733E}{\isasymexists}}\ t{\isaliteral{2E}{\isachardot}}\ {\isaliteral{28}{\isacharparenleft}}s{\isaliteral{2C}{\isacharcomma}}t{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C696E3E}{\isasymin}}\ M\ {\isaliteral{5C3C616E643E}{\isasymand}}\ Q\ t{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C726272616B6B3E}{\isasymrbrakk}}\ {\isaliteral{5C3C4C6F6E6772696768746172726F773E}{\isasymLongrightarrow}}\isanewline
  10.250 -\ \ \ {\isaliteral{5C3C6578697374733E}{\isasymexists}}p{\isaliteral{5C3C696E3E}{\isasymin}}Paths\ s{\isaliteral{2E}{\isachardot}}\ {\isaliteral{5C3C666F72616C6C3E}{\isasymforall}}i{\isaliteral{2E}{\isachardot}}\ Q{\isaliteral{28}{\isacharparenleft}}p\ i{\isaliteral{29}{\isacharparenright}}{\isaliteral{22}{\isachardoublequoteclose}}%
  10.251 -\isadelimproof
  10.252 -%
  10.253 -\endisadelimproof
  10.254 -%
  10.255 -\isatagproof
  10.256 -%
  10.257 -\begin{isamarkuptxt}%
  10.258 -\noindent
  10.259 -First we rephrase the conclusion slightly because we need to prove simultaneously
  10.260 -both the path property and the fact that \isa{Q} holds:%
  10.261 -\end{isamarkuptxt}%
  10.262 -\isamarkuptrue%
  10.263 -\isacommand{apply}\isamarkupfalse%
  10.264 -{\isaliteral{28}{\isacharparenleft}}subgoal{\isaliteral{5F}{\isacharunderscore}}tac\isanewline
  10.265 -\ \ {\isaliteral{22}{\isachardoublequoteopen}}{\isaliteral{5C3C6578697374733E}{\isasymexists}}p{\isaliteral{2E}{\isachardot}}\ s\ {\isaliteral{3D}{\isacharequal}}\ p\ {\isadigit{0}}\ {\isaliteral{5C3C616E643E}{\isasymand}}\ {\isaliteral{28}{\isacharparenleft}}{\isaliteral{5C3C666F72616C6C3E}{\isasymforall}}i{\isaliteral{3A}{\isacharcolon}}{\isaliteral{3A}{\isacharcolon}}nat{\isaliteral{2E}{\isachardot}}\ {\isaliteral{28}{\isacharparenleft}}p\ i{\isaliteral{2C}{\isacharcomma}}\ p{\isaliteral{28}{\isacharparenleft}}i{\isaliteral{2B}{\isacharplus}}{\isadigit{1}}{\isaliteral{29}{\isacharparenright}}{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C696E3E}{\isasymin}}\ M\ {\isaliteral{5C3C616E643E}{\isasymand}}\ Q{\isaliteral{28}{\isacharparenleft}}p\ i{\isaliteral{29}{\isacharparenright}}{\isaliteral{29}{\isacharparenright}}{\isaliteral{22}{\isachardoublequoteclose}}{\isaliteral{29}{\isacharparenright}}%
  10.266 -\begin{isamarkuptxt}%
  10.267 -\noindent
  10.268 -From this proposition the original goal follows easily:%
  10.269 -\end{isamarkuptxt}%
  10.270 -\isamarkuptrue%
  10.271 -\ \isacommand{apply}\isamarkupfalse%
  10.272 -{\isaliteral{28}{\isacharparenleft}}simp\ add{\isaliteral{3A}{\isacharcolon}}\ Paths{\isaliteral{5F}{\isacharunderscore}}def{\isaliteral{2C}{\isacharcomma}}\ blast{\isaliteral{29}{\isacharparenright}}%
  10.273 -\begin{isamarkuptxt}%
  10.274 -\noindent
  10.275 -The new subgoal is proved by providing the witness \isa{path\ s\ Q} for \isa{p}:%
  10.276 -\end{isamarkuptxt}%
  10.277 -\isamarkuptrue%
  10.278 -\isacommand{apply}\isamarkupfalse%
  10.279 -{\isaliteral{28}{\isacharparenleft}}rule{\isaliteral{5F}{\isacharunderscore}}tac\ x\ {\isaliteral{3D}{\isacharequal}}\ {\isaliteral{22}{\isachardoublequoteopen}}path\ s\ Q{\isaliteral{22}{\isachardoublequoteclose}}\ \isakeyword{in}\ exI{\isaliteral{29}{\isacharparenright}}\isanewline
  10.280 -\isacommand{apply}\isamarkupfalse%
  10.281 -{\isaliteral{28}{\isacharparenleft}}clarsimp{\isaliteral{29}{\isacharparenright}}%
  10.282 -\begin{isamarkuptxt}%
  10.283 -\noindent
  10.284 -After simplification and clarification, the subgoal has the following form:
  10.285 -\begin{isabelle}%
  10.286 -\ {\isadigit{1}}{\isaliteral{2E}{\isachardot}}\ {\isaliteral{5C3C416E643E}{\isasymAnd}}i{\isaliteral{2E}{\isachardot}}\ {\isaliteral{5C3C6C6272616B6B3E}{\isasymlbrakk}}Q\ s{\isaliteral{3B}{\isacharsemicolon}}\ {\isaliteral{5C3C666F72616C6C3E}{\isasymforall}}s{\isaliteral{2E}{\isachardot}}\ Q\ s\ {\isaliteral{5C3C6C6F6E6772696768746172726F773E}{\isasymlongrightarrow}}\ {\isaliteral{28}{\isacharparenleft}}{\isaliteral{5C3C6578697374733E}{\isasymexists}}t{\isaliteral{2E}{\isachardot}}\ {\isaliteral{28}{\isacharparenleft}}s{\isaliteral{2C}{\isacharcomma}}\ t{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C696E3E}{\isasymin}}\ M\ {\isaliteral{5C3C616E643E}{\isasymand}}\ Q\ t{\isaliteral{29}{\isacharparenright}}{\isaliteral{5C3C726272616B6B3E}{\isasymrbrakk}}\isanewline
  10.287 -\isaindent{\ {\isadigit{1}}{\isaliteral{2E}{\isachardot}}\ {\isaliteral{5C3C416E643E}{\isasymAnd}}i{\isaliteral{2E}{\isachardot}}\ }{\isaliteral{5C3C4C6F6E6772696768746172726F773E}{\isasymLongrightarrow}}\ {\isaliteral{28}{\isacharparenleft}}path\ s\ Q\ i{\isaliteral{2C}{\isacharcomma}}\ SOME\ t{\isaliteral{2E}{\isachardot}}\ {\isaliteral{28}{\isacharparenleft}}path\ s\ Q\ i{\isaliteral{2C}{\isacharcomma}}\ t{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C696E3E}{\isasymin}}\ M\ {\isaliteral{5C3C616E643E}{\isasymand}}\ Q\ t{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C696E3E}{\isasymin}}\ M\ {\isaliteral{5C3C616E643E}{\isasymand}}\isanewline
  10.288 -\isaindent{\ {\isadigit{1}}{\isaliteral{2E}{\isachardot}}\ {\isaliteral{5C3C416E643E}{\isasymAnd}}i{\isaliteral{2E}{\isachardot}}\ {\isaliteral{5C3C4C6F6E6772696768746172726F773E}{\isasymLongrightarrow}}\ }Q\ {\isaliteral{28}{\isacharparenleft}}path\ s\ Q\ i{\isaliteral{29}{\isacharparenright}}%
  10.289 -\end{isabelle}
  10.290 -It invites a proof by induction on \isa{i}:%
  10.291 -\end{isamarkuptxt}%
  10.292 -\isamarkuptrue%
  10.293 -\isacommand{apply}\isamarkupfalse%
  10.294 -{\isaliteral{28}{\isacharparenleft}}induct{\isaliteral{5F}{\isacharunderscore}}tac\ i{\isaliteral{29}{\isacharparenright}}\isanewline
  10.295 -\ \isacommand{apply}\isamarkupfalse%
  10.296 -{\isaliteral{28}{\isacharparenleft}}simp{\isaliteral{29}{\isacharparenright}}%
  10.297 -\begin{isamarkuptxt}%
  10.298 -\noindent
  10.299 -After simplification, the base case boils down to
  10.300 -\begin{isabelle}%
  10.301 -\ {\isadigit{1}}{\isaliteral{2E}{\isachardot}}\ {\isaliteral{5C3C6C6272616B6B3E}{\isasymlbrakk}}Q\ s{\isaliteral{3B}{\isacharsemicolon}}\ {\isaliteral{5C3C666F72616C6C3E}{\isasymforall}}s{\isaliteral{2E}{\isachardot}}\ Q\ s\ {\isaliteral{5C3C6C6F6E6772696768746172726F773E}{\isasymlongrightarrow}}\ {\isaliteral{28}{\isacharparenleft}}{\isaliteral{5C3C6578697374733E}{\isasymexists}}t{\isaliteral{2E}{\isachardot}}\ {\isaliteral{28}{\isacharparenleft}}s{\isaliteral{2C}{\isacharcomma}}\ t{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C696E3E}{\isasymin}}\ M\ {\isaliteral{5C3C616E643E}{\isasymand}}\ Q\ t{\isaliteral{29}{\isacharparenright}}{\isaliteral{5C3C726272616B6B3E}{\isasymrbrakk}}\isanewline
  10.302 -\isaindent{\ {\isadigit{1}}{\isaliteral{2E}{\isachardot}}\ }{\isaliteral{5C3C4C6F6E6772696768746172726F773E}{\isasymLongrightarrow}}\ {\isaliteral{28}{\isacharparenleft}}s{\isaliteral{2C}{\isacharcomma}}\ SOME\ t{\isaliteral{2E}{\isachardot}}\ {\isaliteral{28}{\isacharparenleft}}s{\isaliteral{2C}{\isacharcomma}}\ t{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C696E3E}{\isasymin}}\ M\ {\isaliteral{5C3C616E643E}{\isasymand}}\ Q\ t{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C696E3E}{\isasymin}}\ M%
  10.303 -\end{isabelle}
  10.304 -The conclusion looks exceedingly trivial: after all, \isa{t} is chosen such that \isa{{\isaliteral{28}{\isacharparenleft}}s{\isaliteral{2C}{\isacharcomma}}\ t{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C696E3E}{\isasymin}}\ M}
  10.305 -holds. However, we first have to show that such a \isa{t} actually exists! This reasoning
  10.306 -is embodied in the theorem \isa{someI{\isadigit{2}}{\isaliteral{5F}{\isacharunderscore}}ex}:
  10.307 -\begin{isabelle}%
  10.308 -\ \ \ \ \ {\isaliteral{5C3C6C6272616B6B3E}{\isasymlbrakk}}{\isaliteral{5C3C6578697374733E}{\isasymexists}}a{\isaliteral{2E}{\isachardot}}\ {\isaliteral{3F}{\isacharquery}}P\ a{\isaliteral{3B}{\isacharsemicolon}}\ {\isaliteral{5C3C416E643E}{\isasymAnd}}x{\isaliteral{2E}{\isachardot}}\ {\isaliteral{3F}{\isacharquery}}P\ x\ {\isaliteral{5C3C4C6F6E6772696768746172726F773E}{\isasymLongrightarrow}}\ {\isaliteral{3F}{\isacharquery}}Q\ x{\isaliteral{5C3C726272616B6B3E}{\isasymrbrakk}}\ {\isaliteral{5C3C4C6F6E6772696768746172726F773E}{\isasymLongrightarrow}}\ {\isaliteral{3F}{\isacharquery}}Q\ {\isaliteral{28}{\isacharparenleft}}SOME\ x{\isaliteral{2E}{\isachardot}}\ {\isaliteral{3F}{\isacharquery}}P\ x{\isaliteral{29}{\isacharparenright}}%
  10.309 -\end{isabelle}
  10.310 -When we apply this theorem as an introduction rule, \isa{{\isaliteral{3F}{\isacharquery}}P\ x} becomes
  10.311 -\isa{{\isaliteral{28}{\isacharparenleft}}s{\isaliteral{2C}{\isacharcomma}}\ x{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C696E3E}{\isasymin}}\ M\ {\isaliteral{5C3C616E643E}{\isasymand}}\ Q\ x} and \isa{{\isaliteral{3F}{\isacharquery}}Q\ x} becomes \isa{{\isaliteral{28}{\isacharparenleft}}s{\isaliteral{2C}{\isacharcomma}}\ x{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C696E3E}{\isasymin}}\ M} and we have to prove
  10.312 -two subgoals: \isa{{\isaliteral{5C3C6578697374733E}{\isasymexists}}a{\isaliteral{2E}{\isachardot}}\ {\isaliteral{28}{\isacharparenleft}}s{\isaliteral{2C}{\isacharcomma}}\ a{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C696E3E}{\isasymin}}\ M\ {\isaliteral{5C3C616E643E}{\isasymand}}\ Q\ a}, which follows from the assumptions, and
  10.313 -\isa{{\isaliteral{28}{\isacharparenleft}}s{\isaliteral{2C}{\isacharcomma}}\ x{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C696E3E}{\isasymin}}\ M\ {\isaliteral{5C3C616E643E}{\isasymand}}\ Q\ x\ {\isaliteral{5C3C4C6F6E6772696768746172726F773E}{\isasymLongrightarrow}}\ {\isaliteral{28}{\isacharparenleft}}s{\isaliteral{2C}{\isacharcomma}}\ x{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C696E3E}{\isasymin}}\ M}, which is trivial. Thus it is not surprising that
  10.314 -\isa{fast} can prove the base case quickly:%
  10.315 -\end{isamarkuptxt}%
  10.316 -\isamarkuptrue%
  10.317 -\ \isacommand{apply}\isamarkupfalse%
  10.318 -{\isaliteral{28}{\isacharparenleft}}fast\ intro{\isaliteral{3A}{\isacharcolon}}\ someI{\isadigit{2}}{\isaliteral{5F}{\isacharunderscore}}ex{\isaliteral{29}{\isacharparenright}}%
  10.319 -\begin{isamarkuptxt}%
  10.320 -\noindent
  10.321 -What is worth noting here is that we have used \methdx{fast} rather than
  10.322 -\isa{blast}.  The reason is that \isa{blast} would fail because it cannot
  10.323 -cope with \isa{someI{\isadigit{2}}{\isaliteral{5F}{\isacharunderscore}}ex}: unifying its conclusion with the current
  10.324 -subgoal is non-trivial because of the nested schematic variables. For
  10.325 -efficiency reasons \isa{blast} does not even attempt such unifications.
  10.326 -Although \isa{fast} can in principle cope with complicated unification
  10.327 -problems, in practice the number of unifiers arising is often prohibitive and
  10.328 -the offending rule may need to be applied explicitly rather than
  10.329 -automatically. This is what happens in the step case.
  10.330 -
  10.331 -The induction step is similar, but more involved, because now we face nested
  10.332 -occurrences of \isa{SOME}. As a result, \isa{fast} is no longer able to
  10.333 -solve the subgoal and we apply \isa{someI{\isadigit{2}}{\isaliteral{5F}{\isacharunderscore}}ex} by hand.  We merely
  10.334 -show the proof commands but do not describe the details:%
  10.335 -\end{isamarkuptxt}%
  10.336 -\isamarkuptrue%
  10.337 -\isacommand{apply}\isamarkupfalse%
  10.338 -{\isaliteral{28}{\isacharparenleft}}simp{\isaliteral{29}{\isacharparenright}}\isanewline
  10.339 -\isacommand{apply}\isamarkupfalse%
  10.340 -{\isaliteral{28}{\isacharparenleft}}rule\ someI{\isadigit{2}}{\isaliteral{5F}{\isacharunderscore}}ex{\isaliteral{29}{\isacharparenright}}\isanewline
  10.341 -\ \isacommand{apply}\isamarkupfalse%
  10.342 -{\isaliteral{28}{\isacharparenleft}}blast{\isaliteral{29}{\isacharparenright}}\isanewline
  10.343 -\isacommand{apply}\isamarkupfalse%
  10.344 -{\isaliteral{28}{\isacharparenleft}}rule\ someI{\isadigit{2}}{\isaliteral{5F}{\isacharunderscore}}ex{\isaliteral{29}{\isacharparenright}}\isanewline
  10.345 -\ \isacommand{apply}\isamarkupfalse%
  10.346 -{\isaliteral{28}{\isacharparenleft}}blast{\isaliteral{29}{\isacharparenright}}\isanewline
  10.347 -\isacommand{apply}\isamarkupfalse%
  10.348 -{\isaliteral{28}{\isacharparenleft}}blast{\isaliteral{29}{\isacharparenright}}\isanewline
  10.349 -\isacommand{done}\isamarkupfalse%
  10.350 -%
  10.351 -\endisatagproof
  10.352 -{\isafoldproof}%
  10.353 -%
  10.354 -\isadelimproof
  10.355 -%
  10.356 -\endisadelimproof
  10.357 -%
  10.358 -\begin{isamarkuptext}%
  10.359 -Function \isa{path} has fulfilled its purpose now and can be forgotten.
  10.360 -It was merely defined to provide the witness in the proof of the
  10.361 -\isa{infinity{\isaliteral{5F}{\isacharunderscore}}lemma}. Aficionados of minimal proofs might like to know
  10.362 -that we could have given the witness without having to define a new function:
  10.363 -the term
  10.364 -\begin{isabelle}%
  10.365 -\ \ \ \ \ nat{\isaliteral{5F}{\isacharunderscore}}rec\ s\ {\isaliteral{28}{\isacharparenleft}}{\isaliteral{5C3C6C616D6264613E}{\isasymlambda}}n\ t{\isaliteral{2E}{\isachardot}}\ SOME\ u{\isaliteral{2E}{\isachardot}}\ {\isaliteral{28}{\isacharparenleft}}t{\isaliteral{2C}{\isacharcomma}}\ u{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C696E3E}{\isasymin}}\ M\ {\isaliteral{5C3C616E643E}{\isasymand}}\ Q\ u{\isaliteral{29}{\isacharparenright}}%
  10.366 -\end{isabelle}
  10.367 -is extensionally equal to \isa{path\ s\ Q},
  10.368 -where \isa{nat{\isaliteral{5F}{\isacharunderscore}}rec} is the predefined primitive recursor on \isa{nat}.%
  10.369 -\end{isamarkuptext}%
  10.370 -\isamarkuptrue%
  10.371 -%
  10.372 -\isadelimproof
  10.373 -%
  10.374 -\endisadelimproof
  10.375 -%
  10.376 -\isatagproof
  10.377 -%
  10.378 -\endisatagproof
  10.379 -{\isafoldproof}%
  10.380 -%
  10.381 -\isadelimproof
  10.382 -%
  10.383 -\endisadelimproof
  10.384 -%
  10.385 -\begin{isamarkuptext}%
  10.386 -At last we can prove the opposite direction of \isa{AF{\isaliteral{5F}{\isacharunderscore}}lemma{\isadigit{1}}}:%
  10.387 -\end{isamarkuptext}%
  10.388 -\isamarkuptrue%
  10.389 -\isacommand{theorem}\isamarkupfalse%
  10.390 -\ AF{\isaliteral{5F}{\isacharunderscore}}lemma{\isadigit{2}}{\isaliteral{3A}{\isacharcolon}}\ {\isaliteral{22}{\isachardoublequoteopen}}{\isaliteral{7B}{\isacharbraceleft}}s{\isaliteral{2E}{\isachardot}}\ {\isaliteral{5C3C666F72616C6C3E}{\isasymforall}}p\ {\isaliteral{5C3C696E3E}{\isasymin}}\ Paths\ s{\isaliteral{2E}{\isachardot}}\ {\isaliteral{5C3C6578697374733E}{\isasymexists}}i{\isaliteral{2E}{\isachardot}}\ p\ i\ {\isaliteral{5C3C696E3E}{\isasymin}}\ A{\isaliteral{7D}{\isacharbraceright}}\ {\isaliteral{5C3C73756273657465713E}{\isasymsubseteq}}\ lfp{\isaliteral{28}{\isacharparenleft}}af\ A{\isaliteral{29}{\isacharparenright}}{\isaliteral{22}{\isachardoublequoteclose}}%
  10.391 -\isadelimproof
  10.392 -%
  10.393 -\endisadelimproof
  10.394 -%
  10.395 -\isatagproof
  10.396 -%
  10.397 -\begin{isamarkuptxt}%
  10.398 -\noindent
  10.399 -The proof is again pointwise and then by contraposition:%
  10.400 -\end{isamarkuptxt}%
  10.401 -\isamarkuptrue%
  10.402 -\isacommand{apply}\isamarkupfalse%
  10.403 -{\isaliteral{28}{\isacharparenleft}}rule\ subsetI{\isaliteral{29}{\isacharparenright}}\isanewline
  10.404 -\isacommand{apply}\isamarkupfalse%
  10.405 -{\isaliteral{28}{\isacharparenleft}}erule\ contrapos{\isaliteral{5F}{\isacharunderscore}}pp{\isaliteral{29}{\isacharparenright}}\isanewline
  10.406 -\isacommand{apply}\isamarkupfalse%
  10.407 -\ simp%
  10.408 -\begin{isamarkuptxt}%
  10.409 -\begin{isabelle}%
  10.410 -\ {\isadigit{1}}{\isaliteral{2E}{\isachardot}}\ {\isaliteral{5C3C416E643E}{\isasymAnd}}x{\isaliteral{2E}{\isachardot}}\ x\ {\isaliteral{5C3C6E6F74696E3E}{\isasymnotin}}\ lfp\ {\isaliteral{28}{\isacharparenleft}}af\ A{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C4C6F6E6772696768746172726F773E}{\isasymLongrightarrow}}\ {\isaliteral{5C3C6578697374733E}{\isasymexists}}p{\isaliteral{5C3C696E3E}{\isasymin}}Paths\ x{\isaliteral{2E}{\isachardot}}\ {\isaliteral{5C3C666F72616C6C3E}{\isasymforall}}i{\isaliteral{2E}{\isachardot}}\ p\ i\ {\isaliteral{5C3C6E6F74696E3E}{\isasymnotin}}\ A%
  10.411 -\end{isabelle}
  10.412 -Applying the \isa{infinity{\isaliteral{5F}{\isacharunderscore}}lemma} as a destruction rule leaves two subgoals, the second
  10.413 -premise of \isa{infinity{\isaliteral{5F}{\isacharunderscore}}lemma} and the original subgoal:%
  10.414 -\end{isamarkuptxt}%
  10.415 -\isamarkuptrue%
  10.416 -\isacommand{apply}\isamarkupfalse%
  10.417 -{\isaliteral{28}{\isacharparenleft}}drule\ infinity{\isaliteral{5F}{\isacharunderscore}}lemma{\isaliteral{29}{\isacharparenright}}%
  10.418 -\begin{isamarkuptxt}%
  10.419 -\begin{isabelle}%
  10.420 -\ {\isadigit{1}}{\isaliteral{2E}{\isachardot}}\ {\isaliteral{5C3C416E643E}{\isasymAnd}}x{\isaliteral{2E}{\isachardot}}\ {\isaliteral{5C3C666F72616C6C3E}{\isasymforall}}s{\isaliteral{2E}{\isachardot}}\ s\ {\isaliteral{5C3C6E6F74696E3E}{\isasymnotin}}\ lfp\ {\isaliteral{28}{\isacharparenleft}}af\ A{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C6C6F6E6772696768746172726F773E}{\isasymlongrightarrow}}\ {\isaliteral{28}{\isacharparenleft}}{\isaliteral{5C3C6578697374733E}{\isasymexists}}t{\isaliteral{2E}{\isachardot}}\ {\isaliteral{28}{\isacharparenleft}}s{\isaliteral{2C}{\isacharcomma}}\ t{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C696E3E}{\isasymin}}\ M\ {\isaliteral{5C3C616E643E}{\isasymand}}\ t\ {\isaliteral{5C3C6E6F74696E3E}{\isasymnotin}}\ lfp\ {\isaliteral{28}{\isacharparenleft}}af\ A{\isaliteral{29}{\isacharparenright}}{\isaliteral{29}{\isacharparenright}}\isanewline
  10.421 -\ {\isadigit{2}}{\isaliteral{2E}{\isachardot}}\ {\isaliteral{5C3C416E643E}{\isasymAnd}}x{\isaliteral{2E}{\isachardot}}\ {\isaliteral{5C3C6578697374733E}{\isasymexists}}p{\isaliteral{5C3C696E3E}{\isasymin}}Paths\ x{\isaliteral{2E}{\isachardot}}\ {\isaliteral{5C3C666F72616C6C3E}{\isasymforall}}i{\isaliteral{2E}{\isachardot}}\ p\ i\ {\isaliteral{5C3C6E6F74696E3E}{\isasymnotin}}\ lfp\ {\isaliteral{28}{\isacharparenleft}}af\ A{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C4C6F6E6772696768746172726F773E}{\isasymLongrightarrow}}\isanewline
  10.422 -\isaindent{\ {\isadigit{2}}{\isaliteral{2E}{\isachardot}}\ {\isaliteral{5C3C416E643E}{\isasymAnd}}x{\isaliteral{2E}{\isachardot}}\ }{\isaliteral{5C3C6578697374733E}{\isasymexists}}p{\isaliteral{5C3C696E3E}{\isasymin}}Paths\ x{\isaliteral{2E}{\isachardot}}\ {\isaliteral{5C3C666F72616C6C3E}{\isasymforall}}i{\isaliteral{2E}{\isachardot}}\ p\ i\ {\isaliteral{5C3C6E6F74696E3E}{\isasymnotin}}\ A%
  10.423 -\end{isabelle}
  10.424 -Both are solved automatically:%
  10.425 -\end{isamarkuptxt}%
  10.426 -\isamarkuptrue%
  10.427 -\ \isacommand{apply}\isamarkupfalse%
  10.428 -{\isaliteral{28}{\isacharparenleft}}auto\ dest{\isaliteral{3A}{\isacharcolon}}\ not{\isaliteral{5F}{\isacharunderscore}}in{\isaliteral{5F}{\isacharunderscore}}lfp{\isaliteral{5F}{\isacharunderscore}}afD{\isaliteral{29}{\isacharparenright}}\isanewline
  10.429 -\isacommand{done}\isamarkupfalse%
  10.430 -%
  10.431 -\endisatagproof
  10.432 -{\isafoldproof}%
  10.433 -%
  10.434 -\isadelimproof
  10.435 -%
  10.436 -\endisadelimproof
  10.437 -%
  10.438 -\begin{isamarkuptext}%
  10.439 -If you find these proofs too complicated, we recommend that you read
  10.440 -\S\ref{sec:CTL-revisited}, where we show how inductive definitions lead to
  10.441 -simpler arguments.
  10.442 -
  10.443 -The main theorem is proved as for PDL, except that we also derive the
  10.444 -necessary equality \isa{lfp{\isaliteral{28}{\isacharparenleft}}af\ A{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{3D}{\isacharequal}}\ {\isaliteral{2E}{\isachardot}}{\isaliteral{2E}{\isachardot}}{\isaliteral{2E}{\isachardot}}} by combining
  10.445 -\isa{AF{\isaliteral{5F}{\isacharunderscore}}lemma{\isadigit{1}}} and \isa{AF{\isaliteral{5F}{\isacharunderscore}}lemma{\isadigit{2}}} on the spot:%
  10.446 -\end{isamarkuptext}%
  10.447 -\isamarkuptrue%
  10.448 -\isacommand{theorem}\isamarkupfalse%
  10.449 -\ {\isaliteral{22}{\isachardoublequoteopen}}mc\ f\ {\isaliteral{3D}{\isacharequal}}\ {\isaliteral{7B}{\isacharbraceleft}}s{\isaliteral{2E}{\isachardot}}\ s\ {\isaliteral{5C3C5475726E7374696C653E}{\isasymTurnstile}}\ f{\isaliteral{7D}{\isacharbraceright}}{\isaliteral{22}{\isachardoublequoteclose}}\isanewline
  10.450 -%
  10.451 -\isadelimproof
  10.452 -%
  10.453 -\endisadelimproof
  10.454 -%
  10.455 -\isatagproof
  10.456 -\isacommand{apply}\isamarkupfalse%
  10.457 -{\isaliteral{28}{\isacharparenleft}}induct{\isaliteral{5F}{\isacharunderscore}}tac\ f{\isaliteral{29}{\isacharparenright}}\isanewline
  10.458 -\isacommand{apply}\isamarkupfalse%
  10.459 -{\isaliteral{28}{\isacharparenleft}}auto\ simp\ add{\isaliteral{3A}{\isacharcolon}}\ EF{\isaliteral{5F}{\isacharunderscore}}lemma\ equalityI{\isaliteral{5B}{\isacharbrackleft}}OF\ AF{\isaliteral{5F}{\isacharunderscore}}lemma{\isadigit{1}}\ AF{\isaliteral{5F}{\isacharunderscore}}lemma{\isadigit{2}}{\isaliteral{5D}{\isacharbrackright}}{\isaliteral{29}{\isacharparenright}}\isanewline
  10.460 -\isacommand{done}\isamarkupfalse%
  10.461 -%
  10.462 -\endisatagproof
  10.463 -{\isafoldproof}%
  10.464 -%
  10.465 -\isadelimproof
  10.466 -%
  10.467 -\endisadelimproof
  10.468 -%
  10.469 -\begin{isamarkuptext}%
  10.470 -The language defined above is not quite CTL\@. The latter also includes an
  10.471 -until-operator \isa{EU\ f\ g} with semantics ``there \emph{E}xists a path
  10.472 -where \isa{f} is true \emph{U}ntil \isa{g} becomes true''.  We need
  10.473 -an auxiliary function:%
  10.474 -\end{isamarkuptext}%
  10.475 -\isamarkuptrue%
  10.476 -\isacommand{primrec}\isamarkupfalse%
  10.477 -\isanewline
  10.478 -until{\isaliteral{3A}{\isacharcolon}}{\isaliteral{3A}{\isacharcolon}}\ {\isaliteral{22}{\isachardoublequoteopen}}state\ set\ {\isaliteral{5C3C52696768746172726F773E}{\isasymRightarrow}}\ state\ set\ {\isaliteral{5C3C52696768746172726F773E}{\isasymRightarrow}}\ state\ {\isaliteral{5C3C52696768746172726F773E}{\isasymRightarrow}}\ state\ list\ {\isaliteral{5C3C52696768746172726F773E}{\isasymRightarrow}}\ bool{\isaliteral{22}{\isachardoublequoteclose}}\ \isakeyword{where}\isanewline
  10.479 -{\isaliteral{22}{\isachardoublequoteopen}}until\ A\ B\ s\ {\isaliteral{5B}{\isacharbrackleft}}{\isaliteral{5D}{\isacharbrackright}}\ \ \ \ {\isaliteral{3D}{\isacharequal}}\ {\isaliteral{28}{\isacharparenleft}}s\ {\isaliteral{5C3C696E3E}{\isasymin}}\ B{\isaliteral{29}{\isacharparenright}}{\isaliteral{22}{\isachardoublequoteclose}}\ {\isaliteral{7C}{\isacharbar}}\isanewline
  10.480 -{\isaliteral{22}{\isachardoublequoteopen}}until\ A\ B\ s\ {\isaliteral{28}{\isacharparenleft}}t{\isaliteral{23}{\isacharhash}}p{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{3D}{\isacharequal}}\ {\isaliteral{28}{\isacharparenleft}}s\ {\isaliteral{5C3C696E3E}{\isasymin}}\ A\ {\isaliteral{5C3C616E643E}{\isasymand}}\ {\isaliteral{28}{\isacharparenleft}}s{\isaliteral{2C}{\isacharcomma}}t{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C696E3E}{\isasymin}}\ M\ {\isaliteral{5C3C616E643E}{\isasymand}}\ until\ A\ B\ t\ p{\isaliteral{29}{\isacharparenright}}{\isaliteral{22}{\isachardoublequoteclose}}%
  10.481 -\begin{isamarkuptext}%
  10.482 -\noindent
  10.483 -Expressing the semantics of \isa{EU} is now straightforward:
  10.484 -\begin{isabelle}%
  10.485 -\ \ \ \ \ s\ {\isaliteral{5C3C5475726E7374696C653E}{\isasymTurnstile}}\ EU\ f\ g\ {\isaliteral{3D}{\isacharequal}}\ {\isaliteral{28}{\isacharparenleft}}{\isaliteral{5C3C6578697374733E}{\isasymexists}}p{\isaliteral{2E}{\isachardot}}\ until\ {\isaliteral{7B}{\isacharbraceleft}}t{\isaliteral{2E}{\isachardot}}\ t\ {\isaliteral{5C3C5475726E7374696C653E}{\isasymTurnstile}}\ f{\isaliteral{7D}{\isacharbraceright}}\ {\isaliteral{7B}{\isacharbraceleft}}t{\isaliteral{2E}{\isachardot}}\ t\ {\isaliteral{5C3C5475726E7374696C653E}{\isasymTurnstile}}\ g{\isaliteral{7D}{\isacharbraceright}}\ s\ p{\isaliteral{29}{\isacharparenright}}%
  10.486 -\end{isabelle}
  10.487 -Note that \isa{EU} is not definable in terms of the other operators!
  10.488 -
  10.489 -Model checking \isa{EU} is again a least fixed point construction:
  10.490 -\begin{isabelle}%
  10.491 -\ \ \ \ \ mc{\isaliteral{28}{\isacharparenleft}}EU\ f\ g{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{3D}{\isacharequal}}\ lfp{\isaliteral{28}{\isacharparenleft}}{\isaliteral{5C3C6C616D6264613E}{\isasymlambda}}T{\isaliteral{2E}{\isachardot}}\ mc\ g\ {\isaliteral{5C3C756E696F6E3E}{\isasymunion}}\ mc\ f\ {\isaliteral{5C3C696E7465723E}{\isasyminter}}\ {\isaliteral{28}{\isacharparenleft}}M{\isaliteral{5C3C696E76657273653E}{\isasyminverse}}\ {\isaliteral{60}{\isacharbackquote}}{\isaliteral{60}{\isacharbackquote}}\ T{\isaliteral{29}{\isacharparenright}}{\isaliteral{29}{\isacharparenright}}%
  10.492 -\end{isabelle}
  10.493 -
  10.494 -\begin{exercise}
  10.495 -Extend the datatype of formulae by the above until operator
  10.496 -and prove the equivalence between semantics and model checking, i.e.\ that
  10.497 -\begin{isabelle}%
  10.498 -\ \ \ \ \ mc\ {\isaliteral{28}{\isacharparenleft}}EU\ f\ g{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{3D}{\isacharequal}}\ {\isaliteral{7B}{\isacharbraceleft}}s{\isaliteral{2E}{\isachardot}}\ s\ {\isaliteral{5C3C5475726E7374696C653E}{\isasymTurnstile}}\ EU\ f\ g{\isaliteral{7D}{\isacharbraceright}}%
  10.499 -\end{isabelle}
  10.500 -%For readability you may want to annotate {term EU} with its customary syntax
  10.501 -%{text[display]"| EU formula formula    E[_ U _]"}
  10.502 -%which enables you to read and write {text"E[f U g]"} instead of {term"EU f g"}.
