VERSION 2 (for HOL88.2.02) March 16, 1994

The HOL System

REFERENCE

University of Cambridge  DSTO  SRI International

Preface

This volume is the reference manual for the HOL system. It is one of three documents making up the documentation for HOL:

(i) TUTORIAL: a tutorial introduction to HOL, with case studies.

(ii) DESCRIPTION: a description of higher order logic, the ML programming language, and theorem proving methods in the HOL system;

(iii) REFERENCE: the reference documentation of the tools available in HOL.

These three documents will be referred to by the short names (in small slanted capitals) given above.

This document, REFERENCE, provides documentation on all the pre-defined ML variable bindings in the HOL system. These include: general-purpose functions, such as ML functions for list processing, arithmetic, input/output, and interface configuration; functions for processing the types and terms of the HOL logic, for setting up theories, and for using the subgoal package; primitive and derived forward inference rules; tactics and tacticals; and pre-proved built-in theorems.

The manual entries for these ML identifiers are divided into two chapters. The first chapter is an alphabetical sequence of manual entries for all ML identifiers in the system except those identifiers that are bound to theorems. The theorems are listed in the second chapter, roughly grouped into sections based on subject matter.

The REFERENCE volume is purely for reference and browsing. It is generated from the same database that is used by the help system. For an introduction to the HOL system, see TUTORIAL; for a systematic presentation, see DESCRIPTION. iv Preface

Acknowledgements

The three volumes TUTORIAL, DESCRIPTION and REFERENCE were produced at the Cambridge Research Center of SRI International with the support of DSTO Australia.

The HOL documentation project was managed by Mike Gordon, who also wrote parts of DESCRIPTION and TUTORIAL using material based on an early paper describing the HOL system^{1} and The ML Handbook^{2}. Other contributers to DESCRIPTION incude Avra Cohn, who contributed material on theorems, rules, conversions and tactics, and also composed the index (which was typeset by Juanito Camilleri); Tom Melham, who wrote the sections describing type definitions, the concrete type package and the ‘resolution’ tactics; and Andy Pitts, who devised the set-theoretic semantics of the HOL logic and wrote the material describing it.

The first edition of TUTORIAL contained case studies on microprocessor systems (by Jeff Joyce), protocol verification (by Rachel Cardell-Oliver) and modular arithmetic based on group theory (by Elsa Gunter). These are now separate documents in the HOL distribution directory hol/Training/studies. The chapter in TUTORIAL on the proof of the binomial theorem in HOL was written by Andy Gordon.

The second edition of REFERENCE was a joint effort by the Cambridge HOL group. The original document design used LaTEX macros supplied by Elsa Gunter, Tom Mel-

ham and Larry Paulson. The typesetting of all three volumes was managed by Tom Melham. The conversion of the troff sources of The ML Handbook to LaTEX was done by Inder Dhingra and John Van Tassel. The cover design is by Arnold Smith, who used a photograph of a ‘snow watching lantern’ taken by Avra Cohn (in whose garden the original object resides). John Van Tassel composed the LaTEX picture of the lantern.

Many people other than those listed above have contributed to the HOL documentation effort, either by providing material, or by sending lists of errors in the first edition. Thanks to everyone who helped, and thanks to DSTO and SRI for their generous support. vi Acknowledgements

1M.J.C. Gordon, ‘HOL: a Proof Generating System for Higher Order Logic’, in: VLSI Specification, Verification and Synthesis, edited by G. Birtwistle and P.A. Subrahmanyam, (Kluwer Academic Publishers, 1988), pp. 73–128.

2The ML Handbook, unpublished report from Inria by Guy Cousineau, Mike Gordon, Gérard Huet, Robin Milner, Larry Paulson and Chris Wadsworth.

Contents

1 Pre-defined ML Identifiers 1

2 Pre-proved Theorems 609 2.1 Definitions of Basic Logical Constants . . . . . . . . . . . . . . . . . . . . . 609 2.2 Constants for syntactic abbreviations . . . . . . . . . . . . . . . . . . . . . 610 2.3 Axioms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 610 2.4 Logical tautologies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 611 2.5 Theorems about functions . . . . . . . . . . . . . . . . . . . . . . . . . . . 614 2.6 Theorems about the type one . . . . . . . . . . . . . . . . . . . . . . . . . 615 2.7 Theorems about combinators . . . . . . . . . . . . . . . . . . . . . . . . . 616 2.8 Theorems about pairs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 617 2.9 Theorems about disjoint sums . . . . . . . . . . . . . . . . . . . . . . . . . 618 2.10 Theorems about arithmetic . . . . . . . . . . . . . . . . . . . . . . . . . . 619 2.11 Theorems about lists . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 634 2.12 Theorems about trees . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 659 2.13 Theorems used to define types . . . . . . . . . . . . . . . . . . . . . . . . . 661

Index 663 viii Contents

Chapter 1

Pre-defined ML Identifiers

This chapter provides manual entries for all the pre-defined ML identifiers in the HOL system, except the identifiers that are bound to pre-proved theorems (for these, see chapter two). These include: general-purpose functions, such as functions for list processing, arithmetic, input/output, and interface configuration; functions for processing the types and terms of the HOL logic, for setting up theories, and for using the subgoal package; primitive and derived forward inference rules; and tactics and tacticals. The arrangement is alphabetical.

 #

$# : (((* -> **) # (*** -> ****)) -> (* # ***) -> (** # ****))

Synopsis

Applies two functions to a pair: (f # g) (x,y) = (f x, g y).

Failure

Never fails.

See also

B, C, CB, Co, I, K, KI, o, oo, S, W.

 *

$* : ((int # int) -> int)

Synopsis

Performs multiplication on ML integers.

Failure

Never fails.

 +

$+ : ((int # int) -> int)

Synopsis

Performs addition on ML integers.

Failure

Never fails.

 -

$- : ((int # int) -> int)

Synopsis

Performs subtraction on ML integers.

Failure

Never fails.

Comments

Unary - exists as an internal parser object, but not as a function. So, whilst typing in -1;; will work, -;; will return a parse error.

 .

$. : ((* # * list) -> * list)

Synopsis

Adds single element to the head of a list.

Description

The . operator is an infixed primitive list constructor, analogous to CONS in LISP. Its

effect is x . [x1;....;xn] = [x;x1;...;xn].

\underline{/ 3}

Failure

Never fails.

 /

$/ : ((int # int) -> int)

Synopsis

Performs division on ML integers.

Failure

Fails on division by zero.

 ^

$^: (string -> string -> string)

Synopsis

Concatenates two ML strings.

Description

The ^is the ML infix string concatenation operator. If s1 and s2 are strings, then s1^s2 gives a string which is their concatenation.

Failure

Never fails.

Example

#`Hello `^`world`;;
`Hello world` : string

Comments

The ML role of the ^operator should not be confused with its use in quoted terms to introduce antiquotation (see DESCRIPTION for details).

See also

concat, concatl.

 <

$< : ((int # int) -> bool)

Synopsis

Performs a less-than test on ML integers.

Failure

Never fails.

 <<

$<< : ((* # **) -> bool)

Synopsis

Performs a lexical comparison of values.

Description

$<< performs a fast ordering on values. It is substitutive with respect to equality in ML (i.e. if x << y and x = x' and y = y' then x' << y').

Failure

Never fails.

Uses

It is often useful, for example in normalizing terms in some way, to be able to impose some arbitrary (but definite) ordering on ML values.

See also

=.

 =

$= : ((* # *) -> bool)

\underline{= 5}

Synopsis

Performs an equality test on two ML values.

Description

$= works as expected on non-function types. It may give unexpected results when applied to function types (or types containing them, such as a pair of functions), and should be considered unreliable in those situations.

6 Chapter 1. Pre-defined ML Identifiers

Example

#1 = 2;;
false : bool
#1 = 1;;
true : bool
#let f x = x + 1 and g x = x + 2;;
f = - : (int -> int)
g = - : (int -> int)
#let f' = f and h x = f x and h' x = x + 1;;
f' = - : (int -> int)
h = - : (int -> int)
h' = - : (int -> int)
#f=f;;
true : bool
#f = f';;
true : bool
#f = g;;
false : bool
#f =h;;
false : bool
#f=h';;
false : bool
#h = h';;
false : bool

 >

$> : ((int # int) -> bool)

Synopsis

Performs a greater-than test on ML integers.

\underline{@ 7}

Failure

Never fails.

 @

$@ : ((* list # * list) -> * list)

Synopsis

Concatenates two lists.

Description

@ is an infix operator which concatenates two lists.

Failure

Never fails.

Example

#[1;2;3] @ [4;5;6];;
[1; 2; 3; 4; 5; 6] : int list

See also

append.

 ABS

ABS : (term -> thm -> thm)

Synopsis

Abstracts both sides of an equation.

Description

         A |- t1 = t2
   ------------------------  ABS "x"            [Where x is not free in A]
    A |- (\x.t1) = (\x.t2)

Failure

If the theorem is not an equation, or if the variable x is free in the assumptions A.

8 Chapter 1. Pre-defined ML Identifiers

Example

#ABS "m:num" (REFL "m:num");;
|- (\m. m) = (\m. m)

See also

ETA_CONV, EXT, MK_ABS.
 ABS_CONV
ABS_CONV : (conv -> conv)

Synopsis

Applies a conversion to the body of an abstraction.

Description

If c is a conversion that maps a term "t" to the theorem |- t = t', then the conversion ABS_CONV c maps abstractions of the form "\x.t" to theorems of the form:

   |- (\x.t) = (\x.t')

That is, ABS_CONV c "\x.t" applies c to the body of the abstraction "\x.t".

Failure

ABS_CONV c tm fails if tm is not an abstraction or if tm has the form "\x.t" but the conversion c fails when applied to the term t. The function returned by ABS_CONV c may also fail if the ML function c:term->thm is not, in fact, a conversion (i.e. a function that maps a term t to a theorem |- t = t').

Example

#ABS_CONV SYM_CONV "\x. 1 = x";;
|- (\x. 1 = x) = (\x. x = 1)

See also

RAND_CONV, RATOR_CONV, SUB_CONV.

 abs_goals

abs_goals : (subgoals list -> goalstack)

Synopsis

This function is for internal use only and is to be deleted from a future version of the system. It should not be used.

 ACCEPT_TAC

ACCEPT_TAC : thm_tactic

Synopsis

Solves a goal if supplied with the desired theorem (up to alpha-conversion).

Description

ACCEPT_TAC maps a given theorem th to a tactic that solves any goal whose conclusion is alpha-convertible to the conclusion of th.

Failure

ACCEPT_TAC th (A,g) fails if the term g is not alpha-convertible to the conclusion of the supplied theorem th.

Example

ACCEPT_TAC applied to the axiom

   BOOL_CASES_AX = |- !t. (t = T) \/ (t = F)

will solve the goal

   ?- !x. (x = T) \/ (x = F)

but will fail on the goal

   ?- !x. (x = F) \/ (x = T)

Uses

Used for completing proofs by supplying an existing theorem, such as an axiom, or a lemma already proved.

See also

MATCH_ACCEPT_TAC.
 achieves
achieves : (thm -> goal -> bool)

Synopsis

This function is for internal use only and is to be deleted from a future version of the system. It should not be used.

 achieve_first
achieve_first : (subgoals -> thm -> subgoals)

Synopsis

This function is for internal use only and is to be deleted from a future version of the system. It should not be used.

 aconv
aconv : (term -> term -> bool)

Synopsis

Tests for alpha-convertibility of terms.

Description

When applied to two terms, aconv returns true if they are alpha-convertible, and false otherwise.

Failure

Never fails.

Example

A simple case of alpha-convertibility is the renaming of a single quantified variable:

   #aconv "?x. x=T" "?y. y=T";;
   true : bool

See also

ALPHA, ALPHA_CONV.

 activate_binders
activate_binders : (string -> string list)

Synopsis

Makes the quotation parser treat all binders in the current theory segment as such.

Description

The call

   activate_binders `thy`

where thy is an ancestor theory (`-` stands for the current theory), will return a list of all binders on that theory, and make the parser treat them all as binders, that is, for each binder b, will allow the syntactic sugaring "b x. y" as a shorthand for "b (\x. y)". The special syntactic status may be suppressed by preceding b with a dollar sign. The function returns a list of all the binders dealt with.

Failure

Never fails.

Comments

This function is mainly intended for internal use. All binders declared by new_binder or new_binder_definition are always parsed as such anyway.

See also

activate_all_binders, binders, new_binder, parse_as_binder.

 AC_CONV

AC_CONV : ((thm # thm) -> conv)

Synopsis

Proves equality of terms using associative and commutative laws.

Description

Suppose _is a function, which is assumed to be infix in the following syntax, and ath and cth are theorems expressing its associativity and commutativity; they must be of the following form, except that any free variables may have arbitrary names and may be universally quantified:

   ath = |- m _(n _p) = (m _n) _p
   cth = |- m _n = n _m

Then the conversion AC_CONV(ath,cth) will prove equations whose left and right sides can be made identical using these associative and commutative laws.

Failure

Fails if the associative or commutative law has an invalid form, or if the term is not an equation between AC-equivalent terms.

Example

   #AC_CONV(ADD_ASSOC,ADD_SYM)
   #  "x + (SUC t) + ((3 + y) + z) = 3 + (SUC t) + x + y + z";;
   |- (x + ((SUC t) + ((3 + y) + z)) = 3 + ((SUC t) + (x + (y + z)))) = T

Comments

Note that the preproved associative and commutative laws for the operators +, *, /\ and \/ are already in the right form to give to AC_CONV.

See also

SYM_CONV.

 ADD_ASSUM

ADD_ASSUM : (term -> thm -> thm)

Synopsis

Adds an assumption to a theorem.

\underline{ADD CONV 13}

Description

When applied to a boolean term s and a theorem A |- t, the inference rule ADD_ASSUM returns the theorem A u {s} |- t.

       A |- t
   --------------  ADD_ASSUM "s"
    A u {s} |- t

ADD_ASSUM performs straightforward set union with the new assumption; it checks for identical assumptions, but not for alpha-equivalent ones. The position at which the new assumption is inserted into the assumption list should not be relied on.

Failure

Fails unless the given term has type bool.

See also

ASSUME, UNDISCH.

 ADD_CONV

ADD_CONV : conv

Synopsis

Computes the sum of two natural number constants.

Description

If n and m are numeral constants (e.g. 0, 1, 2, 3,...), then ADD_CONV "n + m" returns the theorem:

   |- n + m = s

where s is the numeral that denotes the sum of the natural numbers denoted by n and m.

Failure

ADD_CONV tm fails if tm is not of the form "n + m", where n and m are numerals.

14 Chapter 1. Pre-defined ML Identifiers

Example

#ADD_CONV "75 + 25";;
|- 75 + 25 = 100

 allowed_constant
allowed_constant : (string -> bool)

Synopsis

Tests if a string has a permissible name for a constant.

Description

When applied to a string, allowed_constant returns true if the string is a permissible constant name, that is, if it is an identifier (see the DESCRIPTION for more details), and false otherwise.

Failure

Never fails.

Example

The following shows how the lexical rules can be altered:

   #map allowed_constant [`pi`; `@`; `a name`; `+++++`; `*`];;
   [true; true; false; false; true] : bool list
   #new_special_symbol `+++++`;;
   () : void
   #map allowed_constant [`pi`; `@`; `a name`; `+++++`; `*`];;
   [true; true; false; true; true] : bool list

Comments

Note that this function only performs a lexical test; it does not check whether there is already a constant of that name in the current theory.

See also

constants, is_constant, new_alphanum, new_special_symbol, special_symbols.

\underline{ALL CONV 15}

 ALL_CONV
ALL_CONV : conv

Synopsis

Conversion that always succeeds and leaves a term unchanged.

Description

When applied to a term "t", the conversion ALL_CONV returns the theorem |- t = t.

Failure

Never fails.

Uses

Identity element for THENC.

See also

NO_CONV, REFL.
 ALL_EL_CONV
ALL_EL_CONV : conv -> conv

Synopsis

Computes by inference the result of applying a predicate to elements of a list.

Description

ALL_EL_CONV takes a conversion conv and a term tm in the following form:

   ALL_EL P [x0;...xn]

It returns the theorem

   |- ALL_EL P [x0;...xn] = T

if for every xi occurred in the list, conv "P xi" returns a theorem |- P xi = T, otherwise, if for at least one xi, evaluating conv "P xi" returns the theorem |- P xi = F, then it returns the theorem

   |- ALL_EL P [x0;...xn] = F

Failure

ALL_EL_CONV conv tm fails if tm is not of the form described above, or failure occurs when evaluating conv "P xi" for some xi.

Example

Evaluating

   ALL_EL_CONV bool_EQ_CONV "ALL_EL ($= T) [T;F;T]";;

returns the following theorem:

   |- ALL_EL($= T)[T;F;T] = F

In general, if the predicate P is an explicit lambda abstraction (\x. P x), the conversion should be in the form

   (BETA_CONV THENC conv')

See also

SOME_EL_CONV, IS_EL_CONV, FOLDL_CONV, FOLDR_CONV, list_FOLD_CONV.

 ALL_TAC

ALL_TAC : tactic

Synopsis

Passes on a goal unchanged.

Description

ALL_TAC applied to a goal g simply produces the subgoal list [g]. It is the identity for the THEN tactical.

\underline{ALL THEN 17}

Example

The tactic INDUCT_TAC THENL [ALL_TAC;tac], applied to a goal g, applies INDUCT_TAC to

g to give a basis and step subgoal; it then returns the basis unchanged, along with the subgoals produced by applying tac to the step.

Uses

Used to write tacticals such as REPEAT. Often used as a place-holder in building compound tactics using tacticals such as THENL.

See also

NO_TAC, REPEAT, THENL.

 ALL_THEN

ALL_THEN : thm_tactical

Synopsis

Passes a theorem unchanged to a theorem-tactic.

Description

For any theorem-tactic ttac and theorem th, the application ALL_THEN ttac th results simply in ttac th, that is, the theorem is passed unchanged to the theorem-tactic. ALL_THEN is the identity theorem-tactical.

Failure

The application of ALL_THEN to a theorem-tactic never fails. The resulting theorem-tactic fails under exactly the same conditions as the original one

Uses

Writing compound tactics or tacticals, e.g. terminating list iterations of theorem-tacticals.

See also

ALL_TAC, FAIL_TAC, NO_TAC, NO_THEN, THEN_TCL, ORELSE_TCL.

 ALPHA

ALPHA : (term -> term -> thm)

Synopsis

Proves equality of alpha-equivalent terms.

Description

When applied to a pair of terms t1 and t1' which are alpha-equivalent, ALPHA returns the

theorem |- t1 = t1'.
   -------------  ALPHA "t1" "t1'"
    |- t1 = t1'

Failure

Fails unless the terms provided are alpha-equivalent.

Example

#ALPHA "!x:num. x = x" "!y:num. y = y";;
|- (!x. x = x) = (!y. y = y)

Comments

The system shows the type of ALPHA as term -> conv.

See also

aconv, ALPHA_CONV, GEN_ALPHA_CONV.

 ALPHA_CONV

ALPHA_CONV : (term -> conv)

Synopsis

Renames the bound variable of a lambda-abstraction.

Description

If "x" is a variable of type ty and "\y.t" is an abstraction in which the bound variable y also has type ty, then ALPHA_CONV "x" "\y.t" returns the theorem:

   |- (\y.t) = (\x'. t[x'/y])

where the variable x':ty is a primed variant of x chosen so as not to be free in "\y.t".

Failure

ALPHA_CONV "x" "tm" fails if x is not a variable, if tm is not an abstraction, or if x is a variable v and tm is a lambda abstraction \y.t but the types of v and y differ.

See also

ALPHA, GEN_ALPHA_CONV.

 ancestors

ancestors : (string -> string list)

Synopsis

Gets a list of the (proper) ancestors of a theory.

Description

A call to ancestors `th` returns a list of all the proper ancestors (i.e. parents, parents of parents, etc.) of the theory th.

Failure

Fails if ‘th‘ is not an ancestor of the current theory.

See also

ancestry, parents.

 ancestry

ancestry : (void -> string list)

Synopsis

Gets a list of the ancestors of the current theory.

Description

A call ancestry() returns a list of all the ancestors of the current theory, i.e. the current theory itself, its parents, parents of parents, etc.

Comments

The call ancestry() is considerably more efficient than ancestors `-`.

See also

ancestors, parents.

 AND_EXISTS_CONV

AND_EXISTS_CONV : conv

Synopsis

Moves an existential quantification outwards through a conjunction.

Description

When applied to a term of the form (?x.P) /\ (?x.Q), where x is free in neither P nor Q, AND_EXISTS_CONV returns the theorem:

   |- (?x. P) /\ (?x. Q) = (?x. P /\ Q)

Failure

AND_EXISTS_CONV fails if it is applied to a term not of the form (?x.P) /\ (?x.Q), or if it is applied to a term (?x.P) /\ (?x.Q) in which the variable x is free in either P or Q.

See also

EXISTS_AND_CONV, LEFT_AND_EXISTS_CONV, RIGHT_AND_EXISTS_CONV.

 AND_FORALL_CONV

AND_FORALL_CONV : conv

Synopsis

Moves a universal quantification outwards through a conjunction.

Description

When applied to a term of the form (!x.P) /\ (!x.Q), the conversion AND_FORALL_CONV returns the theorem:

   |- (!x.P) /\ (!x.Q) = (!x. P /\ Q)

Failure

Fails if applied to a term not of the form (!x.P) /\ (!x.Q).

See also

FORALL_AND_CONV, LEFT_AND_FORALL_CONV, RIGHT_AND_FORALL_CONV.

 ANTE_CONJ_CONV

ANTE_CONJ_CONV : conv

Synopsis

Eliminates a conjunctive antecedent in favour of implication.

Description

When applied to a term of the form "(t1 /\ t2) ==> t", the conversion ANTE_CONJ_CONV returns the theorem:

   |- (t1 /\ t2 ==> t) = (t1 ==> t2 ==> t)

Failure

Fails if applied to a term not of the form "(t1 /\ t2) ==> t".

Uses

Somewhat ad-hoc, but can be used (with CONV_TAC) to transform a goal of the form ?- (P /\ Q) ==> R into the subgoal ?- P ==> (Q ==> R), so that only the antecedent P is moved into the assumptions by DISCH_TAC.

 ANTE_RES_THEN

ANTE_RES_THEN : thm_tactical

Synopsis

Resolves implicative assumptions with an antecedent.

Description

Given a theorem-tactic ttac and a theorem A |- t, the function ANTE_RES_THEN produces a tactic that attempts to match t to the antecedent of each implication

   Ai |- !x1...xn. ui ==> vi

(where Ai is just !x1...xn. ui ==> vi) that occurs among the assumptions of a goal. If the antecedent ui of any implication matches t, then an instance of Ai u A |- vi is obtained by specialization of the variables x1, ..., xn and type instantiation, followed by an application of modus ponens. Because all implicative assumptions are tried, this may result in several modus-ponens consequences of the supplied theorem and the assumptions. Tactics are produced using ttac from all these theorems, and these tactics are applied in sequence to the goal. That is,

   ANTE_RES_THEN ttac (A |- t) g

has the effect of:

   MAP_EVERY ttac [A1 u A |- v1; ...; Am u A |- vm] g

where the theorems Ai u A |- vi are all the consequences that can be drawn by a (single) matching modus-ponens inference from the implications that occur among the assumptions of the goal g and the supplied theorem A |- t. Any negation ~v that appears among the assumptions of the goal is treated as an implication v ==> F. The sequence in which the theorems Ai u A |- vi are generated and the corresponding tactics applied is unspecified.

Failure

ANTE_RES_THEN ttac (A |- t) fails when applied to a goal g if any of the tactics produced by ttac (Ai u A |- vi), where Ai u A |- vi is the ith resolvent obtained from the theorem A |- t and the assumptions of g, fails when applied in sequence to g.

See also

IMP_RES_TAC, IMP_RES_THEN, MATCH_MP, RES_TAC, RES_THEN.

 append

append : (* list -> * list -> * list)

Synopsis

Concatenates two lists.

Description

append [x1;...;xn] [y1;...;ym] returns [x1;...;xn;y1;...;ym].

Failure

Never fails.

Comments

Performs the same operation as $@.

 APPEND_CONV

APPEND_CONV : conv

Synopsis

Computes by inference the result of appending two object-language lists.

Description

For any pair of object language lists of the form "[x1;...;xn]" and "[y1;...;ym]", the result of evaluating

   APPEND_CONV "APPEND [x1;...;xn] [y1;...;ym]"

is the theorem

   |- APPEND [x1;...;xn] [y1;...;ym] = [x1;...;xn;y1;...;ym]

The length of either list (or both) may be 0.

Failure

APPEND_CONV tm fails if tm is not of the form "APPEND l1 l2", where l1 and l2 are (possibly empty) object-language lists of the forms "[x1;...;xn]" and "[y1;...;ym]".

 append_openw

append_openw : (string -> string)

Synopsis

Opens a port for appending to a named file.

Description

When applied to a filename `name`, the function append_openw opens the file name for writing, such that existing contents are appended to rather than overwritten. It returns a port descriptor string, which can be used by write to append to the file, and by close to close it.

Example

The following example assumes that HOL is being run under Unix. It will overwrite an existing file test-file in the current directory.

   #system `echo -n 'Hello ' >test-file`;;
   0 : int
   #let port = append_openw `test-file`;;
   port = `%test-file` : string
   #write(port,`world`);;
   () : void
   #close port;;
   () : void
   #system `cat test-file`;;
   Hello world0 : int

See also

close, openi, openw, read, write.

 apply_proof

apply_proof : (subgoals -> thm)

Synopsis

This function is for internal use only and is to be deleted from a future version of the system. It should not be used.

\underline{AP TERM 25}

 AP_TERM

AP_TERM : (term -> thm -> thm)

Synopsis

Applies a function to both sides of an equational theorem.

Description

When applied to a term f and a theorem A |- x = y, the inference rule AP_TERM returns the theorem A |- f x = f y.

      A |- x = y
   ----------------  AP_TERM "f"
    A |- f x = f y

Failure

Fails unless the theorem is equational and the supplied term is a function whose domain type is the same as the type of both sides of the equation.

See also

AP_THM, MK_COMB.

 AP_TERM_TAC

AP_TERM_TAC : tactic

Synopsis

Strips a function application from both sides of an equational goal.

Description

AP_TERM_TAC reduces a goal of the form A ?- f x = f y by stripping away the function applications, giving the new goal A ?- x = y.

    A ?- f x = f y
   ================  AP_TERM_TAC
     A ?- x = y

Failure

Fails unless the goal is equational, with both sides being applications of the same function.

See also

AP_TERM, AP_THM.
 AP_THM
AP_THM : (thm -> term -> thm)

Synopsis

Proves equality of equal functions applied to a term.

Description

When applied to a theorem A |- f = g and a term x, the inference rule AP_THM returns the theorem A |- f x = g x.

      A |- f = g
   ----------------  AP_THM (A |- f = g) "x"
    A |- f x = g x

Failure

Fails unless the conclusion of the theorem is an equation, both sides of which are functions whose domain type is the same as that of the supplied term.

Comments

The type of AP_THM is shown by the system as thm -> conv.

See also

AP_TERM, ETA_CONV, EXT, MK_COMB.
 AP_THM_TAC
AP_THM_TAC : tactic

Synopsis

Strips identical operands from functions on both sides of an equation.

\underline{arb term 27}

Description

When applied to a goal of the form A ?- f x = g x, the tactic AP_THM_TAC strips away the operands of the function application:

    A ?- f x = g x
   ================  AP_THM_TAC
      A ?- f = g

Failure

Fails unless the goal has the above form, namely an equation both sides of which consist of function applications to the same arguments.

See also

AP_TERM, AP_TERM_TAC, AP_THM, EXT.

 arb_term

arb_term : term

Synopsis

This identifier is bound for implementation reasons only.

Description

arb_term is the term "arb:*", i.e. it is a variable named arb of logical type ":*".

 arity

arity : (string -> int)

Synopsis

Returns the arity of a type operator.

Description

arity `op` returns n if op is the name of an n-ary type operator (n can be 0), and otherwise fails.

Failure

arity st fails if st is not the name of a type constant or type operator.

See also

is_type.

 ascii

ascii : (int -> string)

Synopsis

Maps an integer to the corresponding ASCII character.

Description

When given an integer, ascii returns a string consisting of the single character corresponding to that integer under the ASCII encoding.

Failure

Fails unless the integer supplied is in the range 0 <= x < 128.

See also

ascii_code, int_of_string, is_alphanum, is_letter, string_of_int.

 ascii_code

ascii_code : (string -> int)

Synopsis

Maps a character to corresponding ASCII numeric code.

Description

When given a string, ascii_code returns the numeric encoding in the ASCII character set of the first character of that string.

Failure

Fails if the string is empty (``).

See also

ascii, int_of_string, is_alphanum, is_letter, string_of_int.

 ASM_CASES_TAC

ASM_CASES_TAC : (term -> tactic)

Synopsis

Given a term, produces a case split based on whether or not that term is true.

Description

Given a term u, ASM_CASES_TAC applied to a goal produces two subgoals, one with u as an assumption and one with ~u:

               A ?-  t
   ================================  ASM_CASES_TAC "u"
    A u {u} ?- t   A u {~u} ?- t
ASM_CASES_TAC u is implemented by DISJ_CASES_TAC(SPEC u EXCLUDED_MIDDLE), where
EXCLUDED_MIDDLE is the axiom |- !u. u \/ ~u.

Failure

By virtue of the implementation (see above), the decomposition fails if EXCLUDED_MIDDLE cannot be instantiated to u, e.g. if u does not have boolean type.

Example

The tactic ASM_CASES_TAC "u" can be used to produce a case analysis on "u":

    ASM_CASES_TAC "u:bool" ([],"(P:bool -> bool) u");;
    ([(["u"], "P u"); (["~u"], "P u")], -) : subgoals

Uses

Performing a case analysis according to whether a given term is true or false.

See also

BOOL_CASES_TAC, COND_CASES_TAC, DISJ_CASES_TAC, SPEC, STRUCT_CASES_TAC.

 ASM_REWRITE_RULE

ASM_REWRITE_RULE : (thm list -> thm -> thm)

Synopsis

Rewrites a theorem including built-in rewrites and the theorem’s assumptions.

Description

ASM_REWRITE_RULE rewrites with the tautologies in basic_rewrites, the given list of theorems, and the set of hypotheses of the theorem. All hypotheses are used. No ordering is specified among applicable rewrites. Matching subterms are searched for recursively, starting with the entire term of the conclusion and stopping when no rewritable expressions remain. For more details about the rewriting process, see GEN_REWRITE_RULE. To avoid using the set of basic tautologies, see PURE_ASM_REWRITE_RULE.

Failure

ASM_REWRITE_RULE does not fail, but may result in divergence. To prevent divergence where it would occur, ONCE_ASM_REWRITE_RULE can be used.

See also

GEN_REWRITE_RULE, ONCE_ASM_REWRITE_RULE, PURE_ASM_REWRITE_RULE,
PURE_ONCE_ASM_REWRITE_RULE, REWRITE_RULE.

 ASM_REWRITE_TAC

ASM_REWRITE_TAC : (thm list -> tactic)

Synopsis

Rewrites a goal including built-in rewrites and the goal’s assumptions.

Description

ASM_REWRITE_TAC generates rewrites with the tautologies in basic_rewrites, the set of assumptions, and a list of theorems supplied by the user. These are applied top-down and recursively on the goal, until no more matches are found. The order in which the set of rewrite equations is applied is an implementation matter and the user should not depend on any ordering. Rewriting strategies are described in more detail under GEN_REWRITE_TAC. For omitting the common tautologies, see the tactic PURE_ASM_REWRITE_TAC. To rewrite with only a subset of the assumptions use FILTER_ASM_REWRITE_TAC.

Failure

ASM_REWRITE_TAC does not fail, but it can diverge in certain situations. For rewriting to a limited depth, see ONCE_ASM_REWRITE_TAC. The resulting tactic may not be valid if the applicable replacement introduces new assumptions into the theorem eventually proved.

\underline{assert 31}

Example

The use of assumptions in rewriting, specially when they are not in an obvious equational form, is illustrated below:

#ASM_REWRITE_TAC[](["P x"],"P x = Q x");;
([(["P x"], "Q x")], -) : subgoals
#ASM_REWRITE_TAC[](["~P x"],"P x = Q x");;
([(["~P x"], "~Q x")], -) : subgoals

See also

basic_rewrites, FILTER_ASM_REWRITE_TAC, FILTER_ONCE_ASM_REWRITE_TAC,
GEN_REWRITE_TAC, ONCE_ASM_REWRITE_TAC, ONCE_REWRITE_TAC, PURE_ASM_REWRITE_TAC,
PURE_ONCE_ASM_REWRITE_TAC, PURE_REWRITE_TAC, REWRITE_TAC, SUBST_TAC.

assert

assert : ((* -> bool) -> * -> *)

Synopsis

Checks that a value satisfies a predicate.

Description

assert p x returns x if the application p x yields true. Otherwise, assert p x fails.

Failure

assert p x fails with the string `fail` if the predicate p yields false when applied to the value x.

Example

#null [];;
true : bool
#assert null [];;
[] : * list
#null [1];;
false : bool
#assert null [1];;
evaluation failed     fail

See also

can.

 assignable_print_term

assignable_print_term : (term -> void)

Synopsis

Assignable term-printing function used for printing goals.

Description

The printing of terms can be modified using the ML directive top_print. However the term printing functions used for printing goals are not affected by top_print. To make use of user-defined print functions in goals, the assignable variable assignable_print_term must be changed. assignable print term 33

Example

#let my_print_term tm =
# do (print_string `<<`;print_term tm;print_string `>>`);;
my_print_term = - : (term -> void)
#"x ==> y";;
"x ==> y" : term
#top_print my_print_term;;
- : (term -> void)
#"x ==> y";;
<<"x ==> y">> : term
#g "(x ==> y) /\ (y ==> x) ==> (x = y)";;
"(x ==> y) /\ (y ==> x) ==> (x = y)"
() : void
#expand (REPEAT STRIP_TAC);;
OK..
"x = y"
    [ "x ==> y" ]
    [ "y ==> x" ]
() : void
#assignable_print_term := my_print_term;;
- : (term -> void)
#expand ALL_TAC;;
OK..
<<"x = y">>
    [ <<"x ==> y">> ]
    [ <<"y ==> x">> ]
() : void
#assignable_print_term := print_term;;
- : (term -> void)
#expand ALL_TAC;;
OK..
"x = y"
    [ "x ==> y" ]
    [ "y ==> x" ]
() : void

See also

print_term, top_print.

 assoc
assoc : (* -> (* # **) list -> (* # **))

Synopsis

Searches a list of pairs for a pair whose first component equals a specified value.

Description

assoc x [(x1,y1);...;(xn,yn)] returns the first (xi,yi) in the list such that xi equals

x.

Failure

Fails if no matching pair is found. This will always be the case if the list is empty.

Example

#assoc 2 [(1,4);(3,2);(2,5);(2,6)];;
(2, 5) : (int # int)

See also

rev_assoc, find, mem, tryfind, exists, forall.

 associate_restriction
associate_restriction : ((string # string) -> void)

Synopsis

Associates a restriction semantics with a binder.

Description

If B is a binder and RES_B a constant then

   associate_restriction(`B`, `RES_B`)

will cause the parser and pretty-printer to support:

               ---- parse ---->
   Bv::P. B                       RES_B  P (\v. B)
              <---- print ----

Anything can be written between the binder and `::` that could be written between the binder and `.` in the old notation. See the examples below.

Associations between user defined binders and their restrictions are not stored in the theory, so they have to be set up for each hol session (e.g. with a hol-init.ml file).

The flag `print_restrict` has default true, but if set to false will disable the pretty printing. This is useful for seeing what the semantics of particular restricted abstractions are.

The following associations are predefined:

   \v::P. B    <---->   RES_ABSTRACT P (\v. B)
   !v::P. B    <---->   RES_FORALL   P (\v. B)
   ?v::P. B    <---->   RES_EXISTS   P (\v. B)
   @v::P. B    <---->   RES_SELECT   P (\v. B)

  Where the constants RES_ABSTRACT, RES_FORALL, RES_EXISTS and RES_SELECT are defined

in the theory `bool` by:

   |- RES_ABSTRACT P B =  \x:*. (P x => B x | ARB:**)
   |- RES_FORALL P B   =  !x:*. P x ==> B x
   |- RES_EXISTS P B   =  ?x:*. P x /\ B x
   |- RES_SELECT P B   =  @x:*. P x /\ B x

where ARB is defined in the theory `bool` by:

   |- ARB  =  @x:*. T

Failure

Never fails.

Example

#new_binder_definition(`DURING`, "DURING(p:num#num->bool) = $!p");;
|- !p. $DURING p = $! p
#"DURING x::(m,n). p x";;
no restriction constant associated with DURING
skipping: x " ;; parse failed
#new_definition
# (`RES_DURING`, "RES_DURING(m,n)p = !x. m<=x /\ x<=n ==> p x");;
|- !m n p. RES_DURING(m,n)p = (!x. m <= x /\ x <= n ==> p x)
#associate_restriction(`DURING`,`RES_DURING`);;
() : void
#"DURING x::(m,n). p x";;
"DURING x :: (m,n). p x" : term
#set_flag(`print_restrict`,false);;
true : bool
#"DURING x::(m,n). p x";;
"RES_DURING(m,n)(\x. p x)" : term

 ASSUME

ASSUME : (term -> thm)

Synopsis

Introduces an assumption.

Description

When applied to a term t, which must have type bool, the inference rule ASSUME returns the theorem t |- t.

   --------  ASSUME "t"
    t |- t

Failure

Fails unless the term t has type bool.

Comments

The type of ASSUME is shown by the system as conv.

See also

ADD_ASSUM, REFL.

 ASSUME_TAC

ASSUME_TAC : thm_tactic

Synopsis

Adds an assumption to a goal.

Description

Given a theorem th of the form A' |- u, and a goal, ASSUME_TAC th adds u to the assumptions of the goal.

         A ?- t
    ==============  ASSUME_TAC (A' |- u)
     A u {u} ?- t

Note that unless A' is a subset of A, this tactic is invalid.

Failure

Never fails.

Example

Given a goal g of the form {x = y, y = z} ?- P, where "x", "y" and "z" have type ":*", the theorem x = y, y = z |- x = z can, first, be inferred by forward proof

   TRANS(ASSUME "x = y")(ASSUME "y = z")

and then added to the assumptions. This process requires the explicit text of the assumptions, as well as invocation of the rule ASSUME:

   ASSUME_TAC(TRANS(ASSUME "x = y")(ASSUME "y = z"))g;;
   ([(["x = z"; "x = y"; "y = z"], "P")], -) : subgoals

This is the naive way of manipulating assumptions; there are more advanced proof styles (more elegant and less transparent) that achieve the same effect, but this is a perfectly correct technique in itself.

Alternatively, the axiom EQ_TRANS could be added to the assumptions of g:

   ASSUME_TAC EQ_TRANS g;;
   ([(["!x y z. (x = y) /\ (y = z) ==> (x = z)"; "x = y"; "y = z"], "P")],
    -)
   : subgoals

A subsequent resolution (see RES_TAC) would then be able to add the assumption "x = z" to the subgoal shown above. (Aside from purposes of example, it would be more usual to use IMP_RES_TAC than ASSUME_TAC followed by RES_TAC in this context.)

Uses

ASSUME_TAC is the naive way of manipulating assumptions (i.e. without recourse to advanced tacticals); and it is useful for enriching the assumption list with lemmas as a prelude to resolution (RES_TAC, IMP_RES_TAC), rewriting with assumptions (ASM_REWRITE_TAC and so on), and other operations involving assumptions.

See also

ACCEPT_TAC, IMP_RES_TAC, RES_TAC, STRIP_ASSUME_TAC.

 ASSUM_LIST

ASSUM_LIST : ((thm list -> tactic) -> tactic)

Synopsis

Applies a tactic generated from the goal’s assumption list.

Description

When applied to a function of type thm list -> tactic and a goal, ASSUM_LIST constructs a tactic by applying f to a list of ASSUMEd assumptions of the goal, then applies that tactic to the goal.

   ASSUM_LIST f ({A1;...;An} ?- t)
         = f [A1 |- A1; ... ; An |- An] ({A1;...;An} ?- t)

Failure

Fails if the function fails when applied to the list of ASSUMEd assumptions, or if the resulting tactic fails when applied to the goal.

Comments

There is nothing magical about ASSUM_LIST: the same effect can usually be achieved just as conveniently by using ASSUME a wherever the assumption a is needed. If ASSUM_LIST is used, it is extremely unwise to use a function which selects elements from its argument list by number, since the ordering of assumptions should not be relied on.

Example

The tactic:

   ASSUM_LIST SUBST_TAC

makes a single parallel substitution using all the assumptions, which can be useful if the rewriting tactics are too blunt for the required task.

Uses

Making more careful use of the assumption list than simply rewriting or using resolution.

See also

ASM_REWRITE_TAC, EVERY_ASSUM, IMP_RES_TAC, POP_ASSUM, POP_ASSUM_LIST,
REWRITE_TAC.

 attempt_first

attempt_first : (subgoals -> tactic -> subgoals)

Synopsis

This function is for internal use only and is to be deleted from a future version of the system. It should not be used.

 autoload

autoload : ((string # string # string list) -> void)

Synopsis

Sets up a general autoloading action.

Description

After a call autoload(`name`,`f`,[`arg1`;...;`argn`]), a subsequent occurrence of name

in an ML phrase will cause the ML expression f [`arg1`;...;`argn`] to be evaluated before any of the toplevel phrase containing name is evaluated. Notice that f is interpreted as a single identifier denoting a function, whereas the various arguments are string literals.

Failure

Never fails (obviously failure may occur when the action is actually performed; the ML phrase could be nonsense).

Example

The following is a simple example:

   #let action = tty_write o hd;;
   action = - : (string list -> void)
   #autoload(`key1`,`action`,[`Hello John!`]);;
   () : void
   #let key1 = 1;;
   Hello John!() : void
   key1 = 1 : int

Comments

There is no obligation to use the argument list; an alternative to achieve the same as the above is:

   #let action (l:(string)list) = tty_write `Hello John!`;;
   action = - : (string list -> void)
   #autoload(`key2`,`action`,[]);;
   () : void
   #let key2 = 1;;
   Hello John!() : void
   key2 = 1 : int

If a normal autoloading action is all that is required, the function autoload_theory provides a simpler way.

See also

autoload_theory, let_after, let_before, undo_autoload.

 autoload_theory

autoload_theory : ((string # string # string) -> void)

Synopsis

Makes an axiom, definition or theorem autoload when mentioned.

Description

After a call autoload_theory(`kind`,`thy`,`name`), a subsequent occurrence of the name name in an ML phrase will cause the relevant autoloading action. The kind value should be one of axiom, definition (this includes type definitions) or theorem, and the appropriate entity called name will be loaded from theory thy before the ML phrase containing name is evaluated.

Failure

Never fails, although the subsequent autoloading action may do.

Example

The following autoload is not necessary because ETA_AX is already bound to an identifier when HOL is started. However, it shows the general idea.

   #autoload_theory(`axiom`,`bool`,`ETA_AX`);;
   () : void
   #ETA_AX;;
   Axiom ETA_AX autoloaded from theory `bool`.
   ETA_AX = |- !t. (\x. t x) = t
   |- !t. (\x. t x) = t

Comments

More general automatic actions can be achieved using autoload.

See also

autoload, undo_autoload.

 axiom

axiom : (string -> string -> thm)

Synopsis

Loads an axiom from a given theory segment of the current theory.

Description

A call of axiom `thy` `ax` returns axiom ax from the theory segment thy. The theory segment thy must be part of the current theory. The name ax is the name given to the axiom by the user when it was originally added to the theory segment (by a call to new_axiom). The name of the current theory segment can be abbreviated by `-`.

Failure

The call axiom `thy` `ax` will fail if the theory segment thy is not part of the current theory. It will fail if there does not exist an axiom of name ax in theory segment thy.

Example

#axiom `bool` `BOOL_CASES_AX`;;
|- !t. (t = T) \/ (t = F)

See also

axioms, definition, load_axiom, load_axioms, new_axiom, print_theory, theorem.

 axioms

axioms : (string -> (string # thm) list)

Synopsis

Returns the axioms of a given theory segment of the current theory.

Description

A call axioms `thy` returns the axioms of the theory segment thy together with their names. The theory segment thy must be part of the current theory. The names are those given to the axioms by the user when they were originally added to the theory segment (by a call to new_axiom). The name of the current theory segment can be abbreviated by

`-`.

Failure

The call axioms `thy` will fail if the theory segment thy is not part of the current theory. axiom lfn 43

Example

#axioms `bool`;;
[(`SELECT_AX`, |- !P x. P x ==> P($@ P));
 (`ETA_AX`, |- !t. (\x. t x) = t);
 (`IMP_ANTISYM_AX`,
  |- !t1 t2. (t1 ==> t2) ==> (t2 ==> t1) ==> (t1 = t2));
 (`BOOL_CASES_AX`, |- !t. (t = T) \/ (t = F));
 (`ARB_THM`, |- $= = $=)]
: (string # thm) list

See also

axiom, definitions, load_axiom, load_axioms, new_axiom, print_theory, theorems.

 axiom_lfn

axiom_lfn : (string list -> thm)

Synopsis

Loads a given axiom from a given theory.

Description

If thy is an ancestor theory, and ax one of its axioms, then the call

   axiom_lfn [`thy`;`ax`]

will return that axiom.

Failure

Fails if thy is not an ancestor theory, or if ax is not one of its axioms.

Example

#axiom_lfn [`bool`;`ETA_AX`];;
|- !t. (\x. t x) = t

Comments

This call has the same effect as axiom `thy` `ax`.

See also

axiom, axioms, axiom_msg_lfn, load_axiom, load_axioms.

 axiom_msg_lfn
axiom_msg_lfn : (string list -> thm)

Synopsis

Loads a given axiom from a given theory, with an autoload message.

Description

If thy is an ancestor theory, and ax one of its axioms, then the call

   axiom_msg_lfn [`thy`;`ax`]

will print a message of the form

   Axiom ax autoloaded from theory `thy`

and cancel any autoloading action associated with the name ax, and will then return that axiom.

Failure

Fails if thy is not an ancestor theory, or if ax is not one of its axioms.

Example

#axiom_msg_lfn [`bool`;`ETA_AX`];;
Axiom ETA_AX autoloaded from theory `bool`.
|- !t. (\x. t x) = t

See also

autoload, autoload_theory, axiom, axioms, axiom_lfn, load_axiom, load_axioms,
undo_autoload.
 B
B : ((* -> **) -> (*** -> *) -> *** -> **)

Synopsis

Performs curried function-composition: B f g x = f (g x).

\underline{b 45}

Failure

Never fails.

See also

#, C, CB, Co, I, K, KI, o, oo, S, W.

 b

b : (void -> void)

Synopsis

Restores the proof state undoing the effects of a previous expansion.

Description

The function b is part of the subgoal package. It is an abbreviation for the function backup. For a description of the subgoal package, see set_goal.

Failure

As for backup.

Uses

Back tracking in a goal-directed proof to undo errors or try different tactics.

See also

backup, backup_limit, e, expand, expandf, g, get_state, p, print_state, r,
rotate, save_top_thm, set_goal, set_state, top_goal, top_thm.

 backup

backup : (void -> void)

Synopsis

Restores the proof state, undoing the effects of a previous expansion.

Description

The function backup is part of the subgoal package. It allows backing up from the last state change (caused by calls to expand, set_goal, rotate and their abbreviations, or to set_state). The package maintains a backup list of previous proof states. A call to backup restores the state to the previous state (which was on top of the backup list). The current state and the state on top of the backup list are discarded. The maximum number of proof states saved on the backup list is one greater than the value of the assignable variable backup_limit. This variable is initially set to 12. Adding new proof states after the maximum is reached causes the earliest proof state on the list to be discarded. The user may backup repeatedly until the list is exhausted. The state restored includes all unproven subgoals or, if a goal had been proved in the previous state, the corresponding theorem. backup is abbreviated by the function b. For a description of the subgoal package, see set_goal.

Failure

The function backup will fail if the backup list is empty. backup limit 47

Example

#g "(HD[1;2;3] = 1) /\ (TL[1;2;3] = [2;3])";;
"(HD[1;2;3] = 1) /\ (TL[1;2;3] = [2;3])"
() : void
#e CONJ_TAC;;
OK..
2 subgoals
"TL[1;2;3] = [2;3]"
"HD[1;2;3] = 1"
() : void
#backup();;
"(HD[1;2;3] = 1) /\ (TL[1;2;3] = [2;3])"
() : void
#e (REWRITE_TAC[HD;TL]);;
OK..
goal proved
|- (HD[1;2;3] = 1) /\ (TL[1;2;3] = [2;3])
Previous subproof:
goal proved
() : void

Uses

Back tracking in a goal-directed proof to undo errors or try different tactics.

See also

b, backup_limit, e, expand, expandf, g, get_state, p, print_state, r, rotate,
save_top_thm, set_goal, set_state, top_goal, top_thm.

 backup_limit

backup_limit : int

Synopsis

Limits the number of proof states saved on the subgoal package backup list.

Description

The assignable variable backup_limit is initially set to 12. Its value is one less than the maximum number of proof states that may be saved on the backup list. Adding a new proof state (by, for example, a call to expand) after the maximum is reached causes the earliest proof state on the list to be discarded. For a description of the subgoal package,

see set_goal.

backup limit 49

Example

#backup_limit := 0;;
0 : int
#g "(HD[1;2;3] = 1) /\ (TL[1;2;3] = [2;3])";;
"(HD[1;2;3] = 1) /\ (TL[1;2;3] = [2;3])"
() : void
#e CONJ_TAC;;
OK..
2 subgoals
"TL[1;2;3] = [2;3]"
"HD[1;2;3] = 1"
() : void
#e (REWRITE_TAC[HD]);;
OK..
goal proved
|- HD[1;2;3] = 1
Previous subproof:
"TL[1;2;3] = [2;3]"
() : void
#b();;
2 subgoals
"TL[1;2;3] = [2;3]"
"HD[1;2;3] = 1"
() : void
#b();;
evaluation failed     backup:  backup list is empty

See also

b, backup, e, expand, expandf, g, get_state, p, print_state, r, rotate,
save_top_thm, set_goal, set_state, top_goal, top_thm.

 backup_list
backup_list : goalstack list

Synopsis

This function is for internal use only and is to be deleted from a future version of the system. It should not be used.

 basic_rewrites
basic_rewrites: thm list

Synopsis

Contains a number of built-in tautologies used, by default, in rewriting.

Description

The variable basic_rewrites contains polymorphic tautologies which are often used for simplifying and solving a goal through rewriting. They include the clause for reflexivity:

   |- !x. (x = x) = T;

as well as rules to reason about equality:

   |- !t.
      ((T = t) = t) /\ ((t = T) = t) /\ ((F = t) = ~t) /\ ((t = F) = ~t);

Negations are manipulated by the following clauses:

   |- (!t. ~~t = t) /\ (~T = F) /\ (~F = T);

The set of tautologies includes truth tables for conjunctions, disjunctions, and implicabasic rewrites 51

tions:

|- !t.
(T /\ t = t) /\
(t /\ T = t) /\
(F /\ t = F) /\
(t /\ F = F) /\
(t /\ t = t);
|- !t.
(T \/ t = T) /\
(t \/ T = T) /\
(F \/ t = t) /\
(t \/ F = t) /\
(t \/ t = t);
|- !t.
(T ==> t = t) /\
(t ==> T = T) /\
(F ==> t = T) /\
(t ==> t = T) /\
(t ==> F = ~t);

Simple rules for reasoning about conditionals are given by:

|- !t1 t2. ((T => t1 | t2) = t1) /\ ((F => t1 | t2) = t2);

Rewriting with the following tautologies allows simplification of universally and existentially quantified variables and abstractions:

|- !t. (!x. t) = t;
|- !t. (?x. t) = t;
|- !t1 t2. (\x. t1)t2 = t1;

The list basic_rewrites also includes rules for reasoning about pairs in HOL:

|- !x. FST x,SND x = x;
|- !x y. FST(x,y) = x;
|- !x y. SND(x,y) = y]

Uses

The basic_rewrites are included in the set of equations used by some of the rewriting tools.

See also

ABS_SIMP, AND_CLAUSES, COND_CLAUSES, EQ_CLAUSES, EXISTS_SIMP, FORALL_SIMP, FST,
GEN_REWRITE_RULE, GEN_REWRITE_TAC, IMP_CLAUSES, NOT_CLAUSES, OR_CLAUSES, PAIR,
REFL_CLAUSE, REWRITE_RULE, REWRITE_TAC, SND.

 BETA_CONV
BETA_CONV : conv

Synopsis

Performs a simple beta-conversion.

Description

The conversion BETA_CONV maps a beta-redex "(\x.u)v" to the theorem

   |- (\x.u)v = u[v/x]

where u[v/x] denotes the result of substituting v for all free occurrences of x in u, after renaming sufficient bound variables to avoid variable capture. This conversion is one of the primitive inference rules of the HOL system.

Failure

BETA_CONV tm fails if tm is not a beta-redex.

Example

#BETA_CONV "(\x.x+1)y";;
|- (\x. x + 1)y = y + 1
#BETA_CONV "(\x y. x+y)y";;
|- (\x y. x + y)y = (\y'. y + y')

Comments

This primitive inference rule is actually not very primitive, since it does automatic bound variable renaming. It would be logically cleaner for this renaming to be derived rather than built-in, but since beta-reduction is so common this would slow the system down a lot. It is hoped to document the exact renaming algorithm used by BETA_CONV in the future.

See also

BETA_RULE, BETA_TAC, LIST_BETA_CONV, PAIRED_BETA_CONV, RIGHT_BETA,
RIGHT_LIST_BETA.

 BETA_RULE

BETA_RULE : (thm -> thm)

\underline{BETA TAC 53}

Synopsis

Beta-reduces all the beta-redexes in the conclusion of a theorem.

Description

When applied to a theorem A |- t, the inference rule BETA_RULE beta-reduces all betaredexes, at any depth, in the conclusion t. Variables are renamed where necessary to avoid free variable capture.

    A |- ....((\x. s1) s2)....
   ----------------------------  BETA_RULE
      A |- ....(s1[s2/x])....

Failure

Never fails, but will have no effect if there are no beta-redexes.

Example

The following example is a simple reduction which illustrates variable renaming:

   #top_print print_all_thm;;
   - : (thm -> void)
   #let x = ASSUME "f = ((\x y. x + y) y)";;
   x = f = (\x y. x + y)y |- f = (\x y. x + y)y
   #BETA_RULE x;;
   f = (\x y. x + y)y |- f = (\y'. y + y')

See also

BETA_CONV, BETA_TAC, PAIRED_BETA_CONV, RIGHT_BETA.

 BETA_TAC

BETA_TAC : tactic

Synopsis

Beta-reduces all the beta-redexes in the conclusion of a goal.

Description

When applied to a goal A ?- t, the tactic BETA_TAC produces a new goal which results from beta-reducing all beta-redexes, at any depth, in t. Variables are renamed where necessary to avoid free variable capture.

    A ?- ...((\x. s1) s2)...
   ==========================  BETA_TAC
     A ?- ...(s1[s2/x])...

Failure

Never fails, but will have no effect if there are no beta-redexes.

See also

BETA_CONV, BETA_TAC, PAIRED_BETA_CONV.

 binders

binders : (string -> term list)

Synopsis

Lists the binders in the named theory.

Description

The function binders should be applied to a string which is the name of an ancestor theory (including the current theory; the special string `-` is always interpreted as the current theory). It returns a list of all the binders declared in the named theory.

Failure

Fails unless the given theory is an ancestor of the current theory.

Example

#binders `bool`;;
["$?!"; "$!"; "$@"] : term list
#binders `ind`;;
[] : term list

See also

ancestors, axioms, constants, definitions, infixes, new_binder, parents, types.

\underline{bndvar 55}

 bndvar
bndvar : (term -> term)

Synopsis

Returns the bound variable of an abstraction.

Description

bndvar "\var. t" returns "var".

Failure

Fails unless the term is an abstraction.

See also

body, dest_abs.
 body
body : (term -> term)

Synopsis

Returns the body of an abstraction.

Description

body "\var. t" returns "t".

Failure

Fails unless the term is an abstraction.

See also

bndvar, dest_abs.
 BODY_CONJUNCTS
BODY_CONJUNCTS : (thm -> thm list)

Synopsis

Splits up conjuncts recursively, stripping away universal quantifiers.

Description

When applied to a theorem, BODY_CONJUNCTS recursively strips off universal quantifiers by specialization, and breaks conjunctions into a list of conjuncts.

    A |- !x1...xn. t1 /\ (!y1...ym. t2 /\ t3) /\ ...
   --------------------------------------------------  BODY_CONJUNCTS
          [A |- t1; A |- t2; A |- t3; ...]

Failure

Never fails, but has no effect if there are no top-level universal quantifiers or conjuncts.

Example

The following illustrates how a typical term will be split:

   #let x = ASSUME "!x:bool. A /\ (B \/ (C /\ D)) /\ ((!y:bool. E) /\ F)";;
   x = . |- !x. A /\ (B \/ C /\ D) /\ (!y. E) /\ F
   #BODY_CONJUNCTS x;;
   [. |- A; . |- B \/ C /\ D; . |- E; . |- F] : thm list

See also

CONJ, CONJUNCT1, CONJUNCT2, CONJUNCTS, CONJ_TAC.

 BOOL_CASES_TAC

BOOL_CASES_TAC : (term -> tactic)

Synopsis

Performs boolean case analysis on a (free) term in the goal.

Description

When applied to a term x (which must be of type bool but need not be simply a variable), and a goal A ?- t, the tactic BOOL_CASES_TAC generates the two subgoals corresponding bool EQ CONV 57 to A ?- t but with any free instances of x replaced by F and T respectively.

              A ?- t
   ============================  BOOL_CASES_TAC "x"
    A ?- t[F/x]    A ?- t[T/x]

The term given does not have to be free in the goal, but if it isn’t, BOOL_CASES_TAC will merely duplicate the original goal twice.

Failure

Fails unless the term x has type bool.

Example

The goal:

   ?- (b ==> ~b) ==> (b ==> a)

can be completely solved by using BOOL_CASES_TAC on the variable b, then simply rewriting the two subgoals using only the inbuilt tautologies, i.e. by applying the following tactic:

   BOOL_CASES_TAC "b:bool" THEN REWRITE_TAC[]

Uses

Avoiding fiddly logical proofs by brute-force case analysis, possibly only over a key term as in the above example, possibly over all free boolean variables.

See also

ASM_CASES_TAC, COND_CASES_TAC, DISJ_CASES_TAC, STRUCT_CASES_TAC.
 bool_EQ_CONV
bool_EQ_CONV : conv

Synopsis

Simplifies expressions involving boolean equality.

Description

The conversion bool_EQ_CONV simplifies equations of the form "t1 = t2", where t1 and t2 are of type :bool. When applied to a term of the form "t = t", the conversion 58 Chapter 1. Pre-defined ML Identifiers

bool_EQ_CONV returns the theorem

   |- (t = t) = T

When applied to a term of the form "t = T", the conversion returns

   |- (t = T) = t

And when applied to a term of the form "T = t", it returns

   |- (T = t) = t

Failure

Fails unless applied to a term of the form "t1 = t2", where t1 and t2 are boolean, and either t1 and t2 are syntactically identical terms or one of t1 and t2 is the constant "T".

Example

#bool_EQ_CONV "T = F";;
|- (T = F) = F
#bool_EQ_CONV "(0 < n) = T";;
|- (0 < n = T) = 0 < n

 bool_ty
bool_ty : type

Synopsis

Holds the logical type ":bool".

 BUTFIRSTN_CONV
BUTFIRSTN_CONV : conv

Synopsis

Computes by inference the result of dropping the initial n elements of a list.

\underline{butlast 59}

Description

For any object language list of the form "[x0;...x(n-k);...;x(n-1)]" , the result of evaluating

   BUTFIRSTN_CONV "BUTFIRSTN k [x0;...x(n-k);...;x(n-1)]"

is the theorem

   |- BUTFIRSTN k [x0;...;x(n-k);...;x(n-1)] = [x(n-k);...;x(n-1)]

Failure

BUTFIRSTN_CONV tm fails if tm is not of the form described above, or k is greater than the length of the list.

 butlast

butlast : (* list -> * list)

Synopsis

Computes the sub-list of a list consisting of all but the last element.

Description

butlast [x1;...;xn] returns [x1;...;x(n-1)].

Failure

Fails if the list is empty.

See also

last, hd, tl, el, null.

 BUTLASTN_CONV

BUTLASTN_CONV : conv

Synopsis

Computes by inference the result of dropping the last n elements of a list.

Description

For any object language list of the form "[x0;...x(n-k);...;x(n-1)]" , the result of evaluating

   BUTLASTN_CONV "BUTLASTN k [x0;...x(n-k);...;x(n-1)]"

is the theorem

   |- BUTLASTN k [x0;...;x(n-k);...;x(n-1)] = [x0;...;x(n-k-1)]

Failure

BUTLASTN_CONV tm fails if tm is not of the form described above, or k is greater than the length of the list.

 BUTLAST_CONV

BUTLAST_CONV : conv

Synopsis

Computes by inference the result of stripping the last element of a list.

Description

For any object language list of the form "[x0;...x(n-1)]" , the result of evaluating

   BUTLAST_CONV "BUTLAST [x0;...;x(n-1)]"

is the theorem

   |- BUTLAST [x0;...;x(n-1)] = [x0;...; x(n-2)]

Failure

BUTLAST_CONV tm fails if tm is an empty list.

 C

C : ((* -> ** -> ***) -> ** -> * -> ***)

Synopsis

Permutes first two arguments to curried function: C f x y = f y x.

Failure

Never fails.

See also

#, B, CB, Co, I, K, KI, o, oo, S, W.

 cached_theories

cached_theories : (void -> (string # bool) list)

Synopsis

Gives a list of cached and uncached theories.

Description

A call cached_theories() returns a list pairs, one for each loaded theory, associating the name of the theory with either true, indicating that a theory has been removed from the cache by delete_cache, or false otherwise. For more details of the cacheing mechanism, see the DESCRIPTION.

Failure

Never fails.

See also

delete_cache.

 can

can : ((* -> **) -> * -> bool)

Synopsis

Tests for failure.

Description

can f x evaluates to true if the application of f to x succeeds. It evaluates to false if the application fails.

Failure

Never fails.

Example

#hd [];;
evaluation failed     hd
#can hd [];;
false : bool

See also

assert.

 CASES_THENL

CASES_THENL : (thm_tactic list -> thm_tactic)

Synopsis

Applies the theorem-tactics in a list to corresponding disjuncts in a theorem.

Description

When given a list of theorem-tactics [ttac1;...;ttacn] and a theorem whose conclusion is a top-level disjunction of n terms, CASES_THENL splits a goal into n subgoals resulting from applying to the original goal the result of applying the i’th theorem-tactic to the i’th disjunct. This can be represented as follows, where the number of existentially quantified variables in a disjunct may be zero. If the theorem th has the form:

   A' |- ?x11..x1m. t1 \/ ... \/ ?xn1..xnp. tn

where the number of existential quantifiers may be zero, and for all i from 1 to n:

     A ?- s
   ========== ttaci (|- ti[xi1'/xi1]..[xim'/xim])
    Ai ?- si

where the primed variables have the same type as their unprimed counterparts, then:

             A ?- s
   =========================  CASES_THENL [ttac1;...;ttacn] th
    A1 ?- s1  ...  An ?- sn

Unless A' is a subset of A, this is an invalid tactic.

\underline{CB 63}

Failure

Fails if the given theorem does not, at the top level, have the same number of (possibly multiply existentially quantified) disjuncts as the length of the theorem-tactic list (this includes the case where the theorem-tactic list is empty), or if any of the tactics generated as specified above fail when applied to the goal.

Uses

Performing very general disjunctive case splits.

See also

DISJ_CASES_THENL, X_CASES_THENL.
 CB
$CB : ((* -> **) -> (** -> ***) -> * -> ***)

Synopsis

Composes two functions: (f CB g) x = g (f x).

Failure

Never fails.

See also

#, B, C, Co, I, K, KI, o, oo, S, W.
 CCONTR
CCONTR : (term -> thm -> thm)

Synopsis

Implements the classical contradiction rule.

Description

When applied to a term t and a theorem A |- F, the inference rule CCONTR returns the

theorem A - {~t} |- t.
       A |- F
   ---------------  CCONTR "t"
    A - {~t} |- t

Failure

Fails unless the term has type bool and the theorem has F as its conclusion.

Comments

The usual use will be when ~t exists in the assumption list; in this case, CCONTR corresponds to the classical contradiction rule: if ~t leads to a contradiction, then t must be true.

See also

CONTR, CONTRAPOS, CONTR_TAC, NOT_ELIM.

 CHANGED_CONV

CHANGED_CONV : (conv -> conv)

Synopsis

Makes a conversion fail if applying it leaves a term unchanged.

Description

If c is a conversion that maps a term "t" to a theorem |- t = t', where t' is alphaequivalent to t, then CHANGED_CONV c is a conversion that fails when applied to the term "t". If c maps "t" to |- t = t', where t' is not alpha-equivalent to t, then

CHANGED_CONV c also maps "t" to |- t = t'. That is, CHANGED_CONV c is the conversion

that behaves exactly like c, except that it fails whenever the conversion c would leave its input term unchanged (up to alpha-equivalence).

Failure

CHANGED_CONV c "t" fails if c maps "t" to |- t = t', where t' is alpha-equivalent to t, or if c fails when applied to "t". The function returned by CHANGED_CONV c may also fail if the ML function c:term->thm is not, in fact, a conversion (i.e. a function that maps a term t to a theorem |- t = t').

Uses

CHANGED_CONV is used to transform a conversion that may leave terms unchanged, and therefore may cause a nonterminating computation if repeated, into one that can safely be repeated until application of it fails to substantially modify its input term.

 CHANGED_TAC

CHANGED_TAC : (tactic -> tactic)

Synopsis

Makes a tactic fail if it has no effect.

Description

When applied to a tactic T, the tactical CHANGED_TAC gives a new tactic which is the same as T if that has any effect, and otherwise fails.

Failure

The application of CHANGED_TAC to a tactic never fails. The resulting tactic fails if the basic tactic either fails or has no effect.

See also

TRY, VALID.

 change_state

change_state : (goalstack -> void)

Synopsis

This function is for internal use only and is to be deleted from a future version of the system. It should not be used.

 CHECK_ASSUME_TAC

CHECK_ASSUME_TAC : thm_tactic

Synopsis

Adds a theorem to the assumption list of goal, unless it solves the goal.

Description

When applied to a theorem A' |- s and a goal A ?- t, the tactic CHECK_ASSUME_TAC checks whether the theorem will solve the goal (this includes the possibility that the theorem is just A' |- F). If so, the goal is duly solved. If not, the theorem is added to the assumptions of the goal, unless it is already there.

       A ?- t
   ==============  CHECK_ASSUME_TAC (A' |- F)   [special case 1]

       A ?- t
   ==============  CHECK_ASSUME_TAC (A' |- t)   [special case 2]

       A ?- t
   ==============  CHECK_ASSUME_TAC (A' |- s)   [general case]
    A u {s} ?- t

Unless A' is a subset of A, the tactic will be invalid, although it will not fail.

Failure

Never fails.

See also

ACCEPT_TAC, ASSUME_TAC, CONTR_TAC, DISCARD_TAC, MATCH_ACCEPT_TAC.

 check_lhs

check_lhs : (term -> term list)

Synopsis

This function is for internal use only and is to be deleted from a future version of the system. It should not be used.

 check_specification

check_specification : (* -> (string # string) list -> thm -> goal)

Synopsis

This function is for internal use only and is to be deleted from a future version of the system. It should not be used.

 check_valid

check_valid : (goal -> subgoals -> bool)

Synopsis

Checks whether a prospective proof is valid.

Description

check_valid (A,t) ([A1,t1;...;An,tn],prf) checks whether the applying the proof prf

to the list of theorems [(A1 |- t1);...;(An |- tn)] would produce a theorem alphaequivalent to A |- t. This check is done by creating this list of theorems using chktac and then applying the proof prf.

Failure

Never fails, unless the proof prf fails or the assignable variable chktac has been rebound to a function that fails.

See also

chktac, VALID.

 check_varstruct

check_varstruct : (term -> term list)

Synopsis

This function is for internal use only and is to be deleted from a future version of the system. It should not be used.

 chktac

chktac : (subgoals -> thm)

Synopsis

Applies a proof to a list of theorems created using mk_thm.

Description

Evaluating chktac ([A1,t1;...;An,tn],prf) applies the proof prf to the list of theorems [(A1 |- t1);...;(An |- tn)]. The list is created by mapping mk_thm down the supplied list of subgoals.

chktac is, in fact, an assignable variable in ML, bound when the system is built to a function that uses mk_thm Its presence therefore introduces a potential insecurity into the system. But the function chktac is used only by check_valid to check the validity of tactics, and users worried about security can therefore eliminate this insecurity by doing:

   chktak := \(gl,prf). fail

This will disable the validity checking of tactics (using VALID), but will remove the insecurity.

Failure

Never fails (unless the proof prf fails).

See also

check_valid, VALID.

 CHOOSE

CHOOSE : ((term # thm) -> thm -> thm)

Synopsis

Eliminates existential quantification using deduction from a particular witness.

Description

When applied to a term-theorem pair (v,A1 |- ?x. s) and a second theorem of the form A2 u {s[v/x]} |- t, the inference rule CHOOSE produces the theorem A1 u A2 |- t.

    A1 |- ?x. s[x]    A2 u {s[v/x]} |- t
   ---------------------------------------  CHOOSE ("v",(A1 |- ?x. s))
                A1 u A2 |- t

Where v is not free in A2 or t.

Failure

Fails unless the terms and theorems correspond as indicated above; in particular, 1) v must be a variable and have the same type as the variable existentially quantified over, and it must not be free in A2 or t; 2) the second theorem must have s[v/x] in its assumptions.

See also

CHOOSE_TAC, EXISTS, EXISTS_TAC, SELECT_ELIM.

 CHOOSE_TAC

CHOOSE_TAC : thm_tactic

Synopsis

Adds the body of an existentially quantified theorem to the assumptions of a goal.

Description

When applied to a theorem A' |- ?x. t and a goal, CHOOSE_TAC adds t[x'/x] to the assumptions of the goal, where x' is a variant of x which is not free in the assumption list; normally x' is just x.

         A ?- u
   ====================  CHOOSE_TAC (A' |- ?x. t)
    A u {t[x'/x]} ?- u

Unless A' is a subset of A, this is not a valid tactic.

Failure

Fails unless the given theorem is existentially quantified.

Example

Suppose we have a goal asserting that the output of an electrical circuit (represented as a boolean-valued function) will become high at some time:

   ?- ?t. output(t)

and we have the following theorems available:

   t1 = |- ?t. input(t)
   t2 = !t. input(t) ==> output(t+1)

Then the goal can be solved by the application of:

   CHOOSE_TAC t1 THEN EXISTS_TAC "t+1" THEN
     UNDISCH_TAC "input (t:num) :bool" THEN MATCH_ACCEPT_TAC t2

See also

CHOOSE_THEN, X_CHOOSE_TAC.

 CHOOSE_THEN

CHOOSE_THEN : thm_tactical

Synopsis

Applies a tactic generated from the body of existentially quantified theorem.

Description

When applied to a theorem-tactic ttac, an existentially quantified theorem A' |- ?x. t, and a goal, CHOOSE_THEN applies the tactic ttac (t[x'/x] |- t[x'/x]) to the goal, where x' is a variant of x chosen not to be free in the assumption list of the goal. Thus if:

    A ?- s1
   =========  ttac (t[x'/x] |- t[x'/x])
    B ?- s2

then

    A ?- s1
   ==========  CHOOSE_THEN ttac (A' |- ?x. t)
    B ?- s2

This is invalid unless A' is a subset of A.

Failure

Fails unless the given theorem is existentially quantified, or if the resulting tactic fails when applied to the goal.

Example

This theorem-tactical and its relatives are very useful for using existentially quantified theorems. For example one might use the inbuilt theorem

   LESS_ADD_1 = |- !m n. n < m ==> (?p. m = n + (p + 1))

to help solve the goal

   ?- x < y ==> 0 < y * y

by starting with the following tactic

   DISCH_THEN (CHOOSE_THEN SUBST1_TAC o MATCH_MP LESS_ADD_1)

which reduces the goal to

   ?- 0 < ((x + (p + 1)) * (x + (p + 1)))

which can then be finished off quite easily, by, for example:

   REWRITE_TAC[ADD_ASSOC; SYM (SPEC_ALL ADD1);
               MULT_CLAUSES; ADD_CLAUSES; LESS_0]

See also

CHOOSE_TAC, X_CHOOSE_THEN.

 chop_list

chop_list : (int -> * list -> (* list # * list))

Synopsis

Chops a list into two parts at a specified point.

Description

chop_list i [x1;...;xn] returns ([x1;...;xi],[x(i+1);...;xn]).

Failure

Fails with chop_list if i is negative or greater than the length of the list.

Example

#chop_list 3 [1;2;3;4;5];;
([1; 2; 3], [4; 5]) : (int list # int list)

See also

partition.

 close

close : (string -> void)

Synopsis

Closes an ML port.

Description

The function close closes a port that had been opened for reading (by openi) or writing (by openw or append_openw). Ports are represented by the strings that are returned by

one of the functions append-openw, openi and openw.

Failure

Fails when the named port is not open.

Example

#openw `foo`;;
`%foo` : string
#close it;;
() : void

See also

append_openw, openi, openw, read, write

 close_theory

close_theory : (void -> void)

\underline{Co 73}

Synopsis

Finishes a session in draft mode, writing changes to the theory file.

Description

Executing close_theory() finishes a session in draft mode. It switches the system to proof mode. Changes made to the current theory segment are written to the theory file associated with it. For a theory segment named `thy`, the associated file will be thy.th in the directory from which HOL was called. If the theory file does not exist, it will be created. If HOL is quitted before close_theory is invoked, the additions made to the segment may not persist to future HOL sessions. Whilst in proof mode, the only changes which may be made to the theory are the addition of theorems. The theory segment may later be extended with extend_theory.

Failure

A call to close_theory will fail if the system is not in draft mode. Since it involves writing to the file system, if the write fails for any reason close_theory will fail.

See also

extend_theory, new_theory, print_theory.

 Co

$Co : (((* -> ** -> ***) # (**** -> *)) -> ** -> **** -> ***)

Synopsis

Performs permuted function composition: (f Co g) x y = f (g y) x.

Failure

Never fails.

See also

#, B, C, CB, I, K, KI, o, oo, S, W.

 com

$com : ((* list # ** list) -> (* # **) list)

74 Chapter 1. Pre-defined ML Identifiers

Synopsis

Converts a pair of lists into a list of pairs (infix version).

Description

[x1;...;xn] com [y1;...;yn] returns [(x1,y1);...;(xn,yn)].

Failure

Fails if the two lists are of different lengths.

Comments

Has the same effect as combine.

See also

combine, split.
 combine
combine : ((* list # ** list) -> (* # **) list)

Synopsis

Converts a pair of lists into a list of pairs.

Description

combine ([x1;...;xn],[y1;...;yn]) returns [(x1,y1);...;(xn,yn)].

Failure

Fails if the two lists are of different lengths.

Comments

Has the same effect as com.

See also

com, split.
 compile
compile : ((string # bool) -> void)

\underline{compile 75}

Synopsis

Compiles the named ML source file.

Description

Given a pair (`name`,flag), compile loads the named file and then compiles it into LISP, generating a file name_ml.l. It then calls the LISP compiler to create an object file name_ml.o. The intermediate LISP file is automatically deleted once the name_ml.o file has been generated. If flag is true, a verbose account of the compilation is generated, if flag is false, compilation is silent.

Failure

Fails if the named ML source file does not exist, or if the load is unsuccessful. In the latter case, the intermediate name_ml.l file is left undeleted.

Example

To compile two files a.ml and b.ml, where b.ml depends on definitions made in a.ml, one can type:

   #compile (`a`,true);;
   #compile (`b`,true);;

Suppose one exists the HOL session and attempts to load the files in a new session:

   #load(`a`,false);;
   [fasl a_ml.o]
   #load(`b`,false);;
   [fasl b_ml.o]

Note that load always loads an object file if one exists, regardless of its creation date. Loading a_ml.o sets up the static bindings necessary for b_ml.o to run. File b.ml may be edited without recompilation of a.ml, however, if a.ml is edited and recompiled, then b.ml has to be recompiled before being used. Consequently, if the ML code built into the system is recompiled, users have to recompile all their programs.

Comments

Compiled ML runs faster than interpreted ML, and loads almost instantaneously.

There is a potential problem with compiling code that mentions the names of theorems set up to be autoloaded. Suppose a file f.ml is to be compiled and contains the following code:

   let f x = SPEC x num_CASES;;

where num_CASES is a built-in theorem which is set up to be autoloaded on demand. If, in a given session, the theorem num_CASES has already been autoloaded before the file f.ml is compiled, then the resulting object code will not itself autoload this theorem; it will just evaluate a compiled version of the identifier num_CASES when the function f is called. In particular, an unbound identifier error will occur if the compiled file f_ml.o is loaded in a separate session and the function f is then called.

To get around this problem, one should rewrite functions that refer to autoloaded values so that they explicitly fetch the required theorems from disk. In general, one must arrange for code to be compiled not to invoke any autoloading action. For the example shown above, this could be done by defining the function f as follows.

   let f =
       let thm = theorem `arithmetic` `num_CASES` in
       \x. SPEC x thm;;

Note that thm in this definition is not the name of any automatically autoloaded theorem. Note also that it would be most undesirable to define f by:

   let f x =
       let thm = theorem `arithmetic` `num_CASES` in
       SPEC x thm;;

With this definition, function f fetches num_CASES off disk each time it is called, rather than just once when it is defined.

See also

compilef, compilet, load, loadf, loadt.

 compilef

compilef : (string -> void)

Synopsis

Compiles an ML source file ‘silently’.

Description

Given a string `name`, compile loads the named file, and then compiles it into LISP generating a file name_ml.l. It then calls the LISP compiler to create an object file name_ml.o. The intermediate LISP file is automatically deleted once the name_ml.o file has been generated. Loading and compilation are silent.

Failure

Fails if the named ML source file does not exist, or if the load is unsuccessful. In the latter case, the intermediate name_ml.l file is left undeleted.

Comments

The function call compilef `foo` is the same as compile (`foo`,false).

See also

compile, compilet, load, loadf, loadt

 compilet

compilet : (string -> void)

Synopsis

Compiles the named ML source file with verbose messages.

Description

Given a string `name`, compile loads the named file, and then compiles it into LISP generating a file name_ml.l. It then calls the LISP compiler to create an object file name_ml.o. The intermediate LISP file is automatically deleted once the name_ml.o file has been generated. Loading and compilation are verbose.

Failure

Fails if the named ML source file does not exist, or if the load is unsuccessful. In the latter case, the intermediate name_ml.l file is left undeleted.

Comments

The function call compilet `foo` is the same as compile (`foo`,true).

See also

compile, compilet, load, loadf, loadt

 compiling

compiling : bool

Synopsis

Assignable variable: true when compiling, false when loading.

Description

The identifier compiling is an assignable ML variable of type bool which used to indicate whether the expressions currently being evaluated by ML are being compiled or loaded. At the start of the evaluation of a call to compile or its variants, the variable compiling is set to true; and at the start of the evaluation of a call to load or its variants, compiling is set to false. In both cases, the previous value of compiling is restored at the end of evaluation. The initial value of compiling when HOL is run is false.

Failure

Evaluation of the variable compiling never fails.

Uses

The main function of compiling is to provide a mechanism by which expressions may be conditionally evaluated, depending on whether they are being compiled or not. In particular, the main purpose of compiling is to allow conditional loading of files in ML. For example, suppose that the line

   if compiling then load(`foo`,false);;

appears at the start of an ML file bar.ml. Then whenever the file bar.ml is compiled, the file foo.ml will be loaded. But whenever the file bar.ml is merely loaded (whether in compiled form or not) the file bar.ml will not be loaded.

See also

compiling_stack.

 compiling_stack

compiling_stack : bool list

Synopsis

Keeps track of the value of the assignable variable compiling.

Description

The identifier compiling_stack is an assignable ML variable of type bool list which used internally by the system to keep track of the value of the assignable variable compiling \underline{concat 79} during nested calls to compile and load (and their variants). The compiling_stack is not intended for general use, and no value should be assigned by users to this variable.

Failure

Evaluation of the variable compiling_stack never fails.

See also

compiling.
 concat
concat : (string -> string -> string)

Synopsis

Concatenates two ML strings.

Failure

Never fails.

Example

#concat `1` ``;;
`1` : string
#concat `hello` `world`;;
`helloworld` : string
#concat `hello` (concat ` ` `world`);;
`hello world` : string

See also

concatl, ^.
 concatl
concatl : (string list -> string)

80 Chapter 1. Pre-defined ML Identifiers

Synopsis

Concatenates a list of ML strings.

Failure

Never fails.

Example

#concatl [];;
`` : string
#concatl [`hello`;`world`];;
`helloworld` : string
#concatl [`hello`;` `;`world`];;
`hello world` : string

See also

concat, ^.
 concl
concl : (thm -> term)

Synopsis

Returns the conclusion of a theorem.

Description

When applied to a theorem A |- t, the function concl returns t.

Failure

Never fails.

See also

dest_thm, hyp.
 COND_CASES_TAC
COND_CASES_TAC : tactic

Synopsis

Induces a case split on a conditional expression in the goal.

Description

COND_CASES_TAC searches for a conditional sub-term in the term of a goal, i.e. a sub-term of the form p=>u|v, choosing one by its own criteria if there is more than one. It then induces a case split over p as follows:

                             A ?- t
    =======================================================  COND_CASES_TAC
     A u {p} ?- t[u/(p=>u|v)]   A u {~p} ?- t[v/(p=>u|v)]]

where p is not a constant, and the term p=>u|v is free in t. Note that it both enriches the assumptions and inserts the assumed value into the conditional.

Failure

COND_CASES_TAC fails if there is no conditional sub-term as described above.

Example

For "x", "y", "z1" and "z2" of type ":*", and "P:*->bool",
   COND_CASES_TAC ([], "x = (P y => z1 | z2)");;
   ([(["P y"], "x = z1"); (["~P y"], "x = z2")], -) : subgoals

but it fails, for example, if "y" is not free in the term part of the goal:

   COND_CASES_TAC ([], "!y. x = (P y => z1 | z2)");;
   evaluation failed     COND_CASES_TAC

In contrast, ASM_CASES_TAC does not perform the replacement:

   ASM_CASES_TAC "P y" ([], "x = (P y => z1 | z2)");;
   ([(["P y"], "x = (P y => z1 | z2)"); (["~P y"], "x = (P y => z1 | z2)")],
    -)
   : subgoals

Uses

Useful for case analysis and replacement in one step, when there is a conditional subterm in the term part of the goal. When there is more than one such sub-term and one in particular is to be analyzed, COND_CASES_TAC cannot be depended on to choose the ‘desired’ one. It can, however, be used repeatedly to analyze all conditional sub-terms of a goal.

See also

ASM_CASES_TAC, DISJ_CASES_TAC, STRUCT_CASES_TAC.

 COND_CONV

COND_CONV : conv

Synopsis

Simplifies conditional terms.

Description

The conversion COND_CONV simplifies a conditional term "c => u | v" if the condition c is either the constant T or the constant F or if the two terms u and v are equivalent up to alpha-conversion. The theorems returned in these three cases have the forms:

   |- (T => u | v) = u
   |- (F => u | v) = u
   |- (c => u | u) = u

Failure

COND_CONV tm fails if tm is not a conditional "c => u | v", where c is T or F, or u and v are alpha-equivalent.

 CONJ

CONJ : (thm -> thm -> thm)

Synopsis

Introduces a conjunction.

Description

    A1 |- t1      A2 |- t2
   ------------------------  CONJ
     A1 u A2 |- t1 /\ t2

See also

BODY_CONJUNCTS, CONJUNCT1, CONJUNCT2, CONJ_PAIR, LIST_CONJ, CONJ_LIST,
CONJUNCTS.

 CONJUNCT1

CONJUNCT1 : (thm -> thm)

Synopsis

Extracts left conjunct of theorem.

Description

    A |- t1 /\ t2
   ---------------  CONJUNCT1
       A |- t1

Failure

Fails unless the input theorem is a conjunction.

See also

BODY_CONJUNCTS, CONJUNCT2, CONJ_PAIR, CONJ, LIST_CONJ, CONJ_LIST, CONJUNCTS.

 CONJUNCT2

CONJUNCT2 : (thm -> thm)

Synopsis

Extracts right conjunct of theorem.

Description

    A |- t1 /\ t2
   ---------------  CONJUNCT2
       A |- t2

Failure

Fails unless the input theorem is a conjunction.

See also

BODY_CONJUNCTS, CONJUNCT1, CONJ_PAIR, CONJ, LIST_CONJ, CONJ_LIST, CONJUNCTS.

 CONJUNCTS

CONJUNCTS : (thm -> thm list)

Synopsis

Recursively splits conjunctions into a list of conjuncts.

Description

Flattens out all conjuncts, regardless of grouping. Returns a singleton list if the input theorem is not a conjunction.

       A |- t1 /\ t2 /\ ... /\ tn
   -----------------------------------  CONJUNCTS
    A |- t1   A |- t2   ...   A |- tn

Failure

Never fails.

Example

Suppose the identifier th is bound to the theorem:

   A |- (x /\ y) /\ z /\ w

Application of CONJUNCTS to th returns the following list of theorems:

   [A |- x; A |- y; A |- z; A |- w] : thm list

See also

BODY_CONJUNCTS, CONJ_LIST, LIST_CONJ, CONJ, CONJUNCT1, CONJUNCT2, CONJ_PAIR.

 conjuncts

conjuncts : (term -> term list)

Synopsis

Iteratively splits conjunctions into a list of conjuncts.

Description

conjuncts "t1 /\ ... /\ tn" returns ["t1";...;"tn"]. The argument term may be any

tree of conjunctions. It need not have the form "t1 /\ (t2 /\ ( ... /\ tn)...)". A term that is not a conjunction is simply returned as the sole element of a list. Note that

   conjuncts(list_mk_conj(["t1";...;"tn"]))

will not return ["t1";...;"tn"] if any of t1,...,tn are conjunctions.

Failure

Never fails.

Example

#list_mk_conj ["a /\ b";"c /\ d";"e /\ f"];;
"(a /\ b) /\ (c /\ d) /\ e /\ f" : term
#conjuncts it;;
["a"; "b"; "c"; "d"; "e"; "f"] : term list
#list_mk_conj it;;
"a /\ b /\ c /\ d /\ e /\ f" : term
#conjuncts "1";;
["1"] : term list

Comments

Because conjuncts splits both the left and right sides of a conjunction, this operation is not the inverse of list_mk_conj. It may be useful to introduce list_dest_conj for splitting only the right tails of a conjunction.

See also

list_mk_conj, dest_conj.

 CONJUNCTS_CONV

CONJUNCTS_CONV : ((term # term) -> thm)

Synopsis

Prove equivalence under idempotence, symmetry and associativity of conjunction.

Description

CONJUNCTS_CONV takes a pair of terms "t1" and "t2", and proves |- t1 = t2 if t1 and t2 are equivalent up to idempotence, symmetry and associativity of conjunction. That is, if t1 and t2 are two (different) arbitrarily-nested conjunctions of the same set of terms, then CONJUNCTS_CONV (t1,t2) returns |- t1 = t2. Otherwise, it fails.

Failure

Fails if t1 and t2 are not equivalent, as described above.

Example

#CONJUNCTS_CONV ("(P /\ Q) /\ R", "R /\ (Q /\ R) /\ P");;
|- (P /\ Q) /\ R = R /\ (Q /\ R) /\ P

Uses

Used to reorder a conjunction. First sort the conjuncts in a term t1 into the desired order (e.g. lexicographic order, for normalization) to get a new term t2, then call

CONJUNCTS_CONV(t1,t2).

Comments

This is not a true conversion, so perhaps it ought to be called something else.

See also

CONJ_SET_CONV.

 CONJUNCTS_THEN

CONJUNCTS_THEN : thm_tactical

Synopsis

Applies a theorem-tactic to each conjunct of a theorem.

Description

CONJUNCTS_THEN takes a theorem-tactic f, and a theorem t whose conclusion must be a conjunction. CONJUNCTS_THEN breaks t into two new theorems, t1 and t2 which are CONJUNCT1 and CONJUNCT2 of t respectively, and then returns a new tactic: f t1 THEN f t2. That is,

CONJUNCTS_THEN f (A |- l /\ r) =  f (A |- l) THEN f (A |- r)

so if

A1 ?- t1                    A2 ?- t2
==========  f (A |- l)      ==========  f (A |- r)
A2 ?- t2                    A3 ?- t3

then

 A1 ?- t1
==========  CONJUNCTS_THEN f (A |- l /\ r)
 A3 ?- t3

Failure

CONJUNCTS_THEN f will fail if applied to a theorem whose conclusion is not a conjunction.

Comments

CONJUNCTS_THEN f (A |- u1 /\ ... /\ un) results in the tactic:
f (A |- u1) THEN f (A |- u2 /\ ... /\ un)

Unfortunately, it is more likely that the user had wanted the tactic:

f (A |- u1) THEN ... THEN f(A |- un)

Such a tactic could be defined as follows:

let CONJUNCTS_THENL (f:thm_tactic) thm =
      itlist $THEN (map f (CONJUNCTS thm)) ALL_TAC;;
or by using REPEAT_TCL.

See also

CONJUNCT1, CONJUNCT2, CONJUNCTS, CONJUNCTS_TAC, CONJUNCTS_THEN2,
STRIP_THM_THEN.

CONJUNCTS_THEN2

CONJUNCTS_THEN2 : (thm_tactic -> thm_tactic -> thm_tactic)

Synopsis

Applies two theorem-tactics to the corresponding conjuncts of a theorem.

Description

CONJUNCTS_THEN2 takes two theorem-tactics, f1 and f2, and a theorem t whose conclusion must be a conjunction. CONJUNCTS_THEN2 breaks t into two new theorems, t1 and t2 which are CONJUNCT1 and CONJUNCT2 of t respectively, and then returns the tactic

f1 t1 THEN f2 t2. Thus
   CONJUNCTS_THEN2 f1 f2 (A |- l /\ r) =  f1 (A |- l) THEN f2 (A |- r)

so if

   A1 ?- t1                     A2 ?- t2
  ==========  f1 (A |- l)      ==========  f2 (A |- r)
   A2 ?- t2                     A3 ?- t3

then

    A1 ?- t1
   ==========  CONJUNCTS_THEN2 f1 f2 (A |- l /\ r)
    A3 ?- t3

Failure

CONJUNCTS_THEN f will fail if applied to a theorem whose conclusion is not a conjunction.

Comments

The system shows the type as (thm_tactic -> thm_tactical).

Uses

The construction of complex tacticals like CONJUNCTS_THEN.

See also

CONJUNCT1, CONJUNCT2, CONJUNCTS, CONJUNCTS_TAC, CONJUNCTS_THEN2,
STRIP_THM_THEN.

 CONJ_DISCH

CONJ_DISCH : (term -> thm -> thm)

Synopsis

Discharges an assumption and conjoins it to both sides of an equation.

Description

Given an term t and a theorem A |- t1 = t2, which is an equation between boolean

terms, CONJ_DISCH returns A - {t} |- (t /\ t1) = (t /\ t2), i.e. conjoins t to both

sides of the equation, removing t from the assumptions if it was there.

            A |- t1 = t2
   ------------------------------  CONJ_DISCH "t"
    A - {t} |- t /\ t1 = t /\ t2

Failure

Fails unless the theorem is an equation, both sides of which, and the term provided are of type bool.

See also

CONJ_DISCHL.

 CONJ_DISCHL

CONJ_DISCHL : (term list -> thm -> thm)

Synopsis

Conjoins multiple assumptions to both sides of an equation.

Description

Given a term list [t1;...;tn] and a theorem whose conclusion is an equation between boolean terms, CONJ_DISCHL conjoins all the terms in the list to both sides of the equation, and removes any of the terms which were in the assumption list.

                        A |- s = t
   --------------------------------------------------------  CONJ_DISCHL
    A - {t1,...,tn} |- (t1/\.../\tn/\s) = (t1/\.../\tn/\t)     ["t1";...;"tn"]

Failure

Fails unless the theorem is an equation, both sides of which, and all the terms provided, are of type bool.

See also

CONJ_DISCH.

 CONJ_LIST

CONJ_LIST : (int -> thm -> thm list)

Synopsis

Extracts a list of conjuncts from a theorem (non-flattening version).

Description

CONJ_LIST is the proper inverse of LIST_CONJ. Unlike CONJUNCTS which recursively splits as many conjunctions as possible both to the left and to the right, CONJ_LIST splits the top-level conjunction and then splits (recursively) only the right conjunct. The integer argument is required because the term tn may itself be a conjunction. A list of n theorems is returned.

    A |- t1 /\ (t2 /\ ( ... /\ tn)...)
   ------------------------------------  CONJ_LIST n (A |- t1 /\ ... /\ tn)
    A |- t1   A |- t2   ...   A |- tn

Failure

Fails if the integer argument (n) is less than one, or if the input theorem has less than n conjuncts.

Example

Suppose the identifier th is bound to the theorem:

A |- (x /\ y) /\ z /\ w

Here are some applications of CONJ_LIST to th:

#CONJ_LIST 0 th;;
evaluation failed     CONJ_LIST
#CONJ_LIST 1 th;;
[A |- (x /\ y) /\ z /\ w] : thm list
#CONJ_LIST 2 th;;
[A |- x /\ y; A |- z /\ w] : thm list
#CONJ_LIST 3 th;;
[A |- x /\ y; A |- z; A |- w] : thm list
#CONJ_LIST 4 th;;
evaluation failed     CONJ_LIST

See also

BODY_CONJUNCTS, LIST_CONJ, CONJUNCTS, CONJ, CONJUNCT1, CONJUNCT2, CONJ_PAIR.

CONJ_PAIR

CONJ_PAIR : (thm -> (thm # thm))

Synopsis

Extracts both conjuncts of a conjunction.

Description

    A |- t1 /\ t2
----------------------  CONJ_PAIR
 A |- t1      A |- t2

The two resultant theorems are returned as a pair.

Failure

Fails if the input theorem is not a conjunction.

See also

BODY_CONJUNCTS, CONJUNCT1, CONJUNCT2, CONJ, LIST_CONJ, CONJ_LIST, CONJUNCTS.

 CONJ_SET_CONV

CONJ_SET_CONV : (term list -> term list -> thm)

Synopsis

Proves the equivalence of the conjunctions of two equal sets of terms.

Description

The arguments to CONJ_SET_CONV are two lists of terms [t1;...;tn] and [u1;...;um]. If these are equal when considered as sets, that is if the sets

   {t1,...,tn} and {u1,...,um}

are equal, then CONJ_SET_CONV returns the theorem:

   |- (t1 /\ ... /\ tn) = (u1 /\ ... /\ um)

Otherwise CONJ_SET_CONV fails.

Failure

CONJ_SET_CONV [t1;...;tn] [u1;...;um] fails if [t1,...,tn] and [u1,...,um], regarded

as sets of terms, are not equal. Also fails if any ti or ui does not have type bool.

Uses

Used to order conjuncts. First sort a list of conjuncts l1 into the desired order to get a

new list l2, then call CONJ_SET_CONV l1 l2.

Comments

This is not a true conversion, so perhaps it ought to be called something else.

See also

CONJUNCTS_CONV.

 CONJ_TAC

CONJ_TAC : tactic

Synopsis

Reduces a conjunctive goal to two separate subgoals.

Description

When applied to a goal A ?- t1 /\ t2, the tactic CONJ_TAC reduces it to the two subgoals corresponding to each conjunct separately.

       A ?- t1 /\ t2
   ======================  CONJ_TAC
    A ?- t1      A ?- t2

Failure

Fails unless the conclusion of the goal is a conjunction.

See also

STRIP_TAC.

 constants

constants : (string -> term list)

Synopsis

Returns a list of the constants defined in a named theory.

Description

The call

   constants `thy`

where thy is an ancestor theory (the special string `-` means the current theory), returns a list of all the constants in that theory.

Failure

Fails if the named theory does not exist, or is not an ancestor of the current theory.

Example

#constants `combin`;;
["I"; "S"; "K"; "$o"] : term list

See also

axioms, binders, definitions, infixes, theorems

 CONTR

CONTR : (term -> thm -> thm)

Synopsis

Implements the intuitionistic contradiction rule.

Description

When applied to a term t and a theorem A |- F, the inference rule CONTR returns the theorem A |- t.

    A |- F
   --------  CONTR "t"
    A |- t

Failure

Fails unless the term has type bool and the theorem has F as its conclusion.

See also

CCONTR, CONTRAPOS, CONTR_TAC, NOT_ELIM.

 CONTRAPOS

CONTRAPOS : (thm -> thm)

Synopsis

Deduces the contrapositive of an implication.

Description

When applied to a theorem A |- s ==> t, the inference rule CONTRAPOS returns its contrapositive, A |- ~t ==> ~s.

     A |- s ==> t
   ----------------  CONTRAPOS
    A |- ~t ==> ~s

Failure

Fails unless the theorem is an implication.

See also

CCONTR, CONTR, CONTRAPOS_CONV, NOT_ELIM.

 CONTRAPOS_CONV
CONTRAPOS_CONV : conv

Synopsis

Proves the equivalence of an implication and its contrapositive.

Description

When applied to an implication P ==> Q, the conversion CONTRAPOS_CONV returns the theorem:

   |- (P ==> Q) = (~Q ==> ~P)

Failure

Fails if applied to a term that is not an implication.

See also

CONTRAPOS.

 CONTR_TAC

CONTR_TAC : thm_tactic

Synopsis

Solves any goal from contradictory theorem.

Description

When applied to a contradictory theorem A' |- F, and a goal A ?- t, the tactic CONTR_TAC completely solves the goal. This is an invalid tactic unless A' is a subset of A.

    A ?- t
   ========  CONTR_TAC (A' |- F)

Failure

Fails unless the theorem is contradictory, i.e. has F as its conclusion.

See also

CHECK_ASSUME_TAC, CONTR, CCONTR, CONTRAPOS, NOT_ELIM.

 CONV_RULE

CONV_RULE : (conv -> thm -> thm)

Synopsis

Makes an inference rule from a conversion.

Description

If c is a conversion, then CONV_RULE c is an inference rule that applies c to the conclusion of a theorem. That is, if c maps a term "t" to the theorem |- t = t', then the rule CONV_RULE c infers |- t' from the theorem |- t. More precisely, if c "t" returns

A' |- t = t', then:
       A |- t
   --------------  CONV_RULE c
    A u A' |- t'

Note that if the conversion c returns a theorem with assumptions, then the resulting inference rule adds these to the assumptions of the theorem it returns.

Failure

CONV_RULE c th fails if c fails when applied to the conclusion of th. The function returned by CONV_RULE c will also fail if the ML function c:term->thm is not, in fact, a conversion (i.e. a function that maps a term t to a theorem |- t = t').

See also

CONV_TAC, RIGHT_CONV_RULE.

 CONV_TAC

CONV_TAC : (conv -> tactic)

Synopsis

Makes a tactic from a conversion.

Description

If c is a conversion, then CONV_TAC c is a tactic that applies c to the goal. That is, if c maps a term "g" to the theorem |- g = g', then the tactic CONV_TAC c reduces a goal g to the subgoal g'. More precisely, if c "g" returns A' |- g = g', then:

         A ?- g
     ===============  CONV_TAC c
         A ?- g'

Note that the conversion c should return a theorem whose assumptions are also among the assumptions of the goal (normally, the conversion will returns a theorem with no assumptions). CONV_TAC does not fail if this is not the case, but the resulting tactic will be invalid, so the theorem ultimately proved using this tactic will have more assumptions than those of the original goal.

Failure

CONV_TAC c applied to a goal A ?- g fails if c fails when applied to the term g. The function returned by CONV_TAC c will also fail if the ML function c:term->thm is not, in fact, a conversion (i.e. a function that maps a term t to a theorem |- t = t').

Uses

CONV_TAC is used to apply simplifications that can’t be expressed as equations (rewrite rules). For example, a goal can be simplified by beta-reduction, which is not expressible as a single equation, using the tactic

   CONV_TAC(DEPTH_CONV BETA_CONV)

The conversion BETA_CONV maps a beta-redex "(\x.u)v" to the theorem

   |- (\x.u)v = u[v/x]

and the ML expression (DEPTH_CONV BETA_CONV) evaluates to a conversion that maps a term "t" to the theorem |- t=t' where t' is obtained from t by beta-reducing all beta-redexes in t. Thus CONV_TAC(DEPTH_CONV BETA_CONV) is a tactic which reduces betaredexes anywhere in a goal.

See also

CONV_RULE.

 current_theory

current_theory : (void -> string)

Synopsis

Returns the name of the current theory.

Description

Within a HOL session there is always a current theory. It is the theory represented by the current theory segment together with its ancestry. A call of current_theory() returns the name of the current theory. Initially HOL has current theory HOL.

Failure

Never fails.

See also

close_theory, extend_theory, load_theory, new_theory, print_theory.

 curry

curry : (((* # **) -> ***) -> * -> ** -> ***)

Synopsis

Converts a function on a pair to a corresponding curried function.

Description

The application curry f returns \x y. f(x,y), so that

   curry f x y = f(x,y)

Failure

Never fails.

Example

#let increment = curry $+ 1;;
increment = - : (int -> int)
#increment 6;;
7 : int

See also

uncurry.

 define_finite_set_syntax

define_finite_set_syntax : ((string # string) -> void)

Synopsis

Sets up an interpretation of finite set syntax.

Description

The HOL quotation parser supports the notation "{x1,...,xn}". This is primarily intended to support the sets library and dependent work, meaning ‘the set consisting just of the elements x1...xn’, but this function allows the interpretation of the notation to be changed. A call

   define_finite_set_syntax(`base`,`cons`)

causes

   "{x1,x2,...,xn}"

to be parsed as

   "cons x1 (cons x2 (cons ... (cons xn base) ... ))"

where base and cons should be the names of constants, the former of which may be an infix. The printer will invert this transformation.

Failure

Fails unless both argument strings are the names of constants of the current theory.

Example

We can use set notation for special boolean lists as follows

   #new_theory `snork`;;
   () : void
   #new_definition(`cons`,"cons (x:bool) (l:bool list) = CONS x l");;
   |- !x l. cons x l = CONS x l
   #new_definition(`nil`,"nil = ([]:bool list)");;
   |- nil = []
   #define_finite_set_syntax(`nil`,`cons`);;
   () : void
   #"{F,T,T}";;
   "{F,T,T}" : term
   #it = "cons F (cons T (cons T nil))";;
   true : bool

Comments

For more details about the use of set notation, refer to the DESCRIPTION.

See also

define_set_abstraction_syntax, load_library.

 define_load_lib_function

define_load_lib_function = - : (string list -> void -> void)

Synopsis

Defines a function for loading the contents of a library.

Description

If a library is loaded while the system is not in draft mode, it may not be loaded completely. In such case, a function whose name is created by prefixing the name of the library with ‘load_’ is defined. This function can be called later to complete the loading.

The function define_load_lib_function dynamically defines such a function. It is called in the generic library loader library_loader. Due to the way it is called using let_before, it can take only a single argument, a string list. The information passed in this list consists of the library name, the names of theories and the names of the code files. The library name is the first string in the list and it is mandatory. The theory names and code file names follow, and they are separated by a null string. Both of these are optional. E.g. the simplest case is [`lib_name`; ``].

When the loading function defined by define_load_lib_function is called, the code files will be loaded, and the theorems and definitions in the theories will be set up for autoloading.

Failure

The function define_load_lib_function fails if called with an argument not in the form described above. The loading function defined by it will fail if any of the code files cannot be loaded successfully, or any of the theories is not in the ancestry of the current theory.

See also

library_loader, load_library.

 define_new_type_bijections

define_new_type_bijections : (string -> string -> string -> thm -> thm)

Synopsis

Introduces abstraction and representation functions for a defined type.

Description

The result of making a type definition using new_type_definition is a theorem of the following form:

   |- ?rep:nty->ty. TYPE_DEFINITION P rep

which asserts only the existence of a bijection from the type it defines (in this case, nty) to the corresponding subset of an existing type (here, ty) whose characteristic function is specified by P. To automatically introduce constants that in fact denote this bijection and its inverse, the ML function define_new_type_bijections is provided.

This function takes three string arguments and a theorem argument. The theorem argument must be a definitional axiom of the form returned by new_type_definition. The first string argument is the name under which the constant definition (a constant specification, in fact) made by define_new_type_bijections will be stored in the current theory segment. The second and third string arguments are user-specified names for the two constants that are to be defined. These constants are defined so as to denote mutually inverse bijections between the defined type, whose definition is given by the supplied theorem, and the representing type of this defined type.

If th is a theorem of the form returned by new_type_definition:

   |- ?rep:newty->ty. TYPE_DEFINITION P rep

then evaluating:

   define_new_type_bijections `name` `abs` `rep` th

automatically defines two new constants abs:ty->newty and rep:newty->ty such that:

   |- (!a. abs(rep a) = a) /\ (!r. P r = (rep(abs r) = r))

This theorem, which is the defining property for the constants abs and rep, is stored under the name name in the current theory segment. It is also the value returned by define_new_type_bijections. The theorem states that abs is the left inverse of rep and, for values satisfying P, that rep is the left inverse of abs.

Failure

A call to define_new_type_bijections name abs rep th fails if th is not a theorem of

the form returned by new_type_definition, or if either abs or rep is already the name of a constant in the current theory, or there already exists a constant definition, constant specification, type definition or axiom named name in the current theory, or HOL is not in draft mode.

See also

new_type_definition, prove_abs_fn_one_one, prove_abs_fn_onto,
prove_rep_fn_one_one, prove_rep_fn_onto.

 define_set_abstraction_syntax

define_set_abstraction_syntax : (string -> void)

Synopsis

Sets up an interpretation of set abstraction syntax.

Description

The HOL quotation parser supports the notation "{x | P}". This is primarily intended for use in the sets library and dependent work, meaning ‘the set of elements x such that P is true’ (presumably x will be free in P), but this function allows the interpretation to be changed. A call

   define_set_abstraction_syntax `c`

where c is a constant of the current theory, will make the quotation parser interpret

   {x | P}

as

   c (\(x1...xn). (x,P))

where the x1...xn are all the variables that occur free in both x or P. The printer will invert this transformation.

Failure

Fails if c is not a constant of the current theory.

Comments

For further details about the use of this function in the sets library, refer to the DE-SCRIPTION.

See also

define_finite_set_syntax, load_library.

 define_type

define_type : (string -> string -> thm)

Synopsis

Automatically defines a user-specified concrete recursive data type.

Description

The ML function define_type automatically defines any required concrete recursive type in the logic. The first argument is the name under which the results of making the definition will be stored in the current theory segment. The second argument is a usersupplied specification of the type to be defined. This specification (explained below) simply states the names of the new type’s constructors and the logical types of their arguments. The theorem returned by define_type is an automatically-proved abstract characterization of the concrete data type described by this specification.

The type specification given as the second argument to define_type must be a string of the form:

   `op = C1 ty ... ty | C2 ty ... ty | ... | Cn ty ... ty`

where op is the name of the type constant or type operator to be defined, C1, ..., Cn are identifiers, and each ty is either a (logical) type expression valid in the current theory (in which case ty must not contain op) or just the identifier ‘op’ itself.

A string of this form describes an n-ary type operator op, where n is the number of distinct type variables in the types ty on the right hand side of the equation. If n is zero then op is a type constant; otherwise op is an n-ary type operator. The type described by the specification has n distinct constructors C1, ..., Cn. Each constructor Ci is a function that takes arguments whose types are given by the associated type expressions ty in the specification. If one or more of the type expressions ty is the type op itself, then the equation specifies a recursive data type. In any specification, at least one constructor must be non-recursive, i.e. all its arguments must have types which already exist in the current theory.

Given a type specification of the form described above, define_type makes an appropriate type definition for the type operator op. It then makes appropriate definitions for the constants C1, ..., Cn, and automatically proves a theorem that states an abstract characterization of the newly-defined type op. This theorem, which is stored in the current theory segment under the name supplied as the first argument and also returned by define_type, has the form of a ‘primitive recursion theorem’ for the concrete type op (see the examples given below). This property provides an abstract characterization of the type op which is both succinct and complete, in the sense that it completely determines the structure of the values of op up to isomorphism.

Failure

Evaluating

   define_type `name` `op = C1 ty ... ty | ... | Cn ty ... ty`

fails if HOL is not in draft mode; if op is already the name of a type constant or type operator in the current theory; if the supplied constant names C1, ..., Cn are not distinct; if any one of C1, ..., Cn is already a constant in the current theory or is not an allowed name for a constant; if ABS_op or REP_op are already constants in the current theory; if there is already an axiom, definition, constant specification or type definition stored under either the name op_TY_DEF or the name op_ISO_DEF in the current theory segment; if there is already a theorem stored under the name `name` in the current theory segment; or (finally) if the input type specification does not conform in any other respect to the syntax described above.

Example

The following call to define_type defines tri to be a simple enumerated type with exactly three distinct values:

   #define_type `tri_DEF` `tri = ONE | TWO | THREE`;;
   |- !e0 e1 e2. ?! fn. (fn ONE = e0) /\ (fn TWO = e1) /\ (fn THREE = e2)

The theorem returned is a degenerate ‘primitive recursion’ theorem for the concrete type tri. An example of a recursive type that can be defined using define_type is a type of binary trees:

   #define_type `btree_DEF` `btree = LEAF * | NODE btree btree`;;
   |- !f0 f1.
        ?! fn.
        (!x. fn(LEAF x) = f0 x) /\
        (!b1 b2. fn(NODE b1 b2) = f1(fn b1)(fn b2)b1 b2)

The theorem returned by define_type in this case asserts the unique existence of functions defined by primitive recursion over labelled binary trees.

Note that the type being defined may not occur as a proper subtype in any of the types of the arguments of the constructors:

   #define_type `name` `ty = NUM num | FUN (ty -> ty)`;;
   evaluation failed     ill-formed type expression(s)

In this example, there is an error because ty occurs within the type expression (ty -> ty).

See also

INDUCT_THEN, new_recursive_definition, prove_cases_thm,
prove_constructors_distinct, prove_constructors_one_one, prove_induction_thm,
prove_rec_fn_exists.

 definition

definition : (string -> string -> thm)

Synopsis

Reads a constant definition from a given theory segment of the current theory.

Description

A call definition `thy` `def` returns constant definition def from the theory segment thy. The theory segment thy must be part of the current theory. The name def is the one given to the definition by the user when it was originally added to the theory segment (by a call to new_definition). The name of the current theory segment can be abbreviated

by `-`.

Failure

The call definition `thy` `def` will fail if the theory segment thy is not part of the current theory. It will fail if there does not exist a constant definition of name def in theory segment thy.

Example

#definition `bool` `ONTO_DEF`;;
|- !f. ONTO f = (!y. ?x. y = f x)

See also

axiom, definitions, load_definition, load_definitions, new_definition,
print_theory, theorem.

 definitions

definitions : (string -> (string # thm) list)

Synopsis

Returns the constant definitions, type definitions and constant specifications of a given theory segment of the current theory.

Description

A call of definitions `thy` returns the definitions of the theory segment thy together with their names. Constant definitions, type definitions and constant specifications are all retrieved by the function definitions. The theory segment thy must be part of the current theory. The names are those given to the definitions by the user when they were originally added to the theory segment (by a call, for example, to new_definition). The name of the current theory segment can be abbreviated by `-`.

Failure

The call definitions `thy` will fail if the theory segment thy is not part of the current theory. definition lfn 107

Example

#definitions `combin`;;
[(`I_DEF`, |- I = S K K);
 (`S_DEF`, |- S = (\f g x. f x(g x)));
 (`K_DEF`, |- K = (\x y. x));
 (`o_DEF`, |- !f g. f o g = (\x. f(g x)))]
: (string # thm) list

See also

axioms, definition, load_definition, load_definitions, new_definition,
print_theory, theorems.

 definition_lfn

definition_lfn : (string list -> thm)

Synopsis

Loads a given definition from a given theory.

Description

If thy is an ancestor theory, and def one of its definitions, then the call

   definition_lfn [`thy`;`def`]

will return that definition.

Failure

Fails if thy is not an ancestor theory, or if def is not one of its definitions.

Example

#definition_lfn [`bool`; `EXISTS_DEF`];;
|- $? = (\P. P($@ P))

Comments

This call has the same effect as definition `thy` `def`.

See also

definition, definitions, definition_msg_lfn, load_definition, load_definitions.

 definition_msg_lfn
definition_msg_lfn : (string list -> thm)

Synopsis

Loads a given definition from a given theory, with an autoload message.

Description

If thy is an ancestor theory, and def one of its definitions, then the call

   definition_msg_lfn [`thy`;`def`]

will print out a message of the form

   Definition def autoloaded from theory `thy`

and cancel any autoloading action associated with the name def, and return that definition.

Failure

Fails if thy is not an ancestor theory, or if def is not one of its definitions.

Example

#definition_msg_lfn [`bool`;`NOT_DEF`];;
Definition NOT_DEF autoloaded from theory `bool`.
|- $~ = (\t. t ==> F)

See also

autoload, autoload_theory, definition, definitions, definition_lfn,
load_definition, load_definitions, undo_autoload.
 DEF_EXISTS_RULE
DEF_EXISTS_RULE : (term -> thm)

Synopsis

Proves that a function defined by a definitional equation exists.

Description

This rule accepts a term of the form "c = ..." or "f x1 ... xn = ...", the variables of which may be universally quantified, and returns an existential theorem. The resulting theorem is typically used for generating HOL specifications.

Failure

DEF_EXISTS_RULE fails if the definition is not an equation, if there is any variable in the right-hand side which does not occur in the left-hand side, if the definition is recursive, if there is a free type variable, or if the name being defined by the function is not allowed.

Example

The effect of this rule can be understood more clearly through an example:

   #DEF_EXISTS_RULE "max a b = ((a < b) => b | a)" ;;
   |- ?max. !a b. max a b = (a < b => b | a)

Comments

In later versions of HOL this function may be made internal.

See also

new_definition, new_gen_definition, new_specification.

 delete_cache

delete_cache : (string -> void)

Synopsis

Deletes a theory from the theory cache.

Description

A call delete_cache thy deletes the named theory from the theory cache. For more details of the cacheing mechanism, see the DESCRIPTION.

Failure

Never fails, even if the name is not the name of a loaded theory.

See also

cached_theories.

 delete_thm

delete_thm : (string -> string -> thm)

Synopsis

Deletes a theorem from a theory.

Description

If thy is an ancestor theory, and th the name of a theorem of that theory, then the call

   delete_thm `thy` `th`

will delete the theorem th from the theory thy. As usual, the special string `-` is allowed as a theory name, standing for the current theory. The call will return the theorem deleted.

Failure

Fails if thy is not an ancestor theory, or if th is not one of its theorems, or for various system-dependent reasons connected with writing to the theory file.

Example

#new_theory `geek`;;
() : void
#theorems `-`;;
[] : (string # thm) list
#save_thm(`truth`,TRUTH);;
|- T
#theorems `-`;;
[(`truth`, |- T)] : (string # thm) list
#delete_thm `-` `truth`;;
|- T
#theorems `-`;;
[] : (string # thm) list

Comments

The particular theorems which are stored in a theory have no logical significance, so this operation is quite safe. By contrast, being able to delete a definition from a theory would compromise the consistency of the logic, so it is not allowed.

See also

prove_thm, save_thm, theorem, theorems.

 DEPTH_CONV

DEPTH_CONV : (conv -> conv)

Synopsis

Applies a conversion repeatedly to all the sub-terms of a term, in bottom-up order.

Description

DEPTH_CONV c tm repeatedly applies the conversion c to all the subterms of the term tm, including the term tm itself. The supplied conversion is applied repeatedly (zero or more times, as is done by REPEATC) to each subterm until it fails. The conversion is applied to subterms in bottom-up order.

Failure

DEPTH_CONV c tm never fails but can diverge if the conversion c can be applied repeatedly to some subterm of tm without failing.

Example

The following example shows how DEPTH_CONV applies a conversion to all subterms to which it applies:

   #DEPTH_CONV BETA_CONV "(\x. (\y. y + x) 1) 2";;
   |- (\x. (\y. y + x)1)2 = 1 + 2

Here, there are two beta-redexes in the input term, one of which occurs within the other. DEPTH_CONV BETA_CONV applies beta-conversion to innermost beta-redex (\y. y + x) 1 first. The outermost beta-redex is then (\x. 1 + x) 2, and beta-conversion of this redex gives 1 + 2.

Because DEPTH_CONV applies a conversion bottom-up, the final result may still contain subterms to which the supplied conversion applies. For example, in:

   #DEPTH_CONV BETA_CONV "(\f x. (f x) + 1) (\y.y) 2";;
   |- (\f x. (f x) + 1)(\y. y)2 = ((\y. y)2) + 1

the right-hand side of the result still contains a beta-redex, because the redex "(\y.y)2" is introduced by virtue an application of BETA_CONV higher-up in the structure of the input term. By contrast, in the example:

   #DEPTH_CONV BETA_CONV "(\f x. (f x)) (\y.y) 2";;
   |- (\f x. f x)(\y. y)2 = 2

all beta-redexes are eliminated, because DEPTH_CONV repeats the supplied conversion (in this case, BETA_CONV) at each subterm (in this case, at the top-level term).

Uses

If the conversion c implements the evaluation of a function in logic, then DEPTH_CONV c will do bottom-up evaluation of nested applications of it. For example, the conversion ADD_CONV implements addition of natural number constants within the logic. Thus, the effect of:

   #DEPTH_CONV ADD_CONV "(1 + 2) + (3 + 4 + 5)";;
   |- (1 + 2) + (3 + (4 + 5)) = 15

is to compute the sum represented by the input term.

Comments

The implementation of this function uses failure to avoid rebuilding unchanged subterms. That is to say, during execution the failure string `QCONV` may be generated and later trapped. The behaviour of the function is dependent on this use of failure. So, if the conversion given as an argument happens to generate a failure with string `QCONV`, the operation of DEPTH_CONV will be unpredictable.

See also

ONCE_DEPTH_CONV, REDEPTH_CONV, TOP_DEPTH_CONV.

 dest_abs

dest_abs : (term -> (term # term))

Synopsis

Breaks apart an abstraction into abstracted variable and body.

Description

dest_abs is a term destructor for abstractions: dest_abs "\var. t" returns ("var","t"). dest comb 113

Failure

Fails with dest_abs if term is not an abstraction.

See also

mk_abs, is_abs, dest_var, dest_const, dest_comb, strip_abs.
 dest_comb
dest_comb : (term -> (term # term))

Synopsis

Breaks apart a combination (function application) into rator and rand.

Description

dest_comb is a term destructor for combinations:

   dest_comb "t1 t2"
returns ("t1","t2").

Failure

Fails with dest_comb if term is not a combination.

See also

mk_comb, is_comb, dest_var, dest_const, dest_abs, strip_comb.
 dest_cond
dest_cond : (term -> (term # term # term))

Synopsis

Breaks apart a conditional into the three terms involved.

Description

dest_cond is a term destructor for conditionals:

   dest_cond "t => t1 | t2"
returns ("t","t1","t2").

Failure

Fails with dest_cond if term is not a conditional.

See also

mk_cond, is_cond.

 dest_conj

dest_conj : (term -> (term # term))

Synopsis

Term destructor for conjunctions.

Description

dest_conj("t1 /\ t2") returns ("t1","t2").

Failure

Fails with dest_conj if term is not a conjunction.

See also

mk_conj, is_conj.

 dest_cons

dest_cons : (term -> (term # term))

Synopsis

Breaks apart a ‘CONS pair’ into head and tail.

Description

dest_cons is a term destructor for ‘CONS pairs’. When applied to a term representing a nonempty list "[t;t1;...;tn]" (which is equivalent to "CONS t [t1;...;tn]"), it returns

the pair of terms ("t","[t1;...;tn]").

Failure

Fails with dest_cons if the term is not a non-empty list.

See also

mk_cons, is_cons, mk_list, dest_list, is_list.
 dest_const
dest_const : (term -> (string # type))

Synopsis

Breaks apart a constant into name and type.

Description

dest_const is a term destructor for constants:

   dest_const "const:ty"
returns (`const`,":ty").

Failure

Fails with dest_const if term is not a constant.

See also

mk_const, is_const, dest_var, dest_comb, dest_abs.
 dest_definition
dest_definition : (term -> term)

Synopsis

This function is for internal use only and is to be deleted from a future version of the system. It should not be used.

 dest_disj
dest_disj : (term -> (term # term))

116 Chapter 1. Pre-defined ML Identifiers

Synopsis

Breaks apart a disjunction into the two disjuncts.

Description

dest_disj is a term destructor for disjunctions:

   dest_disj "t1 \/ t2"
returns ("t1","t2").

Failure

Fails with dest_disj if term is not a disjunction.

See also

mk_disj, is_disj.
 dest_eq
dest_eq : (term -> (term # term))

Synopsis

Term destructor for equality.

Description

dest_eq("t1 = t2") returns ("t1","t2").

Failure

Fails with dest_eq if term is not an equality.

See also

mk_eq, is_eq.
 dest_exists
dest_exists : (term -> (term # term))

Synopsis

Breaks apart an existentially quantified term into quantified variable and body. dest forall 117

Description

dest_exists is a term destructor for existential quantification: dest_exists "?var. t"

returns ("var","t").

Failure

Fails with dest_exists if term is not an existential quantification.

See also

mk_exists, is_exists, strip_exists.
 dest_forall
dest_forall : (term -> (term # term))

Synopsis

Breaks apart a universally quantified term into quantified variable and body.

Description

dest_forall is a term destructor for universal quantification: dest_forall "!var. t"

returns ("var","t").

Failure

Fails with dest_forall if term is not a universal quantification.

See also

mk_forall, is_forall, strip_forall.
 dest_form
dest_form : (form -> term)

Synopsis

This function is for internal use only and is to be deleted from a future version of the system. It should not be used.

 dest_imp
dest_imp : (term -> (term # term))

Synopsis

Breaks apart an implication into antecedent and consequent.

Description

dest_imp is a term destructor for implications. Thus

   dest_imp "t1 ==> t2"

returns

   ("t1","t2")

Failure

Fails with dest_imp if term is not an implication.

Comments

Previous version of dest_imp treats negations as an implication with F as the conclusion. This is renamed to dest_neg_imp.

See also

mk_imp, is_imp, strip_imp, dest_neg_imp.
 dest_let
dest_let : (term -> (term # term))

Synopsis

Breaks apart a let-expression.

Description

dest_let is a term destructor for general let-expressions: dest_let "LET f x" returns

("f","x").

dest list 119

Failure

Fails with dest_let if term is not a let-expression or of the more general "LET f x" form.

Example

#dest_let "LET ($= 1) 2";;
("$= 1", "2") : (term # term)
#dest_let "let x = 2 in (x = 1)";;
("\x. x = 1", "2") : (term # term)

See also

mk_let, is_let.
 dest_list
dest_list : (term -> (term list # type))

Synopsis

Iteratively breaks apart a list term.

Description

dest_list is a term destructor for lists: dest_list("[t1;...;tn]:(ty)list") returns
(["t1";...;"tn"],":ty").

Failure

Fails with dest_list if the term is not a list.

See also

mk_list, is_list, mk_cons, dest_cons, is_cons.
 dest_neg
dest_neg : (term -> term)

Synopsis

Breaks apart a negation, returning its body.

Description

dest_neg is a term destructor for negations: dest_neg "~t" returns "t".

Failure

Fails with dest_neg if term is not a negation.

See also

mk_neg, is_neg.

 dest_neg_imp

dest_neg_imp : (term -> (term # term))

Synopsis

Breaks apart an implication (or negation) into antecedent and consequent.

Description

dest_neg_imp is a term destructor for implications, which treats negations as implications with consequent F. Thus

   dest_neg_imp "t1 ==> t2"

returns

   ("t1","t2")

and also

   dest_neg_imp "~t"

returns

   ("t","F")

Failure

Fails with dest_neg_imp if term is neither an implication nor a negation.

Comments

Destructs negations for compatibility with PPLAMBDA code. This function used to be

called dest_imp

dest pabs 121

See also

is_neg_imp, dest_imp, strip_imp.
 dest_pabs
dest_pabs : (term -> (term # term))

Synopsis

Breaks apart a paired abstraction into abstracted varstruct and body.

Description

dest_pabs is a term destructor for paired abstractions: dest_pabs "\(v1..(..)..vn). t"

returns ("(v1..(..)..vn)","t").

Failure

Fails unless the term is a paired abstraction.

See also

mk_pabs, is_pabs, dest_abs, dest_var, dest_const, dest_comb.
 dest_pair
dest_pair : (term -> (term # term))

Synopsis

Breaks apart a pair into two separate terms.

Description

dest_pair is a term destructor for pairs: dest_pair "(t1,t2)" returns ("t1","t2").

Failure

Fails with dest_pair if term is not a pair.

See also

mk_pair, is_pair, strip_pair.

 dest_pred
dest_pred : (term -> (string # term))

Synopsis

Breaks apart a combination whose operator is a constant.

Description

Given a term "op t", dest_pred returns the pair (`op`,"t"), provided "op" is a constant.

Failure

Fails if the given term is not a combination whose operator is a constant.

Example

dest_pred "$/\ T";;
(`/\`, "T") : (string # term)

See also

dest_comb, dest_const, is_pred
 dest_select
dest_select : (term -> (term # term))

Synopsis

Breaks apart a choice term into selected variable and body.

Description

dest_select is a term destructor for choice terms:

   dest_select "@var. t"
returns ("var","t").

Failure

Fails with dest_select if term is not an epsilon-term.

\underline{dest thm 123}

See also

mk_select, is_select.
 dest_thm
dest_thm : (thm -> goal)

Synopsis

Breaks a theorem into assumption list and conclusion.

Description

dest_thm (t1,...,tn |- t) returns (["t1";...;"tn"],"t").

Failure

Never fails.

Example

#dest_thm (ASSUME "p=T");;
(["p = T"], "p = T") : goal

See also

concl, hyp.
 dest_type
dest_type : (type -> (string # type list))

Synopsis

Breaks apart a type (other than a variable type).

Description

dest_type(":(ty1,...,tyn)op") returns (`op`,[":ty1";...;":tyn"]).

Failure

Fails with dest_type if the type is a type variable.

124 Chapter 1. Pre-defined ML Identifiers

Example

#dest_type ":bool";;
(`bool`, []) : (string # type list)
#dest_type ":(bool)list";;
(`list`, [":bool"]) : (string # type list)
#dest_type ":num -> bool";;
(`fun`, [":num"; ":bool"]) : (string # type list)

See also

mk_type, dest_vartype.
 dest_var
dest_var : (term -> (string # type))

Synopsis

Breaks apart a variable into name and type.

Description

dest_var "var:ty" returns (`var`,":ty").

Failure

Fails with dest_var if term is not a variable.

See also

mk_var, is_var, dest_const, dest_comb, dest_abs.
 dest_vartype
dest_vartype : (type -> string)

Synopsis

Breaks a type variable down to its name.

Description

dest_vartype ":*..." returns `*...`.

Failure

Fails with dest_vartype if the type is not a type variable.

Example

#dest_vartype ":*test";;
`*test` : string
#dest_vartype ":bool";;
evaluation failed     dest_vartype
#dest_vartype ":* -> bool";;
evaluation failed     dest_vartype

See also

mk_vartype, is_vartype, dest_type.

 DISCARD_TAC

DISCARD_TAC : thm_tactic

Synopsis

Discards a theorem already present in a goal’s assumptions.

Description

When applied to a theorem A' |- s and a goal, DISCARD_TAC checks that s is simply T (true), or already exists (up to alpha-conversion) in the assumption list of the goal. In either case, the tactic has no effect. Otherwise, it fails.

    A ?- t
   ========  DISCARD_TAC (A' |- s)
    A ?- t

Failure

Fails if the above conditions are not met, i.e. the theorem’s conclusion is not T or already in the assumption list (up to alpha-conversion).

See also

POP_ASSUM, POP_ASSUM_LIST.

 DISCH

DISCH : (term -> thm -> thm)

Synopsis

Discharges an assumption.

Description

       A |- t
--------------------  DISCH "u"
 A - {u} |- u ==> t

Failure

DISCH will fail if "u" is not boolean.

Comments

The term "u" need not be a hypothesis. Discharging "u" will remove all identical and alpha-equivalent hypotheses.

See also

DISCH_ALL, DISCH_TAC, DISCH_THEN, FILTER_DISCH_TAC, FILTER_DISCH_THEN,
NEG_DISCH, STRIP_TAC, UNDISCH, UNDISCH_ALL, UNDISCH_TAC.

 disch

disch : ((term # term list) -> term list)

Synopsis

Removes those elements of a list of terms that are alpha equivalent to a given term.

Description

Given a pair ("t",tl), disch removes those elements of tl that are alpha equivalent to

"t".

Example

disch ("\x:bool.T",["A = T";"B = 3";"\y:bool.T"]);;
["A = T";"B = 3"] : term list

See also

filter.

 DISCH_ALL

DISCH_ALL : (thm -> thm)

Synopsis

Discharges all hypotheses of a theorem.

Description

         A1, ..., An |- t
   ----------------------------  DISCH_ALL
    |- A1 ==> ... ==> An ==> t

Failure

DISCH_ALL will not fail if there are no hypotheses to discharge, it will simply return the theorem unchanged.

Comments

Users should not rely on the hypotheses being discharged in any particular order. Two or more alpha-convertible hypotheses will be discharged by a single implication; users should not rely on which hypothesis appears in the implication.

See also

DISCH, DISCH_TAC, DISCH_THEN, NEG_DISCH, FILTER_DISCH_TAC, FILTER_DISCH_THEN,
STRIP_TAC, UNDISCH, UNDISCH_ALL, UNDISCH_TAC.

 DISCH_TAC

DISCH_TAC : tactic

128 Chapter 1. Pre-defined ML Identifiers

Synopsis

Moves the antecedent of an implicative goal into the assumptions.

Description

    A ?- u ==> v
   ==============  DISCH_TAC
    A u {u} ?- v

Note that DISCH_TAC treats "~u" as "u ==> F", so will also work when applied to a goal with a negated conclusion.

Failure

DISCH_TAC will fail for goals which are not implications or negations.

Uses

Solving goals of the form "u ==> v" by rewriting "v" with "u", although the use of DISCH_THEN is usually more elegant in such cases.

Comments

If the antecedent already appears in the assumptions, it will be duplicated.

See also

DISCH, DISCH_ALL, DISCH_THEN, FILTER_DISCH_TAC, FILTER_DISCH_THEN, NEG_DISCH,
STRIP_TAC, UNDISCH, UNDISCH_ALL, UNDISCH_TAC.
 DISCH_THEN
DISCH_THEN : (thm_tactic -> tactic)

Synopsis

Undischarges an antecedent of an implication and passes it to a theorem-tactic.

Description

DISCH_THEN removes the antecedent and then creates a theorem by ASSUMEing it. This new theorem is passed to the theorem-tactic given as DISCH_THEN’s argument. The consequent

\underline{DISJ1 129}

tactic is then applied. Thus:

   DISCH_THEN f (asl,"t1 ==> t2") = f(ASSUME "t1")(asl,"t2")

For example, if

    A ?- t
   ========  f (ASSUME "u")
    B ?- v

then

    A ?- u ==> t
   ==============  DISCH_THEN f
       B ?- v
Note that DISCH_THEN treats "~u" as "u ==> F".

Failure

DISCH_THEN will fail for goals which are not implications or negations.

Example

The following shows how DISCH_THEN can be used to preprocess an antecedent before adding it to the assumptions.

    A ?- (x = y) ==> t
   ====================  DISCH_THEN (ASSUME_TAC o SYM)
     A u {y = x} ?- t

In many cases, it is possible to use an antecedent and then throw it away:

    A ?- (x = y) ==> t x
   ======================  DISCH_THEN (\th. PURE_REWRITE_TAC [th])
          A ?- t y

See also

DISCH, DISCH_ALL, DISCH_TAC, NEG_DISCH, FILTER_DISCH_TAC, FILTER_DISCH_THEN,
STRIP_TAC, UNDISCH, UNDISCH_ALL, UNDISCH_TAC.

 DISJ1

DISJ1 : (thm -> term -> thm)

Synopsis

Introduces a right disjunct into the conclusion of a theorem.

Description

       A |- t1
   ---------------  DISJ1 (A |- t1) "t2"
    A |- t1 \/ t2

Failure

Fails unless the term argument is boolean.

Example

#DISJ1 TRUTH "F";;
|- T \/ F

Comments

The system shows the type of DISJ1 as (thm -> conv).

See also

DISJ1_TAC, DISJ2, DISJ2_TAC, DISJ_CASES.

 DISJ1_TAC

DISJ1_TAC : tactic

Synopsis

Selects the left disjunct of a disjunctive goal.

Description

   A ?- t1 \/ t2
  ===============  DISJ1_TAC
     A ?- t1

Failure

Fails if the goal is not a disjunction.

\underline{DISJ2 131}

See also

DISJ1, DISJ2, DISJ2_TAC.
 DISJ2
DISJ2 : (term -> thm -> thm)

Synopsis

Introduces a left disjunct into the conclusion of a theorem.

Description

      A |- t2
   ---------------  DISJ2 "t1"
    A |- t1 \/ t2

Failure

Fails if the term argument is not boolean.

Example

#DISJ2 "F" TRUTH;;
|- F \/ T

See also

DISJ1, DISJ1_TAC, DISJ2_TAC, DISJ_CASES.
 DISJ2_TAC
DISJ2_TAC : tactic

Synopsis

Selects the right disjunct of a disjunctive goal.

132 Chapter 1. Pre-defined ML Identifiers

Description

    A ?- t1 \/ t2
   ===============  DISJ2_TAC
       A ?- t2

Failure

Fails if the goal is not a disjunction.

See also

DISJ1, DISJ1_TAC, DISJ2.

 disjuncts
disjuncts : (term -> term list)

Synopsis

Iteratively breaks apart a disjunction.

Description

disjuncts "t1 \/ ... \/ tn" returns ["t1";...;"tn"]. The argument term may be any

tree of disjunctions; it need not have the form "t1 \/ (t2 \/ ( ... \/ tn)...)". A term that is not a disjunction is simply returned as the sole element of a list. Note that

   disjuncts(list_mk_disj(["t1";...;"tn"]))

will not return ["t1";...;"tn"] if any of t1,...,tn are disjunctions.

Failure

Never fails.

Example

#list_mk_disj ["a \/ b";"c \/ d";"e \/ f"];;
"(a \/ b) \/ (c \/ d) \/ e \/ f" : term
#disjuncts it;;
["a"; "b"; "c"; "d"; "e"; "f"] : term list
#list_mk_disj it;;
"a \/ b \/ c \/ d \/ e \/ f" : term
#disjuncts "1";;
["1"] : term list

Comments

Because disjuncts splits both the left and right sides of a disjunction, this operation is not the inverse of list_mk_disj. It may be useful to introduce list_dest_disj for splitting only the right tails of a disjunction.

See also

list_mk_disj, dest_disj.

 DISJ_CASES

DISJ_CASES : (thm -> thm -> thm -> thm)

Synopsis

Eliminates disjunction by cases.

Description

The rule DISJ_CASES takes a disjunctive theorem, and two ‘case’ theorems, each with one of the disjuncts as a hypothesis while sharing alpha-equivalent conclusions. A new theorem is returned with the same conclusion as the ‘case’ theorems, and the union of all assumptions excepting the disjuncts.

    A |- t1 \/ t2     A1 u {t1} |- t      A2 u {t2} |- t
   ------------------------------------------------------  DISJ_CASES
                    A u A1 u A2 |- t

Failure

Fails if the first argument is not a disjunctive theorem, or if the conclusions of the other two theorems are not alpha-convertible.

Example

Specializing the built-in theorem num_CASES gives the theorem:

   th = |- (m = 0) \/ (?n. m = SUC n)

Using two additional theorems, each having one disjunct as a hypothesis:

   th1 = (m = 0 |- (PRE m = m) = (m = 0))
   th2 = (?n. m = SUC n" |- (PRE m = m) = (m = 0))

a new theorem can be derived:

   #DISJ_CASES th th1 th2;;
   |- (PRE m = m) = (m = 0)

Comments

Neither of the ‘case’ theorems is required to have either disjunct as a hypothesis, but otherwise DISJ_CASES is pointless.

See also

DISJ_CASES_TAC, DISJ_CASES_THEN, DISJ_CASES_THEN2, DISJ_CASES_UNION, DISJ1,
DISJ2.

 DISJ_CASES_TAC

DISJ_CASES_TAC : thm_tactic

Synopsis

Produces a case split based on a disjunctive theorem.

Description

Given a theorem th of the form A |- u \/ v, DISJ_CASES_TAC th applied to a goal produces two subgoals, one with u as an assumption and one with v:

              A ?- t
   ============================  DISJ_CASES_TAC (A |- u \/ v)
    A u {u} ?- t   A u {v}?- t

Failure

Fails if the given theorem does not have a disjunctive conclusion.

Example

Given the simple fact about arithmetic th, |- (m = 0) \/ (?n. m = SUC n), the tactic DISJ_CASES_TAC th can be used to produce a case split:

   #DISJ_CASES_TAC th ([],"(P:num -> bool) m");;
   ([(["m = 0"], "P m");
     (["?n. m = SUC n"], "P m")], -) : subgoals

Uses

Performing a case analysis according to a disjunctive theorem.

See also

ASSUME_TAC, ASM_CASES_TAC, COND_CASES_TAC, DISJ_CASES_THEN, STRUCT_CASES_TAC.

 DISJ_CASES_THEN

DISJ_CASES_THEN : thm_tactical

Synopsis

Applies a theorem-tactic to each disjunct of a disjunctive theorem.

Description

If the theorem-tactic f:thm->tactic applied to either ASSUMEd disjunct produces results as follows when applied to a goal (A ?- t):

    A ?- t                                A ?- t
   =========  f (u |- u)      and        =========  f (v |- v)
    A ?- t1                               A ?- t2

then applying DISJ_CASES_THEN f (|- u \/ v) to the goal (A ?- t) produces two subgoals.

           A ?- t
   ======================  DISJ_CASES_THEN f (|- u \/ v)
    A ?- t1      A ?- t2

Failure

Fails if the theorem is not a disjunction. An invalid tactic is produced if the theorem has any hypothesis which is not alpha-convertible to an assumption of the goal.

Example

Given the theorem

   th = |- (m = 0) \/ (?n. m = SUC n)

and a goal of the form ?- (PRE m = m) = (m = 0), applying the tactic

   DISJ_CASES_THEN ASSUME_TAC th

produces two subgoals, each with one disjunct as an added assumption:

   ?n. m = SUC n ?- (PRE m = m) = (m = 0)
   m = 0 ?- (PRE m = m) = (m = 0)

Uses

Building cases tactics. For example, DISJ_CASES_TAC could be defined by:

   let DISJ_CASES_TAC = DISJ_CASES_THEN ASSUME_TAC

Comments

Use DISJ_CASES_THEN2 to apply different tactic generating functions to each case.

See also

STRIP_THM_THEN, CHOOSE_THEN, CONJUNCTS_THEN, CONJUNCTS_THEN2, DISJ_CASES_TAC,
DISJ_CASES_THEN2, DISJ_CASES_THENL.

 DISJ_CASES_THEN2

DISJ_CASES_THEN2 : (thm_tactic -> thm_tactical)

Synopsis

Applies separate theorem-tactics to the two disjuncts of a theorem.

Description

If the theorem-tactics f1 and f2, applied to the ASSUMEd left and right disjunct of a theorem |- u \/ v respectively, produce results as follows when applied to a goal (A ?- t):

    A ?- t                                 A ?- t
   =========  f1 (u |- u)      and        =========  f2 (v |- v)
    A ?- t1                                A ?- t2
then applying DISJ_CASES_THEN2 f1 f2 (|- u \/ v) to the goal (A ?- t) produces two

DISJ CASES THEN2 137

subgoals.

           A ?- t
   ======================  DISJ_CASES_THEN2 f1 f2 (|- u \/ v)
    A ?- t1      A ?- t2

Failure

Fails if the theorem is not a disjunction. An invalid tactic is produced if the theorem has any hypothesis which is not alpha-convertible to an assumption of the goal.

Example

Given the theorem

   th = |- (m = 0) \/ (?n. m = SUC n)

and a goal of the form ?- (PRE m = m) = (m = 0), applying the tactic

   DISJ_CASES_THEN2 SUBST1_TAC ASSUME_TAC th

to the goal will produce two subgoals

   ?n. m = SUC n ?- (PRE m = m) = (m = 0)
   ?- (PRE 0 = 0) = (0 = 0)

The first subgoal has had the disjunct m = 0 used for a substitution, and the second has added the disjunct to the assumption list. Alternatively, applying the tactic

   DISJ_CASES_THEN2 SUBST1_TAC (CHOOSE_THEN SUBST1_TAC) th

to the goal produces the subgoals:

   ?- (PRE(SUC n) = SUC n) = (SUC n = 0)
   ?- (PRE 0 = 0) = (0 = 0)

Uses

Building cases tacticals. For example, DISJ_CASES_THEN could be defined by:

  let DISJ_CASES_THEN f = DISJ_CASES_THEN2 f f

See also

STRIP_THM_THEN, CHOOSE_THEN, CONJUNCTS_THEN, CONJUNCTS_THEN2, DISJ_CASES_THEN,
DISJ_CASES_THENL.

 DISJ_CASES_THENL
DISJ_CASES_THENL : (thm_tactic list -> thm_tactic)

Synopsis

Applies theorem-tactics in a list to the corresponding disjuncts in a theorem.

Description

If the theorem-tactics f1...fn applied to the ASSUMEd disjuncts of a theorem

   |- d1 \/ d2 \/...\/ dn

produce results as follows when applied to a goal (A ?- t):

    A ?- t                                A ?- t
   =========  f1 (d1 |- d1) and ... and =========  fn (dn |- dn)
    A ?- t1                              A ?- tn
then applying DISJ_CASES_THENL [f1;...;fn] (|- d1 \/...\/ dn) to the goal (A ?- t)

produces n subgoals.

           A ?- t
   =======================  DISJ_CASES_THENL [f1;...;fn] (|- d1 \/...\/ dn)
    A ?- t1  ...  A ?- tn

DISJ_CASES_THENL is defined using iteration, hence for theorems with more than n disjuncts, dn would itself be disjunctive.

Failure

Fails if the number of tactic generating functions in the list exceeds the number of disjuncts in the theorem. An invalid tactic is produced if the theorem has any hypothesis which is not alpha-convertible to an assumption of the goal.

Uses

Used when the goal is to be split into several cases, where a different tactic-generating function is to be applied to each case.

See also

CHOOSE_THEN, CONJUNCTS_THEN, CONJUNCTS_THEN2, DISJ_CASES_THEN,
DISJ_CASES_THEN2, STRIP_THM_THEN.

 DISJ_CASES_UNION
DISJ_CASES_UNION : (thm -> thm -> thm -> thm)

Synopsis

Makes an inference for each arm of a disjunct.

Description

Given a disjunctive theorem, and two additional theorems each having one disjunct as a hypothesis, a new theorem with a conclusion that is the disjunction of the conclusions of the last two theorems is produced. The hypotheses include the union of hypotheses of all three theorems less the two disjuncts.

    A |- t1 \/ t2    A1 u {t1} |- t3     A2 u {t2} |- t4
   ------------------------------------------------------  DISJ_CASES_UNION
                 A u A1 u A2 |- t3 \/ t4

Failure

Fails if the first theorem is not a disjunction.

Example

The built-in theorem LESS_CASES can be specialized to:

   th1 = |- m < n \/ n <= m

and used with two additional theorems:

   th2 = (m < n |- (m MOD n = m))
   th3 = ({0 < n, n <= m} |- (m MOD n) = ((m - n) MOD n))

to derive a new theorem:

   #DISJ_CASES_UNION th1 th2 th3;;
   ["0 < n"] |- (m MOD n = m) \/ (m MOD n = (m - n) MOD n)

See also

DISJ_CASES, DISJ_CASES_TAC, DISJ1, DISJ2.

 DISJ_IMP

DISJ_IMP : (thm -> thm)

Synopsis

Converts a disjunctive theorem to an equivalent implicative theorem.

Description

The left disjunct of a disjunctive theorem becomes the negated antecedent of the newly generated theorem.

     A |- t1 \/ t2
   -----------------  DISJ_IMP
    A |- ~t1 ==> t2

Failure

Fails if the theorem is not a disjunction.

Example

Specializing the built-in theorem LESS_CASES gives the theorem:

   th = |- m < n \/ n <= m

to which DISJ_IMP may be applied:

   #DISJ_IMP th;;
   |- ~m < n ==> n <= m

See also

DISJ_CASES.

 distinct

distinct : (* list -> bool)

Synopsis

Checks whether the elements of a list are all distinct.

Description

If all the elements in a list are distinct, returns true, otherwise returns false.

\underline{do 141}

See also

setify.

 do
$do : (* -> void)

Synopsis

Evaluates an expression for its side-effects.

Description

The function do evaluates its argument (presumably for its side-effects) and returns the

value (): void.

Failure

Fails iff the evaluation of its argument fails.

Example

The following shows how an assignment can be evaluated for its side-effects:

   #letref x = 1;;
   x = 1 : int
   #x := x + 1;;
   2 : int
   #do (x := x + 1);;
   () : void
   #x := x + 1;;
   4 : int

Comments

The use of do as if it were a normal ML function should not be confused with its role as a syntactic construct in a while loop. For example, following on from the above example, consider the following:

   #while x > 0 do do (x := x - 1);;
   () : void
   #x;;
   0 : int

In the above, the first do is part of the while loop, whereas the second is function-like.

 draft_mode
draft_mode : (void -> bool)

Synopsis

Tests whether HOL is currently in draft mode.

Description

The call draft_mode() returns true if HOL is in draft mode (see DESCRIPTION for an explanation of what this means), and false otherwise.

Failure

Never fails.

Example

The following session assumes HOL is not in draft mode initially.

   #draft_mode();;
   false : bool
   #new_theory `spong`;;
   () : void
   #draft_mode();;
   true : bool
   #close_theory();;
   () : void
   #draft_mode();;
   false : bool

 dropout
dropout : (void -> void)

Synopsis

Move from top-level ML to top-level Lisp.

\underline{e 143}

Description

Unlike lsp, which breaks out of ML, and leaves one in a position to return to it by continuing lisp execution, dropout returns the user to the Lisp top-level. The function (tml) must then be invoked to return to ML. This is inherently dangerous (internal state may not be consistent), and should be avoided.

Failure

Never fails.

Example

          _________
   |___|__|   |  |   |     |__|  |__|
   |      |  |   |__|   |__|__|  |__|
          Version 1.12 (Sun3/Franz), built on Feb 23 1991
#dropout();;
[Return to top level]
-> ^D
EOF
-> (tml)
          _________
   |___|__|   |  |   |     |__|  |__|
   |      |  |   |__|   |__|__|  |__|
          Version 1.12 (Sun3/Franz), built on Feb 23 1991
##

Comments

The behaviour of dropout is unpredictable in Common Lisp, but performs as advertised in plain Franz Lisp. dropout is not meant for general use, and should be treated with great care. If one is not wary, it is entirely possible to corrupt HOL by using it.

See also

lisp, lsp.

 e
e : (tactic -> void)

144 Chapter 1. Pre-defined ML Identifiers

Synopsis

Applies a tactic to the current goal, stacking the resulting subgoals.

Description

The function e is part of the subgoal package. It is an abbreviation for expand. For a description of the subgoal package, see set_goal.

Failure

As for expand.

Uses

Doing a step in an interactive goal-directed proof.

See also

b, backup, backup_limit, expand, expandf, g, get_state, p, print_state, r,
rotate, save_top_thm, set_goal, set_state, top_goal, top_thm, VALID.
 el
el : (int -> * list -> *)

Synopsis

Extracts a specified element from a list.

Description

el i [x1;...;xn] returns xi. Note that the elements are numbered starting from 1, not

0.

Failure

Fails with el if the integer argument is less than 1 or greater than the length of the list.

Example

#el 3 [1;2;7;1];;
7 : int

See also

hd, tl.

\underline{ELL CONV 145}

 ELL_CONV
ELL_CONV : conv

Synopsis

Computes by inference the result of indexing an element of a list.

Description

For any object language list of the form "[xn-1;...;xk;...x0]" , the result of evaluating

   ELL_CONV "ELL k [xn-1;...;xk;...;x0]"

is the theorem

   |- ELL k [xn-1;...;xk;...;x0] = xk

where k must not be greater then the length of the list. Note that ELL index the list elements from the tail end.

Failure

ELL_CONV tm fails if tm is not of the form described above, or k is not less than the length of the list.

See also

EL_CONV
 EL_CONV
EL_CONV : conv

Synopsis

Computes by inference the result of indexing an element from a list.

Description

For any object language list of the form "[x0;...xk;...;xn]" , the result of evaluating

   EL_CONV "EL k [x0;...xk;...;xn]"

is the theorem

   |- EL k [x0;...;xk;...;xn] = xk

Failure

EL_CONV tm fails if tm is not of the form described above, or k is not less than the length of the list.

See also

ELL_CONV

 end_itlist

end_itlist : ((* -> * -> *) -> * list -> *)

Synopsis

List iteration function. Applies a binary function between adjacent elements of a list.

Description

end_itlist f [x1;...;xn] returns f x1 ( ... (f x(n-1) xn)...). Returns x for a one-

element list [x].

Failure

Fails with end_itlist if list is empty.

Example

#end_itlist (\x y. x + y) [1;2;3;4];;
10 : int

See also

itlist, rev_itlist.

 enter_form_rep

enter_form_rep : ((* # form # * list) -> * list)

Synopsis

This function is for internal use only and is to be deleted from a future version of the system. It should not be used.

 enter_term

enter_term : ((term # *) -> * term_net -> * term_net)

Synopsis

This function is for internal use only and is to be deleted from a future version of the system. It should not be used.

 enter_term_rep

enter_term_rep : ((* # term # * list) -> * list)

Synopsis

This function is for internal use only and is to be deleted from a future version of the system. It should not be used.

 EQF_ELIM

EQF_ELIM : (thm -> thm)

Synopsis

Replaces equality with F by negation.

Description

    A |- tm = F
   -------------  EQF_ELIM
     A |- ~tm

Failure

Fails if the argument theorem is not of the form A |- tm = F.

See also

EQF_INTRO, EQT_ELIM, EQT_INTRO.

 EQF_INTRO

EQF_INTRO : (thm -> thm)

Synopsis

Converts negation to equality with F.

Description

     A |- ~tm
   -------------  EQF_INTRO
    A |- tm = F

Failure

Fails if the argument theorem is not a negation.

See also

EQF_ELIM, EQT_ELIM, EQT_INTRO.

 EQT_ELIM

EQT_ELIM : (thm -> thm)

Synopsis

Eliminates equality with T.

Description

    A |- tm = T
   -------------  EQT_ELIM
      A |- tm

Failure

Fails if the argument theorem is not of the form A |- tm = T.

See also

EQT_INTRO, EQF_ELIM, EQF_INTRO.

 EQT_INTRO

EQT_INTRO : (thm -> thm)

Synopsis

Introduces equality with T.

Description

      A |- tm
   -------------  EQF_INTRO
    A |- tm = T

Failure

Never fails.

See also

EQT_ELIM, EQF_ELIM, EQF_INTRO.

 EQ_IMP_RULE

EQ_IMP_RULE : (thm -> (thm # thm))

Synopsis

Derives forward and backward implication from equality of boolean terms.

Description

When applied to a theorem A |- t1 = t2, where t1 and t2 both have type bool, the inference rule EQ_IMP_RULE returns the theorems A |- t1 ==> t2 and A |- t2 ==> t1.

              A |- t1 = t2
   -----------------------------------  EQ_IMP_RULE
    A |- t1 ==> t2     A |- t2 ==> t1

Failure

Fails unless the conclusion of the given theorem is an equation between boolean terms.

See also

EQ_MP, EQ_TAC, IMP_ANTISYM_RULE.

 EQ_LENGTH_INDUCT_TAC

EQ_LENGTH_INDUCT_TAC : tactic

Synopsis

Performs tactical proof by structural induction on two equal length lists.

Description

EQ_LENGTH_INDUCT_TAC reduces a goal !x y . (LENGTH x = LENGTH y) ==> t[x,y], where

x and y range over lists, to two subgoals corresponding to the base and step cases in a proof by induction on the length of x and y. The induction hypothesis appears among the assumptions of the subgoal for the step case. The specification of EQ_LENGTH_INDUCT_TAC is:

         A ?- !x y . (LENGTH x = LENGTH y) ==> t[x,y]
   ====================================================  EQ_LENGTH_INDUCT_TAC
                            A ?- t[NIL/x][NIL/y]
    A u {LENGTH x = LENGTH y, t[x'/x, y'/y]} ?-
         !h h'. t[(CONS h x)/x, (CONS h' y)/y]

Failure

EQ_LENGTH_INDUCT_TAC g fails unless the conclusion of the goal g has the form

   !x y . (LENGTH x = LENGTH y) ==> t[x,y]

where the variables x and y have types (xty)list and (yty)list for some types xty and yty. It also fails if either of the variables x or y appear free in the assumptions.

Uses

use this tactic when structural induction is performed on two lists and they have identical length.

See also

LIST_APPEND_INDUCT_TAC, LIST_INDUCT_TAC, SNOC_INDUCT_TAC,
LENGTH_LIST_INDUCT_TAC, EQ_LENGTH_SNOC_INDUCT_TAC.

 EQ_LENGTH_SNOC_INDUCT_TAC

EQ_LENGTH_SNOC_INDUCT_TAC : tactic

Synopsis

Performs tactical proof by structural induction on two equal length lists from the tail end.

Description

EQ_LENGTH_SNOC_INDUCT_TAC reduces a goal !x y . (LENGTH x = LENGTH y) ==> t[x,y],

where x and y range over lists, to two subgoals corresponding to the base and step cases in a proof by induction on the length of x and y. The induction hypothesis appears among the assumptions of the subgoal for the step case. The specification of

EQ_LENGTH_SNOC_INDUCT_TAC is:
     A ?- !x y . (LENGTH x = LENGTH y) ==> t[x,y]
   ================================================  EQ_LENGTH_SNOC_INDUCT_TAC
                            A ?- t[NIL/x][NIL/y]
    A u {LENGTH x = LENGTH y, t[x'/x, y'/y]} ?-
         !h h'. t[(SNOC h x)/x, (SNOC h' y)/y]

Failure

EQ_LENGTH_SNOC_INDUCT_TAC g fails unless the conclusion of the goal g has the form

   !x y . (LENGTH x = LENGTH y) ==> t[x,y]

where the variables x and y have types (xty)list and (yty)list for some types xty and yty. It also fails if either of the variables x or y appear free in the assumptions.

Uses

use this tactic when structural induction is performed on two lists and they have identical length.

152 Chapter 1. Pre-defined ML Identifiers

See also

LIST_APPEND_INDUCT_TAC, LIST_INDUCT_TAC, SNOC_INDUCT_TAC,
LENGTH_LIST_INDUCT_TAC, EQ_LENGTH_INDUCT_TAC
 EQ_MP
EQ_MP : (thm -> thm -> thm)

Synopsis

Equality version of the Modus Ponens rule.

Description

When applied to theorems A1 |- t1 = t2 and A2 |- t1, the inference rule EQ_MP returns the theorem A1 u A2 |- t2.

    A1 |- t1 = t2   A2 |- t1
   --------------------------  EQ_MP
         A1 u A2 |- t2

Failure

Fails unless the first theorem is equational and its left side is the same as the conclusion of the second theorem (and is therefore of type bool), up to alpha-conversion.

See also

EQ_IMP_RULE, IMP_ANTISYM_RULE, MP.
 EQ_TAC
EQ_TAC : tactic

Synopsis

Reduces goal of equality of boolean terms to forward and backward implication.

\underline{ETA CONV 153}

Description

When applied to a goal A ?- t1 = t2, where t1 and t2 have type bool, the tactic EQ_TAC returns the subgoals A ?- t1 ==> t2 and A ?- t2 ==> t1.

             A ?- t1 = t2
   =================================  EQ_TAC
    A ?- t1 ==> t2   A ?- t2 ==> t1

Failure

Fails unless the conclusion of the goal is an equation between boolean terms.

See also

EQ_IMP_RULE, IMP_ANTISYM_RULE.

 ETA_CONV

ETA_CONV : conv

Synopsis

Performs a toplevel eta-conversion.

Description

ETA_CONV maps an eta-redex "\x. t x", where x does not occur free in t, to the theorem

|- (\x. t x) = t.

Failure

Fails if the input term is not an eta-redex.

 EVERY

EVERY : (tactic list -> tactic)

Synopsis

Sequentially applies all the tactics in a given list of tactics.

Description

When applied to a list of tactics [T1; ... ;Tn], and a goal g, the tactical EVERY applies each tactic in sequence to every subgoal generated by the previous one. This can be represented as:

   EVERY [T1;...;Tn] = T1 THEN ... THEN Tn

If the tactic list is empty, the resulting tactic has no effect.

Failure

The application of EVERY to a tactic list never fails. The resulting tactic fails iff any of the component tactics do.

Comments

It is possible to use EVERY instead of THEN, but probably stylistically inferior. EVERY is more useful when applied to a list of tactics generated by a function.

See also

FIRST, MAP_EVERY, THEN.

 EVERY_ASSUM

EVERY_ASSUM : (thm_tactic -> tactic)

Synopsis

Sequentially applies all tactics given by mapping a function over the assumptions of a goal.

Description

When applied to a theorem-tactic f and a goal ({A1;...;An} ?- C), the EVERY_ASSUM tactical maps f over a list of ASSUMEd assumptions then applies the resulting tactics, in sequence, to the goal:

   EVERY_ASSUM f ({A1;...;An} ?- C)
    = (f(A1 |- A1) THEN ... THEN f(An |- An)) ({A1;...;An} ?- C)

If the goal has no assumptions, then EVERY_ASSUM has no effect.

Failure

The application of EVERY_ASSUM to a theorem-tactic and a goal fails if the theorem-tactic fails when applied to any of the ASSUMEd assumptions of the goal, or if any of the resulting tactics fail when applied sequentially.

See also

ASSUM_LIST, MAP_EVERY, MAP_FIRST, THEN.

 EVERY_CONV

EVERY_CONV : (conv list -> conv)

Synopsis

Applies in sequence all the conversions in a given list of conversions.

Description

EVERY_CONV [c1;...;cn] "t" returns the result of applying the conversions c1, ..., cn in sequence to the term "t". The conversions are applied in the order in which they are given in the list. In particular, if ci "ti" returns |- ti=ti+1 for i from 1 to n, then EVERY_CONV [c1;...;cn] "t1" returns |- t1=t(n+1). If the supplied list of conversions is empty, then EVERY_CONV returns the identity conversion. That is, EVERY_CONV [] "t" returns |- t=t.

Failure

EVERY_CONV [c1;...;cn] "t" fails if any one of the conversions c1, ..., cn fails when applied in sequence as specified above.

See also

THENC.

 EVERY_TCL

EVERY_TCL : (thm_tactical list -> thm_tactical)

Synopsis

Composes a list of theorem-tacticals.

156 Chapter 1. Pre-defined ML Identifiers

Description

When given a list of theorem-tacticals and a theorem, EVERY_TCL simply composes their effects on the theorem. The effect is:

   EVERY_TCL [ttl1;...;ttln] = ttl1 THEN_TCL ... THEN_TCL ttln

In other words, if:

   ttl1 ttac th1 = ttac th2  ...  ttln ttac thn = ttac thn'

then:

   EVERY_TCL [ttl1;...;ttln] ttac th1 = ttac thn'

If the theorem-tactical list is empty, the resulting theorem-tactical behaves in the same way as ALL_THEN, the identity theorem-tactical.

Failure

The application to a list of theorem-tacticals never fails.

See also

FIRST_TCL, ORELSE_TCL, REPEAT_TCL, THEN_TCL.
 EXISTENCE
EXISTENCE : (thm -> thm)

Synopsis

Deduces existence from unique existence.

Description

When applied to a theorem with a unique-existentially quantified conclusion, EXISTENCE returns the same theorem with normal existential quantification over the same variable.

    A |- ?!x. p
   -------------  EXISTENCE
    A |- ?x. p

Failure

Fails unless the conclusion of the theorem is unique-existentially quantified.

\underline{EXISTS 157}

See also

EXISTS_UNIQUE_CONV.

 EXISTS

EXISTS : ((term # term) -> thm -> thm)

Synopsis

Introduces existential quantification given a particular witness.

Description

When applied to a pair of terms and a theorem, the first term an existentially quantified pattern indicating the desired form of the result, and the second a witness whose substitution for the quantified variable gives a term which is the same as the conclusion of the theorem, EXISTS gives the desired theorem.

    A |- p[u/x]
   -------------  EXISTS ("?x. p","u")
    A |- ?x. p

Failure

Fails unless the substituted pattern is the same as the conclusion of the theorem.

Example

The following examples illustrate how it is possible to deduce different things from the same theorem:

   #EXISTS ("?x. x=T","T") (REFL "T");;
   |- ?x. x = T
   #EXISTS ("?x:bool. x=x","T") (REFL "T");;
   |- ?x. x = x

See also

CHOOSE, EXISTS_TAC.

 exists

exists : ((* -> bool) -> * list -> bool)

Synopsis

Tests a list to see if it has at least one element satisfying a predicate.

Description

exists p l applies p to the elements of l in order until one is found which satisfies p, or until the list is exhausted, returning true or false accordingly.

Failure

Never fails.

See also

forall, find, tryfind, mem, assoc, rev_assoc.

 EXISTS_AND_CONV

EXISTS_AND_CONV : conv

Synopsis

Moves an existential quantification inwards through a conjunction.

Description

When applied to a term of the form ?x. P /\ Q, where x is not free in both P and Q, EXISTS_AND_CONV returns a theorem of one of three forms, depending on occurrences of the variable x in P and Q. If x is free in P but not in Q, then the theorem:

   |- (?x. P /\ Q) = (?x.P) /\ Q

is returned. If x is free in Q but not in P, then the result is:

   |- (?x. P /\ Q) = P /\ (?x.Q)

And if x is free in neither P nor Q, then the result is:

   |- (?x. P /\ Q) = (?x.P) /\ (?x.Q)

Failure

EXISTS_AND_CONV fails if it is applied to a term not of the form ?x. P /\ Q, or if it is applied to a term ?x. P /\ Q in which the variable x is free in both P and Q.

See also

AND_EXISTS_CONV, LEFT_AND_EXISTS_CONV, RIGHT_AND_EXISTS_CONV.

 EXISTS_EQ

EXISTS_EQ : (term -> thm -> thm)

Synopsis

Existentially quantifies both sides of an equational theorem.

Description

When applied to a variable x and a theorem whose conclusion is equational, A |- t1 = t2, the inference rule EXISTS_EQ returns the theorem A |- (?x. t1) = (?x. t2), provided the variable x is not free in any of the assumptions.

         A |- t1 = t2
   ------------------------  EXISTS_EQ "x"      [where x is not free in A]
    A |- (?x.t1) = (?x.t2)

Failure

Fails unless the theorem is equational with both sides having type bool, or if the term is not a variable, or if the variable to be quantified over is free in any of the assumptions.

See also

AP_TERM, EXISTS_IMP, FORALL_EQ, MK_EXISTS, SELECT_EQ.

 EXISTS_GREATEST_CONV

EXISTS_GREATEST_CONV : conv

Synopsis

Proves that a nonempty bounded set of natural numbers has a greatest element.

Description

The call

   EXISTS_GREATEST_CONV "(?x. P[x]) /\ (?y. !z. z > y ==> ~P[z])"

returns the theorem

   (?x. P[x]) /\ (?y. !z. z > y ==> ~P[z]) = ?x. P[x] /\ !z. z > x ==> ~P[z]

This expresses the equivalence of the statements ‘a property P is true for some number 160 Chapter 1. Pre-defined ML Identifiers

x, and there is a limit y beyond which P is not true’ and ‘there is a greatest number such that P is true’.

Failure

EXISTS_GREATEST_CONV tm fails unless tm has the form specified above.

See also

EXISTS_LEAST_CONV.
 EXISTS_IMP
EXISTS_IMP : (term -> thm -> thm)

Synopsis

Existentially quantifies both the antecedent and consequent of an implication.

Description

When applied to a variable x and a theorem A |- t1 ==> t2, the inference rule EXISTS_IMP returns the theorem A |- (?x. t1) ==> (?x. t2), provided x is not free in the assumptions.

         A |- t1 ==> t2
   --------------------------  EXISTS_IMP "x"   [where x is not free in A]
    A |- (?x.t1) ==> (?x.t2)

Failure

Fails if the theorem is not implicative, or if the term is not a variable, or if the term is a variable but is free in the assumption list.

See also

EXISTS_EQ.
 EXISTS_IMP_CONV
EXISTS_IMP_CONV : conv

Synopsis

Moves an existential quantification inwards through an implication.

Description

When applied to a term of the form ?x. P ==> Q, where x is not free in both P and Q, EXISTS_IMP_CONV returns a theorem of one of three forms, depending on occurrences of the variable x in P and Q. If x is free in P but not in Q, then the theorem:

   |- (?x. P ==> Q) = (!x.P) ==> Q

is returned. If x is free in Q but not in P, then the result is:

   |- (?x. P ==> Q) = P ==> (?x.Q)

And if x is free in neither P nor Q, then the result is:

   |- (?x. P ==> Q) = (!x.P) ==> (?x.Q)

Failure

EXISTS_IMP_CONV fails if it is applied to a term not of the form ?x. P ==> Q, or if it is applied to a term ?x. P ==> Q in which the variable x is free in both P and Q.

See also

LEFT_IMP_FORALL_CONV, RIGHT_IMP_EXISTS_CONV.

 EXISTS_LEAST_CONV

EXISTS_LEAST_CONV : conv

Synopsis

Applies the well-ordering property of the natural numbers.

Description

Given a term of the form "?n:num.P[n]", the conversion EXISTS_LEAST_CONV proves that this assertion is equivalent to the statement that there is a least number n such that P[n] holds. The theorem returned is:

   |- (?n. P[n]) = ?n. P[n] /\ !n'. (n' < n) ==> ~P[n']

where n' is a primed variant of n that does not appear free in the input term. Note that the variable n need not in fact appear free in the body of the existentially-quantified input term. For example, EXISTS_LEAST_CONV "?n:num.T" returns the theorem:

   |- (?n. T) = (?n. T /\ (!n'. n' < n ==> ~T))

Failure

EXISTS_LEAST_CONV tm fails if tm is not of the form "?n:num.P".

See also

EXISTS_GREATEST_CONV.

 EXISTS_NOT_CONV

EXISTS_NOT_CONV : conv

Synopsis

Moves an existential quantification inwards through a negation.

Description

When applied to a term of the form ?x.~P, the conversion EXISTS_NOT_CONV returns the theorem:

   |- (?x.~P) = ~(!x. P)

Failure

Fails if applied to a term not of the form ?x.~P.

See also

FORALL_NOT_CONV, NOT_EXISTS_CONV, NOT_FORALL_CONV.

 EXISTS_OR_CONV

EXISTS_OR_CONV : conv

Synopsis

Moves an existential quantification inwards through a disjunction.

Description

When applied to a term of the form ?x. P \/ Q, the conversion EXISTS_OR_CONV returns the theorem:

   |- (?x. P \/ Q) = (?x.P) \/ (?x.Q)

Failure

Fails if applied to a term not of the form ?x. P \/ Q.

See also

OR_EXISTS_CONV, LEFT_OR_EXISTS_CONV, RIGHT_OR_EXISTS_CONV.

 EXISTS_TAC

EXISTS_TAC : (term -> tactic)

Synopsis

Reduces existentially quantified goal to one involving a specific witness.

Description

When applied to a term u and a goal ?x. t, the tactic EXISTS_TAC reduces the goal to t[u/x] (substituting u for all free instances of x in t, with variable renaming if necessary to avoid free variable capture).

    A ?- ?x. t
   =============  EXISTS_TAC "u"
    A ?- t[u/x]

Failure

Fails unless the goal’s conclusion is existentially quantified and the term supplied has the same type as the quantified variable in the goal.

Example

The goal:

   ?- ?x. x=T

can be solved by:

   EXISTS_TAC "T" THEN REFL_TAC

See also

EXISTS.

 EXISTS_UNIQUE_CONV

EXISTS_UNIQUE_CONV : conv

Synopsis

Expands with the definition of unique existence.

Description

Given a term of the form "?!x.P[x]", the conversion EXISTS_UNIQUE_CONV proves that this assertion is equivalent to the conjunction of two statements, namely that there exists at least one value x such that P[x], and that there is at most one value x for which P[x] holds. The theorem returned is:

   |- (?! x. P[x]) = (?x. P[x]) /\ (!x x'. P[x] /\ P[x'] ==> (x = x'))

where x' is a primed variant of x that does not appear free in the input term. Note that the quantified variable x need not in fact appear free in the body of the input term. For example, EXISTS_UNIQUE_CONV "?!x.T" returns the theorem:

   |- (?! x. T) = (?x. T) /\ (!x x'. T /\ T ==> (x = x'))

Failure

EXISTS_UNIQUE_CONV tm fails if tm does not have the form "?!x.P".

See also

EXISTENCE.

 expand

expand : (tactic -> void)

Synopsis

Applies a tactic to the current goal, stacking the resulting subgoals.

Description

The function expand is part of the subgoal package. It may be abbreviated by the function e. It applies a tactic to the current goal to give a new proof state. The previous state is \underline{expand 165}

stored on the backup list. If the tactic produces subgoals, the new proof state is formed from the old one by removing the current goal from the goal stack and adding a new level consisting of its subgoals. The corresponding justification is placed on the justification stack. The new subgoals are printed. If more than one subgoal is produced, they are printed from the bottom of the stack so that the new current goal is printed last.

If a tactic solves the current goal (returns an empty subgoal list), then its justification is used to prove a corresponding theorem. This theorem is incorporated into the justification of the parent goal and printed. If the subgoal was the last subgoal of the level, the level is removed and the parent goal is proved using its (new) justification. This process is repeated until a level with unproven subgoals is reached. The next goal on the goal stack then becomes the current goal. This goal is printed. If all the subgoals are proved, the resulting proof state consists of the theorem proved by the justifications.

The tactic applied is a validating version of the tactic given. It ensures that the justification of the tactic does provide a proof of the goal from the subgoals generated by the tactic. It will cause failure if this is not so. The tactical VALID performs this validation.

For a description of the subgoal package, see set_goal.

Failure

expand tac fails if the tactic tac fails for the top goal. It will diverge if the tactic diverges for the goal. It will fail if there are no unproven goals. This could be because no goal has been set using set_goal or because the last goal set has been completely proved. It will also fail in cases when the tactic is invalid.

Example

#expand CONJ_TAC;;
OK..
evaluation failed     no goals to expand
#g "(HD[1;2;3] = 1) /\ (TL[1;2;3] = [2;3])";;
"(HD[1;2;3] = 1) /\ (TL[1;2;3] = [2;3])"
() : void
#expand CONJ_TAC;;
OK..
2 subgoals
"TL[1;2;3] = [2;3]"
"HD[1;2;3] = 1"
() : void
#expand (REWRITE_TAC[HD]);;
OK..
goal proved
|- HD[1;2;3] = 1
Previous subproof:
"TL[1;2;3] = [2;3]"
() : void
#expand (REWRITE_TAC[TL]);;
OK..
goal proved
|- TL[1;2;3] = [2;3]
|- (HD[1;2;3] = 1) /\ (TL[1;2;3] = [2;3])
Previous subproof:
goal proved
() : void

In the following example an invalid tactic is used. It is invalid because it assumes something that is not on the assumption list of the goal. The justification adds this assumption \underline{expandf 167}

to the assumption list so the justification would not prove the goal that was set.

#set_goal([],"1=2");;
"1 = 2"
() : void
#expand (REWRITE_TAC[ASSUME "1=2"]);;
OK..
evaluation failed     Invalid tactic

Uses

Doing a step in an interactive goal-directed proof.

See also

b, backup, backup_limit, e, expandf, g, get_state, p, print_state, r, rotate,
save_top_thm, set_goal, set_state, top_goal, top_thm, VALID.

 expandf

expandf : (tactic -> void)

Synopsis

Applies a tactic to the current goal, stacking the resulting subgoals.

Description

The function expandf is a faster version of expand. It does not use a validated version of the tactic. That is, no check is made that the justification of the tactic does prove the goal from the subgoals it generates. If an invalid tactic is used, the theorem ultimately proved may not match the goal originally set. Alternatively, failure may occur when the justifications are applied in which case the theorem would not be proved. For a description of the subgoal package, see under set_goal.

Failure

Calling expandf tac fails if the tactic tac fails for the top goal. It will diverge if the tactic diverges for the goal. It will fail if there are no unproven goals. This could be because no goal has been set using set_goal or because the last goal set has been completely proved. If an invalid tactic, whose justification actually fails, has been used earlier in the proof, expandf tac may succeed in applying tac and apparently prove the current goal. It may then fail as it applies the justifications of the tactics applied earlier.

Example

   #g "HD[1;2;3] = 1";;
   "HD[1;2;3] = 1"
   () : void
   #expandf (REWRITE_TAC[HD;TL]);;
   OK..
   goal proved
   |- HD[1;2;3] = 1
   Previous subproof:
   goal proved
   () : void

The following example shows how the use of an invalid tactic can yield a theorem which does not correspond to the goal set.

   #set_goal([],"1=2");;
   "1 = 2"
   () : void
   #expandf (REWRITE_TAC[ASSUME "1=2"]);;
   OK..
   goal proved
   . |- 1 = 2
   Previous subproof:
   goal proved
   () : void

The proof assumed something which was not on the assumption list. This assumption appears in the assumption list of the theorem proved, even though it was not in the goal. An attempt to perform the proof using expand fails. The validated version of the tactic detects that the justification produces a theorem which does not correspond to the goal set. It therefore fails.