  10.503 -\end{exercise}
  10.504 -For more CTL exercises see, for example, Huth and Ryan \cite{Huth-Ryan-book}.%
  10.505 -\end{isamarkuptext}%
  10.506 -\isamarkuptrue%
  10.507 -%
  10.508 -\isadelimproof
  10.509 -%
  10.510 -\endisadelimproof
  10.511 -%
  10.512 -\isatagproof
  10.513 -%
  10.514 -\endisatagproof
  10.515 -{\isafoldproof}%
  10.516 -%
  10.517 -\isadelimproof
  10.518 -%
  10.519 -\endisadelimproof
  10.520 -%
  10.521 -\isadelimproof
  10.522 -%
  10.523 -\endisadelimproof
  10.524 -%
  10.525 -\isatagproof
  10.526 -%
  10.527 -\endisatagproof
  10.528 -{\isafoldproof}%
  10.529 -%
  10.530 -\isadelimproof
  10.531 -%
  10.532 -\endisadelimproof
  10.533 -%
  10.534 -\isadelimproof
  10.535 -%
  10.536 -\endisadelimproof
  10.537 -%
  10.538 -\isatagproof
  10.539 -%
  10.540 -\endisatagproof
  10.541 -{\isafoldproof}%
  10.542 -%
  10.543 -\isadelimproof
  10.544 -%
  10.545 -\endisadelimproof
  10.546 -%
  10.547 -\begin{isamarkuptext}%
  10.548 -Let us close this section with a few words about the executability of
  10.549 -our model checkers.  It is clear that if all sets are finite, they can be
  10.550 -represented as lists and the usual set operations are easily
  10.551 -implemented. Only \isa{lfp} requires a little thought.  Fortunately, theory
  10.552 -\isa{While{\isaliteral{5F}{\isacharunderscore}}Combinator} in the Library~\cite{HOL-Library} provides a
  10.553 -theorem stating that in the case of finite sets and a monotone
  10.554 -function~\isa{F}, the value of \mbox{\isa{lfp\ F}} can be computed by
  10.555 -iterated application of \isa{F} to~\isa{{\isaliteral{7B}{\isacharbraceleft}}{\isaliteral{7D}{\isacharbraceright}}} until a fixed point is
  10.556 -reached. It is actually possible to generate executable functional programs
  10.557 -from HOL definitions, but that is beyond the scope of the tutorial.%
  10.558 -\index{CTL|)}%
  10.559 -\end{isamarkuptext}%
  10.560 -\isamarkuptrue%
  10.561 -%
  10.562 -\isadelimtheory
  10.563 -%
  10.564 -\endisadelimtheory
  10.565 -%
  10.566 -\isatagtheory
  10.567 -%
  10.568 -\endisatagtheory
  10.569 -{\isafoldtheory}%
  10.570 -%
  10.571 -\isadelimtheory
  10.572 -%
  10.573 -\endisadelimtheory
  10.574 -\end{isabellebody}%
  10.575 -%%% Local Variables:
  10.576 -%%% mode: latex
  10.577 -%%% TeX-master: "root"
  10.578 -%%% End:

    11.1 --- a/doc-src/TutorialI/CTL/document/CTLind.tex	Thu Jul 26 16:08:16 2012 +0200
    11.2 +++ /dev/null	Thu Jan 01 00:00:00 1970 +0000
    11.3 @@ -1,252 +0,0 @@
    11.4 -%
    11.5 -\begin{isabellebody}%
    11.6 -\def\isabellecontext{CTLind}%
    11.7 -%
    11.8 -\isadelimtheory
    11.9 -%
   11.10 -\endisadelimtheory
   11.11 -%
   11.12 -\isatagtheory
   11.13 -%
   11.14 -\endisatagtheory
   11.15 -{\isafoldtheory}%
   11.16 -%
   11.17 -\isadelimtheory
   11.18 -%
   11.19 -\endisadelimtheory
   11.20 -%
   11.21 -\isamarkupsubsection{CTL Revisited%
   11.22 -}
   11.23 -\isamarkuptrue%
   11.24 -%
   11.25 -\begin{isamarkuptext}%
   11.26 -\label{sec:CTL-revisited}
   11.27 -\index{CTL|(}%
   11.28 -The purpose of this section is twofold: to demonstrate
   11.29 -some of the induction principles and heuristics discussed above and to
   11.30 -show how inductive definitions can simplify proofs.
   11.31 -In \S\ref{sec:CTL} we gave a fairly involved proof of the correctness of a
   11.32 -model checker for CTL\@. In particular the proof of the
   11.33 -\isa{infinity{\isaliteral{5F}{\isacharunderscore}}lemma} on the way to \isa{AF{\isaliteral{5F}{\isacharunderscore}}lemma{\isadigit{2}}} is not as
   11.34 -simple as one might expect, due to the \isa{SOME} operator
   11.35 -involved. Below we give a simpler proof of \isa{AF{\isaliteral{5F}{\isacharunderscore}}lemma{\isadigit{2}}}
   11.36 -based on an auxiliary inductive definition.
   11.37 -
   11.38 -Let us call a (finite or infinite) path \emph{\isa{A}-avoiding} if it does
   11.39 -not touch any node in the set \isa{A}. Then \isa{AF{\isaliteral{5F}{\isacharunderscore}}lemma{\isadigit{2}}} says
   11.40 -that if no infinite path from some state \isa{s} is \isa{A}-avoiding,
   11.41 -then \isa{s\ {\isaliteral{5C3C696E3E}{\isasymin}}\ lfp\ {\isaliteral{28}{\isacharparenleft}}af\ A{\isaliteral{29}{\isacharparenright}}}. We prove this by inductively defining the set
   11.42 -\isa{Avoid\ s\ A} of states reachable from \isa{s} by a finite \isa{A}-avoiding path:
   11.43 -% Second proof of opposite direction, directly by well-founded induction
   11.44 -% on the initial segment of M that avoids A.%
   11.45 -\end{isamarkuptext}%
   11.46 -\isamarkuptrue%
   11.47 -\isacommand{inductive{\isaliteral{5F}{\isacharunderscore}}set}\isamarkupfalse%
   11.48 -\isanewline
   11.49 -\ \ Avoid\ {\isaliteral{3A}{\isacharcolon}}{\isaliteral{3A}{\isacharcolon}}\ {\isaliteral{22}{\isachardoublequoteopen}}state\ {\isaliteral{5C3C52696768746172726F773E}{\isasymRightarrow}}\ state\ set\ {\isaliteral{5C3C52696768746172726F773E}{\isasymRightarrow}}\ state\ set{\isaliteral{22}{\isachardoublequoteclose}}\isanewline
   11.50 -\ \ \isakeyword{for}\ s\ {\isaliteral{3A}{\isacharcolon}}{\isaliteral{3A}{\isacharcolon}}\ state\ \isakeyword{and}\ A\ {\isaliteral{3A}{\isacharcolon}}{\isaliteral{3A}{\isacharcolon}}\ {\isaliteral{22}{\isachardoublequoteopen}}state\ set{\isaliteral{22}{\isachardoublequoteclose}}\isanewline
   11.51 -\isakeyword{where}\isanewline
   11.52 -\ \ \ \ {\isaliteral{22}{\isachardoublequoteopen}}s\ {\isaliteral{5C3C696E3E}{\isasymin}}\ Avoid\ s\ A{\isaliteral{22}{\isachardoublequoteclose}}\isanewline
   11.53 -\ \ {\isaliteral{7C}{\isacharbar}}\ {\isaliteral{22}{\isachardoublequoteopen}}{\isaliteral{5C3C6C6272616B6B3E}{\isasymlbrakk}}\ t\ {\isaliteral{5C3C696E3E}{\isasymin}}\ Avoid\ s\ A{\isaliteral{3B}{\isacharsemicolon}}\ t\ {\isaliteral{5C3C6E6F74696E3E}{\isasymnotin}}\ A{\isaliteral{3B}{\isacharsemicolon}}\ {\isaliteral{28}{\isacharparenleft}}t{\isaliteral{2C}{\isacharcomma}}u{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C696E3E}{\isasymin}}\ M\ {\isaliteral{5C3C726272616B6B3E}{\isasymrbrakk}}\ {\isaliteral{5C3C4C6F6E6772696768746172726F773E}{\isasymLongrightarrow}}\ u\ {\isaliteral{5C3C696E3E}{\isasymin}}\ Avoid\ s\ A{\isaliteral{22}{\isachardoublequoteclose}}%
   11.54 -\begin{isamarkuptext}%
   11.55 -It is easy to see that for any infinite \isa{A}-avoiding path \isa{f}
   11.56 -with \isa{f\ {\isadigit{0}}\ {\isaliteral{5C3C696E3E}{\isasymin}}\ Avoid\ s\ A} there is an infinite \isa{A}-avoiding path
   11.57 -starting with \isa{s} because (by definition of \isa{Avoid}) there is a
   11.58 -finite \isa{A}-avoiding path from \isa{s} to \isa{f\ {\isadigit{0}}}.
   11.59 -The proof is by induction on \isa{f\ {\isadigit{0}}\ {\isaliteral{5C3C696E3E}{\isasymin}}\ Avoid\ s\ A}. However,
   11.60 -this requires the following
   11.61 -reformulation, as explained in \S\ref{sec:ind-var-in-prems} above;
   11.62 -the \isa{rule{\isaliteral{5F}{\isacharunderscore}}format} directive undoes the reformulation after the proof.%
   11.63 -\end{isamarkuptext}%
   11.64 -\isamarkuptrue%
   11.65 -\isacommand{lemma}\isamarkupfalse%
   11.66 -\ ex{\isaliteral{5F}{\isacharunderscore}}infinite{\isaliteral{5F}{\isacharunderscore}}path{\isaliteral{5B}{\isacharbrackleft}}rule{\isaliteral{5F}{\isacharunderscore}}format{\isaliteral{5D}{\isacharbrackright}}{\isaliteral{3A}{\isacharcolon}}\isanewline
   11.67 -\ \ {\isaliteral{22}{\isachardoublequoteopen}}t\ {\isaliteral{5C3C696E3E}{\isasymin}}\ Avoid\ s\ A\ \ {\isaliteral{5C3C4C6F6E6772696768746172726F773E}{\isasymLongrightarrow}}\isanewline
   11.68 -\ \ \ {\isaliteral{5C3C666F72616C6C3E}{\isasymforall}}f{\isaliteral{5C3C696E3E}{\isasymin}}Paths\ t{\isaliteral{2E}{\isachardot}}\ {\isaliteral{28}{\isacharparenleft}}{\isaliteral{5C3C666F72616C6C3E}{\isasymforall}}i{\isaliteral{2E}{\isachardot}}\ f\ i\ {\isaliteral{5C3C6E6F74696E3E}{\isasymnotin}}\ A{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C6C6F6E6772696768746172726F773E}{\isasymlongrightarrow}}\ {\isaliteral{28}{\isacharparenleft}}{\isaliteral{5C3C6578697374733E}{\isasymexists}}p{\isaliteral{5C3C696E3E}{\isasymin}}Paths\ s{\isaliteral{2E}{\isachardot}}\ {\isaliteral{5C3C666F72616C6C3E}{\isasymforall}}i{\isaliteral{2E}{\isachardot}}\ p\ i\ {\isaliteral{5C3C6E6F74696E3E}{\isasymnotin}}\ A{\isaliteral{29}{\isacharparenright}}{\isaliteral{22}{\isachardoublequoteclose}}\isanewline
   11.69 -%
   11.70 -\isadelimproof
   11.71 -%
   11.72 -\endisadelimproof
   11.73 -%
   11.74 -\isatagproof
   11.75 -\isacommand{apply}\isamarkupfalse%
   11.76 -{\isaliteral{28}{\isacharparenleft}}erule\ Avoid{\isaliteral{2E}{\isachardot}}induct{\isaliteral{29}{\isacharparenright}}\isanewline
   11.77 -\ \isacommand{apply}\isamarkupfalse%
   11.78 -{\isaliteral{28}{\isacharparenleft}}blast{\isaliteral{29}{\isacharparenright}}\isanewline
   11.79 -\isacommand{apply}\isamarkupfalse%
   11.80 -{\isaliteral{28}{\isacharparenleft}}clarify{\isaliteral{29}{\isacharparenright}}\isanewline
   11.81 -\isacommand{apply}\isamarkupfalse%
   11.82 -{\isaliteral{28}{\isacharparenleft}}drule{\isaliteral{5F}{\isacharunderscore}}tac\ x\ {\isaliteral{3D}{\isacharequal}}\ {\isaliteral{22}{\isachardoublequoteopen}}{\isaliteral{5C3C6C616D6264613E}{\isasymlambda}}i{\isaliteral{2E}{\isachardot}}\ case\ i\ of\ {\isadigit{0}}\ {\isaliteral{5C3C52696768746172726F773E}{\isasymRightarrow}}\ t\ {\isaliteral{7C}{\isacharbar}}\ Suc\ i\ {\isaliteral{5C3C52696768746172726F773E}{\isasymRightarrow}}\ f\ i{\isaliteral{22}{\isachardoublequoteclose}}\ \isakeyword{in}\ bspec{\isaliteral{29}{\isacharparenright}}\isanewline
   11.83 -\isacommand{apply}\isamarkupfalse%
   11.84 -{\isaliteral{28}{\isacharparenleft}}simp{\isaliteral{5F}{\isacharunderscore}}all\ add{\isaliteral{3A}{\isacharcolon}}\ Paths{\isaliteral{5F}{\isacharunderscore}}def\ split{\isaliteral{3A}{\isacharcolon}}\ nat{\isaliteral{2E}{\isachardot}}split{\isaliteral{29}{\isacharparenright}}\isanewline
   11.85 -\isacommand{done}\isamarkupfalse%
   11.86 -%
   11.87 -\endisatagproof
   11.88 -{\isafoldproof}%
   11.89 -%
   11.90 -\isadelimproof
   11.91 -%
   11.92 -\endisadelimproof
   11.93 -%
   11.94 -\begin{isamarkuptext}%
   11.95 -\noindent
   11.96 -The base case (\isa{t\ {\isaliteral{3D}{\isacharequal}}\ s}) is trivial and proved by \isa{blast}.
   11.97 -In the induction step, we have an infinite \isa{A}-avoiding path \isa{f}
   11.98 -starting from \isa{u}, a successor of \isa{t}. Now we simply instantiate
   11.99 -the \isa{{\isaliteral{5C3C666F72616C6C3E}{\isasymforall}}f{\isaliteral{5C3C696E3E}{\isasymin}}Paths\ t} in the induction hypothesis by the path starting with
  11.100 -\isa{t} and continuing with \isa{f}. That is what the above $\lambda$-term
  11.101 -expresses.  Simplification shows that this is a path starting with \isa{t} 
  11.102 -and that the instantiated induction hypothesis implies the conclusion.
  11.103 -
  11.104 -Now we come to the key lemma. Assuming that no infinite \isa{A}-avoiding
  11.105 -path starts from \isa{s}, we want to show \isa{s\ {\isaliteral{5C3C696E3E}{\isasymin}}\ lfp\ {\isaliteral{28}{\isacharparenleft}}af\ A{\isaliteral{29}{\isacharparenright}}}. For the
  11.106 -inductive proof this must be generalized to the statement that every point \isa{t}
  11.107 -``between'' \isa{s} and \isa{A}, in other words all of \isa{Avoid\ s\ A},
  11.108 -is contained in \isa{lfp\ {\isaliteral{28}{\isacharparenleft}}af\ A{\isaliteral{29}{\isacharparenright}}}:%
  11.109 -\end{isamarkuptext}%
  11.110 -\isamarkuptrue%
  11.111 -\isacommand{lemma}\isamarkupfalse%
  11.112 -\ Avoid{\isaliteral{5F}{\isacharunderscore}}in{\isaliteral{5F}{\isacharunderscore}}lfp{\isaliteral{5B}{\isacharbrackleft}}rule{\isaliteral{5F}{\isacharunderscore}}format{\isaliteral{28}{\isacharparenleft}}no{\isaliteral{5F}{\isacharunderscore}}asm{\isaliteral{29}{\isacharparenright}}{\isaliteral{5D}{\isacharbrackright}}{\isaliteral{3A}{\isacharcolon}}\isanewline
  11.113 -\ \ {\isaliteral{22}{\isachardoublequoteopen}}{\isaliteral{5C3C666F72616C6C3E}{\isasymforall}}p{\isaliteral{5C3C696E3E}{\isasymin}}Paths\ s{\isaliteral{2E}{\isachardot}}\ {\isaliteral{5C3C6578697374733E}{\isasymexists}}i{\isaliteral{2E}{\isachardot}}\ p\ i\ {\isaliteral{5C3C696E3E}{\isasymin}}\ A\ {\isaliteral{5C3C4C6F6E6772696768746172726F773E}{\isasymLongrightarrow}}\ t\ {\isaliteral{5C3C696E3E}{\isasymin}}\ Avoid\ s\ A\ {\isaliteral{5C3C6C6F6E6772696768746172726F773E}{\isasymlongrightarrow}}\ t\ {\isaliteral{5C3C696E3E}{\isasymin}}\ lfp{\isaliteral{28}{\isacharparenleft}}af\ A{\isaliteral{29}{\isacharparenright}}{\isaliteral{22}{\isachardoublequoteclose}}%
  11.114 -\isadelimproof
  11.115 -%
  11.116 -\endisadelimproof
  11.117 -%
  11.118 -\isatagproof
  11.119 -%
  11.120 -\begin{isamarkuptxt}%
  11.121 -\noindent
  11.122 -The proof is by induction on the ``distance'' between \isa{t} and \isa{A}. Remember that \isa{lfp\ {\isaliteral{28}{\isacharparenleft}}af\ A{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{3D}{\isacharequal}}\ A\ {\isaliteral{5C3C756E696F6E3E}{\isasymunion}}\ M{\isaliteral{5C3C696E76657273653E}{\isasyminverse}}\ {\isaliteral{60}{\isacharbackquote}}{\isaliteral{60}{\isacharbackquote}}\ lfp\ {\isaliteral{28}{\isacharparenleft}}af\ A{\isaliteral{29}{\isacharparenright}}}.
  11.123 -If \isa{t} is already in \isa{A}, then \isa{t\ {\isaliteral{5C3C696E3E}{\isasymin}}\ lfp\ {\isaliteral{28}{\isacharparenleft}}af\ A{\isaliteral{29}{\isacharparenright}}} is
  11.124 -trivial. If \isa{t} is not in \isa{A} but all successors are in
  11.125 -\isa{lfp\ {\isaliteral{28}{\isacharparenleft}}af\ A{\isaliteral{29}{\isacharparenright}}} (induction hypothesis), then \isa{t\ {\isaliteral{5C3C696E3E}{\isasymin}}\ lfp\ {\isaliteral{28}{\isacharparenleft}}af\ A{\isaliteral{29}{\isacharparenright}}} is
  11.126 -again trivial.
  11.127 -
  11.128 -The formal counterpart of this proof sketch is a well-founded induction
  11.129 -on~\isa{M} restricted to \isa{Avoid\ s\ A\ {\isaliteral{2D}{\isacharminus}}\ A}, roughly speaking:
  11.130 -\begin{isabelle}%
  11.131 -\ \ \ \ \ {\isaliteral{7B}{\isacharbraceleft}}{\isaliteral{28}{\isacharparenleft}}y{\isaliteral{2C}{\isacharcomma}}\ x{\isaliteral{29}{\isacharparenright}}{\isaliteral{2E}{\isachardot}}\ {\isaliteral{28}{\isacharparenleft}}x{\isaliteral{2C}{\isacharcomma}}\ y{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C696E3E}{\isasymin}}\ M\ {\isaliteral{5C3C616E643E}{\isasymand}}\ x\ {\isaliteral{5C3C696E3E}{\isasymin}}\ Avoid\ s\ A\ {\isaliteral{5C3C616E643E}{\isasymand}}\ x\ {\isaliteral{5C3C6E6F74696E3E}{\isasymnotin}}\ A{\isaliteral{7D}{\isacharbraceright}}%
  11.132 -\end{isabelle}
  11.133 -As we shall see presently, the absence of infinite \isa{A}-avoiding paths
  11.134 -starting from \isa{s} implies well-foundedness of this relation. For the
  11.135 -moment we assume this and proceed with the induction:%
  11.136 -\end{isamarkuptxt}%
  11.137 -\isamarkuptrue%
  11.138 -\isacommand{apply}\isamarkupfalse%
  11.139 -{\isaliteral{28}{\isacharparenleft}}subgoal{\isaliteral{5F}{\isacharunderscore}}tac\ {\isaliteral{22}{\isachardoublequoteopen}}wf{\isaliteral{7B}{\isacharbraceleft}}{\isaliteral{28}{\isacharparenleft}}y{\isaliteral{2C}{\isacharcomma}}x{\isaliteral{29}{\isacharparenright}}{\isaliteral{2E}{\isachardot}}\ {\isaliteral{28}{\isacharparenleft}}x{\isaliteral{2C}{\isacharcomma}}y{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C696E3E}{\isasymin}}\ M\ {\isaliteral{5C3C616E643E}{\isasymand}}\ x\ {\isaliteral{5C3C696E3E}{\isasymin}}\ Avoid\ s\ A\ {\isaliteral{5C3C616E643E}{\isasymand}}\ x\ {\isaliteral{5C3C6E6F74696E3E}{\isasymnotin}}\ A{\isaliteral{7D}{\isacharbraceright}}{\isaliteral{22}{\isachardoublequoteclose}}{\isaliteral{29}{\isacharparenright}}\isanewline
  11.140 -\ \isacommand{apply}\isamarkupfalse%
  11.141 -{\isaliteral{28}{\isacharparenleft}}erule{\isaliteral{5F}{\isacharunderscore}}tac\ a\ {\isaliteral{3D}{\isacharequal}}\ t\ \isakeyword{in}\ wf{\isaliteral{5F}{\isacharunderscore}}induct{\isaliteral{29}{\isacharparenright}}\isanewline
  11.142 -\ \isacommand{apply}\isamarkupfalse%
  11.143 -{\isaliteral{28}{\isacharparenleft}}clarsimp{\isaliteral{29}{\isacharparenright}}%
  11.144 -\begin{isamarkuptxt}%
  11.145 -\noindent
  11.146 -\begin{isabelle}%
  11.147 -\ {\isadigit{1}}{\isaliteral{2E}{\isachardot}}\ {\isaliteral{5C3C416E643E}{\isasymAnd}}t{\isaliteral{2E}{\isachardot}}\ {\isaliteral{5C3C6C6272616B6B3E}{\isasymlbrakk}}{\isaliteral{5C3C666F72616C6C3E}{\isasymforall}}p{\isaliteral{5C3C696E3E}{\isasymin}}Paths\ s{\isaliteral{2E}{\isachardot}}\ {\isaliteral{5C3C6578697374733E}{\isasymexists}}i{\isaliteral{2E}{\isachardot}}\ p\ i\ {\isaliteral{5C3C696E3E}{\isasymin}}\ A{\isaliteral{3B}{\isacharsemicolon}}\isanewline
  11.148 -\isaindent{\ {\isadigit{1}}{\isaliteral{2E}{\isachardot}}\ {\isaliteral{5C3C416E643E}{\isasymAnd}}t{\isaliteral{2E}{\isachardot}}\ \ }{\isaliteral{5C3C666F72616C6C3E}{\isasymforall}}y{\isaliteral{2E}{\isachardot}}\ {\isaliteral{28}{\isacharparenleft}}t{\isaliteral{2C}{\isacharcomma}}\ y{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C696E3E}{\isasymin}}\ M\ {\isaliteral{5C3C616E643E}{\isasymand}}\ t\ {\isaliteral{5C3C6E6F74696E3E}{\isasymnotin}}\ A\ {\isaliteral{5C3C6C6F6E6772696768746172726F773E}{\isasymlongrightarrow}}\isanewline
  11.149 -\isaindent{\ {\isadigit{1}}{\isaliteral{2E}{\isachardot}}\ {\isaliteral{5C3C416E643E}{\isasymAnd}}t{\isaliteral{2E}{\isachardot}}\ \ {\isaliteral{5C3C666F72616C6C3E}{\isasymforall}}y{\isaliteral{2E}{\isachardot}}\ }y\ {\isaliteral{5C3C696E3E}{\isasymin}}\ Avoid\ s\ A\ {\isaliteral{5C3C6C6F6E6772696768746172726F773E}{\isasymlongrightarrow}}\ y\ {\isaliteral{5C3C696E3E}{\isasymin}}\ lfp\ {\isaliteral{28}{\isacharparenleft}}af\ A{\isaliteral{29}{\isacharparenright}}{\isaliteral{3B}{\isacharsemicolon}}\isanewline
  11.150 -\isaindent{\ {\isadigit{1}}{\isaliteral{2E}{\isachardot}}\ {\isaliteral{5C3C416E643E}{\isasymAnd}}t{\isaliteral{2E}{\isachardot}}\ \ }t\ {\isaliteral{5C3C696E3E}{\isasymin}}\ Avoid\ s\ A{\isaliteral{5C3C726272616B6B3E}{\isasymrbrakk}}\isanewline
  11.151 -\isaindent{\ {\isadigit{1}}{\isaliteral{2E}{\isachardot}}\ {\isaliteral{5C3C416E643E}{\isasymAnd}}t{\isaliteral{2E}{\isachardot}}\ }{\isaliteral{5C3C4C6F6E6772696768746172726F773E}{\isasymLongrightarrow}}\ t\ {\isaliteral{5C3C696E3E}{\isasymin}}\ lfp\ {\isaliteral{28}{\isacharparenleft}}af\ A{\isaliteral{29}{\isacharparenright}}\isanewline
  11.152 -\ {\isadigit{2}}{\isaliteral{2E}{\isachardot}}\ {\isaliteral{5C3C666F72616C6C3E}{\isasymforall}}p{\isaliteral{5C3C696E3E}{\isasymin}}Paths\ s{\isaliteral{2E}{\isachardot}}\ {\isaliteral{5C3C6578697374733E}{\isasymexists}}i{\isaliteral{2E}{\isachardot}}\ p\ i\ {\isaliteral{5C3C696E3E}{\isasymin}}\ A\ {\isaliteral{5C3C4C6F6E6772696768746172726F773E}{\isasymLongrightarrow}}\isanewline
  11.153 -\isaindent{\ {\isadigit{2}}{\isaliteral{2E}{\isachardot}}\ }wf\ {\isaliteral{7B}{\isacharbraceleft}}{\isaliteral{28}{\isacharparenleft}}y{\isaliteral{2C}{\isacharcomma}}\ x{\isaliteral{29}{\isacharparenright}}{\isaliteral{2E}{\isachardot}}\ {\isaliteral{28}{\isacharparenleft}}x{\isaliteral{2C}{\isacharcomma}}\ y{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C696E3E}{\isasymin}}\ M\ {\isaliteral{5C3C616E643E}{\isasymand}}\ x\ {\isaliteral{5C3C696E3E}{\isasymin}}\ Avoid\ s\ A\ {\isaliteral{5C3C616E643E}{\isasymand}}\ x\ {\isaliteral{5C3C6E6F74696E3E}{\isasymnotin}}\ A{\isaliteral{7D}{\isacharbraceright}}%
  11.154 -\end{isabelle}
  11.155 -Now the induction hypothesis states that if \isa{t\ {\isaliteral{5C3C6E6F74696E3E}{\isasymnotin}}\ A}
  11.156 -then all successors of \isa{t} that are in \isa{Avoid\ s\ A} are in
  11.157 -\isa{lfp\ {\isaliteral{28}{\isacharparenleft}}af\ A{\isaliteral{29}{\isacharparenright}}}. Unfolding \isa{lfp} in the conclusion of the first
  11.158 -subgoal once, we have to prove that \isa{t} is in \isa{A} or all successors
  11.159 -of \isa{t} are in \isa{lfp\ {\isaliteral{28}{\isacharparenleft}}af\ A{\isaliteral{29}{\isacharparenright}}}.  But if \isa{t} is not in \isa{A},
  11.160 -the second 
  11.161 -\isa{Avoid}-rule implies that all successors of \isa{t} are in
  11.162 -\isa{Avoid\ s\ A}, because we also assume \isa{t\ {\isaliteral{5C3C696E3E}{\isasymin}}\ Avoid\ s\ A}.