Uses

Saving CPU time when doing goal-directed proofs, since the extra validation is not done. Redoing proofs quickly that are already known to work.

Comments

The CPU time saved may cause misery later. If an invalid tactic is used, this will only be discovered when the proof has apparently been finished and the justifications are applied.

\underline{explode 169}

See also

b, backup, backup_limit, e, expand, g, get_state, p, print_state, r, rotate,
save_top_thm, set_goal, set_state, top_goal, top_thm, VALID.
 explode
explode : (string -> string list)

Synopsis

Converts a string into a list of single-character strings.

Description

explode s returns the list of single-character strings that make up s, in the order in which they appear in s. If s is the empty string, then an empty list is returned.

Failure

Never fails.

Example

#explode `example`;;
[`e`; `x`; `a`; `m`; `p`; `l`; `e`] : string list

See also

implode, concat, concatl.
 EXT
EXT : (thm -> thm)

Synopsis

Derives equality of functions from extentional equivalence.

Description

When applied to a theorem A |- !x. t1 x = t2 x, the inference rule EXT returns the

theorem A |- t1 = t2.
    A |- !x. t1 x = t2 x
   ----------------------  EXT          [where x is not free in t1 or t2]
        A |- t1 = t2

Failure

Fails if the theorem does not have the form indicated above, or if the variable x is free either of the functions t1 or t2.

See also

AP_THM, ETA_CONV, FUN_EQ_CONV.

 extend_theory

extend_theory : (string -> void)

Synopsis

Allows an existing theory to be extended.

Description

Calling extend_theory `thy` loads the existing theory thy into the system and makes it the current theory. The message ‘Theory thy loaded’ is printed. The theory is entered in draft mode. This allows new axioms, constants, types, constant specifications, infix constants, binders and parents to be added to the theory segment. Inconsistencies may be introduced to the theory if inconsistent axioms are asserted. New theorems can also be added as when in proof mode. If new type or constant names are added to theory thy which clash with names in any of its descendants, later attempts to load those descendants will fail. The extensions to the theory segment might not be written to the theory file until the session is finished with a call to close_theory. If HOL is quitted without closing the session with close_theory, parts of the theory segment created during the session may be lost. If the system is in draft mode when a call to extend_theory is made, the previous session is closed; all changes made in it will be written to the associated theory file.

Failure

A call to extend_theory `thy` will fail if theory thy does not appear on the current search path. It will fail unless theory thy is either the current theory or a descendant of it. It will

\underline{FAIL TAC 171}

fail if any of the theory files of the theory thy have been damaged. It will also fail if an ancestor of theory thy has been extended with either new types or constants which clash with names in theory thy. Since it could involve writing to the file system, if a write fails for any reason extend_theory will fail. On failure, the system recovers cleanly, unloading any theory segments it had loaded before the failure was detected. It will diverge if the theory hierarchy within theory thy contains loops, so that a theory segment is its own ancestor.

Uses

The normal way to build upon a theory is to use it as a parent. You should only use extend_theory to add declarations, etc., that were mistakenly omitted from a theory.

Comments

It would be difficult to implement the necessary checks to ensure that added types, constants, etc., did not invalidate declarations in the descendant theories.

See also

load_theory, new_parent, new_theory, print_theory, search_path.

 FAIL_TAC

FAIL_TAC : (string -> tactic)

Synopsis

Tactic which always fails, with the supplied string.

Description

Whatever goal it is applied to, FAIL_TAC s always fails with the string s.

Failure

The application of FAIL_TAC to a string never fails; the resulting tactic always fails.

Example

The following example uses the fact that if a tactic t1 solves a goal, then the tactic t1 THEN t2 never results in the application of t2 to anything, because t1 produces no 172 Chapter 1. Pre-defined ML Identifiers subgoals. In attempting to solve the following goal:

   ?- x => T | T

the tactic

   REWRITE_TAC[] THEN FAIL_TAC `Simple rewriting failed to solve goal`

will fail with the message provided, whereas:

   CONV_TAC COND_CONV THEN FAIL_TAC `Using COND_CONV failed to solve goal`

will silently solve the goal because COND_CONV reduces it to just ?- T.

See also

ALL_TAC, NO_TAC.
 falsity
falsity : term

Synopsis

Contains the constant "F:bool".

 fast_arith
fast_arith : (bool -> void)

Synopsis

Switches fast, finite-precision arithmetic either on or off.

Description

HOL normally does arithmetic using arbitrary precision. It can be changed to use faster, finite-precision arithmetic by fast_arith true, and the normal behaviour restored with fast_arith false. The current state does not affect the mode of arithmetic in previously defined functions, such as num_CONV.

\underline{filter 173}

Failure

Never fails.

Example

#fast_arith true;;
() : void
#let pow2 x = funpow x (curry $* 2) 1;;
pow2 = - : (int -> int)
#map pow2 [30; 31; 32; 33];;
[1073741824; -2147483648; 0; 0] : int list

Comments

This function is extremely dependent on the version of Lisp used, and its behaviour should not be relied upon; it may not work at all in Lisps other than Franz. It is questionable whether it is ever worthwhile to use it anyway, because although it cannot compromise the consistency of the logic, it can lead to confusing failures if one is manipulating numbers larger than the word size of the machine.

 filter

filter : ((* -> bool) -> * list -> * list)

Synopsis

Filters a list to the sublist of elements satisfying a predicate.

Description

filter p l applies p to every element of l, returning a list of those that satisfy p, in the order they appeared in the original list.

Failure

Never fails.

See also

mapfilter, partition, remove.

 FILTER_ASM_REWRITE_RULE

FILTER_ASM_REWRITE_RULE : ((term -> bool) -> thm list -> thm -> thm)

Synopsis

Rewrites a theorem including built-in rewrites and some of the theorem’s assumptions.

Description

This function implements selective rewriting with a subset of the assumptions of the theorem. The first argument (a predicate on terms) is applied to all assumptions, and the ones which return true are used (along with the set of basic tautologies and the given theorem list) to rewrite the theorem. See GEN_REWRITE_RULE for more information on rewriting.

Failure

FILTER_ASM_REWRITE_RULE does not fail. Using FILTER_ASM_REWRITE_RULE may result in

a diverging sequence of rewrites. In such cases FILTER_ONCE_ASM_REWRITE_RULE may be used.

Uses

This rule can be applied when rewriting with all assumptions results in divergence. Typically, the predicate can model checks as to whether a certain variable appears on the left-hand side of an equational assumption, or whether the assumption is in disjunctive form.

Another use is to improve performance when there are many assumptions which are not applicable. Rewriting, though a powerful method of proving theorems in HOL, can result in a reduced performance due to the pattern matching and the number of primitive inferences involved.

See also

ASM_REWRITE_RULE, FILTER_ONCE_ASM_REWRITE_RULE, FILTER_PURE_ASM_REWRITE_RULE,
FILTER_PURE_ONCE_ASM_REWRITE_RULE, GEN_REWRITE_RULE, ONCE_REWRITE_RULE,
PURE_REWRITE_RULE, REWRITE_RULE.

 FILTER_ASM_REWRITE_TAC

FILTER_ASM_REWRITE_TAC : ((term -> bool) -> thm list -> tactic)

Synopsis

Rewrites a goal including built-in rewrites and some of the goal’s assumptions.

Description

This function implements selective rewriting with a subset of the assumptions of the goal. The first argument (a predicate on terms) is applied to all assumptions, and the ones which return true are used (along with the set of basic tautologies and the given theorem list) to rewrite the goal. See GEN_REWRITE_TAC for more information on rewriting.

Failure

FILTER_ASM_REWRITE_TAC does not fail, but it can result in an invalid tactic if the rewrite is invalid. This happens when a theorem used for rewriting has assumptions which are not alpha-convertible to assumptions of the goal. Using FILTER_ASM_REWRITE_TAC may result in a diverging sequence of rewrites. In such cases FILTER_ONCE_ASM_REWRITE_TAC may be used.

Uses

This tactic can be applied when rewriting with all assumptions results in divergence, or in an unwanted proof state. Typically, the predicate can model checks as to whether a certain variable appears on the left-hand side of an equational assumption, or whether the assumption is in disjunctive form. Thus it allows choice of assumptions to rewrite with in a position-independent fashion.

Another use is to improve performance when there are many assumptions which are not applicable. Rewriting, though a powerful method of proving theorems in HOL, can result in a reduced performance due to the pattern matching and the number of primitive inferences involved.

See also

ASM_REWRITE_TAC, FILTER_ONCE_ASM_REWRITE_TAC, FILTER_PURE_ASM_REWRITE_TAC,
FILTER_PURE_ONCE_ASM_REWRITE_TAC, GEN_REWRITE_TAC, ONCE_REWRITE_TAC,
PURE_REWRITE_TAC, REWRITE_TAC.

 FILTER_CONV

FILTER_CONV : conv -> conv

Synopsis

Computes by inference the result of applying a predicate to elements of a list.

176 Chapter 1. Pre-defined ML Identifiers

Description

FILTER_CONV takes a conversion conv and a term tm in the following form:

   FILTER P [x0;...xn]

It returns the theorem

   |- FILTER P [x0;...xn] = [...xi...]

where for every xi occurred in the right-hand side of the resulting theorem, conv "P xi" returns a theorem |- P xi = T.

Failure

FILTER_CONV conv tm fails if tm is not of the form described above.

Example

Evaluating

   FILTER_CONV bool_EQ_CONV "FILTER ($= T) [T;F;T]";;

returns the following theorem:

   |- FILTER($= T)[T;F;T] = [T;T]

In general, if the predicate P is an explicit lambda abstraction (\x. P x), the conversion should be in the form

   (BETA_CONV THENC conv')

See also

FOLDL_CONV, FOLDR_CONV, list_FOLD_CONV.

 FILTER_DISCH_TAC
FILTER_DISCH_TAC : (term -> tactic)

Synopsis

Conditionally moves the antecedent of an implicative goal into the assumptions.

Description

FILTER_DISCH_TAC will move the antecedent of an implication into the assumptions, provided its parameter does not occur in the antecedent.

    A ?- u ==> v
   ==============  FILTER_DISCH_TAC "w"
    A u {u} ?- v

Note that DISCH_TAC treats "~u" as "u ==> F". Unlike DISCH_TAC, the antecedent will be STRIPed into its various components before being ASSUMEd. This stripping includes generating multiple goals for case-analysis of disjunctions. Also, unlike DISCH_TAC, should any component of the discharged antecedent directly imply or contradict the goal, then this simplification will also be made. Again, unlike DISCH_TAC, FILTER_DISCH_TAC will not duplicate identical or alpha-equivalent assumptions.

Failure

FILTER_DISCH_TAC will fail if a term which is identical, or alpha-equivalent to "w" occurs free in the antecedent, or if the theorem is not an implication or a negation.

Comments

FILTER_DISCH_TAC "w" behaves like FILTER_DISCH_THEN STRIP_ASSUME_TAC "w".

See also

DISCH, DISCH_ALL, DISCH_TAC, DISCH_THEN, FILTER_DISCH_THEN, NEG_DISCH,
STRIP_TAC, UNDISCH, UNDISCH_ALL, UNDISCH_TAC.

 FILTER_DISCH_THEN

FILTER_DISCH_THEN : (thm_tactic -> term -> tactic)

Synopsis

Conditionally gives to a theorem-tactic the antecedent of an implicative goal.

Description

If FILTER_DISCH_THEN’s second argument, a term, does not occur in the antecedent, then FILTER_DISCH_THEN removes the antecedent and then creates a theorem by ASSUMEing it.

This new theorem is passed to FILTER_DISCH_THEN’s first argument, which is subsequently expanded. For example, if

    A ?- t
   ========  f (ASSUME "u")
    B ?- v

then

    A ?- u ==> t
   ==============  FILTER_DISCH_THEN f
       B ?- v
Note that FILTER_DISCH_THEN treats "~u" as "u ==> F".

Failure

FILTER_DISCH_THEN will fail if a term which is identical, or alpha-equivalent to "w" occurs free in the antecedent. FILTER_DISCH_THEN will also fail if the theorem is an implication or a negation.

Comments

FILTER_DISCH_THEN is most easily understood by first understanding DISCH_THEN.

Uses

For preprocessing an antecedent before moving it to the assumptions, or for using antecedents and then throwing them away.

See also

DISCH, DISCH_ALL, DISCH_TAC, DISCH_THEN, FILTER_DISCH_TAC, NEG_DISCH,
STRIP_TAC, UNDISCH, UNDISCH_ALL, UNDISCH_TAC.

 FILTER_GEN_TAC

FILTER_GEN_TAC : (term -> tactic)

Synopsis

Strips off a universal quantifier, but fails for a given quantified variable.

Description

When applied to a term s and a goal A ?- !x. t, the tactic FILTER_GEN_TAC fails if the quantified variable x is the same as s, but otherwise advances the goal in the same way as GEN_TAC, i.e. returns the goal A ?- t[x'/x] where x' is a variant of x chosen to avoid clashing with any variables free in the goal’s assumption list. Normally x' is just x.

     A ?- !x. t
   ==============  FILTER_GEN_TAC "s"
    A ?- t[x'/x]

Failure

Fails if the goal’s conclusion is not universally quantified or the quantified variable is equal to the given term.

See also

GEN, GEN_TAC, GENL, GEN_ALL, SPEC, SPECL, SPEC_ALL, SPEC_TAC, STRIP_TAC.

 FILTER_ONCE_ASM_REWRITE_RULE

FILTER_ONCE_ASM_REWRITE_RULE : ((term -> bool) -> thm list -> thm -> thm)

Synopsis

Rewrites a theorem once including built-in rewrites and some of its assumptions.

Description

The first argument is a predicate applied to the assumptions. The theorem is rewritten with the assumptions for which the predicate returns true, the given list of theorems, and the tautologies stored in basic_rewrites. It searches the term of the theorem once, without applying rewrites recursively. Thus it avoids the divergence which can result from the application of FILTER_ASM_REWRITE_RULE. For more information on rewriting rules, see

GEN_REWRITE_RULE.

Failure

Never fails.

Uses

This function is useful when rewriting with a subset of assumptions of a theorem, allowing control of the number of rewriting passes.

See also

ASM_REWRITE_RULE, FILTER_ASM_REWRITE_RULE, FILTER_PURE_ASM_REWRITE_RULE,
FILTER_PURE_ONCE_ASM_REWRITE_RULE, GEN_REWRITE_RULE, ONCE_ASM_REWRITE_RULE,

ONCE_DEPTH_CONV, PURE_ASM_REWRITE_RULE, PURE_ONCE_ASM_REWRITE_RULE,
PURE_REWRITE_RULE, REWRITE_RULE.

 FILTER_ONCE_ASM_REWRITE_TAC

FILTER_ONCE_ASM_REWRITE_TAC : ((term -> bool) -> thm list -> tactic)

Synopsis

Rewrites a goal once including built-in rewrites and some of its assumptions.

Description

The first argument is a predicate applied to the assumptions. The goal is rewritten with the assumptions for which the predicate returns true, the given list of theorems, and the tautologies stored in basic_rewrites. It searches the term of the goal once, without applying rewrites recursively. Thus it avoids the divergence which can result from the application of FILTER_ASM_REWRITE_TAC. For more information on rewriting tactics, see

GEN_REWRITE_TAC.

Failure

Never fails.

Uses

This function is useful when rewriting with a subset of assumptions of a goal, allowing control of the number of rewriting passes.

See also

ASM_REWRITE_TAC, FILTER_ASM_REWRITE_TAC, FILTER_PURE_ASM_REWRITE_TAC,
FILTER_PURE_ONCE_ASM_REWRITE_TAC, GEN_REWRITE_TAC, ONCE_ASM_REWRITE_TAC,
ONCE_DEPTH_CONV, PURE_ASM_REWRITE_TAC, PURE_ONCE_ASM_REWRITE_TAC,
PURE_REWRITE_TAC, REWRITE_TAC.

 FILTER_PURE_ASM_REWRITE_RULE

FILTER_PURE_ASM_REWRITE_RULE : ((term -> bool) -> thm list -> thm ->thm)

Synopsis

Rewrites a theorem with some of the theorem’s assumptions.

Description

This function implements selective rewriting with a subset of the assumptions of the theorem. The first argument (a predicate on terms) is applied to all assumptions, and the ones which return true are used to rewrite the goal. See GEN_REWRITE_RULE for more information on rewriting.

Failure

FILTER_PURE_ASM_REWRITE_RULE does not fail. Using FILTER_PURE_ASM_REWRITE_RULE may

result in a diverging sequence of rewrites. In such cases FILTER_PURE_ONCE_ASM_REWRITE_RULE may be used.

Uses

This rule can be applied when rewriting with all assumptions results in divergence. Typically, the predicate can model checks as to whether a certain variable appears on the left-hand side of an equational assumption, or whether the assumption is in disjunctive form.

Another use is to improve performance when there are many assumptions which are not applicable. Rewriting, though a powerful method of proving theorems in HOL, can result in a reduced performance due to the pattern matching and the number of primitive inferences involved.

See also

ASM_REWRITE_RULE, FILTER_ASM_REWRITE_RULE, FILTER_ONCE_ASM_REWRITE_RULE,
FILTER_PURE_ONCE_ASM_REWRITE_RULE, GEN_REWRITE_RULE, ONCE_REWRITE_RULE,
PURE_REWRITE_RULE, REWRITE_RULE.

 FILTER_PURE_ASM_REWRITE_TAC

FILTER_PURE_ASM_REWRITE_TAC : ((term -> bool) -> thm list -> tactic)

Synopsis

Rewrites a goal with some of the goal’s assumptions.

Description

This function implements selective rewriting with a subset of the assumptions of the goal. The first argument (a predicate on terms) is applied to all assumptions, and the ones which return true are used to rewrite the goal. See GEN_REWRITE_TAC for more information on rewriting.

Failure

FILTER_PURE_ASM_REWRITE_TAC does not fail, but it can result in an invalid tactic if the rewrite is invalid. This happens when a theorem used for rewriting has assumptions which are not alpha-convertible to assumptions of the goal. Using FILTER_PURE_ASM_REWRITE_TAC may result in a diverging sequence of rewrites. In such cases FILTER_PURE_ONCE_ASM_REWRITE_TAC may be used.

Uses

This tactic can be applied when rewriting with all assumptions results in divergence, or in an unwanted proof state. Typically, the predicate can model checks as to whether a certain variable appears on the left-hand side of an equational assumption, or whether the assumption is in disjunctive form. Thus it allows choice of assumptions to rewrite with in a position-independent fashion.

Another use is to improve performance when there are many assumptions which are not applicable. Rewriting, though a powerful method of proving theorems in HOL, can result in a reduced performance due to the pattern matching and the number of primitive inferences involved.

See also

ASM_REWRITE_TAC, FILTER_ASM_REWRITE_TAC, FILTER_ONCE_ASM_REWRITE_TAC,
FILTER_PURE_ONCE_ASM_REWRITE_TAC, GEN_REWRITE_TAC, ONCE_REWRITE_TAC,
PURE_REWRITE_TAC, REWRITE_TAC.

 FILTER_PURE_ONCE_ASM_REWRITE_RULE

FILTER_PURE_ONCE_ASM_REWRITE_RULE : ((term -> bool) -> thm list -> thm -> thm)

Synopsis

Rewrites a theorem once using some of its assumptions.

Description

The first argument is a predicate applied to the assumptions. The theorem is rewritten with the assumptions for which the predicate returns true and the given list of theorems. It searches the term of the theorem once, without applying rewrites recursively. Thus it avoids the divergence which can result from the application of FILTER_PURE_ASM_REWRITE_RULE. For more information on rewriting rules, see GEN_REWRITE_RULE.

Uses

This function is useful when rewriting with a subset of assumptions of a theorem, allowing control of the number of rewriting passes.

See also

ASM_REWRITE_RULE, FILTER_ASM_REWRITE_RULE, FILTER_ONCE_ASM_REWRITE_RULE,
FILTER_PURE_ASM_REWRITE_RULE, GEN_REWRITE_RULE, ONCE_ASM_REWRITE_RULE,
ONCE_DEPTH_CONV, PURE_ASM_REWRITE_RULE, PURE_ONCE_ASM_REWRITE_RULE,
PURE_REWRITE_RULE, REWRITE_RULE.

 FILTER_PURE_ONCE_ASM_REWRITE_TAC
FILTER_PURE_ONCE_ASM_REWRITE_TAC : ((term -> bool) -> thm list -> tactic)

Synopsis

Rewrites a goal once using some of its assumptions.

Description

The first argument is a predicate applied to the assumptions. The goal is rewritten with the assumptions for which the predicate returns true and the given list of theorems. It searches the term of the goal once, without applying rewrites recursively. Thus it avoids the divergence which can result from the application of FILTER_PURE_ASM_REWRITE_TAC. For more information on rewriting tactics, see GEN_REWRITE_TAC.

Failure

Never fails.

Uses

This function is useful when rewriting with a subset of assumptions of a goal, allowing control of the number of rewriting passes.

See also

ASM_REWRITE_TAC, FILTER_ASM_REWRITE_TAC, FILTER_ONCE_ASM_REWRITE_TAC,
FILTER_PURE_ASM_REWRITE_TAC, GEN_REWRITE_TAC, ONCE_ASM_REWRITE_TAC,
ONCE_DEPTH_CONV, PURE_ASM_REWRITE_TAC, PURE_ONCE_ASM_REWRITE_TAC,
PURE_REWRITE_TAC, REWRITE_TAC.

 FILTER_STRIP_TAC
FILTER_STRIP_TAC : (term -> tactic)

Synopsis

Conditionally strips apart a goal by eliminating the outermost connective.

Description

Stripping apart a goal in a more careful way than is done by STRIP_TAC may be necessary when dealing with quantified terms and implications. FILTER_STRIP_TAC behaves like STRIP_TAC, but it does not strip apart a goal if it contains a given term.

If u is a term, then FILTER_STRIP_TAC u is a tactic that removes one outermost occurrence of one of the connectives !, ==>, ~ or /\ from the conclusion of the goal t, provided the term being stripped does not contain u. A negation ~t is treated as the implication t ==> F. FILTER_STRIP_TAC u also breaks apart conjunctions without applying any filtering.

If t is a universally quantified term, FILTER_STRIP_TAC u strips off the quantifier:

      A ?- !x.v
   ================  FILTER_STRIP_TAC "u"       [where x is not u]
     A ?- v[x'/x]

where x' is a primed variant that does not appear free in the assumptions A. If t is a conjunction, no filtering is done and FILTER_STRIP_TAC u simply splits the conjunction:

      A ?- v /\ w
   =================  FILTER_STRIP_TAC "u"
    A ?- v   A ?- w

If t is an implication and the antecedent does not contain a free instance of u, then FILTER_STRIP_TAC u moves the antecedent into the assumptions and recursively splits the antecedent according to the following rules (see STRIP_ASSUME_TAC):

    A ?- v1 /\ ... /\ vn ==> v            A ?- v1 \/ ... \/ vn ==> v
   ============================        =================================
       A u {v1,...,vn} ?- v             A u {v1} ?- v ... A u {vn} ?- v
     A ?- ?x.w ==> v
   ====================
    A u {w[x'/x]} ?- v

where x' is a variant of x.

Failure

FILTER_STRIP_TAC u (A,t) fails if t is not a universally quantified term, an implication, a negation or a conjunction; or if the term being stripped contains u in the sense described above (conjunction excluded).

Example

When trying to solve the goal

   ?- !n. m <= n /\ n <= m ==> (m = n)

the universally quantified variable n can be stripped off by using

   FILTER_STRIP_TAC "m:num"

and then the implication can be stripped apart by using

   FILTER_STRIP_TAC "m:num = n"

Uses

FILTER_STRIP_TAC is used when stripping outer connectives from a goal in a more delicate way than STRIP_TAC. A typical application is to keep stripping by using the tactic REPEAT (FILTER_STRIP_TAC u) until one hits the term u at which stripping is to stop.

See also

CONJ_TAC, FILTER_DISCH_TAC, FILTER_DISCH_THEN, FILTER_GEN_TAC,
STRIP_ASSUME_TAC, STRIP_TAC.

 FILTER_STRIP_THEN

FILTER_STRIP_THEN : (thm_tactic -> term -> tactic)

Synopsis

Conditionally strips a goal, handing an antecedent to the theorem-tactic.

Description

Given a theorem-tactic ttac, a term u and a goal (A,t), FILTER_STRIP_THEN ttac u removes one outer connective (!, ==>, or ~) from t, if the term being stripped does not contain a free instance of u. A negation ~t is treated as the implication t ==> F. The theorem-tactic ttac is applied only when stripping an implication, by using the antecedent stripped off. FILTER_STRIP_THEN also breaks conjunctions.

FILTER_STRIP_THEN behaves like STRIP_GOAL_THEN, if the term being stripped does not contain a free instance of u. In particular, FILTER_STRIP_THEN STRIP_ASSUME_TAC behaves

like FILTER_STRIP_TAC.

Failure

FILTER_STRIP_THEN ttac u (A,t) fails if t is not a universally quantified term, an implication, a negation or a conjunction; or if the term being stripped contains the term u (conjunction excluded); or if the application of ttac fails, after stripping the goal.

Example

When solving the goal

   ?- (n = 1) ==> (n * n = n)
the application of FILTER_STRIP_THEN SUBST1_TAC "m:num" results in the goal
   ?- 1 * 1 = 1

Uses

FILTER_STRIP_THEN is used when manipulating intermediate results using theorem-tactics, after stripping outer connectives from a goal in a more delicate way than STRIP_GOAL_THEN.

See also

CONJ_TAC, FILTER_DISCH_TAC, FILTER_DISCH_THEN, FILTER_GEN_TAC,
FILTER_STRIP_TAC, STRIP_ASSUME_TAC, STRIP_GOAL_THEN.

 find

find : ((* -> bool) -> * list -> *)

Synopsis

Returns the first element of a list which satisfies a predicate.

Description

find p [x1;...;xn] returns the first xi in the list such that (p xi) is true.

Failure

Fails with find if no element satisfies the predicate. This will always be the case if the list is empty.

See also

tryfind, mem, exists, forall, assoc, rev_assoc.

\underline{find file 187}

 find_file

find_file: (string -> string)

Synopsis

Searches for a named file.

Description

Searches for a named file using the search path, and returns the full pathname if successful (if the file is in the current directory, this will just be the argument string).

Failure

Fails if the named file cannot be found using the current search path.

Example

The answer from the following will depend on where HOL is installed:

   #find_file `combin.th`;;
   `/usr/groups/hol/HOL2/sun4_sos/theories/combin.th` : string

See also

find_ml_file, search_path, set_search_path

 find_match

find_match: (term -> term -> ((term # term) list # (type # type) list))

Synopsis

Determines whether a term matches a subterm of another term.

Description

Recursively destructs its second argument and attempts to match the resulting subterms with the first term. It returns a list of differing instances of free variables and types in the matched terms. The search is done in a depth-first, left-to-right order.

Failure

Fails if the none of the subterms of the second argument match the first.

Example

#find_match "a:num" "a:num";;
([], []) : ((term # term) list # (type # type) list)
#find_match "a:*" "T";;
([("T", "a")], [(":bool", ":*")])
: ((term # term) list # (type # type) list)
#find_match "x:num" "n < 2 ==> (a /\ b)";;
([("n", "x")], []) : ((term # term) list # (type # type) list)
#find_match "x:bool" "n < 2 ==> (a /\ b)";;
([("n < 2 ==> a /\ b", "x")], [])
: ((term # term) list # (type # type) list)
#find_match "x /\ y" "1 < 2 ==> (a /\ b)";;
([("b", "y"); ("a", "x")], [])
: ((term # term) list # (type # type) list)

See also

match, find_term, find_terms

 find_ml_file

find_ml_file: (string -> string)

Synopsis

Searches for a named ML file.

Description

Given a `.ml` suffixed string `foo.ml`, find_ml_file searches for the ML source file foo.ml. If the given string does not have a `.ml` suffix, then find_ml_file searches for the object file foo_ml.o or the ML source file foo.ml. If the object file exists, then its name is returned. Otherwise, the name of the ML source file is returned if it exists.

Failure

Fails if the appropriate file cannot be found using the current search path.

\underline{find term 189}

Example

#find_ml_file `foo`;;
`foo_ml.o` : string
#find_ml_file `foo.ml`;;
`foo.ml` : string

Uses

Typically used to determine whether an object file exists for a named ML source file.

See also

find_file, search_path, set_search_path

 find_term

find_term: ((term -> bool) -> term -> term)

Synopsis

Searches a term for a subterm that satisfies a given predicate.

Description

The largest subterm, in a depth-first, left-to-right search of the given term, that satisfies the predicate is returned.

Failure

Fails if no subterm of the given term satisfies the predicate.

Example

#find_term is_pred "SUC 0";;
"SUC 0" : term
#find_term is_const "SUC 0";;
"SUC" : term
#find_term is_var "SUC n";;
"n" : term

See also

find_terms

 find_terms

find_terms : ((term -> bool) -> term -> term list)

Synopsis

Searches a term for all subterms that satisfy a predicate.

Description

A list of subterms of a given term that satisfy the predicate is returned. The terms may not be disjoint.

Failure

Fails if no subterm of the given term satisfies the predicate.

Example

The following shows that the terms returned may overlap or contain each other:

   #find_terms (\tm. rator tm = "SUC" ? false) "SUC(SUC 1 + SUC 2)";;
   ["SUC 2"; "SUC 1"; "SUC((SUC 1) + (SUC 2))"] : term list

See also

find_term.

 find_theory

find_theory : (string -> string)

Synopsis

Attempts to find a named theory.

Description

Given a string `foo`, find_theory attempts to find the theory file `foo.th` using the current search path. If it succeeds, it returns a full pathname (possibly a relative pathname identical to the argument string).

Failure

Fails if the named theory file cannot be found using the current search path.

\underline{FIRST 191}

Example

#find_theory `num`;;
`/usr/groups/hol/HOL2/sun4_sos/theories/num.th` : string

See also

find_file, find_ml_file, search_path, set_search_path.

 FIRST

FIRST : (tactic list -> tactic)

Synopsis

Applies the first tactic in a tactic list which succeeds.

Description

When applied to a list of tactics [T1;...;Tn], and a goal g, the tactical FIRST tries applying the tactics to the goal until one succeeds. If the first tactic which succeeds is Tm, then the effect is the same as just Tm. Thus FIRST effectively behaves as follows:

   FIRST [T1;...;Tn] = T1 ORELSE ... ORELSE Tn

Failure

The application of FIRST to a tactic list never fails. The resulting tactic fails iff all the component tactics do when applied to the goal, or if the tactic list is empty.

See also

EVERY, ORELSE.

 FIRSTN_CONV

FIRSTN_CONV : conv

Synopsis

Computes by inference the result of taking the initial n elements of a list.

Description

For any object language list of the form "[x0;...x(n-k);...;x(n-1)]" , the result of evaluating

   FIRSTN_CONV "FIRSTN k [x0;...x(n-k);...;x(n-1)]"

is the theorem

   |- FIRSTN k [x0;...;x(n-k);...;x(n-1)] = [x0;...;x(n-k)]

Failure

FIRSTN_CONV tm fails if tm is not of the form described above, or k is greater than the length of the list.

 FIRST_ASSUM

FIRST_ASSUM : (thm_tactic -> tactic)

Synopsis

Maps a theorem-tactic over the assumptions, applying first successful tactic.

Description

The tactic

   FIRST_ASSUM ttac ([A1; ...; An], g)

has the effect of applying the first tactic which can be produced by ttac from the ASSUMEd assumptions (A1 |- A1), ..., (An |- An) and which succeeds when applied to the goal. Failures of ttac to produce a tactic are ignored.

Failure

Fails if ttac (Ai |- Ai) fails for every assumption Ai, or if the assumption list is empty, or if all the tactics produced by ttac fail when applied to the goal.

Example

The tactic

   FIRST_ASSUM (\asm. CONTR_TAC asm  ORELSE  ACCEPT_TAC asm)

searches the assumptions for either a contradiction or the desired conclusion. The tactic

   FIRST_ASSUM MATCH_MP_TAC

searches the assumption list for an implication whose conclusion matches the goal, reducing the goal to the antecedent of the corresponding instance of this implication.

See also

ASSUM_LIST, EVERY, EVERY_ASSUM, FIRST, MAP_EVERY, MAP_FIRST.

 FIRST_CONV

FIRST_CONV : (conv list -> conv)

Synopsis

Apply the first of the conversions in a given list that succeeds.

Description

FIRST_CONV [c1;...;cn] "t" returns the result of applying to the term "t" the first conversion ci that succeeds when applied to "t". The conversions are tried in the order in which they are given in the list.

Failure

FIRST_CONV [c1;...;cn] "t" fails if all the conversions c1, ..., cn fail when applied to the term "t". FIRST_CONV cs "t" also fails if cs is the empty list.

See also

ORELSEC.

 FIRST_TCL

FIRST_TCL : (thm_tactical list -> thm_tactical)

Synopsis

Applies the first theorem-tactical in a list which succeeds.

Description

When applied to a list of theorem-tacticals, a theorem-tactic and a theorem, FIRST_TCL returns the tactic resulting from the application of the first theorem-tactical to the theoremtactic and theorem which succeeds. The effect is the same as:

   FIRST_TCL [ttl1;...;ttln] = ttl1 ORELSE_TCL ... ORELSE_TCL ttln

Failure

FIRST_TCL fails iff each tactic in the list fails when applied to the theorem-tactic and theorem. This is trivially the case if the list is empty.

See also

EVERY_TCL, ORELSE_TCL, REPEAT_TCL, THEN_TCL.

 flags

flags : (void -> string list)

Synopsis

Returns a list of settable system flags.

Description

Given the void argument (), flags returns a list of settable system flags. The default values of these flags can be altered by set_flag.

Comments

A full explanation of the standard flags is given in the DESCRIPTION.

See also

set_flag.

 flat

flat : (* list list -> * list)

Synopsis

Flattens a list of lists into one long list.

Description

flat [l1;...;ln] returns (l1 @ ... @ ln) where each li is a list and @ is list concatenation.

Failure

Never fails.

Example

#flat [[1;2];[3;4;5];[6]];;
[1; 2; 3; 4; 5; 6] : int list

 FLAT_CONV

FLAT_CONV : conv

Synopsis

Computes by inference the result of flattening a list of lists.

Description

FLAT_CONV a term tm in the following form:

   FLAT [[x00;...x0n]; ...; [xm0;...xmn]]

It returns the theorem

   |- FLAT  [[x00;...x0n]; ...; [xm0;...xmn]] =
[x00;...x0n; ...; xm0;...xmn]

Failure

FLAT_CONV tm fails if tm is not of the form described above.

196 Chapter 1. Pre-defined ML Identifiers

Example

Evaluating

   FLAT_CONV "FLAT [[0;2;4];[0;1;2;3;4]]";;

returns the following theorem:

   |- FLAT[[0;2;4];[0;1;2;3;4]] = [0;2;4;0;1;2;3;4]

See also

FOLDL_CONV, FOLDR_CONV, list_FOLD_CONV.

 FOLDL_CONV
FOLDL_CONV : conv -> conv

Synopsis

Computes by inference the result of applying a function to elements of a list.

Description

FOLDL_CONV takes a conversion conv and a term tm in the following form:

   FOLDL f e [x0;...xn]

It returns the theorem

   |- FOLDL f e [x0;...xn] = tm'

where tm' is the result of applying the function f iteratively to the successive elements of the list and the result of the previous application starting from the tail end of the list. During each iteration, an expression f ei xi is evaluated. The user supplied conversion conv is used to derive a theorem

   |- f ei xi = e(i+1)

which is used in the next iteration.

Failure

FOLDL_CONV conv tm fails if tm is not of the form described above.

FOLDR CONV 197

Example

To sum the elements of a list, one can evaluate

   FOLDL_CONV ADD_CONV "FOLDL $+ 0 [0;1;2;3]";;

which returns the following theorem:

   |- FOLDL $+ 0[0;1;2;3] = 6

In general, if the function f is an explicit lambda abstraction (\x x'. t[x,x']), the conversion should be in the form

   ((RATOR_CONV BETA_CONV) THENC BETA_CONV THENC conv'))

where conv' applied to t[x,x'] returns the theorem

   |-t[x,x'] = e''.

See also

FOLDR_CONV, list_FOLD_CONV.

 FOLDR_CONV
FOLDR_CONV : conv -> conv

Synopsis

Computes by inference the result of applying a function to elements of a list.

Description

FOLDR_CONV takes a conversion conv and a term tm in the following form:

   FOLDR f e [x0;...xn]

It returns the theorem

   |- FOLDR f e [x0;...xn] = tm'

where tm' is the result of applying the function f iteratively to the successive elements of the list and the result of the previous application starting from the tail end of the list.

198 Chapter 1. Pre-defined ML Identifiers

During each iteration, an expression f xi ei is evaluated. The user supplied conversion conv is used to derive a theorem

   |- f xi ei = e(i+1)

which is used in the next iteration.

Failure

FOLDR_CONV conv tm fails if tm is not of the form described above.

Example

To sum the elements of a list, one can evaluate

   FOLDR_CONV ADD_CONV "FOLDR $+ 0 [0;1;2;3]";;

which returns the following theorem:

   |- FOLDR $+ 0[0;1;2;3] = 6

In general, if the function f is an explicit lambda abstraction (\x x'. t[x,x']), the conversion should be in the form

   ((RATOR_CONV BETA_CONV) THENC BETA_CONV THENC conv'))

where conv' applied to t[x,x'] returns the theorem

   |-t[x,x'] = e''.

See also

FOLDL_CONV, list_FOLD_CONV.
 forall
forall : ((* -> bool) -> * list -> bool)

Synopsis

Tests a list to see if all its elements satisfy a predicate.

Description

forall p [x1;...;xn] returns true if (p xi) is true for all xi in the list. Otherwise it returns false. If the list is empty, this function always returns true.

Failure

Never fails.

See also

exists, find, tryfind, mem, assoc, rev_assoc.

 FORALL_AND_CONV

FORALL_AND_CONV : conv

Synopsis

Moves a universal quantification inwards through a conjunction.

Description

When applied to a term of the form !x. P /\ Q, the conversion FORALL_AND_CONV returns the theorem:

   |- (!x. P /\ Q) = (!x.P) /\ (!x.Q)

Failure

Fails if applied to a term not of the form !x. P /\ Q.

See also

AND_FORALL_CONV, LEFT_AND_FORALL_CONV, RIGHT_AND_FORALL_CONV.

 FORALL_EQ

FORALL_EQ : (term -> thm -> thm)

Synopsis

Universally quantifies both sides of an equational theorem.

Description

When applied to a variable x and a theorem A |- t1 = t2, whose conclusion is an equation between boolean terms, FORALL_EQ returns the theorem A |- (!x. t1) = (!x. t2), unless the variable x is free in any of the assumptions.

         A |- t1 = t2
   ------------------------  FORALL_EQ "x"      [where x is not free in A]
    A |- (!x.t1) = (!x.t2)

Failure

Fails if the theorem is not an equation between boolean terms, or if the supplied term is not simply a variable, or if the variable is free in any of the assumptions.

See also

AP_TERM, EXISTS_EQ, SELECT_EQ.

 FORALL_IMP_CONV

FORALL_IMP_CONV : conv

Synopsis

Moves a universal quantification inwards through an implication.

Description

When applied to a term of the form !x. P ==> Q, where x is not free in both P and Q, FORALL_IMP_CONV returns a theorem of one of three forms, depending on occurrences of the variable x in P and Q. If x is free in P but not in Q, then the theorem:

   |- (!x. P ==> Q) = (?x.P) ==> Q

is returned. If x is free in Q but not in P, then the result is:

   |- (!x. P ==> Q) = P ==> (!x.Q)

And if x is free in neither P nor Q, then the result is:

   |- (!x. P ==> Q) = (?x.P) ==> (!x.Q)

Failure

FORALL_IMP_CONV fails if it is applied to a term not of the form !x. P ==> Q, or if it is applied to a term !x. P ==> Q in which the variable x is free in both P and Q.

See also

LEFT_IMP_EXISTS_CONV, RIGHT_IMP_FORALL_CONV.
 FORALL_NOT_CONV
FORALL_NOT_CONV : conv

Synopsis

Moves a universal quantification inwards through a negation.

Description

When applied to a term of the form !x.~P, the conversion FORALL_NOT_CONV returns the theorem:

   |- (!x.~P) = ~(?x. P)

Failure

Fails if applied to a term not of the form !x.~P.

See also

EXISTS_NOT_CONV, NOT_EXISTS_CONV, NOT_FORALL_CONV.
 FORALL_OR_CONV
FORALL_OR_CONV : conv

Synopsis

Moves a universal quantification inwards through a disjunction.

Description

When applied to a term of the form !x. P \/ Q, where x is not free in both P and Q, FORALL_OR_CONV returns a theorem of one of three forms, depending on occurrences of the variable x in P and Q. If x is free in P but not in Q, then the theorem:

   |- (!x. P \/ Q) = (!x.P) \/ Q

is returned. If x is free in Q but not in P, then the result is:

   |- (!x. P \/ Q) = P \/ (!x.Q)

And if x is free in neither P nor Q, then the result is:

   |- (!x. P \/ Q) = (!x.P) \/ (!x.Q)

Failure

FORALL_OR_CONV fails if it is applied to a term not of the form !x. P \/ Q, or if it is applied to a term !x. P \/ Q in which the variable x is free in both P and Q.

See also

OR_FORALL_CONV, LEFT_OR_FORALL_CONV, RIGHT_OR_FORALL_CONV.

 frees

frees : (term -> term list)

Synopsis

Returns a list of the variables which are free in a term.

Description

When applied to a term, frees returns a list of the free variables in that term. There are no repetitions in the list produced even if there are multiple free instances of some variables.

Failure

Never fails.

Example

Clearly in the following term, x and y are free, whereas z is bound:

   #frees "(x=1) /\ (y=2) /\ (!z. z >= 0)";;
   ["x"; "y"] : term list

See also

freesl, free_in, thm_frees.

\underline{freesl 203}

 freesl
freesl : (term list -> term list)

Synopsis

Returns a list of the free variables in a list of terms.

Description

When applied to a list of terms, freesl returns a list of the variables which are free in any of those terms. There are no repetitions in the list produced even if several terms contain the same free variable.

Failure

Never fails.

Example

In the following example there are two free instances each of x and y, whereas the only instances of z are bound:

   #freesl ["x+y=2"; "!z. z >= (x-y)"];;
   ["x"; "y"] : term list

See also

frees, free_in, thm_frees.
 FREEZE_THEN
FREEZE_THEN : thm_tactical

Synopsis

‘Freezes’ a theorem to prevent instantiation of its free variables.

Description

FREEZE_THEN expects a tactic-generating function f:thm->tactic and a theorem (A1 |- w) as arguments. The tactic-generating function f is applied to the theorem (w |- w). If 204 Chapter 1. Pre-defined ML Identifiers

this tactic generates the subgoal:

    A ?- t
   =========  f (w |- w)
    A ?- t1

then applying FREEZE_THEN f (A1 |- w) to the goal (A ?- t) produces the subgoal:

    A ?- t
   =========  FREEZE_THEN f (A1 |- w)
    A ?- t1

Since the term w is a hypothesis of the argument to the function f, none of the free variables present in w may be instantiated or generalized. The hypothesis is discharged by PROVE_HYP upon the completion of the proof of the subgoal.

Failure

Failures may arise from the tactic-generating function. An invalid tactic arises if the hypotheses of the theorem are not alpha-convertible to assumptions of the goal.

Example

Given the goal ([ "b < c"; "a < b" ], "(SUC a) <= c"), and the specialized variant of the theorem LESS_TRANS:

   th = |- !p. a < b /\ b < p ==> a < p

IMP_RES_TAC th will generate several unneeded assumptions:

   {b < c, a < b, a < c, !p. c < p ==> b < p, !a'. a' < a ==> a' < b}
       ?- (SUC a) <= c

which can be avoided by first ‘freezing’ the theorem, using the tactic

   FREEZE_THEN IMP_RES_TAC th

This prevents the variables a and b from being instantiated.

   {b < c, a < b, a < c} ?- (SUC a) <= c

Uses

Used in serious proof hacking to limit the matches achievable by resolution and rewriting.

See also

ASSUME, IMP_RES_TAC, PROVE_HYP, RES_TAC, REWR_CONV.

\underline{free in 205}

 free_in
free_in : (term -> term -> bool)

Synopsis

Tests if one term is free in another.

Description

When applied to two terms t1 and t2, the function free_in returns true if t1 is free in t2, and false otherwise. It is not necessary that t1 be simply a variable.

Failure

Never fails.

Example

In the following example free_in returns false because the x in SUC x in the second term is bound:

   #free_in "SUC x" "!x. SUC x = x + 1";;
   false : bool

whereas the following call returns true because the first instance of x in the second term is free, even though there is also a bound instance:

   #free_in "x:bool" "x /\ (?x. x=T)";;
   true : bool

See also

frees, freesl, thm_frees.
 FRONT_CONJ_CONV
FRONT_CONJ_CONV: (term list -> term -> thm)

Synopsis

Moves a specified conjunct to the beginning of a conjunction.

Description

Given a list of boolean terms [t1;...;t;...;tn] and a term t which occurs in the list,

FRONT_CONJ_CONV returns:
   |- (t1 /\ ... /\ t /\ ... /\ tn) = (t /\ t1 /\ ... /\ tn)

That is, FRONT_CONJ_CONV proves that t can be moved to the ‘front’ of a conjunction of several terms.

Failure

FRONT_CONJ_CONV ["t1";...;"tn"] "t" fails if t does not occur in the list [t1,...,tn] or

if any of t1, ..., tn do not have type bool.

Comments

This is not a true conversion, so perhaps it ought to be called something else. The system

shows its type as (term list -> conv).

 fst

fst : ((* # **) -> *)

Synopsis

Extracts the first component of a pair.

Description

fst (x,y) returns x.

Failure

Never fails.

See also

snd, pair.

 funpow

funpow : (int -> (* -> *) -> * -> *)

Synopsis

Iterates a function a fixed number of times.

Description

funpow n f x applies f to x, n times, giving the result f (f ... (f x)...) where the number of f’s is n. funpow 0 f x returns x. If n is negative, funpow n f x will either fail or loop indefinitely, depending on the values of f and x.

Failure

funpow n f x fails if any of the n applications of f fail.

Example

Apply tl three times to a list:

   #funpow 3 tl [1;2;3;4;5];;
   [4; 5] : int list

Apply tl zero times:

   #funpow 0 tl [1;2;3;4;5];;
   [1; 2; 3; 4; 5] : int list

Apply tl six times to a list of only five elements:

   #funpow 6 tl [1;2;3;4;5];;
   evaluation failed     tl

Next, an application of funpow in which the integer argument is negative. Since the function cannot be applied to the argument an arbitrary number of times, the application of funpow fails.

   #funpow (-1) tl [1;2;3;4;5];;
   evaluation failed     tl

An example that causes indefinite looping:

   #funpow (-1) I [1;2;3;4;5];;

 FUN_EQ_CONV

FUN_EQ_CONV : conv

Synopsis

Equates normal and extensional equality for two functions.

Description

The conversion FUN_EQ_CONV embodies the fact that two functions are equal precisely when they give the same results for all values to which they can be applied. When supplied with a term argument of the form f = g, where f and g are functions of type ty1->ty2, FUN_EQ_CONV returns the theorem:

   |- (f = g) = (!x. f x = g x)

where x is a variable of type ty1 chosen by the conversion.

Failure

FUN_EQ_CONV tm fails if tm is not an equation f = g, where f and g are functions.

Uses

Used for proving equality of functions.

See also

EXT, X_FUN_EQ_CONV.

 g

g : (term -> void)

Synopsis

Initializes the subgoal package with a new goal which has no assumptions.

Description

The call

   g "tm"

is equivalent to

   set_goal([],"tm")

and clearly more convenient if a goal has no assumptions. For a description of the subgoal package, see set_goal.

\underline{GEN 209}

Failure

Fails unless the argument term has type bool.

Example

g "(HD[1;2;3] = 1) /\ (TL[1;2;3] = [2;3])";;
"(HD[1;2;3] = 1) /\ (TL[1;2;3] = [2;3])"
() : void

See also

b, backup, backup_limit, e, expand, expandf, get_state, p, print_state, r,
rotate, save_top_thm, set_goal, set_state, top_goal, top_thm.

 GEN

GEN : (term -> thm -> thm)

Synopsis

Generalizes the conclusion of a theorem.

Description

When applied to a term x and a theorem A |- t, the inference rule GEN returns the theorem A |- !x. t, provided x is a variable not free in any of the assumptions. There is no compulsion that x should be free in t.

      A |- t
   ------------  GEN "x"                [where x is not free in A]
    A |- !x. t

Failure

Fails if x is not a variable, or if it is free in any of the assumptions.

Example

The following example shows how the above side-condition prevents the derivation of the theorem x=T |- !x. x=T, which is clearly invalid.

   #top_print print_all_thm;;
   - : (thm -> void)
   #let t = ASSUME "x=T";;
   t = x = T |- x = T
   #GEN "x:bool" t;;
   evaluation failed     GEN

See also

GENL, GEN_ALL, GEN_TAC, SPEC, SPECL, SPEC_ALL, SPEC_TAC.

 GENL

GENL : (term list -> thm -> thm)

Synopsis

Generalizes zero or more variables in the conclusion of a theorem.

Description

When applied to a term list [x1;...;xn] and a theorem A |- t, the inference rule GENL returns the theorem A |- !x1...xn. t, provided none of the variables xi are free in any of the assumptions. It is not necessary that any or all of the xi should be free in t.

         A |- t
   ------------------  GENL "[x1;...;xn]"       [where no xi is free in A]
    A |- !x1...xn. t

Failure

Fails unless all the terms in the list are variables, none of which are free in the assumption list.

See also

GEN, GEN_ALL, GEN_TAC, SPEC, SPECL, SPEC_ALL, SPEC_TAC.

 genvar

genvar : (type -> term)

\underline{GEN ALL 211}

Synopsis

Returns a variable whose name has not been used previously.

Description

When given a type, genvar returns a variable of that type whose name has not been used for a variable or constant in the HOL session so far.

Failure

Never fails.

Example

The following indicates the typical stylized form of the names (this should not be relied on, of course):

   #genvar ":bool";;
   "GEN%VAR%357" : term
   #genvar ":num";;
   "GEN%VAR%358" : term

Trying to anticipate genvar doesn’t work:

   #let v = mk_var(`GEN%VAR%359`,":bool");;
   v = "GEN%VAR%359" : term
   #genvar ":bool";;
   "GEN%VAR%360" : term

Uses

The unique variables are useful in writing derived rules, for specializing terms without having to worry about such things as free variable capture. If the names are to be visible to a typical user, the function variant can provide rather more meaningful names.

See also

GSPEC, variant.

 GEN_ALL

GEN_ALL : (thm -> thm)

Synopsis

Generalizes the conclusion of a theorem over its own free variables.

Description

When applied to a theorem A |- t, the inference rule GEN_ALL returns the theorem A |- !x1...xn. t, where the xi are all the variables, if any, which are free in t but not in the assumptions.

         A |- t
   ------------------  GEN_ALL
    A |- !x1...xn. t

Failure

Never fails.

See also

GEN, GENL, GEN_ALL, SPEC, SPECL, SPEC_ALL, SPEC_TAC.

 GEN_ALPHA_CONV
GEN_ALPHA_CONV : (term -> conv)

Synopsis

Renames the bound variable of an abstraction, a quantified term, or other binder application.

Description

The conversion GEN_ALPHA_CONV provides alpha conversion for lambda abstractions of the form "\y.t", quantified terms of the forms "!y.t", "?y.t" or "?!y.t", and epsilon terms of the form "@y.t". In general, if B is a binder constant, then GEN_ALPHA_CONV implements alpha conversion for applications of the form "B y.t". The function is_binder determines what is regarded as a binder in this context.

If tm is an abstraction "\y.t" or an application of a binder to an abstraction "B y.t", where the bound variable y has type ":ty", and if "x" is a variable also of type :ty, then GEN_ALPHA_CONV "x" tm returns one of the theorems:

   |- (\y.t)  = (\x'. t[x'/y])
   |- (B y.t)  = (!x'. t[x'/y])

depending on whether the input term is "\y.t" or "B y.t" respectively. The variable x':ty in the resulting theorem is a primed variant of x chosen so as not to be free in the term provided as the second argument to GEN_ALPHA_CONV.

Failure

GEN_ALPHA_CONV x tm fails if x is not a variable, or if tm does not have one of the forms

"\y.t" or "B y.t", where B is a binder (that is, is_binder `B` returns true). GEN_ALPHA_CONV x tm

also fails if tm does have one of these forms, but types of the variables x and y differ.

See also

ALPHA, ALPHA_CONV, is_binder.

 GEN_BETA_CONV

GEN_BETA_CONV : conv

Synopsis

Beta-reduces single or paired beta-redexes, creating a paired argument if needed.

Description

The conversion GEN_BETA_CONV will perform beta-reduction of simple beta-redexes in the manner of BETA_CONV, or of tupled beta-redexes in the manner of PAIRED_BETA_CONV. Unlike the latter, it will force through a beta-reduction by introducing arbitrarily nested pair destructors if necessary. The following shows the action for one level of pairing; others are similar.

   GEN_BETA_CONV "(\(x,y). t) p" = t[(FST p)/x, (SND p)/y]

Failure

GEN_BETA_CONV tm fails if tm is neither a simple nor a tupled beta-redex.

Example

The following examples show the action of GEN_BETA_CONV on tupled redexes. In the following, it acts in the same way as PAIRED_BETA_CONV:

   #GEN_BETA_CONV "(\(x,y). x + y) (1,2)";;
   |- (\(x,y). x + y)(1,2) = 1 + 2

whereas in the following, the operand of the beta-redex is not a pair, so FST and SND are introduced:

   #GEN_BETA_CONV "(\(x,y). x + y) numpair";;
   |- (\(x,y). x + y)numpair = (FST numpair) + (SND numpair)

The introduction of FST and SND will be done more than once as necessary:

   #GEN_BETA_CONV "(\(w,x,y,z). w + x + y + z) (1,triple)";;
   |- (\(w,x,y,z). w + (x + (y + z)))(1,triple) =
      1 + ((FST triple) + ((FST(SND triple)) + (SND(SND triple))))

See also

BETA_CONV, PAIRED_BETA_CONV.

 GEN_REWRITE_CONV

GEN_REWRITE_CONV : ((conv -> conv) -> thm list -> thm list -> conv)

Synopsis

Rewrites a term, selecting terms according to a user-specified strategy.

Description

Rewriting in HOL is based on the use of equational theorems as left-to-right replacements on the subterms of an object theorem. This replacement is mediated by the use of REWR_CONV, which finds matches between left-hand sides of given equations in a term and applies the substitution.

Equations used in rewriting are obtained from the theorem lists given as arguments to the function. These are at first transformed into a form suitable for rewriting. Conjunctions are separated into individual rewrites. Theorems with conclusions of the form "~t" are transformed into the corresponding equations "t = F". Theorems "t" which are not equations are cast as equations of form "t = T".

If a theorem is used to rewrite a term, its assumptions are added to the assumptions of the returned theorem. The matching involved uses variable instantiation. Thus, all free variables are generalized, and terms are instantiated before substitution. Theorems may have universally quantified variables.

The theorems with which rewriting is done are divided into two groups, to facilitate implementing other rewriting tools. However, they are considered in an order-independent fashion. (That is, the ordering is an implementation detail which is not specified.)

The search strategy for finding matching subterms is the first argument to the rule. Matching and substitution may occur at any level of the term, according to the specified search strategy: the whole term, or starting from any subterm. The search strategy also specifies the depth of the search: recursively up to an arbitrary depth until no matches occur, once over the selected subterm, or any more complex scheme.

Failure

GEN_REWRITE_CONV fails if the search strategy fails. It may also cause a non-terminating sequence of rewrites, depending on the search strategy used.

Uses

This conversion is used in the system to implement all other rewritings conversions, and may provide a user with a method to fine-tune rewriting of terms.

Example

Suppose we have a term of the form:

   "(1 + 2) + 3 = (3 + 1) + 2"

and we would like to rewrite the left-hand side with the theorem ADD_SYM without changing the right hand side. This can be done by using:

   GEN_REWRITE_CONV (RATOR_CONV o ONCE_DEPTH_CONV) []  [ADD_SYM] mythm

Other rules, such as ONCE_REWRITE_CONV, would match and substitute on both sides, which would not be the desirable result.

As another example, REWRITE_CONV could be implemented as

    GEN_REWRITE_CONV TOP_DEPTH_CONV basic_rewrites

which specifies that matches should be searched recursively starting from the whole term of the theorem, and basic_rewrites must be added to the user defined set of theorems employed in rewriting.

See also

ONCE_REWRITE_CONV, PURE_REWRITE_CONV, REWR_CONV, REWRITE_CONV.

 GEN_REWRITE_RULE

GEN_REWRITE_RULE : ((conv -> conv) -> thm list -> thm list -> thm -> thm)

Synopsis

Rewrites a theorem, selecting terms according to a user-specified strategy.

Description

Rewriting in HOL is based on the use of equational theorems as left-to-right replacements on the subterms of an object theorem. This replacement is mediated by the use of REWR_CONV, which finds matches between left-hand sides of given equations in a term and applies the substitution.

Equations used in rewriting are obtained from the theorem lists given as arguments to the function. These are at first transformed into a form suitable for rewriting. Conjunctions are separated into individual rewrites. Theorems with conclusions of the form "~t" are transformed into the corresponding equations "t = F". Theorems "t" which are not equations are cast as equations of form "t = T".

If a theorem is used to rewrite the object theorem, its assumptions are added to the assumptions of the returned theorem, unless they are alpha-convertible to existing assumptions. The matching involved uses variable instantiation. Thus, all free variables are generalized, and terms are instantiated before substitution. Theorems may have universally quantified variables.

The theorems with which rewriting is done are divided into two groups, to facilitate implementing other rewriting tools. However, they are considered in an order-independent fashion. (That is, the ordering is an implementation detail which is not specified.)

The search strategy for finding matching subterms is the first argument to the rule. Matching and substitution may occur at any level of the term, according to the specified search strategy: the whole term, or starting from any subterm. The search strategy also specifies the depth of the search: recursively up to an arbitrary depth until no matches occur, once over the selected subterm, or any more complex scheme.

Failure

GEN_REWRITE_RULE fails if the search strategy fails. It may also cause a non-terminating sequence of rewrites, depending on the search strategy used.

Uses

This rule is used in the system to implement all other rewriting rules, and may provide a user with a method to fine-tune rewriting of theorems.

Example

Suppose we have a theorem of the form:

   thm = |- (1 + 2) + 3 = (3 + 1) + 2

and we would like to rewrite the left-hand side with the theorem ADD_SYM without changing the right hand side. This can be done by using:

   GEN_REWRITE_RULE (RATOR_CONV o ONCE_DEPTH_CONV) []  [ADD_SYM] mythm

Other rules, such as ONCE_REWRITE_RULE, would match and substitute on both sides, which would not be the desirable result.

As another example, REWRITE_RULE could be implemented as

    GEN_REWRITE_RULE TOP_DEPTH_CONV basic_rewrites

which specifies that matches should be searched recursively starting from the whole term of the theorem, and basic_rewrites must be added to the user defined set of theorems employed in rewriting.

See also

ASM_REWRITE_RULE, FILTER_ASM_REWRITE_RULE, ONCE_REWRITE_RULE,
PURE_REWRITE_RULE, REWR_CONV, REWRITE_RULE.

 GEN_REWRITE_TAC

GEN_REWRITE_TAC : ((conv -> conv) -> thm list -> thm list -> tactic)

Synopsis

Rewrites a goal, selecting terms according to a user-specified strategy.

Description

Distinct rewriting tactics differ in the search strategies used in finding subterms on which to apply substitutions, and the built-in theorems used in rewriting. In the case of REWRITE_TAC, this is a recursive traversal starting from the body of the goal’s conclusion part, while in the case of ONCE_REWRITE_TAC, for example, the search stops as soon as a term on which a substitution is possible is found. GEN_REWRITE_TAC allows a user to specify a more complex strategy for rewriting.

The basis of pattern-matching for rewriting is the notion of conversions, through the application of REWR_CONV. Conversions are rules for mapping terms with theorems equating the given terms to other semantically equivalent ones.

When attempting to rewrite subterms recursively, the use of conversions (and therefore rewrites) can be automated further by using functions which take a conversion and search for instances at which they are applicable. Examples of these functions are

ONCE_DEPTH_CONV and RAND_CONV. The first argument to GEN_REWRITE_TAC is such a func-

tion, which specifies a search strategy; i.e. it specifies how subterms (on which substitutions are allowed) should be searched for.

The second and third arguments are lists of theorems used for rewriting. The order in which these are used is not specified. The theorems need not be in equational form: negated terms, say "~ t", are transformed into the equivalent equational form "t = F", while other non-equational theorems with conclusion of form "t" are cast as the corresponding equations "t = T". Conjunctions are separated into the individual components, which are used as distinct rewrites.

Failure

GEN_REWRITE_TAC fails if the search strategy fails. It may also cause a non-terminating sequence of rewrites, depending on the search strategy used. The resulting tactic is invalid when a theorem which matches the goal (and which is thus used for rewriting it with) has a hypothesis which is not alpha-convertible to any of the assumptions of the goal. Applying such an invalid tactic may result in a proof of a theorem which does not correspond to the original goal.

Uses

Detailed control of rewriting strategy, allowing a user to specify a search strategy.

Example

Given a goal such as:

   ?- a - (b + c) = a - (c + b)

we may want to rewrite only one side of it with a theorem, say ADD_SYM. Rewriting tactics which operate recursively result in divergence; the tactic ONCE_REWRITE_TAC [ADD_SYM] rewrites on both sides to produce the following goal:

   ?- a - (c + b) = a - (b + c)

as ADD_SYM matches at two positions. To rewrite on only one side of the equation, the following tactic can be used:

   GEN_REWRITE_TAC (RAND_CONV o ONCE_DEPTH_CONV) [] [ADD_SYM]

which produces the desired goal:

   ?- a - (c + b) = a - (c + b)

As another example, one can write a tactic which will behave similarly to REWRITE_TAC

\underline{GEN TAC 219}

but will also include ADD_CLAUSES in the set of theorems to use always:

   let ADD_REWRITE_TAC = GEN_REWRITE_TAC TOP_DEPTH_CONV
                             (ADD_CLAUSES . basic_rewrites) ;;

See also

ASM_REWRITE_TAC, GEN_REWRITE_RULE, ONCE_REWRITE_TAC, PURE_REWRITE_TAC,
REWR_CONV, REWRITE_TAC,

 GEN_TAC

GEN_TAC : tactic

Synopsis

Strips the outermost universal quantifier from the conclusion of a goal.

Description

When applied to a goal A ?- !x. t, the tactic GEN_TAC reduces it to A ?- t[x'/x] where x' is a variant of x chosen to avoid clashing with any variables free in the goal’s assumption list. Normally x' is just x.

     A ?- !x. t
   ==============  GEN_TAC
    A ?- t[x'/x]

Failure

Fails unless the goal’s conclusion is universally quantified.

Uses

The tactic REPEAT GEN_TAC strips away any universal quantifiers, and is commonly used before tactics relying on the underlying term structure.

See also

FILTER_GEN_TAC, GEN, GENL, GEN_ALL, SPEC, SPECL, SPEC_ALL, SPEC_TAC, STRIP_TAC,
X_GEN_TAC.

 getenv

getenv : (string -> string)

220 Chapter 1. Pre-defined ML Identifiers

Synopsis

Returns the value of a Unix environment variable.

Description

getenv x returns the value of x from the current environment list; this will include shell environment variables set before HOL is run.

Failure

If in a Unix environment, fails with getenv if the variable is undefined, or has an empty value. In other environments, it will normally fail anyway.

Example

#getenv `SHELL`;;
`/bin/csh` : string

 get_const_type
get_const_type : (string -> type)

Synopsis

Gets the generic type of a constant from the name of the constant.

Description

get_const_type `c` returns the generic type of "c", if "c" is a constant.

Failure

get_const_type st fails if st is not the name of a constant.

Example

#get_const_type `COND`;;
":bool -> (* -> (* -> *))" : type

See also

dest_const, is_constant.

 get_flag_value

get_flag_value : (string -> bool)

Synopsis

Returns the value of one of the system flags.

Description

The call get_flag_value name will read the value of the system flag called name.

Failure

Fails unless the name denotes a flag.

Example

#get_flag_value `timing`;;
false : bool

Comments

The various flags which are set up by default are detailed in the DESCRIPTION.

See also

flags, set_flag_value.

 get_state

get_state : (void -> goalstack)

Synopsis

Returns the current proof state of the subgoal package.

Description

The function get_state is part of the subgoal package. It returns the current proof state. A proof state of the package consists of either goal and justification stacks if a proof is in progress or a theorem if a proof has just been completed. For a description of the subgoal package, see set_goal.

Uses

Providing additional backup. Pausing in the proof of a goal whilst lemmas required for its completion are proved. get_state is used in conjunction with set_state. The current state may be bound to an ML variable using get_state and later restored using set_state.

Example

In this example, a proof state is bound to the ML variable main_proof.

   #g "(HD[1;2;3] = 1) /\ (TL[1;2;3] = [2;3])";;
   "(HD[1;2;3] = 1) /\ (TL[1;2;3] = [2;3])"
   () : void
   #let main_proof = get_state();;
   main_proof = - : goalstack

Other goals may now be set and proved. The proof state may later be restored using set_state and the original proof continued.

   #set_state main_proof;;
   "(HD[1;2;3] = 1) /\ (TL[1;2;3] = [2;3])"
   () : void

See also

b, backup, backup_limit, e, expand, expandf, g, p, print_state, r, rotate,
save_top_thm, set_goal, set_state, top_goal, top_thm.

 get_steps

get_steps : void -> step list

Synopsis

Get the proof steps since last time the proof recorder is enabled.

Description

A proof is a list of inference steps. After the proof recorder is enabled, every inference performed by the system is recorded and cumulated in an internal buffer. When a proof is completed, the raw records can then be processed and output to a disk file.

get_steps is a low level user function for managing the proof recorder. It returns the list of steps cumulated since last time the proof recorder is enabled, i.e. the function record_proof is called with the value true. The list of inference step needs to be processed to produce a proof line list which can be output to a file.

Failure

Never fail.

Example

Below is an example showing how to record an extremely simple proof in which the function get_steps is called to get the list of inference steps:

#let th = SPEC_ALL ADD_SYM;;
Theorem ADD_SYM autoloading from theory `arithmetic` ...
ADD_SYM = |- !m n. m + n = n + m
th = |- m + n = n + m
#let v = genvar ":num";;
"GEN%VAR%536" : term
#record_proof true;;
() : void
#let th1 = (REFL "SUC(m + n)");;
th1 = |- SUC(m + n) = SUC(m + n)
#let th2 = SUBST [th,v] "SUC(m + n) = SUC ^v" th1;;
th2 = |- SUC(m + n) = SUC(n + m)
#record_proof false;;
() : void
#write_proof_to `ap_term.prf` `ap_term` [] (get_steps());;
() : void

The proof consists of two inference steps: the application of the two primitive inference rules REFL and SUBST. The function write_proof_to outputs the proof into a file names

ap_term.prf.

Comments

This function is used to implement higher level user functions for recording proof in the library record_proof. It is much more convenient to use those functions than the low level functions such as get_steps directly.

See also

record_proof, is_recording_proof, RecordStep, suspend_recording,

resume_recording, MakeProof, current_proof, current_proof_file, new_proof_file,
close_proof_file, begin_proof, end_proof, TAC_PROOF, PROVE, prove, prove_thm.

 get_type

get_type : (term -> type -> type)

Synopsis

This function is for internal use only and is to be deleted from a future version of the system. It should not be used.

 goals

goals : goalstack

Synopsis

This function is for internal use only and is to be deleted from a future version of the system. It should not be used.

 GSPEC

GSPEC : (thm -> thm)

Synopsis

Specializes the conclusion of a theorem with unique variables.

Description

When applied to a theorem A |- !x1...xn. t, where the number of universally quantified variables may be zero, GSPEC returns A |- t[g1/x1]...[gn/xn], where the gi are distinct variable names of the appropriate type, chosen by genvar.

        A |- !x1...xn. t
   -------------------------  GSPEC
    A |- t[g1/x1]...[gn/xn]

Uses

GSPEC is useful in writing derived inference rules which need to specialize theorems while avoiding using any variables that may be present elsewhere.

See also

GEN, GENL, genvar, GEN_ALL, GEN_TAC, SPEC, SPECL, SPEC_ALL, SPEC_TAC.

 GSUBST_TAC

GSUBST_TAC : (((term # term) list -> term -> term) -> thm list -> tactic)

Synopsis

Makes term substitutions in a goal using a supplied substitution function.

Description

GSUBST_TAC is the basic substitution tactic by means of which other tactics such as

SUBST_OCCS_TAC and SUBST_TAC are defined. Given a list [(v1,w1);...;(vk,wk)] of pairs

of terms and a term w, a substitution function replaces occurrences of wj in w with vj according to a specific substitution criterion. Such a criterion may be, for example, to substitute all the occurrences or only some selected ones of each wj in w.

  Given a substitution function sfn, GSUBST_TAC sfn [A1|-t1=u1;...;An|-tn=un] (A,t)

replaces occurrences of ti in t with ui according to sfn.

              A ?- t
   =============================  GSUBST_TAC sfn [A1|-t1=u1;...;An|-tn=un]
    A ?- t[u1,...,un/t1,...,tn]

The assumptions of the theorems used to substitute with are not added to the assumptions A of the goal, while they are recorded in the proof. If any Ai is not a subset of A (up to alpha-conversion), then GSUBST_TAC sfn [A1|-t1=u1;...;An|-tn=un] results in an invalid tactic.

GSUBST_TAC automatically renames bound variables to prevent free variables in ui becoming bound after substitution.

Failure

GSUBST_TAC sfn [th1;...;thn] (A,t) fails if the conclusion of each theorem in the list is not an equation. No change is made to the goal if the occurrences to be substituted according to the substitution function sfn do not appear in t.

Uses

GSUBST_TAC is used to define substitution tactics such as SUBST_OCCS_TAC and SUBST_TAC. It may also provide the user with a tool for tailoring substitution tactics.

See also

SUBST1_TAC, SUBST_OCCS_TAC, SUBST_TAC.

 GSYM

GSYM : (thm -> thm)

Synopsis

Reverses the first equation(s) encountered in a top-down search.

Description

The inference rule GSYM reverses the first equation(s) encountered in a top-down search of the conclusion of the argument theorem. An equation will be reversed iff it is not a proper subterm of another equation. If a theorem contains no equations, it will be returned unchanged.

    A |- ..(s1 = s2)...(t1 = t2)..
   --------------------------------  GSYM
    A |- ..(s2 = s1)...(t2 = t1)..

Failure

Never fails, and never loops infinitely.

Example

#ADD;;
|- (!n. 0 + n = n) /\ (!m n. (SUC m) + n = SUC(m + n))
Run time: 0.0s
#GSYM ADD;;
|- (!n. n = 0 + n) /\ (!m n. SUC(m + n) = (SUC m) + n)

See also

NOT_EQ_SYM, REFL, SYM.

 HALF_MK_ABS

HALF_MK_ABS : (thm -> thm)

Synopsis

Converts a function definition to lambda-form.

Description

When applied to a theorem A |- !x. t1 x = t2, whose conclusion is a universally quantified equation, HALF_MK_ABS returns the theorem A |- t1 = \x. t2.

    A |- !x. t1 x = t2
   --------------------  HALF_MK_ABS            [where x is not free in t1]
    A |- t1 = (\x. t2)

Failure

Fails unless the theorem is a singly universally quantified equation whose left-hand side is a function applied to the quantified variable, or if the variable is free in that function.

See also

ETA_CONV, MK_ABS, MK_COMB, MK_EXISTS.

 hd

hd : (* list -> *)

Synopsis

Computes the first element (the head) of a list.

Description

hd [x1;...;xn] returns x1.

Failure

Fails with hd if the list is empty.

See also

tl, el, null.

 help

help : (string -> void)

Synopsis

Displays help on a given identifier in the system.

Description

help will attempt to display the help file associated with a particular identifier in the system. The identifier is provided as an ML string, and the file should be located somewhere on the help search path. Normally the help file for an identifier name would be called name.doc, but there are a few exceptions, because some identifiers have characters that cannot be put in filenames (e.g. ‘/’ under Unix, which is the directory separator).

Failure

Fails if no information can be found on the identifier in question.

See also

help_search_path, set_help_search_path.

 help_search_path

help_search_path : (void -> string list)

Synopsis

Returns the internal search path use by HOL to find online help files.

Description

Evaluating help_search_path() returns a list of strings representing the pathnames of the directories that are searched when the help function searches for online help files. Although the help search path can be set to an arbitrary list of strings, each string is normally expected to be either empty (``) or a pathname with ‘/’ as its final character. When the help function looks for an online help file, the directories in the help search path are searched in the order in which they occur in the list returned by help_search_path.

See also

install, search_path, set_help_search_path, set_search_path.

 hide_constant

hide_constant : (string -> void)

Synopsis

Stops the quotation parser from recognizing a constant.

Description

A call hide_constant `c` where c is the name of a constant, will prevent the quotation parser from parsing it as such; it will just be parsed as a variable. The effect can be

reversed by unhide_constant `c`.

Failure

Fails if the given name is not a constant of the current theory, or if the named constant is already hidden.

Comments

The hiding of a constant only affects the quotation parser; the constant is still there in a theory, and may not be redefined.

See also

unhide_constant.

 hol_pathname

hol_pathname : (void -> string)

Synopsis

Returns the absolute pathname to the hol system directory.

Description

Evaluating hol_pathname() returns a string giving the absolute pathname to the directory in which the HOL system is resident.

Failure

Never fails.

Example

#hol_pathname();;
`/usr/groups/hol/HOL2/sun4_sos` : string

See also

library_pathname.

 host_name

host_name : (void -> string)

Synopsis

Returns the name of the host machine.

Example

When the HOL system was being run on the host machine scaup.cl.cam.ac.uk:

   #host_name ();;
   `scaup.cl.cam.ac.uk` : string

Comments

This function uses the facilities provided by the underlying Lisp, which unfortunately are extremely inconsistent. In Lisps other that Franz, this function may not work at all. However, the ability to perform system commands usually provides an adequate \underline{hyp 231}

alternative, if one is prepared to put in a bit more work. For example:

#let host_name2() =
#system `hostname >/tmp/.hostname`;
#let handle = openi `/tmp/.hostname` in
#letref name, char = ``, `` in
#while not (char = `\
#`) do (name := name^char; char := read handle);
#close handle;
#system `rm /tmp/.hostname`;
#name;;
host_name2 = - : (* -> string)
#host_name();;
`` : string
#host_name2();;
`auk.cl.cam.ac.uk` : string

hyp

hyp : (thm -> term list)

Synopsis

Returns the hypotheses of a theorem.

Description

When applied to a theorem A |- t, the function hyp returns A, the list of hypotheses of the theorem.

Failure

Never fails.

See also

dest_thm, concl.

hyp_union

hyp_union : (thm list -> term list)

Synopsis

Returns union of assumption lists of the given theorems.

Description

When applied to a list of theorems, hyp_union returns the union (see union) of their assumption lists. Straight repetitions only arise if there were multiple instances of an assumption in a single assumption list. There is no elimination of alpha-equivalent pairs of assumptions, only ones which are actually equal.

   hyp_union [A1 |- t1; ... ; An |- tn] = A1 u...u An

Failure

Never fails.

Uses

Designed for internal use, in writing primitive inference rules.

See also

union.

 I

I : (* -> *)

Synopsis

Performs identity operation: I x = x.

Failure

Never fails.

See also

#, B, C, CB, Co, K, KI, o, oo, S, W.

 implode

implode : (string list -> string)

Synopsis

Converts a list of single-character strings into one string.

Description

implode [s1;...;sn] returns the string formed by concatenating the single-character strings s1 ... sn. If n is zero (the list is empty), then the empty string is returned.

Failure

Fails if any of the strings in the argument list are null or longer than one character.

Example

#implode [`e`;`x`;`a`;`m`;`p`;`l`;`e`];;
`example` : string
#implode [`ex`;`a`;`mpl`;``;`e`];;
evaluation failed     implode

See also

explode, concat, concatl.

 IMP_ANTISYM_RULE

IMP_ANTISYM_RULE : (thm -> thm -> thm)

Synopsis

Deduces equality of boolean terms from forward and backward implications.

Description

When applied to the theorems A1 |- t1 ==> t2 and A2 |- t2 ==> t1, the inference rule

IMP_ANTISYM_RULE returns the theorem A1 u A2 |- t1 = t2.
   A1 |- t1 ==> t2     A2 |- t2 ==> t1
  -------------------------------------  IMP_ANTISYM_RULE
           A1 u A2 |- t1 = t2

Failure

Fails unless the theorems supplied are a complementary implicative pair as indicated above.

See also

EQ_IMP_RULE, EQ_MP, EQ_TAC.

 IMP_CANON

IMP_CANON : (thm -> thm list)

Synopsis

Puts theorem into a ‘canonical’ form.

Description

IMP_CANON puts a theorem in ‘canonical’ form by removing quantifiers and breaking apart conjunctions, as well as disjunctions which form the antecedent of implications. It applies the following transformation rules:

      A |- t1 /\ t2           A |- !x. t           A |- (t1 /\ t2) ==> t
   -------------------       ------------         ------------------------
    A |- t1   A |- t2           A |- t             A |- t1 ==> (t2 ==> t)
        A |- (t1 \/ t2) ==> t              A |- (?x. t1) ==> t2
   -------------------------------        ----------------------
    A |- t1 ==> t   A |- t2 ==> t          A |- t1[x'/x] ==> t2

Failure

Never fails, but if there is no scope for one of the above reductions, merely gives a list whose only member is the original theorem.

Comments

This is a rather ad-hoc inference rule, and its use is not recommended.

See also

CONJ1, CONJ2, CONJUNCTS, DISJ1, DISJ2, EXISTS, SPEC.

 IMP_CONJ

IMP_CONJ : (thm -> thm -> thm)

\underline{IMP ELIM 235}

Synopsis

Conjoins antecedents and consequents of two implications.

Description

When applied to theorems A1 |- p ==> r and A2 |- q ==> s, the IMP_CONJ inference rule

returns the theorem A1 u A2 |- p /\ q ==> r /\ s.
    A1 |- p ==> r    A2 |- q ==> s
   --------------------------------  IMP_CONJ
     A1 u A2 |- p /\ q ==> r /\ s

Failure

Fails unless the conclusions of both theorems are implicative.

See also

CONJ.

 IMP_ELIM

IMP_ELIM : (thm -> thm)

Synopsis

Transforms |- s ==> t into |- ~s \/ t.

Description

When applied to a theorem A |- s ==> t, the inference rule IMP_ELIM returns the theorem

A |- ~s \/ t.
    A |- s ==> t
   --------------  IMP_ELIM
    A |- ~s \/ t

Failure

Fails unless the theorem is implicative.

See also

NOT_INTRO, NOT_ELIM.

 IMP_RES_TAC

IMP_RES_TAC : thm_tactic

Synopsis

Enriches assumptions by repeatedly resolving an implication with them.

Description

Given a theorem th, the theorem-tactic IMP_RES_TAC uses RES_CANON to derive a canonical list of implications, each of which has the form:

   A |- u1 ==> u2 ==> ... ==> un ==> v

IMP_RES_TAC then tries to repeatedly ‘resolve’ these theorems against the assumptions of a goal by attempting to match the antecedents u1, u2, ..., un (in that order) to some assumption of the goal (i.e. to some candidate antecedents among the assumptions). If all the antecedents can be matched to assumptions of the goal, then an instance of the theorem

   A u {a1,...,an} |- v

called a ‘final resolvent’ is obtained by repeated specialization of the variables in the implicative theorem, type instantiation, and applications of modus ponens. If only the first i antecedents u1, ..., ui can be matched to assumptions and then no further matching is possible, then the final resolvent is an instance of the theorem:

   A u {a1,...,ai} |- u(i+1) ==> ... ==> v

All the final resolvents obtained in this way (there may be several, since an antecedent ui may match several assumptions) are added to the assumptions of the goal, in the stripped form produced by using STRIP_ASSUME_TAC. If the conclusion of any final resolvent is a contradiction ‘F’ or is alpha-equivalent to the conclusion of the goal, then IMP_RES_TAC solves the goal.

Failure

Never fails.

See also

IMP_RES_THEN, RES_CANON, RES_TAC, RES_THEN.

 IMP_RES_THEN

IMP_RES_THEN : thm_tactical

Synopsis

Resolves an implication with the assumptions of a goal.

Description

The function IMP_RES_THEN is the basic building block for resolution in HOL. This is not full higher-order, or even first-order, resolution with unification, but simply one way simultaneous pattern-matching (resulting in term and type instantiation) of the antecedent of an implicative theorem to the conclusion of another theorem (the candidate antecedent).

Given a theorem-tactic ttac and a theorem th, the theorem-tactical IMP_RES_THEN uses RES_CANON to derive a canonical list of implications from th, each of which has the form:

   Ai |- !x1...xn. ui ==> vi

IMP_RES_THEN then produces a tactic that, when applied to a goal A ?- g attempts to match each antecedent ui to each assumption aj |- aj in the assumptions A. If the antecedent ui of any implication matches the conclusion aj of any assumption, then an instance of the theorem Ai u {aj} |- vi, called a ‘resolvent’, is obtained by specialization of the variables x1, ..., xn and type instantiation, followed by an application of modus ponens. There may be more than one canonical implication and each implication is tried against every assumption of the goal, so there may be several resolvents (or, indeed, none).

Tactics are produced using the theorem-tactic ttac from all these resolvents (failures of ttac at this stage are filtered out) and these tactics are then applied in an unspecified sequence to the goal. That is,

   IMP_RES_THEN ttac th  (A ?- g)

has the effect of:

   MAP_EVERY (mapfilter ttac [... ; (Ai u {aj} |- vi) ; ...]) (A ?- g)

where the theorems Ai u {aj} |- vi are all the consequences that can be drawn by a (single) matching modus-ponens inference from the assumptions of the goal A ?- g and the implications derived from the supplied theorem th. The sequence in which the theorems Ai u {aj} |- vi are generated and the corresponding tactics applied is unspecified.

Failure

Evaluating IMP_RES_THEN ttac th fails with ‘no implication’ if the supplied theorem th is not an implication, or if no implications can be derived from th by the transformation process described under the entry for RES_CANON. Evaluating IMP_RES_THEN ttac th (A ?- g) fails with ‘no resolvents’ if no assumption of the goal A ?- g can be resolved with the implication or implications derived from th. Evaluation also fails, with ‘no tactics’, if there are resolvents, but for every resolvent Ai u {aj} |- vi evaluating the application ttac (Ai u {aj} |- vi) fails—that is, if for every resolvent ttac fails to produce a tactic. Finally, failure is propagated if any of the tactics that are produced from the resolvents by ttac fails when applied in sequence to the goal.

Example

The following example shows a straightforward use of IMP_RES_THEN to infer an equational consequence of the assumptions of a goal, use it once as a substitution in the conclusion of goal, and then ‘throw it away’. Suppose the goal is:

   a + n = a  ?- !k. k - n = k

By the built-in theorem:

   ADD_INV_0 = |- !m n. (m + n = m) ==> (n = 0)

the assumption of this goal implies that n equals 0. A single-step resolution with this theorem followed by substitution:

   IMP_RES_THEN SUBST1_TAC ADD_INV_0

can therefore be used to reduce the goal to:

   a + n = a  ?- !k. k - 0 = m

Here, a single resolvent a + n = a |- n = 0 is obtained by matching the antecedent of ADD_INV_0 to the assumption of the goal. This is then used to substitute 0 for n in the conclusion of the goal.

See also

IMP_RES_TAC, MATCH_MP, RES_CANON, RES_TAC, RES_THEN.

 IMP_TRANS

IMP_TRANS : (thm -> thm -> thm)

\underline{INDUCT 239}

Synopsis

Implements the transitivity of implication.

Description

When applied to theorems A1 |- t1 ==> t2 and A2 |- t2 ==> t3, the inference rule

IMP_TRANS returns the theorem A1 u A2 |- t1 ==> t3.
    A1 |- t1 ==> t2   A2 |- t2 ==> t3
   -----------------------------------  IMP_TRANS
         A1 u A2 |- t1 ==> t3

Failure

Fails unless the theorems are both implicative, with the consequent of the first being the same as the antecedent of the second (up to alpha-conversion).

See also

IMP_ANTISYM_RULE, SYM, TRANS.

 INDUCT

INDUCT : ((thm # thm) -> thm)

Synopsis

Performs a proof by mathematical induction on the natural numbers.

Description

The derived inference rule INDUCT implements the rule of mathematical induction:

      A1 |- P[0]      A2 |- !n. P[n] ==> P[SUC n]
    -----------------------------------------------  INDUCT
               A1 u A2 |- !n. P[n]

When supplied with a theorem A1 |- P[0], which asserts the base case of a proof of the proposition P[n] by induction on n, and the theorem A2 |- !n. P[n] ==> P[SUC n], which asserts the step case in the induction on n, the inference rule INDUCT returns

A1 u A2 |- !n. P[n].

Failure

INDUCT th1 th2 fails if the theorems th1 and th2 do not have the forms A1 |- P[0] and

A2 |- !n. P[n] ==> P[SUC n] respectively.

See also

INDUCT_TAC.

 INDUCT_TAC

INDUCT_TAC : tactic

Synopsis

Performs tactical proof by mathematical induction on the natural numbers.

Description

INDUCT_TAC reduces a goal !n.P[n], where n has type num, to two subgoals corresponding to the base and step cases in a proof by mathematical induction on n. The induction hypothesis appears among the assumptions of the subgoal for the step case. The specification of INDUCT_TAC is:

                A ?- !n. P
    ========================================  INDUCT_TAC
     A ?- P[0/n]     A u {P} ?- P[SUC n'/n]

where n' is a primed variant of n that does not appear free in the assumptions A (usually, n' just equals n). When INDUCT_TAC is applied to a goal of the form !n.P, where n does not appear free in P, the subgoals are just A ?- P and A u {P} ?- P.

Failure

INDUCT_TAC g fails unless the conclusion of the goal g has the form !n.t, where the variable n has type num.

See also

INDUCT.

 INDUCT_THEN

INDUCT_THEN : (thm -> thm_tactic -> tactic)

Synopsis

Structural induction tactic for automatically-defined concrete types.

Description

The function INDUCT_THEN implements structural induction tactics for arbitrary concrete recursive types of the kind definable by define_type. The first argument to INDUCT_THEN is a structural induction theorem for the concrete type in question. This theorem must have the form of an induction theorem of the kind returned by prove_induction_thm. When applied to such a theorem, the function INDUCT_THEN constructs specialized tactic for doing structural induction on the concrete type in question.

The second argument to INDUCT_THEN is a function that determines what is be done with the induction hypotheses in the goal-directed proof by structural induction. Suppose that th is a structural induction theorem for a concrete data type ty, and that A ?- !x.P is a universally-quantified goal in which the variable x ranges over values of type ty. If the type ty has n constructors C1, ..., Cn and ‘Ci(vs)’ represents a (curried) application of the ith constructor to a sequence of variables, then if ttac is a function that maps the induction hypotheses hypi of the ith subgoal to the tactic:

      A  ?- P[Ci(vs)/x]
   ======================  MAP_EVERY ttac hypi
         A1 ?- Gi

then INDUCT_THEN th ttac is an induction tactic that decomposes the goal A ?- !x.P into a set of n subgoals, one for each constructor, as follows:

            A ?- !x.P
  ================================  INDUCT_THEN th ttac
     A1 ?- G1  ...   An ?- Gn

The resulting subgoals correspond to the cases in a structural induction on the variable x of type ty, with induction hypotheses treated as determined by ttac.

Failure

INDUCT_THEN th ttac g fails if th is not a structural induction theorem of the form returned by prove_induction_thm, or if the goal does not have the form A ?- !x:ty.P where ty is the type for which th is the induction theorem, or if ttac fails for any subgoal in the induction.

Example

The built-in structural induction theorem for lists is:

   |- !P. P[] /\ (!t. P t ==> (!h. P(CONS h t))) ==> (!l. P l)

When INDUCT_THEN is applied to this theorem, it constructs and returns a specialized induction tactic (parameterized by a theorem-tactic) for doing induction on lists:

   #let LIST_INDUCT_THEN = INDUCT_THEN list_INDUCT;;
   LIST_INDUCT_THEN = - : (thm_tactic -> tactic)

The resulting function, when supplied with the thm-tactic ASSUME_TAC, returns a tactic that decomposes a goal ?- !l.P[l] into the base case ?- P[NIL] and a step case P[l] ?- !h. P[CONS h l], where the induction hypothesis P[l] in the step case has been put on the assumption list. That is, the tactic:

   LIST_INDUCT_THEN ASSUME_TAC

does structural induction on lists, putting any induction hypotheses that arise onto the assumption list:

                      A ?- !l. P
   =======================================================
    A |- P[NIL/l]   A u {P[l'/l]} ?- !h. P[(CONS h l')/l]

Likewise LIST_INDUCT_THEN STRIP_ASSUME_TAC will also do induction on lists, but will strip induction hypotheses apart before adding them to the assumptions (this may be useful if P is a conjunction or a disjunction, or is existentially quantified). By contrast, the tactic:

   LIST_INDUCT_THEN MP_TAC

will decompose the goal as follows:

                      A ?- !l. P
   =====================================================
    A |- P[NIL/l]   A ?- P[l'/l] ==> !h. P[CONS h l'/l]

That is, the induction hypothesis becomes the antecedent of an implication expressing the step case in the induction, rather than an assumption of the step-case subgoal.

See also

define_type, new_recursive_definition, prove_cases_thm,
prove_constructors_distinct, prove_constructors_one_one, prove_induction_thm,
prove_rec_fn_exists.

 infixes

infixes : (string -> term list)

Synopsis

Lists the infixes in the named theory.

Description

The function infixes should be applied to a string which is the name of an ancestor theory (including the current theory; the special string `-` is always interpreted as the current theory). It returns a list of all the infixes declared in that theory.

Failure

Fails unless the given theory is an ancestor of the current theory.

Example

The theory HOL has no infixes:

   #infixes `HOL`;;
   [] : term list

but the theory arithmetic has several:

   #infixes `arithmetic`;;
   ["$DIV"; "$MOD"; "$>="; "$<="; "$>"; "$EXP"; "$*"; "$-"; "$+"]
   : term list

See also

ancestors, axioms, binders, constants, definitions, new_infix,
new_infix_definition, new_infix_list_rec_definition,
new_infix_prim_rec_definition, parents, types.

 infix_variable

infix_variable : string -> void

Synopsis

Makes a HOL variable parse and print as an infix.

Description

A call infix_variable `x` makes x an infixed variable. This is purely an interface property for the current session. Infixed variables are assumed curried. Infixed variables used in non-infix positions (e.g. as arguments or when being quantified) must be preceded by

$.

Failure

Never fails.

Example

   #new_special_symbol `<<`;;
   () : void
   #infix_variable `<<`;;
   () : void
   #"!$<<. TRANSITIVE $<< = !(x y z:*). x << y /\ y << z ==> x << z";;
   "TRANSITIVE $<< = (!x y z. x << y /\ y << z ==> x << z)" : term

 inject_input

inject_input : (int list -> void)

Synopsis

Passes a list of character codes to the ML interpreter.

Description

When applied to a list of character codes, inject_input passes these to the ML interpreter, which will, after evaluating other pending phrases, interpret them.

Failure

The injection of input never fails, but of course the subsequent interpretation may do.

Example

#inject_input (map ascii_code (explode `tty_write \`Yo!\`;;\
#`));;
() : void
Yo!() : void

Comments

The function ML_eval is similar, and easier to use.

See also

let_after, let_before, ML_eval.

\underline{inl 245}

 inl

inl : (* -> (* + **))

Synopsis

Injects into left of disjoint union type.

Description

The function inl is a constructor function for disjoint union (sum) types, which takes an element of an arbitrary type * and creates an element of type * # ** which holds the same data.

Failure

Never fails

Example

#let x = inl 1;;
x = inl 1 : (int + *)
#let y = inl `hello` : string + int;;
y = inl `hello` : (string + int)

See also

inr, isl, outl, outr.

 inr

inr : (* -> (** + *))

Synopsis

Injects into right of disjoint union type.

Description

The function inr is a constructor function for disjoint union (sum) types, which takes an element of an arbitrary type ** and creates an element of type * # ** which holds the same data.

Failure

Never fails

Example

#let x = inr 1;;
x = inr 1 : (* + int)
#let y = inr 12 : string + int;;
y = inr 12 : (string + int)

See also

inl, isl, outl, outr.

 INST

INST : ((term # term) list -> thm -> thm)

Synopsis

Instantiates free variables in a theorem.

Description

INST is a rule for substituting arbitrary terms for free variables in a theorem:

             A |- t
   -----------------------------  INST [(t1,x1);...;(tn,xn)]
    A |- t[t1,...,tn/x1,...,xn]

where the variables x1, ..., xn are not free in the assumptions A.

Failure

INST fails if a variable being instantiated is free in the assumptions.

Example

In the following example a theorem is instantiated for a specific term:

   #CONJUNCT1 ADD_CLAUSES ;;
   |- 0 + m = m
   #INST [("2 * x","m:num")] (CONJUNCT1 ADD_CLAUSES) ;;
   |- 0 + (2 * x) = 2 * x

See also

INST_TY_TERM, INST_TYPE, ISPEC, ISPECL, SPEC; SPECL, SUBS, subst, SUBST.

\underline{inst 247}

 inst

inst : (term list -> (type # type) list -> term -> term)

Synopsis

Performs type instantiations in a term, avoiding certain ones.

Description

The function inst should be used as follows:

   inst [tm1;...;tmn] [(t1',t1);...;(tn',tn)] tm

where tm1...tmn are variables, t1...tn,t1'...tn' types and tm a term to be typeinstantiated. This call will instantiate, in parallel, the types t1'...tn' for the types t1...tn wherever they appear in tm (possibly nowhere). However, if the name (not necessarily the type) of any variable being instantiated matches one of the [tm1...tmn], it will be renamed (by adding primes) prior to the instantiation. This is useful to avoid obscure problems of free variable capture when type-instantiating theorems.

Failure

Fails if the instantiation list is non-empty and some of the tm1...tmn are not simply variables.

Example

#inst [] [(":num",":*")] "(x:*) = (x:*)";;
"x = x" : term
#inst ["x:bool"] [(":num",":*")] "(x:*) = (x:*)";;
"x' = x'" : term
#inst [] [(":num",":bool")] "x:bool";;
"x" : term
#type_of it;;
":num" : type

Uses

Performing internal functions connected with type instantiation.

See also

inst_check, inst_rename_list, inst_type, INST_TYPE.

 install

install : (string -> void)

Synopsis

Informs HOL of the absolute pathname to the hol distribution directory.

Description

install reconfigures a running HOL system to a new root directory. The string argument to install should be the absolute path name to the directory in which the HOL system is located. Executing

   install `/dir1/dir2/dir3/.../hol`;;

sets the internal HOL search path to:

   [``; `~/`; `/dir1/dir2/dir3/.../hol/theories/`]

In addition, install sets the internal search path used by HOL to find the standard online help files and the internal search path used by HOL to find libraries.

Failure

Never fails.

Comments

The effect persists only for the current HOL session. To change the image permanently, use the save function after installation.

See also

help_search_path, library_pathname, library_search_path, search_path,
set_help_search_path, set_library_search_path, set_search_path.

 inst_check

inst_check : (((type # type) list # term list) -> term list)

Synopsis

Checks the validity of type instantiations.

Description

If the t1...tn are types (monomorphic or polymorphic), the v1...vn type variables (e.g. ":*"), and tm1...tmn terms, the call

   inst_check ([(t1,v1);...;(tn,vn)],[tm1;...;tmn])

will return a list of the variables free in the tm1...tmn, provided none of the type variables v1...vn are free in tm1...tmn. If this condition is not met, or any of the v’s are not simply type variables, the call fails.

Failure

Fails if any of the v’s are not simple type variables, or if any of them are free in the terms

v1...vn.

Uses

Checking the validity of type instantiations (for example, if the terms are the hypotheses of a theorem).

See also

inst, inst_rename_list, inst_type, INST_TYPE.

 inst_rename_list

inst_rename_list : (term -> term list)

Synopsis

Looks for variables which could become bound after type instantiation.

Description

The call

  inst_rename_list tm

will return a list of those variables in tm which are in the scope of a binding of a variable with the same name but a different type. This means that instantiating the type of a variable of that name could lead to free variable capture.

Example

The examples needed to exercise this routine cannot be created using a single quoted term, since the quotation parser assumes that all variables with the same name are identical.

   #let tm = mk_abs("x:num","~x");;
   tm = "\x. ~x" : term
   #inst_rename_list tm;;
   ["x"] : term list
   #type_of (hd it);;
   ":bool" : type

Uses

Checking the validity of type instantiations.

See also

inst, inst_check, inst_type, INST_TYPE.

 INST_TYPE

INST_TYPE : ((type # type) list -> thm -> thm)

Synopsis

Instantiates types in a theorem.

Description

INST_TYPE is a primitive rule in the HOL logic, which allows instantiation of type variables.

               A |- t
   -----------------------------------  INST_TYPE [(ty1,vty1);...;(tyn,vtyn)]
    A |- t[ty1,...,tyn/vty1,...,vtyn]

where none of the types vtyi are free in the assumption list. Variables will be renamed if necessary to prevent distinct variables becoming identical after the instantiation.

Failure

INST_TYPE fails if any of the type variables occurs free in the hypotheses of the theorem, or if upon instantiation two distinct variables (with the same name) become equal.

Uses

INST_TYPE is employed to make use of polymorphic theorems.

Example

Suppose one wanted to specialize the theorem EQ_SYM_EQ for particular values, the first attempt could be to use SPECL as follows:

   #SPECL ["a:num"; "b:num"] EQ_SYM_EQ ;;
   evaluation failed     SPECL

The failure occurred because EQ_SYM_EQ contains polymorphic types. The desired specialization can be obtained by using INST_TYPE:

   #SPECL ["a:num"; "b:num"] (INST_TYPE [":num",":*"] EQ_SYM_EQ) ;;
   |- (a = b) = (b = a)

See also

INST, INST_TY_TERM.

 inst_type

inst_type : ((type # type) list -> type -> type)

Synopsis

Instantiates types in a type.

Description

If [(t1',t1);...;(tn',tn)] is a list of type instantiations, where t1...tn are the initial types, and t1'...tn' the desired instantiations, and ty is a type to instantiate, the call

   inst_type [(t1',t1);...;(tn',tn)] ty

will appropriately instantiate the type ty. The instantiations will be performed in parallel. If several of the type instantiations are applicable, the choice is undefined. In normal use the t1...tn are type variables, although this is not essential. Neither is it necessary that any or all of the types t1...tn should in fact appear in ty.

Example

#inst_type [(":bool",":*")] ":* # **";;
":bool # **" : type
#inst_type [(":num",":* # **"); (":bool",":*")] ":* # **";;
":num" : type
#inst_type [(":bool",":*"); (":num",":* # **")] ":* # **";;
":num" : type
#inst_type [(":bool",":num"); (":num",":bool")] ":(bool)list";;
":(num)list" : type

See also

inst, inst_check, inst_type, INST_TYPE.

 INST_TY_TERM

INST_TY_TERM : (((term # term) list # (type # type) list) -> thm -> thm)

Synopsis

Instantiates terms and types of a theorem.

Description

INST_TY_TERM instantiates types in a theorem, in the same way INST_TYPE does. Then it instantiates some or all of the free variables in the resulting theorem, in the same way as

INST.

Failure

INST_TY_TERM fails under the same conditions as either INST or INST_TYPE fail.

See also

INST, INST_TYPE, ISPEC, SPEC, SUBS, SUBST.

 interface_map

interface_map : (void -> (string # string) list)

intersect 253

Synopsis

Returns the current interface map.

Description

A call interface_map() will return the current interface map. This is a list of string pairs which specify different toplevel representations for constants; see the DESCRIPTION for further details.

Failure

Never fails.

See also

set_interface_map.
 intersect
intersect : (* list -> * list -> * list)

Synopsis

Computes the intersection of two ‘sets’.

Description

intersect l1 l2 returns a list consisting of those elements of l1 that also appear in l2.

Failure

Never fails.

Example

#intersect [1;2;3] [3;5;4;1];;
[1; 3] : int list
#intersect [1;2;4;1] [1;2;3;2];;
[1; 2; 1] : int list

See also

setify, set_equal, union, subtract.

 int_of_string

int_of_string : (string -> int)

Synopsis

Maps a string of numbers to the corresponding integer.

Description

Given a string representing an integer in standard decimal notation, possibly including a leading plus sign or minus sign and/or leading zeros, int_of_string returns the corresponding integer constant.

Failure

Fails unless the string is a valid decimal representation as specified above.

See also

ascii, ascii_code, string_of_int.

 int_of_term

int_of_term : (term -> int)

Synopsis

Maps a numeric term to the corresponding ML integer.

Description

Given a term representing a natural number, i.e., of type :num int_of_term returns the corresponding ML integer constant.

Failure

Never fails.

Example

   #int_of_term "2";;
   2 : int

See also

term_of_int, string_of_int, int_of_string.

\underline{isl 255}

 isl
isl : ((* + **) -> bool)

Synopsis

Tests for membership of left summand.

Example

#let x = inl 1 and y = inr 2;;
#isl x;;
true : bool
#isl y;;
false : bool

See also

inl, inr
 ISPEC
ISPEC : (term -> thm -> thm)

Synopsis

Specializes a theorem, with type instantiation if necessary.

Description

This rule specializes a quantified variable as does SPEC; it differs from it in also instantiating the type if needed:

     A |- !x:ty.tm
  -----------------------  ISPEC "t:ty'"
      A |- tm[t/x]

(where t is free for x in tm, and ty' is an instance of ty).

Failure

ISPEC fails if the input theorem is not universally quantified, if the type of the given term is not an instance of the type of the quantified variable, or if the type variable is free in the assumptions.

See also

INST_TY_TERM, INST_TYPE, ISPECL, SPEC, match.

 ISPECL

ISPECL : (term list -> thm -> thm)

Synopsis

Specializes a theorem zero or more times, with type instantiation if necessary.

Description

ISPECL is an iterative version of ISPEC

         A |- !x1...xn.t
   ----------------------------  ISPECL ["t1",...,"tn"]
    A |- t[t1,...tn/x1,...,xn]

(where ti is free for xi in tm).

Failure

ISPECL fails if the list of terms is longer than the number of quantified variables in the term, if the type instantiation fails, or if the type variable being instantiated is free in the assumptions.

See also

INST_TYPE, INST_TY_TERM, ISPEC, MATCH, SPEC, SPECL.

 is_abs

is_abs : (term -> bool)

Synopsis

Tests a term to see if it is an abstraction.

Description

is_abs "\var. t" returns true. If the term is not an abstraction the result is false.

Failure

Never fails.

See also

mk_abs, dest_abs, is_var, is_const, is_comb.

 is_alphanum

is_alphanum : (string -> bool)

Synopsis

Tests whether a character is alphanumeric.

Description

When given a string, which should be of length 1, is_alphanum returns true iff the character is alphanumeric. By default this means that it is an upper or lower case letter, a digit, a prime (') or an underscore (_). However the definition can be changed using the

function new_alphanum.

Failure

Fails if the string has length greater than 1. Returns false for the null string (``).

See also

ascii, ascii_code, is_letter, new_alphanum, new_letter.

 is_axiom

is_axiom : ((string # string) -> bool)

Synopsis

Tests if there is an axiom with the given name in the given theory.

Description

The call is_axiom(`th`,`ax`), where th is the name of a theory (as usual `-` means the current theory), tests if there is an axiom called ax in that theory.

258 Chapter 1. Pre-defined ML Identifiers

Failure

Fails unless the given theory is an ancestor.

Example

#is_axiom(`bool`,`BOOL_CASES_AX`);;
true : bool
#is_axiom(`bool`,`INFINITY_AX`);;
false : bool
#is_axiom(`ind`,`INFINITY_AX`);;
true : bool

See also

axioms, new_axiom.
 is_binder
is_binder : (string -> bool)

Synopsis

Determines whether a given string represents a binder.

Description

This predicate returns true if the given string argument is the name of a binder: it returns false otherwise.

Example

#binders `bool`;;
["$?!"; "$!"; "$@"] : term list
#is_binder `$?!`;;
false : bool
#is_binder `?!`;;
true : bool

See also

binders, is_binder_type, is_infix, is_constant

is binder type 259

 is_binder_type

is_binder_type : (type -> bool)

Synopsis

Determines whether a given type is an appropriate type for a binder.

Description

The most general binder type is ":(* -> **) -> ***". The function is_binder_type returns true if the given type is an instance of the most general binder type: it returns false otherwise.

Failure

Sometimes fails in a nasty way: e.g.,

   #is_binder_type ":(* -> **)";;
   evaluation failed     dest_type

Example

#is_binder_type ":(* -> **) -> ***";;
true : bool
#is_binder_type ":(* -> **) -> (* -> **)";;
true : bool
#is_binder_type ":(num -> bool) -> bool";;
true : bool
#is_binder_type ":(num)list";;
false : bool

See also

is_binder, is_infix_type, is_type

 is_comb

is_comb : (term -> bool)

260 Chapter 1. Pre-defined ML Identifiers

Synopsis

Tests a term to see if it is a combination (function application).

Description

is_comb "t1 t2" returns true. If the term is not a combination the result is false.

Failure

Never fails

See also

mk_comb, dest_comb, is_var, is_const, is_abs.
 is_cond
is_cond : (term -> bool)

Synopsis

Tests a term to see if it is a conditional.

Description

is_cond "t => t1 | t2" returns true. If the term is not a conditional the result is false.

Failure

Never fails.

See also

mk_cond, dest_cond.
 is_conj
is_conj : (term -> bool)

Synopsis

Tests a term to see if it is a conjunction.

Description

is_conj "t1 /\ t2" returns true. If the term is not a conjunction the result is false.

\underline{is cons 261}

Failure

Never fails.

See also

mk_conj, dest_conj.
 is_cons
is_cons : (term -> bool)

Synopsis

Tests a term to see if it is an application of CONS.

Description

is_cons returns true of a term representing a non-empty list. Otherwise it returns false.

Failure

Never fails.

See also

mk_cons, dest_cons, mk_list, dest_list, is_list.
 is_const
is_const : (term -> bool)

Synopsis

Tests a term to see if it is a constant.

Description

is_const "const:ty" returns true. If the term is not a constant the result is false.

Failure

Never fails.

See also

mk_const, dest_const, is_var, is_comb, is_abs.

 is_constant

is_constant : (string -> bool)

Synopsis

Determines whether a string is the name of a constant.

Description

This predicate returns true if the given string argument is the name of a constant defined in the current theory or its ancestors: it returns false otherwise.

Example

#is_constant `SUC`;;
true : bool
#is_constant `3`;;
true : bool
#is_constant `$!`;;
false : bool
#is_constant `!`;;
true : bool
#is_constant `xx`;;
false : bool

See also

is_infix, is_binder

 is_definition

is_definition : (term -> bool)

Synopsis

This function is for internal use only and is to be deleted from a future version of the system. It should not be used.

\underline{is disj 263}

 is_disj

is_disj : (term -> bool)

Synopsis

Tests a term to see if it is a disjunction.

Description

is_disj "t1 \/ t2" returns true. If the term is not a disjunction the result is false.

Failure

Never fails.

See also

mk_disj, dest_disj.

 IS_EL_CONV

IS_EL_CONV : conv -> conv

Synopsis

Computes by inference the result of testing whether a list contains acertain element.

Description

IS_EL_CONV takes a conversion conv and a term tm in the following form:

   IS_EL x [x0;...xn]

It returns the theorem

   |- IS_EL x [x0;...xn] = F

if for every xi occurred in the list, conv "x = xi" returns a theorem |- P xi = F, otherwise, if for at least one xi, evaluating conv "P xi" returns the theorem |- P xi = T, then it returns the theorem

   |- IS_EL P [x0;...xn] = T

Failure

IS_EL_CONV conv tm fails if tm is not of the form described above, or failure occurs when evaluating conv "x = xi" for some xi.

Example

Evaluating

   IS_EL_CONV bool_EQ_CONV "IS_EL T [T;F;T]";;

returns the following theorem:

   |- IS_EL($= T)[F;F] = F

See also

SOME_EL_CONV, ALL_EL_CONV, FOLDL_CONV, FOLDR_CONV, list_FOLD_CONV.

 is_eq

is_eq : (term -> bool)

Synopsis

Tests a term to see if it is an equation.

Description

is_eq "t1 = t2" returns true. If the term is not an equation the result is false.

Failure

Never fails.

See also

mk_eq, dest_eq.

 is_exists

is_exists : (term -> bool)

Synopsis

Tests a term to see if it as an existential quantification.

Description

is_exists "?var. t" returns true. If the term is not an existential quantification the result is false. is forall 265

Failure

Never fails.

See also

mk_exists, dest_exists.
 is_forall
is_forall : (term -> bool)

Synopsis

Tests a term to see if it is a universal quantification.

Description

is_forall "!var. t" returns true. If the term is not a universal quantification the result

is false.

Failure

Never fails.

See also

mk_forall, dest_forall.
 is_hidden
is_hidden : (string -> bool)

Synopsis

Determines whether a constant is hidden.

Description

This predicate returns true if the named ML constant has been hidden by the function hide_constant; it returns false if the constant is not hidden. Hiding a constant forces the quotation parser to treat the constant as a variable (lexical rules permitting).

Example

#is_hidden `0`;;
false : bool
#hide_constant `0`;;
() : void
#is_hidden `0`;;
true : bool
#unhide_constant `0`;;
() : void
#is_hidden `0`;;
false : bool

See also

hide_constant, unhide_constant

 is_imp

is_imp : (term -> bool)

Synopsis

Tests a term to see if it is an implication.

Description

is_imp "t1 ==> t2" returns true. If the term is not an implication the result is false.

Failure

Never fails.

Comments

This function used to take negation as an implication with F conclusion. This behaviour is implemented by the function is_neg_imp.

See also

mk_imp, dest_imp, dest_neg_imp, is_neg_imp.

\underline{is infix 267}

 is_infix
is_infix : (string -> bool)

Synopsis

Determines whether an operator is infix.

Description

This predicate returns true if the given string argument is the name of an infix operator (a constant); it returns false otherwise.

Example

#is_infix `$+`;;
false : bool
#is_infix `+`;;
true : bool
#is_infix `SUC`;;
false : bool

See also

infixes, is_binder, is_constant.
 is_infix_type
is_infix_type : (type -> bool)

Synopsis

Determines whether a given type is an appropriate infix type.

Description

The most general infix type is ":* -> (** -> ***)". The function is_infix_type returns true if the given type is an instance of the most general infix type: it returns false otherwise.

Failure

Sometimes fails in a nasty way: e.g.,

   #is_infix_type ":(* -> **)";;
   evaluation failed     dest_type

Example

#is_infix_type ":*->**->***";;
true : bool
#is_infix_type ":bool->num->bool";;
true : bool
#is_infix_type ":(bool->bool)";;
false : bool
#is_infix_type ":bool";;
false : bool

See also

is_infix, is_type, is_binder_type

 is_let

is_let : (term -> bool)

Synopsis

Tests a term to see if it is a let-expression.

Description

is_let "LET f x" returns true. If the term is not a let-expression (or of the more general "LET f x" form) the result is false. is letter 269

Example

#is_let "LET ($= 1) 2";;
true : bool
#is_let "let x = 2 in (x = 1)";;
true : bool

See also

mk_let, dest_let.
 is_letter
is_letter : (string -> bool)

Synopsis

Tests whether a character is a letter.

Description

When given a string, which should be of length 1, is_letter returns true iff the character is a letter. By default this means what one would expect, namely one of a..z A..Z. However the scope of the definition can be increased using new_letter.

Failure

Fails if the string has length greater than 1. Returns false for the null string (``).

See also

ascii, ascii_code, is_alphanum, new_alphanum, new_letter.
 is_list
is_list : (term -> bool)

Synopsis

Tests a term to see if it is a list.

Description

is_list returns true of a term representing a list. Otherwise it returns false.

Failure

Never fails.

See also

mk_list, dest_list, mk_cons, dest_cons, is_cons.

 is_ml_curried_infix

is_ml_curried_infix : (string -> bool)

Synopsis

Tests whether a string is the name of a user-defined curried ML infix.

Description

is_ml_curried_infix `string` returns true if string is the name of a user-defined curried ML infix, and false otherwise.

Failure

Never fails.

See also

is_ml_paired_infix, is_ml_infix, ml_curried_infix.

 is_ml_infix

is_ml_infix : (string -> bool)

Synopsis

Tests whether a string is the name of an ML infix.

Description

is_ml_infix `string` returns true if string is the name of a built-in or user-defined ML infix, and false otherwise. is ml paired infix 271

Failure

Never fails.

See also

is_ml_paired_infix, is_ml_curried_infix, ml_paired_infix, ml_curried_infix.
 is_ml_paired_infix
is_ml_paired_infix : (string -> bool)

Synopsis

Tests whether a string is the name of a user-defined paired ML infix.

Description

is_ml_paired_infix `string` returns true if string is the name of a user-defined paired ML infix, and false otherwise.

Failure

Never fails.

See also

is_ml_curried_infix, is_ml_infix, ml_paired_infix.
 is_neg
is_neg : (term -> bool)

Synopsis

Tests a term to see if it is a negation.

Description

is_neg "~t" returns true. If the term is not a negation the result is false.

Failure

Never fails.

See also

mk_neg, dest_neg.

 is_neg_imp

is_neg_imp : (term -> bool)

Synopsis

Tests a term to see if it is an implication or a negation.

Description

is_neg_imp "t1 ==> t2" returns true. is_neg_imp "~t" returns true. If the term is

neither an implication nor a negation the result is false.

Failure

Never fails.

Comments

Yields true of negations because dest_neg_imp destructs negations (for compatibility with PPLAMBDA code). This function used to be called is_imp.

See also

dest_neg_imp, is_imp, dest_imp.

 is_pabs

is_pabs : (term -> bool)

Synopsis

Tests a term to see if it is a paired abstraction.

Description

is_pabs "\(v1..(..)..vn). t" returns true. If the term is not a paired abstraction the result is false.

\underline{is pair 273}

See also

mk_pabs, dest_pabs, is_abs, is_var, is_const, is_comb.
 is_pair
is_pair : (term -> bool)

Synopsis

Tests a term to see if it is a pair.

Description

is_pair "(t1,t2)" returns true. If the term is not a pair the result is false.

Failure

Never fails.

See also

mk_pair, dest_pair.
 is_pred
is_pred : (term -> bool)

Synopsis

Determines whether the operator of a combination is a constant.

Description

The function is_pred returns true when applied to a term of the form "c tm" where c is a constant. Otherwise it returns false.

Example

   #is_pred "SUC 0";;
   true : bool

Comments

This function may be reimplemented.

See also

dest_pred

 is_recording_proof

is_recording_proof : void -> bool

Synopsis

Get the current state of proof recorder.

Description

A proof is a list of inference steps. After the proof recorder is enabled, every inference performed by the system is recorded and cumulated in an internal buffer. When a proof is completed, the raw records can then be processed and output to a disk file.

is_recording_proof is a low level user function for managing the proof recorder. It returns true is the proof recording is currently enabled. Otherwise, it returns false.

Failure

Never fail.

Comments

This function is used to implement higher level user functions for recording proof in the library record_proof. It is much more convenient to use those functions than the low level functions such as is_recording_proof directly.

See also

record_proof, RecordStep, get_steps, suspend_recording, resume_recording,
current_proof, current_proof_file, new_proof_file, close_proof_file,
begin_proof, end_proof, TAC_PROOF, PROVE, prove, prove_thm.

 is_select

is_select : (term -> bool)

Synopsis

Tests a term to see if it is a choice binding.

\underline{is type 275}

Description

is_select "@var. t" returns true. If the term is not an epsilon-term the result is false.

Failure

Never fails.

See also

mk_select, dest_select.
 is_type
is_type : (string -> bool)

Synopsis

Tests whether a string is the name of a type.

Description

is_type `op` returns true if `op' is the name of a type or type operator and false otherwise.

Failure

Never fails.

See also

arity.
 is_var
is_var : (term -> bool)

Synopsis

Tests a term to see if it is a variable.

Description

is_var "var:ty" returns true. If the term is not a variable the result is false.

Failure

Never fails.

See also

mk_var, dest_var, is_const, is_comb, is_abs.

 is_vartype

is_vartype : (type -> bool)

Synopsis

Tests a type to see if it is a type variable.

Description

is_vartype(":*...") returns true. For types which are not type variables it returns

false.

Failure

Never fails.

Example

#is_vartype ":*test";;
true : bool
#is_vartype ":bool";;
false : bool
#is_vartype ":* -> bool";;
false : bool

See also

mk_vartype, dest_vartype.

 it

it : (*)

\underline{itlist 277}

Synopsis

Binds the value of the last expression evaluated at top level.

Description

The identifier it is bound to the value of the last expression evaluated at top level. Declarations do not effect the value of it.

Example

#2 + 3;;
5 : int
#let x = 2*3;;
x = 6 : int
#it;;
5 : int

Uses

Used in evaluating expressions that require the value of the last evaluated expression.

 itlist

itlist : ((* -> ** -> **) -> * list -> ** -> **)

Synopsis

List iteration function. Applies a binary function between adjacent elements of a list.

Description

itlist f [x1;...;xn] y returns
   f x1 (f x2 ... (f xn y)...)

It returns y if list is empty.

278 Chapter 1. Pre-defined ML Identifiers

Example

#itlist (\x y. x + y) [1;2;3;4] 0;;
10 : int

See also

rev_itlist, end_itlist.
 itlist2
itlist2 : (((* # **) -> *** -> ***) -> (* list # ** list) -> *** -> ***)

Synopsis

Applies a paired function between adjacent elements of 2 lists.

Description

itlist2 f ([x1;...;xn],[y1;...;yn]) z returns
   f (x1,y1) (f (x2,y2) ... (f (xn,yn) z)...)

It returns z if both lists are empty.

Failure

Fails with itlist2 if the two lists are of different lengths.

Example

#itlist2 (\(x,y) z. (x * y) + z) ([1;2],[3;4]) 0;;
11 : int

See also

itlist, rev_itlist, end_itlist, uncurry.
 K
K : (* -> ** -> *)

\underline{KI 279}

Synopsis

Forms a constant function: (K x) y = x.

Failure

Never fails.

See also

#, B, C, CB, Co, I, KI, o, oo, S, W.
 KI
KI : (* -> ** -> **)

Synopsis

Maps a value to the identity function: (KI x) y = y.

Comments

This is the combinator dual to K.

Failure

Never fails.

See also

#, B, C, CB, Co, I, K, o, oo, S, W.
 last
last : (* list -> *)

Synopsis

Computes the last element of a list.

Description

last [x1;...;xn] returns xn.

Failure

Fails with last if the list is empty.

See also

butlast, hd, tl, el, null.

 LASTN_CONV

LASTN_CONV : conv

Synopsis

Computes by inference the result of taking the last n elements of a list.

Description

For any object language list of the form "[x0;...x(n-k);...;x(n-1)]" , the result of evaluating

   LASTN_CONV "LASTN k [x0;...x(n-k);...;x(n-1)]"

is the theorem

   |- LASTN k [x0;...;x(n-k);...;x(n-1)] = [x(n-k);...;x(n-1)]

Failure

LASTN_CONV tm fails if tm is not of the form described above, or k is greater than the length of the list.

 LAST_CONV

LAST_CONV : conv

Synopsis

Computes by inference the result of taking the last element of a list.

Description

For any object language list of the form "[x0;...x(n-1)]" , the result of evaluating

   LAST_CONV "LAST [x0;...;x(n-1)]"

is the theorem

   |- LAST [x0;...;x(n-1)] = x(n-1)

Failure

LAST_CONV tm fails if tm is an empty list.

 LEFT_AND_EXISTS_CONV

LEFT_AND_EXISTS_CONV : conv

Synopsis

Moves an existential quantification of the left conjunct outwards through a conjunction.

Description

When applied to a term of the form (?x.P) /\ Q, the conversion LEFT_AND_EXISTS_CONV returns the theorem:

   |- (?x.P) /\ Q = (?x'. P[x'/x] /\ Q)

where x' is a primed variant of x that does not appear free in the input term.

Failure

Fails if applied to a term not of the form (?x.P) /\ Q.

See also

AND_EXISTS_CONV, EXISTS_AND_CONV, RIGHT_AND_EXISTS_CONV.

 LEFT_AND_FORALL_CONV

LEFT_AND_FORALL_CONV : conv

Synopsis

Moves a universal quantification of the left conjunct outwards through a conjunction.

Description

When applied to a term of the form (!x.P) /\ Q, the conversion LEFT_AND_FORALL_CONV returns the theorem:

   |- (!x.P) /\ Q = (!x'. P[x'/x] /\ Q)

where x' is a primed variant of x that does not appear free in the input term.

Failure

Fails if applied to a term not of the form (!x.P) /\ Q.

See also

AND_FORALL_CONV, FORALL_AND_CONV, RIGHT_AND_FORALL_CONV.

 LEFT_IMP_EXISTS_CONV
LEFT_IMP_EXISTS_CONV : conv

Synopsis

Moves an existential quantification of the antecedent outwards through an implication.

Description

When applied to a term of the form (?x.P) ==> Q, the conversion LEFT_IMP_EXISTS_CONV returns the theorem:

   |- (?x.P) ==> Q = (!x'. P[x'/x] ==> Q)

where x' is a primed variant of x that does not appear free in the input term.

Failure

Fails if applied to a term not of the form (?x.P) ==> Q.

See also

FORALL_IMP_CONV, RIGHT_IMP_FORALL_CONV.

 LEFT_IMP_FORALL_CONV
LEFT_IMP_FORALL_CONV : conv

Synopsis

Moves a universal quantification of the antecedent outwards through an implication.

Description

When applied to a term of the form (!x.P) ==> Q, the conversion LEFT_IMP_FORALL_CONV returns the theorem:

   |- (!x.P) ==> Q = (?x'. P[x'/x] ==> Q)

where x' is a primed variant of x that does not appear free in the input term.

Failure

Fails if applied to a term not of the form (!x.P) ==> Q.

See also

EXISTS_IMP_CONV, RIGHT_IMP_FORALL_CONV.

 LEFT_OR_EXISTS_CONV
LEFT_OR_EXISTS_CONV : conv

Synopsis

Moves an existential quantification of the left disjunct outwards through a disjunction.

Description

When applied to a term of the form (?x.P) \/ Q, the conversion LEFT_OR_EXISTS_CONV returns the theorem:

   |- (?x.P) \/ Q = (?x'. P[x'/x] \/ Q)

where x' is a primed variant of x that does not appear free in the input term.

Failure

Fails if applied to a term not of the form (?x.P) \/ Q.

See also

EXISTS_OR_CONV, OR_EXISTS_CONV, RIGHT_OR_EXISTS_CONV.

 LEFT_OR_FORALL_CONV
LEFT_OR_FORALL_CONV : conv

Synopsis

Moves a universal quantification of the left disjunct outwards through a disjunction.

Description

When applied to a term of the form (!x.P) \/ Q, the conversion LEFT_OR_FORALL_CONV returns the theorem:

   |- (!x.P) \/ Q = (!x'. P[x'/x] \/ Q)

where x' is a primed variant of x that does not appear free in the input term.

Failure

Fails if applied to a term not of the form (!x.P) \/ Q.

See also

OR_FORALL_CONV, FORALL_OR_CONV, RIGHT_OR_FORALL_CONV.

 length

length : (* list -> int)

Synopsis

Computes the length of a list: length [x1;...;xn] returns n.

Failure

Never fails.

 LENGTH_CONV

LENGTH_CONV : conv

Synopsis

Computes by inference the length of an object-language list.

Description

For any object language list of the form "[x1;x2;...;xn]", where x1, x2, ..., xn are arbitrary terms of the same type, the result of evaluating

   LENGTH_CONV "LENGTH [x1;x2;...;xn]"

is the theorem

   |- LENGTH [x1;x2;...;xn] = n

where n is the numeral constant that denotes the length of the list.

Failure

LENGTH_CONV tm fails if tm is not of the form "LENGTH [x1;x2;...;xn]" or "LENGTH []".

 let_after

let_after : ((string # string # string list) -> void)

Synopsis

Makes an ML declaration dynamically after other pending declarations.

Description

The call

   let_after(`x`,`f`,[`arg1`;...;`argn`])

puts an ML declaration

   let x = f [`arg1`;...;`argn`];;

at the end of the queue of currently pending toplevel items. It will be evaluated after the phrase which invoked let_after, and any other pending evaluations. This gives a way of performing declarations dynamically. Note that the first two argument strings are interpreted as single identifiers, whereas the arguments are passed as literal strings.

Failure

Never fails, although the subsequent declaration may well fail for any of the usual reasons.

Example

#let fn = \l:(string)list. 1;;
fn = - : (string list -> int)
#let_after(`x`,`fn`,[]);;
() : void
x = 1 : int
#x;;
1 : int

Uses

Performing variants on autoloading.

See also

inject_input, let_before, ML_eval.

 let_before

let_before : ((string # string # string list) -> void)

Synopsis

Makes an ML declaration dynamically before other pending declarations.

Description

The call

   let_before(`x`,`f`,[`arg1`;...;`argn`])

puts an ML declaration

   let x = f [`arg1`;...;`argn`];;

at the head of the queue of currently pending toplevel items. It will be evaluated after the phrase which invoked let_before. This gives a way of performing declarations dynamically. Note that the first two argument strings are interpreted as single identifiers, whereas the arguments are passed as literal strings.

Failure

Never fails, although the subsequent declaration may well fail for any of the usual reasons.

\underline{let CONV 287}

Example

#let fn = \l:(string)list. 1;;
fn = - : (string list -> int)
#let_before(`x`,`fn`,[]);;
() : void
x = 1 : int
#x;;
1 : int

Uses

Performing variants on autoloading.

See also

inject_input, let_after, ML_eval.

 let_CONV

let_CONV : conv

Synopsis

Evaluates let-terms in the HOL logic.

Description

The conversion let_CONV implements evaluation of object-language let-terms. When applied to a let-term of the form:

   let v1 = t1 and ... and vn = tn in t

where v1, ..., vn are variables, let_CONV proves and returns the theorem:

   |- (let v1 = t1 and ... and vn = tn in t) = t[t1,...,tn/v1,...,vn]

where t[t1,...,tn/v1,...,vn] denotes the result of substituting ti for v1 in parallel in t, with automatic renaming of bound variables to prevent free variable capture.

let_CONV also works on let-terms that bind tuples of variables to tuples of values. That is, if <tup> is an arbitrarily-nested tuple of distinct variables v1, ..., vn and <val> is a structurally similar tuple of values, that is <val> equals <tup>[t1,...,tn/v1,...,vn] for some terms t1, ..., tn, then:

   let_CONV "let <tup> = <val> in t"

returns

  |- (let <tup> = <val> in t) = t[t1,...,tn/v1,...,vn]

That is, the term ti is substituted for the corresponding variable vi in t. This form of let-reduction also works with simultaneous binding of tuples using and.

Finally, let_CONV also handles let-terms that introduce local definitions of functions. When applied to a term of the form:

   "let f v1 ... vn = tm in t"

let_CONV returns:

   |- (let f v1 ... vn = tm in t) = t'

where t' is obtained by rewriting all applications of the function f in t using the defining equation f v1 ... vn = tm. Partial applications of the form f x1 ... xm where m is less that n are rewritten to lambda-abstractions (see the example given below). Simultaneous introduction of functions using and is handled, and each of v1, ..., vn in the pattern shown above can be either a variable or a tuple of variables.

Failure

let_CONV tm fails if tm is not a reducible let-term of one of the forms specified above.

\underline{lhs 289}

Example

A simple example of the use of let_CONV to eliminate a single local variable is the following:

   #let_CONV "let x = 1 in x+y";;
   |- (let x = 1 in x + y) = 1 + y

and an example showing a tupled binding is:

   #let_CONV "let (x,y) = (1,2) in x+y";;
   |- (let (x,y) = 1,2 in x + y) = 1 + 2

Simultaneous introduction of two local functions f and g and rewriting is illustrated by:

   #let_CONV "let f x = x + 1 and g x = x + 2 in !x. g(f(g x)) = x + 5";;
   |- (let f x = x + 1 and g x = x + 2 in (!x. g(f(g x)) = x + 5)) =
      (!x. ((x + 2) + 1) + 2 = x + 5)

and an example of partial application is:

   #let_CONV "let f x y = x+y in f 1";;
   |- (let f x y = x + y in f 1) = (\y. 1 + y)

Note the introduction of a lambda-abstraction in the result.

See also

BETA_CONV, PAIRED_BETA_CONV.
 lhs
lhs : (term -> term)

Synopsis

Returns the left-hand side of an equation.

Description

lhs "t1 = t2" returns "t1".

Failure

Fails with lhs if the term is not an equation.

See also

rhs, dest_eq.

 libraries

libraries : (void -> string list)

Synopsis

Evaluating libraries() returns a list of the libraries that have been successfully loaded during the current session.

Failure

Never fails.

See also

library_pathname, load_library.

 library_loader

library_loader : ((string # string list # string list #
    string list # string # string # string list) -> void)

Synopsis

Performs the actual loading of a library.

Description

This function is a generic library loader which carries out the standard loading procedures for loading library. This provides a simple interface for library authors to write the library load file. A library consists of three parts: theories, codes and document. Any of these may be absent (however, it is strongly recommanded to provide proper document for all libraries). The standard procedures of loading a library are: 1) update the system search path to include the library directory; 2) load any libraries on which the current library depends; 3) load the theories (if there are any); 4) load the codes (if there are any); 5) update the help search path to include the current library document; 6) set up auto-loading of theorems, definitions, etc.

When a library, say foo, is loaded into a HOL session by evaluating

   load_library `foo`;;

the system will load a file named ‘foo.ml’ in the directory ‘foo’ which is in the library search path. The generic library loader library_loader should be called with appropriate arguments in this file. In addition to the standard loading procedures, extra functions may be called in this file to set up special environment necessary for working with the library.

The function library_loader takes a 6-tuple

   (lib_name, parent_libs, theories, codes, load_parent, part_path, help_paths)

as its argument. The meanings of the fields are described below. lib_name : string is the name of the library. It should be the name of the directory where the library is found, and the basename of the load file. parent_libs : string list are the names of the libraries on which the current library depends. They will be loaded in the order given before the theories and codes of the current library are loaded. theories : string list are the names of the theories in this library. If the library contains more than one theory, the descendant of all other theories should be the first in the list. This theory will be loaded and it becomes the current theory or the new parent of the current theory depending on whether the system is in draft mode. If we are not in draft mode and this theory is not an ancestor of the current theory, it will not be loaded. Instead, a function whose name is created by prefixing the string load_to the name of the library is defined. This may be called later to complete the loading of the library. The order of other names is not important. The axioms, definitions and theorems in all the theories listed are set up to be autoloaded. If there is no theory in the library, this field should be a null list. codes : string list are the names of the code files. They will be loaded in the order given after loading the first theory in theories. If there is no code files in the library, this field should be a null list. load_parent : string is the name of a file to be loaded before the code files are loaded. If we are not currently in draft mode, the parent libraries may not be loaded completely. Instead, functions having name prefixed by load_will be defined. If the codes of the current theory depend on the parent libraries, these loading functions should be called before loading the codes. A file containing the calls of the loading functions and possibly other neccessory functions to set up the working environment will be loaded. The name of this file is given in this field. part_path : string is the directory name of the library part. If only part of the library is to be loaded, the string lib_name should have the part separator : in it, e.g. `lib:part`. It such case, the files of the library part may reside in a sub-directory. The name of this sub-directory is specified by this field, and it is added to the search path. help_paths : string list are the names of directories containing the help files. These are relative to the subdirectory ‘help‘ of the library. They are added to the help_search_path.

Failure

It fails if any parent libraries, theories or files cannot be loaded.

Example

Suppose the the name of the library is mylib. It depends on the libraries lib1 and lib2, and it consists of two theories thy1 and thy2, and a single code file mylib_convs.ml. A load file for this library will be as below:

   let this_lib_name = `mylib`
   and parent_libs = [`lib1`; `lib2`]
   and theories = [`thy2`; `thy1`]
   and codes = [`mylib_convs`]
   and load_parent = `load_parent`
   and part_path = ``
   and help_paths = [`entries`]
   in
   library_loader (this_lib_name, parent_libs, theories, codes,
    load_parent, part_path, help_paths);;

If both of the libraries lib1 and lib2 have theories and they are independent, and if the library mylib is loaded when we are not in draft mode, a function for loading the second parent lib2, namely load_lib2, will be defined. This should be called in the file load_parent.ml to complete the loading of lib2.

Uses

This function is primarily used in library load files. The user function for loading a library

is load_library.

See also

library_pathname, load_library, set_library_search_path,
define_load_lib_function.

 library_pathname

library_pathname : (void -> string)

Synopsis

Returns the pathname to the current library directory.

Description

Evaluating library_pathname() returns a string giving the root pathname of the current library directory. Usually, this is just the absolute pathname to the HOL system library. But during the evaluation of a call to load_library, the string returned by library_pathname() is the library directory in which the library being loaded resides.

Failure

Never fails.

Example

A very typical application is illustrated by the following code from the load file for the built-in string library:

   let path = library_pathname() ^`/string/` in
       set_search_path (union (search_path()) [path]);;

When the string library load file is loaded using load_library, this part of the code adds the pathname to the string library to the internal HOL search path.

Uses

The main purpose of the function library_pathname is to allow library load files to update the internal HOL search paths in a site-independent way.

See also

install, library_search_path, set_library_search_path.

 library_search_path

library_search_path : (void -> string list)

Synopsis

Returns the internal search path use by HOL to find libraries.

Description

Evaluating library_search_path() returns a list of strings representing the pathnames of the directories that are searched when the load_library function searches for libraries. Although the library search path can be set to an arbitrary list of strings, each string is normally expected to be a pathname with ‘/’ as its final character. When load_library looks for a library load file, the directories in the library search path are searched in the order in which they occur in the list returned by library_search_path.

Failure

Never fails.

See also

library_pathname, load_library, set_library_search_path.

 link

link : ((string # string) -> void)

Synopsis

Makes a new link to a file.

Description

If old and new are filenames, where old exists and new does not, then the call

   link(`old`,`new`)

will link the name new to the file old in the manner of the Unix shell command

   ln old new

Failure

A call to link may fail in various system-related ways, in particular if old does not exist, or is a directory, or new already exists.

Example

The following example is assumed to be run under Unix:

   #system `touch test-file`;;
   0 : int
   #link(`test-file`,`test-link`);;
   () : void

Comments

This call is somewhat Unix-related, and may not work under other operating systems.

See also

system, unlink.

 lisp

lisp : (string -> void)

Synopsis

Executes a lisp command from ML.

Description

lisp executes a lisp s-expression (written as an ML string). Returned values do not appear on the standard output, unless they are explicitly printed.

Failure

Fails if the s-expression is improperly constructed or fails when evaluated by lisp.

Example

#lisp `(princ "hello")`;;
hello() : void
#lisp `(cons 'a 'b)`;;
() : void
#lisp `(princ (cons 'a 'b))`;;
(A . B)() : void
#lisp `(car 'a)`;;
Error: Attempt to take the car of A which is not a cons.
evaluation failed     lisp -- NIL
#lisp `(princ "hello"`;;
Error: eof encountered on input stream #<string input stream  @ #x869fe6>
evaluation failed     lisp -- NIL

Comments

lisp is not meant for general use, and should be treated with great care. If one is not wary, it is entirely possible to corrupt HOL by using it.

See also

dropout, lsp.

 lisp_dir_pathname

lisp_dir_pathname : string

Synopsis

Absolute pathname to the HOL lisp sources.

Description

For implementation reasons, the ML variable lisp_dir_pathname is bound when the system if built to a string giving the absolute pathname of the directory containing the HOL lisp sources. This value is not for general use.

Failure

Evaluating lisp_dir_pathname never fails.

See also

ml_dir_pathname.

 LIST_BETA_CONV
LIST_BETA_CONV : conv

Synopsis

Performs an iterated beta conversion.

Description

The conversion LIST_BETA_CONV maps terms of the form

   "(\x1 x2 ... xn. u) v1 v2 ... vn"

to the theorems of the form

   |- (\x1 x2 ... xn. u) v1 v2 ... vn = u[v1/x1][v2/x2] ... [vn/xn]

where u[vi/xi] denotes the result of substituting vi for all free occurrences of xi in u, after renaming sufficient bound variables to avoid variable capture.

Failure

LIST_BETA_CONV tm fails if tm does not have the form "(\x1 ... xn. u) v1 ... vn" for n

greater than 0.

Example

#LIST_BETA_CONV "(\x y. x+y) 1 2";;
|- (\x y. x + y)1 2 = 1 + 2

See also

BETA_CONV, BETA_RULE, BETA_TAC, RIGHT_BETA, RIGHT_LIST_BETA.

 LIST_CONJ

LIST_CONJ : (thm list -> thm)

Synopsis

Conjoins the conclusions of a list of theorems.

Description

         A1 |- t1 ... An |- tn
   ----------------------------------  LIST_CONJ
    A1 u ... u An |- t1 /\ ... /\ tn

Failure

LIST_CONJ will fail with `end_itlist` if applied to an empty list of theorems.

Comments

The system shows the type as proof.

LIST_CONJ does not check for alpha-equivalence of assumptions when forming their union. If a particular assumption is duplicated within one of the input theorems assumption lists, then it may be duplicated in the resulting assumption list.

See also

BODY_CONJUNCTS, CONJ, CONJUNCT1, CONJUNCT2, CONJUNCTS, CONJ_PAIR, CONJ_TAC.

 list_EQ_CONV

list_EQ_CONV : (conv -> conv)

Synopsis

Prove equality or inequality of two lists.

Description

list_EQ_CONV c implements a decision procedure for equality of lists of type (ty)list where the conversion c decides equality of values of type ty. More precisely, the argument to list_EQ_CONV is expected to be a conversion c which implements a decision procedure for values of some base type ty, in the sense that c "t1 = t2" returns |- (t1 = t2) = T if t1 denotes the same value as t2 and |- (t1 = t2) = F if t1 and t2 denote different values. Given such a conversion c, evaluating:

   list_EQ_CONV c "[t1;...;tn] = [u1;...;um]"

where all the ti and ui have type ty, returns:

   |- ([t1;...;tn] = [u1;...;um]) = F

if n is not equal to m (i.e. if the two lists have different lengths) or if n = m and the conversion c proves |- (ti = ui) = F for some i between 1 and n. The theorem:

   |- ([t1;...;tn] = [u1;...;um]) = T

is returned if n equals m and for all i from 1 to n either ti is syntactically identical to ui

or c proves |- (ti = ui) = T

Failure

list_EQ_CONV t fails if t is not a term of the form "[t1;...;tn] = [u1;...;um]", or if n

equals m and some ti is not syntactically identical to ui but c fails to prove either of the

theorems |- (ti = ui) = T or |- (ti = ui) = F when applied to "ti = ui".

Example

#list_EQ_CONV num_EQ_CONV "[1;SUC 1;3] = [1;2;3]";;
|- ([1;SUC 1;3] = [1;2;3]) = T

 list_FOLD_CONV
list_FOLD_CONV : thm -> conv -> conv

Synopsis

Computes by inference the result of applying a function to elements of a list.

Description

Evaluating list_FOLD_CONV fthm conv tm returns a theorem

   |- CONST x0' ... xi' ... xn' = tm'

The first argument fthm should be a theorem of the form

  |- !x0 ... xi ... xn. CONST x0 ... xi ... xn = FOLD[LR] f e xi

where FOLD[LR] means either FOLDL or FOLDR. The last argument tm is a term of the following form:

   CONST x0' ... xi' ... xn'

where xi' is a concrete list. list_FOLD_CONV first instantiates the input theorem using tm. It then calls either FOLDL_CONV or FOLDR_CONV with the user supplied conversion conv on the right-hand side.

Failure

list_FOLD_CONV fthm conv tm fails if fthm or tm is not of the form described above, or if they do not agree, or the call to FOLDL_CONV OR FOLDR_CONV fails.

Uses

This function is used to implement conversion for logical constants which can be expressed in terms of the fold operators. For example, the constant SUM can be expressed in terms of FOLDR as in the following theorem:

  |- !l. SUM l = FOLDR $+ 0 l

A conversion for SUM can be implemented as

   let SUM_CONV =
      list_FOLD_CONV (theorem `list` `SUM_FOLDR`) ADD_CONV;;

Then, evaluating SUM_CONV "SUM [0;1;2;3]" will return the following theorem:

   |- SUM [0;1;2;3] = 6

See also

FOLDL_CONV, FOLDR_CONV.

 LIST_INDUCT

LIST_INDUCT : ((thm # thm) -> thm)

Synopsis

Performs proof by structural induction on lists.

Description

The derived inference rule LIST_INDUCT implements the rule of mathematical induction:

     A1 |- P[NIL/l]      A2 |- !t. P[t/l] ==> !h. P[CONS h t/l]
    ------------------------------------------------------------  LIST_INDUCT
                      A1 u A2 |- !l. P

When supplied with a theorem A1 |- P[NIL], which asserts the base case of a proof of the proposition P[l] by structural induction on the list l, and the theorem

   A2 |- !t. P[t] ==> !h. P[CONS h t]

which asserts the step case in the induction on l, the inference rule LIST_INDUCT returns

A1 u A2 |- !l. P[l].

Failure

LIST_INDUCT th1 th2 fails if the theorems th1 and th2 do not have the forms A1 |- P[NIL] and A2 |- !t. P[t] ==> !h. P[CONS h t] respectively (where the empty list NIL in th1 and the list CONS h t in th2 have the same type).

See also

LIST_INDUCT_TAC.

 LIST_INDUCT_TAC
LIST_INDUCT_TAC : tactic

Synopsis

Performs tactical proof by structural induction on lists.

Description

LIST_INDUCT_TAC reduces a goal !l.P[l], where l ranges over lists, to two subgoals corresponding to the base and step cases in a proof by structural induction on l. The induction hypothesis appears among the assumptions of the subgoal for the step case. The specification of LIST_INDUCT_TAC is:

                     A ?- !l. P
   =====================================================  LIST_INDUCT_TAC
    A |- P[NIL/l]   A u {P[l'/l]} ?- !h. P[CONS h l'/l]

where l' is a primed variant of l that does not appear free in the assumptions A (usually, l' is just l). When LIST_INDUCT_TAC is applied to a goal of the form !l.P, where l does not appear free in P, the subgoals are just A ?- P and A u {P} ?- !h.P. list mk abs 301

Failure

LIST_INDUCT_TAC g fails unless the conclusion of the goal g has the form !l.t, where the variable l has type (ty)list for some type ty.

See also

LIST_INDUCT.
 list_mk_abs
list_mk_abs : ((term list # term) -> term)

Synopsis

Iteratively constructs abstractions.

Description

list_mk_abs(["x1";...;"xn"],"t") returns "\x1 ... xn. t".

Failure

Fails with list_mk_abs if the terms in the list are not variables.

Comments

The system shows the type as goal -> term.

See also

strip_abs, mk_abs.
 list_mk_comb
list_mk_comb : ((term # term list) -> term)

Synopsis

Iteratively constructs combinations (function applications).

Description

list_mk_comb("t",["t1";...;"tn"]) returns "t t1 ... tn".

Failure

Fails with list_mk_comb if the types of t1,...,tn are not equal to the argument types of t. It is not necessary for all the arguments of t to be given. In particular the list of terms t1,...,tn may be empty.

Example

#list_mk_comb("1",[]);;
"1" : term
#list_mk_comb("$/\",["T"]);;
"$/\ T" : term
#list_mk_comb("$/\",["1"]);;
evaluation failed     list_mk_comb

See also

strip_comb, mk_comb.

 list_mk_conj

list_mk_conj : (term list -> term)

Synopsis

Constructs the conjunction of a list of terms.

Description

list_mk_conj(["t1";...;"tn"]) returns "t1 /\ ... /\ tn".

Failure

Fails with list_mk_conj if the list is empty or if the list has more than one element, one or more of which are not of type ":bool". list mk disj 303

Example

#list_mk_conj ["T";"F";"T"];;
"T /\ F /\ T" : term
#list_mk_conj ["T";"1";"F"];;
evaluation failed     list_mk_conj
#list_mk_conj ["1"];;
"1" : term

See also

conjuncts, mk_conj.

 list_mk_disj

list_mk_disj : (term list -> term)

Synopsis

Constructs the disjunction of a list of terms.

Description

list_mk_disj(["t1";...;"tn"]) returns "t1 \/ ... \/ tn".

Failure

Fails with list_mk_disj if the list is empty or if the list has more than one element, one or more of which are not of type ":bool".

Example

#list_mk_disj ["T";"F";"T"];;
"T \/ F \/ T" : term
#list_mk_disj ["T";"1";"F"];;
evaluation failed     list_mk_disj
#list_mk_disj ["1"];;
"1" : term

See also

disjuncts, mk_disj.

 LIST_MK_EXISTS

LIST_MK_EXISTS : (term list -> thm -> thm)

Synopsis

Multiply existentially quantifies both sides of an equation using the given variables.

Description

When applied to a list of terms [x1;...;xn], where the ti are all variables, and a theorem A |- t1 = t2, the inference rule LIST_MK_EXISTS existentially quantifies both sides of the equation using the variables given, none of which should be free in the assumption list.

                A |- t1 = t2
   --------------------------------------  LIST_MK_EXISTS ["x1";...;"xn"]
    A |- (?x1...xn. t1) = (?x1...xn. t2)

Failure

Fails if any term in the list is not a variable or is free in the assumption list, or if the theorem is not equational.

See also

EXISTS_EQ, MK_EXISTS.

 list_mk_exists

list_mk_exists : ((term list # term) -> term)

Synopsis

Iteratively constructs existential quantifications.

Description

list_mk_exists(["x1";...;"xn"],"t") returns "?x1 ... xn. t".

Failure

Fails with list_mk_exists if the terms in the list are not variables or if t is not of type ":bool" and the list of terms is non-empty. If the list of terms is empty the type of t can be anything.

Comments

The system shows the type as (goal -> term).

See also

strip_exists, mk_exists.

 list_mk_forall

list_mk_forall : ((term list # term) -> term)

Synopsis

Iteratively constructs a universal quantification.

Description

list_mk_forall(["x1";...;"xn"],"t") returns "!x1 ... xn. t".

Failure

Fails with list_mk_forall if the terms in the list are not variables or if t is not of type ":bool" and the list of terms is non-empty. If the list of terms is empty the type of t can be anything.

Comments

The system shows the type as (goal -> term).

See also

strip_forall, mk_forall.

 list_mk_imp

list_mk_imp : (goal -> term)

Synopsis

Iteratively constructs implications.

Description

list_mk_imp(["t1";...;"tn"],"t") returns "t1 ==> ( ... (tn ==> t)...)".

Failure

Fails with list_mk_imp if any of t1,...,tn are not of type ":bool" or if the list of terms is non-empty and t is not of type ":bool". If the list of terms is empty the type of t can be anything.

Example

#list_mk_imp (["T";"F"],"T");;
"T ==> F ==> T" : term
#list_mk_imp (["T";"1"],"T");;
evaluation failed     list_mk_imp
#list_mk_imp (["T";"F"],"1");;
evaluation failed     list_mk_imp
#list_mk_imp ([],"1");;
"1" : term

See also

strip_imp, mk_imp.

 list_mk_pair

list_mk_pair : (term list -> term)

Synopsis

Constructs a tuple from a list of terms.

Description

list_mk_pair(["t1";...;"tn"]) returns "(t1,...,tn)".

Failure

Fails with list_mk_pair if the list is empty.

\underline{LIST MP 307}

Example

#list_mk_pair ["1";"T";"2"];;
"1,T,2" : term
#list_mk_pair ["1"];;
"1" : term

See also

strip_pair, mk_pair.

 LIST_MP

LIST_MP : (thm list -> thm -> thm)

Synopsis

Performs a chain of Modus Ponens inferences.

Description

When applied to theorems A1 |- t1, ..., An |- tn and a theorem which is a chain of implications with the successive antecedents the same as the conclusions of the theorems in the list (up to alpha-conversion), A |- t1 ==> ... ==> tn ==> t, the LIST_MP inference rule performs a chain of MP inferences to deduce A u A1 u ... u An |- t.

    A1 |- t1 ... An |- tn      A |- t1 ==> ... ==> tn ==> t
   ---------------------------------------------------------  LIST_MP
                    A u A1 u ... u An |- t

Failure

Fails unless the theorem is a chain of implications whose consequents are the same as the conclusions of the list of theorems (up to alpha-conversion), in sequence.

See also

EQ_MP, MATCH_MP, MATCH_MP_TAC, MP, MP_TAC.

 list_of_binders

list_of_binders : term list

Synopsis

List of binders in the current theory.

Description

For implementation reasons, a list containing the binders in the current theory is maintained in the assignable ML variable list_of_binders. This variable is not for general use, and users should never make assignments to it.

Failure

Evaluating the assignable variable list_of_binders never fails.

 load

load : ((string # bool) -> void)

Synopsis

Loads ML phrases from the named file.

Description

A call load(`file`,flag) will load ML phrases from the file described by file. If the boolean value flag is true, then toplevel printing of the system responses will occur, otherwise just a dot is printed for each toplevel phrase. The name file is expanded into a real filename using the same mechanism as find_ml_file.

Failure

Fails if the appropriate file cannot be found on the search path, or if an error occurs in the ML which is being loaded.

Comments

It is usual to use either loadf or loadt rather than this function, which perform the same action with one or the other setting of the flag.

See also

find_ml_file, loadf, loadt, search_path, set_search_path.

 loadf

loadf : (string -> void)

\underline{loadt 309}

Synopsis

Loads an ML file with the verbose flag set to false.

Description

The function loadf takes a string indicating the ML file name as argument and loads it in the same manner as load, except that the verbose flag is always set to false.

Failure

loadf will fail if the file named by the argument does not exist in the search path. It will fail in the same manner if the file is not a valid ML file. Failure in the ML file will terminate loading.

Example

If we have a ML file called foo.ml which contains the line

   let x=2+2;;

this can be loaded as follows:

   #loadf `foo.ml`;;

and the system would respond with:

   .() : void

See also

load, loadf.

 loadt

loadt : (string -> void)

Synopsis

loadt loads an ML file with the verbose flag set to true.

Description

The function loadt takes a string indicating the ML file name as argument and loads it in the same manner as load, except that the verbose flag is always set to true.

Failure

loadt will fail if the file named by the argument does not exist in the search path. It will fail in the same manner if the file is not a valid ML file. Failure in the ML file will also terminate loading.

Example

If we have an ML file called foo.ml which contains the line

   let x=2+2;;

this can be loaded as follows:

   #loadt `foo.ml`;;

and the system would respond with:

   x = 4 : int
   File foo.ml loaded
   () : void

See also

load, loadf.

 load_axiom

load_axiom : (string -> string -> void)

Synopsis

Loads in a given axiom from a given theory.

Description

If thy is the name of an ancestor theory, and ax one of its axioms, then

   load_axiom `thy` `ax`

attempts to load the corresponding axiom, that is, to perform dynamically the following toplevel binding:

  let ax = axiom `thy` `ax`;;

Failure

Fails if thy is not an ancestor theory, or if ax is not one of its axioms.

Example

#load_axiom `ind` `INFINITY_AX`;;
() : void
INFINITY_AX = |- ?f. ONE_ONE f /\ ~ONTO f
#INFINITY_AX;;
|- ?f. ONE_ONE f /\ ~ONTO f

Uses

Useful for autoloading.

See also

axioms, let_after, let_before, load_axioms.

 load_axioms

load_axioms : (string -> void list)

Synopsis

Loads in all the axioms from a given theory.

Description

If thy is the name of an ancestor theory, then the call

   load_axioms `thy`

attempts to load in all the axioms from that theory, that is, for each axiom ax, to perform dynamically the following toplevel binding:

  let ax = axiom `thy` `ax`;;

Failure

Fails unless thy is an ancestor theory.

312 Chapter 1. Pre-defined ML Identifiers

Example

#load_axioms `bool`;;
[(); (); (); (); ()] : void list
SELECT_AX = |- !P x. P x ==> P($@ P)
ETA_AX = |- !t. (\x. t x) = t
IMP_ANTISYM_AX = |- !t1 t2. (t1 ==> t2) ==> (t2 ==> t1) ==> (t1 = t2)
BOOL_CASES_AX = |- !t. (t = T) \/ (t = F)
ARB_THM = |- $= = $=

See also

axioms, let_after, let_before, load_axiom.

 load_definition
load_definition : (string -> string -> void)

Synopsis

Loads in a given definition from a given theory.

Description

If thy is the name of an ancestor theory, and def one of its definitions, then

   load_definition `thy` `def`

attempts to load the corresponding definition, that is, to perform dynamically the following toplevel binding:

  let def = definition `thy` `def`;;

Failure

Fails if thy is not an ancestor theory, or if def is not one of its definitions.

Example

#load_definition `bool` `FORALL_DEF`;;
() : void
FORALL_DEF = |- $! = (\P. P = (\x. T))
#FORALL_DEF;;
|- $! = (\P. P = (\x. T))

Uses

Useful for autoloading.

See also

definitions, let_after, let_before, load_definitions.

 load_definitions

load_definitions : (string -> void list)

Synopsis

Loads in all the definitions from a given theory.

Description

If thy is the name of an ancestor theory, then the call

   load_definitions `thy`

attempts to load in all the definitions of that theory, that is, for each definition def, to perform dynamically the following toplevel binding:

  let def = definition `thy` `def`;;

Failure

Fails unless thy is an ancestor theory.

314 Chapter 1. Pre-defined ML Identifiers

Example

#load_definitions `combin`;;
[(); (); (); ()] : void list
I_DEF = |- I = S K K
S_DEF = |- S = (\f g x. f x(g x))
K_DEF = |- K = (\x y. x)
o_DEF = |- !f g. f o g = (\x. f(g x))

See also

definitions, let_after, let_before, load_definition.

 load_library
load_library : (string -> void)

Synopsis

Load a library.

Description

The function load_library can either be used to load an entire library or to load only a part of a library. Loading an entire library called ‘name’ is done by evaluating

   load_library `name`;;

This will attempt to load the library called name unless it is already loaded, in which case a message is printed. The loading of a library name is done by searching for the library’s load file ‘name/name.ml’ using the internal library search path and then loading this file. For example, if the library search path contains the pathnames to a local library and to the system library:

   [`~/lib/`; `/usr/lib/hol/Library/`]

then load_library will load the ML file

   ~/lib/name/name.ml

if this exists in the local library. Otherwise, the file

   /usr/lib/hol/Library/name/name.ml

will be loaded from the system library.

A named part of a library is loaded by evaluating:

   load_library `name:partname`;;

where name is the name of the library, and partname is the name of a segment of this library. In this case, load_library searches along the library search path for the load file name/partname.ml. Note that this can be used to load an arbitrary ML file from the library. Users should not, however, rely on this feature, but should access libraries only in the ways the officially supported and documented in library manuals.

The results of evaluation during the loading of a library are displayed if the flag print_lib is true. Otherwise, the results of evaluation are not printed but abbreviated by a series of dots, each of which represents the evaluation of one ML phrase.

Failure

Fails if the library load file cannot be found or if the ML code being loaded itself fails for any reason.

Comments

More detail about the organization of libraries, in particular how to create your own, can be found in DESCRIPTION, which also gives a list of all the libraries currently in the standard HOL distribution.

See also

libraries, library_pathname, library_search_path, set_library_search_path.

 load_theorem

load_theorem : (string -> string -> void)

Synopsis

Loads in a given theorem from a given theory.

Description

If thy is the name of an ancestor theory, and th one of its axioms, then

   load_theorem `thy` `th`

will attempt to load the corresponding theorem, that is, to perform dynamically the following toplevel binding:

  let th = theorem `thy` `th`;;

Failure

Fails if thy is not an ancestor theory, or if th is not one of its theorems.

Example

#load_theorem `bool` `PAIR`;;
() : void
PAIR = |- !x. FST x,SND x = x
#PAIR;;
|- !x. FST x,SND x = x

Uses

Useful for autoloading.

See also

theorems, let_after, let_before, load_theorems.

 load_theorems

load_theorems : (string -> void list)

Synopsis

Loads in all the theorems from a given theory.

Description

If thy is the name of an ancestor theory, then the call

   load_theorems `thy`

attempts to load in all the theorems from that theory, that is, for each axiom th, to perform dynamically the following toplevel binding:

  let th = theorem `thy` `th`;;

Failure

Fails unless thy is an ancestor theory.

Example

#load_theorems `bool`;;
[(); (); (); (); ()] : void list
PAIR_EQ = |- !x y a b. (x,y = a,b) = (x = a) /\ (y = b)
SND = |- !x y. SND(x,y) = y
FST = |- !x y. FST(x,y) = x
PAIR = |- !x. FST x,SND x = x
PAIR_EXISTS = |- ?p. IS_PAIR p

See also

let_after, let_before, load_theorem, theorems.

 load_theory

load_theory : (string -> void)

Synopsis

Loads an existing theory into the system.

Description

A call load_theory `thy` loads the existing theory thy into the system and makes it the current theory. The message ‘Theory thy loaded’ is printed. The theory is entered in proof mode. Whilst in this mode only theorems may be added to the theory segment.

Failure

A call to load_theory `thy` will fail if theory thy does not appear on the current search path. It will fail if theory thy is not a descendant of the current theory. It will fail if an ancestor of theory thy has been extended with either new types or constants which clash with names in theory thy. It will also fail if any of the theory files of the theory thy have been damaged. On failure, the system recovers cleanly, unloading any theory segments it had loaded before the failure was detected. It will diverge if the theory hierarchy within theory thy contains loops, so that a theory segment is its own ancestor.

See also

extend_theory, new_parent, new_theory, print_theory, search_path.

 lookup_form_rep

lookup_form_rep : ((* list # form) -> * list)

Synopsis

This function is for internal use only and is to be deleted from a future version of the system. It should not be used.

 lookup_term

lookup_term : (* term_net -> term -> * list)

Synopsis

This function is for internal use only and is to be deleted from a future version of the system. It should not be used.

 lookup_term_rep

lookup_term_rep : ((* list # term) -> * list)

\underline{lsp 319}

Synopsis

This function is for internal use only and is to be deleted from a future version of the system. It should not be used.

 lsp

lsp : (void -> void)

Synopsis

Breaks out of top-level ML to Lisp.

Description

lsp breaks out of top-level ML to Lisp in such a fashion that one finds oneself in the particular Lisp’s break-level debugger. ML execution may be continued safely by issuing the appropriate continuation command to the Lisp in question. In Franz, this is a Control-D, in Allegro CL it is :continue, in Lucid CL it is (q), and in AKCL it is :r.

Failure

Never fails.

Example

#lsp();;
Break nil
<1>: ^D
[Return to top level]
          _________
   |___|__|   |  |   |     |__|  |__|
   |      |  |   |__|   |__|__|  |__|
          Version 1.12 (Sun3/Franz), built on Feb 23 1991
#

Comments

lsp is not meant for general use, and should be treated with great care. If one is not wary, it is entirely possible to corrupt HOL by using it.

320 Chapter 1. Pre-defined ML Identifiers

See also

dropout, lisp.
 map
map : ((* -> **) -> * list -> ** list)

Synopsis

Applies a function to every element of a list.

Description

map f [x1;...;xn] returns [(f x1);...;(f xn)].

Failure

Never fails.

Example

#map (\x. x * 2) [];;
[] : int list
#map (\x. x * 2) [1;2;3];;
[2; 4; 6] : int list

 map2
map2 : (((* # **) -> ***) -> (* list # ** list) -> *** list)

Synopsis

Maps a binary function over two lists to create one new list.

Description

map2 f ([x1;...;xn],[y1;...;yn]) returns [f(x1,y1);...;f(xn,yn)].

Failure

Fails with map2 if the two lists are of different lengths.

\underline{MAP2 CONV 321}

Example

#map2 $+ ([1;2;3],[3;2;1]);;
[4; 4; 4] : int list

See also

map, uncurry.

 MAP2_CONV
MAP2_CONV : conv -> conv

Synopsis

Compute the result of mapping a binary function down two lists.

Description

The function MAP2_CONV is a conversion for computing the result of mapping a binary function f:ty1->ty2->ty3 down two lists "[l11;...;l1n]" whose elements are of type ty1 and "[l21;...;l2n]" whose elements are of type ty2. The lengths of the two lists must be identical. The first argument to MAP2_CONV is expected to be a conversion that computes the result of applying the function f to a pair of corresponding elements of these lists. When applied to a term "f l1i l2i", this conversion should return a theorem of the form |- (f l1i l2i) = ri, where ri is the result of applying the function f to the elements l1i and l2i. Given an appropriate conv, the conversion MAP2_CONV conv takes a term of the form

"MAP2 f [l11;...;dl2tn] [l21;...;l2n]" and returns the theorem
   |- MAP2 f [l11;...;l1n] [l21;...;l2n] = [r1;...;rn]
where conv "f l1i l2i" returns |- (f l1i l2i) = ri for i from 1 to n.

Example

The following is a very simple example in which the corresponding elements from the two lists are summed to form the resulting list:

   #MAP2_CONV ADD_CONV "MAP2 $+ [1;2;3] [1;2;3]";;
   |- MAP2 $+ [1;2;3] [1;2;3] = [2;4;6]

Failure

MAP2_CONV conv fails if applied to a term not of the form described above. An application

of MAP2_CONV conv to a term "MAP2 f [l11;...;l1n] [l21;...;l2n]" fails unless for all
i where 1<=i<=n evaluating conv "f l1i l2i" returns |- (f l1i l2i) = ri for some ri.

See also

MAP_CONV

 mapfilter

mapfilter : ((* -> **) -> * list -> ** list)

Synopsis

Applies a function to every element of a list, returning a list of results for those elements for which application succeeds.

Failure

Never fails.

Example

#mapfilter hd [[1;2;3];[4;5];[];[6;7;8];[]];;
[1; 4; 6] : int list

See also

filter, map.

 maptok

maptok : ((string -> *) -> string -> * list)

Synopsis

Maps a function over the constituent words of a string.

Description

maptok f s first splits the string s into a list of substrings, and then maps the function f over that list. Splitting of the string occurs at each sequence of blanks and carriage returns (white space). This white space does not appear in the list of substrings. Leading and trailing white space in the input string is also thrown away.

Failure

Fails if one of the applications of f to a substring fails.

Example

#maptok explode `  the cat  sat `;;
[[`t`; `h`; `e`]; [`c`; `a`; `t`]; [`s`; `a`; `t`]] : string list list

Uses

Useful when wanting to map a function over a list of constant strings. Instead of using

map f [`string1`;...;`stringn`] one can use:
   (maptok f `string1 ... stringn`)

See also

words, word_separators, words2, map.

 MAP_CONV

MAP_CONV : conv -> conv

Synopsis

Compute the result of mapping a function down a list.

Description

The function MAP_CONV is a parameterized conversion for computing the result of mapping a function f:ty1->ty2 down a list "[t1;...;tn]" of elements of type ty1. The first argument to MAP_CONV is expected to be a conversion that computes the result of applying the function f to an element of this list. When applied to a term "f ti", this conversion should return a theorem of the form |- (f ti) = ri, where ri is the result of applying the function f to the element ti. Given an appropriate conv, the conversion MAP_CONV conv takes a term of the form

"[MAP f [t1;...;tn]" to the theorem
   |- MAP f [t1;...;tn] = [r1;...;rn]
where conv "f ti" returns |- (f ti) = ri for i from 1 to n.

Example

The following is a very simple example in which no computation is done for applications of the function being mapped down a list:

   #MAP_CONV NO_CONV "MAP SUC [1;2;1;4]";;
   |- MAP SUC[1;2;1;4] = [SUC 1;SUC 2;SUC 1;SUC 4]

The result just contains applications of SUC, since the supplied conversion ALL_CONV does no evaulation.

We now construct a conversion that maps SUC n for any numeral n to the numeral standing for the successor of n:

   #let SUC_CONV tm =
        let n = int_of_string(fst(dest_const(rand tm))) in
        let sucn = mk_const(string_of_int(n+1), ":num") in
            SYM (num_CONV sucn);;
   SUC_CONV = - : conv

The result is a conversion that inverts num_CONV:

   #num_CONV "4";;
   |- 4 = SUC 3
   #SUC_CONV "SUC 3";;
   |- SUC 3 = 4

The conversion SUC_CONV can then be used to compute the result of mapping the successor function down a list of numerals:

   #MAP_CONV SUC_CONV "MAP SUC [1;2;1;4]";;
   |- MAP SUC[1;2;1;4] = [2;3;2;5]

Failure

MAP_CONV conv fails if applied to a term not of the form "MAP f [t1;...;tn]". An application of MAP_CONV conv to a term "MAP f [t1;...;tn]" fails unless for all ti in the list

[t1;...;tn], evaluating conv "f ti" returns |- (f ti) = ri for some ri.

 MAP_EVERY

MAP_EVERY : ((* -> tactic) -> * list -> tactic)

Synopsis

Sequentially applies all tactics given by mapping a function over a list.

Description

When applied to a tactic-producing function f and an operand list [x1;...;xn], the elements of which have the same type as f’s domain type, MAP_EVERY maps the function f over the list, producing a list of tactics, then applies these tactics in sequence as in the case of EVERY. The effect is:

   MAP_EVERY f [x1;...;xn] = (f x1) THEN ... THEN (f xn)

If the operand list is empty, then MAP_EVERY has no effect.

Failure

The application of MAP_EVERY to a function and operand list fails iff the function fails when applied to any element in the list. The resulting tactic fails iff any of the resulting tactics fails.

Example

A convenient way of doing case analysis over several boolean variables is:

   MAP_EVERY BOOL_CASES_TAC ["var1:bool";...;"varn:bool"]

See also

EVERY, FIRST, MAP_FIRST, THEN.

 MAP_FIRST

MAP_FIRST : ((* -> tactic) -> * list -> tactic)

Synopsis

Applies first tactic that succeeds in a list given by mapping a function over a list.

Description

When applied to a tactic-producing function f and an operand list [x1;...;xn], the elements of which have the same type as f’s domain type, MAP_FIRST maps the function f over the list, producing a list of tactics, then tries applying these tactics to the goal till one succeeds. If f(xm) is the first to succeed, then the overall effect is the same as applying f(xm). Thus:

   MAP_FIRST f [x1;...;xn] = (f x1) ORELSE ... ORELSE (f xn)

Failure

The application of MAP_FIRST to a function and tactic list fails iff the function does when applied to any of the elements of the list. The resulting tactic fails iff all the resulting tactics fail when applied to the goal.

See also

EVERY, FIRST, MAP_EVERY, ORELSE.

 match

match : (term -> term -> ((term # term) list # (type # type) list))

Synopsis

Finds instantiations to match one term to another.

Description

When applied to two terms, with no outer quantifiers in the first, match attempts to find type and term instantiations for the first term (only) to make it match the second. If it succeeds, it returns the instantiations in the form of a pair containing a list of term replacements and a list of type instantiations. If the first term represents the conclusion of a theorem, the returned instantiations are of the appropriate form to be passed to

INST_TY_TERM.

Failure

Fails if the term cannot be matched by one-way instantiation.

Example

The following shows how match could be used to match the conclusion of a theorem to a term.

#let th = REFL "x:*";;
th = |- x = x
#match (concl th) "1 = 1";;
([("1", "x")], [(":num", ":*")])
: ((term # term) list # (type # type) list)
#INST_TY_TERM it th;;
|- 1 = 1

Comments

Note that there is no guarantee that the returned instantiations will be possible for INST_TY_TERM to achieve, because some of the variables (term or type) which need to be instantiated may be free in the assumptions, eg:

#top_print print_all_thm;;
- : (thm -> void)
#let th = ASSUME "x:* = x";;
th = x = x |- x = x
#match (concl th) "1 = 1";;
([("1", "x")], [(":num", ":*")])
: ((term # term) list # (type # type) list)
#INST_TY_TERM it th;;
evaluation failed     INST_TYPE: type variable free in assumptions

In fact, for instantiating a theorem, PART_MATCH is usually easier.

See also

INST_TY_TERM, PART_MATCH.

MATCH_ACCEPT_TAC

MATCH_ACCEPT_TAC : thm_tactic

Synopsis

Solves a goal which is an instance of the supplied theorem.

Description

When given a theorem A' |- t and a goal A ?- t' where t can be matched to t' by instantiating variables which are either free or universally quantified at the outer level, including appropriate type instantiation, MATCH_ACCEPT_TAC completely solves the goal.

    A ?- t'
   =========  MATCH_ACCEPT_TAC (A' |- t)

Unless A' is a subset of A, this is an invalid tactic.

Failure

Fails unless the theorem has a conclusion which is instantiable to match that of the goal.

Example

The following example shows variable and type instantiation at work. We can use the polymorphic list theorem HD:

   HD = |- !h t. HD(CONS h t) = h

to solve the goal:

   ?- HD [1;2] = 1

simply by:

   MATCH_ACCEPT_TAC HD

See also

ACCEPT_TAC.

 MATCH_MP

MATCH_MP : (thm -> thm -> thm)

Synopsis

Modus Ponens inference rule with automatic matching.

Description

When applied to theorems A1 |- !x1...xn. t1 ==> t2 and A2 |- t1', the inference rule MATCH_MP matches t1 to t1' by instantiating free or universally quantified variables in the first theorem (only), and returns a theorem A1 u A2 |- !xa..xk. t2', where t2' is a correspondingly instantiated version of t2. Polymorphic types are also instantiated if necessary.

Variables free in the consequent but not the antecedent of the first argument theorem will be replaced by variants if this is necessary to maintain the full generality of the theorem, and any which were universally quantified over in the first argument theorem will be universally quantified over in the result, and in the same order.

    A1 |- !x1..xn. t1 ==> t2   A2 |- t1'
   --------------------------------------  MATCH_MP
          A1 u A2 |- !xa..xk. t2'

Failure

Fails unless the first theorem is a (possibly repeatedly universally quantified) implication whose antecedent can be instantiated to match the conclusion of the second theorem, without instantiating any variables which are free in A1, the first theorem’s assumption list.

Example

In this example, automatic renaming occurs to maintain the most general form of the theorem, and the variant corresponding to z is universally quantified over, since it was universally quantified over in the first argument theorem.

   #let ith =
   # (GENL ["x:num"; "z:num"] o DISCH_ALL o AP_TERM "$+ (w + z)")
   #   (ASSUME "x:num = y");;
   ith = |- !x z. (x = y) ==> ((w + z) + x = (w + z) + y)
   #let th = ASSUME "w:num = z";;
   th = w = z |- w = z
   #MATCH_MP5 ith th;;
   w = z |- !z'. (w' + z') + w = (w' + z') + z

See also

EQ_MP, MATCH_MP_TAC, MP, MP_TAC.

 MATCH_MP_TAC

MATCH_MP_TAC : thm_tactic

Synopsis

Reduces the goal using a supplied implication, with matching.

Description

When applied to a theorem of the form

   A' |- !x1...xn. s ==> !y1...ym. t

MATCH_MP_TAC produces a tactic that reduces a goal whose conclusion t' is a substitution and/or type instance of t to the corresponding instance of s. Any variables free in s but not in t will be existentially quantified in the resulting subgoal:

     A ?- !v1...vi. t'
  ======================  MATCH_MP_TAC (A' |- !x1...xn. s ==> !y1...tm. t)
     A ?- ?z1...zp. s'

where z1, ..., zp are (type instances of) those variables among x1, ..., xn that do not occur free in t. Note that this is not a valid tactic unless A' is a subset of A.

Failure

Fails unless the theorem is an (optionally universally quantified) implication whose consequent can be instantiated to match the goal. The generalized variables v1, ..., vi must occur in s' in order for the conclusion t of the supplied theorem to match t'.

See also

EQ_MP, MATCH_MP, MP, MP_TAC.

 max_print_depth

max_print_depth : (int -> int)

Synopsis

Sets depth of block nesting.

Description

The function max_print_depth is used to define the maximum depth of nesting that the pretty printer will allow. If the number of blocks is greater than the the value set by max_print_depth then the blocks are truncated and this is indicated by the holophrast &. The function always returns the previous maximum depth setting.

\underline{mem 331}

Failure

Never fails.

Example

If the maximum depth setting is the default (500) and we want to change this to 20 the command will be:

   #max_print_depth 20;;

The system will then return the following:

   500 : int

See also

print_begin, print_ibegin, print_end, set_margin, print_break

 mem

mem : (* -> * list -> bool)

Synopsis

Tests whether a list contains a certain member.

Description

mem x [x1;...;xn] returns true if some xi in the list is equal to x. Otherwise it returns

false.

Failure

Never fails.

See also

find, tryfind, exists, forall, assoc, rev_assoc.

 merge_nets_rep

merge_nets_rep : ((* list # * list) -> * list)

Synopsis

This function is for internal use only and is to be deleted from a future version of the system. It should not be used.

 merge_term_nets

merge_term_nets : (* term_net -> * term_net -> * term_net)

Synopsis

This function is for internal use only and is to be deleted from a future version of the system. It should not be used.

 message

message : (string -> void)

Synopsis

Prints a message to the terminal.

Description

message s returns ():void with the side-effect of printing the string s to the terminal followed by a carriage return. String quotes are not printed around the string. The text is queued until the pretty-printer decides where line breaks are needed, or until the queue is explicitly flushed.

Failure

Never fails.

Example

#message `This is an example`;;
This is an example
() : void

See also

print_string, print_tok, print_begin, print_end, print_newline.

\underline{MK ABS 333}

 MK_ABS
MK_ABS : (thm -> thm)

Synopsis

Abstracts both sides of an equation.

Description

When applied to a theorem A |- !x. t1 = t2, whose conclusion is a universally quantified equation, MK_ABS returns the theorem A |- \x. t1 = \x. t2.

        A |- !x. t1 = t2
   --------------------------  MK_ABS
    A |- (\x. t1) = (\x. t2)

Failure

Fails unless the theorem is a (singly) universally quantified equation.