  11.163 -Hence, by the induction hypothesis, all successors of \isa{t} are indeed in
  11.164 -\isa{lfp\ {\isaliteral{28}{\isacharparenleft}}af\ A{\isaliteral{29}{\isacharparenright}}}. Mechanically:%
  11.165 -\end{isamarkuptxt}%
  11.166 -\isamarkuptrue%
  11.167 -\ \isacommand{apply}\isamarkupfalse%
  11.168 -{\isaliteral{28}{\isacharparenleft}}subst\ lfp{\isaliteral{5F}{\isacharunderscore}}unfold{\isaliteral{5B}{\isacharbrackleft}}OF\ mono{\isaliteral{5F}{\isacharunderscore}}af{\isaliteral{5D}{\isacharbrackright}}{\isaliteral{29}{\isacharparenright}}\isanewline
  11.169 -\ \isacommand{apply}\isamarkupfalse%
  11.170 -{\isaliteral{28}{\isacharparenleft}}simp\ {\isaliteral{28}{\isacharparenleft}}no{\isaliteral{5F}{\isacharunderscore}}asm{\isaliteral{29}{\isacharparenright}}\ add{\isaliteral{3A}{\isacharcolon}}\ af{\isaliteral{5F}{\isacharunderscore}}def{\isaliteral{29}{\isacharparenright}}\isanewline
  11.171 -\ \isacommand{apply}\isamarkupfalse%
  11.172 -{\isaliteral{28}{\isacharparenleft}}blast\ intro{\isaliteral{3A}{\isacharcolon}}\ Avoid{\isaliteral{2E}{\isachardot}}intros{\isaliteral{29}{\isacharparenright}}%
  11.173 -\begin{isamarkuptxt}%
  11.174 -Having proved the main goal, we return to the proof obligation that the 
  11.175 -relation used above is indeed well-founded. This is proved by contradiction: if
  11.176 -the relation is not well-founded then there exists an infinite \isa{A}-avoiding path all in \isa{Avoid\ s\ A}, by theorem
  11.177 -\isa{wf{\isaliteral{5F}{\isacharunderscore}}iff{\isaliteral{5F}{\isacharunderscore}}no{\isaliteral{5F}{\isacharunderscore}}infinite{\isaliteral{5F}{\isacharunderscore}}down{\isaliteral{5F}{\isacharunderscore}}chain}:
  11.178 -\begin{isabelle}%
  11.179 -\ \ \ \ \ wf\ r\ {\isaliteral{3D}{\isacharequal}}\ {\isaliteral{28}{\isacharparenleft}}{\isaliteral{5C3C6E6F743E}{\isasymnot}}\ {\isaliteral{28}{\isacharparenleft}}{\isaliteral{5C3C6578697374733E}{\isasymexists}}f{\isaliteral{2E}{\isachardot}}\ {\isaliteral{5C3C666F72616C6C3E}{\isasymforall}}i{\isaliteral{2E}{\isachardot}}\ {\isaliteral{28}{\isacharparenleft}}f\ {\isaliteral{28}{\isacharparenleft}}Suc\ i{\isaliteral{29}{\isacharparenright}}{\isaliteral{2C}{\isacharcomma}}\ f\ i{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C696E3E}{\isasymin}}\ r{\isaliteral{29}{\isacharparenright}}{\isaliteral{29}{\isacharparenright}}%
  11.180 -\end{isabelle}
  11.181 -From lemma \isa{ex{\isaliteral{5F}{\isacharunderscore}}infinite{\isaliteral{5F}{\isacharunderscore}}path} the existence of an infinite
  11.182 -\isa{A}-avoiding path starting in \isa{s} follows, contradiction.%
  11.183 -\end{isamarkuptxt}%
  11.184 -\isamarkuptrue%
  11.185 -\isacommand{apply}\isamarkupfalse%
  11.186 -{\isaliteral{28}{\isacharparenleft}}erule\ contrapos{\isaliteral{5F}{\isacharunderscore}}pp{\isaliteral{29}{\isacharparenright}}\isanewline
  11.187 -\isacommand{apply}\isamarkupfalse%
  11.188 -{\isaliteral{28}{\isacharparenleft}}simp\ add{\isaliteral{3A}{\isacharcolon}}\ wf{\isaliteral{5F}{\isacharunderscore}}iff{\isaliteral{5F}{\isacharunderscore}}no{\isaliteral{5F}{\isacharunderscore}}infinite{\isaliteral{5F}{\isacharunderscore}}down{\isaliteral{5F}{\isacharunderscore}}chain{\isaliteral{29}{\isacharparenright}}\isanewline
  11.189 -\isacommand{apply}\isamarkupfalse%
  11.190 -{\isaliteral{28}{\isacharparenleft}}erule\ exE{\isaliteral{29}{\isacharparenright}}\isanewline
  11.191 -\isacommand{apply}\isamarkupfalse%
  11.192 -{\isaliteral{28}{\isacharparenleft}}rule\ ex{\isaliteral{5F}{\isacharunderscore}}infinite{\isaliteral{5F}{\isacharunderscore}}path{\isaliteral{29}{\isacharparenright}}\isanewline
  11.193 -\isacommand{apply}\isamarkupfalse%
  11.194 -{\isaliteral{28}{\isacharparenleft}}auto\ simp\ add{\isaliteral{3A}{\isacharcolon}}\ Paths{\isaliteral{5F}{\isacharunderscore}}def{\isaliteral{29}{\isacharparenright}}\isanewline
  11.195 -\isacommand{done}\isamarkupfalse%
  11.196 -%
  11.197 -\endisatagproof
  11.198 -{\isafoldproof}%
  11.199 -%
  11.200 -\isadelimproof
  11.201 -%
  11.202 -\endisadelimproof
  11.203 -%
  11.204 -\begin{isamarkuptext}%
  11.205 -The \isa{{\isaliteral{28}{\isacharparenleft}}no{\isaliteral{5F}{\isacharunderscore}}asm{\isaliteral{29}{\isacharparenright}}} modifier of the \isa{rule{\isaliteral{5F}{\isacharunderscore}}format} directive in the
  11.206 -statement of the lemma means
  11.207 -that the assumption is left unchanged; otherwise the \isa{{\isaliteral{5C3C666F72616C6C3E}{\isasymforall}}p} 
  11.208 -would be turned
  11.209 -into a \isa{{\isaliteral{5C3C416E643E}{\isasymAnd}}p}, which would complicate matters below. As it is,
  11.210 -\isa{Avoid{\isaliteral{5F}{\isacharunderscore}}in{\isaliteral{5F}{\isacharunderscore}}lfp} is now
  11.211 -\begin{isabelle}%
  11.212 -\ \ \ \ \ {\isaliteral{5C3C6C6272616B6B3E}{\isasymlbrakk}}{\isaliteral{5C3C666F72616C6C3E}{\isasymforall}}p{\isaliteral{5C3C696E3E}{\isasymin}}Paths\ s{\isaliteral{2E}{\isachardot}}\ {\isaliteral{5C3C6578697374733E}{\isasymexists}}i{\isaliteral{2E}{\isachardot}}\ p\ i\ {\isaliteral{5C3C696E3E}{\isasymin}}\ A{\isaliteral{3B}{\isacharsemicolon}}\ t\ {\isaliteral{5C3C696E3E}{\isasymin}}\ Avoid\ s\ A{\isaliteral{5C3C726272616B6B3E}{\isasymrbrakk}}\ {\isaliteral{5C3C4C6F6E6772696768746172726F773E}{\isasymLongrightarrow}}\ t\ {\isaliteral{5C3C696E3E}{\isasymin}}\ lfp\ {\isaliteral{28}{\isacharparenleft}}af\ A{\isaliteral{29}{\isacharparenright}}%
  11.213 -\end{isabelle}
  11.214 -The main theorem is simply the corollary where \isa{t\ {\isaliteral{3D}{\isacharequal}}\ s},
  11.215 -when the assumption \isa{t\ {\isaliteral{5C3C696E3E}{\isasymin}}\ Avoid\ s\ A} is trivially true
  11.216 -by the first \isa{Avoid}-rule. Isabelle confirms this:%
  11.217 -\index{CTL|)}%
  11.218 -\end{isamarkuptext}%
  11.219 -\isamarkuptrue%
  11.220 -\isacommand{theorem}\isamarkupfalse%
  11.221 -\ AF{\isaliteral{5F}{\isacharunderscore}}lemma{\isadigit{2}}{\isaliteral{3A}{\isacharcolon}}\ \ {\isaliteral{22}{\isachardoublequoteopen}}{\isaliteral{7B}{\isacharbraceleft}}s{\isaliteral{2E}{\isachardot}}\ {\isaliteral{5C3C666F72616C6C3E}{\isasymforall}}p\ {\isaliteral{5C3C696E3E}{\isasymin}}\ Paths\ s{\isaliteral{2E}{\isachardot}}\ {\isaliteral{5C3C6578697374733E}{\isasymexists}}\ i{\isaliteral{2E}{\isachardot}}\ p\ i\ {\isaliteral{5C3C696E3E}{\isasymin}}\ A{\isaliteral{7D}{\isacharbraceright}}\ {\isaliteral{5C3C73756273657465713E}{\isasymsubseteq}}\ lfp{\isaliteral{28}{\isacharparenleft}}af\ A{\isaliteral{29}{\isacharparenright}}{\isaliteral{22}{\isachardoublequoteclose}}\isanewline
  11.222 -%
  11.223 -\isadelimproof
  11.224 -%
  11.225 -\endisadelimproof
  11.226 -%
  11.227 -\isatagproof
  11.228 -\isacommand{by}\isamarkupfalse%
  11.229 -{\isaliteral{28}{\isacharparenleft}}auto\ elim{\isaliteral{3A}{\isacharcolon}}\ Avoid{\isaliteral{5F}{\isacharunderscore}}in{\isaliteral{5F}{\isacharunderscore}}lfp\ intro{\isaliteral{3A}{\isacharcolon}}\ Avoid{\isaliteral{2E}{\isachardot}}intros{\isaliteral{29}{\isacharparenright}}\isanewline
  11.230 -\isanewline
  11.231 -%
  11.232 -\endisatagproof
  11.233 -{\isafoldproof}%
  11.234 -%
  11.235 -\isadelimproof
  11.236 -%
  11.237 -\endisadelimproof
  11.238 -%
  11.239 -\isadelimtheory
  11.240 -%
  11.241 -\endisadelimtheory
  11.242 -%
  11.243 -\isatagtheory
  11.244 -%
  11.245 -\endisatagtheory
  11.246 -{\isafoldtheory}%
  11.247 -%
  11.248 -\isadelimtheory
  11.249 -%
  11.250 -\endisadelimtheory
  11.251 -\end{isabellebody}%
  11.252 -%%% Local Variables:
  11.253 -%%% mode: latex
  11.254 -%%% TeX-master: "root"
  11.255 -%%% End:

    12.1 --- a/doc-src/TutorialI/CTL/document/PDL.tex	Thu Jul 26 16:08:16 2012 +0200
    12.2 +++ /dev/null	Thu Jan 01 00:00:00 1970 +0000
    12.3 @@ -1,342 +0,0 @@
    12.4 -%
    12.5 -\begin{isabellebody}%
    12.6 -\def\isabellecontext{PDL}%
    12.7 -%
    12.8 -\isadelimtheory
    12.9 -%
   12.10 -\endisadelimtheory
   12.11 -%
   12.12 -\isatagtheory
   12.13 -%
   12.14 -\endisatagtheory
   12.15 -{\isafoldtheory}%
   12.16 -%
   12.17 -\isadelimtheory
   12.18 -%
   12.19 -\endisadelimtheory
   12.20 -%
   12.21 -\isamarkupsubsection{Propositional Dynamic Logic --- PDL%
   12.22 -}
   12.23 -\isamarkuptrue%
   12.24 -%
   12.25 -\begin{isamarkuptext}%
   12.26 -\index{PDL|(}
   12.27 -The formulae of PDL are built up from atomic propositions via
   12.28 -negation and conjunction and the two temporal
   12.29 -connectives \isa{AX} and \isa{EF}\@. Since formulae are essentially
   12.30 -syntax trees, they are naturally modelled as a datatype:%
   12.31 -\footnote{The customary definition of PDL
   12.32 -\cite{HarelKT-DL} looks quite different from ours, but the two are easily
   12.33 -shown to be equivalent.}%
   12.34 -\end{isamarkuptext}%
   12.35 -\isamarkuptrue%
   12.36 -\isacommand{datatype}\isamarkupfalse%
   12.37 -\ formula\ {\isaliteral{3D}{\isacharequal}}\ Atom\ {\isaliteral{22}{\isachardoublequoteopen}}atom{\isaliteral{22}{\isachardoublequoteclose}}\isanewline
   12.38 -\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ {\isaliteral{7C}{\isacharbar}}\ Neg\ formula\isanewline
   12.39 -\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ {\isaliteral{7C}{\isacharbar}}\ And\ formula\ formula\isanewline
   12.40 -\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ {\isaliteral{7C}{\isacharbar}}\ AX\ formula\isanewline
   12.41 -\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ {\isaliteral{7C}{\isacharbar}}\ EF\ formula%
   12.42 -\begin{isamarkuptext}%
   12.43 -\noindent
   12.44 -This resembles the boolean expression case study in
   12.45 -\S\ref{sec:boolex}.
   12.46 -A validity relation between states and formulae specifies the semantics.
   12.47 -The syntax annotation allows us to write \isa{s\ {\isaliteral{5C3C5475726E7374696C653E}{\isasymTurnstile}}\ f} instead of
   12.48 -\hbox{\isa{valid\ s\ f}}. The definition is by recursion over the syntax:%
   12.49 -\end{isamarkuptext}%
   12.50 -\isamarkuptrue%
   12.51 -\isacommand{primrec}\isamarkupfalse%
   12.52 -\ valid\ {\isaliteral{3A}{\isacharcolon}}{\isaliteral{3A}{\isacharcolon}}\ {\isaliteral{22}{\isachardoublequoteopen}}state\ {\isaliteral{5C3C52696768746172726F773E}{\isasymRightarrow}}\ formula\ {\isaliteral{5C3C52696768746172726F773E}{\isasymRightarrow}}\ bool{\isaliteral{22}{\isachardoublequoteclose}}\ \ \ {\isaliteral{28}{\isacharparenleft}}{\isaliteral{22}{\isachardoublequoteopen}}{\isaliteral{28}{\isacharparenleft}}{\isaliteral{5F}{\isacharunderscore}}\ {\isaliteral{5C3C5475726E7374696C653E}{\isasymTurnstile}}\ {\isaliteral{5F}{\isacharunderscore}}{\isaliteral{29}{\isacharparenright}}{\isaliteral{22}{\isachardoublequoteclose}}\ {\isaliteral{5B}{\isacharbrackleft}}{\isadigit{8}}{\isadigit{0}}{\isaliteral{2C}{\isacharcomma}}{\isadigit{8}}{\isadigit{0}}{\isaliteral{5D}{\isacharbrackright}}\ {\isadigit{8}}{\isadigit{0}}{\isaliteral{29}{\isacharparenright}}\isanewline
   12.53 -\isakeyword{where}\isanewline
   12.54 -{\isaliteral{22}{\isachardoublequoteopen}}s\ {\isaliteral{5C3C5475726E7374696C653E}{\isasymTurnstile}}\ Atom\ a\ \ {\isaliteral{3D}{\isacharequal}}\ {\isaliteral{28}{\isacharparenleft}}a\ {\isaliteral{5C3C696E3E}{\isasymin}}\ L\ s{\isaliteral{29}{\isacharparenright}}{\isaliteral{22}{\isachardoublequoteclose}}\ {\isaliteral{7C}{\isacharbar}}\isanewline
   12.55 -{\isaliteral{22}{\isachardoublequoteopen}}s\ {\isaliteral{5C3C5475726E7374696C653E}{\isasymTurnstile}}\ Neg\ f\ \ \ {\isaliteral{3D}{\isacharequal}}\ {\isaliteral{28}{\isacharparenleft}}{\isaliteral{5C3C6E6F743E}{\isasymnot}}{\isaliteral{28}{\isacharparenleft}}s\ {\isaliteral{5C3C5475726E7374696C653E}{\isasymTurnstile}}\ f{\isaliteral{29}{\isacharparenright}}{\isaliteral{29}{\isacharparenright}}{\isaliteral{22}{\isachardoublequoteclose}}\ {\isaliteral{7C}{\isacharbar}}\isanewline
   12.56 -{\isaliteral{22}{\isachardoublequoteopen}}s\ {\isaliteral{5C3C5475726E7374696C653E}{\isasymTurnstile}}\ And\ f\ g\ {\isaliteral{3D}{\isacharequal}}\ {\isaliteral{28}{\isacharparenleft}}s\ {\isaliteral{5C3C5475726E7374696C653E}{\isasymTurnstile}}\ f\ {\isaliteral{5C3C616E643E}{\isasymand}}\ s\ {\isaliteral{5C3C5475726E7374696C653E}{\isasymTurnstile}}\ g{\isaliteral{29}{\isacharparenright}}{\isaliteral{22}{\isachardoublequoteclose}}\ {\isaliteral{7C}{\isacharbar}}\isanewline
   12.57 -{\isaliteral{22}{\isachardoublequoteopen}}s\ {\isaliteral{5C3C5475726E7374696C653E}{\isasymTurnstile}}\ AX\ f\ \ \ \ {\isaliteral{3D}{\isacharequal}}\ {\isaliteral{28}{\isacharparenleft}}{\isaliteral{5C3C666F72616C6C3E}{\isasymforall}}t{\isaliteral{2E}{\isachardot}}\ {\isaliteral{28}{\isacharparenleft}}s{\isaliteral{2C}{\isacharcomma}}t{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C696E3E}{\isasymin}}\ M\ {\isaliteral{5C3C6C6F6E6772696768746172726F773E}{\isasymlongrightarrow}}\ t\ {\isaliteral{5C3C5475726E7374696C653E}{\isasymTurnstile}}\ f{\isaliteral{29}{\isacharparenright}}{\isaliteral{22}{\isachardoublequoteclose}}\ {\isaliteral{7C}{\isacharbar}}\isanewline
   12.58 -{\isaliteral{22}{\isachardoublequoteopen}}s\ {\isaliteral{5C3C5475726E7374696C653E}{\isasymTurnstile}}\ EF\ f\ \ \ \ {\isaliteral{3D}{\isacharequal}}\ {\isaliteral{28}{\isacharparenleft}}{\isaliteral{5C3C6578697374733E}{\isasymexists}}t{\isaliteral{2E}{\isachardot}}\ {\isaliteral{28}{\isacharparenleft}}s{\isaliteral{2C}{\isacharcomma}}t{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C696E3E}{\isasymin}}\ M\isaliteral{5C3C5E7375703E}{}\isactrlsup {\isaliteral{2A}{\isacharasterisk}}\ {\isaliteral{5C3C616E643E}{\isasymand}}\ t\ {\isaliteral{5C3C5475726E7374696C653E}{\isasymTurnstile}}\ f{\isaliteral{29}{\isacharparenright}}{\isaliteral{22}{\isachardoublequoteclose}}%
   12.59 -\begin{isamarkuptext}%
   12.60 -\noindent
   12.61 -The first three equations should be self-explanatory. The temporal formula
   12.62 -\isa{AX\ f} means that \isa{f} is true in \emph{A}ll ne\emph{X}t states whereas
   12.63 -\isa{EF\ f} means that there \emph{E}xists some \emph{F}uture state in which \isa{f} is
   12.64 -true. The future is expressed via \isa{\isaliteral{5C3C5E7375703E}{}\isactrlsup {\isaliteral{2A}{\isacharasterisk}}}, the reflexive transitive
   12.65 -closure. Because of reflexivity, the future includes the present.
   12.66 -
   12.67 -Now we come to the model checker itself. It maps a formula into the
   12.68 -set of states where the formula is true.  It too is defined by
   12.69 -recursion over the syntax:%
   12.70 -\end{isamarkuptext}%
   12.71 -\isamarkuptrue%
   12.72 -\isacommand{primrec}\isamarkupfalse%
   12.73 -\ mc\ {\isaliteral{3A}{\isacharcolon}}{\isaliteral{3A}{\isacharcolon}}\ {\isaliteral{22}{\isachardoublequoteopen}}formula\ {\isaliteral{5C3C52696768746172726F773E}{\isasymRightarrow}}\ state\ set{\isaliteral{22}{\isachardoublequoteclose}}\ \isakeyword{where}\isanewline
   12.74 -{\isaliteral{22}{\isachardoublequoteopen}}mc{\isaliteral{28}{\isacharparenleft}}Atom\ a{\isaliteral{29}{\isacharparenright}}\ \ {\isaliteral{3D}{\isacharequal}}\ {\isaliteral{7B}{\isacharbraceleft}}s{\isaliteral{2E}{\isachardot}}\ a\ {\isaliteral{5C3C696E3E}{\isasymin}}\ L\ s{\isaliteral{7D}{\isacharbraceright}}{\isaliteral{22}{\isachardoublequoteclose}}\ {\isaliteral{7C}{\isacharbar}}\isanewline
   12.75 -{\isaliteral{22}{\isachardoublequoteopen}}mc{\isaliteral{28}{\isacharparenleft}}Neg\ f{\isaliteral{29}{\isacharparenright}}\ \ \ {\isaliteral{3D}{\isacharequal}}\ {\isaliteral{2D}{\isacharminus}}mc\ f{\isaliteral{22}{\isachardoublequoteclose}}\ {\isaliteral{7C}{\isacharbar}}\isanewline
   12.76 -{\isaliteral{22}{\isachardoublequoteopen}}mc{\isaliteral{28}{\isacharparenleft}}And\ f\ g{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{3D}{\isacharequal}}\ mc\ f\ {\isaliteral{5C3C696E7465723E}{\isasyminter}}\ mc\ g{\isaliteral{22}{\isachardoublequoteclose}}\ {\isaliteral{7C}{\isacharbar}}\isanewline
   12.77 -{\isaliteral{22}{\isachardoublequoteopen}}mc{\isaliteral{28}{\isacharparenleft}}AX\ f{\isaliteral{29}{\isacharparenright}}\ \ \ \ {\isaliteral{3D}{\isacharequal}}\ {\isaliteral{7B}{\isacharbraceleft}}s{\isaliteral{2E}{\isachardot}}\ {\isaliteral{5C3C666F72616C6C3E}{\isasymforall}}t{\isaliteral{2E}{\isachardot}}\ {\isaliteral{28}{\isacharparenleft}}s{\isaliteral{2C}{\isacharcomma}}t{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C696E3E}{\isasymin}}\ M\ \ {\isaliteral{5C3C6C6F6E6772696768746172726F773E}{\isasymlongrightarrow}}\ t\ {\isaliteral{5C3C696E3E}{\isasymin}}\ mc\ f{\isaliteral{7D}{\isacharbraceright}}{\isaliteral{22}{\isachardoublequoteclose}}\ {\isaliteral{7C}{\isacharbar}}\isanewline
   12.78 -{\isaliteral{22}{\isachardoublequoteopen}}mc{\isaliteral{28}{\isacharparenleft}}EF\ f{\isaliteral{29}{\isacharparenright}}\ \ \ \ {\isaliteral{3D}{\isacharequal}}\ lfp{\isaliteral{28}{\isacharparenleft}}{\isaliteral{5C3C6C616D6264613E}{\isasymlambda}}T{\isaliteral{2E}{\isachardot}}\ mc\ f\ {\isaliteral{5C3C756E696F6E3E}{\isasymunion}}\ {\isaliteral{28}{\isacharparenleft}}M{\isaliteral{5C3C696E76657273653E}{\isasyminverse}}\ {\isaliteral{60}{\isacharbackquote}}{\isaliteral{60}{\isacharbackquote}}\ T{\isaliteral{29}{\isacharparenright}}{\isaliteral{29}{\isacharparenright}}{\isaliteral{22}{\isachardoublequoteclose}}%
   12.79 -\begin{isamarkuptext}%
   12.80 -\noindent
   12.81 -Only the equation for \isa{EF} deserves some comments. Remember that the
   12.82 -postfix \isa{{\isaliteral{5C3C696E76657273653E}{\isasyminverse}}} and the infix \isa{{\isaliteral{60}{\isacharbackquote}}{\isaliteral{60}{\isacharbackquote}}} are predefined and denote the
   12.83 -converse of a relation and the image of a set under a relation.  Thus
   12.84 -\isa{M{\isaliteral{5C3C696E76657273653E}{\isasyminverse}}\ {\isaliteral{60}{\isacharbackquote}}{\isaliteral{60}{\isacharbackquote}}\ T} is the set of all predecessors of \isa{T} and the least
   12.85 -fixed point (\isa{lfp}) of \isa{{\isaliteral{5C3C6C616D6264613E}{\isasymlambda}}T{\isaliteral{2E}{\isachardot}}\ mc\ f\ {\isaliteral{5C3C756E696F6E3E}{\isasymunion}}\ M{\isaliteral{5C3C696E76657273653E}{\isasyminverse}}\ {\isaliteral{60}{\isacharbackquote}}{\isaliteral{60}{\isacharbackquote}}\ T} is the least set
   12.86 -\isa{T} containing \isa{mc\ f} and all predecessors of \isa{T}. If you
   12.87 -find it hard to see that \isa{mc\ {\isaliteral{28}{\isacharparenleft}}EF\ f{\isaliteral{29}{\isacharparenright}}} contains exactly those states from
   12.88 -which there is a path to a state where \isa{f} is true, do not worry --- this
   12.89 -will be proved in a moment.
   12.90 -
   12.91 -First we prove monotonicity of the function inside \isa{lfp}
   12.92 -in order to make sure it really has a least fixed point.%
   12.93 -\end{isamarkuptext}%
   12.94 -\isamarkuptrue%
   12.95 -\isacommand{lemma}\isamarkupfalse%
   12.96 -\ mono{\isaliteral{5F}{\isacharunderscore}}ef{\isaliteral{3A}{\isacharcolon}}\ {\isaliteral{22}{\isachardoublequoteopen}}mono{\isaliteral{28}{\isacharparenleft}}{\isaliteral{5C3C6C616D6264613E}{\isasymlambda}}T{\isaliteral{2E}{\isachardot}}\ A\ {\isaliteral{5C3C756E696F6E3E}{\isasymunion}}\ {\isaliteral{28}{\isacharparenleft}}M{\isaliteral{5C3C696E76657273653E}{\isasyminverse}}\ {\isaliteral{60}{\isacharbackquote}}{\isaliteral{60}{\isacharbackquote}}\ T{\isaliteral{29}{\isacharparenright}}{\isaliteral{29}{\isacharparenright}}{\isaliteral{22}{\isachardoublequoteclose}}\isanewline
   12.97 -%
   12.98 -\isadelimproof
   12.99 -%
  12.100 -\endisadelimproof
  12.101 -%
  12.102 -\isatagproof
  12.103 -\isacommand{apply}\isamarkupfalse%
  12.104 -{\isaliteral{28}{\isacharparenleft}}rule\ monoI{\isaliteral{29}{\isacharparenright}}\isanewline
  12.105 -\isacommand{apply}\isamarkupfalse%
  12.106 -\ blast\isanewline
  12.107 -\isacommand{done}\isamarkupfalse%
  12.108 -%
  12.109 -\endisatagproof
  12.110 -{\isafoldproof}%
  12.111 -%
  12.112 -\isadelimproof
  12.113 -%
  12.114 -\endisadelimproof
  12.115 -%
  12.116 -\begin{isamarkuptext}%
  12.117 -\noindent
  12.118 -Now we can relate model checking and semantics. For the \isa{EF} case we need
  12.119 -a separate lemma:%
  12.120 -\end{isamarkuptext}%
  12.121 -\isamarkuptrue%
  12.122 -\isacommand{lemma}\isamarkupfalse%
  12.123 -\ EF{\isaliteral{5F}{\isacharunderscore}}lemma{\isaliteral{3A}{\isacharcolon}}\isanewline
  12.124 -\ \ {\isaliteral{22}{\isachardoublequoteopen}}lfp{\isaliteral{28}{\isacharparenleft}}{\isaliteral{5C3C6C616D6264613E}{\isasymlambda}}T{\isaliteral{2E}{\isachardot}}\ A\ {\isaliteral{5C3C756E696F6E3E}{\isasymunion}}\ {\isaliteral{28}{\isacharparenleft}}M{\isaliteral{5C3C696E76657273653E}{\isasyminverse}}\ {\isaliteral{60}{\isacharbackquote}}{\isaliteral{60}{\isacharbackquote}}\ T{\isaliteral{29}{\isacharparenright}}{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{3D}{\isacharequal}}\ {\isaliteral{7B}{\isacharbraceleft}}s{\isaliteral{2E}{\isachardot}}\ {\isaliteral{5C3C6578697374733E}{\isasymexists}}t{\isaliteral{2E}{\isachardot}}\ {\isaliteral{28}{\isacharparenleft}}s{\isaliteral{2C}{\isacharcomma}}t{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C696E3E}{\isasymin}}\ M\isaliteral{5C3C5E7375703E}{}\isactrlsup {\isaliteral{2A}{\isacharasterisk}}\ {\isaliteral{5C3C616E643E}{\isasymand}}\ t\ {\isaliteral{5C3C696E3E}{\isasymin}}\ A{\isaliteral{7D}{\isacharbraceright}}{\isaliteral{22}{\isachardoublequoteclose}}%
  12.125 -\isadelimproof
  12.126 -%
  12.127 -\endisadelimproof
  12.128 -%
  12.129 -\isatagproof
  12.130 -%
  12.131 -\begin{isamarkuptxt}%
  12.132 -\noindent
  12.133 -The equality is proved in the canonical fashion by proving that each set
  12.134 -includes the other; the inclusion is shown pointwise:%
  12.135 -\end{isamarkuptxt}%
  12.136 -\isamarkuptrue%
  12.137 -\isacommand{apply}\isamarkupfalse%
  12.138 -{\isaliteral{28}{\isacharparenleft}}rule\ equalityI{\isaliteral{29}{\isacharparenright}}\isanewline
  12.139 -\ \isacommand{apply}\isamarkupfalse%
  12.140 -{\isaliteral{28}{\isacharparenleft}}rule\ subsetI{\isaliteral{29}{\isacharparenright}}\isanewline
  12.141 -\ \isacommand{apply}\isamarkupfalse%
  12.142 -{\isaliteral{28}{\isacharparenleft}}simp{\isaliteral{29}{\isacharparenright}}%
  12.143 -\begin{isamarkuptxt}%
  12.144 -\noindent
  12.145 -Simplification leaves us with the following first subgoal
  12.146 -\begin{isabelle}%
  12.147 -\ {\isadigit{1}}{\isaliteral{2E}{\isachardot}}\ {\isaliteral{5C3C416E643E}{\isasymAnd}}s{\isaliteral{2E}{\isachardot}}\ s\ {\isaliteral{5C3C696E3E}{\isasymin}}\ lfp\ {\isaliteral{28}{\isacharparenleft}}{\isaliteral{5C3C6C616D6264613E}{\isasymlambda}}T{\isaliteral{2E}{\isachardot}}\ A\ {\isaliteral{5C3C756E696F6E3E}{\isasymunion}}\ M{\isaliteral{5C3C696E76657273653E}{\isasyminverse}}\ {\isaliteral{60}{\isacharbackquote}}{\isaliteral{60}{\isacharbackquote}}\ T{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C4C6F6E6772696768746172726F773E}{\isasymLongrightarrow}}\ {\isaliteral{5C3C6578697374733E}{\isasymexists}}t{\isaliteral{2E}{\isachardot}}\ {\isaliteral{28}{\isacharparenleft}}s{\isaliteral{2C}{\isacharcomma}}\ t{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C696E3E}{\isasymin}}\ M\isaliteral{5C3C5E7375703E}{}\isactrlsup {\isaliteral{2A}{\isacharasterisk}}\ {\isaliteral{5C3C616E643E}{\isasymand}}\ t\ {\isaliteral{5C3C696E3E}{\isasymin}}\ A%
  12.148 -\end{isabelle}
  12.149 -which is proved by \isa{lfp}-induction:%
  12.150 -\end{isamarkuptxt}%
  12.151 -\isamarkuptrue%
  12.152 -\ \isacommand{apply}\isamarkupfalse%
  12.153 -{\isaliteral{28}{\isacharparenleft}}erule\ lfp{\isaliteral{5F}{\isacharunderscore}}induct{\isaliteral{5F}{\isacharunderscore}}set{\isaliteral{29}{\isacharparenright}}\isanewline
  12.154 -\ \ \isacommand{apply}\isamarkupfalse%
  12.155 -{\isaliteral{28}{\isacharparenleft}}rule\ mono{\isaliteral{5F}{\isacharunderscore}}ef{\isaliteral{29}{\isacharparenright}}\isanewline
  12.156 -\ \isacommand{apply}\isamarkupfalse%
  12.157 -{\isaliteral{28}{\isacharparenleft}}simp{\isaliteral{29}{\isacharparenright}}%
  12.158 -\begin{isamarkuptxt}%
  12.159 -\noindent
  12.160 -Having disposed of the monotonicity subgoal,
  12.161 -simplification leaves us with the following goal:
  12.162 -\begin{isabelle}
  12.163 -\ {\isadigit{1}}{\isachardot}\ {\isasymAnd}x{\isachardot}\ x\ {\isasymin}\ A\ {\isasymor}\isanewline
  12.164 -\ \ \ \ \ \ \ \ \ x\ {\isasymin}\ M{\isasyminverse}\ {\isacharbackquote}{\isacharbackquote}\ {\isacharparenleft}lfp\ {\isacharparenleft}\dots{\isacharparenright}\ {\isasyminter}\ {\isacharbraceleft}x{\isachardot}\ {\isasymexists}t{\isachardot}\ {\isacharparenleft}x{\isacharcomma}\ t{\isacharparenright}\ {\isasymin}\ M\isactrlsup {\isacharasterisk}\ {\isasymand}\ t\ {\isasymin}\ A{\isacharbraceright}{\isacharparenright}\isanewline
  12.165 -\ \ \ \ \ \ \ \ {\isasymLongrightarrow}\ {\isasymexists}t{\isachardot}\ {\isacharparenleft}x{\isacharcomma}\ t{\isacharparenright}\ {\isasymin}\ M\isactrlsup {\isacharasterisk}\ {\isasymand}\ t\ {\isasymin}\ A
  12.166 -\end{isabelle}
  12.167 -It is proved by \isa{blast}, using the transitivity of 
  12.168 -\isa{M\isactrlsup {\isacharasterisk}}.%
  12.169 -\end{isamarkuptxt}%
  12.170 -\isamarkuptrue%
  12.171 -\ \isacommand{apply}\isamarkupfalse%
  12.172 -{\isaliteral{28}{\isacharparenleft}}blast\ intro{\isaliteral{3A}{\isacharcolon}}\ rtrancl{\isaliteral{5F}{\isacharunderscore}}trans{\isaliteral{29}{\isacharparenright}}%
  12.173 -\begin{isamarkuptxt}%
  12.174 -We now return to the second set inclusion subgoal, which is again proved
  12.175 -pointwise:%
  12.176 -\end{isamarkuptxt}%
  12.177 -\isamarkuptrue%
  12.178 -\isacommand{apply}\isamarkupfalse%
  12.179 -{\isaliteral{28}{\isacharparenleft}}rule\ subsetI{\isaliteral{29}{\isacharparenright}}\isanewline
  12.180 -\isacommand{apply}\isamarkupfalse%
  12.181 -{\isaliteral{28}{\isacharparenleft}}simp{\isaliteral{2C}{\isacharcomma}}\ clarify{\isaliteral{29}{\isacharparenright}}%
  12.182 -\begin{isamarkuptxt}%
  12.183 -\noindent
  12.184 -After simplification and clarification we are left with
  12.185 -\begin{isabelle}%
  12.186 -\ {\isadigit{1}}{\isaliteral{2E}{\isachardot}}\ {\isaliteral{5C3C416E643E}{\isasymAnd}}x\ t{\isaliteral{2E}{\isachardot}}\ {\isaliteral{5C3C6C6272616B6B3E}{\isasymlbrakk}}{\isaliteral{28}{\isacharparenleft}}x{\isaliteral{2C}{\isacharcomma}}\ t{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C696E3E}{\isasymin}}\ M\isaliteral{5C3C5E7375703E}{}\isactrlsup {\isaliteral{2A}{\isacharasterisk}}{\isaliteral{3B}{\isacharsemicolon}}\ t\ {\isaliteral{5C3C696E3E}{\isasymin}}\ A{\isaliteral{5C3C726272616B6B3E}{\isasymrbrakk}}\ {\isaliteral{5C3C4C6F6E6772696768746172726F773E}{\isasymLongrightarrow}}\ x\ {\isaliteral{5C3C696E3E}{\isasymin}}\ lfp\ {\isaliteral{28}{\isacharparenleft}}{\isaliteral{5C3C6C616D6264613E}{\isasymlambda}}T{\isaliteral{2E}{\isachardot}}\ A\ {\isaliteral{5C3C756E696F6E3E}{\isasymunion}}\ M{\isaliteral{5C3C696E76657273653E}{\isasyminverse}}\ {\isaliteral{60}{\isacharbackquote}}{\isaliteral{60}{\isacharbackquote}}\ T{\isaliteral{29}{\isacharparenright}}%
  12.187 -\end{isabelle}
  12.188 -This goal is proved by induction on \isa{{\isaliteral{28}{\isacharparenleft}}s{\isaliteral{2C}{\isacharcomma}}\ t{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C696E3E}{\isasymin}}\ M\isaliteral{5C3C5E7375703E}{}\isactrlsup {\isaliteral{2A}{\isacharasterisk}}}. But since the model
  12.189 -checker works backwards (from \isa{t} to \isa{s}), we cannot use the
  12.190 -induction theorem \isa{rtrancl{\isaliteral{5F}{\isacharunderscore}}induct}: it works in the
  12.191 -forward direction. Fortunately the converse induction theorem
  12.192 -\isa{converse{\isaliteral{5F}{\isacharunderscore}}rtrancl{\isaliteral{5F}{\isacharunderscore}}induct} already exists:
  12.193 -\begin{isabelle}%
  12.194 -\ \ \ \ \ {\isaliteral{5C3C6C6272616B6B3E}{\isasymlbrakk}}{\isaliteral{28}{\isacharparenleft}}a{\isaliteral{2C}{\isacharcomma}}\ b{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C696E3E}{\isasymin}}\ r\isaliteral{5C3C5E7375703E}{}\isactrlsup {\isaliteral{2A}{\isacharasterisk}}{\isaliteral{3B}{\isacharsemicolon}}\ P\ b{\isaliteral{3B}{\isacharsemicolon}}\isanewline
  12.195 -\isaindent{\ \ \ \ \ \ }{\isaliteral{5C3C416E643E}{\isasymAnd}}y\ z{\isaliteral{2E}{\isachardot}}\ {\isaliteral{5C3C6C6272616B6B3E}{\isasymlbrakk}}{\isaliteral{28}{\isacharparenleft}}y{\isaliteral{2C}{\isacharcomma}}\ z{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C696E3E}{\isasymin}}\ r{\isaliteral{3B}{\isacharsemicolon}}\ {\isaliteral{28}{\isacharparenleft}}z{\isaliteral{2C}{\isacharcomma}}\ b{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C696E3E}{\isasymin}}\ r\isaliteral{5C3C5E7375703E}{}\isactrlsup {\isaliteral{2A}{\isacharasterisk}}{\isaliteral{3B}{\isacharsemicolon}}\ P\ z{\isaliteral{5C3C726272616B6B3E}{\isasymrbrakk}}\ {\isaliteral{5C3C4C6F6E6772696768746172726F773E}{\isasymLongrightarrow}}\ P\ y{\isaliteral{5C3C726272616B6B3E}{\isasymrbrakk}}\isanewline
  12.196 -\isaindent{\ \ \ \ \ }{\isaliteral{5C3C4C6F6E6772696768746172726F773E}{\isasymLongrightarrow}}\ P\ a%
  12.197 -\end{isabelle}
  12.198 -It says that if \isa{{\isaliteral{28}{\isacharparenleft}}a{\isaliteral{2C}{\isacharcomma}}\ b{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C696E3E}{\isasymin}}\ r\isaliteral{5C3C5E7375703E}{}\isactrlsup {\isaliteral{2A}{\isacharasterisk}}} and we know \isa{P\ b} then we can infer
  12.199 -\isa{P\ a} provided each step backwards from a predecessor \isa{z} of
  12.200 -\isa{b} preserves \isa{P}.%
  12.201 -\end{isamarkuptxt}%
  12.202 -\isamarkuptrue%
  12.203 -\isacommand{apply}\isamarkupfalse%
  12.204 -{\isaliteral{28}{\isacharparenleft}}erule\ converse{\isaliteral{5F}{\isacharunderscore}}rtrancl{\isaliteral{5F}{\isacharunderscore}}induct{\isaliteral{29}{\isacharparenright}}%
  12.205 -\begin{isamarkuptxt}%
  12.206 -\noindent
  12.207 -The base case
  12.208 -\begin{isabelle}%
  12.209 -\ {\isadigit{1}}{\isaliteral{2E}{\isachardot}}\ {\isaliteral{5C3C416E643E}{\isasymAnd}}x\ t{\isaliteral{2E}{\isachardot}}\ t\ {\isaliteral{5C3C696E3E}{\isasymin}}\ A\ {\isaliteral{5C3C4C6F6E6772696768746172726F773E}{\isasymLongrightarrow}}\ t\ {\isaliteral{5C3C696E3E}{\isasymin}}\ lfp\ {\isaliteral{28}{\isacharparenleft}}{\isaliteral{5C3C6C616D6264613E}{\isasymlambda}}T{\isaliteral{2E}{\isachardot}}\ A\ {\isaliteral{5C3C756E696F6E3E}{\isasymunion}}\ M{\isaliteral{5C3C696E76657273653E}{\isasyminverse}}\ {\isaliteral{60}{\isacharbackquote}}{\isaliteral{60}{\isacharbackquote}}\ T{\isaliteral{29}{\isacharparenright}}%
  12.210 -\end{isabelle}
  12.211 -is solved by unrolling \isa{lfp} once%
  12.212 -\end{isamarkuptxt}%
  12.213 -\isamarkuptrue%
  12.214 -\ \isacommand{apply}\isamarkupfalse%
  12.215 -{\isaliteral{28}{\isacharparenleft}}subst\ lfp{\isaliteral{5F}{\isacharunderscore}}unfold{\isaliteral{5B}{\isacharbrackleft}}OF\ mono{\isaliteral{5F}{\isacharunderscore}}ef{\isaliteral{5D}{\isacharbrackright}}{\isaliteral{29}{\isacharparenright}}%
  12.216 -\begin{isamarkuptxt}%
  12.217 -\begin{isabelle}%
  12.218 -\ {\isadigit{1}}{\isaliteral{2E}{\isachardot}}\ {\isaliteral{5C3C416E643E}{\isasymAnd}}x\ t{\isaliteral{2E}{\isachardot}}\ t\ {\isaliteral{5C3C696E3E}{\isasymin}}\ A\ {\isaliteral{5C3C4C6F6E6772696768746172726F773E}{\isasymLongrightarrow}}\ t\ {\isaliteral{5C3C696E3E}{\isasymin}}\ A\ {\isaliteral{5C3C756E696F6E3E}{\isasymunion}}\ M{\isaliteral{5C3C696E76657273653E}{\isasyminverse}}\ {\isaliteral{60}{\isacharbackquote}}{\isaliteral{60}{\isacharbackquote}}\ lfp\ {\isaliteral{28}{\isacharparenleft}}{\isaliteral{5C3C6C616D6264613E}{\isasymlambda}}T{\isaliteral{2E}{\isachardot}}\ A\ {\isaliteral{5C3C756E696F6E3E}{\isasymunion}}\ M{\isaliteral{5C3C696E76657273653E}{\isasyminverse}}\ {\isaliteral{60}{\isacharbackquote}}{\isaliteral{60}{\isacharbackquote}}\ T{\isaliteral{29}{\isacharparenright}}%
  12.219 -\end{isabelle}
  12.220 -and disposing of the resulting trivial subgoal automatically:%
  12.221 -\end{isamarkuptxt}%
  12.222 -\isamarkuptrue%
  12.223 -\ \isacommand{apply}\isamarkupfalse%
  12.224 -{\isaliteral{28}{\isacharparenleft}}blast{\isaliteral{29}{\isacharparenright}}%
  12.225 -\begin{isamarkuptxt}%
  12.226 -\noindent
  12.227 -The proof of the induction step is identical to the one for the base case:%
  12.228 -\end{isamarkuptxt}%
  12.229 -\isamarkuptrue%
  12.230 -\isacommand{apply}\isamarkupfalse%
  12.231 -{\isaliteral{28}{\isacharparenleft}}subst\ lfp{\isaliteral{5F}{\isacharunderscore}}unfold{\isaliteral{5B}{\isacharbrackleft}}OF\ mono{\isaliteral{5F}{\isacharunderscore}}ef{\isaliteral{5D}{\isacharbrackright}}{\isaliteral{29}{\isacharparenright}}\isanewline
  12.232 -\isacommand{apply}\isamarkupfalse%
  12.233 -{\isaliteral{28}{\isacharparenleft}}blast{\isaliteral{29}{\isacharparenright}}\isanewline
  12.234 -\isacommand{done}\isamarkupfalse%
  12.235 -%
  12.236 -\endisatagproof
  12.237 -{\isafoldproof}%
  12.238 -%
  12.239 -\isadelimproof
  12.240 -%
  12.241 -\endisadelimproof
  12.242 -%
  12.243 -\begin{isamarkuptext}%
  12.244 -The main theorem is proved in the familiar manner: induction followed by
  12.245 -\isa{auto} augmented with the lemma as a simplification rule.%
  12.246 -\end{isamarkuptext}%
  12.247 -\isamarkuptrue%
  12.248 -\isacommand{theorem}\isamarkupfalse%
  12.249 -\ {\isaliteral{22}{\isachardoublequoteopen}}mc\ f\ {\isaliteral{3D}{\isacharequal}}\ {\isaliteral{7B}{\isacharbraceleft}}s{\isaliteral{2E}{\isachardot}}\ s\ {\isaliteral{5C3C5475726E7374696C653E}{\isasymTurnstile}}\ f{\isaliteral{7D}{\isacharbraceright}}{\isaliteral{22}{\isachardoublequoteclose}}\isanewline
  12.250 -%
  12.251 -\isadelimproof
  12.252 -%
  12.253 -\endisadelimproof
  12.254 -%
  12.255 -\isatagproof
  12.256 -\isacommand{apply}\isamarkupfalse%
  12.257 -{\isaliteral{28}{\isacharparenleft}}induct{\isaliteral{5F}{\isacharunderscore}}tac\ f{\isaliteral{29}{\isacharparenright}}\isanewline
  12.258 -\isacommand{apply}\isamarkupfalse%
  12.259 -{\isaliteral{28}{\isacharparenleft}}auto\ simp\ add{\isaliteral{3A}{\isacharcolon}}\ EF{\isaliteral{5F}{\isacharunderscore}}lemma{\isaliteral{29}{\isacharparenright}}\isanewline
  12.260 -\isacommand{done}\isamarkupfalse%
  12.261 -%
  12.262 -\endisatagproof
  12.263 -{\isafoldproof}%
  12.264 -%
  12.265 -\isadelimproof
  12.266 -%
  12.267 -\endisadelimproof
  12.268 -%
  12.269 -\begin{isamarkuptext}%
  12.270 -\begin{exercise}
  12.271 -\isa{AX} has a dual operator \isa{EN} 
  12.272 -(``there exists a next state such that'')%
  12.273 -\footnote{We cannot use the customary \isa{EX}: it is reserved
  12.274 -as the \textsc{ascii}-equivalent of \isa{{\isaliteral{5C3C6578697374733E}{\isasymexists}}}.}
  12.275 -with the intended semantics
  12.276 -\begin{isabelle}%
  12.277 -\ \ \ \ \ s\ {\isaliteral{5C3C5475726E7374696C653E}{\isasymTurnstile}}\ EN\ f\ {\isaliteral{3D}{\isacharequal}}\ {\isaliteral{28}{\isacharparenleft}}{\isaliteral{5C3C6578697374733E}{\isasymexists}}t{\isaliteral{2E}{\isachardot}}\ {\isaliteral{28}{\isacharparenleft}}s{\isaliteral{2C}{\isacharcomma}}\ t{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C696E3E}{\isasymin}}\ M\ {\isaliteral{5C3C616E643E}{\isasymand}}\ t\ {\isaliteral{5C3C5475726E7374696C653E}{\isasymTurnstile}}\ f{\isaliteral{29}{\isacharparenright}}%
  12.278 -\end{isabelle}
  12.279 -Fortunately, \isa{EN\ f} can already be expressed as a PDL formula. How?