See also

ABS, HALF_MK_ABS, MK_COMB, MK_EXISTS.
 mk_abs
mk_abs : ((term # term) -> term)

Synopsis

Constructs an abstraction.

Description

mk_abs "var","t" returns the abstraction "\var. t".

Failure

Fails with mk_abs if first term is not a variable.

See also

dest_abs, is_abs, list_mk_abs, mk_var, mk_const, mk_comb.

 MK_COMB
MK_COMB : ((thm # thm) -> thm)

Synopsis

Proves equality of combinations constructed from equal functions and operands.

Description

When applied to theorems A1 |- f = g and A2 |- x = y, the inference rule MK_COMB returns the theorem A1 u A2 |- f x = g y.

    A1 |- f = g   A2 |- x = y
   ---------------------------  MK_COMB
       A1 u A2 |- f x = g y

Failure

Fails unless both theorems are equational and f and g are functions whose domain types are the same as the types of x and y respectively.

See also

AP_TERM, AP_THM.
 mk_comb
mk_comb : ((term # term) -> term)

Synopsis

Constructs a combination (function application).

Description

mk_comb "t1","t2" returns the combination "t1 t2".

Failure

Fails with mk_comb unless t1 is a function with domain type t2.

\underline{mk cond 335}

Example

#mk_comb("$~","T");;
"~T" : term
#mk_comb("T","T");;
evaluation failed     mk_comb

See also

dest_comb, is_comb, list_mk_comb, mk_var, mk_const, mk_abs.
 mk_cond
mk_cond : ((term # term # term) -> term)

Synopsis

Constructs a conditional term.

Description

mk_cond("t","t1","t2") returns "t => t1 | t2".

Failure

Fails with mk_cond if t is not of type ":bool" or if t1 and t2 are of different types.

See also

dest_cond, is_cond.
 mk_conj
mk_conj : ((term # term) -> term)

Synopsis

Constructs a conjunction.

Description

mk_conj("t1","t2") returns "t1 /\ t2".

Failure

Fails with mk_conj if either t1 or t2 are not of type ":bool".

See also

dest_conj, is_conj, list_mk_conj.

 mk_cons

mk_cons : ((term # term) -> term)

Synopsis

Constructs a CONS pair.

Description

mk_cons("t","[t1;...;tn]") returns "[t;t1;...;tn]".

Failure

Fails with mk_cons if second term is not a list or if the first term is not of the same type as the elements of the list.

See also

dest_cons, is_cons, mk_list, dest_list, is_list.

 mk_const

mk_const : ((string # type) -> term)

Synopsis

Constructs a constant.

Description

mk_const(`const`,":ty") returns the constant "const:ty".

Failure

Fails with mk_const: ... if the string supplied is not the name of a known constant, or if it is known but the type supplied is not the correct type for the constant. mk conv net 337

Example

#mk_const (`T`,":bool");;
"T" : term
#mk_const (`T`,":num");;
evaluation failed     mk_const: wrong type for T supplied
#mk_const (`test`,":bool");;
evaluation failed     mk_const: test not a constant

See also

dest_const, is_const, mk_var, mk_comb, mk_abs.

 mk_conv_net

mk_conv_net : (thm list -> conv term_net)

Synopsis

This function is for internal use only and is to be deleted from a future version of the system. It should not be used.

 mk_definition

mk_definition : (term -> term)

Synopsis

This function is for internal use only and is to be deleted from a future version of the system. It should not be used.

 mk_disj

mk_disj : ((term # term) -> term)

338 Chapter 1. Pre-defined ML Identifiers

Synopsis

Constructs a disjunction.

Description

mk_disj("t1","t2") returns "t1 \/ t2".

Failure

Fails with mk_disj if either t1 or t2 are not of type ":bool".

See also

dest_disj, is_disj, list_mk_disj.
 mk_eq
mk_eq : ((term # term) -> term)

Synopsis

Constructs an equation.

Description

mk_eq("t1","t2") returns "t1 = t2".

Failure

Fails with mk_eq if t1 and t2 have different types.

See also

dest_eq, is_eq.
 MK_EXISTS
MK_EXISTS : (thm -> thm)

Synopsis

Existentially quantifies both sides of a universally quantified equational theorem.

Description

When applied to a theorem A |- !x. t1 = t2, the inference rule MK_EXISTS returns the

theorem A |- (?x. t1) = (?x. t2).
       A |- !x. t1 = t2
   --------------------------  MK_EXISTS
    A |- (?x. t1) = (?x. t2)

Failure

Fails unless the theorem is a singly universally quantified equation.

See also

AP_TERM, EXISTS_EQ, GEN, LIST_MK_EXISTS, MK_ABS.

 mk_exists

mk_exists : ((term # term) -> term)

Synopsis

Constructs an existential quantification.

Description

mk_exists("var","t") returns "?var. t".

Failure

Fails with mk_exists if first term is not a variable or if t is not of type ":bool".

See also

dest_exists, is_exists, list_mk_exists.

 mk_forall

mk_forall : ((term # term) -> term)

Synopsis

Term constructor for universal quantification.

Description

mk_forall("var","t") returns "!var. t".

Failure

Fails with mk_forall if first term is not a variable or if t is not of type ":bool".

See also

dest_forall, is_forall, list_mk_forall.

 mk_form

mk_form : (term -> form)

Synopsis

This function is for internal use only and is to be deleted from a future version of the system. It should not be used.

 mk_imp

mk_imp : ((term # term) -> term)

Synopsis

Constructs an implication.

Description

mk_imp("t1","t2") returns "t1 ==> t2".

Failure

Fails with mk_imp if either t1 or t2 are not of type ":bool".

See also

dest_imp, is_imp, list_mk_imp.

 mk_let

mk_let : ((term # term) -> term)

\underline{mk list 341}

Synopsis

Constructs a let term.

Description

mk_let("f","x") returns "LET f x". If f is of the form "\y. t" then the result will be pretty-printed as "let y=x in t".

Failure

Fails with mk_let if the types of f and x are such that "LET f x" is not well-typed. "LET" has most general type:

   ":(* -> **) -> * -> **"

Example

#mk_let("$= 1","2");;
"LET($= 1)2" : term
#mk_let("\x. x = 1","2");;
"let x = 2 in (x = 1)" : term

See also

dest_let, is_let.

 mk_list

mk_list : ((term list # type) -> term)

Synopsis

Constructs object-level list from list of terms.

Description

mk_list(["t1";...;"tn"],":ty") returns "[t1;...;tn]:(ty)list". The type argument

is required so that empty lists can be constructed.

Failure

Fails with mk_list if any term in the list is not of the type specified as the second argument.

See also

dest_list, is_list, mk_cons, dest_cons, is_cons.

 mk_neg
mk_neg : (term -> term)

Synopsis

Constructs a negation.

Description

mk_neg "t" returns "~t".

Failure

Fails with mk_neg unless t is of type bool.

See also

dest_neg, is_neg.
 mk_pabs
mk_pabs : ((term # term) -> term)

Synopsis

Constructs a paired abstraction.

Description

mk_pabs "(v1,..(..)..,vn)","t" returns the abstraction "\(v1,..(..)..,vn). t".

Failure

Fails unless the first term is an arbitrarily nested pair composed from variables.

See also

dest_pabs, is_pabs, mk_abs.
 mk_pair
mk_pair : ((term # term) -> term)

\underline{mk pp thm 343}

Synopsis

Constructs object-level pair from a pair of terms.

Description

mk_pair("t1","t2") returns "(t1,t2)".

Failure

Never fails.

See also

dest_pair, is_pair, list_mk_pair.

 mk_pp_thm

mk_pp_thm : ((form list # form) -> thm)

Synopsis

This function is for internal use only and is to be deleted from a future version of the system. It should not be used.

 mk_pred

mk_pred : ((string # term) -> term)

Synopsis

Makes an application of a predicate.

Description

When applied to the name of a constant predicate, that is a constant of type ":* -> bool" for some type ‘*’, and an operand term, mk_pred constructs an application of the predicate to the operand.

Failure

Fails if there is no constant with the appropriate name and type.

Example

#mk_pred(`~`,"T");;
"~T" : term

See also

mk_comb, mk_const, new_predicate.

 mk_primed_var

mk_primed_var : ((string # type) -> term)

Synopsis

Primes a variable name sufficiently to make it distinct from all constants.

Description

When applied to a string `v` and a type ":ty", the function mk_primed_var constructs a variable whose name consists of v followed by however many primes are necessary to make it distinct from any constants in the current theory.

Failure

Never fails.

Example

#new_theory `wombat`;;
() : void
#mk_primed_var(`x`,":bool");;
"x" : term
#new_constant(`x`,":num");;
() : void
#mk_primed_var(`x`,":bool");;
"x'" : term

See also

genvar, variant.

 mk_select
mk_select : ((term # term) -> term)

Synopsis

Constructs a choice-term.

Description

mk_select("var","t") returns "@var. t".

Failure

Fails with mk_select if first term is not a variable or if t is not of type ":bool".

See also

dest_select, is_select.
 mk_thm
mk_thm : (((term list # term) -> thm))

Synopsis

Creates an arbitrary theorem (dangerous!)

Description

The function mk_thm can be used to construct an arbitrary theorem. It is applied to a pair consisting of the desired assumption list (possibly empty) and conclusion. All the terms therein should be of type bool.

   mk_thm(["a1";...;"an"],"c") = ({a1,...,an} |- c)

Failure

Fails unless all the terms provided for assumptions and conclusion are of type bool.

Example

The following shows how to create a simple contradiction:

   #mk_thm([],"F");;
   |- F

Comments

Although mk_thm can be useful for experimentation or temporarily plugging gaps, its use should be avoided if at all possible in important proofs, because it can be used to create theorems leading to contradictions. The example above is a trivial case, but it is all too easy to create a contradiction by asserting ‘obviously sound’ theorems.

All theorems which are likely to be needed can be derived using only HOL’s inbuilt 5 axioms and 8 primitive inference rules, which are provably sound (see the DESCRIP-TION). Basing all proofs, normally via derived rules and tactics, on just these axioms and inference rules gives proofs which are (apart from bugs in HOL or the underlying system) completely secure. This is one of the great strengths of HOL, and it is foolish to sacrifice it to save a little work.

Note that the system shows the type of mk_thm as (goal -> thm).

See also

new_axiom.

 mk_type

mk_type : ((string # type list) -> type)

Synopsis

Constructs a type (other than a variable type).

Description

mk_type(`op`,[":ty1";...;":tyn"]) returns ":(ty1,...,tyn)op" where op is the name

of a known n-ary type constructor.

Failure

Fails with mk_type if the string is not the name of a known type, or if the type is known but the length of the list of argument types is not equal to the arity of the type constructor.

\underline{mk var 347}

Example

#mk_type (`bool`,[]);;
":bool" : type
#mk_type (`list`,[":bool"]);;
":(bool)list" : type
#mk_type (`fun`,[":num";":bool"]);;
":num -> bool" : type

See also

dest_type, mk_vartype.

 mk_var

mk_var : ((string # type) -> term)

Synopsis

Constructs a variable of given name and type.

Description

mk_var(`var`,":ty") returns the variable "var:ty".

Failure

Never fails.

Comments

mk_var can be used to construct variables with names which are not acceptable to the term parser. In particular, a variable with the name of a known constant can be constructed

using mk_var.

See also

dest_var, is_var, mk_const, mk_comb, mk_abs.

 mk_vartype

mk_vartype : (string -> type)

Synopsis

Constructs a type variable of the given name.

Description

mk_vartype(`*...`) returns ":*...".

Failure

Fails with mk_vartype if the string does not begin with `*`.

Example

#mk_vartype `*test`;;
":*test" : type
#mk_vartype `test`;;
evaluation failed     mk_vartype

Comments

mk_vartype can be used to create type variables with names which will not parse, i.e. they cannot be entered by quotation.

See also

dest_vartype, is_vartype, mk_type.

 ml_curried_infix

ml_curried_infix : (string -> void)

Synopsis

Declares an ML identifier to have infix status (for curried functions).

Description

ml_curried_infix `string` declares to the ML parser that string has infix status. The identifier string should be bound to a curried function.

Failure

Only ordinary identifiers and certain single character, non-digit, non-layout strings can be used as infixes. An attempt to infix other strings may fail, or it may succeed but have unpredictable effects on the parser. ml dir pathname 349

Example

#ml_curried_infix `plus`;;
() : void
#let x plus y = x + y;;
plus = - : (int -> int -> int)
#1 plus 2;;
3 : int

See also

ml_paired_infix, is_ml_curried_infix, is_ml_paired_infix, is_ml_infix.
 ml_dir_pathname
ml_dir_pathname : string

Synopsis

Absolute pathname to the HOL ML sources.

Description

For implementation reasons, the ML variable ml_dir_pathname is bound when the system if built to a string giving the absolute pathname of the directory containing the HOL ML sources. This value is not for general use.

Failure

Evaluating ml_dir_pathname never fails.

See also

lisp_dir_pathname.
 ML_eval
ML_eval : (string -> void)

Synopsis

Passes a string to the ML interpreter.

Description

When applied to a string, ML_eval will pass it to the ML interpreter, which, after evaluating other pending phrases, will interpret it as if it had been typed at toplevel.

Failure

The call itself never fails, but of course the subsequent interpretation may do.

Example

#ML_eval(`let greeting = \`Hi there!\` in tty_write greeting;;
#`);;
() : void
Hi there!() : void

See also

inject_input, let_after, let_before.

 ml_paired_infix

ml_paired_infix : (string -> void)

Synopsis

Declares an ML identifier to have infix status (for functions that take a pair as argument).

Description

ml_paired_infix `string` declares to the ML parser that string has infix status. string should be bound to a function that takes a pair as its argument.

Failure

Only ordinary identifiers and certain single character, non-digit, non-layout strings can be used as infixes. An attempt to infix other strings may fail, or it may succeed but have unpredictable effects on the parser.

\underline{MP 351}

Example

#ml_paired_infix `plus`;;
() : void
#let x plus y = x + y;;
plus = - : ((int # int) -> int)
#1 plus 2;;
3 : int

See also

ml_curried_infix, is_ml_paired_infix, is_ml_curried_infix, is_ml_infix.

 MP

MP : (thm -> thm -> thm)

Synopsis

Implements the Modus Ponens inference rule.

Description

When applied to theorems A1 |- t1 ==> t2 and A2 |- t1, the inference rule MP returns the theorem A1 u A2 |- t2.

    A1 |- t1 ==> t2   A2 |- t1
   ----------------------------  MP
          A1 u A2 |- t2

Failure

Fails unless the first theorem is an implication whose antecedent is the same as the conclusion of the second theorem (up to alpha-conversion).

See also

EQ_MP, LIST_MP, MATCH_MP, MATCH_MP_TAC, MP_TAC, NOT_MP.

 MP_TAC

MP_TAC : thm_tactic

Synopsis

Reduces a goal to implication from a known theorem.

Description

When applied to the theorem A' |- s and the goal A ?- t, the tactic MP_TAC reduces the goal to A ?- s ==> t. Unless A' is a subset of A, this is an invalid tactic.

       A ?- t
   ==============  MP_TAC (A' |- s)
    A ?- s ==> t

Failure

Never fails.

See also

MATCH_MP_TAC, MP, UNDISCH_TAC.

 NEG_DISCH

NEG_DISCH : (term -> thm -> thm)

Synopsis

Discharges an assumption, transforming |- s ==> F into |- ~s.

Description

When applied to a term s and a theorem A |- t, the inference rule NEG_DISCH returns the theorem A - {s} |- s ==> t, or if t is just F, returns the theorem A - {s} |- ~s.

          A |- F
   --------------------  NEG_DISCH    [special case]
      A - {s} |- ~s
          A |- t
   --------------------  NEG_DISCH    [general case]
    A - {s} |- s ==> t

Failure

Fails unless the supplied term has type bool.

See also

DISCH, NOT_ELIM, NOT_INTRO.

 new_alphanum

new_alphanum : (string -> void)

Synopsis

Defines a character to be alphanumeric.

Description

When given a string, which should be of length 1, new_alphanum extends the scope of the definition of ‘alphanumeric’ as used by is_alphanum. (If the supplied string is null (``) then new_alphanum has no effect.)

The term ‘alphanumeric’ initially means one of the following: a..z A..Z 0..9 _'. A call to new_alphanum can affect ML lexical analysis dynamically, because the function is_alphanum is called by the lexical analyzer to check for characters beyond the first in an identifier.

Example

Suppose we set a variable y as follows:

   #let y = 2;;
   y = 2 : int

then y-1 is a numeric expression:

   #let x = y-1;;
   x = 1 : int

but after defining - to be alphanumeric:

   #new_alphanum `-`;;
   () : void

y-1 counts as a single token (which is undefined).

   #let x = y-1;;
   unbound or non-assignable variable y-1

Failure

Fails if the string has length greater than 1.

See also

ascii, ascii_code, is_alphanum, is_letter, new_alphanum.

 new_axiom

new_axiom : ((string # term) -> thm)

Synopsis

Sets up a new axiom in the current theory.

Description

If tm is a term of type bool, a call new_axiom(`name`,"tm") creates a theorem

   |- !x1..xn. tm

and stores it away in the theory file. Note that all free variables in tm are generalized automatically before the axiom is set up.

Failure

Fails if HOL is not in draft mode, or there is already an axiom or definition of that name in the current theory, or it the given term does not have type bool.

Example

#new_theory `gurk`;;
() : void
#new_axiom(`untrue`,"x = 1");;
|- !x. x = 1

Comments

For most purposes, it is unnecessary to declare new axioms: all of classical mathematics can be derived by definitional extension alone. Proceeding by definition is not only more elegant, but also guarantees the consistency of the deductions made. However, there are certain entities which cannot be modelled in simple type theory without further axioms, such as higher transfinite ordinals.

See also

mk_thm, new_definition.

 new_binder

new_binder : ((string # type) -> void)

Synopsis

Sets up a new binder in the current theory.

Description

A call new_binder(`bnd`,":ty") declares a new binder bnd in the current theory. The type must be of the form (* -> **) -> ***, because being a binder, bnd will apply to an abstraction; for example "!x:bool. (x=T) \/ (x=F)" is actually a prettyprinting of

"$! (\x. (x=T) \/ (x=F))".

Failure

Fails if HOL is not in draft mode, or there is already a constant of some sort of that name in the current theory, or if the type does not correspond to the above pattern.

Example

#new_theory `anorak`;;
() : void
#new_binder(`!!`,":(bool->bool)->bool");;
() : void
#"!!x. T";;
"!! x. T" : term

See also

binders, is_binder.

 new_binder_definition

new_binder_definition : ((string # term) -> thm)

Synopsis

Defines a new constant, giving it the syntactic status of a binder.

Description

The function new_binder_definition provides a facility for making definitional extensions to the current theory by introducing a constant definition. It takes a pair of arguments, consisting of the name under which the resulting theorem will be saved in the current theory segment and a term giving the desired definition. The value returned by new_binder_definition is a theorem which states the definition requested by the user.

Let v1, ..., vn be syntactically distinct tuples constructed from the variables x1,...,xm. A binder is defined by evaluating

   new_binder_definition (`name`, "b v1 ... vn = t")

where b is not already a constant, b does not occur in t, all the free variables that occur in t are a subset of x1,...,xn, and the type of b has the form ‘(ty1->ty2)->ty3’. This declares b to be a new constant with the syntactic status of a binder in the current theory, and with the definitional theorem

   |- !x1...xn. b v1 ... vn = t

as its specification. This constant specification for b is saved in the current theory under the name name and is returned as a theorem.

The equation supplied to new_binder_definition may optionally have any of its free variables universally quantified at the outermost level. The constant b has binder status only after the definition has been made.

Failure

new_binder_definition fails if called when HOL is not in draft mode. It also fails if there is already an axiom, definition or specification with the given name in the current theory segment, if `b` is already a constant in the current theory or is not an allowed name for a constant, if t contains free variables that are not in any one of the variable structures v1, ..., vn or if any variable occurs more than once in v1, ..., v2. Failure also occurs if the type of b is not of the form appropriate for a binder, namely a type of teh form ‘(ty1->ty2)->ty3’. Finally, failure occurs if there is a type variable in v1, ..., vn or t that does not occur in the type of b.

Example

The unique-existence quantifier ?! is defined as follows.

   #new_binder_definition
     (`EXISTS_UNIQUE_DEF`,
      "$?! = \P:(*->bool). ($? P) /\ (!x y. ((P x) /\ (P y)) ==> (x=y))");;
   |- $?! = (\P. $? P /\ (!x y. P x /\ P y ==> (x = y)))

Comments

It is a common practice among HOL users to write a $ before the constant being defined as a binder to indicate that it will have a special syntactic status after the definition is made:

   new_binder_definition(`name`, "$b = ... ");;

This use of $ is not necessary; but after the definition has been made $ must, of course, be used if the syntactic status of b needs to be suppressed.

See also

new_definition, new_gen_definition, new_infix_definition,
new_infix_list_rec_definition, new_prim_rec_definition,
new_list_rec_definition, new_prim_rec_definition.

 new_constant

new_constant : ((string # type) -> void)

Synopsis

Declares a new constant in the current theory.

Description

A call new_constant(`c`,":ty") makes c a constant in the current theory. Note that it does not specify its value. The constant may have a polymorphic type, which can be used in arbitrary instantiations.

Failure

Fails if HOL is not in draft mode, or if the name is not a valid constant name, or there is already a constant of that name in the current theory.

Example

#new_theory `zonk`;;
() : void
#new_constant(`graham's_number`,":num");;
() : void

See also

constants, infixes, is_constant, is_infix, new_infix, new_definition,
new_infix_definition.

 new_definition

new_definition : ((string # term) -> thm)

Synopsis

Declare a new constant and install a definitional axiom in the current theory.

Description

The function new_definition provides a facility for definitional extensions to the current theory. It takes a pair argument consisting of the name under which the resulting definition will be saved in the current theory segment, and a term giving the desired definition. The value returned by new_definition is a theorem which states the definition requested by the user.

Let v_1,...,v_n be tuples of distinct variables, containing the variables x_1,...,x_m.

Evaluating new_definition (`name`, "c v_1 ... v_n = t"), where c is not already a

constant, declares the sequent ({},"\v_1 ... v_n. t") to be a definition in the current theory, and declares c to be a new constant in the current theory with this definition as its specification. This constant specification is returned as a theorem with the form

   |- !x_1 ... x_m. c v_1 ... v_n = t

and is saved in the current theory under (the name) name. Optionally, the definitional term argument may have any of its variables universally quantified.

Failure

new_definition fails if called when HOL is not in draft mode. It also fails if there is already an axiom, definition or specification of the given name in the current theory \underline{new flag 359}

segment; if `c` is already a constant in the current theory or is not an allowed name for a constant; if t contains free variables that are not in any of the variable structures v_1, ..., v_n (this is equivalent to requiring \v_1 ... v_n. t to be a closed term); or if any variable occurs more than once in v_1, ..., v_n. Finally, failure occurs if there is a type variable in v_1, ..., v_n or t that does not occur in the type of c.

Example

A NAND relation can be defined as follows.

   #new_definition
    (`NAND2`, "NAND2 (in_1,in_2) out = !t:num. out t = ~(in_1 t /\ in_2 t)");;
   |- !in_1 in_2 out.
       NAND2 (in_1,in_2)out = (!t. out t = ~(in_1 t /\ in_2 t))

See also

new_binder_definition, new_gen_definition, new_infix_definition,
new_infix_list_rec_definition, new_prim_rec_definition,
new_list_rec_definition, new_prim_rec_definition, new_recursive_definition,
new_specification.

 new_flag

new_flag : ((string # bool) -> void)

Synopsis

Creates a new settable flag.

Description

A call new_flag(`flagname`,init) declares a new settable flag called flagname, with an initial setting of init (either true or false). Like a system flag, it can be read and written to with get_flag_value and set_flag_value respectively, and will be listed along with the others by flags().

Failure

Fails if there is already a flag of the given name.

Example

#new_flag(`parser hacked`,false);;
() : void
#get_flag_value `parser hacked`;;
false : bool

See also

flags, get_flag_value, set_flag_value.

 new_gen_definition

new_gen_definition : (string -> (string # term) -> thm)

Synopsis

Defines a new constant, infix constant, or binder constant.

Description

The function new_gen_definition provides a facility for definitional extensions to the current theory. It takes two arguments. The first is a flag which can have one of three values: `constant`, `infix`, or `binder`, indicating the status of the object being defined. The second argument is a pair consisting of the name under which the resulting definition will be saved in the current theory segment, and a term giving the desired definition. The value returned by new_gen_definition is a theorem which states the definition requested by the user.

Let v_1,...,v_n be tuples of distinct variables, containing the variables x_1,...,x_m.

Evaluating new_gen_definition flag (`name`, "c v_1 ... v_n = t"), where c is not al-

ready a constant, declares the sequent ({},"\v_1 ... v_n. t") to be a definition in the current theory, and declares c to be a new constant in the current theory with this definition as its specification. This constant specification is returned as a theorem, generally of the form |- !x_1 ... x_m. c v_1 ... v_n = t , and is saved in the current theory under (the name) name. If flag is `infix` or `binder`, the constant is given infix or binder status accordingly. Optionally, the definitional term argument may have any of its variables universally quantified.

Failure

new_gen_definition fails if called when HOL is not in draft mode. It also fails if there is already an axiom, definition or specification of the given name in the current theory \underline{new infix 361}

segment; if c is already a constant in the current theory or is not an allowed name for a constant; if t contains free variables that are not in any of the variable structures v_1, ..., v_n (this is equivalent to requiring \v_1 ... v_n. t to be a closed term); or if any variable occurs more than once in v_1, ..., v_n. Failure also occurs if flag is not one of `constant`, `infix` or `binder` or if the type of c is not suitable for a constant with the syntactic status specified by flag. Finally, failure occurs if there is a type variable in v_1, ..., v_n or t that does not occur in the type of c.

Uses

Used to define the special purpose functions new_definition, new_infix_definition, and new_binder_definition, which are used for defining objects with a particular status.

See also

DEF_EXISTS_RULE, new_binder_definition, new_definition, new_infix_definition,
new_specification.

 new_infix

new_infix : ((string # type) -> void)

Synopsis

Declares a new infix constant in the current theory.

Description

A call new_infix(`i`,":ty") makes i an infix constant in the current theory. Note that it does not specifiy its value. The constant may have a polymorphic type, which may be arbitrarily instantiated. Like any other infix or binder, its special parse status may be suppressed by preceding it with a dollar sign.

Failure

Fails if HOL is not in draft mode, or if the name is not a valid constant name, or there is already a constant of that name in the current theory.

Example

The following shows the use of the curried form as well as the infix:

   #new_theory `groke`;;
   () : void
   #new_infix(`orelse`,":bool->bool->bool");;
   () : void
   #"T orelse F";;
   "T orelse F" : term
   #"$orelse T F";;
   "T orelse F" : term

See also

constants, infixes, is_constant, is_infix, new_constant, new_definition,
new_infix_definition.

 new_infix_definition
new_infix_definition : ((string # term) -> thm)

Synopsis

Declares a new infix constant and installs a definitional axiom in the current theory.

Description

The function new_infix_definition provides a facility for definitional extensions to the current theory. It takes a pair argument consisting of the name under which the resulting definition will be saved in the current theory segment, and a term giving the desired definition. The value returned by new_infix_definition is a theorem which states the definition requested by the user.

Let v_1 and v_2 be tuples of distinct variables, containing the variables x_1,...,x_m.

Evaluating new_infix_definition (`name`, "ix v_1 v_2 = t"), where ix is not already

a constant, declares the sequent ({},"\v_1 v_2. t") to be a definition in the current theory, and declares ix to be a new constant in the current theory with this definition as its specification. This constant specification is returned as a theorem with the form

   |- !x_1 ... x_m. v_1 ix v_2 = t

and is saved in the current theory under (the name) name. Optionally, the definitional term argument may have any of its variables universally quantified. The constant ix has infix status only after the infix declaration has been processed. It is therefore necessary to use the constant in normal prefix position when making the definition.

Failure

new_infix_definition fails if called when HOL is not in draft mode. It also fails if there is already an axiom, definition or specification of the given name in the current theory segment; if `ix` is already a constant in the current theory or is not an allowed name for a constant; if t contains free variables that are not in either of the variable structures v_1 and v_2 (this is equivalent to requiring \v_1 v_2. t to be a closed term); or if any variable occurs more than once in v_1, v_2. Failure also occurs if the type of ix is not of the form :ty_1->ty_2->ty_3. Finally, failure occurs if there is a type variable in v_1, ..., v_n or t that does not occur in the type of ix.

Example

The nand function can be defined as follows.

   #new_infix_definition
    (`nand`, "$nand in_1 in_2 = ~(in_1 /\ in_2)");;
   |- !in_1 in_2. in_1 nand in_2 = ~(in_1 /\ in_2)

Comments

It is a common practice among HOL users to write a $ before the constant being defined as an infix to indicate that after the definition is made, it will have a special syntactic status; ie. to write:

   new_infix_definition(`ix_DEF`, "$ix m n = ... ")

This use of $ is not necessary; but after the definition has been made $ must, of course, be used if the syntactic status needs to be suppressed.

See also

new_binder_definition, new_definition, new_gen_definition,
new_infix_list_rec_definition, new_prim_rec_definition,
new_list_rec_definition, new_prim_rec_definition.

 new_infix_list_rec_definition

new_infix_list_rec_definition : ((string # term) -> thm)

Synopsis

Defines an infix primitive recursive function over the type of lists.

Description

The function new_infix_list_rec_definition provides the facility for defining primitive recursive functions with infix status on the type of lists. It takes a pair argument, consisting of the name under which the resulting definition will be saved in the current theory segment, and a term giving the desired definition. The value returned by new_infix_list_rec_definition is a theorem which states the definition requested by the user. This theorem is derived by formal proof from an instance of the theorem

list_Axiom:
   |- !x f. ?! fn. (fn[] = x) /\ (!h t. fn(CONS h t) = f(fn t)h t)

Evaluating

   new_infix_list_rec_definition
    (`fun_DEF`,
     "(fun [] x = f_1[x]) /\
      (fun (CONS h t) x = f_2[fun t x', h, t, x])");;

where all the free variables in the term x' are contained in {h, t, x}, automatically proves the theorem:

   |-  ?fun. !x. fun x = f_1[x] /\
             !x. fun (CONS h t) x = f_2[fun t x', h, t, x]

and then declares a new constant fun with this property as its specification. This constant specification is returned as a theorem by new_infix_list_rec_definition and is saved with name fun_DEF in the current theory segment.

The ML function new_infix_list_rec_definition is, in fact, slightly more general than is indicated above. In particular, a curried primitive recursive function can be defined by primitive recursion on either one of its arguments using this ML function. The ML function new_infix_list_rec_definition also allows the user to partially specify the value of a function defined (possibly recursively) on lists by giving its value for only one of []

or CONS h t.

Failure

Failure occurs if: HOL cannot prove there is a function satisfying the specification (i.e. if the term supplied to new_infix_list_rec_definition is not a well-formed primitive recursive definition), or if any other condition for making a constant specification is violated (see the failure conditions for new_specification).

Example

An infix append function on polymorphic lists can be defined by

   new_infix_list_rec_definition
   (`app_i`, "($app_i [] l = l) /\
              ($app_i (CONS (h:*) t) l = CONS h ($app_i t l))");;

The $’s are there (as documentation) to indicate that the constant app_i is being declared to be an infix. Evaluating this ML expression will create the following constant specification in the current theory segment:

    |- (!l. [] app_i l = l) /\ (!h t l. (CONS h t) app_i l = CONS h(t app_i l))

See also

new_definition, new_infix_definition, new_infix_prim_rec_definition,
new_list_rec_definition, new_prim_rec_definition, new_recursive_definition,
new_type_definition, new_specification, list_Axiom.

 new_infix_prim_rec_definition

new_infix_prim_rec_definition : ((string # term) -> thm)

Synopsis

Defines an infix primitive recursive function over the type num.

Description

The function new_infix_prim_rec_definition provides the facility for defining primitive recursive functions with infix status on the type num. It takes a pair argument, consisting of the name under which the resulting definition will be saved in the current theory segment, and a term giving the desired definition. The value returned by new_infix_prim_rec_definition is a theorem which states the definition requested by the user. This theorem is derived by formal proof from an instance of the theorem num_Axiom:

   |- !e f. ?! fn. (fn 0 = e) /\ (!n. fn(SUC n) = f(fn n)n)

Evaluating

   new_infix_prim_rec_definition
    (`fun_DEF`,
     "(fun 0 x = f_1[x]) /\
      (fun (SUC n) x = f_2[fun n x', n, x])");;

where all the free variables in the term x' are contained in {n, x}, automatically proves the theorem:

   |-  ?fun. !x. fun 0 x = f_1[x] /\
             !x. fun (SUC n) x = f_2[fun n x', n, x]

and then declares a new constant fun with this property and infix status as its specification. This constant specification is returned as a theorem and is saved with name fun_DEF in the current theory segment.

The ML function new_infix_prim_rec_definition is, in fact, slightly more general than is indicated above. In particular, a curried primitive recursive function can be defined by primitive recursion on either one of its arguments using this ML function. The ML function new_infix_prim_rec_definition also allows the user to partially specify the value of a function defined (possibly recursively) on the natural numbers by giving its value for only one of 0 or SUC n.

Failure

Failure occurs if HOL cannot prove there is a function satisfying the specification (ie. if the term supplied to new_prim_rec_definition is not a well-formed primitive recursive definition); if the type of fun is not of the form ty_1->ty_2->ty_3, or if any other condition for making a constant specification is violated (see the failure conditions for

new_specification).

Example

Here is the recursive definition of the constant + used by the system:

   new_infix_prim_rec_definition
    (`ADD`,
     "($+ 0 n = n) /\
      ($+ (SUC m) n = SUC($+ m n))")

The $’s are there (as documentation) to indicate that the constant + is being declared to be an infix. Evaluating this ML expression will create the following constant specification in the current theory segment:

   ADD = |- (!n. 0 + n = n) /\ (!m n. (SUC m) + n = SUC(m + n))

See also

new_definition, new_infix_definition, new_infix_list_rec_definition,
new_prim_rec_definition, new_list_rec_definition, new_recursive_definition,
new_type_definition, new_specification, num_Axiom.

 new_letter

new_letter : (string -> void)

Synopsis

Defines a character to be a letter.

Description

When given a string, which should be of length 1, new_letter extends the scope of the definition of ‘letter’ as used by is_letter. (If the supplied string is null (``) new_letter has no effect.)

The definition of a ‘letter’ by default includes (only) a..z A..Z. A call to new_letter can affect ML lexical analysis dynamically, because the function is_letter is called by the lexical analyzer to check for the start of an identifier.

Example

In the default state, -1 is parsed as the application of - to 1:

   #let x = -1 ;;
   x = -1 : int

but if we make - into a letter:

   #new_letter(`-`);;
   () : void

then -1 parses as an (undefined) identifier.

   #let x = -1;;
   unbound or non-assignable variable -1

Failure

Fails if the string has length greater than 1.

See also

ascii, ascii_code, is_alphanum, is_letter, new_alphanum.

 new_list_rec_definition

new_list_rec_definition : ((string # term) -> thm)

Synopsis

Defines a primitive recursive function over the type of lists.

Description

The function new_list_rec_definition provides the facility for defining primitive recursive functions on the type of lists. It takes a pair argument, consisting of the name under which the resulting definition will be saved in the current theory segment, and a term giving the desired definition. The value returned by new_list_rec_definition is a theorem which states the definition requested by the user. This theorem is derived by formal proof from an instance of the theorem list_Axiom:

   |- !x f. ?! fn. (fn[] = x) /\ (!h t. fn(CONS h t) = f(fn t)h t)

Evaluating

   new_list_rec_definition
    (`fun_DEF`,
     "(fun x_1 ... [] ... x_i = f_1[x_1, ..., x_i]) /\
      (fun x_1 ... (CONS h t) ... x_i =
               f_2[fun t_1 ... t ... t_i, x_1, ..., h, t, ..., x_i])");;

where all the free variables in the terms t_1, ..., t_i are contained in {h,t,x_1,...,x_i}, automatically proves the theorem:

   |-  ?fun. !x_1 ... x_i. fun x_1 ... [] ... x_i = f_1[x_1, ..., x_i] /\
             !x_1 ... x_i. fun (CONS h t) x_1 ... x_i =
                            f_2[fun t_1 ... t ... t_i, x_1, ..., h, t, ...,x_i]

and then declares a new constant fun with this property as its specification. This constant specification is returned as a theorem by new_list_rec_definition and is saved with name fun_DEF in the current theory segment.

The ML function new_list_rec_definition also allows the user to partially specify the value of a function defined (possibly recursively) on lists by giving its value for only one of [] or CONS h t. See the examples below.

Failure

Failure occurs if HOL cannot prove there is a function satisfying the specification (ie. if the term supplied to mlnew_list_rec_definition is not a well-formed primitive recursive definition), or if any other condition for making a constant specification is violated (see the failure conditions for new_specification).

Example

The HOL system defines a length function, LENGTH, on lists by the primitive recursive definition on lists shown below:

   new_list_rec_definition
     (`LENGTH`,
     "(LENGTH NIL = 0) /\
      (!h:*. !t. LENGTH (CONS h t) = SUC (LENGTH t))")

When this ML expression is evaluated, HOL uses list_Axiom to prove existence of a function that satisfies the given primitive recursive definition, introduces a constant to name this function using a constant specification, and stores the resulting theorem:

    LENGTH   |- (LENGTH[] = 0) /\ (!h t. LENGTH(CONS h t) = SUC(LENGTH t))

in the current theory segment (in this case, the theory list).

Using new_list_rec_definition, the predicate NULL and the selectors HD and TL are defined in the theory list by the specifications:

   NULL |- NULL[] /\ (!h t. ~NULL(CONS h t))
   HD   |- !(h:*) t. HD(CONS h t) = h
   TL   |- !(h:*) t. TL(CONS h t) = t

See also

new_definition, new_infix_definition, new_infix_list_rec_definition,
new_infix_prim_rec_definition, new_prim_rec_definition,
new_recursive_definition, new_type_definition, new_specification, list_Axiom.

 new_open_axiom

new_open_axiom : ((string # term) -> thm)

Synopsis

This function is for internal use only and is to be deleted from a future version of the system. It should not be used.

 new_parent

new_parent : (string -> void)

Synopsis

Extends the current theory with a new parent theory.

Description

Executing new_parent `thy` extends the current theory by making the existing theory named thy a parent of the current theory segment. The extended theory contains the theory segments of both constituent theories. The theory thy is loaded into the system. The message ‘Theory thy loaded’ is printed. The effect of the call may not be written to the theory file of the segment until close_theory is invoked. If HOL is quitted before this, the effect may not persist to future HOL sessions.

Failure

Executing new_parent `thy` will fail if the system is not in draft mode. It will fail if thy is not a theory on the current search path. It will fail if there is a type in theory thy with the same name as a type in the current theory. It will fail if there is a constant in theory thy with the same name as a constant in the current theory. It will fail if an ancestor of theory thy has been extended with either new types or constants which clash with names in theory thy. It will also fail if any of the theory files of theory thy have been damaged. On failure, the system recovers cleanly, unloading any theory segments it had loaded before the failure was detected.

See also

close_theory, extend_theory, new_theory, print_theory, search_path.

 new_predicate

new_predicate : ((string # type) -> void)

Synopsis

Creates a new predicate constant.

Description

The call

   new_predicate(`P`,":ty")

will declare a new predicate called P on type ty, that is, a constant P of type ty->bool.

Failure

Fails if HOL is not in draft mode, or if there is already a constant of the corresponding name in the current theory segment.

See also

mk_const, mk_pred.

 new_prim_rec_definition

new_prim_rec_definition : ((string # term) -> thm)

Synopsis

Define a primitive recursive function over the type :num.

Description

The function new_prim_rec_definition provides the facility for defining primitive recursive functions on the type num. It takes a pair argument, consisting of the name under which the resulting definition will be saved in the current theory segment, and a term giving the desired definition. The value returned by new_prim_rec_definition is a theorem which states the definition requested by the user. This theorem is derived by formal proof from an instance of the theorem num_Axiom:

   |- !e f. ?! fn. (fn 0 = e) /\ (!n. fn(SUC n) = f(fn n)n)

Evaluating

   new_prim_rec_definition
    (`fun_DEF`,
     "(fun x_1 ... 0 ... x_i = f_1[x_1, ..., x_i]) /\
      (fun x_1 ... (SUC n) ... x_i =
               f_2[fun t_1 ... n ... t_i, x_1, ..., n, ..., x_i])");;

where all the free variables in the terms t_1, ..., t_i are contained in {n, x_1, ..., x_i}, automatically proves the theorem:

   |-  ?fun. !x_1 ... x_i. fun x_1 ... 0 ... x_i = f_1[x_1, ..., x_i] /\
             !x_1 ... x_i. fun (SUC n) x_1 ... x_i =
                               f_2[fun t_1 ... n ... t_i, x_1, ..., n, ...,x_i]

and then declares a new constant fun with this property as its specification. This constant specification is returned as a theorem by new_prim_rec_definition and is saved with name fun_DEF in the current theory segment.

The ML function new_prim_rec_definition also allows the user to partially specify the value of a function defined (possibly recursively) on the natural numbers by giving its value for only one of 0 or SUC n. See the example below.

Failure

Failure occurs if HOL cannot prove there is a function satisfying the specification (ie. if the term supplied to new_prim_rec_definition is not a well-formed primitive recursive definition), or if any other condition for making a constant specification is violated (see the failure conditions for new_specification).

Example

A curried addition function plus:num->num->num can be defined by primitive recursion on its first argument:

   #let PLUS = new_prim_rec_definition
   #           (`PLUS`,
   #            "(plus 0 n = n) /\
   #             (plus (SUC m) n = SUC(plus m n))");;
   PLUS = |- (!n. plus 0 n = n) /\ (!m n. plus(SUC m)n = SUC(plus m n))

or by primitive recursion on its second argument:

   #let PLUS = new_prim_rec_definition
   #            (`PLUS`,
   #             "(plus m 0 = m) /\
   #              (plus m (SUC n) = SUC(plus m n))");;
   PLUS = |- (!m. plus m 0 = m) /\ (!m n. plus m(SUC n) = SUC(plus m n))

A decrement function DEC, whose value is specified for only positive natural numbers, can

be defined using new_prim_rec_definition as follows
   #let DEC = new_prim_rec_definition
   #            (`DEC`, "DEC (SUC n) = n");;
   DEC = |- !n. DEC(SUC n) = n

This definition specifies the value of the function DEC only for positive natural numbers. In particular, the value of DEC 0 is left unspecified, and the only non-trivial property that can be proved to hold of the constant DEC is the property stated by the theorem returned by the call to new_prim_rec_definition shown in the session above.

See also

new_definition, new_infix_definition, new_infix_list_rec_definition,
new_infix_prim_rec_definition, new_list_rec_definition,
new_recursive_definition, new_type_definition, new_specification, num_Axiom.

 new_recursive_definition

new_recursive_definition : (bool -> thm -> string -> conv)

Synopsis

Defines a primitive recursive function over a concrete recursive type.

Description

new_recursive_definition provides the facility for defining primitive recursive functions on arbitrary concrete recursive types. It takes four arguments. The first is a boolean flag which indicates if the recursive function to be defined will be an infix or not. The second is the primitive recursion theorem for the concrete type in question; this must be a theorem obtained from define_type. The third argument is a name under which the resulting definition will be saved in the current theory segment. And the fourth argument is a term giving the desired primitive recursive function definition. The value returned by new_recursive_definition is a theorem which states the primitive recursive definition requested by the user. This theorem is derived by formal proof from an instance of the general primitive recursion theorem given as the second argument.

A theorem th of the form returned by define_type is a primitive recursion theorem for an automatically-defined concrete type ty. Let C1, ..., Cn be the constructors of this type, and let ‘(Ci vs)’ represent a (curried) application of the ith constructor to a sequence of variables. Then a curried primitive recursive function fn over ty can be specified by a conjunction of (optionally universally-quantified) clauses of the form:

   fn v1 ... (C1 vs1) ... vm  =  body1   /\
   fn v1 ... (C2 vs2) ... vm  =  body2   /\
                             .
                             .
   fn v1 ... (Cn vsn) ... vm  =  bodyn

where the variables v1, ..., vm, vs are distinct in each clause, and where in the ith clause fn appears (free) in bodyi only as part of an application of the form:

   "fn t1 ... v ... tm"

in which the variable v of type ty also occurs among the variables vsi.

If <definition> is a conjunction of clauses, as described above, then evaluating:

   new_recursive_definition flag th `name` tm "<definition>";;

automatically proves the existence of a function fn that satisfies the defining equations supplied as the fourth argument, and then declares a new constant in the current theory with this definition as its specification. This constant specification is returned as a theorem and is saved in the current theory segment under the name name. If flag is true, the constant is given infix status.

new_recursive_definition also allows the supplied definition to omit clauses for any number of constructors. If a defining equation for the ith constructor is omitted, then the value of fn at that constructor:

   fn v1 ... (Ci vsi) ... vn

is left unspecified (fn, however, is still a total function).

Failure

A call to new_recursive_definition fails if the supplied theorem is not a primitive recursion theorem of the form returned by define_type; if the term argument supplied is not a well-formed primitive recursive definition; or if any other condition for making a constant specification is violated (see the failure conditions for new_specification).

Example

Given the following primitive recursion theorem for labelled binary trees:

   |- !f0 f1.
        ?! fn.
        (!x. fn(LEAF x) = f0 x) /\
        (!b1 b2. fn(NODE b1 b2) = f1(fn b1)(fn b2)b1 b2)

new_recursive_definition can be used to define primitive recursive functions over binary trees. Suppose the value of th is this theorem. Then a recursive function Leaves, which computes the number of leaves in a binary tree, can be defined recursively as shown below:

   #let Leaves =
   #    new_recursive_definition false th `Leaves`
   #      "(Leaves (LEAF (x:*)) = 1) /\
   #       (Leaves (NODE t1 t2) = (Leaves t1) + (Leaves t2))";;
   Leaves =
   |- (!x. Leaves(LEAF x) = 1) /\
      (!t1 t2. Leaves(NODE t1 t2) = (Leaves t1) + (Leaves t2))

The result is a theorem which states that the constant Leaves satisfies the primitiverecursive defining equations supplied by the user.

The function defined using new_recursive_definition need not, in fact, be recursive. Here is the definition of a predicate IsLeaf, which is true of binary trees which are leaves, but is false of the internal nodes in a binary tree:

   #let IsLeaf =
   #    new_recursive_definition false th `IsLeaf`
   #      "(IsLeaf (NODE t1 t2) = F) /\ (IsLeaf (LEAF (x:*)) = T)";;
   IsLeaf = |- (!t1 t2. IsLeaf(NODE t1 t2) = F) /\ (!x. IsLeaf(LEAF x) = T)

Note that the equations defining a (recursive or non-recursive) function on binary trees by cases can be given in either order. Here, the NODE case is given first, and the LEAF case second. The reverse order was used in the above definition of Leaves.

new_recursive_definition also allows the user to partially specify the value of a function defined on a concrete type, by allowing defining equations for some of the constructors to be omitted. Here, for example, is the definition of a function Label which extracts the label from a leaf node. The value of Label applied to an internal node is left unspecified:

   #let Label =
   #    new_recursive_definition false th `Label`
   #      "Label (LEAF (x:*)) = x";;
   Label = |- !x. Label(LEAF x) = x

Curried functions can also be defined, and the recursion can be on any argument. The next definition defines an infix (curried) function << which expresses the idea that one tree is a proper subtree of another.

   #let Subtree =
   #    new_recursive_definition true th `Subtree`
   #      "(<< (t:(*)btree) (LEAF (x:*)) = F) /\
   #       (<< t (NODE t1 t2) = ((t=t1)\/(t=t2)\/(<< t t1)\/(<< t t2)))";;
   Subtree =
   |- (!t x. t << (LEAF x) = F) /\
      (!t t1 t2.
        t << (NODE t1 t2) = (t = t1) \/ (t = t2) \/ t << t1 \/ t << t2)

Note that the first argument is true, to indicate that the function being defined is to have infix status, and that the constant << is an infix after the definition has been made. Furthermore, the function << is recursive on its second argument.

See also

define_type, prove_rec_fn_exists.

 new_special_symbol

new_special_symbol : (string -> void)

Synopsis

Adds new string to the list of special symbols.

Description

An identifier, at the ML or object level, is either alphanumeric, e.g. true or T, or consists of a special symbol which starts with a non-alphanumeric character, e.g. ==> or +. It is a consequence of the non-backtracking implementation of lexical analysis that any (nonnull) initial segment of a special symbol is also a special symbol, so from the above we know that == and = are. The function new_special_symbol makes the given string and its non-null initial segments into special symbols, provided the string does not start with an alphanumeric character (according to is_alphanum).

Failure

Fails if the string provided starts with an alphanumeric character. The test is performed using the function is_alphanum, so this may include some unexpected characters if new_alphanum has been used.

Example

The call:

   new_special_symbol `.EQ.`;;

makes the following three strings special symbols:

   .E  .EQ  .EQ.

See also

is_alphanum, new_alphanum, special_symbols.

 new_specification

new_specification : (string -> (string # string) list -> thm -> thm)

Synopsis

Introduces a constant or constants satisfying a given property.

Description

The ML function new_specification implements the primitive rule of constant specification for the HOL logic. Evaluating:

   new_specification `name` [f1,`c1`;...;fn,`cn`] |- ?x1...xn. t

simultaneously introduces new constants named c1, ..., cn satisfying the property:

   |- t[c1,...,cn/x1,...,xn]

This theorem is stored, with name name, as a definition in the current theory segment. It is also returned by the call to new_specification The strings f1, ..., fn are flags which determine whether the new constants are infixes or binders or neither. If fi is `constant` then ci is declared an ordinary constant, if it is `infix` then ci is declared an infix, and if it is `binder` then ci is declared a binder. A flag of any other value causes failure.

Failure

new_specification fails if called when HOL is not in draft mode. It also fails if there is already an axiom, definition or specification of the given name in the current theory segment; if the theorem argument has assumptions or free variables; if the supplied constant names `c1`, ..., `cn` are not distinct; if any one of `c1`, ..., `cn` is already a constant in the current theory or is not an allowed name for a constant. Failure also occurs if any of f1, ..., fn is not either `constant`, `infix` or `binder` or if the type of ci is not suitable for a constant with the syntactic status specified by the flag fi. Finally, failure occurs if some ci does not contain all the type variables that occur in the term ?x1...xn. t.

Uses

new_specification can be used to introduce constants that satisfy a given property without having to make explicit equational constant definitions for them. For example, the built-in constants MOD and DIV are defined in the system by first proving the theorem:

   th |- ?MOD DIV.
         !n. (0 < n) ==>
             !k. ((k = (((DIV k n) * n) + (MOD k n))) /\ ((MOD k n) < n))

and then making the constant specification:

   #new_specification `DIVISION` [`infix`,`MOD`;`infix`,`DIV`] th;;
   |- !n. (0 < n) ==>
          !k. ((k = (((DIV k n) * n) + (MOD k n))) /\ ((MOD k n) < n))

This introduces the constants MOD and DIV with the defining property shown above.

See also

new_definition, new_binder_definition, new_gen_definition,
new_infix_definition.

 new_stack

new_stack : (goal -> subgoals list)

Synopsis

This function is for internal use only and is to be deleted from a future version of the system. It should not be used.

 new_syntax_block

new_syntax_block : ((string # string # string) -> void)

Synopsis

Declares a new syntax block.

Description

A syntax block starts with keyword and ends with a terminator and is associated with a function of strings. When such a block is encountered in the input stream, all the characters between the start keyword and the terminator are made into a string to which the associated function is applied.

The ML function new_syntax_block declares a new syntax block. The first argument is the start keyword of the block, the second argument is the terminator and the third argument is the name of a function having a type which is an instance of string->*. The effect of

   new_syntax_block(`XXX`, `YYY`, `Fun`);;

is that if

   XXX
      ...
   YYY

occurs in the input, then it is as though

   Fun `
      ...
   `

were input.

Example

#let foo s = print_string `Hello: `; print_string s; print_newline();;
foo = - : (string -> void)
#new_syntax_block(`FOO`,`OOF`, `foo`);;
() : void
#FOO 123OO44OOF;;
Hello: 123OO44
() : void
#FOO
#splat
#OOF;;
Hello: splat
() : void

Uses

Interfacing parsers to HOL.

 new_theory

new_theory : (string -> void)

Synopsis

Creates a new theory by extending the current theory with a new theory segment.

Description

A theory consists of a hierarchy of named parts called theory segments. The theory segment at the top of the hierarchy tree in each theory is said to be current. All theory segments have a theory of the same name associated with them consisting of the theory segment itself and all its ancestors. Each axiom, definition, specification and theorem belongs to a particular theory segment.

Calling new_theory `thy` creates a new theory segment and associated theory having name thy. The theory segment which was current before the call becomes a parent of the new theory segment. The new theory therefore consists of the current theory extended with the new theory segment. The new theory segment replaces its parent as the current theory segment. The call switches the system into draft mode. This allows new axioms, constants, types, constant specifications, infix constants, binders and parents to be added to the theory segment. Inconsistencies will be introduced into the theory if inconsistent axioms are asserted. New theorems can also be added as when in proof mode. The theory file in which the data of the new theory segment is ultimately stored will have name thy.th in the directory from which HOL was called. The theory segment might not be written to this file until the session is finished with a call to close_theory. If HOL is quitted without closing the session with close_theory, parts of the theory segment created during the session may be lost. If the system is in draft mode when a call to new_theory is made, the previous session is closed; all changes made in it will be written to the associated theory file.

Failure

The call new_theory `thy` will fail if there already exists a file thy.th in the current search path. It will also fail if the name thy.th is unsuitable for a filename. Since it could involve writing to the file system, if a write fails for any reason new_theory will fail.

Uses

Hierarchically extending the current theory. By splitting a theory into theory segments using new_theory, the work required if definitions, etc., need to be changed is minimized. Only the associated segment and its descendants need be redefined.

See also

close_theory, current_theory, extend_theory, load_theory, new_axiom,
new_binder, new_constant, new_definition, new_infix, new_parent,
new_specification, new_type, print_theory, save_thm, search_path.

 new_type

new_type : (int -> string -> void)

Synopsis

Declares a new type or type constructor.

Description

A call new_type n `t` declares a new n-ary type constructor called t in the current theory segment. If n is zero, this is just a new base type.

Failure

Fails if HOL is not in draft mode, or if the name is not a valid type name, or there is already a type operator of that name in the current theory.

Example

A version of ZF set theory might declare a new type set and start using it as follows:

   #new_theory `ZF`;;
   () : void
   #new_type 0 `set`;;
   () : void
   #new_infix(`mem`,":set->set->bool");;
   () : void
   #new_axiom(`ext`,"(!z. z mem x = z mem y) ==> (x = y)");;
   |- !x y. (!z. z mem x = z mem y) ==> (x = y)

See also

types, type_abbrevs, new_type_abbrev.

 new_type_abbrev

new_type_abbrev : ((string # type) -> void)

Synopsis

Sets up a new type abbreviation.

Description

A call new_type_abbrev(`ab`,":ty") creates and stores in the current theory segment a new type abbreviation ab for the type ty. In future, ":ab" may be used rather than the perhaps complicated expresion ":ty".

Failure

Fails if HOL is not in draft mode.

Example

#new_theory `gonk`;;
() : void
#new_type_abbrev(`bt`,":bool#bool#bool");;
() : void
#let tm = "x:bt" and ty = ":bt";;
tm = "x" : term
ty = ":bool # (bool # bool)" : type
#type_of tm = ty;;
true : bool

Comments

A similar mechanism can be implemented using antiquotation, for example:

   #let bt = ":bool#bool#bool";;
   bt = ":bool # (bool # bool)" : type
   #let tm = "x:^bt" and ty = ":^bt";;
   tm = "x" : term
   ty = ":bool # (bool # bool)" : type
   #type_of tm = ty;;
   true : bool

although this does have the disadvantage of not being stored in the theory file.

See also

types, type_abbrevs, new_type.

 new_type_definition

new_type_definition : ((string # term # thm) -> thm)

Synopsis

Defines a new type constant or type operator.

Description

The ML function new_type_definition implements the primitive HOL rule of definition for introducing new type constants or type operators into the logic. If "t" is a closed term of type ty->bool containing n distinct type variables, then evaluating:

   new_type_definition(`op`, "t", |- ?x. t x)

results in op being declared as a new n-ary type operator in the current theory and returns a definitional axiom of the following form characterizing that new type operator:

   |- ?rep:(*1,...,*n)op->ty. TYPE_DEFINITION t rep

which is stored as a definition in the current theory segment under the automaticallygenerated name `op_TY_DEF`. The constant TYPE_DEFINITION in this axiomatic characterization of op is defined by:

   |- TYPE_DEFINITION (P:*->bool) (rep:**->*) =
         (!x' x''. (rep x' = rep x'') ==> (x' = x'')) /\
         (!x. P x = (?x'. x = rep x'))

Thus |- ?rep. TYPE_DEFINITION P rep asserts that there is a bijection between the newly defined type (*1,...,*n)op and the set of values of type ty that satisfy P.

Failure

Executing new_type_definition(`op`,"t",th) fails if "t" contains free (term) variables, if op is already the name of a type or type operator in the current theory, if "t" does not have a type of the form ty->bool or th is not a theorem without assumptions of the form |- ?x. t x, if there already exists a constant definition, constant specification, type definition or axiom named op_TY_DEF in the current theory segment, or if HOL is not in draft mode.

See also

define_new_type_bijections, prove_abs_fn_one_one, prove_abs_fn_onto,
prove_rep_fn_one_one, prove_rep_fn_onto.

 nil_term_net

nil_term_net : * term_net

Synopsis

This function is for internal use only and is to be deleted from a future version of the system. It should not be used.

 not
$not : (bool -> bool)

Synopsis

Built-in ML logical negation.

Description

When given a boolean value, not returns its negation. Although it is a prefix function, it needs to be preceded by $ to suppress its special parse status.

Failure

Never fails.

 NOT_ELIM
NOT_ELIM : (thm -> thm)

Synopsis

Transforms |- ~t into |- t ==> F.

Description

When applied to a theorem A |- ~t, the inference rule NOT_ELIM returns the theorem

A |- t ==> F.
      A |- ~t
   --------------  NOT_ELIM
    A |- t ==> F

Failure

Fails unless the theorem has a negated conclusion.

See also

IMP_ELIM, NOT_INTRO.

 NOT_EQ_SYM

NOT_EQ_SYM : (thm -> thm)

Synopsis

Swaps left-hand and right-hand sides of a negated equation.

Description

When applied to a theorem A |- ~(t1 = t2), the inference rule NOT_EQ_SYM returns the

theorem A |- ~(t2 = t1).
    A |- ~(t1 = t2)
   -----------------  NOT_EQ_SYM
    A |- ~(t2 = t1)

Failure

Fails unless the theorem’s conclusion is a negated equation.

See also

DEPTH_CONV, REFL, SYM.

 NOT_EXISTS_CONV

NOT_EXISTS_CONV : conv

Synopsis

Moves negation inwards through an existential quantification.

Description

When applied to a term of the form ~(?x.P), the conversion NOT_EXISTS_CONV returns the theorem:

   |- ~(?x.P) = !x.~P

Failure

Fails if applied to a term not of the form ~(?x.P).

See also

EXISTS_NOT_CONV, FORALL_NOT_CONV, NOT_FORALL_CONV.

 NOT_FORALL_CONV
NOT_FORALL_CONV : conv

Synopsis

Moves negation inwards through a universal quantification.

Description

When applied to a term of the form ~(!x.P), the conversion NOT_FORALL_CONV returns the theorem:

   |- ~(!x.P) = ?x.~P

It is irrelevant whether x occurs free in P.

Failure

Fails if applied to a term not of the form ~(!x.P).

See also

EXISTS_NOT_CONV, FORALL_NOT_CONV, NOT_EXISTS_CONV.

 NOT_INTRO

NOT_INTRO : (thm -> thm)

Synopsis

Transforms |- t ==> F into |- ~t.

Description

When applied to a theorem A |- t ==> F, the inference rule NOT_INTRO returns the theo-

rem A |- ~t.
    A |- t ==> F
   --------------  NOT_INTRO
      A |- ~t

Failure

Fails unless the theorem has an implicative conclusion with F as the consequent.

\underline{NOT MP 387}

See also

IMP_ELIM, NOT_ELIM.

 NOT_MP

NOT_MP : (thm -> thm -> thm)

Synopsis

Implements the Modus Ponens inference rule and takes negation as an implication.

Description

When applied to theorems A1 |- t1 ==> t2 and A2 |- t1, the inference rule NOT_MP returns the theorem A1 u A2 |- t2.

    A1 |- t1 ==> t2   A2 |- t1
   ----------------------------  NOT_MP
          A1 u A2 |- t2

This is the same as the primitive inference rule MP. However, the first theorem can also be a negation. In such case, NOT_MP automatically transforms it to an implication with F as conclusion.

    A1 |- ~ t     A2 |- t
   ----------------------- NOT_MP
       A1 u A2 |- F

Failure

Fails unless the first theorem is an implication whose antecedent is the same as the conclusion of the second theorem (up to alpha-conversion), or it is a negation.

Comments

The rule MP used to behave as what is described in this page due to some historical reasons. Now, MP is the true primitive rule implementing Modus Ponens. NOT_MP is introduced to implement the old MP. The use of NOT_MP is discouraged. If the input theorem is expected to be a negation, use (MP o NOT_ELIM).

See also

MP, EQ_MP, LIST_MP, MATCH_MP, MATCH_MP_TAC, MP_TAC.

 NO_CONV
NO_CONV : conv

Synopsis

Conversion that always fails.

Failure

NO_CONV always fails.

See also

ALL_CONV.
 NO_TAC
NO_TAC : tactic

Synopsis

Tactic which always fails.

Description

Whatever goal it is applied to, NO_TAC always fails with string `NO_TAC`.

Failure

Always fails.

See also

ALL_TAC, ALL_THEN, FAIL_TAC, NO_THEN.
 NO_THEN
NO_THEN : thm_tactical

Synopsis

Theorem-tactical which always fails.

\underline{null 389}

Description

When applied to a theorem-tactic and a theorem, the theorem-tactical NO_THEN always fails with string `NO_THEN`.

Failure

Always fails when applied to a theorem-tactic and a theorem (note that it never gets as far as being applied to a goal!)

Uses

Writing compound tactics or tacticals.

See also

ALL_TAC, ALL_THEN, FAIL_TAC, NO_TAC.

 null

null : (* list -> bool)

Synopsis

Tests for empty list.

Description

Returns true for an empty list. Otherwise it returns false.

Failure

Never fails.

Example

#null [];;
true : bool
#null [1;2;3];;
false : bool

 num_CONV

num_CONV : conv

Synopsis

Provides definitional axiom for a nonzero numeral.

Description

num_CONV is an axiom-scheme from which one may obtain a defining equation for any natural number constant not equal to 0 (i.e. 1, 2, 3,...). If "n" is such a constant, then num_CONV "n" returns the theorem:

   |- n = SUC m

where m is the numeral that denotes the predecessor of the number denoted by n.

Failure

num_CONV tm fails if tm is "0" or if not tm is not a numeral constant.

Example

#num_CONV "3";;
|- 3 = SUC 2

 num_EQ_CONV

num_EQ_CONV : conv

Synopsis

Proves equality or inequality of two natural number constants.

Description

If n and m are two distinct numeral constants (e.g. 0, 1, 2, 3,...), then num_EQ_CONV "n = m" returns the theorem:

   |- (n = m) = F

If n and m are successors of numeral constants (e.g. SUC 0, SUC 1, SUC(SUC 1) etc.), then

num_EQ_CONV "n = m" returns one of:
   |- (n = m) = T       or       |- (n = m) = F

depending on whether the natural numbers represented by n and m are equal or not equal, respectively. Finally, for any term "n" of type num, evaluating num_EQ_CONV "n = n"

returns |- (n = n) = T.

n strip quant 391

Failure

num_EQ_CONV tm fails if tm is not of the form "n = m", where n and m are either numerals or repeated applications of SUC to numerals unless n and m are syntactically identical terms of type num.

Example

#num_EQ_CONV "1 = SUC 2";;
|- (1 = SUC 2) = F
#num_EQ_CONV "SUC 1 = 2";;
|- (SUC 1 = 2) = T

 n_strip_quant
n_strip_quant : ((* -> (** # *)) -> int -> * -> (** list # *))

Synopsis

This function is for internal use only and is to be deleted from a future version of the system. It should not be used.

 o
$o : (((* -> **) # (*** -> *)) -> *** -> **)

Synopsis

Composes two functions: (f o g) x = f (g x).

Failure

Never fails.

See also

#, B, C, Co, I, K, KI, oo, S, W.

 ONCE_ASM_REWRITE_RULE

ONCE_ASM_REWRITE_RULE : (thm list -> thm -> thm)

Synopsis

Rewrites a theorem once including built-in rewrites and the theorem’s assumptions.

Description

ONCE_ASM_REWRITE_RULE applies all possible rewrites in one step over the subterms in the conclusion of the theorem, but stops after rewriting at most once at each subterm. This strategy is specified as for ONCE_DEPTH_CONV. For more details see ASM_REWRITE_RULE, which does search recursively (to any depth) for matching subterms. The general strategy for rewriting theorems is described under GEN_REWRITE_RULE.

Failure

Never fails.

Uses

This tactic is used when rewriting with the hypotheses of a theorem (as well as a given list of theorems and basic_rewrites), when more than one pass is not required or would result in divergence.

See also

ASM_REWRITE_RULE, FILTER_ASM_REWRITE_RULE, FILTER_ONCE_ASM_REWRITE_RULE,
GEN_REWRITE_RULE, ONCE_DEPTH_CONV, ONCE_REWRITE_RULE, PURE_ASM_REWRITE_RULE,
PURE_ONCE_ASM_REWRITE_RULE, PURE_REWRITE_RULE, REWRITE_RULE.

 ONCE_ASM_REWRITE_TAC

ONCE_ASM_REWRITE_TAC : (thm list -> tactic)

Synopsis

Rewrites a goal once including built-in rewrites and the goal’s assumptions.

Description

ONCE_ASM_REWRITE_TAC behaves in the same way as ASM_REWRITE_TAC, but makes one pass only through the term of the goal. The order in which the given theorems are applied is an implementation matter and the user should not depend on any ordering. See GEN_REWRITE_TAC for more information on rewriting a goal in HOL.

Failure

ONCE_ASM_REWRITE_TAC does not fail and, unlike ASM_REWRITE_TAC, does not diverge. The resulting tactic may not be valid, if the rewrites performed add new assumptions to the theorem eventually proved.

Example

The use of ONCE_ASM_REWRITE_TAC to control the amount of rewriting performed is illustrated below:

   #ONCE_ASM_REWRITE_TAC []
   #             (["(a:*) = b"; "(b:*) = c"], "P (a:*): bool") ;;
   ([(["a = b"; "b = c"], "P b")], -) : subgoals
   #(ONCE_ASM_REWRITE_TAC [] THEN ONCE_ASM_REWRITE_TAC [])
   #             (["(a:*) = b"; "(b:*) = c"], "P (a:*): bool") ;;
   ([(["a = b"; "b = c"], "P c")], -) : subgoals

Uses

ONCE_ASM_REWRITE_TAC can be applied once or iterated as required to give the effect of ASM_REWRITE_TAC, either to avoid divergence or to save inference steps.

See also

basic_rewrites, ASM_REWRITE_TAC, FILTER_ASM_REWRITE_TAC,
FILTER_ONCE_ASM_REWRITE_TAC, GEN_REWRITE_TAC, ONCE_ASM_REWRITE_TAC,
ONCE_REWRITE_TAC, PURE_ASM_REWRITE_TAC, PURE_ONCE_ASM_REWRITE_TAC,
PURE_ONCE_REWRITE_TAC, PURE_REWRITE_TAC, REWRITE_TAC, SUBST_TAC.

 ONCE_DEPTH_CONV

ONCE_DEPTH_CONV : (conv -> conv)

Synopsis

Applies a conversion once to the first suitable sub-term(s) encountered in top-down order.

Description

ONCE_DEPTH_CONV c tm applies the conversion c once to the first subterm or subterms encountered in a top-down ‘parallel’ search of the term tm for which c succeeds. If the conversion c fails on all subterms of tm, the theorem returned is |- tm = tm.

Example

The following example shows how ONCE_DEPTH_CONV applies a conversion to only the first suitable subterm(s) found in a top-down search:

   #ONCE_DEPTH_CONV BETA_CONV "(\x. (\y. y + x) 1) 2";;
   |- (\x. (\y. y + x)1)2 = (\y. y + 2)1

Here, there are two beta-redexes in the input term. One of these occurs within the other, so BETA_CONV is applied only to the outermost one.

Note that the supplied conversion is applied by ONCE_DEPTH_CONV to all independent subterms at which it succeeds. That is, the conversion is applied to every suitable subterm not contained in some other subterm for which the conversions also succeeds, as illustrated by the following example:

   #ONCE_DEPTH_CONV num_CONV "(\x. (\y. y + x) 1) 2";;
   |- (\x. (\y. y + x)1)2 = (\x. (\y. y + x)(SUC 0))(SUC 1)

Here num_CONV is applied to both 1 and 2, since neither term occurs within a larger subterm for which the conversion num_CONV succeeds.

Uses

ONCE_DEPTH_CONV is frequently used when there is only one subterm to which the desired conversion applies. This can be much faster than using other functions that attempt to apply a conversion to all subterms of a term (e.g. DEPTH_CONV). If, for example, the current goal in a goal-directed proof contains only one beta-redex, and one wishes to apply BETA_CONV to it, then the tactic

   CONV_TAC (ONCE_DEPTH_CONV BETA_CONV)

may, depending on where the beta-redex occurs, be much faster than

   CONV_TAC (TOP_DEPTH_CONV BETA_CONV)

ONCE_DEPTH_CONV c may also be used when the supplied conversion c never fails, in which case using a conversion such as DEPTH_CONV c, which applies c repeatedly would never terminate.

Comments

The implementation of this function uses failure to avoid rebuilding unchanged subterms. That is to say, during execution the failure string `QCONV` may be generated and later trapped. The behaviour of the function is dependent on this use of failure. So, if the conversion given as argument happens to generate a failure with string `QCONV`, the operation of ONCE_DEPTH_CONV will be unpredictable.

See also

DEPTH_CONV, REDEPTH_CONV, TOP_DEPTH_CONV, ONCE_REW_DEPTH_CONV.

 ONCE_REWRITE_CONV

ONCE_REWRITE_CONV : (thm list -> conv)

Synopsis

Rewrites a term, including built-in tautologies in the list of rewrites.

Description

ONCE_REWRITE_CONV searches for matching subterms and applies rewrites once at each subterm, in the manner specified for ONCE_DEPTH_CONV. The rewrites which are used are obtained from the given list of theorems and the set of tautologies stored in basic_rewrites. See GEN_REWRITE_CONV for the general method of using theorems to rewrite a term.

Failure

ONCE_REWRITE_CONV does not fail; it does not diverge.

Uses

ONCE_REWRITE_CONV can be used to rewrite a term when recursive rewriting is not desired.

See also

GEN_REWRITE_CONV, PURE_ONCE_REWRITE_CONV, PURE_REWRITE_CONV, REWRITE_CONV.

 ONCE_REWRITE_RULE

ONCE_REWRITE_RULE : (thm list -> thm -> thm)

Synopsis

Rewrites a theorem, including built-in tautologies in the list of rewrites.

Description

ONCE_REWRITE_RULE searches for matching subterms and applies rewrites once at each subterm, in the manner specified for ONCE_DEPTH_CONV. The rewrites which are used are obtained from the given list of theorems and the set of tautologies stored in basic_rewrites.

See GEN_REWRITE_RULE for the general method of using theorems to rewrite an object theorem.

Failure

ONCE_REWRITE_RULE does not fail; it does not diverge.

Uses

ONCE_REWRITE_RULE can be used to rewrite a theorem when recursive rewriting is not desired.

See also

ASM_REWRITE_RULE, GEN_REWRITE_RULE, ONCE_ASM_REWRITE_RULE,
PURE_ONCE_REWRITE_RULE, PURE_REWRITE_RULE, REWRITE_RULE.

 ONCE_REWRITE_TAC

ONCE_REWRITE_TAC : (thm list -> tactic)

Synopsis

Rewrites a goal only once with basic_rewrites and the supplied list of theorems.

Description

A set of equational rewrites is generated from the theorems supplied by the user and the set of basic tautologies, and these are used to rewrite the goal at all subterms at which a match is found in one pass over the term part of the goal. The result is returned without recursively applying the rewrite theorems to it. The order in which the given theorems are applied is an implementation matter and the user should not depend on any ordering. More details about rewriting can be found under GEN_REWRITE_TAC.

Failure

ONCE_REWRITE_TAC does not fail and does not diverge. It results in an invalid tactic if any of the applied rewrites introduces new assumptions to the theorem eventually proved.

Example

Given a theorem list:

  th1 = [ |- a = b; |- b = c; |- c = a]

the tactic ONCE_REWRITE_TAC thl can be iterated as required without diverging:

   #ONCE_REWRITE_TAC thl ([], "P a");;
   ([([], "P b")], -) : subgoals
   #(ONCE_REWRITE_TAC thl THEN ONCE_REWRITE_TAC thl) ([], "P a");;
   ([([], "P c")], -) : subgoals
   #(ONCE_REWRITE_TAC thl THEN ONCE_REWRITE_TAC thl THEN ONCE_REWRITE_TAC thl)
   #([], "P a");;
   ([([], "P a")], -) : subgoals

Uses

ONCE_REWRITE_TAC can be used iteratively to rewrite when recursive rewriting would diverge. It can also be used to save inference steps.

See also

ASM_REWRITE_TAC, ONCE_ASM_REWRITE_TAC, PURE_ASM_REWRITE_TAC,
PURE_ONCE_REWRITE_TAC, PURE_REWRITE_TAC, REWRITE_TAC, SUBST_TAC.

 ONCE_REW_DEPTH_CONV

ONCE_REW_DEPTH_CONV : (conv -> conv)

Synopsis

Applies a conversion once to the first suitable sub-term(s) encountered in top-down order. For use in rewriting.

Description

ONCE_REW_DEPTH_CONV c tm applies the conversion c once to the first subterm or subterms encountered in a top-down ‘parallel’ search of the term tm for which c succeeds. If the conversion c fails on all subterms of tm, the theorem returned is |- tm = tm.

ONCE_REW_DEPTH_CONV is a special version of ONCE_DEPTH_CONV for use by the rewriting conversions, rules and tactics. It differs from ONCE_DEPTH_CONV as follows: If converting an abstraction fails due to the presence of the bound variable in the hypotheses of the theorem generated by converting the body, ONCE_REW_DEPTH_CONV retries the conversion having renamed the bound variable of the abstraction. If successful the renaming is reversed.

Failure

Never fails.

Example

The following example illustrates the difference between the functions ONCE_REW_DEPTH_CONV and ONCE_DEPTH_CONV. It is not intended to illustrate the full range of behaviour of the former. Both ONCE_REW_DEPTH_CONV and ONCE_DEPTH_CONV successfully apply the theorem ADD_0 inside an abstraction:

   #ONCE_REW_DEPTH_CONV (REWR_CONV ADD_0) "\n. n + 0";;
   |- (\n. n + 0) = (\n. n)
   #ONCE_DEPTH_CONV (REWR_CONV ADD_0) "\n. n + 0";;
   |- (\n. n + 0) = (\n. n)

However, if a hypothesis containing a free occurrence of the bound variable is added to the rewrite rule, it interferes with the operation of ONCE_DEPTH_CONV but not that of

ONCE_REW_DEPTH_CONV:
   #let th = ADD_ASSUM "n = 0" ADD_0;;
   th = n = 0 |- !m. m + 0 = m
   #ONCE_REW_DEPTH_CONV (REWR_CONV th) "\n. n + 0";;
   n = 0 |- (\n. n + 0) = (\n. n)
   #ONCE_DEPTH_CONV (REWR_CONV th) "\n. n + 0";;
   |- (\n. n + 0) = (\n. n + 0)

Comments

The implementation of this function uses failure to avoid rebuilding unchanged subterms. That is to say, during execution the failure string `QCONV` may be generated and later trapped. The behaviour of the function is dependent on this use of failure. So, if the conversion given as argument happens to generate a failure with string `QCONV`, the operation of ONCE_REW_DEPTH_CONV will be unpredictable.

See also

REW_DEPTH_CONV, ONCE_DEPTH_CONV.

\underline{oo 399}

 oo

$oo : ((((* # **) -> ***) # (**** -> *) # (**** -> **)) -> **** -> ***)

Synopsis

Composes a function a pair of functions: (f oo (g,h)) x = f (g x,h x).

Failure

Never fails.

See also

#, B, C, CB, Co, I, K, KI, o, S, W.

 openi

openi : (string -> string)

Synopsis

Opens a named port for input from a named file.

Description

Given a string argument `foo`, openi returns a string (a port identifier) that can be used by the function read to read characters from the file foo. The port identifier is also used as an argument to the function close; close terminates input.

Failure

Fails if the file cannot be found with the current search path or if read permission on the named file is disabled.

See also

close, openw, read, write

 openw

openw : (string -> string)

Synopsis

Opens a port for writing to a named file.

Description

Given a string argument `foo`, openw creates a new file foo (overwriting an existing file with the same name) and returns a string (a port identifier) that can be used by write to write characters to the file. The port identifier is also used by close to close the file.

Example

#let port = openw `foo`;;
port = `%foo` : string
#write (port, `contents of file foo\L`);;
() : void
#close port;;
() : void
#system `cat foo`;;
contents of file foo
0 : int

See also

close, openi, read, write

 ORELSE

$ORELSE : (tactic -> tactic -> tactic)

Synopsis

Applies first tactic, and iff it fails, applies the second instead.

Description

If T1 and T2 are tactics, T1 ORELSE T2 is a tactic which applies T1 to a goal, and iff it fails, applies T2 to the goal instead.

Failure

The application of ORELSE to a pair of tactics never fails. The resulting tactic fails if both T1 and T2 fail when applied to the relevant goal.

\underline{ORELSEC 401}

See also

EVERY, FIRST, THEN.

 ORELSEC

$ORELSEC : (conv -> conv -> conv)

Synopsis

Applies the first of two conversions that succeeds.

Description

(c1 ORELSEC c2) "t" returns the result of applying the conversion c1 to the term "t" if this succeeds. Otherwise (c1 ORELSEC c2) "t" returns the result of applying the conversion c2 to the term "t".

Failure

(c1 ORELSEC c2) "t" fails both c1 and c2 fail when applied to "t".

See also

FIRST_CONV.

 ORELSE_TCL

$ORELSE_TCL : (thm_tactical -> thm_tactical -> thm_tactical)

Synopsis

Applies a theorem-tactical, and if it fails, tries a second.

Description

When applied to two theorem-tacticals, ttl1 and ttl2, a theorem-tactic ttac, and a theorem th, if ttl1 ttac th succeeds, that gives the result. If it fails, the result is ttl2 ttac th, which may itself fail.

Failure

ORELSE_TCL fails if both the theorem-tacticals fail when applied to the given theorem-tactic and theorem.

See also

EVERY_TCL, FIRST_TCL, THEN_TCL.

 OR_EXISTS_CONV

OR_EXISTS_CONV : conv

Synopsis

Moves an existential quantification outwards through a disjunction.

Description

When applied to a term of the form (?x.P) \/ (?x.Q), the conversion OR_EXISTS_CONV returns the theorem:

   |- (?x.P) \/ (?x.Q) = (?x. P \/ Q)

Failure

Fails if applied to a term not of the form (?x.P) \/ (?x.Q).

See also

EXISTS_OR_CONV, LEFT_OR_EXISTS_CONV, RIGHT_OR_EXISTS_CONV.

 OR_FORALL_CONV

OR_FORALL_CONV : conv

Synopsis

Moves a universal quantification outwards through a disjunction.

Description

When applied to a term of the form (!x.P) \/ (!x.Q), where x is free in neither P nor Q, OR_FORALL_CONV returns the theorem:

   |- (!x. P) \/ (!x. Q) = (!x. P \/ Q)

Failure

OR_FORALL_CONV fails if it is applied to a term not of the form (!x.P) \/ (!x.Q), or if it is applied to a term (!x.P) \/ (!x.Q) in which the variable x is free in either P or Q.

\underline{outl 403}

See also

FORALL_OR_CONV, LEFT_OR_FORALL_CONV, RIGHT_OR_FORALL_CONV.

 outl

outl : ((* + **) -> *)

Synopsis

Projects out of left summand.

Description

The function outl is associated with the disjoint union construction of types. It projects out of the left summand of the union.

Failure

Fails if the operand is a right summand.

Example

#let x = inl 1
#and y = inr 2;;
x = inl 1 : (int + *)
y = inr 2 : (* + int)
#outl x;;
1 : int
#outl y;;
evaluation failed     outl

See also

outr inl inr isl.

 outr

outr : ((* + **) -> **)

Synopsis

Projects out of right summand.

Description

The function outr is associated with the disjoint union construction of types. It projects out of the right summand of the union.

Failure

Fails if the operand is a left summand.

Example

#let x = inl 1
#and y = inr 2;;
x = inl 1 : (int + *)
y = inr 2 : (* + int)
#outr x;;
evaluation failed     outr
#outr y;;
2 : int

See also

outl, inl, inr, isl

 p

p : (int -> void)

Synopsis

Prints the top levels of the subgoal package goal stack.

Description

The function p is part of the subgoal package. It is an abbreviation for the function print_state. For a description of the subgoal package, see set_goal.

\underline{pair 405}

Uses

Examining the proof state during an interactive proof session.

See also

b, backup, backup_limit, e, expand, expandf, g, get_state, print_state, r,
rotate, save_top_thm, set_goal, set_state, top_goal, top_thm.
 pair
pair : (* -> ** -> (* # **))

Synopsis

Makes two values into a pair.

Description

pair x y returns (x,y).

Failure

Never fails.

See also

fst, snd, curry, uncurry.
 PAIRED_BETA_CONV
PAIRED_BETA_CONV : conv

Synopsis

Performs generalized beta conversion for tupled beta-redexes.

Description

The conversion PAIRED_BETA_CONV implements beta-reduction for certain applications of tupled lambda abstractions called ‘tupled beta-redexes’. Tupled lambda abstractions have the form "\<vs>.tm", where <vs> is an arbitrarily-nested tuple of variables called a ‘varstruct’. For the purposes of PAIRED_BETA_CONV, the syntax of varstructs is given by:

   <vs>  ::=   (v1,v2)  |  (<vs>,v)  |  (v,<vs>)  |  (<vs>,<vs>)

where v, v1, and v2 range over variables. A tupled beta-redex is an application of the form "(\<vs>.tm) t", where the term "t" is a nested tuple of values having the same structure as the varstruct <vs>. For example, the term:

   "(\((a,b),(c,d)). a + b + c + d)  ((1,2),(3,4))"

is a tupled beta-redex, but the term:

   "(\((a,b),(c,d)). a + b + c + d)  ((1,2),p)"

is not, since p is not a pair of terms.

Given a tupled beta-redex "(\<vs>.tm) t", the conversion PAIRED_BETA_CONV performs generalized beta-reduction and returns the theorem

   |-  (\<vs>.tm) t = t[t1,...,tn/v1,...,vn]

where ti is the subterm of the tuple t that corresponds to the variable vi in the varstruct <vs>. In the simplest case, the varstruct <vs> is flat, as in the term:

   "(\(v1,...,vn).t) (t1,...,tn)"

When applied to a term of this form, PAIRED_BETA_CONV returns:

   |- (\(v1, ... ,vn).t) (t1, ... ,tn) = t[t1,...,tn/v1,...,vn]

As with ordinary beta-conversion, bound variables may be renamed to prevent free variable capture. That is, the term t[t1,...,tn/v1,...,vn] in this theorem is the result of substituting ti for vi in parallel in t, with suitable renaming of variables to prevent free variables in t1, ..., tn becoming bound in the result.

Failure

PAIRED_BETA_CONV tm fails if tm is not a tupled beta-redex, as described above. Note that ordinary beta-redexes are specifically excluded: PAIRED_BETA_CONV fails when applied to "(\v.t)u". For these beta-redexes, use BETA_CONV.

Example

The following is a typical use of the conversion:

   #PAIRED_BETA_CONV "(\((a,b),(c,d)). a + b + c + d)  ((1,2),(3,4))";;
   |- (\((a,b),c,d). a + (b + (c + d)))((1,2),3,4) = 1 + (2 + (3 + 4))

Note that the term to which the tupled lambda abstraction is applied must have the same structure as the varstruct. For example, the following succeeds:

   #PAIRED_BETA_CONV "(\((a,b),p). a + b)  ((1,2),(3+5,4))";;
   |- (\((a,b),p). a + b)((1,2),3 + 5,4) = 1 + 2

but the following call to PAIRED_BETA_CONV fails:

   #PAIRED_BETA_CONV "(\((a,b),(c,d)). a + b + c + d)  ((1,2),p)";;
   evaluation failed     PAIRED_BETA_CONV

because p is not a pair.

See also

BETA_CONV, BETA_RULE, BETA_TAC, LIST_BETA_CONV, RIGHT_BETA, RIGHT_LIST_BETA.

 paired_delete_thm

paired_delete_thm : ((string # string) -> thm)

Synopsis

This function is for internal use only and is to be deleted from a future version of the system. It should not be used.

 PAIRED_ETA_CONV

PAIRED_ETA_CONV : conv

Synopsis

Performs generalized eta conversion for tupled eta-redexes.

Description

The conversion PAIRED_ETA_CONV generalizes ETA_CONV to eta-redexes with tupled abstractions.

   PAIRED_ETA_CONV "\(v1..(..)..vn). f (v1..(..)..vn)"
    = |- \(v1..(..)..vn). f (v1..(..)..vn) = f

Failure

Fails unless the given term is a paired eta-redex as illustrated above.

Comments

Note that this result cannot be achieved by ordinary eta-reduction because the tupled abstraction is a surface syntax for a term which does not correspond to a normal pattern for eta reduction. Disabling the relevant prettyprinting reveals the true form of a paired eta redex:

   #set_flag(`print_uncurry`,false);;
   true : bool
   #let tm = "\(x:num,y:num). FST (x,y)";;
   tm = "UNCURRY(\x y. FST(x,y))" : term

Example

The following is a typical use of the conversion:

   let SELECT_PAIR_EQ = PROVE
    ("(@(x:*,y:**). (a,b) = (x,y)) = (a,b)",
     CONV_TAC (ONCE_DEPTH_CONV PAIRED_ETA_CONV) THEN
     ACCEPT_TAC (SYM (MATCH_MP SELECT_AX (REFL "(a:*,b:**)"))));;

See also

ETA_CONV.

 paired_new_type

paired_new_type : ((int # string) -> void)

Synopsis

This function is for internal use only and is to be deleted from a future version of the system. It should not be used.

 paired_theorem

paired_theorem : ((string # string) -> thm)

\underline{parents 409}

Synopsis

This function is for internal use only and is to be deleted from a future version of the system. It should not be used.

 parents

parents : (string -> string list)

Synopsis

Lists the parent theories of a named theory.