  12.280 -
  12.281 -Show that the semantics for \isa{EF} satisfies the following recursion equation:
  12.282 -\begin{isabelle}%
  12.283 -\ \ \ \ \ s\ {\isaliteral{5C3C5475726E7374696C653E}{\isasymTurnstile}}\ EF\ f\ {\isaliteral{3D}{\isacharequal}}\ {\isaliteral{28}{\isacharparenleft}}s\ {\isaliteral{5C3C5475726E7374696C653E}{\isasymTurnstile}}\ f\ {\isaliteral{5C3C6F723E}{\isasymor}}\ s\ {\isaliteral{5C3C5475726E7374696C653E}{\isasymTurnstile}}\ EN\ {\isaliteral{28}{\isacharparenleft}}EF\ f{\isaliteral{29}{\isacharparenright}}{\isaliteral{29}{\isacharparenright}}%
  12.284 -\end{isabelle}
  12.285 -\end{exercise}
  12.286 -\index{PDL|)}%
  12.287 -\end{isamarkuptext}%
  12.288 -\isamarkuptrue%
  12.289 -%
  12.290 -\isadelimproof
  12.291 -%
  12.292 -\endisadelimproof
  12.293 -%
  12.294 -\isatagproof
  12.295 -%
  12.296 -\endisatagproof
  12.297 -{\isafoldproof}%
  12.298 -%
  12.299 -\isadelimproof
  12.300 -%
  12.301 -\endisadelimproof
  12.302 -%
  12.303 -\isadelimproof
  12.304 -%
  12.305 -\endisadelimproof
  12.306 -%
  12.307 -\isatagproof
  12.308 -%
  12.309 -\endisatagproof
  12.310 -{\isafoldproof}%
  12.311 -%
  12.312 -\isadelimproof
  12.313 -%
  12.314 -\endisadelimproof
  12.315 -%
  12.316 -\isadelimproof
  12.317 -%
  12.318 -\endisadelimproof
  12.319 -%
  12.320 -\isatagproof
  12.321 -%
  12.322 -\endisatagproof
  12.323 -{\isafoldproof}%
  12.324 -%
  12.325 -\isadelimproof
  12.326 -%
  12.327 -\endisadelimproof
  12.328 -%
  12.329 -\isadelimtheory
  12.330 -%
  12.331 -\endisadelimtheory
  12.332 -%
  12.333 -\isatagtheory
  12.334 -%
  12.335 -\endisatagtheory
  12.336 -{\isafoldtheory}%
  12.337 -%
  12.338 -\isadelimtheory
  12.339 -%
  12.340 -\endisadelimtheory
  12.341 -\end{isabellebody}%
  12.342 -%%% Local Variables:
  12.343 -%%% mode: latex
  12.344 -%%% TeX-master: "root"
  12.345 -%%% End:

    13.1 --- a/doc-src/TutorialI/CodeGen/ROOT.ML	Thu Jul 26 16:08:16 2012 +0200
    13.2 +++ /dev/null	Thu Jan 01 00:00:00 1970 +0000
    13.3 @@ -1,2 +0,0 @@
    13.4 -use "../settings.ML";
    13.5 -use_thy "CodeGen";

    14.1 --- a/doc-src/TutorialI/CodeGen/document/CodeGen.tex	Thu Jul 26 16:08:16 2012 +0200
    14.2 +++ /dev/null	Thu Jan 01 00:00:00 1970 +0000
    14.3 @@ -1,237 +0,0 @@
    14.4 -%
    14.5 -\begin{isabellebody}%
    14.6 -\def\isabellecontext{CodeGen}%
    14.7 -%
    14.8 -\isadelimtheory
    14.9 -%
   14.10 -\endisadelimtheory
   14.11 -%
   14.12 -\isatagtheory
   14.13 -%
   14.14 -\endisatagtheory
   14.15 -{\isafoldtheory}%
   14.16 -%
   14.17 -\isadelimtheory
   14.18 -%
   14.19 -\endisadelimtheory
   14.20 -%
   14.21 -\isamarkupsection{Case Study: Compiling Expressions%
   14.22 -}
   14.23 -\isamarkuptrue%
   14.24 -%
   14.25 -\begin{isamarkuptext}%
   14.26 -\label{sec:ExprCompiler}
   14.27 -\index{compiling expressions example|(}%
   14.28 -The task is to develop a compiler from a generic type of expressions (built
   14.29 -from variables, constants and binary operations) to a stack machine.  This
   14.30 -generic type of expressions is a generalization of the boolean expressions in
   14.31 -\S\ref{sec:boolex}.  This time we do not commit ourselves to a particular
   14.32 -type of variables or values but make them type parameters.  Neither is there
   14.33 -a fixed set of binary operations: instead the expression contains the
   14.34 -appropriate function itself.%
   14.35 -\end{isamarkuptext}%
   14.36 -\isamarkuptrue%
   14.37 -\isacommand{type{\isaliteral{5F}{\isacharunderscore}}synonym}\isamarkupfalse%
   14.38 -\ {\isaliteral{27}{\isacharprime}}v\ binop\ {\isaliteral{3D}{\isacharequal}}\ {\isaliteral{22}{\isachardoublequoteopen}}{\isaliteral{27}{\isacharprime}}v\ {\isaliteral{5C3C52696768746172726F773E}{\isasymRightarrow}}\ {\isaliteral{27}{\isacharprime}}v\ {\isaliteral{5C3C52696768746172726F773E}{\isasymRightarrow}}\ {\isaliteral{27}{\isacharprime}}v{\isaliteral{22}{\isachardoublequoteclose}}\isanewline
   14.39 -\isacommand{datatype}\isamarkupfalse%
   14.40 -\ {\isaliteral{28}{\isacharparenleft}}{\isaliteral{27}{\isacharprime}}a{\isaliteral{2C}{\isacharcomma}}{\isaliteral{27}{\isacharprime}}v{\isaliteral{29}{\isacharparenright}}expr\ {\isaliteral{3D}{\isacharequal}}\ Cex\ {\isaliteral{27}{\isacharprime}}v\isanewline
   14.41 -\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ {\isaliteral{7C}{\isacharbar}}\ Vex\ {\isaliteral{27}{\isacharprime}}a\isanewline
   14.42 -\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ {\isaliteral{7C}{\isacharbar}}\ Bex\ {\isaliteral{22}{\isachardoublequoteopen}}{\isaliteral{27}{\isacharprime}}v\ binop{\isaliteral{22}{\isachardoublequoteclose}}\ \ {\isaliteral{22}{\isachardoublequoteopen}}{\isaliteral{28}{\isacharparenleft}}{\isaliteral{27}{\isacharprime}}a{\isaliteral{2C}{\isacharcomma}}{\isaliteral{27}{\isacharprime}}v{\isaliteral{29}{\isacharparenright}}expr{\isaliteral{22}{\isachardoublequoteclose}}\ \ {\isaliteral{22}{\isachardoublequoteopen}}{\isaliteral{28}{\isacharparenleft}}{\isaliteral{27}{\isacharprime}}a{\isaliteral{2C}{\isacharcomma}}{\isaliteral{27}{\isacharprime}}v{\isaliteral{29}{\isacharparenright}}expr{\isaliteral{22}{\isachardoublequoteclose}}%
   14.43 -\begin{isamarkuptext}%
   14.44 -\noindent
   14.45 -The three constructors represent constants, variables and the application of
   14.46 -a binary operation to two subexpressions.
   14.47 -
   14.48 -The value of an expression with respect to an environment that maps variables to
   14.49 -values is easily defined:%
   14.50 -\end{isamarkuptext}%
   14.51 -\isamarkuptrue%
   14.52 -\isacommand{primrec}\isamarkupfalse%
   14.53 -\ {\isaliteral{22}{\isachardoublequoteopen}}value{\isaliteral{22}{\isachardoublequoteclose}}\ {\isaliteral{3A}{\isacharcolon}}{\isaliteral{3A}{\isacharcolon}}\ {\isaliteral{22}{\isachardoublequoteopen}}{\isaliteral{28}{\isacharparenleft}}{\isaliteral{27}{\isacharprime}}a{\isaliteral{2C}{\isacharcomma}}{\isaliteral{27}{\isacharprime}}v{\isaliteral{29}{\isacharparenright}}expr\ {\isaliteral{5C3C52696768746172726F773E}{\isasymRightarrow}}\ {\isaliteral{28}{\isacharparenleft}}{\isaliteral{27}{\isacharprime}}a\ {\isaliteral{5C3C52696768746172726F773E}{\isasymRightarrow}}\ {\isaliteral{27}{\isacharprime}}v{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C52696768746172726F773E}{\isasymRightarrow}}\ {\isaliteral{27}{\isacharprime}}v{\isaliteral{22}{\isachardoublequoteclose}}\ \isakeyword{where}\isanewline
   14.54 -{\isaliteral{22}{\isachardoublequoteopen}}value\ {\isaliteral{28}{\isacharparenleft}}Cex\ v{\isaliteral{29}{\isacharparenright}}\ env\ {\isaliteral{3D}{\isacharequal}}\ v{\isaliteral{22}{\isachardoublequoteclose}}\ {\isaliteral{7C}{\isacharbar}}\isanewline
   14.55 -{\isaliteral{22}{\isachardoublequoteopen}}value\ {\isaliteral{28}{\isacharparenleft}}Vex\ a{\isaliteral{29}{\isacharparenright}}\ env\ {\isaliteral{3D}{\isacharequal}}\ env\ a{\isaliteral{22}{\isachardoublequoteclose}}\ {\isaliteral{7C}{\isacharbar}}\isanewline
   14.56 -{\isaliteral{22}{\isachardoublequoteopen}}value\ {\isaliteral{28}{\isacharparenleft}}Bex\ f\ e{\isadigit{1}}\ e{\isadigit{2}}{\isaliteral{29}{\isacharparenright}}\ env\ {\isaliteral{3D}{\isacharequal}}\ f\ {\isaliteral{28}{\isacharparenleft}}value\ e{\isadigit{1}}\ env{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{28}{\isacharparenleft}}value\ e{\isadigit{2}}\ env{\isaliteral{29}{\isacharparenright}}{\isaliteral{22}{\isachardoublequoteclose}}%
   14.57 -\begin{isamarkuptext}%
   14.58 -The stack machine has three instructions: load a constant value onto the
   14.59 -stack, load the contents of an address onto the stack, and apply a
   14.60 -binary operation to the two topmost elements of the stack, replacing them by
   14.61 -the result. As for \isa{expr}, addresses and values are type parameters:%
   14.62 -\end{isamarkuptext}%
   14.63 -\isamarkuptrue%
   14.64 -\isacommand{datatype}\isamarkupfalse%
   14.65 -\ {\isaliteral{28}{\isacharparenleft}}{\isaliteral{27}{\isacharprime}}a{\isaliteral{2C}{\isacharcomma}}{\isaliteral{27}{\isacharprime}}v{\isaliteral{29}{\isacharparenright}}\ instr\ {\isaliteral{3D}{\isacharequal}}\ Const\ {\isaliteral{27}{\isacharprime}}v\isanewline
   14.66 -\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ {\isaliteral{7C}{\isacharbar}}\ Load\ {\isaliteral{27}{\isacharprime}}a\isanewline
   14.67 -\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ {\isaliteral{7C}{\isacharbar}}\ Apply\ {\isaliteral{22}{\isachardoublequoteopen}}{\isaliteral{27}{\isacharprime}}v\ binop{\isaliteral{22}{\isachardoublequoteclose}}%
   14.68 -\begin{isamarkuptext}%
   14.69 -The execution of the stack machine is modelled by a function
   14.70 -\isa{exec} that takes a list of instructions, a store (modelled as a
   14.71 -function from addresses to values, just like the environment for
   14.72 -evaluating expressions), and a stack (modelled as a list) of values,
   14.73 -and returns the stack at the end of the execution --- the store remains
   14.74 -unchanged:%
   14.75 -\end{isamarkuptext}%
   14.76 -\isamarkuptrue%
   14.77 -\isacommand{primrec}\isamarkupfalse%
   14.78 -\ exec\ {\isaliteral{3A}{\isacharcolon}}{\isaliteral{3A}{\isacharcolon}}\ {\isaliteral{22}{\isachardoublequoteopen}}{\isaliteral{28}{\isacharparenleft}}{\isaliteral{27}{\isacharprime}}a{\isaliteral{2C}{\isacharcomma}}{\isaliteral{27}{\isacharprime}}v{\isaliteral{29}{\isacharparenright}}instr\ list\ {\isaliteral{5C3C52696768746172726F773E}{\isasymRightarrow}}\ {\isaliteral{28}{\isacharparenleft}}{\isaliteral{27}{\isacharprime}}a{\isaliteral{5C3C52696768746172726F773E}{\isasymRightarrow}}{\isaliteral{27}{\isacharprime}}v{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C52696768746172726F773E}{\isasymRightarrow}}\ {\isaliteral{27}{\isacharprime}}v\ list\ {\isaliteral{5C3C52696768746172726F773E}{\isasymRightarrow}}\ {\isaliteral{27}{\isacharprime}}v\ list{\isaliteral{22}{\isachardoublequoteclose}}\isanewline
   14.79 -\isakeyword{where}\isanewline
   14.80 -{\isaliteral{22}{\isachardoublequoteopen}}exec\ {\isaliteral{5B}{\isacharbrackleft}}{\isaliteral{5D}{\isacharbrackright}}\ s\ vs\ {\isaliteral{3D}{\isacharequal}}\ vs{\isaliteral{22}{\isachardoublequoteclose}}\ {\isaliteral{7C}{\isacharbar}}\isanewline
   14.81 -{\isaliteral{22}{\isachardoublequoteopen}}exec\ {\isaliteral{28}{\isacharparenleft}}i{\isaliteral{23}{\isacharhash}}is{\isaliteral{29}{\isacharparenright}}\ s\ vs\ {\isaliteral{3D}{\isacharequal}}\ {\isaliteral{28}{\isacharparenleft}}case\ i\ of\isanewline
   14.82 -\ \ \ \ Const\ v\ \ {\isaliteral{5C3C52696768746172726F773E}{\isasymRightarrow}}\ exec\ is\ s\ {\isaliteral{28}{\isacharparenleft}}v{\isaliteral{23}{\isacharhash}}vs{\isaliteral{29}{\isacharparenright}}\isanewline
   14.83 -\ \ {\isaliteral{7C}{\isacharbar}}\ Load\ a\ \ \ {\isaliteral{5C3C52696768746172726F773E}{\isasymRightarrow}}\ exec\ is\ s\ {\isaliteral{28}{\isacharparenleft}}{\isaliteral{28}{\isacharparenleft}}s\ a{\isaliteral{29}{\isacharparenright}}{\isaliteral{23}{\isacharhash}}vs{\isaliteral{29}{\isacharparenright}}\isanewline
   14.84 -\ \ {\isaliteral{7C}{\isacharbar}}\ Apply\ f\ \ {\isaliteral{5C3C52696768746172726F773E}{\isasymRightarrow}}\ exec\ is\ s\ {\isaliteral{28}{\isacharparenleft}}{\isaliteral{28}{\isacharparenleft}}f\ {\isaliteral{28}{\isacharparenleft}}hd\ vs{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{28}{\isacharparenleft}}hd{\isaliteral{28}{\isacharparenleft}}tl\ vs{\isaliteral{29}{\isacharparenright}}{\isaliteral{29}{\isacharparenright}}{\isaliteral{29}{\isacharparenright}}{\isaliteral{23}{\isacharhash}}{\isaliteral{28}{\isacharparenleft}}tl{\isaliteral{28}{\isacharparenleft}}tl\ vs{\isaliteral{29}{\isacharparenright}}{\isaliteral{29}{\isacharparenright}}{\isaliteral{29}{\isacharparenright}}{\isaliteral{29}{\isacharparenright}}{\isaliteral{22}{\isachardoublequoteclose}}%
   14.85 -\begin{isamarkuptext}%
   14.86 -\noindent
   14.87 -Recall that \isa{hd} and \isa{tl}
   14.88 -return the first element and the remainder of a list.
   14.89 -Because all functions are total, \cdx{hd} is defined even for the empty
   14.90 -list, although we do not know what the result is. Thus our model of the
   14.91 -machine always terminates properly, although the definition above does not
   14.92 -tell us much about the result in situations where \isa{Apply} was executed
   14.93 -with fewer than two elements on the stack.
   14.94 -
   14.95 -The compiler is a function from expressions to a list of instructions. Its
   14.96 -definition is obvious:%
   14.97 -\end{isamarkuptext}%
   14.98 -\isamarkuptrue%
   14.99 -\isacommand{primrec}\isamarkupfalse%
  14.100 -\ compile\ {\isaliteral{3A}{\isacharcolon}}{\isaliteral{3A}{\isacharcolon}}\ {\isaliteral{22}{\isachardoublequoteopen}}{\isaliteral{28}{\isacharparenleft}}{\isaliteral{27}{\isacharprime}}a{\isaliteral{2C}{\isacharcomma}}{\isaliteral{27}{\isacharprime}}v{\isaliteral{29}{\isacharparenright}}expr\ {\isaliteral{5C3C52696768746172726F773E}{\isasymRightarrow}}\ {\isaliteral{28}{\isacharparenleft}}{\isaliteral{27}{\isacharprime}}a{\isaliteral{2C}{\isacharcomma}}{\isaliteral{27}{\isacharprime}}v{\isaliteral{29}{\isacharparenright}}instr\ list{\isaliteral{22}{\isachardoublequoteclose}}\ \isakeyword{where}\isanewline
  14.101 -{\isaliteral{22}{\isachardoublequoteopen}}compile\ {\isaliteral{28}{\isacharparenleft}}Cex\ v{\isaliteral{29}{\isacharparenright}}\ \ \ \ \ \ \ {\isaliteral{3D}{\isacharequal}}\ {\isaliteral{5B}{\isacharbrackleft}}Const\ v{\isaliteral{5D}{\isacharbrackright}}{\isaliteral{22}{\isachardoublequoteclose}}\ {\isaliteral{7C}{\isacharbar}}\isanewline
  14.102 -{\isaliteral{22}{\isachardoublequoteopen}}compile\ {\isaliteral{28}{\isacharparenleft}}Vex\ a{\isaliteral{29}{\isacharparenright}}\ \ \ \ \ \ \ {\isaliteral{3D}{\isacharequal}}\ {\isaliteral{5B}{\isacharbrackleft}}Load\ a{\isaliteral{5D}{\isacharbrackright}}{\isaliteral{22}{\isachardoublequoteclose}}\ {\isaliteral{7C}{\isacharbar}}\isanewline
  14.103 -{\isaliteral{22}{\isachardoublequoteopen}}compile\ {\isaliteral{28}{\isacharparenleft}}Bex\ f\ e{\isadigit{1}}\ e{\isadigit{2}}{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{3D}{\isacharequal}}\ {\isaliteral{28}{\isacharparenleft}}compile\ e{\isadigit{2}}{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{40}{\isacharat}}\ {\isaliteral{28}{\isacharparenleft}}compile\ e{\isadigit{1}}{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{40}{\isacharat}}\ {\isaliteral{5B}{\isacharbrackleft}}Apply\ f{\isaliteral{5D}{\isacharbrackright}}{\isaliteral{22}{\isachardoublequoteclose}}%
  14.104 -\begin{isamarkuptext}%
  14.105 -Now we have to prove the correctness of the compiler, i.e.\ that the
  14.106 -execution of a compiled expression results in the value of the expression:%
  14.107 -\end{isamarkuptext}%
  14.108 -\isamarkuptrue%
  14.109 -\isacommand{theorem}\isamarkupfalse%
  14.110 -\ {\isaliteral{22}{\isachardoublequoteopen}}exec\ {\isaliteral{28}{\isacharparenleft}}compile\ e{\isaliteral{29}{\isacharparenright}}\ s\ {\isaliteral{5B}{\isacharbrackleft}}{\isaliteral{5D}{\isacharbrackright}}\ {\isaliteral{3D}{\isacharequal}}\ {\isaliteral{5B}{\isacharbrackleft}}value\ e\ s{\isaliteral{5D}{\isacharbrackright}}{\isaliteral{22}{\isachardoublequoteclose}}%
  14.111 -\isadelimproof
  14.112 -%
  14.113 -\endisadelimproof
  14.114 -%
  14.115 -\isatagproof
  14.116 -%
  14.117 -\endisatagproof
  14.118 -{\isafoldproof}%
  14.119 -%
  14.120 -\isadelimproof
  14.121 -%
  14.122 -\endisadelimproof
  14.123 -%
  14.124 -\begin{isamarkuptext}%
  14.125 -\noindent
  14.126 -This theorem needs to be generalized:%
  14.127 -\end{isamarkuptext}%
  14.128 -\isamarkuptrue%
  14.129 -\isacommand{theorem}\isamarkupfalse%
  14.130 -\ {\isaliteral{22}{\isachardoublequoteopen}}{\isaliteral{5C3C666F72616C6C3E}{\isasymforall}}vs{\isaliteral{2E}{\isachardot}}\ exec\ {\isaliteral{28}{\isacharparenleft}}compile\ e{\isaliteral{29}{\isacharparenright}}\ s\ vs\ {\isaliteral{3D}{\isacharequal}}\ {\isaliteral{28}{\isacharparenleft}}value\ e\ s{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{23}{\isacharhash}}\ vs{\isaliteral{22}{\isachardoublequoteclose}}%
  14.131 -\isadelimproof
  14.132 -%
  14.133 -\endisadelimproof
  14.134 -%
  14.135 -\isatagproof
  14.136 -%
  14.137 -\begin{isamarkuptxt}%
  14.138 -\noindent
  14.139 -It will be proved by induction on \isa{e} followed by simplification.  
  14.140 -First, we must prove a lemma about executing the concatenation of two
  14.141 -instruction sequences:%
  14.142 -\end{isamarkuptxt}%
  14.143 -\isamarkuptrue%
  14.144 -%
  14.145 -\endisatagproof
  14.146 -{\isafoldproof}%
  14.147 -%
  14.148 -\isadelimproof
  14.149 -%
  14.150 -\endisadelimproof
  14.151 -\isacommand{lemma}\isamarkupfalse%
  14.152 -\ exec{\isaliteral{5F}{\isacharunderscore}}app{\isaliteral{5B}{\isacharbrackleft}}simp{\isaliteral{5D}{\isacharbrackright}}{\isaliteral{3A}{\isacharcolon}}\isanewline
  14.153 -\ \ {\isaliteral{22}{\isachardoublequoteopen}}{\isaliteral{5C3C666F72616C6C3E}{\isasymforall}}vs{\isaliteral{2E}{\isachardot}}\ exec\ {\isaliteral{28}{\isacharparenleft}}xs{\isaliteral{40}{\isacharat}}ys{\isaliteral{29}{\isacharparenright}}\ s\ vs\ {\isaliteral{3D}{\isacharequal}}\ exec\ ys\ s\ {\isaliteral{28}{\isacharparenleft}}exec\ xs\ s\ vs{\isaliteral{29}{\isacharparenright}}{\isaliteral{22}{\isachardoublequoteclose}}%
  14.154 -\isadelimproof
  14.155 -%
  14.156 -\endisadelimproof
  14.157 -%
  14.158 -\isatagproof
  14.159 -%
  14.160 -\begin{isamarkuptxt}%
  14.161 -\noindent
  14.162 -This requires induction on \isa{xs} and ordinary simplification for the
  14.163 -base cases. In the induction step, simplification leaves us with a formula
  14.164 -that contains two \isa{case}-expressions over instructions. Thus we add
  14.165 -automatic case splitting, which finishes the proof:%
  14.166 -\end{isamarkuptxt}%
  14.167 -\isamarkuptrue%
  14.168 -\isacommand{apply}\isamarkupfalse%
  14.169 -{\isaliteral{28}{\isacharparenleft}}induct{\isaliteral{5F}{\isacharunderscore}}tac\ xs{\isaliteral{2C}{\isacharcomma}}\ simp{\isaliteral{2C}{\isacharcomma}}\ simp\ split{\isaliteral{3A}{\isacharcolon}}\ instr{\isaliteral{2E}{\isachardot}}split{\isaliteral{29}{\isacharparenright}}%
  14.170 -\endisatagproof
  14.171 -{\isafoldproof}%
  14.172 -%
  14.173 -\isadelimproof
  14.174 -%
  14.175 -\endisadelimproof
  14.176 -%
  14.177 -\begin{isamarkuptext}%
  14.178 -\noindent
  14.179 -Note that because both \methdx{simp_all} and \methdx{auto} perform simplification, they can
  14.180 -be modified in the same way as \isa{simp}.  Thus the proof can be
  14.181 -rewritten as%
  14.182 -\end{isamarkuptext}%
  14.183 -\isamarkuptrue%
  14.184 -%
  14.185 -\isadelimproof
  14.186 -%
  14.187 -\endisadelimproof
  14.188 -%
  14.189 -\isatagproof
  14.190 -\isacommand{apply}\isamarkupfalse%
  14.191 -{\isaliteral{28}{\isacharparenleft}}induct{\isaliteral{5F}{\isacharunderscore}}tac\ xs{\isaliteral{2C}{\isacharcomma}}\ simp{\isaliteral{5F}{\isacharunderscore}}all\ split{\isaliteral{3A}{\isacharcolon}}\ instr{\isaliteral{2E}{\isachardot}}split{\isaliteral{29}{\isacharparenright}}%
  14.192 -\endisatagproof
  14.193 -{\isafoldproof}%
  14.194 -%
  14.195 -\isadelimproof
  14.196 -%
  14.197 -\endisadelimproof
  14.198 -%
  14.199 -\begin{isamarkuptext}%
  14.200 -\noindent
  14.201 -Although this is more compact, it is less clear for the reader of the proof.
  14.202 -
  14.203 -We could now go back and prove \isa{exec\ {\isaliteral{28}{\isacharparenleft}}compile\ e{\isaliteral{29}{\isacharparenright}}\ s\ {\isaliteral{5B}{\isacharbrackleft}}{\isaliteral{5D}{\isacharbrackright}}\ {\isaliteral{3D}{\isacharequal}}\ {\isaliteral{5B}{\isacharbrackleft}}value\ e\ s{\isaliteral{5D}{\isacharbrackright}}}
  14.204 -merely by simplification with the generalized version we just proved.
  14.205 -However, this is unnecessary because the generalized version fully subsumes
  14.206 -its instance.%
  14.207 -\index{compiling expressions example|)}%
  14.208 -\end{isamarkuptext}%
  14.209 -\isamarkuptrue%
  14.210 -%
  14.211 -\isadelimproof
  14.212 -%
  14.213 -\endisadelimproof
  14.214 -%
  14.215 -\isatagproof
  14.216 -%
  14.217 -\endisatagproof
  14.218 -{\isafoldproof}%
  14.219 -%
  14.220 -\isadelimproof
  14.221 -%
  14.222 -\endisadelimproof
  14.223 -%
  14.224 -\isadelimtheory
  14.225 -%
  14.226 -\endisadelimtheory
  14.227 -%
  14.228 -\isatagtheory
  14.229 -%
  14.230 -\endisatagtheory
  14.231 -{\isafoldtheory}%
  14.232 -%
  14.233 -\isadelimtheory
  14.234 -%
  14.235 -\endisadelimtheory
  14.236 -\end{isabellebody}%
  14.237 -%%% Local Variables:
  14.238 -%%% mode: latex
  14.239 -%%% TeX-master: "root"
  14.240 -%%% End:

    15.1 --- a/doc-src/TutorialI/Datatype/Nested.thy	Thu Jul 26 16:08:16 2012 +0200
    15.2 +++ b/doc-src/TutorialI/Datatype/Nested.thy	Thu Jul 26 19:59:06 2012 +0200
    15.3 @@ -30,7 +30,7 @@
    15.4  would be something like
    15.5  \medskip
    15.6  
    15.7 -\input{Datatype/document/unfoldnested.tex}
    15.8 +\input{document/unfoldnested.tex}
    15.9  \medskip
   15.10  
   15.11  \noindent

    16.1 --- a/doc-src/TutorialI/Datatype/ROOT.ML	Thu Jul 26 16:08:16 2012 +0200
    16.2 +++ /dev/null	Thu Jan 01 00:00:00 1970 +0000
    16.3 @@ -1,5 +0,0 @@
    16.4 -use "../settings.ML";
    16.5 -use_thy "ABexpr";
    16.6 -use_thy "unfoldnested";
    16.7 -use_thy "Nested";
    16.8 -use_thy "Fundata";

    17.1 --- a/doc-src/TutorialI/Datatype/document/ABexpr.tex	Thu Jul 26 16:08:16 2012 +0200
    17.2 +++ /dev/null	Thu Jan 01 00:00:00 1970 +0000
    17.3 @@ -1,199 +0,0 @@
    17.4 -%
    17.5 -\begin{isabellebody}%
    17.6 -\def\isabellecontext{ABexpr}%
    17.7 -%
    17.8 -\isadelimtheory
    17.9 -%
   17.10 -\endisadelimtheory
   17.11 -%
   17.12 -\isatagtheory
   17.13 -%
   17.14 -\endisatagtheory
   17.15 -{\isafoldtheory}%
   17.16 -%
   17.17 -\isadelimtheory
   17.18 -%
   17.19 -\endisadelimtheory
   17.20 -%
   17.21 -\begin{isamarkuptext}%
   17.22 -\index{datatypes!mutually recursive}%
   17.23 -Sometimes it is necessary to define two datatypes that depend on each
   17.24 -other. This is called \textbf{mutual recursion}. As an example consider a
   17.25 -language of arithmetic and boolean expressions where
   17.26 -\begin{itemize}
   17.27 -\item arithmetic expressions contain boolean expressions because there are
   17.28 -  conditional expressions like ``if $m<n$ then $n-m$ else $m-n$'',
   17.29 -  and
   17.30 -\item boolean expressions contain arithmetic expressions because of
   17.31 -  comparisons like ``$m<n$''.
   17.32 -\end{itemize}
   17.33 -In Isabelle this becomes%
   17.34 -\end{isamarkuptext}%
   17.35 -\isamarkuptrue%
   17.36 -\isacommand{datatype}\isamarkupfalse%
   17.37 -\ {\isaliteral{27}{\isacharprime}}a\ aexp\ {\isaliteral{3D}{\isacharequal}}\ IF\ \ \ {\isaliteral{22}{\isachardoublequoteopen}}{\isaliteral{27}{\isacharprime}}a\ bexp{\isaliteral{22}{\isachardoublequoteclose}}\ {\isaliteral{22}{\isachardoublequoteopen}}{\isaliteral{27}{\isacharprime}}a\ aexp{\isaliteral{22}{\isachardoublequoteclose}}\ {\isaliteral{22}{\isachardoublequoteopen}}{\isaliteral{27}{\isacharprime}}a\ aexp{\isaliteral{22}{\isachardoublequoteclose}}\isanewline
   17.38 -\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ {\isaliteral{7C}{\isacharbar}}\ Sum\ \ {\isaliteral{22}{\isachardoublequoteopen}}{\isaliteral{27}{\isacharprime}}a\ aexp{\isaliteral{22}{\isachardoublequoteclose}}\ {\isaliteral{22}{\isachardoublequoteopen}}{\isaliteral{27}{\isacharprime}}a\ aexp{\isaliteral{22}{\isachardoublequoteclose}}\isanewline
   17.39 -\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ {\isaliteral{7C}{\isacharbar}}\ Diff\ {\isaliteral{22}{\isachardoublequoteopen}}{\isaliteral{27}{\isacharprime}}a\ aexp{\isaliteral{22}{\isachardoublequoteclose}}\ {\isaliteral{22}{\isachardoublequoteopen}}{\isaliteral{27}{\isacharprime}}a\ aexp{\isaliteral{22}{\isachardoublequoteclose}}\isanewline
   17.40 -\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ {\isaliteral{7C}{\isacharbar}}\ Var\ {\isaliteral{27}{\isacharprime}}a\isanewline
   17.41 -\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ {\isaliteral{7C}{\isacharbar}}\ Num\ nat\isanewline
   17.42 -\isakeyword{and}\ \ \ \ \ \ {\isaliteral{27}{\isacharprime}}a\ bexp\ {\isaliteral{3D}{\isacharequal}}\ Less\ {\isaliteral{22}{\isachardoublequoteopen}}{\isaliteral{27}{\isacharprime}}a\ aexp{\isaliteral{22}{\isachardoublequoteclose}}\ {\isaliteral{22}{\isachardoublequoteopen}}{\isaliteral{27}{\isacharprime}}a\ aexp{\isaliteral{22}{\isachardoublequoteclose}}\isanewline
   17.43 -\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ {\isaliteral{7C}{\isacharbar}}\ And\ \ {\isaliteral{22}{\isachardoublequoteopen}}{\isaliteral{27}{\isacharprime}}a\ bexp{\isaliteral{22}{\isachardoublequoteclose}}\ {\isaliteral{22}{\isachardoublequoteopen}}{\isaliteral{27}{\isacharprime}}a\ bexp{\isaliteral{22}{\isachardoublequoteclose}}\isanewline
   17.44 -\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ {\isaliteral{7C}{\isacharbar}}\ Neg\ \ {\isaliteral{22}{\isachardoublequoteopen}}{\isaliteral{27}{\isacharprime}}a\ bexp{\isaliteral{22}{\isachardoublequoteclose}}%
   17.45 -\begin{isamarkuptext}%
   17.46 -\noindent
   17.47 -Type \isa{aexp} is similar to \isa{expr} in \S\ref{sec:ExprCompiler},
   17.48 -except that we have added an \isa{IF} constructor,
   17.49 -fixed the values to be of type \isa{nat} and declared the two binary
   17.50 -operations \isa{Sum} and \isa{Diff}.  Boolean
   17.51 -expressions can be arithmetic comparisons, conjunctions and negations.
   17.52 -The semantics is given by two evaluation functions:%
   17.53 -\end{isamarkuptext}%
   17.54 -\isamarkuptrue%
   17.55 -\isacommand{primrec}\isamarkupfalse%
   17.56 -\ evala\ {\isaliteral{3A}{\isacharcolon}}{\isaliteral{3A}{\isacharcolon}}\ {\isaliteral{22}{\isachardoublequoteopen}}{\isaliteral{27}{\isacharprime}}a\ aexp\ {\isaliteral{5C3C52696768746172726F773E}{\isasymRightarrow}}\ {\isaliteral{28}{\isacharparenleft}}{\isaliteral{27}{\isacharprime}}a\ {\isaliteral{5C3C52696768746172726F773E}{\isasymRightarrow}}\ nat{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C52696768746172726F773E}{\isasymRightarrow}}\ nat{\isaliteral{22}{\isachardoublequoteclose}}\ \isakeyword{and}\isanewline
   17.57 -\ \ \ \ \ \ \ \ \ evalb\ {\isaliteral{3A}{\isacharcolon}}{\isaliteral{3A}{\isacharcolon}}\ {\isaliteral{22}{\isachardoublequoteopen}}{\isaliteral{27}{\isacharprime}}a\ bexp\ {\isaliteral{5C3C52696768746172726F773E}{\isasymRightarrow}}\ {\isaliteral{28}{\isacharparenleft}}{\isaliteral{27}{\isacharprime}}a\ {\isaliteral{5C3C52696768746172726F773E}{\isasymRightarrow}}\ nat{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C52696768746172726F773E}{\isasymRightarrow}}\ bool{\isaliteral{22}{\isachardoublequoteclose}}\ \isakeyword{where}\isanewline
   17.58 -{\isaliteral{22}{\isachardoublequoteopen}}evala\ {\isaliteral{28}{\isacharparenleft}}IF\ b\ a{\isadigit{1}}\ a{\isadigit{2}}{\isaliteral{29}{\isacharparenright}}\ env\ {\isaliteral{3D}{\isacharequal}}\isanewline
   17.59 -\ \ \ {\isaliteral{28}{\isacharparenleft}}if\ evalb\ b\ env\ then\ evala\ a{\isadigit{1}}\ env\ else\ evala\ a{\isadigit{2}}\ env{\isaliteral{29}{\isacharparenright}}{\isaliteral{22}{\isachardoublequoteclose}}\ {\isaliteral{7C}{\isacharbar}}\isanewline
   17.60 -{\isaliteral{22}{\isachardoublequoteopen}}evala\ {\isaliteral{28}{\isacharparenleft}}Sum\ a{\isadigit{1}}\ a{\isadigit{2}}{\isaliteral{29}{\isacharparenright}}\ env\ {\isaliteral{3D}{\isacharequal}}\ evala\ a{\isadigit{1}}\ env\ {\isaliteral{2B}{\isacharplus}}\ evala\ a{\isadigit{2}}\ env{\isaliteral{22}{\isachardoublequoteclose}}\ {\isaliteral{7C}{\isacharbar}}\isanewline
   17.61 -{\isaliteral{22}{\isachardoublequoteopen}}evala\ {\isaliteral{28}{\isacharparenleft}}Diff\ a{\isadigit{1}}\ a{\isadigit{2}}{\isaliteral{29}{\isacharparenright}}\ env\ {\isaliteral{3D}{\isacharequal}}\ evala\ a{\isadigit{1}}\ env\ {\isaliteral{2D}{\isacharminus}}\ evala\ a{\isadigit{2}}\ env{\isaliteral{22}{\isachardoublequoteclose}}\ {\isaliteral{7C}{\isacharbar}}\isanewline
   17.62 -{\isaliteral{22}{\isachardoublequoteopen}}evala\ {\isaliteral{28}{\isacharparenleft}}Var\ v{\isaliteral{29}{\isacharparenright}}\ env\ {\isaliteral{3D}{\isacharequal}}\ env\ v{\isaliteral{22}{\isachardoublequoteclose}}\ {\isaliteral{7C}{\isacharbar}}\isanewline
   17.63 -{\isaliteral{22}{\isachardoublequoteopen}}evala\ {\isaliteral{28}{\isacharparenleft}}Num\ n{\isaliteral{29}{\isacharparenright}}\ env\ {\isaliteral{3D}{\isacharequal}}\ n{\isaliteral{22}{\isachardoublequoteclose}}\ {\isaliteral{7C}{\isacharbar}}\isanewline
   17.64 -\isanewline
   17.65 -{\isaliteral{22}{\isachardoublequoteopen}}evalb\ {\isaliteral{28}{\isacharparenleft}}Less\ a{\isadigit{1}}\ a{\isadigit{2}}{\isaliteral{29}{\isacharparenright}}\ env\ {\isaliteral{3D}{\isacharequal}}\ {\isaliteral{28}{\isacharparenleft}}evala\ a{\isadigit{1}}\ env\ {\isaliteral{3C}{\isacharless}}\ evala\ a{\isadigit{2}}\ env{\isaliteral{29}{\isacharparenright}}{\isaliteral{22}{\isachardoublequoteclose}}\ {\isaliteral{7C}{\isacharbar}}\isanewline
   17.66 -{\isaliteral{22}{\isachardoublequoteopen}}evalb\ {\isaliteral{28}{\isacharparenleft}}And\ b{\isadigit{1}}\ b{\isadigit{2}}{\isaliteral{29}{\isacharparenright}}\ env\ {\isaliteral{3D}{\isacharequal}}\ {\isaliteral{28}{\isacharparenleft}}evalb\ b{\isadigit{1}}\ env\ {\isaliteral{5C3C616E643E}{\isasymand}}\ evalb\ b{\isadigit{2}}\ env{\isaliteral{29}{\isacharparenright}}{\isaliteral{22}{\isachardoublequoteclose}}\ {\isaliteral{7C}{\isacharbar}}\isanewline
   17.67 -{\isaliteral{22}{\isachardoublequoteopen}}evalb\ {\isaliteral{28}{\isacharparenleft}}Neg\ b{\isaliteral{29}{\isacharparenright}}\ env\ {\isaliteral{3D}{\isacharequal}}\ {\isaliteral{28}{\isacharparenleft}}{\isaliteral{5C3C6E6F743E}{\isasymnot}}\ evalb\ b\ env{\isaliteral{29}{\isacharparenright}}{\isaliteral{22}{\isachardoublequoteclose}}%
   17.68 -\begin{isamarkuptext}%
   17.69 -\noindent
   17.70 -
   17.71 -Both take an expression and an environment (a mapping from variables
   17.72 -\isa{{\isaliteral{27}{\isacharprime}}a} to values \isa{nat}) and return its arithmetic/boolean
   17.73 -value. Since the datatypes are mutually recursive, so are functions
   17.74 -that operate on them. Hence they need to be defined in a single
   17.75 -\isacommand{primrec} section. Notice the \isakeyword{and} separating
   17.76 -the declarations of \isa{evala} and \isa{evalb}. Their defining
   17.77 -equations need not be split into two groups;
   17.78 -the empty line is purely for readability.
   17.79 -
   17.80 -In the same fashion we also define two functions that perform substitution:%
   17.81 -\end{isamarkuptext}%
   17.82 -\isamarkuptrue%
   17.83 -\isacommand{primrec}\isamarkupfalse%
   17.84 -\ substa\ {\isaliteral{3A}{\isacharcolon}}{\isaliteral{3A}{\isacharcolon}}\ {\isaliteral{22}{\isachardoublequoteopen}}{\isaliteral{28}{\isacharparenleft}}{\isaliteral{27}{\isacharprime}}a\ {\isaliteral{5C3C52696768746172726F773E}{\isasymRightarrow}}\ {\isaliteral{27}{\isacharprime}}b\ aexp{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C52696768746172726F773E}{\isasymRightarrow}}\ {\isaliteral{27}{\isacharprime}}a\ aexp\ {\isaliteral{5C3C52696768746172726F773E}{\isasymRightarrow}}\ {\isaliteral{27}{\isacharprime}}b\ aexp{\isaliteral{22}{\isachardoublequoteclose}}\ \isakeyword{and}\isanewline
   17.85 -\ \ \ \ \ \ \ \ \ substb\ {\isaliteral{3A}{\isacharcolon}}{\isaliteral{3A}{\isacharcolon}}\ {\isaliteral{22}{\isachardoublequoteopen}}{\isaliteral{28}{\isacharparenleft}}{\isaliteral{27}{\isacharprime}}a\ {\isaliteral{5C3C52696768746172726F773E}{\isasymRightarrow}}\ {\isaliteral{27}{\isacharprime}}b\ aexp{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C52696768746172726F773E}{\isasymRightarrow}}\ {\isaliteral{27}{\isacharprime}}a\ bexp\ {\isaliteral{5C3C52696768746172726F773E}{\isasymRightarrow}}\ {\isaliteral{27}{\isacharprime}}b\ bexp{\isaliteral{22}{\isachardoublequoteclose}}\ \isakeyword{where}\isanewline
   17.86 -{\isaliteral{22}{\isachardoublequoteopen}}substa\ s\ {\isaliteral{28}{\isacharparenleft}}IF\ b\ a{\isadigit{1}}\ a{\isadigit{2}}{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{3D}{\isacharequal}}\isanewline
   17.87 -\ \ \ IF\ {\isaliteral{28}{\isacharparenleft}}substb\ s\ b{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{28}{\isacharparenleft}}substa\ s\ a{\isadigit{1}}{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{28}{\isacharparenleft}}substa\ s\ a{\isadigit{2}}{\isaliteral{29}{\isacharparenright}}{\isaliteral{22}{\isachardoublequoteclose}}\ {\isaliteral{7C}{\isacharbar}}\isanewline
   17.88 -{\isaliteral{22}{\isachardoublequoteopen}}substa\ s\ {\isaliteral{28}{\isacharparenleft}}Sum\ a{\isadigit{1}}\ a{\isadigit{2}}{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{3D}{\isacharequal}}\ Sum\ {\isaliteral{28}{\isacharparenleft}}substa\ s\ a{\isadigit{1}}{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{28}{\isacharparenleft}}substa\ s\ a{\isadigit{2}}{\isaliteral{29}{\isacharparenright}}{\isaliteral{22}{\isachardoublequoteclose}}\ {\isaliteral{7C}{\isacharbar}}\isanewline
   17.89 -{\isaliteral{22}{\isachardoublequoteopen}}substa\ s\ {\isaliteral{28}{\isacharparenleft}}Diff\ a{\isadigit{1}}\ a{\isadigit{2}}{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{3D}{\isacharequal}}\ Diff\ {\isaliteral{28}{\isacharparenleft}}substa\ s\ a{\isadigit{1}}{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{28}{\isacharparenleft}}substa\ s\ a{\isadigit{2}}{\isaliteral{29}{\isacharparenright}}{\isaliteral{22}{\isachardoublequoteclose}}\ {\isaliteral{7C}{\isacharbar}}\isanewline
   17.90 -{\isaliteral{22}{\isachardoublequoteopen}}substa\ s\ {\isaliteral{28}{\isacharparenleft}}Var\ v{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{3D}{\isacharequal}}\ s\ v{\isaliteral{22}{\isachardoublequoteclose}}\ {\isaliteral{7C}{\isacharbar}}\isanewline
   17.91 -{\isaliteral{22}{\isachardoublequoteopen}}substa\ s\ {\isaliteral{28}{\isacharparenleft}}Num\ n{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{3D}{\isacharequal}}\ Num\ n{\isaliteral{22}{\isachardoublequoteclose}}\ {\isaliteral{7C}{\isacharbar}}\isanewline
   17.92 -\isanewline
   17.93 -{\isaliteral{22}{\isachardoublequoteopen}}substb\ s\ {\isaliteral{28}{\isacharparenleft}}Less\ a{\isadigit{1}}\ a{\isadigit{2}}{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{3D}{\isacharequal}}\ Less\ {\isaliteral{28}{\isacharparenleft}}substa\ s\ a{\isadigit{1}}{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{28}{\isacharparenleft}}substa\ s\ a{\isadigit{2}}{\isaliteral{29}{\isacharparenright}}{\isaliteral{22}{\isachardoublequoteclose}}\ {\isaliteral{7C}{\isacharbar}}\isanewline
   17.94 -{\isaliteral{22}{\isachardoublequoteopen}}substb\ s\ {\isaliteral{28}{\isacharparenleft}}And\ b{\isadigit{1}}\ b{\isadigit{2}}{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{3D}{\isacharequal}}\ And\ {\isaliteral{28}{\isacharparenleft}}substb\ s\ b{\isadigit{1}}{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{28}{\isacharparenleft}}substb\ s\ b{\isadigit{2}}{\isaliteral{29}{\isacharparenright}}{\isaliteral{22}{\isachardoublequoteclose}}\ {\isaliteral{7C}{\isacharbar}}\isanewline
   17.95 -{\isaliteral{22}{\isachardoublequoteopen}}substb\ s\ {\isaliteral{28}{\isacharparenleft}}Neg\ b{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{3D}{\isacharequal}}\ Neg\ {\isaliteral{28}{\isacharparenleft}}substb\ s\ b{\isaliteral{29}{\isacharparenright}}{\isaliteral{22}{\isachardoublequoteclose}}%
   17.96 -\begin{isamarkuptext}%
   17.97 -\noindent
   17.98 -Their first argument is a function mapping variables to expressions, the
   17.99 -substitution. It is applied to all variables in the second argument. As a
  17.100 -result, the type of variables in the expression may change from \isa{{\isaliteral{27}{\isacharprime}}a}
  17.101 -to \isa{{\isaliteral{27}{\isacharprime}}b}. Note that there are only arithmetic and no boolean variables.
  17.102 -
  17.103 -Now we can prove a fundamental theorem about the interaction between
  17.104 -evaluation and substitution: applying a substitution $s$ to an expression $a$
  17.105 -and evaluating the result in an environment $env$ yields the same result as
  17.106 -evaluation $a$ in the environment that maps every variable $x$ to the value
  17.107 -of $s(x)$ under $env$. If you try to prove this separately for arithmetic or
  17.108 -boolean expressions (by induction), you find that you always need the other
  17.109 -theorem in the induction step. Therefore you need to state and prove both
  17.110 -theorems simultaneously:%
  17.111 -\end{isamarkuptext}%
  17.112 -\isamarkuptrue%
  17.113 -\isacommand{lemma}\isamarkupfalse%
  17.114 -\ {\isaliteral{22}{\isachardoublequoteopen}}evala\ {\isaliteral{28}{\isacharparenleft}}substa\ s\ a{\isaliteral{29}{\isacharparenright}}\ env\ {\isaliteral{3D}{\isacharequal}}\ evala\ a\ {\isaliteral{28}{\isacharparenleft}}{\isaliteral{5C3C6C616D6264613E}{\isasymlambda}}x{\isaliteral{2E}{\isachardot}}\ evala\ {\isaliteral{28}{\isacharparenleft}}s\ x{\isaliteral{29}{\isacharparenright}}\ env{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C616E643E}{\isasymand}}\isanewline
  17.115 -\ \ \ \ \ \ \ \ evalb\ {\isaliteral{28}{\isacharparenleft}}substb\ s\ b{\isaliteral{29}{\isacharparenright}}\ env\ {\isaliteral{3D}{\isacharequal}}\ evalb\ b\ {\isaliteral{28}{\isacharparenleft}}{\isaliteral{5C3C6C616D6264613E}{\isasymlambda}}x{\isaliteral{2E}{\isachardot}}\ evala\ {\isaliteral{28}{\isacharparenleft}}s\ x{\isaliteral{29}{\isacharparenright}}\ env{\isaliteral{29}{\isacharparenright}}{\isaliteral{22}{\isachardoublequoteclose}}\isanewline
  17.116 -%
  17.117 -\isadelimproof
  17.118 -%
  17.119 -\endisadelimproof
  17.120 -%
  17.121 -\isatagproof
  17.122 -\isacommand{apply}\isamarkupfalse%
  17.123 -{\isaliteral{28}{\isacharparenleft}}induct{\isaliteral{5F}{\isacharunderscore}}tac\ a\ \isakeyword{and}\ b{\isaliteral{29}{\isacharparenright}}%
  17.124 -\begin{isamarkuptxt}%
  17.125 -\noindent The resulting 8 goals (one for each constructor) are proved in one fell swoop:%
  17.126 -\end{isamarkuptxt}%
  17.127 -\isamarkuptrue%
  17.128 -\isacommand{apply}\isamarkupfalse%
  17.129 -\ simp{\isaliteral{5F}{\isacharunderscore}}all%
  17.130 -\endisatagproof
  17.131 -{\isafoldproof}%
  17.132 -%
  17.133 -\isadelimproof
  17.134 -%
  17.135 -\endisadelimproof
  17.136 -%
  17.137 -\begin{isamarkuptext}%
  17.138 -In general, given $n$ mutually recursive datatypes $\tau@1$, \dots, $\tau@n$,
  17.139 -an inductive proof expects a goal of the form
  17.140 -\[ P@1(x@1)\ \land \dots \land P@n(x@n) \]
  17.141 -where each variable $x@i$ is of type $\tau@i$. Induction is started by
  17.142 -\begin{isabelle}
  17.143 -\isacommand{apply}\isa{{\isaliteral{28}{\isacharparenleft}}induct{\isaliteral{5F}{\isacharunderscore}}tac} $x@1$ \isacommand{and} \dots\ \isacommand{and} $x@n$\isa{{\isaliteral{29}{\isacharparenright}}}
  17.144 -\end{isabelle}
  17.145 -
  17.146 -\begin{exercise}
  17.147 -  Define a function \isa{norma} of type \isa{{\isaliteral{27}{\isacharprime}}a\ aexp\ {\isaliteral{5C3C52696768746172726F773E}{\isasymRightarrow}}\ {\isaliteral{27}{\isacharprime}}a\ aexp} that
  17.148 -  replaces \isa{IF}s with complex boolean conditions by nested
  17.149 -  \isa{IF}s; it should eliminate the constructors
  17.150 -  \isa{And} and \isa{Neg}, leaving only \isa{Less}.
  17.151 -  Prove that \isa{norma}
  17.152 -  preserves the value of an expression and that the result of \isa{norma}
  17.153 -  is really normal, i.e.\ no more \isa{And}s and \isa{Neg}s occur in
  17.154 -  it.  ({\em Hint:} proceed as in \S\ref{sec:boolex} and read the discussion
  17.155 -  of type annotations following lemma \isa{subst{\isaliteral{5F}{\isacharunderscore}}id} below).
  17.156 -\end{exercise}%
  17.157 -\end{isamarkuptext}%
  17.158 -\isamarkuptrue%
  17.159 -%
  17.160 -\isadelimproof
  17.161 -%
  17.162 -\endisadelimproof
  17.163 -%
  17.164 -\isatagproof
  17.165 -%
  17.166 -\endisatagproof
  17.167 -{\isafoldproof}%
  17.168 -%
  17.169 -\isadelimproof
  17.170 -%
  17.171 -\endisadelimproof
  17.172 -%
  17.173 -\isadelimproof
  17.174 -%
  17.175 -\endisadelimproof
  17.176 -%
  17.177 -\isatagproof
  17.178 -%
  17.179 -\endisatagproof
  17.180 -{\isafoldproof}%
  17.181 -%
  17.182 -\isadelimproof
  17.183 -%
  17.184 -\endisadelimproof
  17.185 -%
  17.186 -\isadelimtheory
  17.187 -%
  17.188 -\endisadelimtheory
  17.189 -%
  17.190 -\isatagtheory
  17.191 -%
  17.192 -\endisatagtheory
  17.193 -{\isafoldtheory}%
  17.194 -%
  17.195 -\isadelimtheory
  17.196 -%
  17.197 -\endisadelimtheory
  17.198 -\end{isabellebody}%
  17.199 -%%% Local Variables:
  17.200 -%%% mode: latex
  17.201 -%%% TeX-master: "root"
  17.202 -%%% End:

    18.1 --- a/doc-src/TutorialI/Datatype/document/Fundata.tex	Thu Jul 26 16:08:16 2012 +0200
    18.2 +++ /dev/null	Thu Jan 01 00:00:00 1970 +0000
    18.3 @@ -1,115 +0,0 @@
    18.4 -%
    18.5 -\begin{isabellebody}%
    18.6 -\def\isabellecontext{Fundata}%
    18.7 -%
    18.8 -\isadelimtheory
    18.9 -%
   18.10 -\endisadelimtheory
   18.11 -%
   18.12 -\isatagtheory
   18.13 -%
   18.14 -\endisatagtheory
   18.15 -{\isafoldtheory}%
   18.16 -%
   18.17 -\isadelimtheory
   18.18 -%
   18.19 -\endisadelimtheory
   18.20 -\isacommand{datatype}\isamarkupfalse%
   18.21 -\ {\isaliteral{28}{\isacharparenleft}}{\isaliteral{27}{\isacharprime}}a{\isaliteral{2C}{\isacharcomma}}{\isaliteral{27}{\isacharprime}}i{\isaliteral{29}{\isacharparenright}}bigtree\ {\isaliteral{3D}{\isacharequal}}\ Tip\ {\isaliteral{7C}{\isacharbar}}\ Br\ {\isaliteral{27}{\isacharprime}}a\ {\isaliteral{22}{\isachardoublequoteopen}}{\isaliteral{27}{\isacharprime}}i\ {\isaliteral{5C3C52696768746172726F773E}{\isasymRightarrow}}\ {\isaliteral{28}{\isacharparenleft}}{\isaliteral{27}{\isacharprime}}a{\isaliteral{2C}{\isacharcomma}}{\isaliteral{27}{\isacharprime}}i{\isaliteral{29}{\isacharparenright}}bigtree{\isaliteral{22}{\isachardoublequoteclose}}%
   18.22 -\begin{isamarkuptext}%
   18.23 -\noindent
   18.24 -Parameter \isa{{\isaliteral{27}{\isacharprime}}a} is the type of values stored in
   18.25 -the \isa{Br}anches of the tree, whereas \isa{{\isaliteral{27}{\isacharprime}}i} is the index
   18.26 -type over which the tree branches. If \isa{{\isaliteral{27}{\isacharprime}}i} is instantiated to
   18.27 -\isa{bool}, the result is a binary tree; if it is instantiated to
   18.28 -\isa{nat}, we have an infinitely branching tree because each node
   18.29 -has as many subtrees as there are natural numbers. How can we possibly
   18.30 -write down such a tree? Using functional notation! For example, the term
   18.31 -\begin{isabelle}%
   18.32 -\ \ \ \ \ Br\ {\isadigit{0}}\ {\isaliteral{28}{\isacharparenleft}}{\isaliteral{5C3C6C616D6264613E}{\isasymlambda}}i{\isaliteral{2E}{\isachardot}}\ Br\ i\ {\isaliteral{28}{\isacharparenleft}}{\isaliteral{5C3C6C616D6264613E}{\isasymlambda}}n{\isaliteral{2E}{\isachardot}}\ Tip{\isaliteral{29}{\isacharparenright}}{\isaliteral{29}{\isacharparenright}}%
   18.33 -\end{isabelle}
   18.34 -of type \isa{{\isaliteral{28}{\isacharparenleft}}nat{\isaliteral{2C}{\isacharcomma}}\ nat{\isaliteral{29}{\isacharparenright}}\ bigtree} is the tree whose
   18.35 -root is labeled with 0 and whose $i$th subtree is labeled with $i$ and
   18.36 -has merely \isa{Tip}s as further subtrees.
   18.37 -
   18.38 -Function \isa{map{\isaliteral{5F}{\isacharunderscore}}bt} applies a function to all labels in a \isa{bigtree}:%
   18.39 -\end{isamarkuptext}%
   18.40 -\isamarkuptrue%
   18.41 -\isacommand{primrec}\isamarkupfalse%
   18.42 -\ map{\isaliteral{5F}{\isacharunderscore}}bt\ {\isaliteral{3A}{\isacharcolon}}{\isaliteral{3A}{\isacharcolon}}\ {\isaliteral{22}{\isachardoublequoteopen}}{\isaliteral{28}{\isacharparenleft}}{\isaliteral{27}{\isacharprime}}a\ {\isaliteral{5C3C52696768746172726F773E}{\isasymRightarrow}}\ {\isaliteral{27}{\isacharprime}}b{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C52696768746172726F773E}{\isasymRightarrow}}\ {\isaliteral{28}{\isacharparenleft}}{\isaliteral{27}{\isacharprime}}a{\isaliteral{2C}{\isacharcomma}}{\isaliteral{27}{\isacharprime}}i{\isaliteral{29}{\isacharparenright}}bigtree\ {\isaliteral{5C3C52696768746172726F773E}{\isasymRightarrow}}\ {\isaliteral{28}{\isacharparenleft}}{\isaliteral{27}{\isacharprime}}b{\isaliteral{2C}{\isacharcomma}}{\isaliteral{27}{\isacharprime}}i{\isaliteral{29}{\isacharparenright}}bigtree{\isaliteral{22}{\isachardoublequoteclose}}\isanewline
   18.43 -\isakeyword{where}\isanewline
   18.44 -{\isaliteral{22}{\isachardoublequoteopen}}map{\isaliteral{5F}{\isacharunderscore}}bt\ f\ Tip\ \ \ \ \ \ {\isaliteral{3D}{\isacharequal}}\ Tip{\isaliteral{22}{\isachardoublequoteclose}}\ {\isaliteral{7C}{\isacharbar}}\isanewline
   18.45 -{\isaliteral{22}{\isachardoublequoteopen}}map{\isaliteral{5F}{\isacharunderscore}}bt\ f\ {\isaliteral{28}{\isacharparenleft}}Br\ a\ F{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{3D}{\isacharequal}}\ Br\ {\isaliteral{28}{\isacharparenleft}}f\ a{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{28}{\isacharparenleft}}{\isaliteral{5C3C6C616D6264613E}{\isasymlambda}}i{\isaliteral{2E}{\isachardot}}\ map{\isaliteral{5F}{\isacharunderscore}}bt\ f\ {\isaliteral{28}{\isacharparenleft}}F\ i{\isaliteral{29}{\isacharparenright}}{\isaliteral{29}{\isacharparenright}}{\isaliteral{22}{\isachardoublequoteclose}}%
   18.46 -\begin{isamarkuptext}%
   18.47 -\noindent This is a valid \isacommand{primrec} definition because the
   18.48 -recursive calls of \isa{map{\isaliteral{5F}{\isacharunderscore}}bt} involve only subtrees of
   18.49 -\isa{F}, which is itself a subterm of the left-hand side. Thus termination
   18.50 -is assured.  The seasoned functional programmer might try expressing
   18.51 -\isa{{\isaliteral{5C3C6C616D6264613E}{\isasymlambda}}i{\isaliteral{2E}{\isachardot}}\ map{\isaliteral{5F}{\isacharunderscore}}bt\ f\ {\isaliteral{28}{\isacharparenleft}}F\ i{\isaliteral{29}{\isacharparenright}}} as \isa{map{\isaliteral{5F}{\isacharunderscore}}bt\ f\ {\isaliteral{5C3C636972633E}{\isasymcirc}}\ F}, which Isabelle 
   18.52 -however will reject.  Applying \isa{map{\isaliteral{5F}{\isacharunderscore}}bt} to only one of its arguments
   18.53 -makes the termination proof less obvious.