Description

The function parents returns a list of strings that identify the parent theories of a named theory. The function does not recursively descend the theory hierarchy in search of the ‘leaf’ theories. The named theory must be the current theory or an ancestor of the current theory.

Failure

Fails if the named theory is not an ancestor of the current theory.

Example

Initially, the only parent is the main HOL theory:

#new_theory `my-theory`;;
() : void
#parents `my-theory`;;
[`HOL`] : string list
#parents `HOL`;;
[`tydefs`; `sum`; `one`; `BASIC-HOL`] : string list
#parents `tydefs`;;
[`ltree`; `BASIC-HOL`] : string list
#parents `string`;;
evaluation failed     parents -- string is not an ancestor

However, loading the string library creates several additional ancestor theories:

#load_library `string`;;
Loading library `string` ...
Updating search path
.Updating help search path
.Declaring theory string a new parent
Theory string loaded
......
Library `string` loaded.
() : void
#parents `string`;;
[`ascii`; `HOL`] : string list
#parents `my-theory`;;
[`string`; `HOL`] : string list

See also

ancestors, ancestry.

parse_as_binder

parse_as_binder : (string -> string)

Synopsis

Makes the quotation parser treat a name as a binder.

Description

The call parse_as_binder `c` will make the quotation parser treat c as a binder, that is, allow the syntactic sugaring "c x. y" as a shorthand for "c (\x. y)". As with normal binders, e.g. the universal quantifier, the special syntactic status may be suppressed by preceding c with a dollar sign.

Failure

Never fails, even if the string is not an identifier.

Example

#new_theory `groof`;;
() : void
#new_definition(`test`,"!! = ($!:(bool->bool)->bool)");;
|- !! = $!
#"!!x.T";;
. cannot be a term
skipping: . T " ;; parse failed
#parse_as_binder `!!`;;
`!!` : string
#"!!x.T";;
"!! x. T" : term
#"$!! (\x. T)";;
"!! x. T" : term

Comments

Special parse status is allotted automatically when a binder is declared, so this function is unlikely to be needed.

See also

activate_all_binders, activate_binders, binders, new_binder.

 partition

partition : ((* -> bool) -> * list -> (* list # * list))

Synopsis

Separates a list into two lists using a predicate.

Description

partition p l returns a pair of lists. The first list contains the elements which satisfy p. The second list contains all the other elements.

Failure

Never fails.

Example

#partition (\x. x + x = x * x) [1;2;3;4;5];;
([2], [1; 3; 4; 5]) : (int list # int list)

See also

chop_list, remove, filter.

 PART_MATCH

PART_MATCH : ((term -> term) -> thm -> term -> thm)

Synopsis

Instantiates a theorem by matching part of it to a term.

Description

When applied to a ‘selector’ function of type term -> term, a theorem and a term:

   PART_MATCH fn (A |- !x1...xn. t) tm

the function PART_MATCH applies fn to t' (the result of specializing universally quantified variables in the conclusion of the theorem), and attempts to match the resulting term to the argument term tm. If it succeeds, the appropriately instantiated version of the theorem is returned.

Failure

Fails if the selector function fn fails when applied to the instantiated theorem, or if the match fails with the term it has provided.

Example

Suppose that we have the following theorem:

   th = |- !x. x==>x

then the following:

   PART_MATCH (fst o dest_imp) th "T"

results in the theorem:

   |- T ==> T

because the selector function picks the antecedent of the implication (the inbuilt specialization gets rid of the universal quantifier), and matches it to T.

See also

INST_TYPE, INST_TY_TERM, match.

 POP_ASSUM

POP_ASSUM : (thm_tactic -> tactic)

Synopsis

Applies tactic generated from the first element of a goal’s assumption list.

Description

When applied to a theorem-tactic and a goal, POP_ASSUM applies the theorem-tactic to the ASSUMEd first element of the assumption list, and applies the resulting tactic to the goal without the first assumption in its assumption list:

    POP_ASSUM f ({A1;...;An} ?- t) = f (A1 |- A1) ({A2;...;An} ?- t)

Failure

Fails if the assumption list of the goal is empty, or the theorem-tactic fails when applied to the popped assumption, or if the resulting tactic fails when applied to the goal (with depleted assumption list).

Comments

It is possible simply to use the theorem ASSUME A1 as required rather than use POP_ASSUM; this will also maintain A1 in the assumption list, which is generally useful. In addition, this approach can equally well be applied to assumptions other than the first.

There are admittedly times when POP_ASSUM is convenient, but it is most unwise to use it if there is more than one assumption in the assumption list, since this introduces a dependency on the ordering, which is vulnerable to changes in the HOL system.

Another point to consider is that if the relevant assumption has been obtained by DISCH_TAC, it is often cleaner to use DISCH_THEN with a theorem-tactic. For example, instead of:

   DISCH_TAC THEN POP_ASSUM (\th. SUBST1_TAC (SYM th))

one might use

   DISCH_THEN (SUBST1_TAC o SYM)

Example

The goal:

   {4 = SUC x} ?- x = 3

can be solved by:

   POP_ASSUM (\th. REWRITE_TAC[REWRITE_RULE[num_CONV "4"; INV_SUC_EQ] th]))

Uses

Making more delicate use of an assumption than rewriting or resolution using it.

See also

ASSUM_LIST, EVERY_ASSUM, IMP_RES_TAC, POP_ASSUM_LIST, REWRITE_TAC.

 POP_ASSUM_LIST

POP_ASSUM_LIST : ((thm list -> tactic) -> tactic)

Synopsis

Generates a tactic from the assumptions, discards the assumptions and applies the tactic.

Description

When applied to a function and a goal, POP_ASSUM_LIST applies the function to a list of theorems corresponding to the ASSUMEd assumptions of the goal, then applies the resulting tactic to the goal with an empty assumption list.

    POP_ASSUM_LIST f ({A1;...;An} ?- t) = f [A1 |- A1; ... ; An |- An] (?- t)

Failure

Fails if the function fails when applied to the list of ASSUMEd assumptions, or if the resulting tactic fails when applied to the goal with no assumptions.

Comments

There is nothing magical about POP_ASSUM_LIST: the same effect can be achieved by using ASSUME a explicitly wherever the assumption a is used. If POP_ASSUM_LIST is used, it is unwise to select elements by number from the ASSUMEd-assumption list, since this introduces a dependency on ordering.

Example

Suppose we have a goal of the following form:

   {a /\ b, c, (d /\ e) /\ f} ?- t

Then we can split the conjunctions in the assumption list apart by applying the tactic:

   POP_ASSUM_LIST (MAP_EVERY STRIP_ASSUME_TAC)

which results in the new goal:

   {a, b, c, d, e, f} ?- t

Uses

Making more delicate use of the assumption list than simply rewriting or using resolution.

See also

ASSUM_LIST, EVERY_ASSUM, IMP_RES_TAC, POP_ASSUM, REWRITE_TAC.

 pop_proofs

pop_proofs : (subgoals list -> subgoals list)

Synopsis

This function is for internal use only and is to be deleted from a future version of the system. It should not be used.

 pop_proofs_print
pop_proofs_print : (subgoals list -> subgoals list)

Synopsis

This function is for internal use only and is to be deleted from a future version of the system. It should not be used.

 pp_axiom
pp_axiom : (string -> string -> thm)

Synopsis

This function is for internal use only and is to be deleted from a future version of the system. It should not be used.

 preterm_abs
preterm_abs : ((preterm # preterm) -> preterm)

Synopsis

Constructs abstraction preterm.

Description

preterm_abs is analogous to the oft-used ML function mk_abs. Since, however, preterms are untypechecked terms, the restrictions imposed when using mk_abs are not encountered until the preterm is typechecked.

Failure

Never fails. preterm antiquot 417

Example

#let x = preterm_typed(preterm_var `x`,":bool");;
x = preterm_typed((preterm_var `x`), ":bool") : preterm
#let y = preterm_const `T`;;
y = preterm_const `T` : preterm
#preterm_abs(x,y);;
preterm_abs((preterm_typed((preterm_var `x`), ":bool")),
            preterm_const `T`)
: preterm
#preterm_to_term it;;
"\x. T" : term
#preterm_abs(y,x);;
preterm_abs((preterm_const `T`),
            preterm_typed((preterm_var `x`), ":bool"))
: preterm
#preterm_to_term it;;
evaluation failed     mk_abs

See also

mk_abs, preterm_antiquot, preterm_comb, preterm_const, preterm_typed,
preterm_var, preterm_to_term.

 preterm_antiquot

preterm_antiquot : (term -> preterm)

Synopsis

Constructs antiquoted preterm.

Description

preterm_antiquot is analogous to the oft-used HOL strategy of antiquotation. Since, however, preterms are untypechecked terms, the restrictions imposed when using antiquotation are not encountered until the preterm is typechecked.

Example

#preterm_antiquot "T";;
preterm_antiquot"T" : preterm
#preterm_comb(preterm_const `~`,it);;
preterm_comb((preterm_const `~`), preterm_antiquot"T") : preterm
#preterm_to_term it;;
"~T" : term

See also

preterm_abs, preterm_comb, preterm_const, preterm_typed, preterm_var,
preterm_to_term.

 preterm_comb

preterm_comb : ((preterm # preterm) -> preterm)

Synopsis

Constructs combination (function application) preterm.

Description

preterm_comb is analogous to the oft-used ML function mk_comb. Since, however, preterms are untypechecked terms, the restrictions imposed when using mk_comb are not encountered until the preterm is typechecked.

Failure

Never fails.

Example

#preterm_comb(preterm_comb(preterm_const `+`,preterm_var `x`),
              preterm_const `1`);;
preterm_comb((preterm_comb((preterm_const `+`), preterm_var `x`)),
             preterm_const `1`)
: preterm
#preterm_to_term it;;
"x + 1" : term

See also

mk_comb, preterm_abs, preterm_antiquot, preterm_const, preterm_typed,

preterm_var, preterm_to_term.

 preterm_const

preterm_const : (string -> preterm)

Synopsis

Constructs constant preterm.

Description

preterm_const is analogous to the oft-used ML function mk_var. Since, however, preterms are untypechecked terms, the restrictions imposed when using mk_const (i.e. that the constant must be either implicitly or explicitly associated with a specific type) are not encountered until the preterm is typechecked.

Failure

Never fails.

Example

#preterm_const `T`;;
preterm_const `T` : preterm
#preterm_to_term it;;
"T" : term
#type_of it;;
":bool" : type

See also

mk_const, preterm_abs, preterm_antiquot, preterm_comb, preterm_typed,
preterm_var, preterm_to_term.

 preterm_to_term

preterm_to_term : (preterm -> term)

Synopsis

Converts a preterm to a HOL term.

Description

Preterms are untypechecked terms, and are included in the HOL system to allow embedding of special purpose parsers, and to provide a way of experimenting with other forms of type checking. preterm_to_term is the hook for pushing preterms through the standard HOL typechecker.

Failure

Fails with the appropriate HOL error message.

See also

preterm_abs, preterm_antiquot, preterm_comb, preterm_const, preterm_typed,
preterm_var.

 preterm_typed

preterm_typed : ((preterm # type) -> preterm)

Synopsis

Constructs a typed preterm.

Description

preterm_typed allows type information to be associated with various substructures of a given preterm. One can, therefore, construct improperly typed preterms that will fail to typecheck when preterm_to_term is invoked. preterm var 421

Example

#preterm_typed(preterm_const `T`,":bool");;
preterm_typed((preterm_const `T`), ":bool") : preterm
#preterm_to_term it;;
"T" : term
#preterm_typed(preterm_const `T`,":num");;
preterm_typed((preterm_const `T`), ":num") : preterm
#preterm_to_term it;;
evaluation failed     types

See also

preterm_abs, preterm_antiquot, preterm_comb, preterm_const, preterm_var,
preterm_to_term.

 preterm_var

preterm_var : (string -> preterm)

Synopsis

Constructs variable preterm.

Description

preterm_var is analogous to the oft-used ML function mk_var. Since, however, preterms are untypechecked terms, the restrictions imposed when using mk_var (i.e. that the variable must be either implicitly or explicitly associated with a specific type) are not encountered until the preterm is typechecked.

Example

#preterm_var `x`;;
preterm_var `x` : preterm
#preterm_to_term it;;
Indeterminate types:  "x:?"
evaluation failed     types indeterminate
#preterm_typed(preterm_var `x`,":bool");;
preterm_typed((preterm_var `x`), ":bool") : preterm
#preterm_to_term it;;
"x" : term

See also

mk_var, preterm_abs, preterm_antiquot, preterm_comb, preterm_const,
preterm_typed, preterm_to_term.

 print_all_thm

print_all_thm : (thm -> void)

Synopsis

Prints a theorem in full.

Description

The function print_all_thm will cause the system to print a theorem with its hypotheses.

Example

As a simple example of the use of print_all_thm we assume the following two theorems:

   #let a = ASSUME "A:bool";;
   a = . |- A
   #let b = ASSUME "A ==> B";;
   b = . |- A ==> B

Using Modus Ponens (MP) as follows:

   #let r = MP b a;;

The system responds with:

   r = .. |- B

By using print_all_thm as follows:

   #print_all_thm r;;

The system then pretty prints:

   A ==> B, A |- B() : void

This shows all the assumptions of the theorem in a comma separated list.

See also

print_thm.

 print_begin

print_begin : (int -> void)

Synopsis

Initiates a pretty printing block.

Description

The function print_begin initiates a consistent printing block. Consistent breaks cause uniform indentation at each break. This means that if a list is printed and the total list is wider than the margin then the list will be broken at every possible breaking point. The argument is the offset of the block that print_begin initiates. This offset is added to the indentation of any lines broken inside. This offset is virtually never used and should preferably be avoided.

Failure

Never fails.

Example

The first step is to set the margin to be 13 characters wide:

   #set_margin 13;;

The second is to initialize the block using print_begin:

   #let  example =
      (print_newline();
       print_begin 0;
       print_string `first`;
       print_break (1,2);
       print_string `second`;
       print_break (1,2);
       print_string `third`;
       print_end();
       print_newline());;

After initialization of the block three strings ‘first’,‘second’ and ‘third’ are printed each with a break between them. The total width of the three strings is more than 13 (margin) but the first two (‘first’ and ‘second’) combined with the space between them is less than 13. From the result of consistent formatting shown below it is clear that if any wrapping takes place everything will be wrapped. To clearly see what consistent breaking means contrast the above with print_ibegin where the same example is used but with inconsistent formatting. The output we obtain is the following:

   first
     second
     third
   example =
   ()
   : void

See also

print_ibegin, print_break, print_end, max_print_depth, set_margin,
print_newline

 print_bool
print_bool : (bool -> void)

Synopsis

Prints the value of a boolean variable.

Failure

Never fails.

Example

As a simple example, assign the value true to a variable:

   #let B = true;;
   B = true : bool

If we now want find the value of B we type:

   #print_bool B;;

and the system responds with:

   true() : void

 print_break
print_break : ((int # int) -> void)

Synopsis

Breaks a pretty printing block into parts.

Description

The function print_break is used within the print formatting block formed by either print_begin or print_ibegin and print_end. It is used to indicate points where breaks can occur within a list being printed. The function takes two integer arguments, the first indicating the width of the break and the second specifying an offset to be used if wrapping has to be done.

Failure

Never fails.

Example

We first set the margin to 13 by:

   #set_margin 13;;
   72 : int

A simple formatting action is done in the ML segment given below:

   #let  example =
      (print_begin 0;
       print_string `first`;
       print_break (1,2);
       print_string `second`;
       print_break (1,2);
       print_end());;

In this fragment of code print_break is used to put a single space between the strings. However if wrapping occurs, print_break indents the following line by two spaces. The result of this fragment is:

   first second example =
   ()
   : void

If we now change the margin to 10 and execute the same fragment (not given):

   #set_margin 10;;
   13 : int

The result is wrapped with an indent of two character spaces from the left.

   first
     second
     example =
   ()
   : void

Wrapping took place due to the new margin setting.

See also

print_begin, print_ibegin, print_end, print_newline

 print_defined_types

print_defined_types : (void -> void)

Synopsis

Prints all currently defined ML types known to the system.

Description

The function prints all ML types defined by means of lettype. It also lists all abstract types in the system. The printing of lettype defined types can be suppressed by setting the flag print_lettypes to false. The resulting suppression is only partial as only the outer level of defined types is expanded.

Failure

Never fails.

 print_end

print_end : (void -> void)

Synopsis

Closes a formatting block.

Description

This function closes a formatting block initialized by print_begin or print_ibegin. It terminates the offset settings that were defined within the block.

Failure

Never fails.

Example

#let  example =
   (print_begin 0;
    print_string `first`;
    print_break (0,2);
    print_string `second`;
    print_break (0,2);
    print_end());;

It is immediately clear how the function terminates the formatting block.

See also

print_begin, print_ibegin
 print_goal
print_goal : (goal -> void)

Synopsis

Prints a goal, including its assumptions.

Description

The function print_goal takes a goal as argument and prints the goal and its list of assumptions.

Failure

Never fails.

Example

If we define a goal in the following manner:

   #let goal = ([],"!a. a /\ T ==> a");;
   goal = ([], "!a. a /\ T ==> a") : (* list # term)

and then do:

   #print_goal goal;;

The system responds with:

   "!a. a /\ T ==> a"
   () : void

If there were assumptions these would also have been printed.

See also

print_thm

 print_hyps

print_hyps : (term list -> void)

Synopsis

This function is for internal use only and is to be deleted from a future version of the system. It should not be used.

 print_ibegin

print_ibegin : (int -> void)

Synopsis

Initiates a pretty printing block with inconsistent breaks.

Description

The function print_ibegin initiates a inconsistent printing block. Inconsistent breaks cause non-uniform indentation at each break which is unlike the ‘all or nothing’ approach of consistent formatting (see print_begin). The argument is the offset of the block that print_ibegin initiates. This offset is added to the indentation of any lines broken inside. This offset is very seldom used.

Example

Set the margin to be 13 characters wide:

#set_margin 13;;
13 : int

Then initialize the block using print_ibegin:

#let  example =
   (print_newline();
    print_ibegin 0;
    print_string `first`;
    print_break (1,2);
    print_string `second`;
    print_break (1,2);
    print_string `third`;
    print_end();
    print_newline());;

After the initialization of the block the strings ‘first’, ‘second’ and ‘third’ are printed with breaks between them. The first line does not break because we only have 12 characters on the line first second. When starting to print ‘third’ though wrapping has to take place. The output we obtain is the following:

   first second
     third
   example =
   ()
   : void

See also

print_break, print_end, max_print_depth, print_begin

 print_int

print_int : (int -> void)

Synopsis

Prints an ML integer to the terminal.

Description

print_int n returns ():void with the side-effect of printing the value of n to the terminal. The text is not terminated with a carriage return. In fact, the text is queued until the pretty-printer decides where line breaks are needed, or until the queue is explicitly flushed.

Failure

Never fails.

Example

#print_int 2;;
2() : void
#print_int (-10);;
-10() : void

See also

print_begin, print_end, print_newline.

 print_list

print_list : (bool -> string -> (* -> **) -> * list -> void)

Synopsis

Prints a list to the terminal in a specific format.

Description

print_list incon name prfn l returns ():void with the side-effect of printing the elements of l to the terminal using the print function prfn. The string name is also displayed and the flag incon specifies whether line breaking between elements of the list is to be inconsistent (incon is true) or consistent (incon is false). If the list l is empty, no text is displayed. When l is not empty, the elements of the list are printed in reverse order.

The format of the output is illustrated in the example. print_list is used within the HOL system for printing theories. It is unlikely to be of use in general.

Failure

Fails if the print function prfn fails on any of the arguments of the list l.

Example

#set_margin 15;;
72 : int
#print_list true `Test1:` print_int [1;2;3;4;5;6];;
Test1: --
  6     5
  4     3
  2     1
() : void
#print_list false `Test2:` print_int [1;2;3;4;5;6];;
Test2: --
  6
  5
  4
  3
  2
  1
() : void

See also

print_theory, print_begin, print_end, print_newline.

 print_newline

print_newline : (void -> void)

Synopsis

Prints a newline.

Description

The function print_newline starts the text following it on the next line. This is done irrespective of consistent or inconsistent formatting and margin settings.

Example

A simple example is:

   #let example =
      (print_string `first`;
       print_newline();
       print_string `second`;
       print_newline());;

The result is:

   first
   second
   example = () : void

See also

print_begin, print_end, print_break

 print_stack

print_stack : (subgoals list -> int -> void)

Synopsis

This function is for internal use only and is to be deleted from a future version of the system. It should not be used.

 print_state

print_state : (int -> void)

Synopsis

Prints the top levels of the subgoal package goal stack.

Description

The function print_state is part of the subgoal package. Calling print_state n prints the top n levels of the goal stack of the current proof state (that is, the top n levels of 434 Chapter 1. Pre-defined ML Identifiers

unproven subgoals). If more than one subgoal is produced, they are printed from the bottom of the stack so that the current goal is printed last. If n is negative or is greater than the number of levels on the goal stack, the whole stack is printed. If no goal has been set or n is zero, nothing will be printed. If the original goal has just been proved so that the proof state consists of a theorem, and n is non-zero, goal proved is printed. For a description of the subgoal package, see set_goal.

Failure

Never fails.

Example

#g "(HD[1;2;3] = 1) /\ (TL[1;2;3] = [2;3])";;
"(HD[1;2;3] = 1) /\ (TL[1;2;3] = [2;3])"
() : void
#e CONJ_TAC;;
OK..
2 subgoals
"TL[1;2;3] = [2;3]"
"HD[1;2;3] = 1"
() : void
#print_state 2;;
"(HD[1;2;3] = 1) /\ (TL[1;2;3] = [2;3])"
2 subgoals
"TL[1;2;3] = [2;3]"
"HD[1;2;3] = 1"
() : void

Uses

Examining the proof state during an interactive proof session.

See also

b, backup, backup_limit, e, expand, expandf, g, get_state, p, r, rotate,
save_top_thm, set_goal, set_state, top_goal, top_thm.

 print_string

print_string : (string -> void)

Synopsis

Prints an ML string to the terminal (without surrounding string quotes).

Description

print_string s returns ():void with the side-effect of printing the string s to the terminal. String quotes are not printed around the string, and the text is not terminated with a carriage return. In fact, the text is queued until the pretty-printer decides where line breaks are needed, or until the queue is explicitly flushed.

Failure

Never fails.

Example

#print_string `This is an example`;;
This is an example() : void

See also

print_tok, message, print_begin, print_end, print_newline.

 print_subgoals

print_subgoals : (subgoals -> void)

Synopsis

This function is for internal use only and is to be deleted from a future version of the system. It should not be used.

 print_term

print_term : (term -> void)

Synopsis

Prints a HOL term to the terminal.

Description

print_term tm returns ():void with the side-effect of printing the value of tm to the terminal. The text is not terminated with a carriage return. In fact, the text is queued until the pretty-printer decides where line breaks are needed, or until the queue is explicitly flushed.

Failure

Never fails.

Example

#print_term "x /\ y";;
"x /\ y"() : void

See also

print_begin, print_end, print_newline, show_types, print_type, print_thm.

 print_theory

print_theory : (string -> void)

Synopsis

Prints the contents of a HOL theory to the terminal.

Description

print_theory `name` returns ():void with the side-effect of printing the contents of the theory called name. print_theory `-` prints the current theory. The following information is displayed: the parents of the theory, types defined within the theory, type abbreviations defined within the theory, constants of the theory, the binders and infixes (subsets of the constants), the axioms, the definitions, and the derived theorems.

Failure

Fails if the named theory does not exist or is not an ancestor of the current theory.

Example

To obtain an example, type print_theory `bool`;; to the system.

See also

print_type, print_term, print_thm.

 print_thm

print_thm : (thm -> void)

Synopsis

Prints a HOL theorem to the terminal (abbreviating assumptions).

Description

print_thm th returns ():void with the side-effect of printing the value of th to the terminal. The text is not terminated with a carriage return. In fact, the text is queued until the pretty-printer decides where line breaks are needed, or until the queue is explicitly flushed.

Each assumption of the theorem is printed as one dot (period, full stop).

Failure

Never fails.

Example

#print_thm CONJ_SYM;;
|- !t1 t2. t1 /\ t2 = t2 /\ t1() : void

See also

print_all_thm, print_begin, print_end, print_newline, show_types, print_type,
print_term.

 print_tok

print_tok : (string -> void)

Synopsis

Prints an ML string to the terminal (with surrounding string quotes).

Description

print_tok s returns ():void with the side-effect of printing the string s to the terminal. String quotes are printed around the string but the text is not terminated with a carriage return. In fact, the text is queued until the pretty-printer decides where line breaks are needed, or until the queue is explicitly flushed.

Failure

Never fails.

Example

#print_tok `This is an example`;;
`This is an example`() : void

See also

print_string, message, print_begin, print_end, print_newline.

 print_type

print_type : (type -> void)

Synopsis

Prints a HOL type to the terminal.

Description

print_type ty returns ():void with the side-effect of printing the value of ty to the terminal. The text is not terminated with a carriage return. In fact, the text is queued until the pretty-printer decides where line breaks are needed, or until the queue is explicitly flushed.

Failure

Never fails.

Example

#print_type ":bool";;
":bool"() : void

See also

print_begin, print_end, print_newline, print_term, print_thm.

 print_unquoted_term

print_unquoted_term : (term -> void)

Synopsis

Prints a HOL term to the terminal without surrounding quotes.

Description

print_unquoted_term tm returns ():void with the side-effect of printing the value of tm to the terminal without surrounding quotes. The text is not terminated with a carriage return. In fact, the text is queued until the pretty-printer decides where line breaks are needed, or until the queue is explicitly flushed.

Failure

Never fails.

Example

#print_unquoted_term "x /\ y";;
x /\ y() : void

See also

print_term, print_begin, print_end, print_newline, show_types, print_type,
print_thm, print_unquoted_type.

 print_unquoted_type

print_unquoted_type : (type -> void)

Synopsis

Prints a HOL type to the terminal without surrounding quotes and without the leading colon.

Description

print_unquoted_type ty returns ():void with the side-effect of printing the value of ty to the terminal without surrounding quotes and without the leading colon. The text is 440 Chapter 1. Pre-defined ML Identifiers not terminated with a carriage return. In fact, the text is queued until the pretty-printer decides where line breaks are needed, or until the queue is explicitly flushed.

Failure

Never fails.

Example

#print_unquoted_type ":bool";;
bool() : void

See also

print_type, print_begin, print_end, print_newline, print_term, print_thm,
print_unquoted_term.
 print_void
print_void : (void -> void)

Synopsis

Prints ‘()’ to the terminal.

Description

print_void () returns ():void with the side-effect of printing the value ‘()’ to the terminal. The text is not terminated with a carriage return. In fact, the text is queued until the pretty-printer decides where line breaks are needed, or until the queue is explicitly flushed.

Failure

Never fails.

Example

#print_void();;
()() : void

See also

print_begin, print_end, print_newline.

\underline{prompt 441}

 prompt

prompt : (bool -> bool)

Synopsis

Switches the ML prompt on or off.

Description

prompt true switches on the ML prompt (which is ‘#’ by default); prompt false switches it off. In either case, prompt returns the previous state (true for on, false for off).

Failure

Never fails.

See also

set_prompt.

 PROVE

PROVE : ((term # tactic) -> thm)

Synopsis

Attempts to prove a boolean term using the supplied tactic.

Description

When applied to a term-tactic pair (tm,tac), the function PROVE attempts to prove the goal ?- tm, that is, the term tm with no assumptions, using the tactic tac. If PROVE succeeds, it returns the corresponding theorem A |- tm, where the assumption list A may not be empty if the tactic is invalid; PROVE has no inbuilt validity-checking.

Failure

Fails if the term is not of type bool (and so cannot possibly be the conclusion of a theorem), or if the tactic cannot solve the goal. In the latter case PROVE will list the unsolved goals to help the user.

See also

TAC_PROOF, prove, prove_thm, VALID.

 prove

prove : ((term # tactic) -> thm)

Synopsis

Attempts to prove a boolean term using the supplied tactic.

Description

When applied to a term-tactic pair (tm,tac), the function prove attempts to prove the goal ?- tm, that is, the term tm with no assumptions, using the tactic tac. If prove succeeds, it returns the corresponding theorem A |- tm, where the assumption list A may not be empty if the tactic is invalid; prove has no inbuilt validity-checking.

Failure

Fails if the term is not of type bool (and so cannot possibly be the conclusion of a theorem), or if the tactic cannot solve the goal.

Comments

The function PROVE provides almost identical functionality, and will also list unsolved goals if the tactic fails. It is therefore preferable for most purposes.

See also

PROVE, prove_thm, TAC_PROOF, VALID.

 prove_abs_fn_one_one

prove_abs_fn_one_one : (thm -> thm)

Synopsis

Proves that a type abstraction function is one-to-one (injective).

Description

If th is a theorem of the form returned by the function define_new_type_bijections:

   |- (!a. abs(rep a) = a) /\ (!r. P r = (rep(abs r) = r))

then prove_abs_fn_one_one th proves from this theorem that the function abs is one-to-one for values that satisfy P, returning the theorem:

   |- !r r'. P r ==> P r' ==> ((abs r = abs r') = (r = r'))

Failure

Fails if applied to a theorem not of the form shown above.

See also

new_type_definition, define_new_type_bijections, prove_abs_fn_onto,
prove_rep_fn_one_one, prove_rep_fn_onto.

 prove_abs_fn_onto

prove_abs_fn_onto : (thm -> thm)

Synopsis

Proves that a type abstraction function is onto (surjective).

Description

If th is a theorem of the form returned by the function define_new_type_bijections:

   |- (!a. abs(rep a) = a) /\ (!r. P r = (rep(abs r) = r))

then prove_abs_fn_onto th proves from this theorem that the function abs is onto, returning the theorem:

   |- !a. ?r. (a = abs r) /\ P r

Failure

Fails if applied to a theorem not of the form shown above.

See also

new_type_definition, define_new_type_bijections, prove_abs_fn_one_one,
prove_rep_fn_one_one, prove_rep_fn_onto.

 prove_cases_thm

prove_cases_thm : (thm -> thm)

Synopsis

Proves a structural cases theorem for an automatically-defined concrete type.

Description

prove_cases_thm takes as its argument a structural induction theorem, in the form returned by prove_induction_thm for an automatically-defined concrete type. When applied to such a theorem, prove_cases_thm automatically proves and returns a theorem which states that every value the concrete type in question is denoted by the value returned by some constructor of the type.

Failure

Fails if the argument is not a theorem of the form returned by prove_induction_thm

Example

Given the following structural induction theorem for labelled binary trees:

   |- !P. (!x. P(LEAF x)) /\ (!b1 b2. P b1 /\ P b2 ==> P(NODE b1 b2)) ==>
          (!b. P b)

prove_cases_thm proves and returns the theorem:

   |- !b. (?x. b = LEAF x) \/ (?b1 b2. b = NODE b1 b2)

This states that every labelled binary tree b is either a leaf node with a label x or a tree with two subtrees b1 and b2.

See also

define_type, INDUCT_THEN, new_recursive_definition,
prove_constructors_distinct, prove_constructors_one_one, prove_induction_thm,
prove_rec_fn_exists.

 prove_constructors_distinct

prove_constructors_distinct : (thm -> thm)

Synopsis

Proves that the constructors of an automatically-defined concrete type yield distinct values.

Description

prove_constructors_distinct takes as its argument a primitive recursion theorem, in the form returned by define_type for an automatically-defined concrete type. When applied to such a theorem, prove_constructors_distinct automatically proves and returns a theorem which states that distinct constructors of the concrete type in question yield distinct values of this type.

Failure

Fails if the argument is not a theorem of the form returned by define_type, or if the concrete type in question has only one constructor.

Example

Given the following primitive recursion theorem for labelled binary trees:

   |- !f0 f1.
        ?! fn.
        (!x. fn(LEAF x) = f0 x) /\
        (!b1 b2. fn(NODE b1 b2) = f1(fn b1)(fn b2)b1 b2)
prove_constructors_distinct proves and returns the theorem:
   |- !x b1 b2. ~(LEAF x = NODE b1 b2)

This states that leaf nodes are different from internal nodes. When the concrete type in question has more than two constructors, the resulting theorem is just conjunction of inequalities of this kind.

See also

define_type, INDUCT_THEN, new_recursive_definition, prove_cases_thm,
prove_constructors_one_one, prove_induction_thm, prove_rec_fn_exists.

 prove_constructors_one_one

prove_constructors_one_one : (thm -> thm)

Synopsis

Proves that the constructors of an automatically-defined concrete type are injective.

Description

prove_constructors_one_one takes as its argument a primitive recursion theorem, in the form returned by define_type for an automatically-defined concrete type. When applied to such a theorem, prove_constructors_one_one automatically proves and returns a theorem which states that the constructors of the concrete type in question are injective (one-to-one). The resulting theorem covers only those constructors that take arguments (i.e. that are not just constant values).

Failure

Fails if the argument is not a theorem of the form returned by define_type, or if all the constructors of the concrete type in question are simply constants of that type.

Example

Given the following primitive recursion theorem for labelled binary trees:

   |- !f0 f1.
        ?! fn.
        (!x. fn(LEAF x) = f0 x) /\
        (!b1 b2. fn(NODE b1 b2) = f1(fn b1)(fn b2)b1 b2)

prove_constructors_one_one proves and returns the theorem:

   |- (!x x'. (LEAF x = LEAF x') = (x = x')) /\
      (!b1 b2 b1' b2'.
        (NODE b1 b2 = NODE b1' b2') = (b1 = b1') /\ (b2 = b2'))

This states that the constructors LEAF and NODE are both injective.

See also

define_type, INDUCT_THEN, new_recursive_definition, prove_cases_thm,
prove_constructors_distinct, prove_induction_thm, prove_rec_fn_exists.

 PROVE_HYP

PROVE_HYP : (thm -> thm -> thm)

Synopsis

Eliminates a provable assumption from a theorem.

Description

When applied to two theorems, PROVE_HYP gives a new theorem with the conclusion of the second and the union of the assumption list minus the conclusion of the first theorem.

     A1 |- t1     A2 |- t2
   ------------------------  PROVE_HYP
    (A1 u A2) - {t1} |- t2

Comments

This is the Cut rule. It is not necessary for the conclusion of the first theorem to be the same as an assumption of the second, but PROVE_HYP is otherwise of doubtful value.

See also

DISCH, MP, UNDISCH.

 prove_induction_thm

prove_induction_thm : (thm -> thm)

Synopsis

Derives structural induction for an automatically-defined concrete type.

Description

prove_induction_thm takes as its argument a primitive recursion theorem, in the form returned by define_type for an automatically-defined concrete type. When applied to such a theorem, prove_induction_thm automatically proves and returns a theorem that states a structural induction principle for the concrete type described by the argument theorem. The theorem returned by prove_induction_thm is in a form suitable for use with the general structural induction tactic INDUCT_THEN.

Failure

Fails if the argument is not a theorem of the form returned by define_type.

Example

Given the following primitive recursion theorem for labelled binary trees:

   |- !f0 f1.
        ?! fn.
        (!x. fn(LEAF x) = f0 x) /\
        (!b1 b2. fn(NODE b1 b2) = f1(fn b1)(fn b2)b1 b2)

prove_induction_thm proves and returns the theorem:

   |- !P. (!x. P(LEAF x)) /\ (!b1 b2. P b1 /\ P b2 ==> P(NODE b1 b2)) ==>
          (!b. P b)

This theorem states the principle of structural induction on labelled binary trees: if a predicate P is true of all leaf nodes, and if whenever it is true of two subtrees b1 and b2 it is also true of the tree NODE b1 b2, then P is true of all labelled binary trees.

See also

define_type, INDUCT_THEN, new_recursive_definition, prove_cases_thm,
prove_constructors_distinct, prove_constructors_one_one, prove_rec_fn_exists.

 prove_rec_fn_exists

prove_rec_fn_exists : (thm -> term -> thm)

Synopsis

Proves the existence of a primitive recursive function over a concrete recursive type.

Description

prove_rec_fn_exists is a version of new_recursive_definition which proves only that

the required function exists; it does not make a constant specification. The first argument is a theorem of the form returned by define_type, and the second is a user-supplied primitive recursive function definition. The theorem which is returned asserts the existence of the recursively-defined function in question (if it is primitive recursive over the type characterized by the theorem given as the first argument). See the entry for

new_recursive_definition for details.

Failure

As for new_recursive_definition.

Example

Given the following primitive recursion theorem for labelled binary trees:

   |- !f0 f1.
        ?! fn.
        (!x. fn(LEAF x) = f0 x) /\
        (!b1 b2. fn(NODE b1 b2) = f1(fn b1)(fn b2)b1 b2)

prove_rec_fn_exists can be used to prove the existence of primitive recursive functions over binary trees. Suppose the value of th is this theorem. Then the existence of a recursive function Leaves, which computes the number of leaves in a binary tree, can be proved as shown below:

   #prove_rec_fn_exists th
   #  "(Leaves (LEAF (x:*)) = 1) /\
   #   (Leaves (NODE t1 t2) = (Leaves t1) + (Leaves t2))";;
   |- ?Leaves. (!x. Leaves(LEAF x) = 1) /\
               (!t1 t2. Leaves(NODE t1 t2) = (Leaves t1) + (Leaves t2))

The result should be compared with the example given under new_recursive_definition.

See also

define_type, new_recursive_definition.
 prove_rep_fn_one_one
prove_rep_fn_one_one : (thm -> thm)

Synopsis

Proves that a type representation function is one-to-one (injective).

Description

If th is a theorem of the form returned by the function define_new_type_bijections:

   |- (!a. abs(rep a) = a) /\ (!r. P r = (rep(abs r) = r))

then prove_rep_fn_one_one th proves from this theorem that the function rep is one-to-one, returning the theorem:

   |- !a a'. (rep a = rep a') = (a = a')

Failure

Fails if applied to a theorem not of the form shown above.

See also

new_type_definition, define_new_type_bijections, prove_abs_fn_one_one,
prove_abs_fn_onto, prove_rep_fn_onto.
 prove_rep_fn_onto
prove_rep_fn_onto : (thm -> thm)

Synopsis

Proves that a type representation function is onto (surjective).

Description

If th is a theorem of the form returned by the function define_new_type_bijections:

   |- (!a. abs(rep a) = a) /\ (!r. P r = (rep(abs r) = r))

then prove_rep_fn_onto th proves from this theorem that the function rep is onto the set of values that satisfy P, returning the theorem:

   |- !r. P r = (?a. r = rep a)

Failure

Fails if applied to a theorem not of the form shown above.

See also

new_type_definition, define_new_type_bijections, prove_abs_fn_one_one,
prove_abs_fn_onto, prove_rep_fn_one_one.

 prove_thm

prove_thm : ((string # term # tactic) -> thm)

Synopsis

Attempts to prove a boolean term using the supplied tactic, then save the theorem.

Description

When applied to a triple (s,tm,tac), giving the name to save the theorem under, the term to prove (with no assumptions) and the tactic to perform the proof, the function prove_thm attempts to prove the goal ?- tm, that is, the term tm with no assumptions, using the tactic tac. If prove_thm succeeds, it attempts to save the resulting theorem in the current theory segment, and if this succeeds, the saved theorem is returned.

Failure

Fails if the term is not of type bool (and so cannot possibly be the conclusion of a theorem), or if the tactic cannot solve the goal. In the latter case prove_thm will list the unsolved goals to help the user. In addition, prove_thm will fail if the theorem cannot be saved, e.g. because there is already a theorem of that name in the current theory segment, or if the resulting theorem has assumptions; clearly this can only happen if the tactic was invalid, so this gives some measure of validity checking.

See also

prove, PROVE, TAC_PROOF, VALID.

 PURE_ASM_REWRITE_RULE

PURE_ASM_REWRITE_RULE : (thm list -> thm -> thm)

Synopsis

Rewrites a theorem including the theorem’s assumptions as rewrites.

Description

The list of theorems supplied by the user and the assumptions of the object theorem are used to generate a set of rewrites, without adding implicitly the basic tautologies stored under basic_rewrites. The rule searches for matching subterms in a top-down recursive fashion, stopping only when no more rewrites apply. For a general description of rewriting

strategies see GEN_REWRITE_RULE.

Failure

Rewriting with PURE_ASM_REWRITE_RULE does not result in failure. It may diverge, in which

case PURE_ONCE_ASM_REWRITE_RULE may be used.

See also

ASM_REWRITE_RULE, GEN_REWRITE_RULE, ONCE_REWRITE_RULE, PURE_REWRITE_RULE,
PURE_ONCE_ASM_REWRITE_RULE.

 PURE_ASM_REWRITE_TAC

PURE_ASM_REWRITE_TAC : (thm list -> tactic)

Synopsis

Rewrites a goal including the goal’s assumptions as rewrites.

Description

PURE_ASM_REWRITE_TAC generates a set of rewrites from the supplied theorems and the assumptions of the goal, and applies these in a top-down recursive manner until no match is found. See GEN_REWRITE_TAC for more information on the group of rewriting tactics.

Failure

PURE_ASM_REWRITE_TAC does not fail, but it can diverge in certain situations. For limited depth rewriting, see PURE_ONCE_ASM_REWRITE_TAC. It can also result in an invalid tactic.

Uses

To advance or solve a goal when the current assumptions are expected to be useful in reducing the goal.

See also

ASM_REWRITE_TAC, GEN_REWRITE_TAC, FILTER_ASM_REWRITE_TAC,
FILTER_ONCE_ASM_REWRITE_TAC, ONCE_ASM_REWRITE_TAC, ONCE_REWRITE_TAC,
PURE_ONCE_ASM_REWRITE_TAC, PURE_ONCE_REWRITE_TAC, PURE_REWRITE_TAC,
REWRITE_TAC, SUBST_TAC.

 PURE_ONCE_ASM_REWRITE_RULE

PURE_ONCE_ASM_REWRITE_RULE : (thm list -> thm -> thm)

Synopsis

Rewrites a theorem once, including the theorem’s assumptions as rewrites.

Description

PURE_ONCE_ASM_REWRITE_RULE excludes the basic tautologies in basic_rewrites from the

theorems used for rewriting. It searches for matching subterms once only, without recursing over already rewritten subterms. For a general introduction to rewriting tools see

GEN_REWRITE_RULE.

Failure

PURE_ONCE_ASM_REWRITE_RULE does not fail and does not diverge.

See also

ASM_REWRITE_RULE, GEN_REWRITE_RULE, ONCE_ASM_REWRITE_RULE, ONCE_REWRITE_RULE,
PURE_ASM_REWRITE_RULE, PURE_REWRITE_RULE, REWRITE_RULE.

 PURE_ONCE_ASM_REWRITE_TAC

PURE_ONCE_ASM_REWRITE_TAC : (thm list -> tactic)

Synopsis

Rewrites a goal once, including the goal’s assumptions as rewrites.

Description

A set of rewrites generated from the assumptions of the goal and the supplied theorems is used to rewrite the term part of the goal, making only one pass over the goal. The basic tautologies are not included as rewrite theorems. The order in which the given theorems are applied is an implementation matter and the user should not depend on any ordering. See GEN_REWRITE_TAC for more information on rewriting tactics in general.

Failure

PURE_ONCE_ASM_REWRITE_TAC does not fail and does not diverge.

Uses

Manipulation of the goal by rewriting with its assumptions, in instances where rewriting with tautologies and recursive rewriting is undesirable.

See also

ASM_REWRITE_TAC, GEN_REWRITE_TAC, FILTER_ASM_REWRITE_TAC,
FILTER_ONCE_ASM_REWRITE_TAC, ONCE_ASM_REWRITE_TAC, ONCE_REWRITE_TAC,
PURE_ASM_REWRITE_TAC, PURE_ONCE_REWRITE_TAC, PURE_REWRITE_TAC, REWRITE_TAC,
SUBST_TAC.

 PURE_ONCE_REWRITE_CONV

PURE_ONCE_REWRITE_CONV : (thm list -> conv)

Synopsis

Rewrites a term once with only the given list of rewrites.

Description

PURE_ONCE_REWRITE_CONV generates rewrites from the list of theorems supplied by the user, without including the tautologies given in basic_rewrites. The applicable rewrites are employeded once, without entailing in a recursive search for matches over the term. See GEN_REWRITE_CONV for more details about rewriting strategies in HOL.

Failure

This rule does not fail, and it does not diverge.

See also

GEN_REWRITE_CONV, ONCE_DEPTH_CONV, ONCE_REWRITE_CONV, PURE_REWRITE_CONV,
REWRITE_CONV.

 PURE_ONCE_REWRITE_RULE

PURE_ONCE_REWRITE_RULE : (thm list -> thm -> thm)

Synopsis

Rewrites a theorem once with only the given list of rewrites.

Description

PURE_ONCE_REWRITE_RULE generates rewrites from the list of theorems supplied by the user, without including the tautologies given in basic_rewrites. The applicable rewrites are employeded once, without entailing in a recursive search for matches over the theorem. See GEN_REWRITE_RULE for more details about rewriting strategies in HOL.

Failure

This rule does not fail, and it does not diverge.

See also

ASM_REWRITE_RULE, GEN_REWRITE_RULE, ONCE_DEPTH_CONV, ONCE_REWRITE_RULE,
PURE_REWRITE_RULE, REWRITE_RULE.

 PURE_ONCE_REWRITE_TAC

PURE_ONCE_REWRITE_TAC : (thm list -> tactic)

Synopsis

Rewrites a goal using a supplied list of theorems, making one rewriting pass over the goal.

Description

PURE_ONCE_REWRITE_TAC generates a set of rewrites from the given list of theorems, and applies them at every match found through searching once over the term part of the goal, without recursing. It does not include the basic tautologies as rewrite theorems. The order in which the rewrites are applied is unspecified. For more information on rewriting

tactics see GEN_REWRITE_TAC.

Failure

PURE_ONCE_REWRITE_TAC does not fail and does not diverge.

Uses

This tactic is useful when the built-in tautologies are not required as rewrite equations and recursive rewriting is not desired.

See also

ASM_REWRITE_TAC, GEN_REWRITE_TAC, FILTER_ASM_REWRITE_TAC,
FILTER_ONCE_ASM_REWRITE_TAC, ONCE_ASM_REWRITE_TAC, ONCE_REWRITE_TAC,
PURE_ASM_REWRITE_TAC, PURE_ONCE_ASM_REWRITE_TAC, PURE_REWRITE_TAC, REWRITE_TAC,
SUBST_TAC.

 PURE_REWRITE_CONV
PURE_REWRITE_CONV : (thm list -> conv)

Synopsis

Rewrites a term with only the given list of rewrites.

Description

This conversion provides a method for rewriting a term with the theorems given, and excluding simplification with tautologies in basic_rewrites. Matching subterms are found recursively, until no more matches are found. For more details on rewriting see

GEN_REWRITE_CONV.

Uses

PURE_REWRITE_CONV is useful when the simplifications that arise by rewriting a theorem with basic_rewrites are not wanted.

Failure

Does not fail. May result in divergence, in which case PURE_ONCE_REWRITE_CONV can be used.

See also

GEN_REWRITE_CONV, ONCE_REWRITE_CONV, PURE_ONCE_REWRITE_CONV, REWRITE_CONV.

 PURE_REWRITE_RULE
PURE_REWRITE_RULE : (thm list -> thm -> thm)

Synopsis

Rewrites a theorem with only the given list of rewrites.

Description

This rule provides a method for rewriting a theorem with the theorems given, and excluding simplification with tautologies in basic_rewrites. Matching subterms are found recursively starting from the term in the conclusion part of the theorem, until no more matches are found. For more details on rewriting see GEN_REWRITE_RULE.

Uses

PURE_REWRITE_RULE is useful when the simplifications that arise by rewriting a theorem with basic_rewrites are not wanted.

Failure

Does not fail. May result in divergence, in which case PURE_ONCE_REWRITE_RULE can be used.

See also

ASM_REWRITE_RULE, GEN_REWRITE_RULE, ONCE_REWRITE_RULE, PURE_ASM_REWRITE_RULE,
PURE_ONCE_ASM_REWRITE_RULE, PURE_ONCE_REWRITE_RULE, REWRITE_RULE.

 PURE_REWRITE_TAC

PURE_REWRITE_TAC : (thm list -> tactic)

Synopsis

Rewrites a goal with only the given list of rewrites.

Description

PURE_REWRITE_TAC behaves in the same way as REWRITE_TAC, but without the effects of the built-in tautologies. The order in which the given theorems are applied is an implementation matter and the user should not depend on any ordering. For more information on rewriting strategies see GEN_REWRITE_TAC.

Failure

PURE_REWRITE_TAC does not fail, but it can diverge in certain situations; in such cases

PURE_ONCE_REWRITE_TAC may be used.

Uses

This tactic is useful when the built-in tautologies are not required as rewrite equations. It is sometimes useful in making more time-efficient replacements according to equations for which it is clear that no extra reduction via tautology will be needed. (The difference in efficiency is only apparent, however, in quite large examples.)

PURE_REWRITE_TAC advances goals but solves them less frequently than REWRITE_TAC; to be precise, PURE_REWRITE_TAC only solves goals which are rewritten to "T" (i.e. TRUTH) without recourse to any other tautologies.

Example

It might be necessary, say for subsequent application of an induction hypothesis, to resist reducing a term "b = T" to "b".

  #PURE_REWRITE_TAC[]([],"b = T");;
  ([([], "b = T")], -) : subgoals
  #REWRITE_TAC[]([],"b = T");;
  ([([], "b")], -) : subgoals

See also

ASM_REWRITE_TAC, FILTER_ASM_REWRITE_TAC, FILTER_ONCE_ASM_REWRITE_TAC,
GEN_REWRITE_TAC, ONCE_ASM_REWRITE_TAC, ONCE_REWRITE_TAC, PURE_ASM_REWRITE_TAC,
PURE_ONCE_ASM_REWRITE_TAC, PURE_ONCE_REWRITE_TAC, REWRITE_TAC, SUBST_TAC.

 push_fsubgoals

push_fsubgoals : (subgoals list -> tactic -> subgoals list)

Synopsis

This function is for internal use only and is to be deleted from a future version of the system. It should not be used.

 push_print

push_print : (subgoals -> subgoals list -> subgoals list)

Synopsis

This function is for internal use only and is to be deleted from a future version of the system. It should not be used.

 push_subgoals

push_subgoals : (subgoals list -> tactic -> subgoals list)

Synopsis

This function is for internal use only and is to be deleted from a future version of the system. It should not be used.

 quit

quit : (void -> void)

Synopsis

Evaluating quit() terminates the current HOL session.

Failure

Never fails.

 r

r : (int -> void)

Synopsis

Reorders the subgoals on top of the subgoal package goal stack.

Description

The function r is part of the subgoal package. It is an abbreviation for rotate. For a description of the subgoal package, see set_goal.

Failure

As for rotate.

Uses

Proving subgoals in a different order to that generated by the subgoal package.

\underline{rand 459}

See also

b, backup, backup_limit, e, expand, expandf, g, get_state, p, print_state,
rotate, save_top_thm, set_goal, set_state, top_goal, top_thm.

 rand

rand : (term -> term)

Synopsis

Returns the operand from a combination (function application).

Description

rand "t1 t2" returns "t2".

Failure

Fails with rand if term is not a combination.

See also

rator, dest_comb.

 RAND_CONV

RAND_CONV : (conv -> conv)

Synopsis

Applies a conversion to the operand of an application.

Description

If c is a conversion that maps a term "t2" to the theorem |- t2 = t2', then the conversion RAND_CONV c maps applications of the form "t1 t2" to theorems of the form:

   |- (t1 t2) = (t1 t2')

That is, RAND_CONV c "t1 t2" applies c to the operand of the application "t1 t2".

Failure

RAND_CONV c tm fails if tm is not an application or if tm has the form "t1 t2" but the conversion c fails when applied to the term t2. The function returned by RAND_CONV c 460 Chapter 1. Pre-defined ML Identifiers may also fail if the ML function c:term->thm is not, in fact, a conversion (i.e. a function that maps a term t to a theorem |- t = t').

Example

#RAND_CONV num_CONV "SUC 2";;
|- SUC 2 = SUC(SUC 1)

See also

ABS_CONV, RATOR_CONV, SUB_CONV.
 rator
rator : (term -> term)

Synopsis

Returns the operator from a combination (function application).

Description

rator("t1 t2") returns "t1".

Failure

Fails with rator if term is not a combination.

See also

rand, dest_comb.
 RATOR_CONV
RATOR_CONV : (conv -> conv)

Synopsis

Applies a conversion to the operator of an application.

\underline{read 461}

Description

If c is a conversion that maps a term "t1" to the theorem |- t1 = t1', then the conversion RATOR_CONV c maps applications of the form "t1 t2" to theorems of the form:

   |- (t1 t2) = (t1' t2)

That is, RATOR_CONV c "t1 t2" applies c to the operand of the application "t1 t2".

Failure

RATOR_CONV c tm fails if tm is not an application or if tm has the form "t1 t2" but the conversion c fails when applied to the term t1. The function returned by RATOR_CONV c may also fail if the ML function c:term->thm is not, in fact, a conversion (i.e. a function that maps a term t to a theorem |- t = t').

Example

#RATOR_CONV BETA_CONV "(\x y. x + y) 1 2";;
|- (\x y. x + y)1 2 = (\y. 1 + y)2

See also

ABS_CONV, RAND_CONV, SUB_CONV.

 read

read : (string -> string)

Synopsis

Reads a character from a file.

Description

When applied to a string describing a port (a port is the standard ML file descriptor, normally obtained from a call to openi), the function read reads in a character from that port, and advances the internal state so that a subsequent call to read will return the next character. When the end of the file is reached, the multi-character string ‘nil‘ will be returned.

Failure

May fail or hang in system-dependent ways when given an invalid port descriptor.

Example

The following assumes that HOL is being run under Unix. It will overwrite an existing file test-file in the current directory. Notice that the actual string returned by openi may vary on other systems.

   #system `echo "Hi" >test-file`;;
   0 : int
   #let port = openi `test-file`;;
   port = `%test-file` : string
   #read port, read port, read port, read port, read port;;
   (`H`, `i`, `
   `, `nil`, `nil`)
   : (string # string # string # string # string)
   #close port;;
   () : void

See also

append_openw, close, openi, openw, tty_read, tty_write, write.

 RecordStep

RecordStep : step -> void

Synopsis

Record a single inference step.

Description

A proof is a list of inference steps. After the proof recorder is enabled, every inference performed by the system is recorded and cumulated in an internal buffer. When a proof is completed, the raw records can then be processed and output to a disk file.

record_proof is a system function for recording a single proof step. The type step represents a basic inference step. It contains all the necessary information of each inference. There are currently 52 basic inferences which are being recorded. All other ML functions representing inference rules are implemented by these basic inferences. If the proof recorder is enabled when an inference is performed, RecordStep will add a step into the internal buffer.

Failure

Never fail.

Comments

This is a system function implementing the proof recorded. Users should not use this function directly. User functions are provided in the library record_proof. When new basic inference rule is implemented, this function should be called to record the inference step.

See also

record_proof, is_recording_proof, get_steps, suspend_recording,
resume_recording.

 record_proof

record_proof : bool -> void

Synopsis

Enable/disable proof recording.

Description

A proof is a list of inference steps. After the proof recorder is enabled, every inference performed by the system is recorded and cumulated in an internal buffer. When a proof is completed, the raw records can then be processed and output to a disk file.

record_proof is a low level user function for managing the proof recorder. It takes a single boolean as its argument. If this is true, it initialises and enables the proof recorder. If it is false, it disables the proof recorder without clearing the proof recorded since the last time this function is called with the value true.

The current state of the proof recorder can interrogated using the function is_recording_proof. The recorder can be temporarily disabled and later re-enabled without clearing the internal buffer.

Failure

Never fail.

Example

Below is an example showing how to record an extremely simple proof:

#let th = SPEC_ALL ADD_SYM;;
Theorem ADD_SYM autoloading from theory `arithmetic` ...
ADD_SYM = |- !m n. m + n = n + m
th = |- m + n = n + m
#let v = genvar ":num";;
"GEN%VAR%536" : term
#record_proof true;;
() : void
#let th1 = (REFL "SUC(m + n)");;
th1 = |- SUC(m + n) = SUC(m + n)
#let th2 = SUBST [th,v] "SUC(m + n) = SUC ^v" th1;;
th2 = |- SUC(m + n) = SUC(n + m)
#record_proof false;;
() : void
#write_proof_to `ap_term.prf` `ap_term` [] (get_steps());;
() : void

The proof consists of two inference steps: the application of the two primitive inference rules REFL and SUBST. The function write_proof_to outputs the proof into a file names

ap_term.prf.

Comments

This function is used to implement higher level user functions for recording proof in the library record_proof. It is much more convenient to use those functions than the low level functions such as record_proof directly.

See also

is_recording_proof, RecordStep, get_steps, suspend_recording, resume_recording,
current_proof, current_proof_file, new_proof_file, close_proof_file,
begin_proof, end_proof, TAC_PROOF, PROVE, prove, prove_thm.

 REDEPTH_CONV

REDEPTH_CONV : (conv -> conv)

Synopsis

Applies a conversion bottom-up to all subterms, retraversing changed ones.

Description

REDEPTH_CONV c tm applies the conversion c repeatedly to all subterms of the term tm and recursively applies REDEPTH_CONV c to each subterm at which c succeeds, until there is no subterm remaining for which application of c succeeds.

More precisely, REDEPTH_CONV c tm repeatedly applies the conversion c to all the subterms of the term tm, including the term tm itself. The supplied conversion c is applied to the subterms of tm in bottom-up order and is applied repeatedly (zero or more times, as is done by REPEATC) to each subterm until it fails. If c is successfully applied at least once to a subterm, t say, then the term into which t is transformed is retraversed by applying

REDEPTH_CONV c to it.

Failure

REDEPTH_CONV c tm never fails but can diverge if the conversion c can be applied repeatedly to some subterm of tm without failing.

Example

The following example shows how REDEPTH_CONV retraverses subterms:

   #REDEPTH_CONV BETA_CONV "(\f x. (f x) + 1) (\y.y) 2";;
   |- (\f x. (f x) + 1)(\y. y)2 = 2 + 1

Here, BETA_CONV is first applied successfully to the (beta-redex) subterm:

   "(\f x. (f x) + 1) (\y.y)"

This application reduces this subterm to:

   "(\x. ((\y.y) x) + 1)"

REDEPTH_CONV BETA_CONV is then recursively applied to this transformed subterm, eventually reducing it to "(\x. x + 1)". Finally, a beta-reduction of the top-level term, now the simplified beta-redex "(\x. x + 1) 2", produces "2 + 1".

Comments

The implementation of this function uses failure to avoid rebuilding unchanged subterms. That is to say, during execution the failure string `QCONV` may be generated and later trapped. The behaviour of the function is dependent on this use of failure. So, if the conversion given as argument happens to generate a failure with string `QCONV`, the operation of REDEPTH_CONV will be unpredictable.

See also

DEPTH_CONV, ONCE_DEPTH_CONV, TOP_DEPTH_CONV.

 REFL

REFL : conv

Synopsis

Returns theorem expressing reflexivity of equality.

Description

REFL maps any term "t" to the corresponding theorem |- t = t.

Failure

Never fails.

See also

ALL_CONV, REFL_TAC.

 REFL_TAC

REFL_TAC : tactic

Synopsis

Solves a goal which is an equation between alpha-equivalent terms.

Description

When applied to a goal A ?- t = t', where t and t' are alpha-equivalent, REFL_TAC completely solves it.

    A ?- t = t'
   =============  REFL_TAC

Failure

Fails unless the goal is an equation between alpha-equivalent terms.

\underline{remove 467}

See also

ACCEPT_TAC, MATCH_ACCEPT_TAC, REWRITE_TAC.

 remove

remove : ((* -> bool) -> * list -> (* # * list))

Synopsis

Separates the first element of a list to satisfy a predicate from the rest of the list.

Failure

Fails with hd if no element satisfes the predicate. This will always be the case for an empty list.

Example

#remove (\x. x = 3) [1;2;3;4;5;6];;
(3, [1; 2; 4; 5; 6]) : (int # int list)

See also

partition, filter.

 remove_sticky_type

remove_sticky_type : (string -> type)

Synopsis

Removes a sticky type from a given variable.

Description

A call remove_sticky_type name will remove any sticky type from name, whether this was inferred automatically as a result of the setting of the sticky flag, or given explicitly by the set_sticky_type function. It returns the sticky type which was associated with that name. For more details of the sticky type mechanism, refer to the DESCRIPTION.

Failure

Fails if the name was not associated with a sticky type.

See also

set_sticky_type, sticky_list.

 REPEAT

REPEAT : (tactic -> tactic)

Synopsis

Repeatedly applies a tactic until it fails.

Description

The tactic REPEAT T is a tactic which applies T to a goal, and while it succeeds, continues applying it to all subgoals generated.

Failure

The application of REPEAT to a tactic never fails, and neither does the composite tactic, even if the basic tactic fails immediately.

See also

EVERY, FIRST, ORELSE, THEN, THENL.

 REPEATC

REPEATC : (conv -> conv)

Synopsis

Repeatedly apply a conversion (zero or more times) until it fails.

Description

If c is a conversion effects a transformation of a term t to a term t', that is if c maps t to the theorem |- t = t`, then REPEATC c is the conversion that repeats this transformation as often as possible. More exactly, if c maps the term "ti" to |- ti=t(i+1) for i from 1 to n, but fails when applied to the n+1th term "t(n+1)", then REPEATC c "t1" returns

|- t1 = t(n+1). And if c "t" fails, them REPEATC c "t" returns |- t = t.

Failure

Never fails, but can diverge if the supplied conversion never fails.

 REPEAT_GTCL

REPEAT_GTCL : (thm_tactical -> thm_tactical)

Synopsis

Applies a theorem-tactical until it fails when applied to a goal.

Description

When applied to a theorem-tactical, a theorem-tactic, a theorem and a goal:

   REPEAT_GTCL ttl ttac th goal

REPEAT_GTCL repeatedly modifies the theorem according to ttl till the result of handing it to ttac and applying it to the goal fails (this may be no times at all).

Failure

Fails iff the theorem-tactic fails immediately when applied to the theorem and the goal.

Example

The following tactic matches th’s antecedents against the assumptions of the goal until it can do so no longer, then puts the resolvents onto the assumption list:

   REPEAT_GTCL (IMP_RES_THEN ASSUME_TAC) th

See also

REPEAT_TCL, THEN_TCL.

 REPEAT_TCL

REPEAT_TCL : (thm_tactical -> thm_tactical)

Synopsis

Repeatedly applies a theorem-tactical until it fails when applied to the theorem.

Description

When applied to a theorem-tactical, a theorem-tactic and a theorem:

   REPEAT_TCL ttl ttac th

REPEAT_TCL repeatedly modifies the theorem according to ttl until it fails when given to the theorem-tactic ttac.

Failure

Fails iff the theorem-tactic fails immediately when applied to the theorem.

Example

It is often desirable to repeat the action of basic theorem-tactics. For example CHOOSE_THEN strips off a single existential quantification, so one might use REPEAT_TCL CHOOSE_THEN to get rid of them all.

Alternatively, one might want to repeatedly break apart a theorem which is a nested conjunction and apply the same theorem-tactic to each conjunct. For example the following goal:

   ?- ((0 = w) /\ (0 = x)) /\ (0 = y) /\ (0 = z) ==> (w + x + y + z = 0)

might be solved by

   DISCH_THEN (REPEAT_TCL CONJUNCTS_THEN (SUBST1_TAC o SYM)) THEN
   REWRITE_TAC[ADD_CLAUSES]

See also

REPEAT_GTCL, THEN_TCL.

 replicate

replicate : (* -> int -> * list)

Synopsis

Makes a list consisting of a value replicated a specified number of times.

Description

replicate x n returns [x;...;x], a list of length n.

Failure

Fails if number of replications is less than zero.

 rep_goals

rep_goals : (goalstack -> subgoals list)

Synopsis

This function is for internal use only and is to be deleted from a future version of the system. It should not be used.

 resume_recording

resume_recording : void -> void

Synopsis

Suspend proof recording temporarily.

Description

A proof is a list of inference steps. After the proof recorder is enabled, every inference performed by the system is recorded and cumulated in an internal buffer. When a proof is completed, the raw records can then be processed and output to a disk file.

resume_recording is a low level user function for managing the proof recorder. It resumes the proof recorder without clearing the internal inference step buffer. The proof recorder should be in the suspended state. Otherwise, this function does nothing.

The current state of the proof recorder can interrogated using the function is_recording_proof. A value of false indicates the proof recorder is disabled.

Failure

Never fail.

Comments

This function is used to implement higher level user functions for recording proof in the library record_proof. It is much more convenient to use those functions than the low level functions such as resume_recording directly.

See also

record_proof, is_recording_proof, RecordStep, get_steps, suspend_recording,
current_proof, current_proof_file, new_proof_file, close_proof_file,
begin_proof, end_proof, TAC_PROOF, PROVE, prove, prove_thm.

 RES_CANON

RES_CANON : (thm -> thm list)

Synopsis

Put an implication into canonical form for resolution.

Description

All the HOL resolution tactics (e.g. IMP_RES_TAC) work by using modus ponens to draw consequences from an implicative theorem and the assumptions of the goal. Some of these tactics derive this implication from a theorem supplied explicitly the user (or otherwise from ‘outside’ the goal) and some obtain it from the assumptions of the goal itself. But in either case, the supplied theorem or assumption is first transformed into a list of implications in ‘canonical’ form by the function RES_CANON.

The theorem argument to RES_CANON should be either be an implication (which can be universally quantified) or a theorem from which an implication can be derived using the transformation rules discussed below. Given such a theorem, RES_CANON returns a list of implications in canonical form. It is the implications in this resulting list that are used by the various resolution tactics to infer consequences from the assumptions of a goal.

The transformations done by RES_CANON th to the theorem th are as follows. First, if th is a negation A |- ~t, this is converted to the implication A |- t ==> F. The following inference rules are then applied repeatedly, until no further rule applies. Conjunctions are split into their components and equivalence (boolean equality) is split into implication in both directions:

   A |- t1 /\ t2                         A |- t1 = t2
--------------------           ----------------------------------
 A |- t1    A |- t2             A |- t1 ==> t2    A |- t2 ==> t1

Conjunctive antecedents are transformed by:

             A |- (t1 /\ t2) ==> t
---------------------------------------------------
 A |- t1 ==> (t2 ==> t)     A |- t2 ==> (t1 ==> t)

and disjunctive antecedents by:

     A |- (t1 \/ t2) ==> t
--------------------------------
 A |- t1 ==> t    A |- t2 ==> t

The scope of universal quantifiers is restricted, if possible:

 A |- !x. t1 ==> t2
--------------------         [if x is not free in t1]
 A |- t1 ==> !x. t2

and existentially-quantified antecedents are eliminated by:

   A |- (?x. t1) ==> t2
---------------------------  [x' chosen so as not to be free in t2]
 A |- !x'. t1[x'/x] ==> t2

Finally, when no further applications of the above rules are possible, and the theorem is an implication:

A |- !x1...xn. t1 ==> t2

then the theorem A u {t1} |- t2 is transformed by a recursive application of RES_CANON to get a list of theorems:

[A u {t1} |- t21 ; ... ; A u {t1} |- t2n]

and the result of discharging t1 from these theorems:

[A |- !x1...xn. t1 ==> t21 ; ... ; A |- !x1...xn. t1 ==> t2n]

is returned. That is, the transformation rules are recursively applied to the conclusions of all implications.

Failure

RES_CANON th fails if no implication(s) can be derived from th using the transformation rules shown above.

Example

The uniqueness of the remainder k MOD n is expressed in HOL by the built-in theorem

MOD_UNIQUE:
   |- !n k r. (?q. (k = (q * n) + r) /\ r < n) ==> (k MOD n = r)

For this theorem, the canonical list of implications returned by RES_CANON is as follows:

   #RES_CANON MOD_UNIQUE;;
   [|- !k q n r. (k = (q * n) + r) ==> r < n ==> (k MOD n = r);
    |- !r n. r < n ==> (!k q. (k = (q * n) + r) ==> (k MOD n = r))]
   : thm list

The existentially-quantified, conjunctive, antecedent has given rise to two implications, and the scope of universal quantifiers has been restricted to the conclusions of the resulting implications wherever possible.

Uses

The primary use of RES_CANON is for the (internal) pre-processing phase of the built-in

resolution tactics IMP_RES_TAC, IMP_RES_THEN, RES_TAC, and RES_THEN. But the function

RES_CANON is also made available at top-level so that users can call it to see the actual form of the implications used for resolution in any particular case.

See also

IMP_RES_TAC, IMP_RES_THEN, RES_TAC, RES_THEN.

 RES_TAC

RES_TAC : tactic

Synopsis

Enriches assumptions by repeatedly resolving them against each other.

Description

RES_TAC searches for pairs of assumed assumptions of a goal (that is, for a candidate implication and a candidate antecedent, respectively) which can be ‘resolved’ to yield

\underline{RES THEN 475}

new results. The conclusions of all the new results are returned as additional assumptions of the subgoal(s). The effect of RES_TAC on a goal is to enrich the assumptions set with some of its collective consequences.

When applied to a goal A ?- g, the tactic RES_TAC uses RES_CANON to obtain a set of implicative theorems in canonical form from the assumptions A of the goal. Each of the resulting theorems (if there are any) will have the form:

   A |- u1 ==> u2 ==> ... ==> un ==> v

RES_TAC then tries to repeatedly ‘resolve’ these theorems against the assumptions of a goal by attempting to match the antecedents u1, u2, ..., un (in that order) to some assumption of the goal (i.e. to some candidate antecedents among the assumptions). If all the antecedents can be matched to assumptions of the goal, then an instance of the theorem

   A u {a1,...,an} |- v

called a ‘final resolvent’ is obtained by repeated specialization of the variables in the implicative theorem, type instantiation, and applications of modus ponens. If only the first i antecedents u1, ..., ui can be matched to assumptions and then no further matching is possible, then the final resolvent is an instance of the theorem:

   A u {a1,...,ai} |- u(i+1) ==> ... ==> v

All the final resolvents obtained in this way (there may be several, since an antecedent ui may match several assumptions) are added to the assumptions of the goal, in the stripped form produced by using STRIP_ASSUME_TAC. If the conclusion of any final resolvent is a contradiction ‘F’ or is alpha-equivalent to the conclusion of the goal, then RES_TAC solves the goal.

Failure

RES_TAC cannot fail and so should not be unconditionally REPEATed. However, since the final resolvents added to the original assumptions are never used as ‘candidate antecedents’ it is sometimes necessary to apply RES_TAC more than once to derive the desired result.

See also

IMP_RES_TAC, IMP_RES_THEN, RES_CANON, RES_THEN.

 RES_THEN

RES_THEN : (thm_tactic -> tactic)

Synopsis

Resolves all implicative assumptions against the rest.

Description

Like the basic resolution function IMP_RES_THEN, the resolution tactic RES_THEN performs a single-step resolution of an implication and the assumptions of a goal. RES_THEN differs from IMP_RES_THEN only in that the implications used for resolution are taken from the assumptions of the goal itself, rather than supplied as an argument.

When applied to a goal A ?- g, the tactic RES_THEN ttac uses RES_CANON to obtain a set of implicative theorems in canonical form from the assumptions A of the goal. Each of the resulting theorems (if there are any) will have the form:

   ai |- !x1...xn. ui ==> vi

where ai is one of the assumptions of the goal. Having obtained these implications, RES_THEN then attempts to match each antecedent ui to each assumption aj |- aj in the assumptions A. If the antecedent ui of any implication matches the conclusion aj of any assumption, then an instance of the theorem ai, aj |- vi, called a ‘resolvent’, is obtained by specialization of the variables x1, ..., xn and type instantiation, followed by an application of modus ponens. There may be more than one canonical implication derivable from the assumptions of the goal and each such implication is tried against every assumption, so there may be several resolvents (or, indeed, none).

Tactics are produced using the theorem-tactic ttac from all these resolvents (failures of ttac at this stage are filtered out) and these tactics are then applied in an unspecified sequence to the goal. That is,

   RES_THEN ttac (A ?- g)

has the effect of:

   MAP_EVERY (mapfilter ttac [... ; (ai,aj |- vi) ; ...]) (A ?- g)

where the theorems ai,aj |- vi are all the consequences that can be drawn by a (single) matching modus-ponens inference from the assumptions A and the implications derived using RES_CANON from the assumptions. The sequence in which the theorems ai,aj |- vi are generated and the corresponding tactics applied is unspecified.

Failure

Evaluating RES_THEN ttac th fails with ‘no implication’ if no implication(s) can be derived from the assumptions of the goal by the transformation process described under

the entry for RES_CANON. Evaluating RES_THEN ttac (A ?- g) fails with ‘no resolvents’

if no assumption of the goal A ?- g can be resolved with the derived implication or implications. Evaluation also fails, with ‘no tactics’, if there are resolvents, but for every \underline{rev 477}

resolvent ai,aj |- vi evaluating the application ttac (ai,aj |- vi) fails—that is, if for every resolvent ttac fails to produce a tactic. Finally, failure is propagated if any of the tactics that are produced from the resolvents by ttac fails when applied in sequence to the goal.

See also

IMP_RES_TAC, IMP_RES_THEN, MATCH_MP, RES_CANON, RES_TAC.

 rev

rev : (* list -> * list)

Synopsis

Reverses a list.

Description

rev [x1;...;xn] returns [xn;...;x1].

Failure

Never fails.

 REVERSE_CONV

REVERSE_CONV : conv

Synopsis

Computes by inference the result of reversing a list.

Description

REVERSE_CONV a term tm in the following form:

   REVERSE [x0;...xn]

It returns the theorem

   |- REVERSE [x0;...xn] = [xn;...x0]

where the right-hand side is the list in the reverse order.

Failure

REVERSE_CONV tm fails if tm is not of the form described above.

Example

Evaluating

   REVERSE_CONV "REVERSE [0;1;2;3;4]";;

returns the following theorem:

   |- REVERSE [0;1;2;3;4] = [4;3;2;1;0]

See also

FOLDL_CONV, FOLDR_CONV, list_FOLD_CONV.

 rev_assoc

rev_assoc : (* -> (** # *) list -> (** # *))

Synopsis

Searches a list of pairs for a pair whose second component equals a specified value.

Description

rev_assoc y [(x1,y1);...;(xn,yn)] returns the first (xi,yi) in the list such that yi

equals y.

Failure

Fails if no matching pair is found. This will always be the case if the list is empty.

Example

#rev_assoc 2 [(1,4);(3,2);(2,5);(2,6)];;
(3, 2) : (int # int)

See also

assoc, find, mem, tryfind, exists, forall.

 rev_itlist

rev_itlist : ((* -> ** -> **) -> * list -> ** -> **)

Synopsis

Applies a binary function between adjacent elements of the reverse of a list.

Description

rev_itlist f [x1;...;xn] y returns f xn ( ... (f x2 (f x1 y))...). It returns y if

the list is empty.

Failure

Never fails.

Example

#rev_itlist (\x y. x * y) [1;2;3;4] 1;;
24 : int

See also

itlist, end_itlist.

 REWRITE_CONV

REWRITE_CONV : (thm list -> conv)

Synopsis

Rewrites a term including built-in tautologies in the list of rewrites.

Description

Rewriting a term using REWRITE_CONV utilizes as rewrites two sets of theorems: the tautologies in the ML list basic_rewrites and the ones supplied by the user. The rule searches top-down and recursively for subterms which match the left-hand side of any of the possible rewrites, until none of the transformations are applicable. There is no ordering specified among the set of rewrites.

Variants of this conversion allow changes in the set of equations used: PURE_REWRITE_CONV and others in its family do not rewrite with the theorems in basic_rewrites.

The top-down recursive search for matches may not be desirable, as this may increase the number of inferences being made or may result in divergence. In this case other rewriting tools such as ONCE_REWRITE_CONV and GEN_REWRITE_CONV can be used, or the set of theorems given may be reduced.

See GEN_REWRITE_CONV for the general strategy for simplifying theorems in HOL using equational theorems.

Failure

Does not fail, but may diverge if the sequence of rewrites is non-terminating.

Uses

Used to manipulate terms by rewriting them with theorems. While resulting in high degree of automation, REWRITE_CONV can spawn a large number of inference steps. Thus, variants such as PURE_REWRITE_CONV, or other rules such as SUBST_CONV, may be used instead to improve efficiency.

See also

basic_rewrites, GEN_REWRITE_CONV, ONCE_REWRITE_CONV, PURE_REWRITE_CONV,
REWR_CONV, SUBST_CONV.

 REWRITE_RULE

REWRITE_RULE : (thm list -> thm -> thm)

Synopsis

Rewrites a theorem including built-in tautologies in the list of rewrites.

Description

Rewriting a theorem using REWRITE_RULE utilizes as rewrites two sets of theorems: the tautologies in the ML list basic_rewrites and the ones supplied by the user. The rule searches top-down and recursively for subterms which match the left-hand side of any of the possible rewrites, until none of the transformations are applicable. There is no ordering specified among the set of rewrites.

Variants of this rule allow changes in the set of equations used: PURE_REWRITE_RULE and others in its family do not rewrite with the theorems in basic_rewrites. Rules such as ASM_REWRITE_RULE add the assumptions of the object theorem (or a specified subset of these assumptions) to the set of possible rewrites.

The top-down recursive search for matches may not be desirable, as this may increase the number of inferences being made or may result in divergence. In this case other rewriting tools such as ONCE_REWRITE_RULE and GEN_REWRITE_RULE can be used, or the set of theorems given may be reduced.

See GEN_REWRITE_RULE for the general strategy for simplifying theorems in HOL using equational theorems.

Failure

Does not fail, but may diverge if the sequence of rewrites is non-terminating.

Uses

Used to manipulate theorems by rewriting them with other theorems. While resulting in high degree of automation, REWRITE_RULE can spawn a large number of inference steps. Thus, variants such as PURE_REWRITE_RULE, or other rules such as SUBST, may be used instead to improve efficiency.

See also

ASM_REWRITE_RULE, basic_rewrites, GEN_REWRITE_RULE, ONCE_REWRITE_RULE,
PURE_REWRITE_RULE, REWR_CONV, REWRITE_CONV, SUBST.

 REWRITE_TAC

REWRITE_TAC : (thm list -> tactic)

Synopsis

Rewrites a goal including built-in tautologies in the list of rewrites.

Description

Rewriting tactics in HOL provide a recursive left-to-right matching and rewriting facility that automatically decomposes subgoals and justifies segments of proof in which equational theorems are used, singly or collectively. These include the unfolding of definitions, and the substitution of equals for equals. Rewriting is used either to advance or to complete the decomposition of subgoals.

REWRITE_TAC transforms (or solves) a goal by using as rewrite rules (i.e. as left-to-right replacement rules) the conclusions of the given list of (equational) theorems, as well as a set of built-in theorems (common tautologies) held in the ML variable basic_rewrites. Recognition of a tautology often terminates the subgoaling process (i.e. solves the goal).

The equational rewrites generated are applied recursively and to arbitrary depth, with matching and instantiation of variables and type variables. A list of rewrites can set off an infinite rewriting process, and it is not, of course, decidable in general whether a rewrite set has that property. The order in which the rewrite theorems are applied is unspecified, and the user should not depend on any ordering.

See GEN_REWRITE_TAC for more details on the rewriting process. Variants of REWRITE_TAC allow the use of a different set of rewrites. Some of them, such as PURE_REWRITE_TAC, exclude the basic tautologies from the possible transformations. ASM_REWRITE_TAC and others include the assumptions at the goal in the set of possible rewrites.

Still other tactics allow greater control over the search for rewritable subterms. Several of them such as ONCE_REWRITE_TAC do not apply rewrites recursively. GEN_REWRITE_TAC allows a rewrite to be applied at a particular subterm.

Failure

REWRITE_TAC does not fail. Certain sets of rewriting theorems on certain goals may cause a non-terminating sequence of rewrites. Divergent rewriting behaviour results from a term t being immediately or eventually rewritten to a term containing t as a sub-term. The exact behaviour depends on the HOL implementation; it may be possible (unfortunately) to fall into Lisp in this event.

Example

The arithmetic theorem GREATER, |- !m n. m > n = n < m, is used below to advance a goal:

   #REWRITE_TAC[GREATER]([],"5 > 4");;
   ([([], "4 < 5")], -) : subgoals

It is used below with the theorem LESS_0, |- !n. 0 < (SUC n), to solve a goal:

   #let gl,p = REWRITE_TAC[GREATER;LESS_0]([],"(SUC n) > 0");;
   gl = [] : goal list
   p = - : proof
   #p[];;
   |- (SUC n) > 0

Uses

Rewriting is a powerful and general mechanism in HOL, and an important part of many proofs. It relieves the user of the burden of directing and justifying a large number of minor proof steps. REWRITE_TAC fits a forward proof sequence smoothly into the general goal-oriented framework. That is, (within one subgoaling step) it produces and justifies certain forward inferences, none of which are necessarily on a direct path to the desired goal.

REWRITE_TAC may be more powerful a tactic than is needed in certain situations; if efficiency is at stake, alternatives might be considered.

See also

ASM_REWRITE_TAC, GEN_REWRITE_TAC, FILTER_ASM_REWRITE_TAC,
FILTER_ONCE_ASM_REWRITE_TAC, ONCE_ASM_REWRITE_TAC, ONCE_REWRITE_TAC,
PURE_ASM_REWRITE_TAC, PURE_ONCE_ASM_REWRITE_TAC, PURE_ONCE_REWRITE_TAC,
PURE_REWRITE_TAC, REWR_CONV, REWRITE_CONV, SUBST_TAC.

 REWR_CONV

REWR_CONV : (thm -> conv)

Synopsis

Uses an instance of a given equation to rewrite a term.

Description

REWR_CONV is one of the basic building blocks for the implementation of rewriting in the HOL system. In particular, the term replacement or rewriting done by all the built-in rewriting rules and tactics is ultimately done by applications of REWR_CONV to appropriate subterms. The description given here for REWR_CONV may therefore be taken as a specification of the atomic action of replacing equals by equals that is used in all these higher level rewriting tools.

The first argument to REWR_CONV is expected to be an equational theorem which is to be used as a left-to-right rewrite rule. The general form of this theorem is:

   A |- t[x1,...,xn] = u[x1,...,xn]

where x1, ..., xn are all the variables that occur free in the left-hand side of the conclusion of the theorem but do not occur free in the assumptions. Any of these variables may also be universally quantified at the outermost level of the equation, as for example in:

   A |- !x1...xn. t[x1,...,xn] = u[x1,...,xn]

Note that REWR_CONV will also work, but will give a generally undesirable result (see below), if the right-hand side of the equation contains free variables that do not also occur free on the left-hand side, as for example in:

   A |- t[x1,...,xn] = u[x1,...,xn,y1,...,ym]

where the variables y1, ..., ym do not occur free in t[x1,...,xn].

If th is an equational theorem of the kind shown above, then REWR_CONV th returns a conversion that maps terms of the form t[e1,...,en/x1,...,xn], in which the terms e1, ..., en are free for x1, ..., xn in t, to theorems of the form:

   A |- t[e1,...,en/x1,...,xn] = u[e1,...,en/x1,...,xn]

That is, REWR_CONV th tm attempts to match the left-hand side of the rewrite rule th to the term tm. If such a match is possible, then REWR_CONV returns the corresponding substitution instance of th.

If REWR_CONV is given a theorem th:

   A |- t[x1,...,xn] = u[x1,...,xn,y1,...,ym]

where the variables y1, ..., ym do not occur free in the left-hand side, then the result of applying the conversion REWR_CONV th to a term t[e1,...,en/x1,...,xn] will be:

   A |- t[e1,...,en/x1,...,xn] = u[e1,...,en,v1,...,vm/x1,...,xn,y1,...,ym]

where v1, ..., vm are variables chosen so as to be free nowhere in th or in the input term. The user has no control over the choice of the variables v1, ..., vm, and the variables actually chosen may well be inconvenient for other purposes. This situation is, however, relatively rare; in most equations the free variables on the right-hand side are a subset of the free variables on the left-hand side.

In addition to doing substitution for free variables in the supplied equational theorem (or ‘rewrite rule’), REWR_CONV th tm also does type instantiation, if this is necessary in order to match the left-hand side of the given rewrite rule th to the term argument tm. If, for example, th is the theorem:

   A |- t[x1,...,xn] = u[x1,...,xn]

and the input term tm is (a substitution instance of) an instance of t[x1,...,xn] in which the types ty1, ..., tyi are substituted for the type variables vty1, ..., vtyi, that is if:

   tm = t[ty1,...,tyn/vty1,...,vtyn][e1,...,en/x1,...,xn]
then REWR_CONV th tm returns:
   A |- (t = u)[ty1,...,tyn/vty1,...,vtyn][e1,...,en/x1,...,xn]

Note that, in this case, the type variables vty1, ..., vtyi must not occur anywhere in the hypotheses A. Otherwise, the conversion will fail.

Failure

REWR_CONV th fails if th is not an equation or an equation universally quantified at the outermost level. If th is such an equation:

  th = A |- !v1....vi. t[x1,...,xn] = u[x1,...,xn,y1,...,yn]

then REWR_CONV th tm fails unless the term tm is alpha-equivalent to an instance of the left-hand side t[x1,...,xn] which can be obtained by instantiation of free type variables (i.e. type variables not occurring in the assumptions A) and substitution for the free variables x1, ..., xn.

Example

The following example illustrates a straightforward use of REWR_CONV. The supplied rewrite rule is polymorphic, and both substitution for free variables and type instantiation may take place. EQ_SYM_EQ is the theorem:

   |- !x:*. !y. (x = y) = (y = x)

and REWR_CONV EQ_SYM behaves as follows:

   #REWR_CONV EQ_SYM_EQ "1 = 2";;
   |- (1 = 2) = (2 = 1)
   #REWR_CONV EQ_SYM_EQ "1 < 2";;
   evaluation failed     REWR_CONV: lhs of theorem doesn't match term

The second application fails because the left-hand side "x = y" of the rewrite rule does not match the term to be rewritten, namely "1 < 2".

In the following example, one might expect the result to be the theorem A |- f 2 = 2, where A is the assumption of the supplied rewrite rule:

   #REWR_CONV (ASSUME "!x:*. f x = x") "f 2:num";;
   evaluation failed     REWR_CONV: lhs of theorem doesn't match term

The application fails, however, because the type variable * appears in the assumption of the theorem returned by ASSUME "!x:*. f x = x".

Failure will also occur in situations like:

   #REWR_CONV (ASSUME "f (n:num) = n") "f 2:num";;
   evaluation failed     REWR_CONV: lhs of theorem doesn't match term

where the left-hand side of the supplied equation contains a free variable (in this case n) which is also free in the assumptions, but which must be instantiated in order to match the input term.

See also

REWRITE_CONV.

 REW_DEPTH_CONV

REW_DEPTH_CONV : (conv -> conv)

Synopsis

Applies a conversion top-down to all subterms, retraversing changed ones. For use in rewriting.

Description

REW_DEPTH_CONV c tm repeatedly applies the conversion c to all the subterms of the term tm, including the term tm itself. The supplied conversion c is applied to the subterms of tm in top-down order and is applied repeatedly (zero or more times, as is done by REPEATC) at each subterm until it fails. If a subterm t is changed (up to alpha-equivalence) by virtue of the application of c to its own subterms, then the term into which t is transformed is retraversed by applying REW_DEPTH_CONV c to it.