   18.54 -
   18.55 -The following lemma has a simple proof by induction:%
   18.56 -\end{isamarkuptext}%
   18.57 -\isamarkuptrue%
   18.58 -\isacommand{lemma}\isamarkupfalse%
   18.59 -\ {\isaliteral{22}{\isachardoublequoteopen}}map{\isaliteral{5F}{\isacharunderscore}}bt\ {\isaliteral{28}{\isacharparenleft}}g\ o\ f{\isaliteral{29}{\isacharparenright}}\ T\ {\isaliteral{3D}{\isacharequal}}\ map{\isaliteral{5F}{\isacharunderscore}}bt\ g\ {\isaliteral{28}{\isacharparenleft}}map{\isaliteral{5F}{\isacharunderscore}}bt\ f\ T{\isaliteral{29}{\isacharparenright}}{\isaliteral{22}{\isachardoublequoteclose}}\isanewline
   18.60 -%
   18.61 -\isadelimproof
   18.62 -%
   18.63 -\endisadelimproof
   18.64 -%
   18.65 -\isatagproof
   18.66 -\isacommand{apply}\isamarkupfalse%
   18.67 -{\isaliteral{28}{\isacharparenleft}}induct{\isaliteral{5F}{\isacharunderscore}}tac\ T{\isaliteral{2C}{\isacharcomma}}\ simp{\isaliteral{5F}{\isacharunderscore}}all{\isaliteral{29}{\isacharparenright}}\isanewline
   18.68 -\isacommand{done}\isamarkupfalse%
   18.69 -%
   18.70 -\endisatagproof
   18.71 -{\isafoldproof}%
   18.72 -%
   18.73 -\isadelimproof
   18.74 -%
   18.75 -\endisadelimproof
   18.76 -%
   18.77 -\isadelimproof
   18.78 -%
   18.79 -\endisadelimproof
   18.80 -%
   18.81 -\isatagproof
   18.82 -%
   18.83 -\begin{isamarkuptxt}%
   18.84 -\noindent
   18.85 -Because of the function type, the proof state after induction looks unusual.
   18.86 -Notice the quantified induction hypothesis:
   18.87 -\begin{isabelle}%
   18.88 -\ {\isadigit{1}}{\isaliteral{2E}{\isachardot}}\ map{\isaliteral{5F}{\isacharunderscore}}bt\ {\isaliteral{28}{\isacharparenleft}}g\ {\isaliteral{5C3C636972633E}{\isasymcirc}}\ f{\isaliteral{29}{\isacharparenright}}\ Tip\ {\isaliteral{3D}{\isacharequal}}\ map{\isaliteral{5F}{\isacharunderscore}}bt\ g\ {\isaliteral{28}{\isacharparenleft}}map{\isaliteral{5F}{\isacharunderscore}}bt\ f\ Tip{\isaliteral{29}{\isacharparenright}}\isanewline
   18.89 -\ {\isadigit{2}}{\isaliteral{2E}{\isachardot}}\ {\isaliteral{5C3C416E643E}{\isasymAnd}}a\ F{\isaliteral{2E}{\isachardot}}\ {\isaliteral{28}{\isacharparenleft}}{\isaliteral{5C3C416E643E}{\isasymAnd}}x{\isaliteral{2E}{\isachardot}}\ map{\isaliteral{5F}{\isacharunderscore}}bt\ {\isaliteral{28}{\isacharparenleft}}g\ {\isaliteral{5C3C636972633E}{\isasymcirc}}\ f{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{28}{\isacharparenleft}}F\ x{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{3D}{\isacharequal}}\ map{\isaliteral{5F}{\isacharunderscore}}bt\ g\ {\isaliteral{28}{\isacharparenleft}}map{\isaliteral{5F}{\isacharunderscore}}bt\ f\ {\isaliteral{28}{\isacharparenleft}}F\ x{\isaliteral{29}{\isacharparenright}}{\isaliteral{29}{\isacharparenright}}{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C4C6F6E6772696768746172726F773E}{\isasymLongrightarrow}}\isanewline
   18.90 -\isaindent{\ {\isadigit{2}}{\isaliteral{2E}{\isachardot}}\ {\isaliteral{5C3C416E643E}{\isasymAnd}}a\ F{\isaliteral{2E}{\isachardot}}\ }map{\isaliteral{5F}{\isacharunderscore}}bt\ {\isaliteral{28}{\isacharparenleft}}g\ {\isaliteral{5C3C636972633E}{\isasymcirc}}\ f{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{28}{\isacharparenleft}}Br\ a\ F{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{3D}{\isacharequal}}\ map{\isaliteral{5F}{\isacharunderscore}}bt\ g\ {\isaliteral{28}{\isacharparenleft}}map{\isaliteral{5F}{\isacharunderscore}}bt\ f\ {\isaliteral{28}{\isacharparenleft}}Br\ a\ F{\isaliteral{29}{\isacharparenright}}{\isaliteral{29}{\isacharparenright}}%
   18.91 -\end{isabelle}%
   18.92 -\end{isamarkuptxt}%
   18.93 -\isamarkuptrue%
   18.94 -%
   18.95 -\endisatagproof
   18.96 -{\isafoldproof}%
   18.97 -%
   18.98 -\isadelimproof
   18.99 -%
  18.100 -\endisadelimproof
  18.101 -%
  18.102 -\isadelimtheory
  18.103 -%
  18.104 -\endisadelimtheory
  18.105 -%
  18.106 -\isatagtheory
  18.107 -%
  18.108 -\endisatagtheory
  18.109 -{\isafoldtheory}%
  18.110 -%
  18.111 -\isadelimtheory
  18.112 -%
  18.113 -\endisadelimtheory
  18.114 -\end{isabellebody}%
  18.115 -%%% Local Variables:
  18.116 -%%% mode: latex
  18.117 -%%% TeX-master: "root"
  18.118 -%%% End:

    19.1 --- a/doc-src/TutorialI/Datatype/document/Nested.tex	Thu Jul 26 16:08:16 2012 +0200
    19.2 +++ /dev/null	Thu Jan 01 00:00:00 1970 +0000
    19.3 @@ -1,240 +0,0 @@
    19.4 -%
    19.5 -\begin{isabellebody}%
    19.6 -\def\isabellecontext{Nested}%
    19.7 -%
    19.8 -\isadelimtheory
    19.9 -%
   19.10 -\endisadelimtheory
   19.11 -%
   19.12 -\isatagtheory
   19.13 -%
   19.14 -\endisatagtheory
   19.15 -{\isafoldtheory}%
   19.16 -%
   19.17 -\isadelimtheory
   19.18 -%
   19.19 -\endisadelimtheory
   19.20 -%
   19.21 -\begin{isamarkuptext}%
   19.22 -\index{datatypes!and nested recursion}%
   19.23 -So far, all datatypes had the property that on the right-hand side of their
   19.24 -definition they occurred only at the top-level: directly below a
   19.25 -constructor. Now we consider \emph{nested recursion}, where the recursive
   19.26 -datatype occurs nested in some other datatype (but not inside itself!).
   19.27 -Consider the following model of terms
   19.28 -where function symbols can be applied to a list of arguments:%
   19.29 -\end{isamarkuptext}%
   19.30 -\isamarkuptrue%
   19.31 -\isacommand{datatype}\isamarkupfalse%
   19.32 -\ {\isaliteral{28}{\isacharparenleft}}{\isaliteral{27}{\isacharprime}}v{\isaliteral{2C}{\isacharcomma}}{\isaliteral{27}{\isacharprime}}f{\isaliteral{29}{\isacharparenright}}{\isaliteral{22}{\isachardoublequoteopen}}term{\isaliteral{22}{\isachardoublequoteclose}}\ {\isaliteral{3D}{\isacharequal}}\ Var\ {\isaliteral{27}{\isacharprime}}v\ {\isaliteral{7C}{\isacharbar}}\ App\ {\isaliteral{27}{\isacharprime}}f\ {\isaliteral{22}{\isachardoublequoteopen}}{\isaliteral{28}{\isacharparenleft}}{\isaliteral{27}{\isacharprime}}v{\isaliteral{2C}{\isacharcomma}}{\isaliteral{27}{\isacharprime}}f{\isaliteral{29}{\isacharparenright}}term\ list{\isaliteral{22}{\isachardoublequoteclose}}%
   19.33 -\begin{isamarkuptext}%
   19.34 -\noindent
   19.35 -Note that we need to quote \isa{term} on the left to avoid confusion with
   19.36 -the Isabelle command \isacommand{term}.
   19.37 -Parameter \isa{{\isaliteral{27}{\isacharprime}}v} is the type of variables and \isa{{\isaliteral{27}{\isacharprime}}f} the type of
   19.38 -function symbols.
   19.39 -A mathematical term like $f(x,g(y))$ becomes \isa{App\ f\ {\isaliteral{5B}{\isacharbrackleft}}Var\ x{\isaliteral{2C}{\isacharcomma}}\ App\ g\ {\isaliteral{5B}{\isacharbrackleft}}Var\ y{\isaliteral{5D}{\isacharbrackright}}{\isaliteral{5D}{\isacharbrackright}}}, where \isa{f}, \isa{g}, \isa{x}, \isa{y} are
   19.40 -suitable values, e.g.\ numbers or strings.
   19.41 -
   19.42 -What complicates the definition of \isa{term} is the nested occurrence of
   19.43 -\isa{term} inside \isa{list} on the right-hand side. In principle,
   19.44 -nested recursion can be eliminated in favour of mutual recursion by unfolding
   19.45 -the offending datatypes, here \isa{list}. The result for \isa{term}
   19.46 -would be something like
   19.47 -\medskip
   19.48 -
   19.49 -\input{Datatype/document/unfoldnested.tex}
   19.50 -\medskip
   19.51 -
   19.52 -\noindent
   19.53 -Although we do not recommend this unfolding to the user, it shows how to
   19.54 -simulate nested recursion by mutual recursion.
   19.55 -Now we return to the initial definition of \isa{term} using
   19.56 -nested recursion.
   19.57 -
   19.58 -Let us define a substitution function on terms. Because terms involve term
   19.59 -lists, we need to define two substitution functions simultaneously:%
   19.60 -\end{isamarkuptext}%
   19.61 -\isamarkuptrue%
   19.62 -\isacommand{primrec}\isamarkupfalse%
   19.63 -\isanewline
   19.64 -subst\ {\isaliteral{3A}{\isacharcolon}}{\isaliteral{3A}{\isacharcolon}}\ {\isaliteral{22}{\isachardoublequoteopen}}{\isaliteral{28}{\isacharparenleft}}{\isaliteral{27}{\isacharprime}}v{\isaliteral{5C3C52696768746172726F773E}{\isasymRightarrow}}{\isaliteral{28}{\isacharparenleft}}{\isaliteral{27}{\isacharprime}}v{\isaliteral{2C}{\isacharcomma}}{\isaliteral{27}{\isacharprime}}f{\isaliteral{29}{\isacharparenright}}term{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C52696768746172726F773E}{\isasymRightarrow}}\ {\isaliteral{28}{\isacharparenleft}}{\isaliteral{27}{\isacharprime}}v{\isaliteral{2C}{\isacharcomma}}{\isaliteral{27}{\isacharprime}}f{\isaliteral{29}{\isacharparenright}}term\ \ \ \ \ \ {\isaliteral{5C3C52696768746172726F773E}{\isasymRightarrow}}\ {\isaliteral{28}{\isacharparenleft}}{\isaliteral{27}{\isacharprime}}v{\isaliteral{2C}{\isacharcomma}}{\isaliteral{27}{\isacharprime}}f{\isaliteral{29}{\isacharparenright}}term{\isaliteral{22}{\isachardoublequoteclose}}\ \isakeyword{and}\isanewline
   19.65 -substs{\isaliteral{3A}{\isacharcolon}}{\isaliteral{3A}{\isacharcolon}}\ {\isaliteral{22}{\isachardoublequoteopen}}{\isaliteral{28}{\isacharparenleft}}{\isaliteral{27}{\isacharprime}}v{\isaliteral{5C3C52696768746172726F773E}{\isasymRightarrow}}{\isaliteral{28}{\isacharparenleft}}{\isaliteral{27}{\isacharprime}}v{\isaliteral{2C}{\isacharcomma}}{\isaliteral{27}{\isacharprime}}f{\isaliteral{29}{\isacharparenright}}term{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C52696768746172726F773E}{\isasymRightarrow}}\ {\isaliteral{28}{\isacharparenleft}}{\isaliteral{27}{\isacharprime}}v{\isaliteral{2C}{\isacharcomma}}{\isaliteral{27}{\isacharprime}}f{\isaliteral{29}{\isacharparenright}}term\ list\ {\isaliteral{5C3C52696768746172726F773E}{\isasymRightarrow}}\ {\isaliteral{28}{\isacharparenleft}}{\isaliteral{27}{\isacharprime}}v{\isaliteral{2C}{\isacharcomma}}{\isaliteral{27}{\isacharprime}}f{\isaliteral{29}{\isacharparenright}}term\ list{\isaliteral{22}{\isachardoublequoteclose}}\isanewline
   19.66 -\isakeyword{where}\isanewline
   19.67 -{\isaliteral{22}{\isachardoublequoteopen}}subst\ s\ {\isaliteral{28}{\isacharparenleft}}Var\ x{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{3D}{\isacharequal}}\ s\ x{\isaliteral{22}{\isachardoublequoteclose}}\ {\isaliteral{7C}{\isacharbar}}\isanewline
   19.68 -\ \ subst{\isaliteral{5F}{\isacharunderscore}}App{\isaliteral{3A}{\isacharcolon}}\isanewline
   19.69 -{\isaliteral{22}{\isachardoublequoteopen}}subst\ s\ {\isaliteral{28}{\isacharparenleft}}App\ f\ ts{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{3D}{\isacharequal}}\ App\ f\ {\isaliteral{28}{\isacharparenleft}}substs\ s\ ts{\isaliteral{29}{\isacharparenright}}{\isaliteral{22}{\isachardoublequoteclose}}\ {\isaliteral{7C}{\isacharbar}}\isanewline
   19.70 -\isanewline
   19.71 -{\isaliteral{22}{\isachardoublequoteopen}}substs\ s\ {\isaliteral{5B}{\isacharbrackleft}}{\isaliteral{5D}{\isacharbrackright}}\ {\isaliteral{3D}{\isacharequal}}\ {\isaliteral{5B}{\isacharbrackleft}}{\isaliteral{5D}{\isacharbrackright}}{\isaliteral{22}{\isachardoublequoteclose}}\ {\isaliteral{7C}{\isacharbar}}\isanewline
   19.72 -{\isaliteral{22}{\isachardoublequoteopen}}substs\ s\ {\isaliteral{28}{\isacharparenleft}}t\ {\isaliteral{23}{\isacharhash}}\ ts{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{3D}{\isacharequal}}\ subst\ s\ t\ {\isaliteral{23}{\isacharhash}}\ substs\ s\ ts{\isaliteral{22}{\isachardoublequoteclose}}%
   19.73 -\begin{isamarkuptext}%
   19.74 -\noindent
   19.75 -Individual equations in a \commdx{primrec} definition may be
   19.76 -named as shown for \isa{subst{\isaliteral{5F}{\isacharunderscore}}App}.
   19.77 -The significance of this device will become apparent below.
   19.78 -
   19.79 -Similarly, when proving a statement about terms inductively, we need
   19.80 -to prove a related statement about term lists simultaneously. For example,
   19.81 -the fact that the identity substitution does not change a term needs to be
   19.82 -strengthened and proved as follows:%
   19.83 -\end{isamarkuptext}%
   19.84 -\isamarkuptrue%
   19.85 -\isacommand{lemma}\isamarkupfalse%
   19.86 -\ subst{\isaliteral{5F}{\isacharunderscore}}id{\isaliteral{3A}{\isacharcolon}}\ {\isaliteral{22}{\isachardoublequoteopen}}subst\ \ Var\ t\ \ {\isaliteral{3D}{\isacharequal}}\ {\isaliteral{28}{\isacharparenleft}}t\ {\isaliteral{3A}{\isacharcolon}}{\isaliteral{3A}{\isacharcolon}}{\isaliteral{28}{\isacharparenleft}}{\isaliteral{27}{\isacharprime}}v{\isaliteral{2C}{\isacharcomma}}{\isaliteral{27}{\isacharprime}}f{\isaliteral{29}{\isacharparenright}}term{\isaliteral{29}{\isacharparenright}}\ \ {\isaliteral{5C3C616E643E}{\isasymand}}\isanewline
   19.87 -\ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ substs\ Var\ ts\ {\isaliteral{3D}{\isacharequal}}\ {\isaliteral{28}{\isacharparenleft}}ts{\isaliteral{3A}{\isacharcolon}}{\isaliteral{3A}{\isacharcolon}}{\isaliteral{28}{\isacharparenleft}}{\isaliteral{27}{\isacharprime}}v{\isaliteral{2C}{\isacharcomma}}{\isaliteral{27}{\isacharprime}}f{\isaliteral{29}{\isacharparenright}}term\ list{\isaliteral{29}{\isacharparenright}}{\isaliteral{22}{\isachardoublequoteclose}}\isanewline
   19.88 -%
   19.89 -\isadelimproof
   19.90 -%
   19.91 -\endisadelimproof
   19.92 -%
   19.93 -\isatagproof
   19.94 -\isacommand{apply}\isamarkupfalse%
   19.95 -{\isaliteral{28}{\isacharparenleft}}induct{\isaliteral{5F}{\isacharunderscore}}tac\ t\ \isakeyword{and}\ ts{\isaliteral{2C}{\isacharcomma}}\ simp{\isaliteral{5F}{\isacharunderscore}}all{\isaliteral{29}{\isacharparenright}}\isanewline
   19.96 -\isacommand{done}\isamarkupfalse%
   19.97 -%
   19.98 -\endisatagproof
   19.99 -{\isafoldproof}%
  19.100 -%
  19.101 -\isadelimproof
  19.102 -%
  19.103 -\endisadelimproof
  19.104 -%
  19.105 -\begin{isamarkuptext}%
  19.106 -\noindent
  19.107 -Note that \isa{Var} is the identity substitution because by definition it
  19.108 -leaves variables unchanged: \isa{subst\ Var\ {\isaliteral{28}{\isacharparenleft}}Var\ x{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{3D}{\isacharequal}}\ Var\ x}. Note also
  19.109 -that the type annotations are necessary because otherwise there is nothing in
  19.110 -the goal to enforce that both halves of the goal talk about the same type
  19.111 -parameters \isa{{\isaliteral{28}{\isacharparenleft}}{\isaliteral{27}{\isacharprime}}v{\isaliteral{2C}{\isacharcomma}}{\isaliteral{27}{\isacharprime}}f{\isaliteral{29}{\isacharparenright}}}. As a result, induction would fail
  19.112 -because the two halves of the goal would be unrelated.
  19.113 -
  19.114 -\begin{exercise}
  19.115 -The fact that substitution distributes over composition can be expressed
  19.116 -roughly as follows:
  19.117 -\begin{isabelle}%
  19.118 -\ \ \ \ \ subst\ {\isaliteral{28}{\isacharparenleft}}f\ {\isaliteral{5C3C636972633E}{\isasymcirc}}\ g{\isaliteral{29}{\isacharparenright}}\ t\ {\isaliteral{3D}{\isacharequal}}\ subst\ f\ {\isaliteral{28}{\isacharparenleft}}subst\ g\ t{\isaliteral{29}{\isacharparenright}}%
  19.119 -\end{isabelle}
  19.120 -Correct this statement (you will find that it does not type-check),
  19.121 -strengthen it, and prove it. (Note: \isa{{\isaliteral{5C3C636972633E}{\isasymcirc}}} is function composition;
  19.122 -its definition is found in theorem \isa{o{\isaliteral{5F}{\isacharunderscore}}def}).
  19.123 -\end{exercise}
  19.124 -\begin{exercise}\label{ex:trev-trev}
  19.125 -  Define a function \isa{trev} of type \isa{{\isaliteral{28}{\isacharparenleft}}{\isaliteral{27}{\isacharprime}}v{\isaliteral{2C}{\isacharcomma}}\ {\isaliteral{27}{\isacharprime}}f{\isaliteral{29}{\isacharparenright}}\ Nested{\isaliteral{2E}{\isachardot}}term\ {\isaliteral{5C3C52696768746172726F773E}{\isasymRightarrow}}\ {\isaliteral{28}{\isacharparenleft}}{\isaliteral{27}{\isacharprime}}v{\isaliteral{2C}{\isacharcomma}}\ {\isaliteral{27}{\isacharprime}}f{\isaliteral{29}{\isacharparenright}}\ Nested{\isaliteral{2E}{\isachardot}}term}
  19.126 -that recursively reverses the order of arguments of all function symbols in a
  19.127 -  term. Prove that \isa{trev\ {\isaliteral{28}{\isacharparenleft}}trev\ t{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{3D}{\isacharequal}}\ t}.
  19.128 -\end{exercise}
  19.129 -
  19.130 -The experienced functional programmer may feel that our definition of
  19.131 -\isa{subst} is too complicated in that \isa{substs} is
  19.132 -unnecessary. The \isa{App}-case can be defined directly as
  19.133 -\begin{isabelle}%
  19.134 -\ \ \ \ \ subst\ s\ {\isaliteral{28}{\isacharparenleft}}App\ f\ ts{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{3D}{\isacharequal}}\ App\ f\ {\isaliteral{28}{\isacharparenleft}}map\ {\isaliteral{28}{\isacharparenleft}}subst\ s{\isaliteral{29}{\isacharparenright}}\ ts{\isaliteral{29}{\isacharparenright}}%
  19.135 -\end{isabelle}
  19.136 -where \isa{map} is the standard list function such that
  19.137 -\isa{map\ f\ {\isaliteral{5B}{\isacharbrackleft}}x{\isadigit{1}}{\isaliteral{2C}{\isacharcomma}}{\isaliteral{2E}{\isachardot}}{\isaliteral{2E}{\isachardot}}{\isaliteral{2E}{\isachardot}}{\isaliteral{2C}{\isacharcomma}}xn{\isaliteral{5D}{\isacharbrackright}}\ {\isaliteral{3D}{\isacharequal}}\ {\isaliteral{5B}{\isacharbrackleft}}f\ x{\isadigit{1}}{\isaliteral{2C}{\isacharcomma}}{\isaliteral{2E}{\isachardot}}{\isaliteral{2E}{\isachardot}}{\isaliteral{2E}{\isachardot}}{\isaliteral{2C}{\isacharcomma}}f\ xn{\isaliteral{5D}{\isacharbrackright}}}. This is true, but Isabelle
  19.138 -insists on the conjunctive format. Fortunately, we can easily \emph{prove}
  19.139 -that the suggested equation holds:%
  19.140 -\end{isamarkuptext}%
  19.141 -\isamarkuptrue%
  19.142 -%
  19.143 -\isadelimproof
  19.144 -%
  19.145 -\endisadelimproof
  19.146 -%
  19.147 -\isatagproof
  19.148 -%
  19.149 -\endisatagproof
  19.150 -{\isafoldproof}%
  19.151 -%
  19.152 -\isadelimproof
  19.153 -%
  19.154 -\endisadelimproof
  19.155 -%
  19.156 -\isadelimproof
  19.157 -%
  19.158 -\endisadelimproof
  19.159 -%
  19.160 -\isatagproof
  19.161 -%
  19.162 -\endisatagproof
  19.163 -{\isafoldproof}%
  19.164 -%
  19.165 -\isadelimproof
  19.166 -%
  19.167 -\endisadelimproof
  19.168 -%
  19.169 -\isadelimproof
  19.170 -%
  19.171 -\endisadelimproof
  19.172 -%
  19.173 -\isatagproof
  19.174 -%
  19.175 -\endisatagproof
  19.176 -{\isafoldproof}%
  19.177 -%
  19.178 -\isadelimproof
  19.179 -\isanewline
  19.180 -%
  19.181 -\endisadelimproof
  19.182 -\isacommand{lemma}\isamarkupfalse%
  19.183 -\ {\isaliteral{5B}{\isacharbrackleft}}simp{\isaliteral{5D}{\isacharbrackright}}{\isaliteral{3A}{\isacharcolon}}\ {\isaliteral{22}{\isachardoublequoteopen}}subst\ s\ {\isaliteral{28}{\isacharparenleft}}App\ f\ ts{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{3D}{\isacharequal}}\ App\ f\ {\isaliteral{28}{\isacharparenleft}}map\ {\isaliteral{28}{\isacharparenleft}}subst\ s{\isaliteral{29}{\isacharparenright}}\ ts{\isaliteral{29}{\isacharparenright}}{\isaliteral{22}{\isachardoublequoteclose}}\isanewline
  19.184 -%
  19.185 -\isadelimproof
  19.186 -%
  19.187 -\endisadelimproof
  19.188 -%
  19.189 -\isatagproof
  19.190 -\isacommand{apply}\isamarkupfalse%
  19.191 -{\isaliteral{28}{\isacharparenleft}}induct{\isaliteral{5F}{\isacharunderscore}}tac\ ts{\isaliteral{2C}{\isacharcomma}}\ simp{\isaliteral{5F}{\isacharunderscore}}all{\isaliteral{29}{\isacharparenright}}\isanewline
  19.192 -\isacommand{done}\isamarkupfalse%
  19.193 -%
  19.194 -\endisatagproof
  19.195 -{\isafoldproof}%
  19.196 -%
  19.197 -\isadelimproof
  19.198 -%
  19.199 -\endisadelimproof
  19.200 -%
  19.201 -\begin{isamarkuptext}%
  19.202 -\noindent
  19.203 -What is more, we can now disable the old defining equation as a
  19.204 -simplification rule:%
  19.205 -\end{isamarkuptext}%
  19.206 -\isamarkuptrue%
  19.207 -\isacommand{declare}\isamarkupfalse%
  19.208 -\ subst{\isaliteral{5F}{\isacharunderscore}}App\ {\isaliteral{5B}{\isacharbrackleft}}simp\ del{\isaliteral{5D}{\isacharbrackright}}%
  19.209 -\begin{isamarkuptext}%
  19.210 -\noindent The advantage is that now we have replaced \isa{substs} by \isa{map}, we can profit from the large number of
  19.211 -pre-proved lemmas about \isa{map}.  Unfortunately, inductive proofs
  19.212 -about type \isa{term} are still awkward because they expect a
  19.213 -conjunction. One could derive a new induction principle as well (see
  19.214 -\S\ref{sec:derive-ind}), but simpler is to stop using
  19.215 -\isacommand{primrec} and to define functions with \isacommand{fun}
  19.216 -instead.  Simple uses of \isacommand{fun} are described in
  19.217 -\S\ref{sec:fun} below.  Advanced applications, including functions
  19.218 -over nested datatypes like \isa{term}, are discussed in a
  19.219 -separate tutorial~\cite{isabelle-function}.
  19.220 -
  19.221 -Of course, you may also combine mutual and nested recursion of datatypes. For example,
  19.222 -constructor \isa{Sum} in \S\ref{sec:datatype-mut-rec} could take a list of
  19.223 -expressions as its argument: \isa{Sum}~\isa{{\isaliteral{22}{\isachardoublequote}}{\isaliteral{27}{\isacharprime}}a\ aexp\ list{\isaliteral{22}{\isachardoublequote}}}.%
  19.224 -\end{isamarkuptext}%
  19.225 -\isamarkuptrue%
  19.226 -%
  19.227 -\isadelimtheory
  19.228 -%
  19.229 -\endisadelimtheory
  19.230 -%
  19.231 -\isatagtheory
  19.232 -%
  19.233 -\endisatagtheory
  19.234 -{\isafoldtheory}%
  19.235 -%
  19.236 -\isadelimtheory
  19.237 -%
  19.238 -\endisadelimtheory
  19.239 -\end{isabellebody}%
  19.240 -%%% Local Variables:
  19.241 -%%% mode: latex
  19.242 -%%% TeX-master: "root"
  19.243 -%%% End:

    20.1 --- a/doc-src/TutorialI/Datatype/document/unfoldnested.tex	Thu Jul 26 16:08:16 2012 +0200
    20.2 +++ /dev/null	Thu Jan 01 00:00:00 1970 +0000
    20.3 @@ -1,36 +0,0 @@
    20.4 -%
    20.5 -\begin{isabellebody}%
    20.6 -\def\isabellecontext{unfoldnested}%
    20.7 -%
    20.8 -\isadelimtheory
    20.9 -%
   20.10 -\endisadelimtheory
   20.11 -%
   20.12 -\isatagtheory
   20.13 -%
   20.14 -\endisatagtheory
   20.15 -{\isafoldtheory}%
   20.16 -%
   20.17 -\isadelimtheory
   20.18 -%
   20.19 -\endisadelimtheory
   20.20 -\isacommand{datatype}\isamarkupfalse%
   20.21 -\ {\isaliteral{28}{\isacharparenleft}}{\isaliteral{27}{\isacharprime}}v{\isaliteral{2C}{\isacharcomma}}{\isaliteral{27}{\isacharprime}}f{\isaliteral{29}{\isacharparenright}}{\isaliteral{22}{\isachardoublequoteopen}}term{\isaliteral{22}{\isachardoublequoteclose}}\ {\isaliteral{3D}{\isacharequal}}\ Var\ {\isaliteral{27}{\isacharprime}}v\ {\isaliteral{7C}{\isacharbar}}\ App\ {\isaliteral{27}{\isacharprime}}f\ {\isaliteral{22}{\isachardoublequoteopen}}{\isaliteral{28}{\isacharparenleft}}{\isaliteral{27}{\isacharprime}}v{\isaliteral{2C}{\isacharcomma}}{\isaliteral{27}{\isacharprime}}f{\isaliteral{29}{\isacharparenright}}term{\isaliteral{5F}{\isacharunderscore}}list{\isaliteral{22}{\isachardoublequoteclose}}\isanewline
   20.22 -\isakeyword{and}\ {\isaliteral{28}{\isacharparenleft}}{\isaliteral{27}{\isacharprime}}v{\isaliteral{2C}{\isacharcomma}}{\isaliteral{27}{\isacharprime}}f{\isaliteral{29}{\isacharparenright}}term{\isaliteral{5F}{\isacharunderscore}}list\ {\isaliteral{3D}{\isacharequal}}\ Nil\ {\isaliteral{7C}{\isacharbar}}\ Cons\ {\isaliteral{22}{\isachardoublequoteopen}}{\isaliteral{28}{\isacharparenleft}}{\isaliteral{27}{\isacharprime}}v{\isaliteral{2C}{\isacharcomma}}{\isaliteral{27}{\isacharprime}}f{\isaliteral{29}{\isacharparenright}}term{\isaliteral{22}{\isachardoublequoteclose}}\ {\isaliteral{22}{\isachardoublequoteopen}}{\isaliteral{28}{\isacharparenleft}}{\isaliteral{27}{\isacharprime}}v{\isaliteral{2C}{\isacharcomma}}{\isaliteral{27}{\isacharprime}}f{\isaliteral{29}{\isacharparenright}}term{\isaliteral{5F}{\isacharunderscore}}list{\isaliteral{22}{\isachardoublequoteclose}}%
   20.23 -\isadelimtheory
   20.24 -%
   20.25 -\endisadelimtheory
   20.26 -%
   20.27 -\isatagtheory
   20.28 -%
   20.29 -\endisatagtheory
   20.30 -{\isafoldtheory}%
   20.31 -%
   20.32 -\isadelimtheory
   20.33 -%
   20.34 -\endisadelimtheory
   20.35 -\end{isabellebody}%
   20.36 -%%% Local Variables:
   20.37 -%%% mode: latex
   20.38 -%%% TeX-master: "root"
   20.39 -%%% End:

    21.1 --- a/doc-src/TutorialI/Documents/ROOT.ML	Thu Jul 26 16:08:16 2012 +0200
    21.2 +++ /dev/null	Thu Jan 01 00:00:00 1970 +0000
    21.3 @@ -1,2 +0,0 @@
    21.4 -
    21.5 -use_thy "Documents";

    22.1 --- a/doc-src/TutorialI/Documents/document/Documents.tex	Thu Jul 26 16:08:16 2012 +0200
    22.2 +++ /dev/null	Thu Jan 01 00:00:00 1970 +0000
    22.3 @@ -1,933 +0,0 @@
    22.4 -%
    22.5 -\begin{isabellebody}%
    22.6 -\def\isabellecontext{Documents}%
    22.7 -%
    22.8 -\isadelimtheory
    22.9 -%
   22.10 -\endisadelimtheory
   22.11 -%
   22.12 -\isatagtheory
   22.13 -%
   22.14 -\endisatagtheory
   22.15 -{\isafoldtheory}%
   22.16 -%
   22.17 -\isadelimtheory
   22.18 -%
   22.19 -\endisadelimtheory
   22.20 -%
   22.21 -\isamarkupsection{Concrete Syntax \label{sec:concrete-syntax}%
   22.22 -}
   22.23 -\isamarkuptrue%
   22.24 -%
   22.25 -\begin{isamarkuptext}%
   22.26 -The core concept of Isabelle's framework for concrete syntax is that
   22.27 -  of \bfindex{mixfix annotations}.  Associated with any kind of
   22.28 -  constant declaration, mixfixes affect both the grammar productions
   22.29 -  for the parser and output templates for the pretty printer.
   22.30 -
   22.31 -  In full generality, parser and pretty printer configuration is a
   22.32 -  subtle affair~\cite{isabelle-ref}.  Your syntax specifications need
   22.33 -  to interact properly with the existing setup of Isabelle/Pure and
   22.34 -  Isabelle/HOL\@.  To avoid creating ambiguities with existing
   22.35 -  elements, it is particularly important to give new syntactic
   22.36 -  constructs the right precedence.
   22.37 -
   22.38 -  Below we introduce a few simple syntax declaration
   22.39 -  forms that already cover many common situations fairly well.%
   22.40 -\end{isamarkuptext}%
   22.41 -\isamarkuptrue%
   22.42 -%
   22.43 -\isamarkupsubsection{Infix Annotations%
   22.44 -}
   22.45 -\isamarkuptrue%
   22.46 -%
   22.47 -\begin{isamarkuptext}%
   22.48 -Syntax annotations may be included wherever constants are declared,
   22.49 -  such as \isacommand{definition} and \isacommand{primrec} --- and also
   22.50 -  \isacommand{datatype}, which declares constructor operations.
   22.51 -  Type-constructors may be annotated as well, although this is less
   22.52 -  frequently encountered in practice (the infix type \isa{{\isaliteral{5C3C74696D65733E}{\isasymtimes}}} comes
   22.53 -  to mind).
   22.54 -
   22.55 -  Infix declarations\index{infix annotations} provide a useful special
   22.56 -  case of mixfixes.  The following example of the exclusive-or
   22.57 -  operation on boolean values illustrates typical infix declarations.%
   22.58 -\end{isamarkuptext}%
   22.59 -\isamarkuptrue%
   22.60 -\isacommand{definition}\isamarkupfalse%
   22.61 -\ xor\ {\isaliteral{3A}{\isacharcolon}}{\isaliteral{3A}{\isacharcolon}}\ {\isaliteral{22}{\isachardoublequoteopen}}bool\ {\isaliteral{5C3C52696768746172726F773E}{\isasymRightarrow}}\ bool\ {\isaliteral{5C3C52696768746172726F773E}{\isasymRightarrow}}\ bool{\isaliteral{22}{\isachardoublequoteclose}}\ \ \ \ {\isaliteral{28}{\isacharparenleft}}\isakeyword{infixl}\ {\isaliteral{22}{\isachardoublequoteopen}}{\isaliteral{5B}{\isacharbrackleft}}{\isaliteral{2B}{\isacharplus}}{\isaliteral{5D}{\isacharbrackright}}{\isaliteral{22}{\isachardoublequoteclose}}\ {\isadigit{6}}{\isadigit{0}}{\isaliteral{29}{\isacharparenright}}\isanewline
   22.62 -\isakeyword{where}\ {\isaliteral{22}{\isachardoublequoteopen}}A\ {\isaliteral{5B}{\isacharbrackleft}}{\isaliteral{2B}{\isacharplus}}{\isaliteral{5D}{\isacharbrackright}}\ B\ {\isaliteral{5C3C65717569763E}{\isasymequiv}}\ {\isaliteral{28}{\isacharparenleft}}A\ {\isaliteral{5C3C616E643E}{\isasymand}}\ {\isaliteral{5C3C6E6F743E}{\isasymnot}}\ B{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C6F723E}{\isasymor}}\ {\isaliteral{28}{\isacharparenleft}}{\isaliteral{5C3C6E6F743E}{\isasymnot}}\ A\ {\isaliteral{5C3C616E643E}{\isasymand}}\ B{\isaliteral{29}{\isacharparenright}}{\isaliteral{22}{\isachardoublequoteclose}}%
   22.63 -\begin{isamarkuptext}%
   22.64 -\noindent Now \isa{xor\ A\ B} and \isa{A\ {\isaliteral{5B}{\isacharbrackleft}}{\isaliteral{2B}{\isacharplus}}{\isaliteral{5D}{\isacharbrackright}}\ B} refer to the
   22.65 -  same expression internally.  Any curried function with at least two
   22.66 -  arguments may be given infix syntax.  For partial applications with
   22.67 -  fewer than two operands, there is a notation using the prefix~\isa{op}.  For instance, \isa{xor} without arguments is represented as
   22.68 -  \isa{op\ {\isaliteral{5B}{\isacharbrackleft}}{\isaliteral{2B}{\isacharplus}}{\isaliteral{5D}{\isacharbrackright}}}; together with ordinary function application, this
   22.69 -  turns \isa{xor\ A} into \isa{op\ {\isaliteral{5B}{\isacharbrackleft}}{\isaliteral{2B}{\isacharplus}}{\isaliteral{5D}{\isacharbrackright}}\ A}.
   22.70 -
   22.71 -  The keyword \isakeyword{infixl} seen above specifies an
   22.72 -  infix operator that is nested to the \emph{left}: in iterated
   22.73 -  applications the more complex expression appears on the left-hand
   22.74 -  side, and \isa{A\ {\isaliteral{5B}{\isacharbrackleft}}{\isaliteral{2B}{\isacharplus}}{\isaliteral{5D}{\isacharbrackright}}\ B\ {\isaliteral{5B}{\isacharbrackleft}}{\isaliteral{2B}{\isacharplus}}{\isaliteral{5D}{\isacharbrackright}}\ C} stands for \isa{{\isaliteral{28}{\isacharparenleft}}A\ {\isaliteral{5B}{\isacharbrackleft}}{\isaliteral{2B}{\isacharplus}}{\isaliteral{5D}{\isacharbrackright}}\ B{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5B}{\isacharbrackleft}}{\isaliteral{2B}{\isacharplus}}{\isaliteral{5D}{\isacharbrackright}}\ C}.  Similarly, \isakeyword{infixr} means nesting to the
   22.75 -  \emph{right}, reading \isa{A\ {\isaliteral{5B}{\isacharbrackleft}}{\isaliteral{2B}{\isacharplus}}{\isaliteral{5D}{\isacharbrackright}}\ B\ {\isaliteral{5B}{\isacharbrackleft}}{\isaliteral{2B}{\isacharplus}}{\isaliteral{5D}{\isacharbrackright}}\ C} as \isa{A\ {\isaliteral{5B}{\isacharbrackleft}}{\isaliteral{2B}{\isacharplus}}{\isaliteral{5D}{\isacharbrackright}}\ {\isaliteral{28}{\isacharparenleft}}B\ {\isaliteral{5B}{\isacharbrackleft}}{\isaliteral{2B}{\isacharplus}}{\isaliteral{5D}{\isacharbrackright}}\ C{\isaliteral{29}{\isacharparenright}}}.  A \emph{non-oriented} declaration via \isakeyword{infix}
   22.76 -  would render \isa{A\ {\isaliteral{5B}{\isacharbrackleft}}{\isaliteral{2B}{\isacharplus}}{\isaliteral{5D}{\isacharbrackright}}\ B\ {\isaliteral{5B}{\isacharbrackleft}}{\isaliteral{2B}{\isacharplus}}{\isaliteral{5D}{\isacharbrackright}}\ C} illegal, but demand explicit
   22.77 -  parentheses to indicate the intended grouping.
   22.78 -
   22.79 -  The string \isa{{\isaliteral{22}{\isachardoublequote}}{\isaliteral{5B}{\isacharbrackleft}}{\isaliteral{2B}{\isacharplus}}{\isaliteral{5D}{\isacharbrackright}}{\isaliteral{22}{\isachardoublequote}}} in our annotation refers to the
   22.80 -  concrete syntax to represent the operator (a literal token), while
   22.81 -  the number \isa{{\isadigit{6}}{\isadigit{0}}} determines the precedence of the construct:
   22.82 -  the syntactic priorities of the arguments and result.  Isabelle/HOL
   22.83 -  already uses up many popular combinations of ASCII symbols for its
   22.84 -  own use, including both \isa{{\isaliteral{2B}{\isacharplus}}} and \isa{{\isaliteral{2B}{\isacharplus}}{\isaliteral{2B}{\isacharplus}}}.  Longer
   22.85 -  character combinations are more likely to be still available for
   22.86 -  user extensions, such as our~\isa{{\isaliteral{5B}{\isacharbrackleft}}{\isaliteral{2B}{\isacharplus}}{\isaliteral{5D}{\isacharbrackright}}}.
   22.87 -
   22.88 -  Operator precedences have a range of 0--1000.  Very low or high
   22.89 -  priorities are reserved for the meta-logic.  HOL syntax mainly uses
   22.90 -  the range of 10--100: the equality infix \isa{{\isaliteral{3D}{\isacharequal}}} is centered at
   22.91 -  50; logical connectives (like \isa{{\isaliteral{5C3C6F723E}{\isasymor}}} and \isa{{\isaliteral{5C3C616E643E}{\isasymand}}}) are
   22.92 -  below 50; algebraic ones (like \isa{{\isaliteral{2B}{\isacharplus}}} and \isa{{\isaliteral{2A}{\isacharasterisk}}}) are
   22.93 -  above 50.  User syntax should strive to coexist with common HOL
   22.94 -  forms, or use the mostly unused range 100--900.%
   22.95 -\end{isamarkuptext}%
   22.96 -\isamarkuptrue%
   22.97 -%
   22.98 -\isamarkupsubsection{Mathematical Symbols \label{sec:syntax-symbols}%
   22.99 -}
  22.100 -\isamarkuptrue%
  22.101 -%
  22.102 -\begin{isamarkuptext}%
  22.103 -Concrete syntax based on ASCII characters has inherent limitations.
  22.104 -  Mathematical notation demands a larger repertoire of glyphs.
  22.105 -  Several standards of extended character sets have been proposed over
  22.106 -  decades, but none has become universally available so far.  Isabelle
  22.107 -  has its own notion of \bfindex{symbols} as the smallest entities of
  22.108 -  source text, without referring to internal encodings.  There are
  22.109 -  three kinds of such ``generalized characters'':
  22.110 -
  22.111 -  \begin{enumerate}
  22.112 -
  22.113 -  \item 7-bit ASCII characters
  22.114 -
  22.115 -  \item named symbols: \verb,\,\verb,<,$ident$\verb,>,
  22.116 -
  22.117 -  \item named control symbols: \verb,\,\verb,<^,$ident$\verb,>,
  22.118 -
  22.119 -  \end{enumerate}
  22.120 -
  22.121 -  Here $ident$ is any sequence of letters. 
  22.122 -  This results in an infinite store of symbols, whose
  22.123 -  interpretation is left to further front-end tools.  For example, the
  22.124 -  user-interface of Proof~General + X-Symbol and the Isabelle document
  22.125 -  processor (see \S\ref{sec:document-preparation}) display the
  22.126 -  \verb,\,\verb,<forall>, symbol as~\isa{{\isaliteral{5C3C666F72616C6C3E}{\isasymforall}}}.
  22.127 -
  22.128 -  A list of standard Isabelle symbols is given in
  22.129 -  \cite{isabelle-isar-ref}.  You may introduce your own
  22.130 -  interpretation of further symbols by configuring the appropriate
  22.131 -  front-end tool accordingly, e.g.\ by defining certain {\LaTeX}
  22.132 -  macros (see also \S\ref{sec:doc-prep-symbols}).  There are also a
  22.133 -  few predefined control symbols, such as \verb,\,\verb,<^sub>, and
  22.134 -  \verb,\,\verb,<^sup>, for sub- and superscript of the subsequent
  22.135 -  printable symbol, respectively.  For example, \verb,A\<^sup>\<star>, is
  22.136 -  output as \isa{A\isaliteral{5C3C5E7375703E}{}\isactrlsup {\isaliteral{5C3C737461723E}{\isasymstar}}}.
  22.137 -
  22.138 -  A number of symbols are considered letters by the Isabelle lexer and
  22.139 -  can be used as part of identifiers. These are the greek letters
  22.140 -  \isa{{\isaliteral{5C3C616C7068613E}{\isasymalpha}}} (\verb+\+\verb+<alpha>+), \isa{{\isaliteral{5C3C626574613E}{\isasymbeta}}}
  22.141 -  (\verb+\+\verb+<beta>+), etc. (excluding \isa{{\isaliteral{5C3C6C616D6264613E}{\isasymlambda}}}),
  22.142 -  special letters like \isa{{\isaliteral{5C3C413E}{\isasymA}}} (\verb+\+\verb+<A>+) and \isa{{\isaliteral{5C3C41413E}{\isasymAA}}} (\verb+\+\verb+<AA>+), and the control symbols
  22.143 -  \verb+\+\verb+<^isub>+ and \verb+\+\verb+<^isup>+ for single letter
  22.144 -  sub and super scripts. This means that the input
  22.145 -
  22.146 -  \medskip
  22.147 -  {\small\noindent \verb,\,\verb,<forall>\,\verb,<alpha>\<^isub>1.,~\verb,\,\verb,<alpha>\<^isub>1 = \,\verb,<Pi>\<^isup>\<A>,}
  22.148 -
  22.149 -  \medskip
  22.150 -  \noindent is recognized as the term \isa{{\isaliteral{5C3C666F72616C6C3E}{\isasymforall}}{\isaliteral{5C3C616C7068613E}{\isasymalpha}}\isaliteral{5C3C5E697375623E}{}\isactrlisub {\isadigit{1}}{\isaliteral{2E}{\isachardot}}\ {\isaliteral{5C3C616C7068613E}{\isasymalpha}}\isaliteral{5C3C5E697375623E}{}\isactrlisub {\isadigit{1}}\ {\isaliteral{3D}{\isacharequal}}\ {\isaliteral{5C3C50693E}{\isasymPi}}\isaliteral{5C3C5E697375703E}{}\isactrlisup {\isaliteral{5C3C413E}{\isasymA}}} 
  22.151 -  by Isabelle. Note that \isa{{\isaliteral{5C3C50693E}{\isasymPi}}\isaliteral{5C3C5E697375703E}{}\isactrlisup {\isaliteral{5C3C413E}{\isasymA}}} is a single
  22.152 -  syntactic entity, not an exponentiation.
  22.153 -
  22.154 -  Replacing our previous definition of \isa{xor} by the
  22.155 -  following specifies an Isabelle symbol for the new operator:%
  22.156 -\end{isamarkuptext}%
  22.157 -\isamarkuptrue%
  22.158 -%
  22.159 -\isadelimML
  22.160 -%
  22.161 -\endisadelimML
  22.162 -%
  22.163 -\isatagML
  22.164 -%
  22.165 -\endisatagML
  22.166 -{\isafoldML}%
  22.167 -%
  22.168 -\isadelimML
  22.169 -%
  22.170 -\endisadelimML
  22.171 -\isacommand{definition}\isamarkupfalse%
  22.172 -\ xor\ {\isaliteral{3A}{\isacharcolon}}{\isaliteral{3A}{\isacharcolon}}\ {\isaliteral{22}{\isachardoublequoteopen}}bool\ {\isaliteral{5C3C52696768746172726F773E}{\isasymRightarrow}}\ bool\ {\isaliteral{5C3C52696768746172726F773E}{\isasymRightarrow}}\ bool{\isaliteral{22}{\isachardoublequoteclose}}\ \ \ \ {\isaliteral{28}{\isacharparenleft}}\isakeyword{infixl}\ {\isaliteral{22}{\isachardoublequoteopen}}{\isaliteral{5C3C6F706C75733E}{\isasymoplus}}{\isaliteral{22}{\isachardoublequoteclose}}\ {\isadigit{6}}{\isadigit{0}}{\isaliteral{29}{\isacharparenright}}\isanewline
  22.173 -\isakeyword{where}\ {\isaliteral{22}{\isachardoublequoteopen}}A\ {\isaliteral{5C3C6F706C75733E}{\isasymoplus}}\ B\ {\isaliteral{5C3C65717569763E}{\isasymequiv}}\ {\isaliteral{28}{\isacharparenleft}}A\ {\isaliteral{5C3C616E643E}{\isasymand}}\ {\isaliteral{5C3C6E6F743E}{\isasymnot}}\ B{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C6F723E}{\isasymor}}\ {\isaliteral{28}{\isacharparenleft}}{\isaliteral{5C3C6E6F743E}{\isasymnot}}\ A\ {\isaliteral{5C3C616E643E}{\isasymand}}\ B{\isaliteral{29}{\isacharparenright}}{\isaliteral{22}{\isachardoublequoteclose}}%
  22.174 -\isadelimML
  22.175 -%
  22.176 -\endisadelimML
  22.177 -%
  22.178 -\isatagML
  22.179 -%
  22.180 -\endisatagML
  22.181 -{\isafoldML}%
  22.182 -%
  22.183 -\isadelimML
  22.184 -%
  22.185 -\endisadelimML
  22.186 -%
  22.187 -\begin{isamarkuptext}%
  22.188 -\noindent Proof~General provides several input methods to enter
  22.189 -  \isa{{\isaliteral{5C3C6F706C75733E}{\isasymoplus}}} in the text.  If all fails one may just type a named
  22.190 -  entity \verb,\,\verb,<oplus>, by hand; the corresponding symbol will
  22.191 -  be displayed after further input.
  22.192 -
  22.193 -  More flexible is to provide alternative syntax forms
  22.194 -  through the \bfindex{print mode} concept~\cite{isabelle-ref}.  By
  22.195 -  convention, the mode of ``$xsymbols$'' is enabled whenever
  22.196 -  Proof~General's X-Symbol mode or {\LaTeX} output is active.  Now
  22.197 -  consider the following hybrid declaration of \isa{xor}:%
  22.198 -\end{isamarkuptext}%
  22.199 -\isamarkuptrue%
  22.200 -%
  22.201 -\isadelimML
  22.202 -%
  22.203 -\endisadelimML
  22.204 -%
  22.205 -\isatagML
  22.206 -%
  22.207 -\endisatagML
  22.208 -{\isafoldML}%
  22.209 -%
  22.210 -\isadelimML
  22.211 -%
  22.212 -\endisadelimML
  22.213 -\isacommand{definition}\isamarkupfalse%
  22.214 -\ xor\ {\isaliteral{3A}{\isacharcolon}}{\isaliteral{3A}{\isacharcolon}}\ {\isaliteral{22}{\isachardoublequoteopen}}bool\ {\isaliteral{5C3C52696768746172726F773E}{\isasymRightarrow}}\ bool\ {\isaliteral{5C3C52696768746172726F773E}{\isasymRightarrow}}\ bool{\isaliteral{22}{\isachardoublequoteclose}}\ \ \ \ {\isaliteral{28}{\isacharparenleft}}\isakeyword{infixl}\ {\isaliteral{22}{\isachardoublequoteopen}}{\isaliteral{5B}{\isacharbrackleft}}{\isaliteral{2B}{\isacharplus}}{\isaliteral{5D}{\isacharbrackright}}{\isaliteral{5C3C69676E6F72653E}{\isasymignore}}{\isaliteral{22}{\isachardoublequoteclose}}\ {\isadigit{6}}{\isadigit{0}}{\isaliteral{29}{\isacharparenright}}\isanewline
  22.215 -\isakeyword{where}\ {\isaliteral{22}{\isachardoublequoteopen}}A\ {\isaliteral{5B}{\isacharbrackleft}}{\isaliteral{2B}{\isacharplus}}{\isaliteral{5D}{\isacharbrackright}}{\isaliteral{5C3C69676E6F72653E}{\isasymignore}}\ B\ {\isaliteral{5C3C65717569763E}{\isasymequiv}}\ {\isaliteral{28}{\isacharparenleft}}A\ {\isaliteral{5C3C616E643E}{\isasymand}}\ {\isaliteral{5C3C6E6F743E}{\isasymnot}}\ B{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C6F723E}{\isasymor}}\ {\isaliteral{28}{\isacharparenleft}}{\isaliteral{5C3C6E6F743E}{\isasymnot}}\ A\ {\isaliteral{5C3C616E643E}{\isasymand}}\ B{\isaliteral{29}{\isacharparenright}}{\isaliteral{22}{\isachardoublequoteclose}}\isanewline
  22.216 -\isanewline
  22.217 -\isacommand{notation}\isamarkupfalse%
  22.218 -\ {\isaliteral{28}{\isacharparenleft}}xsymbols{\isaliteral{29}{\isacharparenright}}\ xor\ {\isaliteral{28}{\isacharparenleft}}\isakeyword{infixl}\ {\isaliteral{22}{\isachardoublequoteopen}}{\isaliteral{5C3C6F706C75733E}{\isasymoplus}}{\isaliteral{5C3C69676E6F72653E}{\isasymignore}}{\isaliteral{22}{\isachardoublequoteclose}}\ {\isadigit{6}}{\isadigit{0}}{\isaliteral{29}{\isacharparenright}}%
  22.219 -\isadelimML
  22.220 -%
  22.221 -\endisadelimML
  22.222 -%
  22.223 -\isatagML
  22.224 -%
  22.225 -\endisatagML
  22.226 -{\isafoldML}%
  22.227 -%
  22.228 -\isadelimML
  22.229 -%
  22.230 -\endisadelimML
  22.231 -%
  22.232 -\begin{isamarkuptext}%
  22.233 -\noindent
  22.234 -The \commdx{notation} command associates a mixfix
  22.235 -annotation with a known constant.  The print mode specification,
  22.236 -here \isa{{\isaliteral{28}{\isacharparenleft}}xsymbols{\isaliteral{29}{\isacharparenright}}}, is optional.
  22.237 -
  22.238 -We may now write \isa{A\ {\isaliteral{5B}{\isacharbrackleft}}{\isaliteral{2B}{\isacharplus}}{\isaliteral{5D}{\isacharbrackright}}\ B} or \isa{A\ {\isaliteral{5C3C6F706C75733E}{\isasymoplus}}\ B} in input, while
  22.239 -output uses the nicer syntax of $xsymbols$ whenever that print mode is
  22.240 -active.  Such an arrangement is particularly useful for interactive
  22.241 -development, where users may type ASCII text and see mathematical
  22.242 -symbols displayed during proofs.%
  22.243 -\end{isamarkuptext}%
  22.244 -\isamarkuptrue%
  22.245 -%
  22.246 -\isamarkupsubsection{Prefix Annotations%
  22.247 -}
  22.248 -\isamarkuptrue%
  22.249 -%
  22.250 -\begin{isamarkuptext}%
  22.251 -Prefix syntax annotations\index{prefix annotation} are another form
  22.252 -  of mixfixes \cite{isabelle-ref}, without any template arguments or
  22.253 -  priorities --- just some literal syntax.  The following example
  22.254 -  associates common symbols with the constructors of a datatype.%
  22.255 -\end{isamarkuptext}%
  22.256 -\isamarkuptrue%
  22.257 -\isacommand{datatype}\isamarkupfalse%
  22.258 -\ currency\ {\isaliteral{3D}{\isacharequal}}\isanewline
  22.259 -\ \ \ \ Euro\ nat\ \ \ \ {\isaliteral{28}{\isacharparenleft}}{\isaliteral{22}{\isachardoublequoteopen}}{\isaliteral{5C3C6575726F3E}{\isasymeuro}}{\isaliteral{22}{\isachardoublequoteclose}}{\isaliteral{29}{\isacharparenright}}\isanewline
  22.260 -\ \ {\isaliteral{7C}{\isacharbar}}\ Pounds\ nat\ \ {\isaliteral{28}{\isacharparenleft}}{\isaliteral{22}{\isachardoublequoteopen}}{\isaliteral{5C3C706F756E64733E}{\isasympounds}}{\isaliteral{22}{\isachardoublequoteclose}}{\isaliteral{29}{\isacharparenright}}\isanewline
  22.261 -\ \ {\isaliteral{7C}{\isacharbar}}\ Yen\ nat\ \ \ \ \ {\isaliteral{28}{\isacharparenleft}}{\isaliteral{22}{\isachardoublequoteopen}}{\isaliteral{5C3C79656E3E}{\isasymyen}}{\isaliteral{22}{\isachardoublequoteclose}}{\isaliteral{29}{\isacharparenright}}\isanewline
  22.262 -\ \ {\isaliteral{7C}{\isacharbar}}\ Dollar\ nat\ \ {\isaliteral{28}{\isacharparenleft}}{\isaliteral{22}{\isachardoublequoteopen}}{\isaliteral{24}{\isachardollar}}{\isaliteral{22}{\isachardoublequoteclose}}{\isaliteral{29}{\isacharparenright}}%
  22.263 -\begin{isamarkuptext}%
  22.264 -\noindent Here the mixfix annotations on the rightmost column happen
  22.265 -  to consist of a single Isabelle symbol each: \verb,\,\verb,<euro>,,
  22.266 -  \verb,\,\verb,<pounds>,, \verb,\,\verb,<yen>,, and \verb,$,.  Recall
  22.267 -  that a constructor like \isa{Euro} actually is a function \isa{nat\ {\isaliteral{5C3C52696768746172726F773E}{\isasymRightarrow}}\ currency}.  The expression \isa{Euro\ {\isadigit{1}}{\isadigit{0}}} will be
  22.268 -  printed as \isa{{\isaliteral{5C3C6575726F3E}{\isasymeuro}}\ {\isadigit{1}}{\isadigit{0}}}; only the head of the application is
  22.269 -  subject to our concrete syntax.  This rather simple form already
  22.270 -  achieves conformance with notational standards of the European
  22.271 -  Commission.
  22.272 -
  22.273 -  Prefix syntax works the same way for other commands that introduce new constants, e.g. \isakeyword{primrec}.%
  22.274 -\end{isamarkuptext}%
  22.275 -\isamarkuptrue%
  22.276 -%
  22.277 -\isamarkupsubsection{Abbreviations \label{sec:abbreviations}%
  22.278 -}
  22.279 -\isamarkuptrue%
  22.280 -%
  22.281 -\begin{isamarkuptext}%
  22.282 -Mixfix syntax annotations merely decorate particular constant
  22.283 -application forms with concrete syntax, for instance replacing
  22.284 -\isa{xor\ A\ B} by \isa{A\ {\isaliteral{5C3C6F706C75733E}{\isasymoplus}}\ B}.  Occasionally, the relationship
  22.285 -between some piece of notation and its internal form is more
  22.286 -complicated.  Here we need \emph{abbreviations}.
  22.287 -
  22.288 -Command \commdx{abbreviation} introduces an uninterpreted notational
  22.289 -constant as an abbreviation for a complex term. Abbreviations are
  22.290 -unfolded upon parsing and re-introduced upon printing. This provides a
  22.291 -simple mechanism for syntactic macros.
  22.292 -
  22.293 -A typical use of abbreviations is to introduce relational notation for
  22.294 -membership in a set of pairs, replacing \isa{{\isaliteral{28}{\isacharparenleft}}x{\isaliteral{2C}{\isacharcomma}}\ y{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C696E3E}{\isasymin}}\ sim} by
  22.295 -\isa{x\ {\isaliteral{5C3C617070726F783E}{\isasymapprox}}\ y}. We assume that a constant \isa{sim} of type
  22.296 -\isa{{\isaliteral{28}{\isacharparenleft}}{\isaliteral{27}{\isacharprime}}a\ {\isaliteral{5C3C74696D65733E}{\isasymtimes}}\ {\isaliteral{27}{\isacharprime}}a{\isaliteral{29}{\isacharparenright}}\ set} has been introduced at this point.%
  22.297 -\end{isamarkuptext}%
  22.298 -\isamarkuptrue%
  22.299 -\isacommand{abbreviation}\isamarkupfalse%
  22.300 -\ sim{\isadigit{2}}\ {\isaliteral{3A}{\isacharcolon}}{\isaliteral{3A}{\isacharcolon}}\ {\isaliteral{22}{\isachardoublequoteopen}}{\isaliteral{27}{\isacharprime}}a\ {\isaliteral{5C3C52696768746172726F773E}{\isasymRightarrow}}\ {\isaliteral{27}{\isacharprime}}a\ {\isaliteral{5C3C52696768746172726F773E}{\isasymRightarrow}}\ bool{\isaliteral{22}{\isachardoublequoteclose}}\ \ \ {\isaliteral{28}{\isacharparenleft}}\isakeyword{infix}\ {\isaliteral{22}{\isachardoublequoteopen}}{\isaliteral{5C3C617070726F783E}{\isasymapprox}}{\isaliteral{22}{\isachardoublequoteclose}}\ {\isadigit{5}}{\isadigit{0}}{\isaliteral{29}{\isacharparenright}}\isanewline
  22.301 -\isakeyword{where}\ {\isaliteral{22}{\isachardoublequoteopen}}x\ {\isaliteral{5C3C617070726F783E}{\isasymapprox}}\ y\ \ {\isaliteral{5C3C65717569763E}{\isasymequiv}}\ \ {\isaliteral{28}{\isacharparenleft}}x{\isaliteral{2C}{\isacharcomma}}\ y{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C696E3E}{\isasymin}}\ sim{\isaliteral{22}{\isachardoublequoteclose}}%
  22.302 -\begin{isamarkuptext}%
  22.303 -\noindent The given meta-equality is used as a rewrite rule
  22.304 -after parsing (replacing \mbox{\isa{x\ {\isaliteral{5C3C617070726F783E}{\isasymapprox}}\ y}} by \isa{{\isaliteral{28}{\isacharparenleft}}x{\isaliteral{2C}{\isacharcomma}}y{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C696E3E}{\isasymin}}\ sim}) and before printing (turning \isa{{\isaliteral{28}{\isacharparenleft}}x{\isaliteral{2C}{\isacharcomma}}y{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C696E3E}{\isasymin}}\ sim} back into
  22.305 -\mbox{\isa{x\ {\isaliteral{5C3C617070726F783E}{\isasymapprox}}\ y}}). The name of the dummy constant \isa{sim{\isadigit{2}}}
  22.306 -does not matter, as long as it is unique.
  22.307 -
  22.308 -Another common application of abbreviations is to
  22.309 -provide variant versions of fundamental relational expressions, such
  22.310 -as \isa{{\isaliteral{5C3C6E6F7465713E}{\isasymnoteq}}} for negated equalities.  The following declaration
  22.311 -stems from Isabelle/HOL itself:%
  22.312 -\end{isamarkuptext}%
  22.313 -\isamarkuptrue%
  22.314 -\isacommand{abbreviation}\isamarkupfalse%
  22.315 -\ not{\isaliteral{5F}{\isacharunderscore}}equal\ {\isaliteral{3A}{\isacharcolon}}{\isaliteral{3A}{\isacharcolon}}\ {\isaliteral{22}{\isachardoublequoteopen}}{\isaliteral{27}{\isacharprime}}a\ {\isaliteral{5C3C52696768746172726F773E}{\isasymRightarrow}}\ {\isaliteral{27}{\isacharprime}}a\ {\isaliteral{5C3C52696768746172726F773E}{\isasymRightarrow}}\ bool{\isaliteral{22}{\isachardoublequoteclose}}\ \ \ \ {\isaliteral{28}{\isacharparenleft}}\isakeyword{infixl}\ {\isaliteral{22}{\isachardoublequoteopen}}{\isaliteral{7E}{\isachartilde}}{\isaliteral{3D}{\isacharequal}}{\isaliteral{5C3C69676E6F72653E}{\isasymignore}}{\isaliteral{22}{\isachardoublequoteclose}}\ {\isadigit{5}}{\isadigit{0}}{\isaliteral{29}{\isacharparenright}}\isanewline
  22.316 -\isakeyword{where}\ {\isaliteral{22}{\isachardoublequoteopen}}x\ {\isaliteral{7E}{\isachartilde}}{\isaliteral{3D}{\isacharequal}}{\isaliteral{5C3C69676E6F72653E}{\isasymignore}}\ y\ \ {\isaliteral{5C3C65717569763E}{\isasymequiv}}\ \ {\isaliteral{5C3C6E6F743E}{\isasymnot}}\ {\isaliteral{28}{\isacharparenleft}}x\ {\isaliteral{3D}{\isacharequal}}\ y{\isaliteral{29}{\isacharparenright}}{\isaliteral{22}{\isachardoublequoteclose}}\isanewline
  22.317 -\isanewline
  22.318 -\isacommand{notation}\isamarkupfalse%
  22.319 -\ {\isaliteral{28}{\isacharparenleft}}xsymbols{\isaliteral{29}{\isacharparenright}}\ not{\isaliteral{5F}{\isacharunderscore}}equal\ {\isaliteral{28}{\isacharparenleft}}\isakeyword{infix}\ {\isaliteral{22}{\isachardoublequoteopen}}{\isaliteral{5C3C6E6F7465713E}{\isasymnoteq}}{\isaliteral{5C3C69676E6F72653E}{\isasymignore}}{\isaliteral{22}{\isachardoublequoteclose}}\ {\isadigit{5}}{\isadigit{0}}{\isaliteral{29}{\isacharparenright}}%
  22.320 -\begin{isamarkuptext}%
  22.321 -\noindent The notation \isa{{\isaliteral{5C3C6E6F7465713E}{\isasymnoteq}}} is introduced separately to restrict it
  22.322 -to the \emph{xsymbols} mode.
  22.323 -
  22.324 -Abbreviations are appropriate when the defined concept is a
  22.325 -simple variation on an existing one.  But because of the automatic
  22.326 -folding and unfolding of abbreviations, they do not scale up well to
  22.327 -large hierarchies of concepts. Abbreviations do not replace
  22.328 -definitions.
  22.329 -
  22.330 -Abbreviations are a simplified form of the general concept of
  22.331 -\emph{syntax translations}; even heavier transformations may be
  22.332 -written in ML \cite{isabelle-ref}.%
  22.333 -\end{isamarkuptext}%
  22.334 -\isamarkuptrue%
  22.335 -%
  22.336 -\isamarkupsection{Document Preparation \label{sec:document-preparation}%
  22.337 -}
  22.338 -\isamarkuptrue%
  22.339 -%
  22.340 -\begin{isamarkuptext}%
  22.341 -Isabelle/Isar is centered around the concept of \bfindex{formal
  22.342 -  proof documents}\index{documents|bold}.  The outcome of a formal
  22.343 -  development effort is meant to be a human-readable record, presented
  22.344 -  as browsable PDF file or printed on paper.  The overall document
  22.345 -  structure follows traditional mathematical articles, with sections,
  22.346 -  intermediate explanations, definitions, theorems and proofs.
  22.347 -
  22.348 -  \medskip The Isabelle document preparation system essentially acts
  22.349 -  as a front-end to {\LaTeX}.  After checking specifications and
  22.350 -  proofs formally, the theory sources are turned into typesetting
  22.351 -  instructions in a schematic manner.  This lets you write authentic
  22.352 -  reports on theory developments with little effort: many technical
  22.353 -  consistency checks are handled by the system.