REW_DEPTH_CONV is a special version of TOP_DEPTH_CONV for use by the rewriting conversions, rules and tactics. It differs from TOP_DEPTH_CONV as follows: If converting an abstraction fails due to the presence of the bound variable in the hypotheses of the theorem generated by converting the body, REW_DEPTH_CONV retries the conversion having renamed the bound variable of the abstraction. If successful the renaming is reversed.

Failure

REW_DEPTH_CONV c tm never fails but can diverge.

Example

The following example illustrates the difference between the functions REW_DEPTH_CONV and TOP_DEPTH_CONV. It is not intended to illustrate the full range of behaviour of the former. Both REW_DEPTH_CONV and TOP_DEPTH_CONV successfully apply the theorem ADD_0 inside an abstraction:

   #REW_DEPTH_CONV (REWR_CONV ADD_0) "\n. n + 0";;
   |- (\n. n + 0) = (\n. n)
   #TOP_DEPTH_CONV (REWR_CONV ADD_0) "\n. n + 0";;
   |- (\n. n + 0) = (\n. n)

However, if a hypothesis containing a free occurrence of the bound variable is added to the rewrite rule, it interferes with the operation of TOP_DEPTH_CONV but not that of

REW_DEPTH_CONV:
   #let th = ADD_ASSUM "n = 0" ADD_0;;
   th = n = 0 |- !m. m + 0 = m
   #REW_DEPTH_CONV (REWR_CONV th) "\n. n + 0";;
   n = 0 |- (\n. n + 0) = (\n. n)
   #TOP_DEPTH_CONV (REWR_CONV th) "\n. n + 0";;
   |- (\n. n + 0) = (\n. n + 0)

Comments

The implementation of this function uses failure to avoid rebuilding unchanged subterms. That is to say, during execution the failure string `QCONV` may be generated and later \underline{rhs 487}

trapped. The behaviour of the function is dependent on this use of failure. So, if the conversion given as argument happens to generate a failure with string `QCONV`, the operation of REW_DEPTH_CONV will be unpredictable.

See also

ONCE_REW_DEPTH_CONV, TOP_DEPTH_CONV.

 rhs

rhs : (term -> term)

Synopsis

Returns the right-hand side of an equation.

Description

rhs "t1 = t2" returns "t2".

Failure

Fails with rhs if term is not an equality.

See also

lhs, dest_eq.

 RIGHT_AND_EXISTS_CONV

RIGHT_AND_EXISTS_CONV : conv

Synopsis

Moves an existential quantification of the right conjunct outwards through a conjunction.

Description

When applied to a term of the form P /\ (?x.Q), the conversion RIGHT_AND_EXISTS_CONV returns the theorem:

   |- P /\ (?x.Q) = (?x'. P /\ (Q[x'/x]))

where x' is a primed variant of x that does not appear free in the input term.

488 Chapter 1. Pre-defined ML Identifiers

Failure

Fails if applied to a term not of the form P /\ (?x.Q).

See also

AND_EXISTS_CONV, EXISTS_AND_CONV, LEFT_AND_EXISTS_CONV.
 RIGHT_AND_FORALL_CONV
RIGHT_AND_FORALL_CONV : conv

Synopsis

Moves a universal quantification of the right conjunct outwards through a conjunction.

Description

When applied to a term of the form P /\ (!x.Q), the conversion RIGHT_AND_FORALL_CONV returns the theorem:

   |- P /\ (!x.Q) = (!x'. P /\ (Q[x'/x]))

where x' is a primed variant of x that does not appear free in the input term.

Failure

Fails if applied to a term not of the form P /\ (!x.Q).

See also

AND_FORALL_CONV, FORALL_AND_CONV, LEFT_AND_FORALL_CONV.
 RIGHT_BETA
RIGHT_BETA : (thm -> thm)

Synopsis

Beta-reduces a top-level beta-redex on the right-hand side of an equation.

Description

When applied to an equational theorem, RIGHT_BETA applies beta-reduction at top level to the right-hand side (only). Variables are renamed if necessary to avoid free variable capture.

    A |- s = (\x. t1) t2
   ----------------------  RIGHT_BETA
     A |- s = t1[t2/x]

Failure

Fails unless the theorem is equational, with its right-hand side being a top-level betaredex.

See also

BETA_CONV, BETA_RULE, BETA_TAC, RIGHT_LIST_BETA.

 RIGHT_CONV_RULE

RIGHT_CONV_RULE : (conv -> thm -> thm)

Synopsis

Applies a conversion to the right-hand side of an equational theorem.

Description

If c is a conversion that maps a term "t2" to the theorem |- t2 = t2', then the rule

RIGHT_CONV_RULE c infers |- t1 = t2' from the theorem |- t1 = t2. That is, if c "t2"

returns A' |- t2 = t2', then:

       A |- t1 = t2
   ---------------------  RIGHT_CONV_RULE c
    A u A' |- t1 = t2'

Note that if the conversion c returns a theorem with assumptions, then the resulting inference rule adds these to the assumptions of the theorem it returns.

Failure

RIGHT_CONV_RULE c th fails if the conclusion of the theorem th is not an equation, or if th is an equation but c fails when applied its right-hand side. The function returned by RIGHT_CONV_RULE c will also fail if the ML function c:term->thm is not, in fact, a conversion (i.e. a function that maps a term t to a theorem |- t = t').

See also

CONV_RULE.

 RIGHT_IMP_EXISTS_CONV

RIGHT_IMP_EXISTS_CONV : conv

Synopsis

Moves an existential quantification of the consequent outwards through an implication.

Description

When applied to a term of the form P ==> (?x.Q), the conversion RIGHT_IMP_EXISTS_CONV returns the theorem:

   |- P ==> (?x.Q) = (?x'. P ==> (Q[x'/x]))

where x' is a primed variant of x that does not appear free in the input term.

Failure

Fails if applied to a term not of the form P ==> (?x.Q).

See also

EXISTS_IMP_CONV, LEFT_IMP_FORALL_CONV.

 RIGHT_IMP_FORALL_CONV

RIGHT_IMP_FORALL_CONV : conv

Synopsis

Moves a universal quantification of the consequent outwards through an implication.

Description

When applied to a term of the form P ==> (!x.Q), the conversion RIGHT_IMP_FORALL_CONV returns the theorem:

   |- P ==> (!x.Q) = (!x'. P ==> (Q[x'/x]))

where x' is a primed variant of x that does not appear free in the input term.

Failure

Fails if applied to a term not of the form P ==> (!x.Q).

See also

FORALL_IMP_CONV, LEFT_IMP_EXISTS_CONV.

 RIGHT_LIST_BETA

RIGHT_LIST_BETA : (thm -> thm)

Synopsis

Iteratively beta-reduces a top-level beta-redex on the right-hand side of an equation.

Description

When applied to an equational theorem, RIGHT_LIST_BETA applies beta-reduction over a top-level chain of beta-redexes to the right hand side (only). Variables are renamed if necessary to avoid free variable capture.

    A |- s = (\x1...xn. t) t1 ... tn
   ----------------------------------  RIGHT_LIST_BETA
       A |- s = t[t1/x1]...[tn/xn]

Failure

Fails unless the theorem is equational, with its right-hand side being a top-level betaredex.

See also

BETA_CONV, BETA_RULE, BETA_TAC, LIST_BETA_CONV, RIGHT_BETA.

 RIGHT_OR_EXISTS_CONV

RIGHT_OR_EXISTS_CONV : conv

Synopsis

Moves an existential quantification of the right disjunct outwards through a disjunction.

Description

When applied to a term of the form P \/ (?x.Q), the conversion RIGHT_OR_EXISTS_CONV returns the theorem:

   |- P \/ (?x.Q) = (?x'. P \/ (Q[x'/x]))

where x' is a primed variant of x that does not appear free in the input term.

Failure

Fails if applied to a term not of the form P \/ (?x.Q).

See also

OR_EXISTS_CONV, EXISTS_OR_CONV, LEFT_OR_EXISTS_CONV.

 RIGHT_OR_FORALL_CONV

RIGHT_OR_FORALL_CONV : conv

Synopsis

Moves a universal quantification of the right disjunct outwards through a disjunction.

Description

When applied to a term of the form P \/ (!x.Q), the conversion RIGHT_OR_FORALL_CONV returns the theorem:

   |- P \/ (!x.Q) = (!x'. P \/ (Q[x'/x]))

where x' is a primed variant of x that does not appear free in the input term.

Failure

Fails if applied to a term not of the form P \/ (!x.Q).

See also

OR_FORALL_CONV, FORALL_OR_CONV, LEFT_OR_FORALL_CONV.

 root_goal

root_goal : tactic

\underline{rotate 493}

Synopsis

This function is for internal use only and is to be deleted from a future version of the system. It should not be used.

 rotate

rotate : (int -> void)

Synopsis

Reorders the subgoals on top of the subgoal package goal stack.

Description

The function rotate is part of the subgoal package. Calling rotate n forms a new proof state. It rotates, by n steps, the subgoals in the top level of the goal stack of the current proof state (i.e., those resulting from the application of the most recent tactic). Goals are rotated upwards on the stack, with the top goals being moved to the bottom of the level. If n is greater than the number of goals on the level, the rotation is performed modulo the number of subgoals. The previous proof state is stored on the backup list, so may be restored by a call to backup. The subgoals of the level are printed from the bottom of the stack. The function rotate is abbreviated by the function r. For a description of the subgoal package, see set_goal.

Failure

rotate will fail if no goal has been set or if the last goal set has been completely proved. It will diverge if given a negative argument.

494 Chapter 1. Pre-defined ML Identifiers

Example

#rotate 1;;
evaluation failed     rotate_goals
#g "(HD[1;2;3] = 1) /\ (TL[1;2;3] = [2;3]) /\ (HD (TL[1;2;3]) = 2)";;
"(HD[1;2;3] = 1) /\ (TL[1;2;3] = [2;3]) /\ (HD(TL[1;2;3]) = 2)"
() : void
#e (REPEAT CONJ_TAC);;
OK..
3 subgoals
"HD(TL[1;2;3]) = 2"
"TL[1;2;3] = [2;3]"
"HD[1;2;3] = 1"
() : void
#rotate 1;;
3 subgoals
"HD[1;2;3] = 1"
"HD(TL[1;2;3]) = 2"
"TL[1;2;3] = [2;3]"
() : void

Uses

Proving subgoals in a different order to that generated by the subgoal package. The subgoals of a goal may be considered in any order. However, subgoals deeper in the stack cannot be worked on, nor can subgoals higher in the proof tree.

See also

b, backup, backup_limit, e, expand, expandf, g, get_state, p, print_state, r,
save_top_thm, set_goal, set_state, top_goal, top_thm.
 rotate_goals
rotate_goals : (subgoals -> subgoals)

Synopsis

This function is for internal use only and is to be deleted from a future version of the system. It should not be used.

 rotate_top

rotate_top : (int -> subgoals list -> subgoals list)

Synopsis

This function is for internal use only and is to be deleted from a future version of the system. It should not be used.

 RULE_ASSUM_TAC

RULE_ASSUM_TAC : ((thm -> thm) -> tactic)

Synopsis

Maps an inference rule over the assumptions of a goal.

Description

When applied to an inference rule f and a goal ({A1;...;An} ?- t), the RULE_ASSUM_TAC tactical applies the inference rule to each of the ASSUMEd assumptions to give a new goal.

             {A1,...,An} ?- t
   ====================================  RULE_ASSUM_TAC f
    {f(A1 |- A1),...,f(An |- An)} ?- t

Failure

The application of RULE_ASSUM_TAC f to a goal fails iff f fails when applied to any of the assumptions of the goal.

Comments

It does not matter if the goal has no assumptions, but in this case RULE_ASSUM_TAC has no effect.

See also

ASSUM_LIST, MAP_EVERY, MAP_FIRST, POP_ASSUM_LIST.

 S

S : ((* -> ** -> ***) -> (* -> **) -> * -> ***)

Synopsis

Performs function composition: S f g x = f x (g x) (the S combinator).

Failure

Never fails.

See also

#, B, C, CB, Co, I, K, KI, o, oo, W.

 save

save : (string -> void)

Synopsis

Saves an executable version of HOL in its current state.

Description

The call save `image` will save an executable core image, called image, of HOL in its current state. This means that if this image is subsequently executed instead of the normal HOL, any bindings set up will be preserved.

Failure

Will fail only in system-dependent ways, such as running out of disk space.

Comments

Note that a HOL image is rather large; exactly how large depends on the version of Lisp and other factors, but it is usually a good many megabytes.

Uses

Avoiding the need to re-execute certain initializations, in particular, installation, every time HOL is run. Note that a hol-init.ml file will be executed automatically every time \underline{save thm 497}

HOL is run, and is usually sufficient for private initializations. See the DESCRIPTION for details.

See also

install.

 save_thm

save_thm : ((string # thm) -> thm)

Synopsis

Stores a theorem in the current theory segment.

Description

The call save_thm(`name`, th) adds the theorem th to the current theory segment under the name name. The theorem is returned as a value. The call can be made in both proof and draft mode. The name name must be a distinct name within the theory segment, but may be the same as for items within other theory segments of the theory. If the current theory segment is named thy, the theorem will be written to the file thy.th in the directory from which HOL was called. If the system is in draft mode, other changes made to the current theory segment during the session will also be written to the theory file. If the theory file does not exist, it will be created.

Failure

A call to save_thm will fail if the name given is the same as the name of an existing fact in the current theory segment. Saving the theorem involves writing to the file system. If the write fails for any reason save_thm will fail. For example, on start up the initial theory is HOL. The associated theory files are read-only so an attempt to save a theorem in that theory segment will fail.

Uses

Adding theorems to the current theory. Saving theorems for retrieval in later sessions. The theorem may be retrieved using the function theorem. Binding the result of save_thm to an ML variable makes it easy to access the theorem in the current terminal session.

See also

new_theory, prove_thm, save_top_thm, theorem.

 save_top_thm

save_top_thm : (string -> thm)

Synopsis

Stores the theorem just proved with the subgoal package in the current theory segment.

Description

The function save_top_thm is part of the subgoal package. A proof state of the package consists of either goal and justification stacks if a proof is in progress or a theorem if a proof has just been completed. If the proof state consists of a theorem, the call save_top_thm `name` adds that theorem to the current theory segment under the name name. The theorem is returned as a value. The name name must be a distinct name within the theory segment, but may be the same as for items within other theory segments of the theory. If the current theory segment is named thy, the theorem will be written to the file thy.th in the directory from which HOL was called. If the system is in draft mode, other changes made to the current theory segment during the session will also be written to the theory file. If the theory file does not exist, it will be created. The call can be made in both proof and draft mode. For a description of the subgoal package, see set_goal.

Failure

A call to save_top_thm will fail if the proof state does not hold a theorem. This will be so either because no goal has been set or because a proof is in progress with unproven subgoals. It will fail if the name given is the same as the name of an existing fact in the current theory segment. Storing the theorem involves writing to the file system. If the write fails for any reason save_top_thm will fail. For example, on start up the initial theory is HOL. The associated theory files are read-only so an attempt to store a theorem in that theory segment will fail.

Uses

Adding theorems to the current theory. Saving theorems for retrieval in later sessions. The theorem may be retrieved using the function theorem. Binding the result of save_top_thm to an ML variable makes it easy to access the theorem in the current terminal session.

See also

get_state, new_theory, print_state, prove_thm, save_thm, set_goal, set_state,
theorem, top_thm.

 SCANL_CONV
SCANL_CONV : conv -> conv

Synopsis

Computes by inference the result of applying a function to elements of a list.

Description

SCANL_CONV takes a conversion conv and a term tm in the following form:

   SCANL f e0 [x1;...xn]

It returns the theorem

   |- SCANL f e0 [x1;...xn] = [e0; e1; ...;en]

where ei is the result of applying the function f to the result of the previous iteration and the current element, i.e., ei = f e(i-1) xi. The iteration starts from the left-hand side (the head) of the list. The user supplied conversion conv is used to derive a theorem

   |- f e(i-1) xi = ei

which is used in the next iteration.

Failure

SCANL_CONV conv tm fails if tm is not of the form described above, or failure occurs when

evaluating conv "f e(i-1) xi".

Example

To sum the elements of a list and save the result at each step, one can evaluate

   SCANL_CONV ADD_CONV "SCANL $+ 0 [1;2;3]";;

which returns the following theorem:

   |- SCANL $+ 0[1;2;3] = [0;1;3;6]

In general, if the function f is an explicit lambda abstraction (\x x'. t[x,x']), the 500 Chapter 1. Pre-defined ML Identifiers

conversion should be in the form

   ((RATOR_CONV BETA_CONV) THENC BETA_CONV THENC conv'))

where conv' applied to t[x,x'] returns the theorem

   |-t[x,x'] = e''.

See also

SCANR_CONV, FOLDL_CONV, FOLDR_CONV, list_FOLD_CONV.

 SCANR_CONV
SCANR_CONV : conv -> conv

Synopsis

Computes by inference the result of applying a function to elements of a list.

Description

SCANR_CONV takes a conversion conv and a term tm in the following form:

   SCANR f e0 [xn;...;x1]

It returns the theorem

   |- SCANR f e0 [xn;...;x1] = [en; ...;e1;e0]

where ei is the result of applying the function f to the result of the previous iteration and the current element, i.e., ei = f e(i-1) xi. The iteration starts from the right-hand side (the tail) of the list. The user supplied conversion conv is used to derive a theorem

   |- f e(i-1) xi = ei

which is used in the next iteration.

Failure

SCANR_CONV conv tm fails if tm is not of the form described above, or failure occurs when

evaluating conv "f e(i-1) xi".

Example

To sum the elements of a list and save the result at each step, one can evaluate

   SCANR_CONV ADD_CONV "SCANR $+ 0 [1;2;3]";;

which returns the following theorem:

   |- SCANR $+ 0[1;2;3] = [0;1;3;6]

In general, if the function f is an explicit lambda abstraction (\x x'. t[x,x']), the conversion should be in the form

   ((RATOR_CONV BETA_CONV) THENC BETA_CONV THENC conv'))

where conv' applied to t[x,x'] returns the theorem

   |-t[x,x'] = e''.

See also

SCANL_CONV, FOLDL_CONV, FOLDR_CONV, list_FOLD_CONV.

 search_path

search_path : (void -> string list)

Synopsis

Returns the internal search path use by HOL to find files.

Description

Evaluating search_path() returns a list of strings representing the pathnames of the directories that are searched when HOL makes access to files on disk (using load, compile, load_theory, etc.). Although the search path can be set to an arbitrary list of strings, each string in the search path is normally expected to be either empty (``) or a pathname with ‘/’ as its final character. When HOL looks for a file, the directories in the search path are searched in the order in which they occur in the list returned by search_path.

Example

A typical search path is the following:

   #search_path();;
   [``; `~/`; `/usr/lib/hol/theories/`] : string list

With this search path, HOL first looks for a file in the current working directory (the pathname represented by ``), then in the user‘s home directory `~/`, and finally in the directory `/usr/lib/hol/theories/` (the directory containing HOL‘s built-in theories).

See also

help_search_path, install, set_help_search_path, set_search_path.

 SEG_CONV

SEG_CONV : conv

Synopsis

Computes by inference the result of taking a segment of a list.

Description

For any object language list of the form "[x0;...x(n-1)]" , the result of evaluating

   SEG_CONV "SEG m k [x0;...;x(n-1)]"

is the theorem

   |- SEG m k [x0;...;x(n-1)] = [xk;...;x(m+k-1)]

Failure

SEG_CONV tm fails if tm is not in the form described above or the indexes m and k are not in the correct range, i.e., m + k <= n.

Example

Evaluating the expression

   SEG_CONV "SEG 2 3[0;1;2;3;4;5]";;

returns the following theorem

   |- SEG 2 3[0;1;2;3;4;5] = [3;4]

See also

FIRSTN_CONV, LASTN_CONV, BUTFIRSTN_CONV, BUTLASTN_CONV, LAST_CONV,

BUTLAST_CONV.

 SELECT_CONV

SELECT_CONV : conv

Synopsis

Eliminates an epsilon term by introducing an existential quantifier.

Description

The conversion SELECT_CONV expects a boolean term of the form "P[@x.P[x]/x]", which asserts that the epsilon term @x.P[x] denotes a value, x say, for which P[x] holds. This assertion is equivalent to saying that there exists such a value, and SELECT_CONV applied to a term of this form returns the theorem |- P[@x.P[x]/x] = ?x. P[x].

Failure

Fails if applied to a term that is not of the form "P[@x.P[x]/x]".

Example

#SELECT_CONV "(@n. n < m) < m";;
|- (@n. n < m) < m = (?n. n < m)

Uses

Particularly useful in conjunction with CONV_TAC for proving properties of values denoted by epsilon terms. For example, suppose that one wishes to prove the goal

   ["0 < m"], "(@n. n < m) < SUC m"

Using the built-in arithmetic theorem

   LESS_SUC  |- !m n. m < n ==> m < (SUC n)

this goal may be reduced by the tactic MATCH_MP_TAC LESS_SUC to the subgoal

   ["0 < m"], "(@n. n < m) < m"

This is now in the correct form for using CONV_TAC SELECT_CONV to eliminate the epsilon term, resulting in the existentially quantified goal

   ["0 < m"], "?n. n < m"

which is then straightforward to prove.

See also

SELECT_ELIM, SELECT_INTRO, SELECT_RULE.

 SELECT_ELIM

SELECT_ELIM : (thm -> (term # thm) -> thm)

Synopsis

Eliminates an epsilon term, using deduction from a particular instance.

Description

SELECT_ELIM expects two arguments, a theorem th1, and a pair (v,th2):(term # thm). The conclusion of th1 must have the form P($@ P), which asserts that the epsilon term $@ P denotes some value at which P holds. The variable v appears only in the assumption P v of the theorem th2. The conclusion of the resulting theorem matches that of th2, and the hypotheses include the union of all hypotheses of the premises excepting P v.

    A1 |- P($@ P)     A2 u {P v} |- t
   -----------------------------------  SELECT_ELIM th1 (v,th2)
              A1 u A2 |- t

where v is not free in A2. If v appears in the conclusion of th2, the epsilon term will NOT be eliminated, and the conclusion will be t[$@ P/v].

Failure

Fails if the first theorem is not of the form A1 |- P($@ P), or if the variable v occurs free in any other assumption of th2.

Example

If a property of functions is defined by:

   INCR = |- !f. INCR f = (!t1 t2. t1 < t2 ==> (f t1) < (f t2))

The following theorem can be proved.

   th1 = |- INCR(@f. INCR f)

Additionally, if such a function is assumed to exist, then one can prove that there also exists a function which is injective (one-to-one) but not surjective (onto).

   th2 = [ INCR g ] |- ?h. ONE_ONE h /\ ~ONTO h

These two results may be combined using SELECT_ELIM to give a new theorem:

   #SELECT_ELIM th1 ("g:num->num", th2);;
   |- ?h. ONE_ONE h /\ ~ONTO h

Uses

This rule is rarely used. The equivalence of P($@ P) and $? P makes this rule fundamentally similar to the ?-elimination rule CHOOSE.

See also

CHOOSE, SELECT_AX, SELECT_CONV, SELECT_INTRO, SELECT_RULE.

 SELECT_EQ

SELECT_EQ : (term -> thm -> thm)

Synopsis

Applies epsilon abstraction to both terms of an equation.

Description

Effects the extensionality of the epsilon operator @.

       A |- t1 = t2
   ------------------------  SELECT_EQ "x"      [where x is not free in A]
    A |- (@x.t1) = (@x.t2)

Failure

Fails if the conclusion of the theorem is not an equation, or if the variable x is free in A.

Example

Given a theorem which shows the equivalence of two distinct forms of defining the property 506 Chapter 1. Pre-defined ML Identifiers

of being an even number:

   th = |- (x MOD 2 = 0) = (?y. x = 2 * y)

A theorem giving the equivalence of the epsilon abstraction of each form is obtained:

   #SELECT_EQ "x:num" th;;
   |- (@x. x MOD 2 = 0) = (@x. ?y. x = 2 * y)

See also

ABS, AP_TERM, EXISTS_EQ, FORALL_EQ, SELECT_AX, SELECT_CONV, SELECT_ELIM,
SELECT_INTRO.

 SELECT_INTRO
SELECT_INTRO : (thm -> thm)

Synopsis

Introduces an epsilon term.

Description

SELECT_INTRO takes a theorem with an applicative conclusion, say P x, and returns a theorem with the epsilon term $@ P in place of the original operand x.

     A |- P x
   --------------  SELECT_INTRO
    A |- P($@ P)

The returned theorem asserts that $@ P denotes some value at which P holds.

Failure

Fails if the conclusion of the theorem is not an application.

Example

Given the theorem

   th1 = |- (\n. m = n)m

applying SELECT_INTRO replaces the second occurrence of m with the epsilon abstraction of the operator:

   #let th2 = SELECT_INTRO th1;;
   th2 = |- (\n. m = n)(@n. m = n)

This theorem could now be used to derive a further result:

   #EQ_MP(BETA_CONV(concl th2))th2;;
   |- m = (@n. m = n)

See also

EXISTS, SELECT_AX, SELECT_CONV, SELECT_ELIM, SELECT_RULE.

 SELECT_RULE

SELECT_RULE : (thm -> thm)

Synopsis

Introduces an epsilon term in place of an existential quantifier.

Description

The inference rule SELECT_RULE expects a theorem asserting the existence of a value x such that P holds. The equivalent assertion that the epsilon term @x.P denotes a value of x for which P holds is returned as a theorem.

       A |- ?x. P
   ------------------  SELECT_RULE
    A |- P[(@x.P)/x]

Failure

Fails if applied to a theorem the conclusion of which is not existentially quantified.

Example

The axiom INFINITY_AX in the theory ind is of the form:

   |- ?f. ONE_ONE f /\ ~ONTO f

Applying SELECT_RULE to this theorem returns the following.

   #SELECT_RULE INFINITY_AX;;
   |- ONE_ONE(@f. ONE_ONE f /\ ~ONTO f) /\ ~ONTO(@f. ONE_ONE f /\ ~ONTO f)

Uses

May be used to introduce an epsilon term to permit rewriting with a constant defined using the epsilon operator.

See also

CHOOSE, SELECT_AX, SELECT_CONV, SELECT_ELIM, SELECT_INTRO.

 setify

setify : (* list -> * list)

Synopsis

Removes repeated elements from a list. Makes a list into a ‘set’.

Description

setify l removes repeated elements from l, leaving the last occurrence of each duplicate in the list.

Failure

Never fails.

Example

#setify [1;2;3;1;4;3];;
[2; 1; 4; 3] : int list

Comments

Perhaps the first occurrence of each duplicate should be left in the list, not the last? However, other functions may rely on the ordering currently used.

See also

distinct.
 set_equal
set_equal : (* list -> * list -> bool)

Synopsis

Tests two ‘sets’ for equality.

Description

set_equal l1 l2 returns true if every element of l1 appears in l2 and every element of l2 appears in l1. Otherwise it returns false.

Failure

Never fails.

Example

#set_equal [1;2] [2;1;2];;
true : bool
#set_equal [1;2] [1;3];;
false : bool

See also

setify, union, intersect, subtract.
 set_fail
set_fail : (string -> (* -> **) -> * -> **)

Synopsis

Specifies the failure string for a function evaluation.

Description

When applied to a string s and a function f, the function set_fail gives a function which behaves identically to f except that on failure, the failure string is s, regardless of what failure string f itself gives rise to.

Failure

Never fails.

Example

The following example shows how a failure string can be customized either by using set_fail or by adding a toplevel error trap.

   #BETA_CONV "1 + 1";;
   evaluation failed     BETA_CONV
   #(set_fail `Term is not a beta-redex` BETA_CONV) "1 + 1";;
   evaluation failed     Term is not a beta-redex
   #(BETA_CONV "1 + 1") ? failwith `Term is not a beta-redex`;;
   evaluation failed     Term is not a beta-redex

See also

set_fail_prefix.

 set_fail_prefix

set_fail_prefix : (string -> (* -> **) -> * -> **)

Synopsis

Specifies a prefix to the failure string for a function evaluation.

Description

When applied to a string s and a function f, the function set_fail_prefix gives a function which behaves identically to f except that on failure, the failure string given by f has s and `--` prepended.

\underline{set flag 511}

Example

#BETA_CONV "1 + 1";;
evaluation failed     BETA_CONV
#(set_fail_prefix `Application to "1 + 1" ` BETA_CONV) "1 + 1";;
evaluation failed     Application to "1 + 1"  -- BETA_CONV

Uses

Providing a traceback of failures through function applications.

See also

set_fail.
 set_flag
set_flag : ((string # bool) -> bool)

Synopsis

Sets a named flag to a specific boolean value.

Description

The function set_flag sets a flag to a given value. The previous value of the flag is returned. The list of settable flags can be determined by executing flags ().

Failure

If the named string does not identify a settable flag.

Example

   #set_flag (`timing`, true);;
   false : bool
   Run time: 0.0s

See also

flags.

 set_goal

set_goal : (goal -> void)

Synopsis

Initializes the subgoal package with a new goal.

Description

The function set_goal initializes the subgoal management package. A proof state of the package consists of either a goal stack and a justification stack if a proof is in progress, or a theorem if a proof has just been completed. set_goal sets a new proof state consisting of an empty justification stack and a goal stack with the given goal as its sole goal. The goal is printed.

Failure

Fails unless all terms in the goal are of type bool.

Example

#set_goal([], "(HD[1;2;3] = 1) /\ (TL[1;2;3] = [2;3])");;
"(HD[1;2;3] = 1) /\ (TL[1;2;3] = [2;3])"
() : void

Uses

Starting an interactive proof session with the subgoal package.

The subgoal package implements a simple framework for interactive goal-directed proof. When conducting a proof that involves many subgoals and tactics, the user must keep track of all the justifications and compose them in the correct order. While this is feasible even in large proofs, it is tedious. The subgoal package provides a way of building and traversing the tree of subgoals top-down, stacking the justifications and applying them properly.

The package maintains a proof state consisting of either a goal stack of outstanding goals and a justification stack, or a theorem. Tactics are used to expand the current goal (the one on the top of the goal stack) into subgoals and justifications. These are pushed onto the goal stack and justification stack, respectively, to form a new proof state. Several preceding proof states are saved and can be returned to if a mistake is made in the proof. The goal stack is divided into levels, a new level being created each time a \underline{set help 513}

tactic is successfully applied to give new subgoals. The subgoals of the current level may be considered in any order.

If a tactic solves the current goal (returns an empty subgoal list), then its justification is used to prove a corresponding theorem. This theorem is then incorporated into the justification of the parent goal. If the subgoal was the last subgoal of the level, the level is removed and the parent goal is proved using its (new) justification. This process is repeated until a level with unproven subgoals is reached. The next goal on the goal stack then becomes the current goal. If all the subgoals are proved, the resulting proof state consists of the theorem proved by the justifications. This theorem may be accessed and saved.

Comments

A more sophisticated subgoal management package will be implemented in the future.

See also

b, backup, backup_limit, e, expand, expandf, g, get_state, p, print_state, r,
rotate, save_top_thm, set_state, top_goal, top_thm.

 set_help

set_help : (string -> string)

Synopsis

Specifies a filter to pipe help output through.

Description

Evaluating set_help `filter` will make future help output (generated in response to a help command) be piped through the program filter. The function returns the name of the previous filter. The default is cat, so output is just sent to the console. Previous versions of HOL used more by default.

Failure

Never fails.

Example

#set_help `lpr`;;
`cat` : string

This causes the help file to be printed instead of being displayed.

See also

help, help_search_path, set_help_search_path

 set_help_search_path

set_help_search_path : (string list -> void)

Synopsis

Sets the internal search path use by HOL to find files.

Description

When applied to a list of strings l, each of which represents the pathname to a directory, set_help_search_path sets the internal search path used when the help function searches for online help files to the list l. Although the help search path can be set to an arbitrary list of strings, each string is normally expected to be either empty (``) or a pathname with ‘/’ as its final character. When help looks for a help file, the directories in the search path are searched in the order in which they occur in the list supplied to set_help_search_path.

Failure

Never fails.

See also

help_search_path, install, search_path, set_search_path.

 set_interface_map

set_interface_map : ((string # string) list -> (string # string) list)

Synopsis

Sets up a new interface map.

Description

A call set_interface_map [(a1,c1);...;(an,cn)], where the c’s are the names of existing

constants, will set up the corresponding interface map, and return the previous one. This means that a variable or constant with the name ai occurring in a quoted term will be translated into the corresponding ci. Furthermore, if the flag interface_print is set, the transformation will be reversed when terms are printed. For more details of interface maps, refer to the DESCRIPTION. Note that each call of set_interface_map starts from scratch; it is not possible to augment a previous interface map by a second call.

Failure

The call will fail if the given map is invalid, for one of the following reasons: if any of the c’s are not the names of existing constants, or if the map has multiple c’s corresponding to a single a or vice versa, or if one of the a’s is a constant name which is not redefined by the map (this would create a confusing interface where two different constants would have to be printed identically).

Example

#set_interface_map[`and`,`/\\`; `or`,`\\/`];;
[] : (string # string) list
#"T and F";;
"T and F" : term
#set_flag(`interface_print`,false);;
true : bool
#"T and F";;
"T /\ F" : term

See also

interface_map.

 set_lambda

set_lambda : (string -> string)

Synopsis

Sets the ‘lambda’ symbol used in printing terms.

Description

If s is a string, then set_lambda s sets to s the ‘lambda’ symbol (by default ‘\’) which is used to represent lambda-abstraction in terms. The call returns the previous string used for this purpose. The call affects the printing of terms, but the original symbol is still expected by the quotation parser.

Failure

Never fails.

Example

In the following, the lambda symbol is set to ‘fn’, and the effect on the printing of a typical term is illustrated.

   #set_lambda `fn`;;
   `\` : string
   #"\x. SUC x";;
   "fn x. SUC x" : term

See also

set_prompt, set_turnstile.

 set_library_search_path

set_library_search_path : (string list -> void)

Synopsis

Sets the internal search path use by HOL to find libraries.

Description

When applied to a list of strings l, each of which represents the pathname to a directory, set_library_search_path sets the internal search path used when the load_library function searches for library load files to the list l. Although the library search path can be set to an arbitrary list of strings, each string is normally expected to be a pathname with ‘/’ as its final character. When load_library looks for a library load file, the directories in the search path are searched in the order in which they occur in the list supplied to

set_library_search_path.

Failure

Never fails.

Example

The following call adds a user’s local library directory ~/hol/lib/ to the library search path:

   set_library_search_path (union [`~/hol/lib/`] (library_search_path()));;

Users with local libraries would typically have a line of this form in their hol-init file.

Note that the function union is used to avoid multiple occurrences of the same pathname in the library search path.

See also

library_pathname, library_search_path, load_library.

 set_margin

set_margin : (int -> int)

Synopsis

Changes the limit on the width of the output produced by the pretty-printer.

Description

set_margin i sets the limit on the width of the output produced by the pretty-printer to the integer i. The pretty-printer will try to avoid exceeding this limit by breaking the text into multiple lines. However it can only break at points specified by the functions that send text to it. The result of a call to set_margin is the value to which the margin was previously set.

Failure

Never fails.

Uses

Obtaining readable output when using a text window of non-standard width. It is a good idea to set the margin to a few characters less than the actual width of the window; for example the default is 72 for an 80 character wide display.

See also

print_begin, print_end, print_newline, print_break.

 set_pretty_mode

set_pretty_mode : (bool -> void)

Synopsis

Initializes the pretty-printer.

Description

set_pretty_mode true causes all remaining text in the print queue to be printed, and then the pretty-printer is reinitialized.

Failure

Never fails.

Comments

set_pretty_mode false should turn the pretty-printer off after printing all text in the queue, but the current implementation does not do this.

See also

print_begin, print_end, print_newline.

 set_prompt

set_prompt : (string -> string)

Synopsis

Changes the ML prompt string.

Description

If s is a string, then set_prompt s sets the ML prompt (which is ‘#’ by default) to the string s, and returns the previous prompt string. The string may contain newlines, or be null (although prompt false is a cleaner way of completely eliminating the prompt).

Failure

Never fails.

Example

In the following session, the prompt is set to `Ready` on a line of its own, then reset to its original state.

   #let oldprompt = set_prompt `Ready\
   #`;;
   oldprompt = `#` : string
   Ready
   do set_prompt oldprompt;;
   () : void
   # ...more ML...

See also

prompt, set_lambda, set_turnstile.

 set_search_path

set_search_path : (string list -> void)

Synopsis

Sets the internal search path used by HOL to find files.

Description

When applied to a list of strings l, each of which represents a directory pathname, set_search_path sets the internal search path used when HOL makes access to files on disk to the list l. Although the search path can be set to an arbitrary list of strings, each string in the search path is normally expected to be either empty (``) or a pathname with ‘/’ as its final character. When HOL looks for a file, the directories in the search path are searched in the order in which they occur in the list supplied to set_search_path.

Failure

Never fails.

Example

A typical search path is the following:

   #search_path();;
   [``; `~/`; `/usr/lib/hol/theories/`] : string list

With this search path, HOL first looks for a file in the current working directory (the pathname represented by ``), then in the user‘s home directory `~/`, and finally in the directory `/usr/lib/hol/theories/` (the directory containing HOL‘s built-in theories).

One might augment this search path by doing:

   #set_search_path(`/foo/bar/` . search_path());;
   () : void

so that the directory /foo/bar/ is also searched, and searched first, when HOL tries to find a file.

See also

help_search_path, install, search_path, set_help_search_path.

 set_state

set_state : (goalstack -> void)

Synopsis

Sets the current proof state of the subgoal package to the one given.

Description

The function set_state is part of the subgoal package. It restores the current proof state to one previously saved (using get_state). The restored state will include all unproven subgoals or, if the original goal had been proved before the state was saved, the corresponding theorem. The old proof state is placed on the backup list. For a description of the subgoal package, see set_goal.

Uses

Providing additional backup. Pausing in the proof of a goal to allow lemmas to be proved. set_state is used in conjunction with get_state.

Example

The current state may be bound to an ML variable (main_proof in this example) using

get_state.
   #g "(HD[1;2;3] = 1) /\ (TL[1;2;3] = [2;3])";;
   "(HD[1;2;3] = 1) /\ (TL[1;2;3] = [2;3])"
   () : void
   #let main_proof = get_state();;
   main_proof = - : goalstack

Other goals may now be set and proved. The proof state may later be restored using set_state and the original proof continued.

   #set_state main_proof;;
   "(HD[1;2;3] = 1) /\ (TL[1;2;3] = [2;3])"
   () : void

See also

b, backup, backup_limit, e, expand, expandf, g, get_state, p, print_state, r,
rotate, save_top_thm, set_goal, top_goal, top_thm.

 set_sticky_type

set_sticky_type : ((string # type) -> void)

Synopsis

Gives a particular sticky type to a named variable.

Description

A call set_sticky_type(`name`,":ty") will give the name name a sticky type ty. This means that if name occurs in a quotation with a completely unconstrained type (in particular, the sticky type will not be used if the name is that of a constant), the type ty is automatically inferred. For further details of the sticky type mechanism, refer to the DESCRIPTION.

Failure

Never fails, even if the name could not be the name of a variable or constant. It is permissible to redefine a sticky type.

Example

The following shows how the sticky type is used only when the type of the variable is unconstrained by context.

  #set_sticky_type(`n`,":num");;
  () : void
  #"n = n";;
  "n = n" : term
  #type_of (snd (dest_eq it));;
  ":num" : type
  #"HD [F] = n";;
  "HD[F] = n" : term
  #type_of (snd (dest_eq it));;
  ":bool" : type

Comments

If the flag sticky is set, the name is liable to have its sticky type changed automatically, just like any other name.

See also

remove_sticky_type, sticky_list.

 set_string_escape

set_string_escape : (int -> int)

Synopsis

Changes the escape character inside strings.

Description

set_string_escape n changes the escape character in strings to be the character with ascii code n. The previous character code is returned. Initially the escape is ascii 92 (i.e. ‘\’). If n is not an ascii code then there is no escape character available.

Failure

Never fails (not even if the supplied code is not an ascii code).

 set_thm_count
set_thm_count : (int -> int)

Synopsis

Sets the theorem-counter to the given value.

Description

HOL maintains a counter which is incremented every time a primitive inference is performed (including when an axiom or definition set up). A call to set_thm_count sets the counter to a particular value, returning the previous value.

Failure

Never fails.

See also

thm_count, timer.
 set_turnstile
set_turnstile : (string -> string)

Synopsis

Sets the ‘turnstile’ symbol used in printing theorems.

Description

If s is a string, then set_turnstile s sets to s the ‘turnstile’ symbol (by default ‘|- ’) which is used to represent entailment, i.e. to separate assumptions from conclusion when printing a theorem. The call returns the previous string used for the turnstile.

Failure

Never fails.

Example

The following shows the turnstile being set to ‘|= ’. A space is necessary at the end to separate the conclusion neatly, but not at the beginning.

   #set_turnstile `|= `;;
   `|- ` : string
   #ASSUME "F";;
   . |= F

See also

set_lambda, set_prompt.

 show_types

show_types : (bool -> bool)

Synopsis

Turns printing of HOL types (in terms) on/off.

Description

Normally HOL types in terms are not printed, since this makes terms hard to read. Type printing is enabled by show_types true, and disabled by show_types false. When printing of types is enabled, not all variables and constants are annotated with a type. The intention is to provide sufficient type information to remove any ambiguities without swamping the term with type information.

Example

#BOOL_CASES_AX;;
|- !t. (t = T) \/ (t = F)
#show_types true;;
false : bool
#BOOL_CASES_AX;;
|- !(t:bool). (t = T) \/ (t = F)

Comments

It is possible to construct an abstraction in which the bound variable has the same name but a different type to a variable in the body. In such a case the two variables are considered to be distinct. Without type information such a term can be very misleading, so it might be a good idea to provide type information for the free variable whether or not printing of types is enabled.

See also

print_term.

 SKOLEM_CONV

SKOLEM_CONV : conv

Synopsis

Proves the existence of a Skolem function.

Description

When applied to an argument of the form !x1...xn. ?y. P, the conversion SKOLEM_CONV returns the theorem:

   |- (!x1...xn. ?y. P) = (?y'. !x1...xn. P[y' x1 ... xn/y])

where y' is a primed variant of y not free in the input term.

Failure

SKOLEM_CONV tm fails unless tm is a term of the form !x1...xn. ?y. P, with at least one universally quantified variable.

See also

X_SKOLEM_CONV.
 snd
snd : ((* # **) -> **)

Synopsis

Extracts the second component of a pair.

Description

snd (x,y) returns y.

Failure

Never fails.

See also

fst, pair.
 SNOC_CONV
SNOC_CONV : conv

Synopsis

Computes by inference the result of adding an element to the tail end of a list.

Description

SNOC_CONV a term tm in the following form:

   SNOC x [x0;...xn]

It returns the theorem

   |- SNOC x [x0;...xn] = [x0;...xn;x]

where the right-hand side is the list in the canonical form, i.e., constructed with only the constructor CONS.

Failure

SNOC_CONV tm fails if tm is not of the form described above.

Example

Evaluating

   SNOC_CONV "SNOC 5[0;1;2;3;4]";;

returns the following theorem:

   |- SNOC 5[0;1;2;3;4] = [0;1;2;3;4;5]

See also

FOLDL_CONV, FOLDR_CONV, list_FOLD_CONV.

 SNOC_INDUCT_TAC

SNOC_INDUCT_TAC : tactic

Synopsis

Performs tactical proof by structural induction on lists.

Description

SNOC_INDUCT_TAC reduces a goal !l.P[l], where l ranges over lists, to two subgoals corresponding to the base and step cases in a proof by structural induction on l from the tail end. The induction hypothesis appears among the assumptions of the subgoal for the step case. The specification of SNOC_INDUCT_TAC is:

                     A ?- !l. P
   =====================================================  SNOC_INDUCT_TAC
    A |- P[NIL/l]   A u {P[l'/l]} ?- !x. P[SNOC x l'/l]

where l' is a primed variant of l that does not appear free in the assumptions A (usually, l' is just l). When SNOC_INDUCT_TAC is applied to a goal of the form !l.P, where l does not appear free in P, the subgoals are just A ?- P and A u {P} ?- !h.P.

Failure

SNOC_INDUCT_TAC g fails unless the conclusion of the goal g has the form !l.t, where the variable l has type (ty)list for some type ty.

See also

LIST_INDUCT, LIST_INDUCT_TAC.

 SOME_EL_CONV
SOME_EL_CONV : conv -> conv

Synopsis

Computes by inference the result of applying a predicate to elements of a list.

Description

SOME_EL_CONV takes a conversion conv and a term tm in the following form:

   SOME_EL P [x0;...xn]

It returns the theorem

   |- SOME_EL P [x0;...xn] = F

if for every xi occurred in the list, conv "P xi" returns a theorem |- P xi = F, otherwise, if for at least one xi, evaluating conv "P xi" returns the theorem |- P xi = T, then it returns the theorem

   |- SOME_EL P [x0;...xn] = T

Failure

SOME_EL_CONV conv tm fails if tm is not of the form described above, or failure occurs when evaluating conv "P xi" for some xi.

Example

Evaluating

   SOME_EL_CONV bool_EQ_CONV "SOME_EL ($= T) [T;F;T]";;

returns the following theorem:

   |- SOME_EL($= T)[T;F;T] = T

In general, if the predicate P is an explicit lambda abstraction (\x. P x), the conversion \underline{sort 529} should be in the form

   (BETA_CONV THENC conv')

See also

ALL_EL_CONV, IS_EL_CONV, FOLDL_CONV, FOLDR_CONV, list_FOLD_CONV.
 sort
sort : (((* # *) -> bool) -> * list -> * list)

Synopsis

Sorts a list using a given transitive ‘ordering’ relation.

Description

The call

   sort op list

where op is an (uncurried) transitive relation on the elements of list, will topologically sort the list, i.e. will permute it such that if x op y but not y op x then x will occur to the left of y in the sorted list. In particular if op is a total order, the list will be sorted in the usual sense of the word.

Failure

Never fails.

Example

A simple example is:

   #sort $< [3; 1; 4; 1; 5; 9; 2; 6; 5; 3; 5; 8; 9; 7; 9];;
   [1; 1; 2; 3; 3; 4; 5; 5; 5; 6; 7; 8; 9; 9; 9] : int list

The following example is a little more complicated. Note that the ‘ordering’ is not antisymmetric.

   #sort ($< o (fst # fst)) [(1,3); (7,11); (3,2); (3,4); (7,2); (5,1)];;
   [(1, 3); (3, 4); (3, 2); (5, 1); (7, 2); (7, 11)] : (int # int) list

 SPEC

SPEC : (term -> thm -> thm)

Synopsis

Specializes the conclusion of a theorem.

Description

When applied to a term u and a theorem A |- !x. t, then SPEC returns the theorem A |- t[u/x]. If necessary, variables will be renamed prior to the specialization to ensure that u is free for x in t, that is, no variables free in u become bound after substitution.

     A |- !x. t
   --------------  SPEC "u"
    A |- t[u/x]

Failure

Fails if the theorem’s conclusion is not universally quantified, or if x and u have different types.

Example

The following example shows how SPEC renames bound variables if necessary, prior to substitution: a straightforward substitution would result in the clearly invalid theorem

|- ~y ==> (!y. y ==> ~y).
   #let xv = "x:bool" and yv="y:bool" in
   #     (GEN xv o DISCH xv o GEN yv o DISCH yv) (ASSUME xv);;
   |- !x. x ==> (!y. y ==> x)
   #SPEC "~y" it;;
   |- ~y ==> (!y'. y' ==> ~y)

See also

ISPEC, SPECL, SPEC_ALL, SPEC_VAR, GEN, GENL, GEN_ALL.

 special_symbols

special_symbols : (void -> string list)

Synopsis

Returns a list of special symbols.

Description

An identifier, at the ML or object level, is either alphanumeric, e.g. true or T, or consists of a special symbol which starts with a non-alphanumeric character, e.g. ==> or +. It is a consequence of the non-backtracking implementation of lexical analysis that any (nonnull) initial segment of a special symbol is also a special symbol, so from the above we know that == and = are. The function special_symbols returns a list of special symbols; all non-null initial prefixes of them are also special symbols.

Failure

Never fails.

See also

new_special_symbol.

 SPECL

SPECL : (term list -> thm -> thm)

Synopsis

Specializes zero or more variables in the conclusion of a theorem.

Description

When applied to a term list [u1;...;un] and a theorem A |- !x1...xn. t, the inference rule SPECL returns the theorem A |- t[u1/x1]...[un/xn], where the substitutions are made sequentially left-to-right in the same way as for SPEC, with the same sort of alphaconversions applied to t if necessary to ensure that no variables which are free in ui become bound after substitution.

       A |- !x1...xn. t
   --------------------------  SPECL "[u1;...;un]"
     A |- t[u1/x1]...[un/xn]

It is permissible for the term-list to be empty, in which case the application of SPECL has no effect.

Failure

Fails unless each of the terms is of the same as that of the appropriate quantified variable in the original theorem.

Example

The following is a specialization of a theorem from theory arithmetic.

   #let t = theorem `arithmetic` `LESS_EQ_LESS_EQ_MONO`;;
   t = |- !m n p q. m <= p /\ n <= q ==> (m + n) <= (p + q)
   #SPECL ["1"; "2"; "3"; "4"] t;;
   |- 1 <= 3 /\ 2 <= 4 ==> (1 + 2) <= (3 + 4)

See also

GEN, GENL, GEN_ALL, GEN_TAC, SPEC, SPEC_ALL, SPEC_TAC.

 SPEC_ALL

SPEC_ALL : (thm -> thm)

Synopsis

Specializes the conclusion of a theorem with its own quantified variables.

Description

When applied to a theorem A |- !x1...xn. t, the inference rule SPEC_ALL returns the theorem A |- t[x1'/x1]...[xn'/xn] where the xi' are distinct variants of the corresponding xi, chosen to avoid clashes with any variables free in the assumption list and with the

\underline{SPEC TAC 533}

names of constants. Normally xi' is just xi, in which case SPEC_ALL simply removes all universal quantifiers.

       A |- !x1...xn. t
   ---------------------------  SPEC_ALL
    A |- t[x1'/x1]...[xn'/xn]

Failure

Never fails.

Example

The following example shows how variables are also renamed to avoid clashing with the names of constants.

   #let v=mk_var(`T`,":bool") in ASSUME "!^v. ^v \/ ~^v";;
   !T. T \/ ~T |- !T. T \/ ~T
   #SPEC_ALL it;;
   !T. T \/ ~T |- T' \/ ~T'

See also

GEN, GENL, GEN_ALL, GEN_TAC, SPEC, SPECL, SPEC_ALL, SPEC_TAC.

 SPEC_TAC

SPEC_TAC : ((term # term) -> tactic)

Synopsis

Generalizes a goal.

Description

When applied to a pair of terms (u,x), where x is just a variable, and a goal A ?- t, the tactic SPEC_TAC generalizes the goal to A ?- !x. t[x/u], that is, all instances of u are turned into x.

        A ?- t
   =================  SPEC_TAC ("u","x")
    A ?- !x. t[x/u]

Failure

Fails unless x is a variable with the same type as u.

Uses

Removing unnecessary speciality in a goal, particularly as a prelude to an inductive proof.

See also

GEN, GENL, GEN_ALL, GEN_TAC, SPEC, SPECL, SPEC_ALL, STRIP_TAC.

 SPEC_VAR

SPEC_VAR : (thm -> (term # thm))

Synopsis

Specializes the conclusion of a theorem, returning the chosen variant.

Description

When applied to a theorem A |- !x. t, the inference rule SPEC_VAR returns the term x' and the theorem A |- t[x'/x], where x' is a variant of x chosen to avoid free variable capture.

     A |- !x. t
   --------------  SPEC_VAR
    A |- t[x'/x]

Failure

Fails unless the theorem’s conclusion is universally quantified.

Comments

This rule is very similar to plain SPEC, except that it returns the variant chosen, which may be useful information under some circumstances.

See also

GEN, GENL, GEN_ALL, GEN_TAC, SPEC, SPECL, SPEC_ALL.

 split

split : ((* # **) list -> (* list # ** list))

\underline{splitp 535}

Synopsis

Converts a list of pairs into a pair of lists.

Description

split [(x1,y1);...;(xn,yn)] returns ([x1;...;xn],[y1;...;yn]).

Failure

Never fails.

See also

combine, com.

 splitp

splitp : ((* -> bool) -> * list -> (* list # * list))

Synopsis

Splits a list into a pair of lists according to a predicate.

Description

splitp P [x1;...;xk;...;xn] returns ([x1;...;x(k-1)],[xk;...;xn]) where xk is the

first element satisfying the predicate P. If no element satisfies P, ([x1;...;xn],[]) is returned.

Failure

Never fails.

See also

split, partition, chop_list.

 sticky_list

sticky_list : (void -> (string # type) list)

Synopsis

Returns a list of the current sticky type settings.

Description

A call sticky_list() will return a list of names and the associated sticky types. This list can be changed explicitly via set_sticky_type and remove_sticky_type, or if the flag sticky is set, will be changed behind the scenes as terms are parsed. For more details of the sticky type mechanism, refer to the DESCRIPTION.

Failure

Never fails.

See also

remove_sticky_type, set_sticky_type.

 store_binders

store_binders : (term list -> thm)

Synopsis

This function is for internal use only and is to be deleted from a future version of the system. It should not be used.

 store_definition

store_definition : ((string # term) -> thm)

Synopsis

This function is for internal use only and is to be deleted from a future version of the system. It should not be used.

 string_of_int

string_of_int : (int -> string)

Synopsis

Maps an integer to the corresponding decimal string.

Description

When given an integer, string_of_int returns a string representing the number in standard decimal notation, with a leading minus sign if the number is negative, and no leading zeros.

Failure

Never fails.

See also

ascii, ascii_code, int_of_string.

 strip_abs

strip_abs : (term -> goal)

Synopsis

Iteratively breaks apart abstractions.

Description

strip_abs "\x1 ... xn. t" returns (["x1";...;"xn"],"t"). Note that
   strip_abs(list_mk_abs(["x1";...;"xn"],"t"))

will not return (["x1";...;"xn"],"t") if t is an abstraction.

Failure

Never fails.

See also

list_mk_abs, dest_abs.

 STRIP_ASSUME_TAC

STRIP_ASSUME_TAC : thm_tactic

Synopsis

Splits a theorem into a list of theorems and then adds them to the assumptions.

Description

Given a theorem th and a goal (A,t), STRIP_ASSUME_TAC th splits th into a list of theorems. This is done by recursively breaking conjunctions into separate conjuncts, casessplitting disjunctions, and eliminating existential quantifiers by choosing arbitrary variables. Schematically, the following rules are applied:

           A ?- t
   ======================  STRIP_ASSUME_TAC (A' |- v1 /\ ... /\ vn)
    A u {v1,...,vn} ?- t
                A ?- t
   =================================  STRIP_ASSUME_TAC (A' |- v1 \/ ... \/ vn)
    A u {v1} ?- t ... A u {vn} ?- t
          A ?- t
   ====================  STRIP_ASSUME_TAC (A' |- ?x.v)
    A u {v[x'/x]} ?- t

where x' is a variant of x.

If the conclusion of th is not a conjunction, a disjunction or an existentially quantified term, the whole theorem th is added to the assumptions.

As assumptions are generated, they are examined to see if they solve the goal (either by being alpha-equivalent to the conclusion of the goal or by deriving a contradiction).

The assumptions of the theorem being split are not added to the assumptions of the goal(s), but they are recorded in the proof. This means that if A' is not a subset of the assumptions A of the goal (up to alpha-conversion), STRIP_ASSUME_TAC (A'|-v) results in an invalid tactic.

Example

When solving the goal

   ?- m = 0 + m

assuming the clauses for addition with STRIP_ASSUME_TAC ADD_CLAUSES results in the goal

  {m + (SUC n) = SUC(m + n), (SUC m) + n = SUC(m + n),
   m + 0 = m, 0 + m = m, m = 0 + m} ?- m = 0 + m

while the same tactic directly solves the goal

   ?- 0 + m = m

Uses

STRIP_ASSUME_TAC is used when applying a previously proved theorem to solve a goal, or when enriching its assumptions so that resolution, rewriting with assumptions and other operations involving assumptions have more to work with.

See also

ASSUME_TAC, CHOOSE_TAC, CHOOSE_THEN, CONJUNCTS_THEN, DISJ_CASES_TAC,
DISJ_CASES_THEN.

 strip_comb

strip_comb : (term -> (term # term list))

Synopsis

Iteratively breaks apart combinations (function applications).

Description

strip_comb "t t1 ... tn" returns ("t",["t1";...;"tn"]). Note that
   strip_comb(list_mk_comb("t",["t1";...;"tn"]))

will not return ("t",["t1";...;"tn"]) if t is a combination.

540 Chapter 1. Pre-defined ML Identifiers

Example

#strip_comb "x /\ y";;
("$/\", ["x"; "y"]) : (term # term list)
#strip_comb "T";;
("T", []) : (term # term list)

See also

list_mk_comb, dest_comb.
 strip_exists
strip_exists : (term -> goal)

Synopsis

Iteratively breaks apart existential quantifications.

Description

strip_exists "?x1 ... xn. t" returns (["x1";...;"xn"],"t"). Note that
   strip_exists(list_mk_exists(["x1";...;"xn"],"t"))

will not return (["x1";...;"xn"],"t") if t is an existential quantification.

Failure

Never fails.

See also

list_mk_exists, dest_exists.
 strip_forall
strip_forall : (term -> goal)

Synopsis

Iteratively breaks apart universal quantifications.

Description

strip_forall "!x1 ... xn. t" returns (["x1";...;"xn"],"t"). Note that
   strip_forall(list_mk_forall(["x1";...;"xn"],"t"))

will not return (["x1";...;"xn"],"t") if t is a universal quantification.

Failure

Never fails.

See also

list_mk_forall, dest_forall.

 STRIP_GOAL_THEN

STRIP_GOAL_THEN : (thm_tactic -> tactic)

Synopsis

Splits a goal by eliminating one outermost connective, applying the given theorem-tactic to the antecedents of implications.

Description

Given a theorem-tactic ttac and a goal (A,t), STRIP_GOAL_THEN removes one outermost occurrence of one of the connectives !, ==>, ~ or /\ from the conclusion of the goal t. If t is a universally quantified term, then STRIP_GOAL_THEN strips off the quantifier:

      A ?- !x.u
   ==============  STRIP_GOAL_THEN ttac
     A ?- u[x'/x]

where x' is a primed variant that does not appear free in the assumptions A. If t is a 542 Chapter 1. Pre-defined ML Identifiers

conjunction, then STRIP_GOAL_THEN simply splits the conjunction into two subgoals:

      A ?- v /\ w
   =================  STRIP_GOAL_THEN ttac
    A ?- v   A ?- w

If t is an implication "u ==> v" and if:

      A ?- v
  ===============  ttac (u |- u)
     A' ?- v'

then:

      A ?- u ==> v
  ====================  STRIP_GOAL_THEN ttac
        A' ?- v'

Finally, a negation ~t is treated as the implication t ==> F.

Failure

STRIP_GOAL_THEN ttac (A,t) fails if t is not a universally quantified term, an implication, a negation or a conjunction. Failure also occurs if the application of ttac fails, after stripping the goal.

Example

When solving the goal

   ?- (n = 1) ==> (n * n = n)

a possible initial step is to apply

   STRIP_GOAL_THEN SUBST1_TAC

thus obtaining the goal

   ?- 1 * 1 = 1

Uses

STRIP_GOAL_THEN is used when manipulating intermediate results (obtained by stripping outer connectives from a goal) directly, rather than as assumptions.

See also

CONJ_TAC, DISCH_THEN, FILTER_STRIP_THEN, GEN_TAC, STRIP_ASSUME_TAC, STRIP_TAC.

strip imp 543

 strip_imp
strip_imp : (term -> goal)

Synopsis

Iteratively breaks apart implications.

Description

strip_imp "t1 ==> ( ... (tn ==> t)...)" returns (["t1";...;"tn"],"t"). Note that
   strip_imp(list_mk_imp(["t1";...;"tn"],"t"))

will not return (["t1";...;"tn"],"t") if t is an implication.

Failure

Never fails.

Example

#strip_imp "(T ==> F) ==> (T ==> F)";;
(["T ==> F"; "T"], "F") : goal

See also

list_mk_imp, dest_imp.
 strip_pair
strip_pair : (term -> term list)

Synopsis

Iteratively breaks apart tuples.

Description

strip_pair("(t1,...,tn)") returns ["t1";...;"tn"]. A term that is not a tuple is simply

returned as the sole element of a list. Note that

   strip_pair(list_mk_pair ["t1";...;"tn"])

will not return ["t1";...;"tn"] if tn is a pair or a tuple.

Failure

Never fails.

Example

#list_mk_pair ["(1,2)";"(3,4)";"(5,6)"];;
"(1,2),(3,4),5,6" : term
#strip_pair it;;
["1,2"; "3,4"; "5"; "6"] : term list
#strip_pair "1";;
["1"] : term list

See also

list_mk_pair, dest_pair.

 STRIP_TAC

STRIP_TAC : tactic

Synopsis

Splits a goal by eliminating one outermost connective.

Description

Given a goal (A,t), STRIP_TAC removes one outermost occurrence of one of the connectives !, ==>, ~ or /\ from the conclusion of the goal t. If t is a universally quantified term, then STRIP_TAC strips off the quantifier:

      A ?- !x.u
   ==============  STRIP_TAC
     A ?- u[x'/x]

where x' is a primed variant that does not appear free in the assumptions A. If t is a conjunction, then STRIP_TAC simply splits the conjunction into two subgoals:

      A ?- v /\ w
   =================  STRIP_TAC
    A ?- v   A ?- w

If t is an implication, STRIP_TAC moves the antecedent into the assumptions, stripping

STRIP THM THEN 545

conjunctions, disjunctions and existential quantifiers according to the following rules:

    A ?- v1 /\ ... /\ vn ==> v            A ?- v1 \/ ... \/ vn ==> v
   ============================        =================================
       A u {v1,...,vn} ?- v             A u {v1} ?- v ... A u {vn} ?- v
     A ?- ?x.w ==> v
   ====================
    A u {w[x'/x]} ?- v

where x' is a primed variant of x that does not appear free in A. Finally, a negation ~t is treated as the implication t ==> F.

Failure

STRIP_TAC (A,t) fails if t is not a universally quantified term, an implication, a negation or a conjunction.

Example

Applying STRIP_TAC twice to the goal:

    ?- !n. m <= n /\ n <= m ==> (m = n)

results in the subgoal:

   {n <= m, m <= n} ?- m = n

Uses

When trying to solve a goal, often the best thing to do first is REPEAT STRIP_TAC to split the goal up into manageable pieces.

See also

CONJ_TAC, DISCH_TAC, DISCH_THEN, GEN_TAC, STRIP_ASSUME_TAC, STRIP_GOAL_THEN.
 STRIP_THM_THEN
STRIP_THM_THEN : thm_tactical

Synopsis

STRIP_THM_THEN applies the given theorem-tactic using the result of stripping off one outer connective from the given theorem.

Description

Given a theorem-tactic ttac, a theorem th whose conclusion is a conjunction, a disjunction or an existentially quantified term, and a goal (A,t), STRIP_THM_THEN ttac th first strips apart the conclusion of th, next applies ttac to the theorem(s) resulting from the stripping and then applies the resulting tactic to the goal.

In particular, when stripping a conjunctive theorem A'|- u /\ v, the tactic

   ttac(u|-u) THEN ttac(v|-v)

resulting from applying ttac to the conjuncts, is applied to the goal. When stripping a disjunctive theorem A'|- u \/ v, the tactics resulting from applying ttac to the disjuncts, are applied to split the goal into two cases. That is, if

    A ?- t                           A ?- t
   =========  ttac (u|-u)    and    =========  ttac (v|-v)
    A ?- t1                          A ?- t2

then:

         A ?- t
   ==================  STRIP_THM_THEN ttac (A'|- u \/ v)
    A ?- t1  A ?- t2

When stripping an existentially quantified theorem A'|- ?x.u, the tactic ttac(u|-u), resulting from applying ttac to the body of the existential quantification, is applied to the goal. That is, if:

    A ?- t
   =========  ttac (u|-u)
    A ?- t1

then:

      A ?- t
   =============  STRIP_THM_THEN ttac (A'|- ?x. u)
      A ?- t1

The assumptions of the theorem being split are not added to the assumptions of the goal(s) but are recorded in the proof. If A' is not a subset of the assumptions A of the goal (up to alpha-conversion), STRIP_THM_THEN ttac th results in an invalid tactic.

Failure

STRIP_THM_THEN ttac th fails if the conclusion of th is not a conjunction, a disjunction or an existentially quantified term. Failure also occurs if the application of ttac fails, after stripping the outer connective from the conclusion of th.

Uses

STRIP_THM_THEN is used enrich the assumptions of a goal with a stripped version of a previously-proved theorem.

See also

CHOOSE_THEN, CONJUNCTS_THEN, DISJ_CASES_THEN, STRIP_ASSUME_TAC.

 STRUCT_CASES_TAC

STRUCT_CASES_TAC : thm_tactic

Synopsis

Performs very general structural case analysis.

Description

When it is applied to a theorem of the form:

   th = A' |- ?y11...y1m. (x=t1) /\ (B11 /\ ... /\ B1k) \/ ... \/
                ?yn1...ynp. (x=tn) /\ (Bn1 /\ ... /\ Bnp)

in which there may be no existential quantifiers where a ‘vector’ of them is shown above, STRUCT_CASES_TAC th splits a goal A ?- s into n subgoals as follows:

                             A ?- s
   ===============================================================
    A u {B11,...,B1k} ?- s[t1/x] ... A u {Bn1,...,Bnp} ?- s[tn/x]

that is, performs a case split over the possible constructions (the ti) of a term, providing as assumptions the given constraints, having split conjoined constraints into separate assumptions. Note that unless A' is a subset of A, this is an invalid tactic.

Failure

Fails unless the theorem has the above form, namely a conjunction of (possibly multiply existentially quantified) terms which assert the equality of the same variable x and the given terms.

Example

Suppose we have the goal:

  ?- ~(l:(*)list = []) ==> (LENGTH l) > 0

then we can get rid of the universal quantifier from the inbuilt list theorem list_CASES:

   list_CASES = !l. (l = []) \/ (?t h. l = CONS h t)

and then use STRUCT_CASES_TAC. This amounts to applying the following tactic:

   STRUCT_CASES_TAC (SPEC_ALL list_CASES)

which results in the following two subgoals:

   ?- ~(CONS h t = []) ==> (LENGTH(CONS h t)) > 0
   ?- ~([] = []) ==> (LENGTH[]) > 0

Note that this is a rather simple case, since there are no constraints, and therefore the resulting subgoals have no assumptions.

Uses

Generating a case split from the axioms specifying a structure.

See also

ASM_CASES_TAC, BOOL_CASES_TAC, COND_CASES_TAC, DISJ_CASES_TAC.

 SUBGOAL_THEN

SUBGOAL_THEN : (term -> thm_tactic -> tactic)

Synopsis

Allows the user to introduce a lemma.

Description

The user proposes a lemma and is then invited to prove it under the current assumptions.

\underline{SUBS 549}

The lemma is then used with the thm_tactic to simplify the goal. That is, if

    A1 ?- t1
   ==========  f (u |- u)
    A2 ?- t2

then

         A1 ?- t1
   ====================  SUBGOAL_THEN "u" f
    A1 ?- u   A2 ?- t2

Failure

SUBGOAL_THEN will fail with `ASSUME` if an attempt is made to use a nonboolean term as a lemma.

Uses

When combined with rotate, SUBGOAL_THEN allows the user to defer some part of a proof and to continue with another part. SUBGOAL_THEN is most convenient when the tactic solves the original goal, leaving only the subgoal. For example, suppose the user wishes top prove the goal

   {n = SUC m} ?- (0 = n) ==> t

Using SUBGOAL_THEN to focus on the case in which ~(n = 0), rewriting establishes it truth, leaving only the proof that ~(n = 0). That is,

   SUBGOAL_THEN "~(0 = n)" (\th:thm. REWRITE_TAC [th])

generates the following subgoals:

   {n = SUC m} ?-  ~(0 = n)
   ?- T

Comments

Some users may expect the generated tactic to be f (A1 |- u), rather than f (u |- u).

 SUBS

SUBS : (thm list -> thm -> thm)

Synopsis

Makes simple term substitutions in a theorem using a given list of theorems.

Description

Term substitution in HOL is performed by replacing free subterms according to the transformations specified by a list of equational theorems. Given a list of theorems A1|-t1=v1,...,An|-tn=vn and a theorem A|-t, SUBS simultaneously replaces each free occurrence of ti in t with vi:

          A1|-t1=v1 ... An|-tn=vn    A|-t
   ---------------------------------------------  SUBS[A1|-t1=v1;...;An|-tn=vn]
    A1 u ... u An u A |- t[v1,...,vn/t1,...,tn]       (A|-t)

No matching is involved; the occurrence of each ti being substituted for must be a free in t (see SUBST_MATCH). An occurrence which is not free can be substituted by using rewriting

rules such as REWRITE_RULE, PURE_REWRITE_RULE and ONCE_REWRITE_RULE.

Failure

SUBS [th1;...;thn] (A|-t) fails if the conclusion of each theorem in the list is not an equation. No change is made to the theorem A |- t if no occurrence of any left-hand side of the supplied equations appears in t.

Example

Substitutions are made with the theorems

   #let thm1 = SPECL ["m:num"; "n:num"] ADD_SYM
   #and thm2 = CONJUNCT1 ADD_CLAUSES;;
   thm1 = |- m + n = n + m
   thm2 = |- 0 + m = m

depending on the occurrence of free subterms

   #SUBS [thm1; thm2] (ASSUME "(n + 0) + (0 + m) = m + n");;
   . |- (n + 0) + m = n + m
   #SUBS [thm1; thm2] (ASSUME "!n. (n + 0) + (0 + m) = m + n");;
   . |- !n. (n + 0) + m = m + n

Uses

SUBS can sometimes be used when rewriting (for example, with REWRITE_RULE) would diverge and term instantiation is not needed. Moreover, applying the substitution rules is often much faster than using the rewriting rules.

\underline{SUBST 551}

See also

ONCE_REWRITE_RULE, PURE_REWRITE_RULE, REWRITE_RULE, SUBST, SUBST_MATCH,
SUBS_OCCS.

 SUBST

SUBST : ((thm # term) list -> term -> thm -> thm)

Synopsis

Makes a set of parallel substitutions in a theorem.

Description

Implements the following rule of simultaneous substitution

    A1 |- t1 = u1 ,  ... , An |- tn = un ,    A |- t[t1,...,tn]
   -------------------------------------------------------------
                  A u A1 u ... u An |- t[ui]

Evaluating

   SUBST [((A1 |- t1=u1), x1); ... ;((An |- tn=un), xn)]
         t[x1,...,xn]
         (A |- t[t1,...,tn])

returns the theorem A |- t[u1,...,un]. The term argument t[x1,...,xn] is a template which should match the conclusion of the theorem being substituted into, with the variables x1, ... , xn marking those places where occurrences of t1, ... , tn are to be replaced by the terms u1, ... , un, respectively. The occurrence of ti at the places marked by xi must be free (i.e. ti must not contain any bound variables). SUBST automatically renames bound variables to prevent free variables in ui becoming bound after substitution.

SUBST is a complex primitive because it performs both parallel simultaneous substitution and renaming of variables. This is for efficiency reasons, but it would be logically cleaner if SUBST were simpler.

Failure

If the template does not match the conclusion of the hypothesis, or the terms in the conclusion marked by the variables x1, ... , xn in the template are not identical to the left hand sides of the supplied equations (i.e. the terms t1, ... , tn).

Example

#let th0 = SPEC "0" ADD1 and th1 = SPEC "1" ADD1;;
th0 = |- SUC 0 = 0 + 1
th1 = |- SUC 1 = 1 + 1
#SUBST [(th0,"x:num");(th1,"y:num")]
#      "(x+y) > SUC 0"
#      (ASSUME "(SUC 0 + SUC 1) > SUC 0");;
. |- ((0 + 1) + (1 + 1)) > (SUC 0)
#SUBST [(th0,"x:num");(th1,"y:num")]
#      "(SUC 0 + y) > SUC 0"
#      (ASSUME "(SUC 0 + SUC 1) > SUC 0");;
. |- ((SUC 0) + (1 + 1)) > (SUC 0)
#SUBST [(th0,"x:num");(th1,"y:num")]
#      "(x+y) > x"
#      (ASSUME "(SUC 0 + SUC 1) > SUC 0");;
. |- ((0 + 1) + (1 + 1)) > (0 + 1)

Uses

For substituting at selected occurrences. Often useful for writing special purpose derived inference rules.

See also

SUBS.

 subst

subst : ((term # term) list -> term -> term)

Synopsis

Substitutes terms in a term.

Description

Given a list of term pairs [("a_1","b_1"),...,("a_n","b_n")] and a term "c", subst

attempts to substitute all free occurrences of "b_i" in "c" by "a_i" for all i ranging between 1 and n.

Failure

Failure occurs if for some i ranging between 1 and n, the substitution of "b_i" by "a_i" fails. The substitution of "b_i" by "a_i" fails for some i, if the types of "a_i" and "b_i" are not the same.

Example

   #subst [("1","SUC 0")] "SUC(SUC 0)";;
   "SUC 1" : term
   #subst [("1","SUC 0");("2","SUC 1")] "SUC(SUC 0)";;
   "SUC 1" : term
   #subst [("1","SUC 0");("2","SUC 1")] "SUC(SUC 0) = SUC 1";;
   "SUC 1 = 2" : term
   #subst [("b:num","a:num")] "\a:num. (b:num)";;
   "\a. b" : term
   #subst [("foo:*","flip:*")] "waddle:*";;
   "waddle" : term

 SUBST1_TAC

SUBST1_TAC : thm_tactic

Synopsis

Makes a simple term substitution in a goal using a single equational theorem.

Description

Given a theorem A'|-u=v and a goal (A,t), the tactic SUBST1_TAC (A'|-u=v) rewrites the term t into t[v/u], by substituting v for each free occurrence of u in t:

      A ?- t
   =============  SUBST1_TAC (A'|-u=v)
    A ?- t[v/u]

The assumptions of the theorem used to substitute with are not added to the assumptions of the goal but are recorded in the proof. If A' is not a subset of the assumptions A of the goal (up to alpha-conversion), then SUBST1_TAC (A'|-u=v) results in an invalid tactic.

SUBST1_TAC automatically renames bound variables to prevent free variables in v becoming bound after substitution.

Failure

SUBST1_TAC th (A,t) fails if the conclusion of th is not an equation. No change is made to the goal if no free occurrence of the left-hand side of th appears in t.

Example

When trying to solve the goal

   ?- m * n = (n * (m - 1)) + n

substituting with the commutative law for multiplication

   SUBST1_TAC (SPECL ["m:num"; "n:num"] MULT_SYM)

results in the goal

   ?- n * m = (n * (m - 1)) + n

Uses

SUBST1_TAC is used when rewriting with a single theorem using tactics such as REWRITE_TAC is too expensive or would diverge. Applying SUBST1_TAC is also much faster than using rewriting tactics.

See also

ONCE_REWRITE_TAC, PURE_REWRITE_TAC, REWRITE_TAC, SUBST_ALL_TAC, SUBST_TAC.

 SUBST_ALL_TAC

SUBST_ALL_TAC : thm_tactic

Synopsis

Substitutes using a single equation in both the assumptions and conclusion of a goal.

Description

SUBST_ALL_TAC breaches the style of natural deduction, where the assumptions are kept

fixed. Given a theorem A|-u=v and a goal ([t1;...;tn], t), SUBST_ALL_TAC (A|-u=v)

transforms the assumptions t1,...,tn and the term t into t1[v/u],...,tn[v/u] and t[v/u] respectively, by substituting v for each free occurrence of u in both the assumptions and the conclusion of the goal.

           {t1,...,tn} ?- t
   =================================  SUBST_ALL_TAC (A|-u=v)
    {t1[v/u],...,tn[v/u]} ?- t[v/u]

The assumptions of the theorem used to substitute with are not added to the assumptions of the goal, but they are recorded in the proof. If A is not a subset of the assumptions of the goal (up to alpha-conversion), then SUBST_ALL_TAC (A|-u=v) results in an invalid tactic.

SUBST_ALL_TAC automatically renames bound variables to prevent free variables in v becoming bound after substitution.

Failure

SUBST_ALL_TAC th (A,t) fails if the conclusion of th is not an equation. No change is made to the goal if no occurrence of the left-hand side of th appears free in (A,t).

Example

Simplifying both the assumption and the term in the goal

   {0 + m = n} ?- 0 + (0 + m) = n

by substituting with the theorem |- 0 + m = m for addition

   SUBST_ALL_TAC (CONJUNCT1 ADD_CLAUSES)

results in the goal

   {m = n} ?- 0 + m = n

See also

ONCE_REWRITE_TAC, PURE_REWRITE_TAC, REWRITE_TAC, SUBST1_TAC, SUBST_TAC.

 SUBST_CONV

SUBST_CONV : ((thm # term) list -> term -> conv)

Synopsis

Makes substitutions in a term at selected occurrences of subterms, using a list of theorems.

Description

SUBST_CONV implements the following rule of simultaneous substitution

                    A1 |- t1 = v1 ... An |- tn = vn
   ------------------------------------------------------------------
    A1 u ... u An |- t[t1,...,tn/x1,...,xn] = t[v1,...,vn/x1,...,xn]
The first argument to SUBST_CONV is a list [(A1|-t1=v1, x1);...;(An|-tn=vn, xn)]. The

second argument is a template term t[x1,...,xn], in which the variables x1,...,xn are used to mark those places where occurrences of t1,...,tn are to be replaced with the terms v1,...,vn, respectively. Thus, evaluating

   SUBST_CONV [(A1|-t1=v1, x1);...;(An|-tn=vn, xn)]
              t[x1,...,xn]
              t[t1,...,tn/x1,...,xn]

returns the theorem

   A1 u ... u An |- t[t1,...,tn/x1,...,xn] = t[v1,...,vn/x1,...,xn]

The occurrence of ti at the places marked by the variable xi must be free (i.e. ti must not contain any bound variables). SUBST_CONV automatically renames bound variables to prevent free variables in vi becoming bound after substitution.

Failure

SUBST_CONV [(th1,x1);...;(thn,xn)] t[x1,...,xn] t' fails if the conclusion of any the-

orem thi in the list is not an equation; or if the template t[x1,...,xn] does not match the term t'; or if and term ti in t' marked by the variable xi in the template, is not identical to the left-hand side of the conclusion of the theorem thi.

Example

The theorems

   #let thm0 = SPEC "0" ADD1 and thm1 = SPEC "1" ADD1;;
   thm0 = |- SUC 0 = 0 + 1
   thm1 = |- SUC 1 = 1 + 1

can be used to substitute selected occurrences of the terms SUC 0 and SUC 1

   #SUBST_CONV [(thm0,"x:num");(thm1,"y:num")]
   #           "(x + y) > SUC 1"
   #           "(SUC 0 + SUC 1) > SUC 1";;
   |- ((SUC 0) + (SUC 1)) > (SUC 1) = ((0 + 1) + (1 + 1)) > (SUC 1)

Uses

SUBST_CONV is used when substituting at selected occurrences of terms and using rewriting rules/conversions is too extensive.

See also

REWR_CONV, SUBS, SUBST, SUBS_OCCS.

 SUBST_MATCH

SUBST_MATCH : (thm -> thm -> thm)

Synopsis

Substitutes in one theorem using another, equational, theorem.

Description

Given the theorems A|-u=v and A'|-t, SUBST_MATCH (A|-u=v) (A'|-t) searches for one

free instance of u in t, according to a top-down left-to-right search strategy, and then substitutes the corresponding instance of v.

    A |- u=v   A' |- t
   --------------------  SUBST_MATCH (A|-u=v) (A'|-t)
     A u A' |- t[v/u]

SUBST_MATCH allows only a free instance of u to be substituted for in t. An instance which contain bound variables can be substituted for by using rewriting rules such as

REWRITE_RULE, PURE_REWRITE_RULE and ONCE_REWRITE_RULE.

Failure

SUBST_MATCH th1 th2 fails if the conclusion of the theorem th1 is not an equation. Moreover, SUBST_MATCH (A|-u=v) (A'|-t) fails if no instance of u occurs in t, since the matching algorithm fails. No change is made to the theorem (A'|-t) if instances of u occur in t, but they are not free (see SUBS).

Example

The commutative law for addition

   #let thm1 = SPECL ["m:num"; "n:num"] ADD_SYM;;
   thm1 = |- m + n = n + m

is used to apply substitutions, depending on the occurrence of free instances

   #SUBST_MATCH thm1 (ASSUME "(n + 1) + (m - 1) = m + n");;
   . |- (m - 1) + (n + 1) = m + n
   #SUBST_MATCH thm1 (ASSUME "!n. (n + 1) + (m - 1) = m + n");;
   . |- !n. (n + 1) + (m - 1) = m + n

Uses

SUBST_MATCH is used when rewriting with the rules such as REWRITE_RULE, using a single theorem is too extensive or would diverge. Moreover, applying SUBST_MATCH can be much faster than using the rewriting rules.

See also

ONCE_REWRITE_RULE, PURE_REWRITE_RULE, REWRITE_RULE, SUBS, SUBST.

 subst_occs

subst_occs : (int list list -> (term # term) list -> term -> term)

Synopsis

Substitutes for particular occurrences of subterms of a given term.

Description

For each substitution pair ("a_i","b_i") in the second argument, there should be a corresponding integer list l_i in the first argument that specifies which free occurrences of "b_i" in the third argument should be substituted by "a_i".

Failure

Failure occurs if any substitution fails, or if the size of the first argument is not equal to the size of the second argument. In other words, every substitution pair should be accompanied by a list specifying when the substitution is applicable.

Example

#subst_occs [[1;3]] [("1","SUC 0")] "SUC 0 + SUC 0 = SUC(SUC 0)";;
"1 + (SUC 0) = SUC 1" : term
#subst_occs [[1];[1]] [("1","SUC 0");("2","SUC 1")] "SUC(SUC 0) = SUC 1";;
"SUC 1 = 2" : term
#subst_occs
#[[1];[1]] [("2","SUC(SUC 0)");("1","SUC 0")] "SUC(SUC 0) = SUC 0";;
"2 = 1" : term

See also

subst

SUBST_OCCS_TAC

SUBST_OCCS_TAC : ((int list # thm) list -> tactic)

Synopsis

Makes substitutions in a goal at specific occurrences of a term, using a list of theorems.

Description

Given a list (l1,A1|-t1=u1),...,(ln,An|-tn=un) and a goal (A,t), SUBST_OCCS_TAC re-

places each ti in t with ui, simultaneously, at the occurrences specified by the integers in the list li = [o1;...;ok] for each theorem Ai|-ti=ui.

           A ?- t
=============================  SUBST_OCCS_TAC [(l1,A1|-t1=u1);...;
 A ?- t[u1,...,un/t1,...,tn]                                (ln,An|-tn=un)]

The assumptions of the theorems used to substitute with are not added to the assumptions A of the goal, but they are recorded in the proof. If any Ai is not a subset of A (up to

alpha-conversion), SUBST_OCCS_TAC [(l1,A1|-t1=u1);...;(ln,An|-tn=un)] results in an

invalid tactic.

SUBST_OCCS_TAC automatically renames bound variables to prevent free variables in ui becoming bound after substitution.

Failure

SUBST_OCCS_TAC [(l1,th1);...;(ln,thn)] (A,t) fails if the conclusion of any theorem in

the list is not an equation. No change is made to the goal if the supplied occurrences li of the left-hand side of the conclusion of thi do not appear in t.

Example

When trying to solve the goal

   ?- (m + n) + (n + m) = (m + n) + (m + n)

applying the commutative law for addition on the third occurrence of the subterm m + n

   SUBST_OCCS_TAC [([3],SPECL ["m:num"; "n:num"] ADD_SYM)]

results in the goal

   ?- (m + n) + (n + m) = (m + n) + (n + m)

Uses

SUBST_OCCS_TAC is used when rewriting a goal at specific occurrences of a term, and

rewriting tactics such as REWRITE_TAC, PURE_REWRITE_TAC, ONCE_REWRITE_TAC, SUBST_TAC,

etc. are too extensive or would diverge.

See also

ONCE_REWRITE_TAC, PURE_REWRITE_TAC, REWRITE_TAC, SUBST1_TAC, SUBST_TAC.

 SUBST_TAC

SUBST_TAC : (thm list -> tactic)

Synopsis

Makes term substitutions in a goal using a list of theorems.

Description

  Given a list of theorems A1|-u1=v1,...,An|-un=vn and a goal (A,t), SUBST_TAC rewrites

the term t into the term t[v1,...,vn/u1,...,un] by simultaneously substituting vi for each occurrence of ui in t with vi:

              A ?- t
   =============================  SUBST_TAC [A1|-u1=v1;...;An|-un=vn]
    A ?- t[v1,...,vn/u1,...,un]

The assumptions of the theorems used to substitute with are not added to the assumptions A of the goal, while they are recorded in the proof. If any Ai is not a subset of A (up to alpha-conversion), then SUBST_TAC [A1|-u1=v1;...;An|-un=vn] results in an invalid tactic.

SUBST_TAC automatically renames bound variables to prevent free variables in vi becoming bound after substitution.

Failure

SUBST_TAC [th1;...;thn] (A,t) fails if the conclusion of any theorem in the list is not an equation. No change is made to the goal if no occurrence of the left-hand side of the conclusion of thi appears in t.

Example

When trying to solve the goal

   ?- (n + 0) + (0 + m) = m + n

by substituting with the theorems

   #let thm1 = SPECL ["m:num"; "n:num"] ADD_SYM
   #and thm2 = CONJUNCT1 ADD_CLAUSES;;
   thm1 = |- m + n = n + m
   thm2 = |- 0 + m = m

applying SUBST_TAC [thm1; thm2] results in the goal

   ?- (n + 0) + m = n + m

Uses

SUBST_TAC is used when rewriting (for example, with REWRITE_TAC) is extensive or would diverge. Substituting is also much faster than rewriting.

See also

ONCE_REWRITE_TAC, PURE_REWRITE_TAC, REWRITE_TAC, SUBST1_TAC, SUBST_ALL_TAC.

 SUBS_OCCS

SUBS_OCCS : ((int list # thm) list -> thm -> thm)

Synopsis

Makes substitutions in a theorem at specific occurrences of a term, using a list of equational theorems.

Description

Given a list (l1,A1|-t1=v1),...,(ln,An|-tn=vn) and a theorem (A|-t), SUBS_OCCS si-

multaneously replaces each ti in t with vi, at the occurrences specified by the integers in the list li = [o1;...;ok] for each theorem Ai|-ti=vi.

     (l1,A1|-t1=v1) ... (ln,An|-tn=vn)  A|-t
   -------------------------------------------  SUBS_OCCS[(l1,A1|-t1=v1);...;
    A1 u ... An u A |- t[v1,...,vn/t1,...,tn]            (ln,An|-tn=vn)] (A|-t)

Failure

SUBS_OCCS [(l1,th1);...;(ln,thn)] (A|-t) fails if the conclusion of any theorem in the

list is not an equation. No change is made to the theorem if the supplied occurrences li of the left-hand side of the conclusion of thi do not appear in t.

Example

The commutative law for addition

   #let thm = SPECL ["m:num"; "n:num"] ADD_SYM;;
   thm = |- m + n = n + m

can be used for substituting only the second occurrence of the subterm m + n

   #SUBS_OCCS [([2],thm)] (ASSUME "(n + m) + (m + n) = (m + n) + (m + n)");;
   . |- (n + m) + (m + n) = (n + m) + (m + n)

Uses

SUBS_OCCS is used when rewriting at specific occurrences of a term, and rules such as

REWRITE_RULE, PURE_REWRITE_RULE, ONCE_REWRITE_RULE, and SUBS are too extensive or

would diverge.

See also

ONCE_REWRITE_RULE, PURE_REWRITE_RULE, REWRITE_RULE, SUBS, SUBST, SUBST_MATCH.

 subtract

subtract : (* list -> * list -> * list)

Synopsis

Computes the set-theoretic difference of two ‘sets’.

\underline{SUB CONV 563}

Description

subtract l1 l2 returns a list consisting of those elements of l1 that do not appear in l2.

Failure

Never fails.

Example

#subtract [1;2;3] [3;5;4;1];;
[2] : int list
#subtract [1;2;4;1] [4;5];;
[1; 2; 1] : int list

See also

setify, set_equal, union, intersect.

 SUB_CONV

SUB_CONV : (conv -> conv)

Synopsis

Applies a conversion to the top-level subterms of a term.

Description

For any conversion c, the function returned by SUB_CONV c is a conversion that applies c to all the top-level subterms of a term. If the conversion c maps t to |- t = t', then SUB_CONV c maps an abstraction "\x.t" to the theorem:

   |- (\x.t) = (\x.t')

That is, SUB_CONV c "\x.t" applies c to the body of the abstraction "\x.t". If c is a conversion that maps "t1" to the theorem |- t1 = t1' and "t2" to the theorem |- t2 = t2', then the conversion SUB_CONV c maps an application "t1 t2" to the theorem:

   |- (t1 t2) = (t1' t2')

That is, SUB_CONV c "t1 t2" applies c to the both the operator t1 and the operand t2 of the application "t1 t2". Finally, for any conversion c, the function returned by SUB_CONV c acts as the identity conversion on variables and constants. That is, if "t" is a variable or constant, then SUB_CONV c "t" returns |- t = t.

Failure

SUB_CONV c tm fails if tm is an abstraction "\x.t" and the conversion c fails when applied to t, or if tm is an application "t1 t2" and the conversion c fails when applied to either t1 or t2. The function returned by SUB_CONV c may also fail if the ML function c:term->thm is not, in fact, a conversion (i.e. a function that maps a term t to a theorem |- t = t').

See also

ABS_CONV, RAND_CONV, RATOR_CONV.

 suspend_recording

suspend_recording : void -> void

Synopsis

Suspend proof recording temporarily.

Description

A proof is a list of inference steps. After the proof recorder is enabled, every inference performed by the system is recorded and cumulated in an internal buffer. When a proof is completed, the raw records can then be processed and output to a disk file.

suspend_recording is a low level user function for managing the proof recorder. It pauses the proof recorder until the function resume_recording is called. When the proof recorder is suspended, any inference carried out by the system will not be recorded. The internal buffer for storing the inference steps will not be cleared. When the proof recorder is resumed, the steps will be appended to what have been saved in the buffer.

The current state of the proof recorder can interrogated using the function is_recording_proof. A value of false indicates the proof recorder is disabled.

Failure

Never fail.

Comments

This function is used to implement higher level user functions for recording proof in the library record_proof. It is much more convenient to use those functions than the low level functions such as suspend_recording directly.

See also

record_proof, is_recording_proof, RecordStep, get_steps, resume_recording,
current_proof, current_proof_file, new_proof_file, close_proof_file,
begin_proof, end_proof, TAC_PROOF, PROVE, prove, prove_thm

 SWAP_EXISTS_CONV

SWAP_EXISTS_CONV : conv

Synopsis

Interchanges the order of two existentially quantified variables.

Description

When applied to a term argument of the form ?x y. P, the conversion SWAP_EXISTS_CONV returns the theorem:

   |- (?x y. P) = (?y x. P)

Failure

SWAP_EXISTS_CONV fails if applied to a term that is not of the form ?x y. P.

 SYM

SYM : (thm -> thm)

Synopsis

Swaps left-hand and right-hand sides of an equation.

Description

When applied to a theorem A |- t1 = t2, the inference rule SYM returns A |- t2 = t1.

    A |- t1 = t2
   --------------  SYM
    A |- t2 = t1

Failure

Fails unless the theorem is equational.

See also

GSYM, NOT_EQ_SYM, REFL.

 SYM_CONV
SYM_CONV : conv

Synopsis

Interchanges the left and right-hand sides of an equation.

Description

When applied to an equational term t1 = t2, the conversion SYM_CONV returns the theorem:

   |- (t1 = t2) = (t2 = t1)

Failure

Fails if applied to a term that is not an equation.

See also

SYM.
 syserror
syserror : (string -> *)

Synopsis

Prints an error message issued by the ML system.

Description

Given a string `error message`, syserror returns an ML system error with diagnostics

`error message`.

\underline{system 567}

Example

   #syserror `in ML function`;;
   ML system error in ML function
   evaluation failed     syserror

 system

system : (string -> int)

Synopsis

Executes a shell command.

Description

Escapes from HOL temporarily to execute a named shell command. The integer value returned is an error code: zero indicates successful completion of the shell command.

Example

#system `zap`;;
zap: Command not found.
1 : int
system `ls`;;
file_a              file_b             file_c
0:int

 TAC_PROOF

TAC_PROOF : ((goal # tactic) -> thm)

Synopsis

Attempts to prove a goal using a given tactic.

Description

When applied to a goal-tactic pair (A ?- t,tac), the TAC_PROOF function attempts to prove the goal A ?- t, using the tactic tac. If it succeeds, it returns the theorem A' |- t corresponding to the goal, where the assumption list A' may be a proper superset of A unless the tactic is valid; there is no inbuilt validity checking.

Failure

Fails unless the goal has hypotheses and conclusions all of type bool, and the tactic can solve the goal.

See also

PROVE, prove_thm, VALID.

 term_of_int

term_of_int : (int -> term)

Synopsis

Maps an ML integer to the corresponding numeric term.

Description

When given a non-negative integer, term_of_int returns a logical term of type :num representing the number.

Failure

Fails if the argument is less than 0.

Example

  #term_of_int 2;;
  "2" : term
  #term_of_int (-2);;
  evaluation failed     mk_const: -2 not a constant

See also

int_of_term, int_of_string, string_of_int.

 THEN

$THEN : (tactic -> tactic -> tactic)

\underline{THENC 569}

Synopsis

Applies two tactics in sequence.

Description

If T1 and T2 are tactics, T1 THEN T2 is a tactic which applies T1 to a goal, then applies the tactic T2 to all the subgoals generated. If T1 solves the goal then T2 is never applied.

Failure

The application of THEN to a pair of tactics never fails. The resulting tactic fails if T1 fails when applied to the goal, or if T2 does when applied to any of the resulting subgoals.

Comments

Although normally used to sequence tactics which generate a single subgoal, it is worth remembering that it is sometimes useful to apply the same tactic to multiple subgoals; sequences like the following:

   EQ_TAC THENL [ASM_REWRITE_TAC[]; ASM_REWRITE_TAC[]]

can be replaced by the briefer:

   EQ_TAC THEN ASM_REWRITE_TAC[]

See also

EVERY, ORELSE, THENL.

 THENC

$THENC : (conv -> conv -> conv)

Synopsis

Applies two conversions in sequence.

Description

If the conversion c1 returns |- t = t' when applied to a term "t", and c2 returns |- t' = t'' when applied to "t'", then the composite conversion (c1 THENC c2) "t" returns |- t = t''. That is, (c1 THENC c2) "t" has the effect of transforming the term "t" first with the conversion c1 and then with the conversion c2.

Failure

(c1 THENC c2) "t" fails if either the conversion c1 fails when applied to "t", or if c1 "t" succeeds and returns |- t = t' but c2 fails when applied to "t'". (c1 THENC c2) "t" may also fail if either of c1 or c2 is not, in fact, a conversion (i.e. a function that maps a term t to a theorem |- t = t').

See also

EVERY_CONV.

 THENL

$THENL : (tactic -> tactic list -> tactic)

Synopsis

Applies a list of tactics to the corresponding subgoals generated by a tactic.

Description

If T,T1,...,Tn are tactics, T THENL [T1;...;Tn] is a tactic which applies T to a goal, and if it does not fail, applies the tactics T1,...,Tn to the corresponding subgoals, unless T completely solves the goal.

Failure

The application of THENL to a tactic and tactic list never fails. The resulting tactic fails if T fails when applied to the goal, or if the goal list is not empty and its length is not the same as that of the tactic list, or finally if Ti fails when applied to the i’th subgoal generated by T.

Uses

Applying different tactics to different subgoals.

See also

EVERY, ORELSE, THEN.

 THEN_TCL

$THEN_TCL : (thm_tactical -> thm_tactical -> thm_tactical)

Synopsis

Composes two theorem-tacticals.

\underline{theorem 571}

Description

If ttl1 and ttl2 are two theorem-tacticals, ttl1 THEN_TCL ttl2 is a theorem-tactical which composes their effect; that is, if:

   ttl1 ttac th1 = ttac th2

and

   ttl2 ttac th2 = ttac th3

then

   (ttl1 THEN_TCL ttl2) ttac th1 = ttac th3

Failure

The application of THEN_TCL to a pair of theorem-tacticals never fails.

See also

EVERY_TCL, FIRST_TCL, ORELSE_TCL.

 theorem

theorem : (string -> string -> thm)

Synopsis

Reads a derived theorem from a given theory segment of the current theory.

Description

A call of theorem `thy` `th` returns the theorem named th from the theory segment thy. The theory segment thy must be part of the current theory. The name th is the name given to the theorem by the user when it was originally added to the theory segment (by, for example, a call to save_thm). The name of the current theory segment can be abbreviated by `-`.

Failure

The call theorem `thy` `th` will fail if the theory segment thy is not part of the current theory. It will fail if there does not exist a derived theorem th in theory segment thy.

Example

#theorem `arithmetic` `ADD_SYM`;;
|- !m n. m + n = n + m

See also

axiom, definition, load_theorem, load_theorems, print_theory, save_thm,
theorems.

 theorems

theorems : (string -> (string # thm) list)

Synopsis

Returns the derived theorems of a given theory segment of the current theory.

Description

A call of theorems `thy` returns the derived theorems of the theory segment thy together with their names. The theory segment thy must be part of the current theory. The names are those given to the theorems by the user when they were originally added to the theory segment (by, for example, a call to save_thm). The name of the current theory segment can be abbreviated by `-`.

Failure

The call theorems `thy` will fail if the theory segment thy is not part of the current theory.

Example

#theorems `bool`;;
[(`PAIR_EQ`, |- !x y a b. (x,y = a,b) = (x = a) /\ (y = b));
 (`SND`, |- !x y. SND(x,y) = y);
 (`FST`, |- !x y. FST(x,y) = x);
 (`PAIR`, |- !x. FST x,SND x = x);
 (`PAIR_EXISTS`, |- ?p. IS_PAIR p)]
: (string # thm) list

See also

axioms, definitions, load_theorem, load_theorems, print_theory, save_thm,
theorem.

 theorem_lfn
theorem_lfn : (string list -> thm)

Synopsis

Loads a given theorem from a given theory.

Description

If thy is an ancestor theory, and th one of its theorems, then the call

   theorem_lfn [`thy`;`th`]

will return that theorem.

Failure

Fails if thy is not an ancestor theory, or if th is not one of its theorems.

Example

#theorem_lfn [`num`;`NOT_SUC`];;
|- !n. ~(SUC n = 0)

Comments

This call has the same effect as theorem `thy` `th`.

See also

theorem, theorems, theorem_msg_lfn, load_theorem, load_theorems.
 theorem_msg_lfn
theorem_msg_lfn : (string list -> thm)

Synopsis

Loads a given theorem from a given theory, with an autoload message.

Description

If thy is an ancestor theory, and th one of its theorems, then the call

   theorem_msg_lfn [`thy`;`th`]

will print a message of the form

   Theorem th autoloaded from theory `thy`

and cancel any autoloading action associated with the name th, and will then return that theorem.

Failure

Fails if thy is not an ancestor theory, or if th is not one of its theorems.

Example

#theorem_msg_lfn [`num`; `INV_SUC`];;
Theorem INV_SUC autoloaded from theory `num`.
|- !m n. (SUC m = SUC n) ==> (m = n)

See also

autoload, autoload_theory, theorem, theorems, theorem_lfn, load_theorem,
load_theorems, undo_autoload.

 thm_count

thm_count : (void -> int)

Synopsis

Returns the current value of the theorem counter.

Description

HOL maintains a counter which is incremented every time a primitive inference is performed (or an axiom or definition set up). A call to thm_count() returns the current value of this counter

See also

set_thm_count, timer.
 thm_frees
thm_frees : (thm -> term list)

Synopsis

Returns a list of the variables free in a theorem’s assumptions and conclusion.

Description

When applied to a theorem, A |- t, the function thm_frees returns a list, without repetitions, of those variables which are free either in t or in some member of the assumption list A.

Failure

Never fails.

Example

When applied to the following theorem:

   (SUC m) < (SUC n) |- m < n

thm_frees returns the list ["m"; "n"]. The term SUC is a constant, not a variable, so that is not included.

See also

frees, freesl, free_in.
 timer
timer : (bool -> bool)

Synopsis

Switches timing and inference-counting on or off.

Description

A call timer true switches on timing and inference-counting; timer false switches it off. In either case, the previous on/off setting (true means on) is returned. When switched on, the CPU (and, if relevant, garbage collection) time and the number of intermediate theorems generated is displayed.

Failure

Never fails.

Example

This example was run from a state with timings initially switched off:

   #let th = SPEC "x:num" (theorem `arithmetic` `ADD1`);;
   th = |- SUC x = x + 1
   Run time: 0.0s
   Intermediate theorems generated: 1
   #ONCE_REWRITE_RULE[EQ_SYM_EQ] th;;
   |- x + 1 = SUC x
   Run time: 0.1s
   Intermediate theorems generated: 11
   #SYM th;;
   |- x + 1 = SUC x
   Run time: 0.0s
   Intermediate theorems generated: 1

Uses

Guiding the optimization of important proofs.

Comments

The same effect can be achieved by setting the flag timing.

See also

set_flag, set_thm_count, thm_count.

 tl

tl : (* list -> * list)

Synopsis

Computes the tail of a list (the original list less the first element).

Description

tl [x1;...;xn] returns [x2;...;xn].

Failure

Fails with tl if the list is empty.

See also

hd, el, null.

 TOP_DEPTH_CONV

TOP_DEPTH_CONV : (conv -> conv)

Synopsis

Applies a conversion top-down to all subterms, retraversing changed ones.

Description

TOP_DEPTH_CONV c tm repeatedly applies the conversion c to all the subterms of the term tm, including the term tm itself. The supplied conversion c is applied to the subterms of tm in top-down order and is applied repeatedly (zero or more times, as is done by REPEATC) at each subterm until it fails. If a subterm t is changed (up to alpha-equivalence) by virtue of the application of c to its own subterms, then the term into which t is transformed is retraversed by applying TOP_DEPTH_CONV c to it.

Failure

TOP_DEPTH_CONV c tm never fails but can diverge.

Comments

The implementation of this function uses failure to avoid rebuilding unchanged subterms. That is to say, during execution the failure string `QCONV` may be generated and later trapped. The behaviour of the function is dependent on this use of failure. So, if the conversion given as argument happens to generate a failure with string `QCONV`, the operation of TOP_DEPTH_CONV will be unpredictable.

See also

DEPTH_CONV, ONCE_DEPTH_CONV, REDEPTH_CONV, REW_DEPTH_CONV.

 top_goal

top_goal : (void -> goal)

Synopsis

Returns the current goal of the subgoal package.

Description

The function top_goal is part of the subgoal package. It returns the top goal of the goal stack in the current proof state. For a description of the subgoal package, see set_goal.

Failure

A call to top_goal will fail if there are no unproven goals. This could be because no goal has been set using set_goal or because the last goal set has been completely proved.

Uses

Examining the proof state after a proof fails.

See also

b, backup, backup_limit, e, expand, expandf, g, get_state, p, print_state, r,
rotate, save_top_thm, set_goal, set_state, top_thm.

 top_print

top_print : ((* -> **) -> (* -> **))

Synopsis

Allows user-supplied functions to be used for printing ML datatypes (including types, terms and theorems).

Description

top_print is not a proper ML function, but an ML construct. It can only be used at toplevel; otherwise an error will result. The type given above for it is therefore somewhat bogus. Its argument should normally be a printing function f:ty->void. top_print f then instructs the system to use the function f whenever it has a value of type ty to print. The ‘call’ to top_print returns f as its result.

Failure

Fails if used anywhere other than at top-level.

Example

The following example illustrates how values of an abstract type can be made to print nicely using top_print. For brevity, most of the functions that would really be defined in the abstract type have been omitted.

   #abstype rat = int # int
   #with mk_rat (n,d) = abs_rat (n,d)
   #and print_rat r =
   #       let (n,d) = rep_rat r
   #       in  if (d = 1)
   #           then print_int n
   #           else do (print_int n; print_string `/`; print_int d);;
   mk_rat = - : ((int # int) -> rat)
   print_rat = - : (rat -> void)
   #mk_rat (2,3);;
   - : rat
   #top_print print_rat;;
   - : (rat -> void)
   #mk_rat (2,3);;
   2/3 : rat
   #mk_rat (3,1);;
   3 : rat

Uses

Useful for defining the printing of abstract types, including terms, theorems and types. In particular, calling top_print with print_all_thm as argument will cause the hypotheses of theorems to be printed in full, rather than simply as a period (dot, full-stop).

See also

assignable_print_term, new_syntax_block.

 top_proof

top_proof : (subgoals list -> thm)

Synopsis

This function is for internal use only and is to be deleted from a future version of the system. It should not be used.

 top_thm

top_thm : (void -> thm)

Synopsis

Returns the theorem just proved using the subgoal package.

Description

The function top_thm is part of the subgoal package. A proof state of the package consists of either goal and justification stacks if a proof is in progress or a theorem if a proof has just been completed. If the proof state consists of a theorem, top_thm returns that theorem. For a description of the subgoal package, see set_goal.

Failure

top_thm will fail if the proof state does not hold a theorem. This will be so either because no goal has been set or because a proof is in progress with unproven subgoals.

Uses

Accessing the result of an interactive proof session with the subgoal package.

See also

b, backup, backup_limit, e, expand, expandf, g, get_state, p, print_state, r,
rotate, save_top_thm, set_goal, set_state, top_goal.

 TRANS

$TRANS : (thm -> thm -> thm)

Synopsis

Uses transitivity of equality on two equational theorems.

\underline{TRY 581}

Description

When applied to a theorem A1 |- t1 = t2 and a theorem A2 |- t2 = t3, the inference rule TRANS returns the theorem A1 u A2 |- t1 = t3. Note that TRANS can also be used as a infix (see example below).

    A1 |- t1 = t2   A2 |- t2 = t3
   -------------------------------  TRANS
         A1 u A2 |- t1 = t3

Failure

Fails unless the theorems are equational, with the right side of the first being the same as the left side of the second.

Example

The following shows identical uses of TRANS, one as a prefix, one an infix.

   #let t1 = ASSUME "a:bool = b" and t2 = ASSUME "b:bool = c";;
   t1 = . |- a = b
   t2 = . |- b = c
   #TRANS t1 t2;;
   .. |- a = c
   #t1 TRANS t2;;
   .. |- a = c

See also

EQ_MP, IMP_TRANS, REFL, SYM.

 TRY

TRY : (tactic -> tactic)

Synopsis

Makes a tactic have no effect rather than fail.

Description

For any tactic T, the application TRY T gives a new tactic which has the same effect as T if that succeeds, and otherwise has no effect.

Failure

The application of TRY to a tactic never fails. The resulting tactic never fails.

See also

CHANGED_TAC, VALID.

 tryfind

tryfind : ((* -> **) -> * list -> **)

Synopsis

Returns the result of the first successful application of a function to the elements of a list.

Description

tryfind f [x1;...;xn] returns (f xi) for the first xi in the list for which application of f succeeds.

Failure

Fails with tryfind if the application of the function fails for all elements in the list. This will always be the case if the list is empty.

See also

find, mem, exists, forall, assoc, rev_assoc.

 TRY_CONV

TRY_CONV : (conv -> conv)

Synopsis

Attempts to apply a conversion; applies identity conversion in case of failure.

Description

TRY_CONV c "t" attempts to apply the conversion c to the term "t"; if this fails, then the identity conversion applied instead. That is, if c is a conversion that maps a term "t" to the theorem |- t = t', then the conversion TRY_CONV c also maps "t" to |- t = t'. But if c fails when applied to "t", then TRY_CONV c "t" returns |- t = t.

\underline{tty read 583}

Failure

Never fails.

See also

ALL_CONV.

 tty_read

tty_read : (void -> string)

Synopsis

Reads a single character from the standard input.

Description

The call tty_read() will read a single character from the standard input, which in an interactive HOL session will normally be the terminal.

Failure

Will only fail under obscure system-dependent circumstances.

Example

The following example shows how a check on the deletion of a file might be implemented:

   #tty_write `Delete GONK.th (y/n)?`;
   #tty_read()=`y` => unlink `GONK.th` | ();;
   Delete GONK.th (y/n)?n
   () : void
   Run time: 0.0s

Comments

Only one character is read per call of tty_read(), and remaining characters will be passed to the ML interpreter as usual. It is of course possible to make multiple calls to tty_read() (e.g. via a while loop) to read in a longer string.

See also

append_openw, close, openi, openw, read, tty_write, write.

 tty_write

tty_write : (string -> void)

Synopsis

Writes a string to the standard output.

Description

The call tty_write s will write the string s to the standard output, which in an interactive HOL session will normally be the screen.

Failure

Will only fail under unusual system-dependent circumstances, for example if the standard output cannot be written.

See also

append_openw, close, openi, openw, read, tty_read, write.

 types

types : (string -> (int # string) list)

Synopsis

Lists the types in the named theory.

Description

The function types should be applied to a string which is the name of an ancestor theory (including the current theory; the special string `-` is always interpreted as the current theory). It returns a list of all the type constructors declared in the named theory, in the form of arity-name pairs.

Failure

Fails unless the named theory is an ancestor. type abbrevs 585

Example

The theory HOL has no types declared:

#types `HOL`;;
[] : (int # string) list

but its ancestors have the following types declared:

#itlist union (map types (ancestors `HOL`)) [];;
[(2, `fun`);
(2, `prod`);
(0, `bool`);
(0, `ind`);
(0, `num`);
(1, `list`);
(0, `tree`);
(1, `ltree`);
(2, `sum`);
(0, `one`)]
: (int # string) list

See also

ancestors, axioms, constants, definitions, infixes, new_type, new_type_abbrev,
new_type_definition, parents.

type_abbrevs

type_abbrevs : (string -> (string # type) list)

Synopsis

Lists the type abbreviations in a named theory.

Description

Given the name of a theory, type_abbrevs returns a list of pairs; each pair contains the abbreviation and the actual type it denotes.

Failure

Fails if the named theory is not an ancestor of the current theory.

Example

#load_library `string`;;
Loading library `string` ...
Updating search path
.Updating help search path
.Declaring theory string a new parent
Theory string loaded
......
Library `string` loaded.
() : void
#type_abbrevs `string`;;
[(`tok`, ":string")] : (string # type) list

See also

new_type_abbrev

 type_in

type_in : (type -> term -> bool)

Synopsis

Determines whether any subterm of a given term has a particular type.

Description

The predicate type_in returns true if a subterm of the second argument has the type specified by the first argument.

Example

#type_in ":num" "5 = 4 + 1";;
true : bool
#type_in ":bool" "5 = 4 + 1";;
true : bool
#type_in ":(num)list" "SUC 0";;
false : bool

See also

find_term, find_terms, type_in_type, type_tyvars.

type in type 587

type_in_type
type_in_type : (type -> type -> bool)

Synopsis

Determines whether a given type is a subtype of another.

Description

The predicate type_in_type returns true if the type given as the first argument is a subtype of the second.

Example

#type_in_type ":num" ":num # bool";;
true : bool
#type_in_type ":num" ":(num)list";;
true :bool
#type_in_type ":bool" ":num + bool";;
true : bool

See also

find_term, find_terms, type_in
type_of
type_of : (term -> type)

Synopsis

Returns the type of a term.

Failure

Never fails.

588 Chapter 1. Pre-defined ML Identifiers

Example

#type_of "T";;
":bool" : type

 type_tyvars
type_tyvars : (type -> type list)

Synopsis

Determines the type variables of a given type.

Description

The function type_tyvars returns a list of type variables used to construct the given type.

Example

#type_tyvars ":bool";;
[] : type list
#type_tyvars ":(* -> **) -> (bool # ***) -> (** + num)";;
[":*"; ":**"; ":***"] : type list

See also

type_abbrevs, type_in, type_in_type.
 tyvars
tyvars : (term -> type list)

Synopsis

Returns a list of the type variables free in a term.

Description

When applied to a term, tyvars returns a list (possibly empty) of the type variables which are free in the term.

\underline{tyvarsl 589}

Failure

Never fails.

Example

#PAIR;;
|- !x. FST x,SND x = x
#tyvars (concl PAIR);;
[":*"; ":**"] : type list
#tyvars "x + 1 = SUC x";;
[] : type list

Comments

In the current HOL logic, there is no binding operation for types, so ‘is free in’ is synonymous with ‘appears in’.

See also

tyvarsl.

 tyvarsl

tyvarsl : (term list -> type list)

Synopsis

Returns a list of the type variables free in a list of terms.

Description

When applied to a list of terms, tyvarsl returns a list (possibly empty) of the type variables which are free in any of those terms.

Failure

Never fails.

Example

#tyvarsl ["!x. x = 1"; "!x:*. x = x"];;
[":*"] : type list

Uses

Finding all the free type variables in the assumptions of a theorem, as a check on the validity of certain inferences.

Comments

In the current HOL logic, there is no binding operation for types, so ‘is free in’ is synonymous with ‘appears in’.

See also

tyvars.

 uncurry

uncurry : ((* -> ** -> ***) -> (* # **) -> ***)

Synopsis

Converts a function taking two arguments into a function taking a single paired argument.

Description

The application uncurry f returns \(x,y). f x y, so that

   uncurry f (x,y) = f x y

Failure

Never fails.

See also

curry.

 UNDISCH

UNDISCH : (thm -> thm)

Synopsis

Undischarges the antecedent of an implicative theorem.

Description

    A |- t1 ==> t2
   ----------------  UNDISCH
     A, t1 |- t2
Note that UNDISCH treats "~u" as "u ==> F".

UNDISCH ALL 591

Failure

UNDISCH will fail on theorems which are not implications or negations.

Comments

If the antecedent already appears in the hypotheses, it will not be duplicated. However, unlike DISCH, if the antecedent is alpha-equivalent to one of the hypotheses, it will still be added to the hypotheses.

See also

DISCH, DISCH_ALL, DISCH_TAC, DISCH_THEN, FILTER_DISCH_TAC, FILTER_DISCH_THEN,
NEG_DISCH, STRIP_TAC, UNDISCH_ALL, UNDISCH_TAC.
 UNDISCH_ALL
UNDISCH_ALL : (thm -> thm)

Synopsis

Iteratively undischarges antecedents in a chain of implications.

Description

    A |- t1 ==> ... ==> tn ==> t
   ------------------------------  UNDISCH_ALL
        A, t1, ..., tn |- t
Note that UNDISCH_ALL treats "~u" as "u ==> F".

Failure

Unlike UNDISCH, UNDISCH_ALL will, when called on something other than an implication or negation, return its argument unchanged rather than failing.

Comments

Identical terms which are repeated in A, "t1", ..., "tn" will not be duplicated in the hypotheses of the resulting theorem. However, if two or more alpha-equivalent terms appear in A, "t1", ..., "tn", then each distinct term will appear in the result.

See also

DISCH, DISCH_ALL, DISCH_TAC, DISCH_THEN, NEG_DISCH, FILTER_DISCH_TAC,
FILTER_DISCH_THEN, STRIP_TAC, UNDISCH, UNDISCH_TAC.

 UNDISCH_TAC

UNDISCH_TAC : (term -> tactic)

Synopsis

Undischarges an assumption.

Description

          A ?- t
   ====================  UNDISCH_TAC "v"
    A - {v} ?- v ==> t

Failure

UNDISCH_TAC will fail if "v" is not an assumption.

Comments

UNDISCHarging "v" will remove all assumptions which are identical to "v", but those which are alpha-equivalent will remain.

See also

DISCH, DISCH_ALL, DISCH_TAC, DISCH_THEN, NEG_DISCH, FILTER_DISCH_TAC,
FILTER_DISCH_THEN, STRIP_TAC, UNDISCH, UNDISCH_ALL.

 undo_autoload

undo_autoload : (string -> bool)

Synopsis

Cancels the autoloading action associated with a name.

Description

A call undo_autoload `name` cancels any autoloading action associated with the identifier name, whether this was specified by the general autoload function, or the more specialized autoload_theory. For more details of the autoloading mechanism, see the reference entries for those functions, or the DESCRIPTION. The call to undo_autoload returns true if there was an autoload action associated with that name, and false otherwise.

Failure

Never fails.

See also

autoload, autoload_theory, let_after, let_before.

 unhide_constant

unhide_constant : (string -> void)

Synopsis

Restores recognition of a constant by the quotation parser.

Description

A call unhide_constant `c`, where c is a hidden constant, will unhide the constant, that is, will make the quotation parser recognize it as such rather than parsing it as a variable. It reverses the effect of the call hide_constant name.

Failure

Fails unless the given name is a hidden constant in the current theory.

Comments

The hiding of a constant only affects the quotation parser; the constant is still there in a theory, and may not be redefined.

See also

hide_constant.

 union

union : (* list -> * list -> * list)

Synopsis

Computes the union of two ‘sets’.

Description

union l1 l2 returns a list consisting of l1 concatenated with those elements of l2 which are not in l1.

Failure

Never fails.

Example

#union [1;2;3] [1;5;4;3];;
[1; 2; 3; 5; 4] : int list
#union [1;1;1] [1;2;3;2];;
[1; 1; 1; 2; 3; 2] : int list

See also

setify, set_equal, intersect, subtract.

 unlink

unlink : (string -> void)

Synopsis

Deletes a file.

Description

If name is the name of an existing file, then unlink `name` will remove that file (if there are other links to the file, this will merely remove a single link). Under Unix, the effect is the same as the rm command.

Failure

A call to unlink may fail in various system-related ways, in particular if name does not exist or the user does not have write permission for the current directory.

Comments

This call is somewhat Unix-related, and may behave differently under other operating systems.

See also

link, system.

 VALID

VALID : (tactic -> tactic)

\underline{variant 595}

Synopsis

Tries to ensure that a tactic is valid.

Description

For any tactic T, the application VALID T gives a new tactic which when applied to a goal, checks that T as applied to that goal is valid, i.e. the subgoals produced, if proved, can be used by the justification function given by T to construct a theorem corresponding to the original goal.

This check is performed by actually creating, using mk_thm, theorems corresponding to the subgoals, and seeing if the result of applying the justification function to them gives a theorem corresponding to the original goal. If it does, then VALID T simply applies T, and if not it fails.

The method by which theorems are created from goals can be changed by rebinding the assignable variable chktac - see its documentation entry for details.

Failure

The application of VALID to a tactic never fails. The resulting tactic fails either if the original tactic fails or is invalid.

Comments

The use of mk_thm is a possible, though improbable, loophole in the general security of the theorem abstract type, since it does create possibly spurious theorems; however these should remain anonymous in the absence of other bugs in the system.

By default the same validity checking procedure, check_valid, is invoked by the subgoal package, but it can be switched off.

It is not checked whether the tactic is strongly valid, i.e. the subgoals are provable; clearly this is not possible in general.

See also

CHANGED_TAC, check_valid, chktac, e, expand, TRY.

 variant

variant : (term list -> term -> term)

Synopsis

Modifies a variable name to avoid clashes.

Description

When applied to a list of variables to avoid clashing with, and a variable to modify, variant returns a variant of the variable to modify, that is, it changes the name as intuitively as possible to make it distinct from any variables in the list, or any (non-hidden) constants. This is normally done by adding primes to the name.

The exact form of the variable name should not be relied on, except that the original variable will be returned unmodified unless it is itself in the list to avoid clashing with.

Failure

variant l t fails if any term in the list l is not a variable or if t is neither a variable nor a constant.

Example

The following shows a couple of typical cases:

   #variant ["y:bool"; "z:bool"] "x:bool";;
   "x" : term
   #variant ["x:bool"; "x':num"; "x'':num"] "x:bool";;
   "x'''" : term

while the following shows that clashes with the names of constants are also avoided:

   #variant [] (mk_var(`T`,":bool"));;
   "T'" : term

Uses

The function variant is extremely useful for complicated derived rules which need to rename variables to avoid free variable capture while still making the role of the variable obvious to the user.

See also

genvar, hide_constant.

 vars

vars : (term -> term list)

Synopsis

Determines the variables used in a given term.

\underline{varsl 597}

Description

Given a term argument, vars returns a list of variables that occur in that term.

Example

#vars "\a:bool. a";;
["a"] : term list
#vars "\b:*. SUC 0";;
["b"] : term list
#vars "(a:num) + (b:num)";;
["a"; "b"] : term list

See also

varsl.

 varsl

varsl : (term list -> term list)

Synopsis

Returns the union of the variables that occur in a given list of terms.

Description

Given a list of terms, varsl returns a list of all the variables that occur in the list of terms.

Example

#varsl ["\a:bool. a"];;
["a"] : term list
#vars "[(a:num) + (b:num); 3 + (a:num) + SUC n]";;
["a"; "b"; "n"] : term list

See also

vars.

 version
version : (void -> int)

Synopsis

Returns the version number of the HOL system being run.

Description

The number is imagined to have a ‘decimal point’ before its last two digits to give the actual version number.

Example

          _________
   |___|__|   |  |   |     |__|  |__|
   |      |  |   |__|   |__|__|  |__|
          Version 2 (Sun4/Allegro 4.0), built on 22/6/91
#version();;
200 : int

 W
W : ((* -> * -> **) -> * -> **)

Synopsis

Duplicates function argument : W f x = f x x.

Failure

Never fails.

See also

#, B, C, CB, Co, I, K, KI, o, oo, S.
 words
words : (string -> string list)

\underline{words2 599}

Synopsis

Splits a string into a list of words.

Description

words s splits the string s into a list of substrings. Splitting occurs at each sequence of blanks and carriage returns (white space). This white space does not appear in the list of substrings. Leading and trailing white space in the input string is also thrown away.

Failure

Never fails.

Example

#words `  the cat  sat on   the mat `;;
[`the`; `cat`; `sat`; `on`; `the`; `mat`] : string list

Uses

Useful when wanting to map a function over a list of constant strings. Instead of using

[`string1`;...;`stringn`] one can use:
   (words `string1 ... stringn`)

See also

words2, word_separators, maptok, explode.

 words2

words2 : (string -> string -> string list)

Synopsis

Splits a string into a list of substrings, breaking at occurrences of a specified character.

Description

words2 char s splits the string s into a list of substrings. Splitting occurs at each occurrence of a sequence of the character char. The char characters do not appear in the list of substrings. Leading and trailing occurrences of char are also thrown away. If char is not a single-character string (its length is not 1), then s will not be split and so the result will be the list [s].

Failure

Never fails.

Example

#words2 `/` `/the/cat//sat/on//the/mat/`;;
[`the`; `cat`; `sat`; `on`; `the`; `mat`] : string list
#words2 `//` `/the/cat//sat/on//the/mat/`;;
[`/the/cat//sat/on//the/mat/`] : string list

See also

words, word_separators, explode.

 word_separators

word_separators : string list

Synopsis

A list of white-space characters used when splitting a string into words.

Description

word_separators is a two-element list of single-character strings. The two characters are the space character (or blank) and the carriage-return character. These are the characters that are considered to be word separators by the function words.

Example

#word_separators;;
[` `; `
`] : string list

See also

words.

 write

write : ((string # string) -> void)

Synopsis

Writes characters to a file.

Description

The call write(port,`characters`), where characters is a string of characters to write, and port is a string describing a port (a port is the standard ML file descriptor, normally obtained from a call to openw or append_openw), will write the given characters to the file corresponding to the port.

Failure

May fail or hang in system-dependent ways when given an invalid port descriptor.

Example

The following assumes that HOL is being run under Unix. It will overwrite any existing file test-file in the current directory. Notice that the actual string returned by openw may vary on other systems.

   #let port = openw `test-file`;;
   port = `%test-file` : string
   #write(port,`Hello world`);;
   () : void
   #close port;;
   () : void
   #system `cat test-file`;;
   Hello world0 : int

See also

append_openw, close, openi, openw, read, tty_read, tty_write.

 X_CASES_THEN

X_CASES_THEN : (term list list -> thm_tactical)

Synopsis

Applies a theorem-tactic to all disjuncts of a theorem, choosing witnesses.

Description

Let [yl1;...;yln] represent a list of variable lists, each of length zero or more, and xl1,...,xln each represent a vector of zero or more variables, so that the variables in each of yl1...yln have the same types as the corresponding xli. X_CASES_THEN expects such a list of variable lists, [yl1;...;yln], a tactic generating function f:thm->tactic, and a disjunctive theorem, where each disjunct may be existentially quantified:

   th = |-(?xl1.B1)  \/...\/  (?xln.Bn)

each disjunct having the form (?xi1 ... xim. Bi). If applying f to the theorem obtained by introducing witness variables yli for the objects xli whose existence is asserted by each disjunct, typically ({Bi[yli/xli]} |- Bi[yli/xli]), produce the following results when applied to a goal (A ?- t):

    A ?- t
   ========= f ({B1[yl1/xl1]} |- B1[yl1/xl1])
    A ?- t1
    ...
    A ?- t
   =========  f ({Bn[yln/xln]} |- Bn[yln/xln])
    A ?- tn
then applying (X_CHOOSE_THEN [yl1;...;yln] f th) to the goal (A ?- t) produces n sub-

goals.

           A ?- t
   =======================  X_CHOOSE_THEN [yl1;...;yln] f th
    A ?- t1  ...  A ?- tn

Failure

Fails (with X_CHOOSE_THEN) if any yli has more variables than the corresponding xli, or (with SUBST) if corresponding variables have different types. Failures may arise in the tactic-generating function. An invalid tactic is produced if any variable in any of the yli is free in the corresponding Bi or in t, or if the theorem has any hypothesis which is not alpha-convertible to an assumption of the goal.

Example

Given the goal ?- (x MOD 2) <= 1, the following theorem may be used to split into 2 cases:

   th = |- (?m. x = 2 * m) \/ (?m. x = (2 * m) + 1)
by the tactic X_CASES_THEN [["n:num"];["n:num"]] ASSUME_TAC th to produce the sub-

goals:

   {x = (2 * n) + 1} ?- (x MOD 2) <= 1
   {x = 2 * n} ?- (x MOD 2) <= 1

See also

DISJ_CASES_THENL, X_CASES_THENL, X_CHOOSE_THEN.

 X_CASES_THENL

X_CASES_THENL : (term list list -> thm_tactic list -> thm_tactic)

Synopsis

Applies theorem-tactics to corresponding disjuncts of a theorem, choosing witnesses.

Description

Let [yl1;...;yln] represent a list of variable lists, each of length zero or more, and xl1,...,xln each represent a vector of zero or more variables, so that the variables in each of yl1...yln have the same types as the corresponding xli. The function X_CASES_THENL expects a list of variable lists, [yl1;...;yln], a list of tactic-generating functions [f1;...;fn]:(thm->tactic)list, and a disjunctive theorem, where each disjunct may be existentially quantified:

   th = |-(?xl1.B1)  \/...\/  (?xln.Bn)

each disjunct having the form (?xi1 ... xim. Bi). If applying each fi to the theorem obtained by introducing witness variables yli for the objects xli whose existence is asserted by the ith disjunct, ({Bi[yli/xli]} |- Bi[yli/xli]), produces the following results when applied to a goal (A ?- t):

    A ?- t
   =========  f1 ({B1[yl1/xl1]} |- B1[yl1/xl1])
    A ?- t1
    ...
    A ?- t
   =========  fn ({Bn[yln/xln]} |- Bn[yln/xln])
    A ?- tn
then applying X_CASES_THENL [yl1;...;yln] [f1;...;fn] th to the goal (A ?- t) pro-

duces n subgoals.

           A ?- t
   =======================  X_CASES_THENL [yl1;...;yln] [f1;...;fn] th
    A ?- t1  ...  A ?- tn

Failure

Fails (with X_CASES_THENL) if any yli has more variables than the corresponding xli, or (with SUBST) if corresponding variables have different types, or (with combine) if the number of theorem tactics differs from the number of disjuncts. Failures may arise in the tactic-generating function. An invalid tactic is produced if any variable in any of the yli is free in the corresponding Bi or in t, or if the theorem has any hypothesis which is not alpha-convertible to an assumption of the goal.

Example

Given the goal ?- (x MOD 2) <= 1, the following theorem may be used to split into 2 cases:

   th = |- (?m. x = 2 * m) \/ (?m. x = (2 * m) + 1)
by the tactic X_CASES_THENL [["n:num"];["n:num"]] [ASSUME_TAC; SUBST1_TAC] th to

produce the subgoals:

   ?- (((2 * n) + 1) MOD 2) <= 1
   {x = 2 * n} ?- (x MOD 2) <= 1

See also

DISJ_CASES_THEN, X_CASES_THEN, X_CHOOSE_THEN.

 X_CHOOSE_TAC

X_CHOOSE_TAC : (term -> thm_tactic)

Synopsis

Assumes a theorem, with existentially quantified variable replaced by a given witness.

Description

X_CHOOSE_TAC expects a variable y and theorem with an existentially quantified conclusion. When applied to a goal, it adds a new assumption obtained by introducing the variable y as a witness for the object x whose existence is asserted in the theorem.

           A ?- t
   ===================  X_CHOOSE_TAC "y" (A1 |- ?x. w)
    A u {w[y/x]} ?- t         ("y" not free anywhere)

Failure

Fails if the theorem’s conclusion is not existentially quantified, or if the first argument is not a variable. Failures may arise in the tactic-generating function. An invalid tactic is produced if the introduced variable is free in w or t, or if the theorem has any hypothesis which is not alpha-convertible to an assumption of the goal.

Example

Given a goal of the form

   {n < m} ?- ?x. m = n + (x + 1)

the following theorem may be applied:

   th = ["n < m"] |- ?p. m = n + p

by the tactic (X_CHOOSE_TAC "q:num" th) giving the subgoal:

   {n < m, m = n + q} ?- ?x. m = n + (x + 1)

See also

CHOOSE, CHOOSE_THEN, X_CHOOSE_THEN.

 X_CHOOSE_THEN

X_CHOOSE_THEN : (term -> thm_tactical)

Synopsis

Replaces existentially quantified variable with given witness, and passes it to a theoremtactic.

Description

X_CHOOSE_THEN expects a variable y, a tactic-generating function f:thm->tactic, and a theorem of the form (A1 |- ?x. w) as arguments. A new theorem is created by introducing the given variable y as a witness for the object x whose existence is asserted in the original theorem, (w[y/x] |- w[y/x]). If the tactic-generating function f applied to this theorem produces results as follows when applied to a goal (A ?- t):

    A ?- t
   =========  f ({w[y/x]} |- w[y/x])
    A ?- t1
then applying (X_CHOOSE_THEN "y" f (A1 |- ?x. w)) to the goal (A ?- t) produces the

subgoal:

    A ?- t
   =========  X_CHOOSE_THEN "y" f (A1 |- ?x. w)
    A ?- t1         ("y" not free anywhere)

Failure

Fails if the theorem’s conclusion is not existentially quantified, or if the first argument is not a variable. Failures may arise in the tactic-generating function. An invalid tactic is produced if the introduced variable is free in w or t, or if the theorem has any hypothesis which is not alpha-convertible to an assumption of the goal.

Example

Given a goal of the form

   {n < m} ?- ?x. m = n + (x + 1)

the following theorem may be applied:

   th = ["n < m"] |- ?p. m = n + p
by the tactic (X_CHOOSE_THEN "q:num" SUBST1_TAC th) giving the subgoal:
   {n < m} ?- ?x. n + q = n + (x + 1)

See also

CHOOSE, CHOOSE_THEN, CONJUNCTS_THEN, CONJUNCTS_THEN2, DISJ_CASES_THEN,
DISJ_CASES_THEN2, DISJ_CASES_THENL, STRIP_THM_THEN, X_CHOOSE_TAC.

 X_FUN_EQ_CONV

X_FUN_EQ_CONV : (term -> conv)

Synopsis

Performs extensionality conversion for functions (function equality).

Description

The conversion X_FUN_EQ_CONV embodies the fact that two functions are equal precisely when they give the same results for all values to which they can be applied. For any variable "x" and equation "f = g", where x is of type ty1 and f and g are functions of type ty1->ty2, a call to X_FUN_EQ_CONV "x" "f = g" returns the theorem:

   |- (f = g) = (!x. f x = g x)

Failure

X_FUN_EQ_CONV x tm fails if x is not a variable or if tm is not an equation f = g where f and g are functions. Furthermore, if f and g are functions of type ty1->ty2, then the variable x must have type ty1; otherwise the conversion fails. Finally, failure also occurs if x is free in either f or g.

See also

EXT, FUN_EQ_CONV.

 X_GEN_TAC

X_GEN_TAC : (term -> tactic)

Synopsis

Specializes a goal with the given variable.

Description

When applied to a term x', which should be a variable, and a goal A ?- !x. t, the tactic

X_GEN_TAC returns the goal A ?- t[x'/x].
     A ?- !x. t
   ==============  X_GEN_TAC "x'"
    A ?- t[x'/x]

Failure

Fails unless the goal’s conclusion is universally quantified and the term a variable of the appropriate type. It also fails if the variable given is free in either the assumptions or (initial) conclusion of the goal.

See also

FILTER_GEN_TAC, GEN, GENL, GEN_ALL, SPEC, SPECL, SPEC_ALL, SPEC_TAC, STRIP_TAC.

 X_SKOLEM_CONV

X_SKOLEM_CONV : (term -> conv)

Synopsis

Introduces a user-supplied Skolem function.

Description

X_SKOLEM_CONV takes two arguments. The first is a variable f, which must range over functions of the appropriate type, and the second is a term of the form !x1...xn. ?y. P. Given these arguments, X_SKOLEM_CONV returns the theorem:

   |- (!x1...xn. ?y. P) = (?f. !x1...xn. tm[f x1 ... xn/y])

which expresses the fact that a skolem function f of the universally quantified variables x1...xn may be introduced in place of the the existentially quantified value y.

Failure

X_SKOLEM_CONV f tm fails if f is not a variable, or if the input term tm is not a term of the form !x1...xn. ?y. P (with at least one universally quantified variable), or if the variable f is free in tm, or if the type of f does not match its intended use as an n-place curried function from the variables x1...xn to a value having the same type as y.

See also

SKOLEM_CONV.

Chapter 2

Pre-proved Theorems

The sections that follow list all the theorems built into the HOL system. These include theorems proved and bound to ML identifiers when the system is built, and theorems proved when the system is built and then stored in a built-in theory file. The latter are usually (but not always) set up to autoload when their names are mentioned in ML.

Theorems are listed in alphabetical order, by the name of the ML identifier to which they are bound or the name under which they are stored in a built-in theory file. Theory names are given after the names of theorems, in parentheses. The theory name ‘none’ indicates that the theorem in question is not stored in any built-in theory.

2.1 Definitions of Basic Logical Constants

AND_DEF (bool)
  |- $/\ = (\t1 t2. !t. (t1 ==> t2 ==> t) ==> t)
EXISTS_DEF (bool)
  |- $? = (\P. P($@ P))
EXISTS_UNIQUE_DEF (bool)
  |- $?! = (\P. $? P /\ (!x y. P x /\ P y ==> (x = y)))
FORALL_DEF (bool)
  |- $! = (\P. P = (\x. T))
F_DEF (bool)
  |- F = (!t. t)
NOT_DEF (bool)
  |- $~ = (\t. t ==> F)
OR_DEF (bool)
  |- $\/ = (\t1 t2. !t. (t1 ==> t) ==> (t2 ==> t) ==> t)
T_DEF (bool)
  |- T = ((\x. x) = (\x. x))

610 Chapter 2. Pre-proved Theorems

2.2 Constants for syntactic abbreviations

ARB (bool)
  |- ARB = (@x. T)
COND_DEF (bool)
  |- COND =
     (\t t1 t2. @x. ((t = T) ==> (x = t1)) /\ ((t = F) ==> (x = t2)))
LET_DEF (bool)
  |- LET = (\f x. f x)
RES_ABSTRACT (bool)
  |- !P B. RES_ABSTRACT P B = (\x. (P x => B x | ARB))
RES_EXISTS (bool)
  |- !P B. RES_EXISTS P B = (?x. P x /\ B x)
RES_FORALL (bool)
  |- !P B. RES_FORALL P B = (!x. P x ==> B x)
RES_SELECT (bool)
  |- !P B. RES_SELECT P B = (@x. P x /\ B x)

2.3 Axioms

ARB_THM (bool)
  |- $= = $=
BOOL_CASES_AX (bool)
  |- !t. (t = T) \/ (t = F)
ETA_AX (bool)
  |- !t. (\x. t x) = t
IMP_ANTISYM_AX (bool)
  |- !t1 t2. (t1 ==> t2) ==> (t2 ==> t1) ==> (t1 = t2)
INFINITY_AX (ind)
  |- ?f. ONE_ONE f /\ ~ONTO f
SELECT_AX (bool)
  |- !P x. P x ==> P($@ P)

2.4. Logical tautologies 611

2.4 Logical tautologies

AND1_THM (none)
  |- !t1 t2. t1 /\ t2 ==> t1
AND2_THM (none)
  |- !t1 t2. t1 /\ t2 ==> t2
AND_CLAUSES (none)
  |- !t. (T /\ t) = t /\
         (t /\ T) = t /\
         (F /\ t) = F /\
         (t /\ F) = F /\
         (t /\ t) = t
AND_IMP_INTRO (none)
  |- !t1 t2 t3. t1 ==> t2 ==> t3 = t1 /\ t2 ==> t3
AND_INTRO_THM (none)
  |- !t1 t2. t1 ==> t2 ==> t1 /\ t2
BOOL_EQ_DISTINCT (none)
  |- ~(T = F) /\ ~(F = T)
COND_ABS (none)
  |- !b f g. (\x. (b => f x | g x)) = (b => f | g)
COND_CLAUSES (none)
  |- !t1 t2. ((T => t1 | t2) = t1) /\ ((F => t1 | t2) = t2)
COND_EXPAND (none)
  |- !b t1 t2. (b => t1 | t2) = (~b \/ t1) /\ (b \/ t2)
COND_ID (none)
  |- !b t. (b => t | t) = t
COND_RAND (none)
  |- !f b x y. f(b => x | y) = (b => f x | f y)
COND_RATOR (none)
  |- !b f g x. (b => f | g)x = (b => f x | g x)
CONJ_ASSOC (none)
  |- !t1 t2 t3. t1 /\ (t2 /\ t3) = (t1 /\ t2) /\ t3

CONJ_SYM (none)
  |- !t1 t2. (t1 /\ t2) = (t2 /\ t1)
DE_MORGAN_THM (none)
  |- !t1 t2. (~(t1 /\ t2) = ~t1 \/ ~t2) /\ (~(t1 \/ t2) = ~t1 /\ ~t2)
DISJ_ASSOC (none)
  |- !t1 t2 t3. t1 \/ t2 \/ t3 = (t1 \/ t2) \/ t3
DISJ_SYM (none)
  |- !t1 t2. t1 \/ t2 = t2 \/ t1
EQ_CLAUSES (none)
  |- !t.
      ((T = t) = t) /\ ((t = T) = t) /\ ((F = t) = ~t) /\ ((t = F) = ~t)
EQ_EXPAND (none)
  |- !t1 t2. (t1 = t2) = t1 /\ t2 \/ ~t1 /\ ~t2
EQ_IMP_THM (none)
  |- !t1 t2. (t1 = t2) = (t1 ==> t2) /\ (t2 ==> t1)
EQ_REFL (none)
  |- !x:*. x = x
EQ_SYM (none)
  |- !x:* y:*. (x = y) ==> (y = x)
EQ_SYM_EQ (none)
  |- !x y. (x = y) = (y = x)
EQ_TRANS (none)
  |- !x:* y:* z:*. (x = y) /\ (y = z) ==> (x = z)
EXCLUDED_MIDDLE (none)
  |- !t. t \/ ~t
EXISTS_SIMP (none)
  |- !t. (?x. t) = t
FALSITY (none)
  |- !t. F ==> t
FORALL_SIMP (none)
  |- !t. (!x. t) = t

2.4. Logical tautologies 613

F_IMP (none)

  |- !t. ~t ==>(t ==> F)
IMP_CLAUSES (none)
  |- !t. (T ==> t) = t /\
         (t ==> T) = T /\
         (F ==> t) = T /\
         (t ==> t) = t /\
         (t ==> F) = ~t
IMP_DISJ_THM (none)
  |- !t1 t2. t1 ==> t2 = ~t1 \/ t2

IMP_F (none)

  |- !t.(t ==> F) ==> ~t
IMP_F_EQ_F (none)
  |- !t. t ==> F = (t = F)
IS_ASSUMPTION_OF (bool)
  |- !t1 t2. t1 IS_ASSUMPTION_OF t2 = t1 ==> t2
LEFT_AND_OVER_OR (none)
  |- !t1 t2 t3. t1 /\ (t2 \/ t3) = t1 /\ t2 \/ t1 /\ t3
LEFT_OR_OVER_AND (none)
  |- !t1 t2 t3. t1 \/ t2 /\ t3 = (t1 \/ t2) /\ (t1 \/ t3)
NOT_AND (none)
  |- !t. ~(t /\ ~t)
NOT_CLAUSES (none)
  |- (!t. ~~t = t) /\ (~T = F) /\ (~F = T)

NOT_F (none)

  |- !t. ~t ==> (t=F)
NOT_IMP (none)
  |- !t1 t2. ~(t1 ==> t2) = t1 /\ ~t2
OR_CLAUSES (none)
  |- !t. (T \/ t) = T /\
         (t \/ T) = T /\
         (F \/ t) = t /\
         (t \/ F) = t /\
         (t \/ t) = t

OR_ELIM_THM (none)
  |- !t t1 t2. (t1 \/ t2) ==> (t1 ==> t) ==> (t2 ==> t) ==> t
OR_IMP_THM (none)
  |- !t1 t2. (t1 = t2 \/ t1) = t2 ==> t1
OR_INTRO_THM1 (none)
  |- !t1 t2. t1 ==> t1 \/ t2
OR_INTRO_THM2 (none)
  |- !t1 t2. t2 ==> t1 \/ t2
REFL_CLAUSE (none)
  |- !x. (x = x) = T
RIGHT_AND_OVER_OR (none)
  |- !t1 t2 t3. (t2 \/ t3) /\ t1 = t2 /\ t1 \/ t3 /\ t1
RIGHT_OR_OVER_AND (none)
  |- !t1 t2 t3. t2 /\ t3 \/ t1 = (t2 \/ t1) /\ (t3 \/ t1)
SELECT_REFL (none)
  |- !x. (@y. y = x) = x
SELECT_UNIQUE (none)
  |- !P x. (!y. P y = (y = x)) ==> ($@ P = x)

TRUTH (none)

  |- T

2.5 Theorems about functions

ABS_SIMP (none)
  |- !t1 t2. (\x. t1)t2 = t1
ASSOC_CONJ (fun)
  |- ASSOC $/\
ASSOC_DEF (fun)
  |- !f. ASSOC f = (!x y z. f x(f y z) = f(f x y)z)
ASSOC_DISJ (fun)
  |- ASSOC $\/

2.6. Theorems about the type one 615

COMM_DEF (fun)
  |- !f. COMM f = (!x y. f x y = f y x)
EQ_EXT (none)
  |- !f g. (!x. f x = g x) ==> (f = g)
FCOMM_ASSOC (fun)
  |- !f. FCOMM f f = ASSOC f
FCOMM_DEF (fun)
  |- !f g. FCOMM f g = (!x y z. g x(f y z) = f(g x y)z)
FUN_EQ_LEMMA (arithmetic)
  |- !f x1 x2. f x1 /\ ~f x2 ==> ~(x1 = x2)
LEFT_ID_DEF (fun)
  |- !f e. LEFT_ID f e = (!x. f e x = x)
MONOID_CONJ_T (fun)
  |- MONOID $/\ T
MONOID_DEF (fun)
  |- !f e. MONOID f e = ASSOC f /\ RIGHT_ID f e /\ LEFT_ID f e
MONOID_DISJ_F (fun)
  |- MONOID $\/ F
ONE_ONE_DEF (bool)
  |- !f. ONE_ONE f = (!x1 x2. (f x1 = f x2) ==> (x1 = x2))
ONTO_DEF (bool)
  |- !f. ONTO f = (!y. ?x. y = f x)
RIGHT_ID_DEF (fun)
  |- !f e. RIGHT_ID f e = (!x. f x e = x)

2.6 Theorems about the type one

one (one)
  |- !v. v = one
one_Axiom (one)
  |- !e. ?! fn. fn one = e

one_axiom (one)
  |- !f g. f = g
one_DEF (one)
  |- one = (@x. T)
one_TY_DEF (one)
  |- ?rep. TYPE_DEFINITION(\b. b)rep

2.7 Theorems about combinators

I_DEF (combin)
  |- I = S K K
I_o_ID (combin)
  |- !f. (I o f = f) /\ (f o I = f)
I_THM (combin)
  |- !x. I x = x
K_DEF (combin)
  |- K = (\x y. x)
K_THM (combin)
  |- !x y. K x y = x
o_ASSOC (combin)
  |- !f g h. f o (g o h) = (f o g) o h
o_DEF (combin)
  |- !f g. f o g = (\x. f(g x))
o_THM (combin)
  |- !f g x. (f o g)x = f(g x)
S_DEF (combin)
  |- S = (\f g x. f x(g x))
S_THM (combin)
  |- !f g x. S f g x = f x(g x)

2.8. Theorems about pairs 617

2.8 Theorems about pairs

COMMA_DEF (bool)
  |- !x y. x,y = (@p. REP_prod p = MK_PAIR x y)
CURRY_DEF (bool)
  |- !f x y. CURRY f x y = f(x,y)
FST (bool)
  |- !x y. FST(x,y) = x
FST_DEF (bool)
  |- !p. FST p = (@x. ?y. MK_PAIR x y = REP_prod p)
IS_PAIR_DEF (bool)
  |- !p. IS_PAIR p = (?x y. p = MK_PAIR x y)
PAIR (bool)
  |- !x. FST x,SND x = x
PAIR_EQ (bool)
  |- !x y a b. (x,y = a,b) = (x = a) /\ (y = b)
PAIR_EXISTS (bool)
  |- ?p. IS_PAIR p
prod_TY_DEF (bool)
  |- ?rep. TYPE_DEFINITION IS_PAIR rep
REP_prod (bool)
  |- REP_prod =
     (@rep.
       (!p' p''. (rep p' = rep p'') ==> (p' = p'')) /\
       (!p. IS_PAIR p = (?p'. p = rep p')))
SND (bool)
  |- !x y. SND(x,y) = y
SND_DEF (bool)
  |- !p. SND p = (@y. ?x. MK_PAIR x y = REP_prod p)
UNCURRY_DEF (bool)
  |- !f x y. UNCURRY f(x,y) = f x y

2.9 Theorems about disjoint sums

INL (sum)
  |- !x. ISL x ==> (INL(OUTL x) = x)
INL_DEF (sum)
  |- !e. INL e = ABS_sum(\b x y. (x = e) /\ b)
INR (sum)
  |- !x. ISR x ==> (INR(OUTR x) = x)
INR_DEF (sum)
  |- !e. INR e = ABS_sum(\b x y. (y = e) /\ ~b)
ISL (sum)
  |- (!x. ISL(INL x)) /\ (!y. ~ISL(INR y))
ISL_OR_ISR (sum)
  |- !x. ISL x \/ ISR x
ISR (sum)
  |- (!x. ISR(INR x)) /\ (!y. ~ISR(INL y))
IS_SUM_REP (sum)
  |- !f.
      IS_SUM_REP f =
      (?v1 v2.
        (f = (\b x y. (x = v1) /\ b)) \/ (f = (\b x y. (y = v2) /\ ~b)))
OUTL (sum)
  |- !x. OUTL(INL x) = x
OUTR (sum)
  |- !x. OUTR(INR x) = x
sum_Axiom (sum)
  |- !f g. ?! h. (!x. h(INL x) = f x) /\ (!x. h(INR x) = g x)
sum_axiom (sum)
  |- !f g. ?! h. (h o INL = f) /\ (h o INR = g)
sum_ISO_DEF (sum)
  |- (!a. ABS_sum(REP_sum a) = a) /\
     (!r. IS_SUM_REP r = (REP_sum(ABS_sum r) = r))
sum_TY_DEF (sum)
  |- ?rep. TYPE_DEFINITION IS_SUM_REP rep

2.10. Theorems about arithmetic 619

2.10 Theorems about arithmetic

ADD (arithmetic)
  |- (!n. 0 + n = n) /\ (!m n. (SUC m) + n = SUC(m + n))
ADD1 (arithmetic)
  |- !m. SUC m = m + 1
ADD_0 (arithmetic)
  |- !m. m + 0 = m
ADD_ASSOC (arithmetic)
  |- !m n p. m + (n + p) = (m + n) + p
ADD_CLAUSES (arithmetic)
  |- (0 + m = m) /\
     (m + 0 = m) /\
     ((SUC m) + n = SUC(m + n)) /\
     (m + (SUC n) = SUC(m + n))
ADD_EQ_0 (arithmetic)
  |- !m n. (m + n = 0) = (m = 0) /\ (n = 0)
ADD_EQ_SUB (arithmetic)
  |- !m n p. n <= p ==> ((m + n = p) = (m = p - n))
ADD_INV_0 (arithmetic)
  |- !m n. (m + n = m) ==> (n = 0)
ADD_INV_0_EQ (arithmetic)
  |- !m n. (m + n = m) = (n = 0)
ADD_MONO_LESS_EQ (arithmetic)
  |- !m n p. (m + n) <= (m + p) = n <= p
ADD_SUB (arithmetic)
  |- !a c. (a + c) - c = a
ADD_SUC (arithmetic)
  |- !m n. SUC(m + n) = m + (SUC n)
ADD_SYM (arithmetic)
  |- !m n. m + n = n + m
ASSOC_ADD (arithmetic)
  |- ASSOC $+

ASSOC_MULT (arithmetic)
  |- ASSOC $*
CANCEL_SUB (arithmetic)
  |- !p n m. p <= n /\ p <= m ==> ((n - p = m - p) = (n = m))
DA (arithmetic)
  |- !k n. 0 < n ==> (?r q. (k = (q * n) + r) /\ r < n)
DIVISION (arithmetic)
  |- !n.
      0 < n ==> (!k. (k = ((k DIV n) * n) + (k MOD n)) /\ (k MOD n) < n)
DIV_LESS_EQ (arithmetic)
  |- !n. 0 < n ==> (!k. (k DIV n) <= k)
DIV_MULT (arithmetic)
  |- !n r. r < n ==> (!q. ((q * n) + r) DIV n = q)
DIV_UNIQUE (arithmetic)
  |- !n k q. (?r. (k = (q * n) + r) /\ r < n) ==> (k DIV n = q)
EQ_LESS (prim rec)
  |- !n. (SUC m = n) ==> m < n
EQ_LESS_EQ (arithmetic)
  |- !m n. (m = n) = m <= n /\ n <= m
EQ_MONO_ADD_EQ (arithmetic)
  |- !m n p. (m + p = n + p) = (m = n)
EVEN (arithmetic)
  |- (EVEN 0 = T) /\ (!n. EVEN(SUC n) = ~EVEN n)
EVEN_ADD (arithmetic)
  |- !m n. EVEN(m + n) = (EVEN m = EVEN n)
EVEN_AND_ODD (arithmetic)
  |- !n. ~(EVEN n /\ ODD n)
EVEN_DOUBLE (arithmetic)
  |- !n. EVEN(2 * n)
EVEN_EXISTS (arithmetic)
  |- !n. EVEN n = (?m. n = 2 * m)

EVEN_MULT (arithmetic)
  |- !m n. EVEN(m * n) = EVEN m \/ EVEN n
EVEN_ODD (arithmetic)
  |- !n. EVEN n = ~ODD n
EVEN_ODD_EXISTS (arithmetic)
  |- !n. (EVEN n ==> (?m. n = 2 * m)) /\ (ODD n ==> (?m. n = SUC(2 * m)))
EVEN_OR_ODD (arithmetic)
  |- !n. EVEN n \/ ODD n
EXP (arithmetic)
  |- (!m. m EXP 0 = 1) /\ (!m n. m EXP (SUC n) = m * (m EXP n))
EXP_ADD (arithmetic)
  |- !p q n. n EXP (p + q) = (n EXP p) * (n EXP q)
FACT (arithmetic)
  |- (FACT 0 = 1) /\ (!n. FACT(SUC n) = (SUC n) * (FACT n))
FACT_LESS (arithmetic)
  |- !n. 0 < (FACT n)
FUN_EQ_LEMMA (arithmetic)
  |- !f x1 x2. f x1 /\ ~f x2 ==> ~(x1 = x2)
GREATER (arithmetic)
  |- !m n. m > n = n < m
GREATER_EQ (arithmetic)
  |- !n m. n >= m = m <= n
GREATER_OR_EQ (arithmetic)
  |- !m n. m >= n = m > n \/ (m = n)
INDUCTION (num)
  |- !P. P 0 /\ (!n. P n ==> P(SUC n)) ==> (!n. P n)
INV_PRE_EQ (arithmetic)
  |- !m n. 0 < m /\ 0 < n ==> ((PRE m = PRE n) = (m = n))
INV_PRE_LESS (arithmetic)
  |- !m. 0 < m ==> (!n. (PRE m) < (PRE n) = m < n)
INV_PRE_LESS_EQ (arithmetic)
  |- !n. 0 < n ==> (!m. (PRE m) <= (PRE n) = m <= n)

INV_SUC (num)
  |- !m n. (SUC m = SUC n) ==> (m = n)
INV_SUC_EQ (prim rec)
  |- !m n. (SUC m = SUC n) = (m = n)
IS_NUM_REP (num)
  |- !m.
      IS_NUM_REP m =
      (!P. P ZERO_REP /\ (!n. P n ==> P(SUC_REP n)) ==> P m)
LEFT_ADD_DISTRIB (arithmetic)
  |- !m n p. p * (m + n) = (p * m) + (p * n)
LEFT_ID_ADD_0 (arithmetic)
  |- LEFT_ID $+ 0
LEFT_ID_MULT_1 (arithmetic)
  |- LEFT_ID $* 1
LEFT_SUB_DISTRIB (arithmetic)
  |- !m n p. p * (m - n) = (p * m) - (p * n)
LESS (prim rec)
  |- !m n. m < n = (?P. (!n'. P(SUC n') ==> P n') /\ P m /\ ~P n)
LESS_0 (prim rec)
  |- !n. 0 < (SUC n)
LESS_0_0 (prim rec)
  |- 0 < (SUC 0)
LESS_0_CASES (arithmetic)
  |- !m. (0 = m) \/ 0 < m
LESS_ADD (arithmetic)
  |- !m n. n < m ==> (?p. p + n = m)
LESS_ADD_1 (arithmetic)
  |- !m n. n < m ==> (?p. m = n + (p + 1))
LESS_ADD_NONZERO (arithmetic)
  |- !m n. ~(n = 0) ==> m < (m + n)
LESS_ADD_SUC (arithmetic)
  |- !m n. m < (m + (SUC n))

LESS_ANTISYM (arithmetic)
  |- !m n. ~(m < n /\ n < m)
LESS_CASES (arithmetic)
  |- !m n. m < n \/ n <= m
LESS_CASES_IMP (arithmetic)
  |- !m n. ~m < n /\ ~(m = n) ==> n < m
LESS_EQ (arithmetic)
  |- !m n. m < n = (SUC m) <= n
LESS_EQUAL_ADD (arithmetic)
  |- !m n. m <= n ==> (?p. n = m + p)
LESS_EQUAL_ANTISYM (arithmetic)
  |- !n m. n <= m /\ m <= n ==> (n = m)
LESS_EQ_0 (arithmetic)
  |- !n. n <= 0 = (n = 0)
LESS_EQ_ADD (arithmetic)
  |- !m n. m <= (m + n)
LESS_EQ_ADD_SUB (arithmetic)
  |- !c b. c <= b ==> (!a. (a + b) - c = a + (b - c))
LESS_EQ_ANTISYM (arithmetic)
  |- !m n. ~(m < n /\ n <= m)
LESS_EQ_CASES (arithmetic)
  |- !m n. m <= n \/ n <= m
LESS_EQ_EXISTS (arithmetic)
  |- !m n. m <= n = (?p. n = m + p)
LESS_EQ_IMP_LESS_SUC (arithmetic)
  |- !n m. n <= m ==> n < (SUC m)
LESS_EQ_LESS_EQ_MONO (arithmetic)
  |- !m n p q. m <= p /\ n <= q ==> (m + n) <= (p + q)
LESS_EQ_LESS_TRANS (arithmetic)
  |- !m n p. m <= n /\ n < p ==> m < p
LESS_EQ_MONO (arithmetic)
  |- !n m. (SUC n) <= (SUC m) = n <= m

LESS_EQ_MONO_ADD_EQ (arithmetic)
  |- !m n p. (m + p) <= (n + p) = m <= n
LESS_EQ_REFL (arithmetic)
  |- !m. m <= m
LESS_EQ_SUB_LESS (arithmetic)
  |- !a b. b <= a ==> (!c. (a - b) < c = a < (b + c))
LESS_EQ_SUC_REFL (arithmetic)
  |- !m. m <= (SUC m)
LESS_EQ_TRANS (arithmetic)
  |- !m n p. m <= n /\ n <= p ==> m <= p
LESS_EXP_SUC_MONO (arithmetic)
  |- !n m. ((SUC(SUC m)) EXP n) < ((SUC(SUC m)) EXP (SUC n))
LESS_IMP_LESS_ADD (arithmetic)
  |- !n m. n < m ==> (!p. n < (m + p))
LESS_IMP_LESS_OR_EQ (arithmetic)
  |- !m n. m < n ==> m <= n
LESS_LEMMA1 (prim rec)
  |- !m n. m < (SUC n) ==> (m = n) \/ m < n
LESS_LEMMA2 (prim rec)
  |- !m n. (m = n) \/ m < n ==> m < (SUC n)
LESS_LESS_CASES (arithmetic)
  |- !m n. (m = n) \/ m < n \/ n < m
LESS_LESS_EQ_TRANS (arithmetic)
  |- !m n p. m < n /\ n <= p ==> m < p
LESS_LESS_SUC (arithmetic)
  |- !m n. ~(m < n /\ n < (SUC m))
LESS_MOD (arithmetic)
  |- !n k. k < n ==> (k MOD n = k)
LESS_MONO (prim rec)
  |- !m n. m < n ==> (SUC m) < (SUC n)
LESS_MONO_ADD (arithmetic)
  |- !m n p. m < n ==> (m + p) < (n + p)

LESS_MONO_ADD_EQ (arithmetic)
  |- !m n p. (m + p) < (n + p) = m < n
LESS_MONO_ADD_INV (arithmetic)
  |- !m n p. (m + p) < (n + p) ==> m < n
LESS_MONO_EQ (arithmetic)
  |- !m n. (SUC m) < (SUC n) = m < n
LESS_MONO_MULT (arithmetic)
  |- !m n p. m <= n ==> (m * p) <= (n * p)
LESS_MONO_REV (arithmetic)
  |- !m n. (SUC m) < (SUC n) ==> m < n
LESS_MULT2 (arithmetic)
  |- !m n. 0 < m /\ 0 < n ==> 0 < (m * n)
LESS_MULT_MONO (arithmetic)
  |- !m i n. ((SUC n) * m) < ((SUC n) * i) = m < i
LESS_NOT_EQ (prim rec)
  |- !m n. m < n ==> ~(m = n)
LESS_NOT_SUC (arithmetic)
  |- !m n. m < n /\ ~(n = SUC m) ==> (SUC m) < n
LESS_OR (arithmetic)
  |- !m n. m < n ==> (SUC m) <= n
LESS_OR_EQ (arithmetic)
  |- !m n. m <= n = m < n \/ (m = n)
LESS_OR_EQ_ADD (arithmetic)
  |- !n m. n < m \/ (?p. n = p + m)
LESS_REFL (prim rec)
  |- !n. ~n < n
LESS_SUB_ADD_LESS (arithmetic)
  |- !n m i. i < (n - m) ==> (i + m) < n
LESS_SUC (prim rec)
  |- !m n. m < n ==> m < (SUC n)
LESS_SUC_EQ_COR (arithmetic)
  |- !m n. m < n /\ ~(SUC m = n) ==> (SUC m) < n

LESS_SUC_IMP (prim rec)
  |- !m n. m < (SUC n) ==> ~(m = n) ==> m < n
LESS_SUC_NOT (arithmetic)
  |- !m n. m < n ==> ~n < (SUC m)
LESS_SUC_REFL (prim rec)
  |- !n. n < (SUC n)
LESS_SUC_SUC (prim rec)
  |- !m. m < (SUC m) /\ m < (SUC(SUC m))
LESS_THM (prim rec)
  |- !m n. m < (SUC n) = (m = n) \/ m < n
LESS_TRANS (arithmetic)
  |- !m n p. m < n /\ n < p ==> m < p
MOD_EQ_0 (arithmetic)
  |- !n. 0 < n ==> (!k. (k * n) MOD n = 0)
MOD_MOD (arithmetic)
  |- !n. 0 < n ==> (!k. (k MOD n) MOD n = k MOD n)
MOD_MULT (arithmetic)
  |- !n r. r < n ==> (!q. ((q * n) + r) MOD n = r)
MOD_ONE (arithmetic)
  |- !k. k MOD (SUC 0) = 0
MOD_PLUS (arithmetic)
  |- !n. 0 < n ==> (!j k. ((j MOD n) + (k MOD n)) MOD n = (j + k) MOD n)
MOD_TIMES (arithmetic)
  |- !n. 0 < n ==> (!q r. ((q * n) + r) MOD n = r MOD n)
MOD_UNIQUE (arithmetic)
  |- !n k r. (?q. (k = (q * n) + r) /\ r < n) ==> (k MOD n = r)
MONOID_ADD_0 (arithmetic)
  |- MONOID $+ 0
MONOID_MULT_1 (arithmetic)
  |- MONOID $* 1
MULT (arithmetic)
  |- (!n. 0 * n = 0) /\ (!m n. (SUC m) * n = (m * n) + n)

MULT_0 (arithmetic)
  |- !m. m * 0 = 0
MULT_ASSOC (arithmetic)
  |- !m n p. m * (n * p) = (m * n) * p
MULT_CLAUSES (arithmetic)
  |- !m n.
      (0 * m = 0) /\
      (m * 0 = 0) /\
      (1 * m = m) /\
      (m * 1 = m) /\
      ((SUC m) * n = (m * n) + n) /\
      (m * (SUC n) = m + (m * n))
MULT_EQ_0 (arithmetic)
  |- !m n. (m * n = 0) = (m = 0) \/ (n = 0)
MULT_EXP_MONO (arithmetic)
  |- !p q n m. (n * ((SUC q) EXP p) = m * ((SUC q) EXP p)) = (n = m)
MULT_LEFT_1 (arithmetic)
  |- !m. 1 * m = m
MULT_LESS_EQ_SUC (arithmetic)
  |- !m n p. m <= n = ((SUC p) * m) <= ((SUC p) * n)
MULT_MONO_EQ (arithmetic)
  |- !m i n. ((SUC n) * m = (SUC n) * i) = (m = i)
MULT_RIGHT_1 (arithmetic)
  |- !m. m * 1 = m
MULT_SUC (arithmetic)
  |- !m n. m * (SUC n) = m + (m * n)
MULT_SUC_EQ (arithmetic)
  |- !p m n. (n * (SUC p) = m * (SUC p)) = (n = m)
MULT_SYM (arithmetic)
  |- !m n. m * n = n * m
NOT_EXP_0 (arithmetic)
  |- !m n. ~((SUC n) EXP m = 0)
NOT_GREATER (arithmetic)
  |- !m n. ~m > n = m <= n

NOT_GREATER_EQ (arithmetic)
  |- !m n. ~m >= n = (SUC m) <= n
NOT_LEQ (arithmetic)
  |- !m n. ~m <= n = (SUC n) <= m
NOT_LESS (arithmetic)
  |- !m n. ~m < n = n <= m
NOT_LESS_0 (prim rec)
  |- !n. ~n < 0
NOT_LESS_EQ (prim rec)
  |- !m n. (m = n) ==> ~m < n
NOT_LESS_EQUAL (arithmetic)
  |- !m n. ~m <= n = n < m
NOT_NUM_EQ (arithmetic)
  |- !m n. ~(m = n) = (SUC m) <= n \/ (SUC n) <= m
NOT_ODD_EQ_EVEN (arithmetic)
  |- !n m. ~(SUC(n + n) = m + m)
NOT_SUC (num)
  |- !n. ~(SUC n = 0)
NOT_SUC_ADD_LESS_EQ (arithmetic)
  |- !m n. ~(SUC(m + n)) <= m
NOT_SUC_LESS_EQ (arithmetic)
  |- !n m. ~(SUC n) <= m = m <= n
NOT_SUC_LESS_EQ_0 (arithmetic)
  |- !n. ~(SUC n) <= 0
num_Axiom (prim rec)
  |- !e f. ?! fn. (fn 0 = e) /\ (!n. fn(SUC n) = f(fn n)n)
num_CASES (arithmetic)
  |- !m. (m = 0) \/ (?n. m = SUC n)
num_ISO_DEF (num)
  |- (!a. ABS_num(REP_num a) = a) /\
     (!r. IS_NUM_REP r = (REP_num(ABS_num r) = r))

num_TY_DEF (num)
  |- ?rep. TYPE_DEFINITION IS_NUM_REP rep
ODD (arithmetic)
  |- (ODD 0 = F) /\ (!n. ODD(SUC n) = ~ODD n)
ODD_ADD (arithmetic)
  |- !m n. ODD(m + n) = ~(ODD m = ODD n)
ODD_DOUBLE (arithmetic)
  |- !n. ODD(SUC(2 * n))
ODD_EVEN (arithmetic)
  |- !n. ODD n = ~EVEN n
ODD_EXISTS (arithmetic)
  |- !n. ODD n = (?m. n = SUC(2 * m))
ODD_MULT (arithmetic)
  |- !m n. ODD(m * n) = ODD m /\ ODD n
ODD_OR_EVEN (arithmetic)
  |- !n. ?m. (n = (SUC(SUC 0)) * m) \/ (n = ((SUC(SUC 0)) * m) + 1)
OR_LESS (arithmetic)
  |- !m n. (SUC m) <= n ==> m < n
PRE (prim rec)
  |- (PRE 0 = 0) /\ (!m. PRE(SUC m) = m)
PRE_DEF (prim rec)
  |- !m. PRE m = ((m = 0) => 0 | (@n. m = SUC n))
PRE_SUB (arithmetic)
  |- !m n. PRE(m - n) = (PRE m) - n
PRE_SUB1 (arithmetic)
  |- !m. PRE m = m - 1
PRE_SUC_EQ (arithmetic)
  |- !m n. 0 < n ==> ((m = PRE n) = (SUC m = n))
PRIM_REC (prim rec)
  |- !x f m. PRIM_REC x f m = PRIM_REC_FUN x f m(PRE m)

PRIM_REC_EQN (prim rec)
  |- !x f.
      (!n. PRIM_REC_FUN x f 0 n = x) /\
      (!m n. PRIM_REC_FUN x f(SUC m)n = f(PRIM_REC_FUN x f m(PRE n))n)
PRIM_REC_FUN (prim rec)
  |- !x f. PRIM_REC_FUN x f = SIMP_REC(\n. x)(\fun n. f(fun(PRE n))n)
PRIM_REC_THM (prim rec)
  |- !x f.
      (PRIM_REC x f 0 = x) /\
      (!m. PRIM_REC x f(SUC m) = f(PRIM_REC x f m)m)
RIGHT_ADD_DISTRIB (arithmetic)
  |- !m n p. (m + n) * p = (m * p) + (n * p)
RIGHT_ID_ADD_0 (arithmetic)
  |- RIGHT_ID $+ 0
RIGHT_ID_MULT_1 (arithmetic)
  |- RIGHT_ID $* 1
RIGHT_SUB_DISTRIB (arithmetic)
  |- !m n p. (m - n) * p = (m * p) - (n * p)
SIMP_REC (prim rec)
  |- !x f n. SIMP_REC x f n = SIMP_REC_FUN x f(SUC n)n
SIMP_REC_EXISTS (prim rec)
  |- !x f n. ?fun. SIMP_REC_REL fun x f n
SIMP_REC_FUN (prim rec)
  |- !x f n. SIMP_REC_FUN x f n = (@fun. SIMP_REC_REL fun x f n)
SIMP_REC_FUN_LEMMA (prim rec)
  |- (?fun. SIMP_REC_REL fun x f n) =
     (SIMP_REC_FUN x f n 0 = x) /\
     (!m. m < n ==> (SIMP_REC_FUN x f n(SUC m) = f(SIMP_REC_FUN x f n m)))
SIMP_REC_REL (prim rec)
  |- !fun x f n.
      SIMP_REC_REL fun x f n =
      (fun 0 = x) /\ (!m. m < n ==> (fun(SUC m) = f(fun m)))

SIMP_REC_THM (prim rec)
  |- !x f.
      (SIMP_REC x f 0 = x) /\
      (!m. SIMP_REC x f(SUC m) = f(SIMP_REC x f m))
SUB (arithmetic)
  |- (!m. 0 - m = 0) /\ (!m n. (SUC m) - n = (m < n => 0 | SUC(m - n)))
SUB_0 (arithmetic)
  |- !m. (0 - m = 0) /\ (m - 0 = m)
SUB_ADD (arithmetic)
  |- !m n. n <= m ==> ((m - n) + n = m)
SUB_CANCEL (arithmetic)
  |- !p n m. n <= p /\ m <= p ==> ((p - n = p - m) = (n = m))
SUB_EQUAL_0 (arithmetic)
  |- !c. c - c = 0
SUB_EQ_0 (arithmetic)
  |- !m n. (m - n = 0) = m <= n
SUB_EQ_EQ_0 (arithmetic)
  |- !m n. (m - n = m) = (m = 0) \/ (n = 0)
SUB_LEFT_ADD (arithmetic)
  |- !m n p. m + (n - p) = (n <= p => m | (m + n) - p)
SUB_LEFT_EQ (arithmetic)
  |- !m n p. (m = n - p) = (m + p = n) \/ m <= 0 /\ n <= p
SUB_LEFT_GREATER (arithmetic)
  |- !m n p. m > (n - p) = (m + p) > n /\ m > 0
SUB_LEFT_GREATER_EQ (arithmetic)
  |- !m n p. m >= (n - p) = (m + p) >= n
SUB_LEFT_LESS (arithmetic)
  |- !m n p. m < (n - p) = (m + p) < n
SUB_LEFT_LESS_EQ (arithmetic)
  |- !m n p. m <= (n - p) = (m + p) <= n \/ m <= 0
SUB_LEFT_SUB (arithmetic)
  |- !m n p. m - (n - p) = (n <= p => m | (m + p) - n)

SUB_LEFT_SUC (arithmetic)
  |- !m n. SUC(m - n) = (m <= n => SUC 0 | (SUC m) - n)
SUB_LESS_0 (arithmetic)
  |- !n m. m < n = 0 < (n - m)
SUB_LESS_EQ (arithmetic)
  |- !n m. (n - m) <= n
SUB_LESS_EQ_ADD (arithmetic)
  |- !m p. m <= p ==> (!n. (p - m) <= n = p <= (m + n))
SUB_LESS_OR (arithmetic)
  |- !m n. n < m ==> n <= (m - 1)
SUB_MONO_EQ (arithmetic)
  |- !n m. (SUC n) - (SUC m) = n - m
SUB_PLUS (arithmetic)
  |- !a b c. a - (b + c) = (a - b) - c
SUB_RIGHT_ADD (arithmetic)
  |- !m n p. (m - n) + p = (m <= n => p | (m + p) - n)
SUB_RIGHT_EQ (arithmetic)
  |- !m n p. (m - n = p) = (m = n + p) \/ m <= n /\ p <= 0
SUB_RIGHT_GREATER (arithmetic)
  |- !m n p. (m - n) > p = m > (n + p)
SUB_RIGHT_GREATER_EQ (arithmetic)
  |- !m n p. (m - n) >= p = m >= (n + p) \/ 0 >= p
SUB_RIGHT_LESS (arithmetic)
  |- !m n p. (m - n) < p = m < (n + p) /\ 0 < p
SUB_RIGHT_LESS_EQ (arithmetic)
  |- !m n p. (m - n) <= p = m <= (n + p)
SUB_RIGHT_SUB (arithmetic)
  |- !m n p. (m - n) - p = m - (n + p)
SUB_SUB (arithmetic)
  |- !b c. c <= b ==> (!a. a - (b - c) = (a + c) - b)
SUC_ADD_SYM (arithmetic)
  |- !m n. SUC(m + n) = (SUC n) + m

SUC_DEF (num)
  |- !m. SUC m = ABS_num(SUC_REP(REP_num m))
SUC_ID (prim rec)
  |- !n. ~(SUC n = n)
SUC_LESS (prim rec)
  |- !m n. (SUC m) < n ==> m < n
SUC_NOT (arithmetic)
  |- !n. ~(0 = SUC n)
SUC_ONE_ADD (arithmetic)
  |- !n. SUC n = 1 + n
SUC_REP_DEF (num)
  |- SUC_REP = (@f. ONE_ONE f /\ ~ONTO f)
SUC_SUB1 (arithmetic)
  |- !m. (SUC m) - 1 = m
TIMES2 (arithmetic)
  |- !n. 2 * n = n + n
WOP (arithmetic)
  |- !P. (?n. P n) ==> (?n. P n /\ (!m. m < n ==> ~P m))
ZERO_DEF (num)
  |- 0 = ABS_num ZERO_REP
ZERO_DIV (arithmetic)
  |- !n. 0 < n ==> (0 DIV n = 0)
ZERO_LESS_EQ (arithmetic)
  |- !n. 0 <= n
ZERO_LESS_EXP (arithmetic)
  |- !m n. 0 < ((SUC n) EXP m)
ZERO_MOD (arithmetic)
  |- !n. 0 < n ==> (0 MOD n = 0)
ZERO_REP_DEF (num)
  |- ZERO_REP = (@x. !y. ~(x = SUC_REP y))

2.