  22.354 -
  22.355 -  Here is an example to illustrate the idea of Isabelle document
  22.356 -  preparation.%
  22.357 -\end{isamarkuptext}%
  22.358 -\isamarkuptrue%
  22.359 -%
  22.360 -\begin{quotation}
  22.361 -%
  22.362 -\begin{isamarkuptext}%
  22.363 -The following datatype definition of \isa{{\isaliteral{27}{\isacharprime}}a\ bintree} models
  22.364 -  binary trees with nodes being decorated by elements of type \isa{{\isaliteral{27}{\isacharprime}}a}.%
  22.365 -\end{isamarkuptext}%
  22.366 -\isamarkuptrue%
  22.367 -\isacommand{datatype}\isamarkupfalse%
  22.368 -\ {\isaliteral{27}{\isacharprime}}a\ bintree\ {\isaliteral{3D}{\isacharequal}}\isanewline
  22.369 -\ \ \ \ \ Leaf\ {\isaliteral{7C}{\isacharbar}}\ Branch\ {\isaliteral{27}{\isacharprime}}a\ \ {\isaliteral{22}{\isachardoublequoteopen}}{\isaliteral{27}{\isacharprime}}a\ bintree{\isaliteral{22}{\isachardoublequoteclose}}\ \ {\isaliteral{22}{\isachardoublequoteopen}}{\isaliteral{27}{\isacharprime}}a\ bintree{\isaliteral{22}{\isachardoublequoteclose}}%
  22.370 -\begin{isamarkuptext}%
  22.371 -\noindent The datatype induction rule generated here is of the form
  22.372 -  \begin{isabelle}%
  22.373 -\ {\isaliteral{5C3C6C6272616B6B3E}{\isasymlbrakk}}P\ Leaf{\isaliteral{3B}{\isacharsemicolon}}\isanewline
  22.374 -\isaindent{\ \ }{\isaliteral{5C3C416E643E}{\isasymAnd}}a\ bintree{\isadigit{1}}\ bintree{\isadigit{2}}{\isaliteral{2E}{\isachardot}}\isanewline
  22.375 -\isaindent{\ \ \ \ \ }{\isaliteral{5C3C6C6272616B6B3E}{\isasymlbrakk}}P\ bintree{\isadigit{1}}{\isaliteral{3B}{\isacharsemicolon}}\ P\ bintree{\isadigit{2}}{\isaliteral{5C3C726272616B6B3E}{\isasymrbrakk}}\ {\isaliteral{5C3C4C6F6E6772696768746172726F773E}{\isasymLongrightarrow}}\ P\ {\isaliteral{28}{\isacharparenleft}}Branch\ a\ bintree{\isadigit{1}}\ bintree{\isadigit{2}}{\isaliteral{29}{\isacharparenright}}{\isaliteral{5C3C726272616B6B3E}{\isasymrbrakk}}\isanewline
  22.376 -\isaindent{\ }{\isaliteral{5C3C4C6F6E6772696768746172726F773E}{\isasymLongrightarrow}}\ P\ bintree%
  22.377 -\end{isabelle}%
  22.378 -\end{isamarkuptext}%
  22.379 -\isamarkuptrue%
  22.380 -%
  22.381 -\end{quotation}
  22.382 -%
  22.383 -\begin{isamarkuptext}%
  22.384 -\noindent The above document output has been produced as follows:
  22.385 -
  22.386 -  \begin{ttbox}
  22.387 -  text {\ttlbrace}*
  22.388 -    The following datatype definition of {\at}{\ttlbrace}text "'a bintree"{\ttrbrace}
  22.389 -    models binary trees with nodes being decorated by elements
  22.390 -    of type {\at}{\ttlbrace}typ 'a{\ttrbrace}.
  22.391 -  *{\ttrbrace}
  22.392 -
  22.393 -  datatype 'a bintree =
  22.394 -    Leaf | Branch 'a  "'a bintree"  "'a bintree"
  22.395 -  \end{ttbox}
  22.396 -  \begin{ttbox}
  22.397 -  text {\ttlbrace}*
  22.398 -    {\ttback}noindent The datatype induction rule generated here is
  22.399 -    of the form {\at}{\ttlbrace}thm [display] bintree.induct [no_vars]{\ttrbrace}
  22.400 -  *{\ttrbrace}
  22.401 -  \end{ttbox}\vspace{-\medskipamount}
  22.402 -
  22.403 -  \noindent Here we have augmented the theory by formal comments
  22.404 -  (using \isakeyword{text} blocks), the informal parts may again refer
  22.405 -  to formal entities by means of ``antiquotations'' (such as
  22.406 -  \texttt{\at}\verb,{text "'a bintree"}, or
  22.407 -  \texttt{\at}\verb,{typ 'a},), see also \S\ref{sec:doc-prep-text}.%
  22.408 -\end{isamarkuptext}%
  22.409 -\isamarkuptrue%
  22.410 -%
  22.411 -\isamarkupsubsection{Isabelle Sessions%
  22.412 -}
  22.413 -\isamarkuptrue%
  22.414 -%
  22.415 -\begin{isamarkuptext}%
  22.416 -In contrast to the highly interactive mode of Isabelle/Isar theory
  22.417 -  development, the document preparation stage essentially works in
  22.418 -  batch-mode.  An Isabelle \bfindex{session} consists of a collection
  22.419 -  of source files that may contribute to an output document.  Each
  22.420 -  session is derived from a single parent, usually an object-logic
  22.421 -  image like \texttt{HOL}.  This results in an overall tree structure,
  22.422 -  which is reflected by the output location in the file system
  22.423 -  (usually rooted at \verb,~/.isabelle/IsabelleXXXX/browser_info,).
  22.424 -
  22.425 -  \medskip The easiest way to manage Isabelle sessions is via
  22.426 -  \texttt{isabelle mkdir} (generates an initial session source setup)
  22.427 -  and \texttt{isabelle make} (run sessions controlled by
  22.428 -  \texttt{IsaMakefile}).  For example, a new session
  22.429 -  \texttt{MySession} derived from \texttt{HOL} may be produced as
  22.430 -  follows:
  22.431 -
  22.432 -\begin{verbatim}
  22.433 -  isabelle mkdir HOL MySession
  22.434 -  isabelle make
  22.435 -\end{verbatim}
  22.436 -
  22.437 -  The \texttt{isabelle make} job also informs about the file-system
  22.438 -  location of the ultimate results.  The above dry run should be able
  22.439 -  to produce some \texttt{document.pdf} (with dummy title, empty table
  22.440 -  of contents etc.).  Any failure at this stage usually indicates
  22.441 -  technical problems of the {\LaTeX} installation.
  22.442 -
  22.443 -  \medskip The detailed arrangement of the session sources is as
  22.444 -  follows.
  22.445 -
  22.446 -  \begin{itemize}
  22.447 -
  22.448 -  \item Directory \texttt{MySession} holds the required theory files
  22.449 -  $T@1$\texttt{.thy}, \dots, $T@n$\texttt{.thy}.
  22.450 -
  22.451 -  \item File \texttt{MySession/ROOT.ML} holds appropriate ML commands
  22.452 -  for loading all wanted theories, usually just
  22.453 -  ``\texttt{use_thy"$T@i$";}'' for any $T@i$ in leaf position of the
  22.454 -  dependency graph.
  22.455 -
  22.456 -  \item Directory \texttt{MySession/document} contains everything
  22.457 -  required for the {\LaTeX} stage; only \texttt{root.tex} needs to be
  22.458 -  provided initially.
  22.459 -
  22.460 -  The latter file holds appropriate {\LaTeX} code to commence a
  22.461 -  document (\verb,\documentclass, etc.), and to include the generated
  22.462 -  files $T@i$\texttt{.tex} for each theory.  Isabelle will generate a
  22.463 -  file \texttt{session.tex} holding {\LaTeX} commands to include all
  22.464 -  generated theory output files in topologically sorted order, so
  22.465 -  \verb,\input{session}, in the body of \texttt{root.tex} does the job
  22.466 -  in most situations.
  22.467 -
  22.468 -  \item \texttt{IsaMakefile} holds appropriate dependencies and
  22.469 -  invocations of Isabelle tools to control the batch job.  In fact,
  22.470 -  several sessions may be managed by the same \texttt{IsaMakefile}.
  22.471 -  See the \emph{Isabelle System Manual} \cite{isabelle-sys} 
  22.472 -  for further details, especially on
  22.473 -  \texttt{isabelle usedir} and \texttt{isabelle make}.
  22.474 -
  22.475 -  \end{itemize}
  22.476 -
  22.477 -  One may now start to populate the directory \texttt{MySession}, and
  22.478 -  the file \texttt{MySession/ROOT.ML} accordingly.  The file
  22.479 -  \texttt{MySession/document/root.tex} should also be adapted at some
  22.480 -  point; the default version is mostly self-explanatory.  Note that
  22.481 -  \verb,\isabellestyle, enables fine-tuning of the general appearance
  22.482 -  of characters and mathematical symbols (see also
  22.483 -  \S\ref{sec:doc-prep-symbols}).
  22.484 -
  22.485 -  Especially observe the included {\LaTeX} packages \texttt{isabelle}
  22.486 -  (mandatory), \texttt{isabellesym} (required for mathematical
  22.487 -  symbols), and the final \texttt{pdfsetup} (provides sane defaults
  22.488 -  for \texttt{hyperref}, including URL markup).  All three are
  22.489 -  distributed with Isabelle. Further packages may be required in
  22.490 -  particular applications, say for unusual mathematical symbols.
  22.491 -
  22.492 -  \medskip Any additional files for the {\LaTeX} stage go into the
  22.493 -  \texttt{MySession/document} directory as well.  In particular,
  22.494 -  adding a file named \texttt{root.bib} causes an automatic run of
  22.495 -  \texttt{bibtex} to process a bibliographic database; see also
  22.496 -  \texttt{isabelle document} \cite{isabelle-sys}.
  22.497 -
  22.498 -  \medskip Any failure of the document preparation phase in an
  22.499 -  Isabelle batch session leaves the generated sources in their target
  22.500 -  location, identified by the accompanying error message.  This lets
  22.501 -  you trace {\LaTeX} problems with the generated files at hand.%
  22.502 -\end{isamarkuptext}%
  22.503 -\isamarkuptrue%
  22.504 -%
  22.505 -\isamarkupsubsection{Structure Markup%
  22.506 -}
  22.507 -\isamarkuptrue%
  22.508 -%
  22.509 -\begin{isamarkuptext}%
  22.510 -The large-scale structure of Isabelle documents follows existing
  22.511 -  {\LaTeX} conventions, with chapters, sections, subsubsections etc.
  22.512 -  The Isar language includes separate \bfindex{markup commands}, which
  22.513 -  do not affect the formal meaning of a theory (or proof), but result
  22.514 -  in corresponding {\LaTeX} elements.
  22.515 -
  22.516 -  There are separate markup commands depending on the textual context:
  22.517 -  in header position (just before \isakeyword{theory}), within the
  22.518 -  theory body, or within a proof.  The header needs to be treated
  22.519 -  specially here, since ordinary theory and proof commands may only
  22.520 -  occur \emph{after} the initial \isakeyword{theory} specification.
  22.521 -
  22.522 -  \medskip
  22.523 -
  22.524 -  \begin{tabular}{llll}
  22.525 -  header & theory & proof & default meaning \\\hline
  22.526 -    & \commdx{chapter} & & \verb,\chapter, \\
  22.527 -  \commdx{header} & \commdx{section} & \commdx{sect} & \verb,\section, \\
  22.528 -    & \commdx{subsection} & \commdx{subsect} & \verb,\subsection, \\
  22.529 -    & \commdx{subsubsection} & \commdx{subsubsect} & \verb,\subsubsection, \\
  22.530 -  \end{tabular}
  22.531 -
  22.532 -  \medskip
  22.533 -
  22.534 -  From the Isabelle perspective, each markup command takes a single
  22.535 -  $text$ argument (delimited by \verb,",~\isa{{\isaliteral{5C3C646F74733E}{\isasymdots}}}~\verb,", or
  22.536 -  \verb,{,\verb,*,~\isa{{\isaliteral{5C3C646F74733E}{\isasymdots}}}~\verb,*,\verb,},).  After stripping any
  22.537 -  surrounding white space, the argument is passed to a {\LaTeX} macro
  22.538 -  \verb,\isamarkupXYZ, for command \isakeyword{XYZ}.  These macros are
  22.539 -  defined in \verb,isabelle.sty, according to the meaning given in the
  22.540 -  rightmost column above.
  22.541 -
  22.542 -  \medskip The following source fragment illustrates structure markup
  22.543 -  of a theory.  Note that {\LaTeX} labels may be included inside of
  22.544 -  section headings as well.
  22.545 -
  22.546 -  \begin{ttbox}
  22.547 -  header {\ttlbrace}* Some properties of Foo Bar elements *{\ttrbrace}
  22.548 -
  22.549 -  theory Foo_Bar
  22.550 -  imports Main
  22.551 -  begin
  22.552 -
  22.553 -  subsection {\ttlbrace}* Basic definitions *{\ttrbrace}
  22.554 -
  22.555 -  definition foo :: \dots
  22.556 -
  22.557 -  definition bar :: \dots
  22.558 -
  22.559 -  subsection {\ttlbrace}* Derived rules *{\ttrbrace}
  22.560 -
  22.561 -  lemma fooI: \dots
  22.562 -  lemma fooE: \dots
  22.563 -
  22.564 -  subsection {\ttlbrace}* Main theorem {\ttback}label{\ttlbrace}sec:main-theorem{\ttrbrace} *{\ttrbrace}
  22.565 -
  22.566 -  theorem main: \dots
  22.567 -
  22.568 -  end
  22.569 -  \end{ttbox}\vspace{-\medskipamount}
  22.570 -
  22.571 -  You may occasionally want to change the meaning of markup commands,
  22.572 -  say via \verb,\renewcommand, in \texttt{root.tex}.  For example,
  22.573 -  \verb,\isamarkupheader, is a good candidate for some tuning.  We
  22.574 -  could move it up in the hierarchy to become \verb,\chapter,.
  22.575 -
  22.576 -\begin{verbatim}
  22.577 -  \renewcommand{\isamarkupheader}[1]{\chapter{#1}}
  22.578 -\end{verbatim}
  22.579 -
  22.580 -  \noindent Now we must change the document class given in
  22.581 -  \texttt{root.tex} to something that supports chapters.  A suitable
  22.582 -  command is \verb,\documentclass{report},.
  22.583 -
  22.584 -  \medskip The {\LaTeX} macro \verb,\isabellecontext, is maintained to
  22.585 -  hold the name of the current theory context.  This is particularly
  22.586 -  useful for document headings:
  22.587 -
  22.588 -\begin{verbatim}
  22.589 -  \renewcommand{\isamarkupheader}[1]
  22.590 -  {\chapter{#1}\markright{THEORY~\isabellecontext}}
  22.591 -\end{verbatim}
  22.592 -
  22.593 -  \noindent Make sure to include something like
  22.594 -  \verb,\pagestyle{headings}, in \texttt{root.tex}; the document
  22.595 -  should have more than two pages to show the effect.%
  22.596 -\end{isamarkuptext}%
  22.597 -\isamarkuptrue%
  22.598 -%
  22.599 -\isamarkupsubsection{Formal Comments and Antiquotations \label{sec:doc-prep-text}%
  22.600 -}
  22.601 -\isamarkuptrue%
  22.602 -%
  22.603 -\begin{isamarkuptext}%
  22.604 -Isabelle \bfindex{source comments}, which are of the form
  22.605 -  \verb,(,\verb,*,~\isa{{\isaliteral{5C3C646F74733E}{\isasymdots}}}~\verb,*,\verb,),, essentially act like
  22.606 -  white space and do not really contribute to the content.  They
  22.607 -  mainly serve technical purposes to mark certain oddities in the raw
  22.608 -  input text.  In contrast, \bfindex{formal comments} are portions of
  22.609 -  text that are associated with formal Isabelle/Isar commands
  22.610 -  (\bfindex{marginal comments}), or as standalone paragraphs within a
  22.611 -  theory or proof context (\bfindex{text blocks}).
  22.612 -
  22.613 -  \medskip Marginal comments are part of each command's concrete
  22.614 -  syntax \cite{isabelle-ref}; the common form is ``\verb,--,~$text$''
  22.615 -  where $text$ is delimited by \verb,",\isa{{\isaliteral{5C3C646F74733E}{\isasymdots}}}\verb,", or
  22.616 -  \verb,{,\verb,*,~\isa{{\isaliteral{5C3C646F74733E}{\isasymdots}}}~\verb,*,\verb,}, as before.  Multiple
  22.617 -  marginal comments may be given at the same time.  Here is a simple
  22.618 -  example:%
  22.619 -\end{isamarkuptext}%
  22.620 -\isamarkuptrue%
  22.621 -\isacommand{lemma}\isamarkupfalse%
  22.622 -\ {\isaliteral{22}{\isachardoublequoteopen}}A\ {\isaliteral{2D}{\isacharminus}}{\isaliteral{2D}{\isacharminus}}{\isaliteral{3E}{\isachargreater}}\ A{\isaliteral{22}{\isachardoublequoteclose}}\isanewline
  22.623 -\ \ %
  22.624 -\isamarkupcmt{a triviality of propositional logic%
  22.625 -}
  22.626 -\isanewline
  22.627 -\ \ %
  22.628 -\isamarkupcmt{(should not really bother)%
  22.629 -}
  22.630 -\isanewline
  22.631 -%
  22.632 -\isadelimproof
  22.633 -\ \ %
  22.634 -\endisadelimproof
  22.635 -%
  22.636 -\isatagproof
  22.637 -\isacommand{by}\isamarkupfalse%
  22.638 -\ {\isaliteral{28}{\isacharparenleft}}rule\ impI{\isaliteral{29}{\isacharparenright}}\ %
  22.639 -\isamarkupcmt{implicit assumption step involved here%
  22.640 -}
  22.641 -%
  22.642 -\endisatagproof
  22.643 -{\isafoldproof}%
  22.644 -%
  22.645 -\isadelimproof
  22.646 -%
  22.647 -\endisadelimproof
  22.648 -%
  22.649 -\begin{isamarkuptext}%
  22.650 -\noindent The above output has been produced as follows:
  22.651 -
  22.652 -\begin{verbatim}
  22.653 -  lemma "A --> A"
  22.654 -    -- "a triviality of propositional logic"
  22.655 -    -- "(should not really bother)"
  22.656 -    by (rule impI) -- "implicit assumption step involved here"
  22.657 -\end{verbatim}
  22.658 -
  22.659 -  From the {\LaTeX} viewpoint, ``\verb,--,'' acts like a markup
  22.660 -  command, associated with the macro \verb,\isamarkupcmt, (taking a
  22.661 -  single argument).
  22.662 -
  22.663 -  \medskip Text blocks are introduced by the commands \bfindex{text}
  22.664 -  and \bfindex{txt}, for theory and proof contexts, respectively.
  22.665 -  Each takes again a single $text$ argument, which is interpreted as a
  22.666 -  free-form paragraph in {\LaTeX} (surrounded by some additional
  22.667 -  vertical space).  This behavior may be changed by redefining the
  22.668 -  {\LaTeX} environments of \verb,isamarkuptext, or
  22.669 -  \verb,isamarkuptxt,, respectively (via \verb,\renewenvironment,) The
  22.670 -  text style of the body is determined by \verb,\isastyletext, and
  22.671 -  \verb,\isastyletxt,; the default setup uses a smaller font within
  22.672 -  proofs.  This may be changed as follows:
  22.673 -
  22.674 -\begin{verbatim}
  22.675 -  \renewcommand{\isastyletxt}{\isastyletext}
  22.676 -\end{verbatim}
  22.677 -
  22.678 -  \medskip The $text$ part of Isabelle markup commands essentially
  22.679 -  inserts \emph{quoted material} into a formal text, mainly for
  22.680 -  instruction of the reader.  An \bfindex{antiquotation} is again a
  22.681 -  formal object embedded into such an informal portion.  The
  22.682 -  interpretation of antiquotations is limited to some well-formedness
  22.683 -  checks, with the result being pretty printed to the resulting
  22.684 -  document.  Quoted text blocks together with antiquotations provide
  22.685 -  an attractive means of referring to formal entities, with good
  22.686 -  confidence in getting the technical details right (especially syntax
  22.687 -  and types).
  22.688 -
  22.689 -  The general syntax of antiquotations is as follows:
  22.690 -  \texttt{{\at}{\ttlbrace}$name$ $arguments${\ttrbrace}}, or
  22.691 -  \texttt{{\at}{\ttlbrace}$name$ [$options$] $arguments${\ttrbrace}}
  22.692 -  for a comma-separated list of options consisting of a $name$ or
  22.693 -  \texttt{$name$=$value$} each.  The syntax of $arguments$ depends on
  22.694 -  the kind of antiquotation, it generally follows the same conventions
  22.695 -  for types, terms, or theorems as in the formal part of a theory.
  22.696 -
  22.697 -  \medskip This sentence demonstrates quotations and antiquotations:
  22.698 -  \isa{{\isaliteral{5C3C6C616D6264613E}{\isasymlambda}}x\ y{\isaliteral{2E}{\isachardot}}\ x} is a well-typed term.
  22.699 -
  22.700 -  \medskip\noindent The output above was produced as follows:
  22.701 -  \begin{ttbox}
  22.702 -text {\ttlbrace}*
  22.703 -  This sentence demonstrates quotations and antiquotations:
  22.704 -  {\at}{\ttlbrace}term "%x y. x"{\ttrbrace} is a well-typed term.
  22.705 -*{\ttrbrace}
  22.706 -  \end{ttbox}\vspace{-\medskipamount}
  22.707 -
  22.708 -  The notational change from the ASCII character~\verb,%, to the
  22.709 -  symbol~\isa{{\isaliteral{5C3C6C616D6264613E}{\isasymlambda}}} reveals that Isabelle printed this term, after
  22.710 -  parsing and type-checking.  Document preparation enables symbolic
  22.711 -  output by default.
  22.712 -
  22.713 -  \medskip The next example includes an option to show the type of all
  22.714 -  variables.  The antiquotation
  22.715 -  \texttt{{\at}}\verb,{term [show_types] "%x y. x"}, produces the
  22.716 -  output \isa{{\isaliteral{5C3C6C616D6264613E}{\isasymlambda}}{\isaliteral{28}{\isacharparenleft}}x{\isaliteral{5C3C436F6C6F6E3E}{\isasymColon}}{\isaliteral{27}{\isacharprime}}a{\isaliteral{29}{\isacharparenright}}\ y{\isaliteral{5C3C436F6C6F6E3E}{\isasymColon}}{\isaliteral{27}{\isacharprime}}b{\isaliteral{2E}{\isachardot}}\ x}.  Type inference has figured
  22.717 -  out the most general typings in the present theory context.  Terms
  22.718 -  may acquire different typings due to constraints imposed by their
  22.719 -  environment; within a proof, for example, variables are given the
  22.720 -  same types as they have in the main goal statement.
  22.721 -
  22.722 -  \medskip Several further kinds of antiquotations and options are
  22.723 -  available \cite{isabelle-isar-ref}.  Here are a few commonly used
  22.724 -  combinations:
  22.725 -
  22.726 -  \medskip
  22.727 -
  22.728 -  \begin{tabular}{ll}
  22.729 -  \texttt{\at}\verb,{typ,~$\tau$\verb,}, & print type $\tau$ \\
  22.730 -  \texttt{\at}\verb,{const,~$c$\verb,}, & check existence of $c$ and print it \\
  22.731 -  \texttt{\at}\verb,{term,~$t$\verb,}, & print term $t$ \\
  22.732 -  \texttt{\at}\verb,{prop,~$\phi$\verb,}, & print proposition $\phi$ \\
  22.733 -  \texttt{\at}\verb,{prop [display],~$\phi$\verb,}, & print large proposition $\phi$ (with linebreaks) \\
  22.734 -  \texttt{\at}\verb,{prop [source],~$\phi$\verb,}, & check proposition $\phi$, print its input \\
  22.735 -  \texttt{\at}\verb,{thm,~$a$\verb,}, & print fact $a$ \\
  22.736 -  \texttt{\at}\verb,{thm,~$a$~\verb,[no_vars]}, & print fact $a$, fixing schematic variables \\
  22.737 -  \texttt{\at}\verb,{thm [source],~$a$\verb,}, & check availability of fact $a$, print its name \\
  22.738 -  \texttt{\at}\verb,{text,~$s$\verb,}, & print uninterpreted text $s$ \\
  22.739 -  \end{tabular}
  22.740 -
  22.741 -  \medskip
  22.742 -
  22.743 -  Note that \attrdx{no_vars} given above is \emph{not} an
  22.744 -  antiquotation option, but an attribute of the theorem argument given
  22.745 -  here.  This might be useful with a diagnostic command like
  22.746 -  \isakeyword{thm}, too.
  22.747 -
  22.748 -  \medskip The \texttt{\at}\verb,{text, $s$\verb,}, antiquotation is
  22.749 -  particularly interesting.  Embedding uninterpreted text within an
  22.750 -  informal body might appear useless at first sight.  Here the key
  22.751 -  virtue is that the string $s$ is processed as Isabelle output,
  22.752 -  interpreting Isabelle symbols appropriately.
  22.753 -
  22.754 -  For example, \texttt{\at}\verb,{text "\<forall>\<exists>"}, produces \isa{{\isaliteral{5C3C666F72616C6C3E}{\isasymforall}}{\isaliteral{5C3C6578697374733E}{\isasymexists}}}, according to the standard interpretation of these symbol
  22.755 -  (cf.\ \S\ref{sec:doc-prep-symbols}).  Thus we achieve consistent
  22.756 -  mathematical notation in both the formal and informal parts of the
  22.757 -  document very easily, independently of the term language of
  22.758 -  Isabelle.  Manual {\LaTeX} code would leave more control over the
  22.759 -  typesetting, but is also slightly more tedious.%
  22.760 -\end{isamarkuptext}%
  22.761 -\isamarkuptrue%
  22.762 -%
  22.763 -\isamarkupsubsection{Interpretation of Symbols \label{sec:doc-prep-symbols}%
  22.764 -}
  22.765 -\isamarkuptrue%
  22.766 -%
  22.767 -\begin{isamarkuptext}%
  22.768 -As has been pointed out before (\S\ref{sec:syntax-symbols}),
  22.769 -  Isabelle symbols are the smallest syntactic entities --- a
  22.770 -  straightforward generalization of ASCII characters.  While Isabelle
  22.771 -  does not impose any interpretation of the infinite collection of
  22.772 -  named symbols, {\LaTeX} documents use canonical glyphs for certain
  22.773 -  standard symbols \cite{isabelle-isar-ref}.
  22.774 -
  22.775 -  The {\LaTeX} code produced from Isabelle text follows a simple
  22.776 -  scheme.  You can tune the final appearance by redefining certain
  22.777 -  macros, say in \texttt{root.tex} of the document.
  22.778 -
  22.779 -  \begin{enumerate}
  22.780 -
  22.781 -  \item 7-bit ASCII characters: letters \texttt{A\dots Z} and
  22.782 -  \texttt{a\dots z} are output directly, digits are passed as an
  22.783 -  argument to the \verb,\isadigit, macro, other characters are
  22.784 -  replaced by specifically named macros of the form
  22.785 -  \verb,\isacharXYZ,.
  22.786 -
  22.787 -  \item Named symbols: \verb,\,\verb,<XYZ>, is turned into
  22.788 -  \verb,{\isasymXYZ},; note the additional braces.
  22.789 -
  22.790 -  \item Named control symbols: \verb,\,\verb,<^XYZ>, is turned into
  22.791 -  \verb,\isactrlXYZ,; subsequent symbols may act as arguments if the
  22.792 -  control macro is defined accordingly.
  22.793 -
  22.794 -  \end{enumerate}
  22.795 -
  22.796 -  You may occasionally wish to give new {\LaTeX} interpretations of
  22.797 -  named symbols.  This merely requires an appropriate definition of
  22.798 -  \verb,\isasymXYZ,, for \verb,\,\verb,<XYZ>, (see
  22.799 -  \texttt{isabelle.sty} for working examples).  Control symbols are
  22.800 -  slightly more difficult to get right, though.
  22.801 -
  22.802 -  \medskip The \verb,\isabellestyle, macro provides a high-level
  22.803 -  interface to tune the general appearance of individual symbols.  For
  22.804 -  example, \verb,\isabellestyle{it}, uses the italics text style to
  22.805 -  mimic the general appearance of the {\LaTeX} math mode; double
  22.806 -  quotes are not printed at all.  The resulting quality of typesetting
  22.807 -  is quite good, so this should be the default style for work that
  22.808 -  gets distributed to a broader audience.%
  22.809 -\end{isamarkuptext}%
  22.810 -\isamarkuptrue%
  22.811 -%
  22.812 -\isamarkupsubsection{Suppressing Output \label{sec:doc-prep-suppress}%
  22.813 -}
  22.814 -\isamarkuptrue%
  22.815 -%
  22.816 -\begin{isamarkuptext}%
  22.817 -By default, Isabelle's document system generates a {\LaTeX} file for
  22.818 -  each theory that gets loaded while running the session.  The
  22.819 -  generated \texttt{session.tex} will include all of these in order of
  22.820 -  appearance, which in turn gets included by the standard
  22.821 -  \texttt{root.tex}.  Certainly one may change the order or suppress
  22.822 -  unwanted theories by ignoring \texttt{session.tex} and load
  22.823 -  individual files directly in \texttt{root.tex}.  On the other hand,
  22.824 -  such an arrangement requires additional maintenance whenever the
  22.825 -  collection of theories changes.
  22.826 -
  22.827 -  Alternatively, one may tune the theory loading process in
  22.828 -  \texttt{ROOT.ML} itself: traversal of the theory dependency graph
  22.829 -  may be fine-tuned by adding \verb,use_thy, invocations, although
  22.830 -  topological sorting still has to be observed.  Moreover, the ML
  22.831 -  operator \verb,no_document, temporarily disables document generation
  22.832 -  while executing a theory loader command.  Its usage is like this:
  22.833 -
  22.834 -\begin{verbatim}
  22.835 -  no_document use_thy "T";
  22.836 -\end{verbatim}
  22.837 -
  22.838 -  \medskip Theory output may be suppressed more selectively, either
  22.839 -  via \bfindex{tagged command regions} or \bfindex{ignored material}.
  22.840 -
  22.841 -  Tagged command regions works by annotating commands with named tags,
  22.842 -  which correspond to certain {\LaTeX} markup that tells how to treat
  22.843 -  particular parts of a document when doing the actual type-setting.
  22.844 -  By default, certain Isabelle/Isar commands are implicitly marked up
  22.845 -  using the predefined tags ``\emph{theory}'' (for theory begin and
  22.846 -  end), ``\emph{proof}'' (for proof commands), and ``\emph{ML}'' (for
  22.847 -  commands involving ML code).  Users may add their own tags using the
  22.848 -  \verb,%,\emph{tag} notation right after a command name.  In the
  22.849 -  subsequent example we hide a particularly irrelevant proof:%
  22.850 -\end{isamarkuptext}%
  22.851 -\isamarkuptrue%
  22.852 -\isacommand{lemma}\isamarkupfalse%
  22.853 -\ {\isaliteral{22}{\isachardoublequoteopen}}x\ {\isaliteral{3D}{\isacharequal}}\ x{\isaliteral{22}{\isachardoublequoteclose}}%
  22.854 -\isadeliminvisible
  22.855 -\ %
  22.856 -\endisadeliminvisible
  22.857 -%
  22.858 -\isataginvisible
  22.859 -\isacommand{by}\isamarkupfalse%
  22.860 -\ {\isaliteral{28}{\isacharparenleft}}simp{\isaliteral{29}{\isacharparenright}}%
  22.861 -\endisataginvisible
  22.862 -{\isafoldinvisible}%
  22.863 -%
  22.864 -\isadeliminvisible
  22.865 -%
  22.866 -\endisadeliminvisible
  22.867 -%
  22.868 -\begin{isamarkuptext}%
  22.869 -The original source has been ``\verb,lemma "x = x" by %invisible (simp),''.
  22.870 -  Tags observe the structure of proofs; adjacent commands with the
  22.871 -  same tag are joined into a single region.  The Isabelle document
  22.872 -  preparation system allows the user to specify how to interpret a
  22.873 -  tagged region, in order to keep, drop, or fold the corresponding
  22.874 -  parts of the document.  See the \emph{Isabelle System Manual}
  22.875 -  \cite{isabelle-sys} for further details, especially on
  22.876 -  \texttt{isabelle usedir} and \texttt{isabelle document}.
  22.877 -
  22.878 -  Ignored material is specified by delimiting the original formal
  22.879 -  source with special source comments
  22.880 -  \verb,(,\verb,*,\verb,<,\verb,*,\verb,), and
  22.881 -  \verb,(,\verb,*,\verb,>,\verb,*,\verb,),.  These parts are stripped
  22.882 -  before the type-setting phase, without affecting the formal checking
  22.883 -  of the theory, of course.  For example, we may hide parts of a proof
  22.884 -  that seem unfit for general public inspection.  The following
  22.885 -  ``fully automatic'' proof is actually a fake:%
  22.886 -\end{isamarkuptext}%
  22.887 -\isamarkuptrue%
  22.888 -\isacommand{lemma}\isamarkupfalse%
  22.889 -\ {\isaliteral{22}{\isachardoublequoteopen}}x\ {\isaliteral{5C3C6E6F7465713E}{\isasymnoteq}}\ {\isaliteral{28}{\isacharparenleft}}{\isadigit{0}}{\isaliteral{3A}{\isacharcolon}}{\isaliteral{3A}{\isacharcolon}}int{\isaliteral{29}{\isacharparenright}}\ {\isaliteral{5C3C4C6F6E6772696768746172726F773E}{\isasymLongrightarrow}}\ {\isadigit{0}}\ {\isaliteral{3C}{\isacharless}}\ x\ {\isaliteral{2A}{\isacharasterisk}}\ x{\isaliteral{22}{\isachardoublequoteclose}}\isanewline
  22.890 -%
  22.891 -\isadelimproof
  22.892 -\ \ %
  22.893 -\endisadelimproof
  22.894 -%
  22.895 -\isatagproof
  22.896 -\isacommand{by}\isamarkupfalse%
  22.897 -\ {\isaliteral{28}{\isacharparenleft}}auto{\isaliteral{29}{\isacharparenright}}%
  22.898 -\endisatagproof
  22.899 -{\isafoldproof}%
  22.900 -%
  22.901 -\isadelimproof
  22.902 -%
  22.903 -\endisadelimproof
  22.904 -%
  22.905 -\begin{isamarkuptext}%
  22.906 -\noindent The real source of the proof has been as follows:
  22.907 -
  22.908 -\begin{verbatim}
  22.909 -  by (auto(*<*)simp add: zero_less_mult_iff(*>*))
  22.910 -\end{verbatim}
  22.911 -%(*
  22.912 -
  22.913 -  \medskip Suppressing portions of printed text demands care.  You
  22.914 -  should not misrepresent the underlying theory development.  It is
  22.915 -  easy to invalidate the visible text by hiding references to
  22.916 -  questionable axioms, for example.%
  22.917 -\end{isamarkuptext}%
  22.918 -\isamarkuptrue%
  22.919 -%
  22.920 -\isadelimtheory
  22.921 -%
  22.922 -\endisadelimtheory
  22.923 -%
  22.924 -\isatagtheory
  22.925 -%
  22.926 -\endisatagtheory
  22.927 -{\isafoldtheory}%
  22.928 -%
  22.929 -\isadelimtheory
  22.930 -%
  22.931 -\endisadelimtheory
  22.932 -\end{isabellebody}%
  22.933 -%%% Local Variables:
  22.934 -%%% mode: latex
  22.935 -%%% TeX-master: "root"
  22.936 -%%% End: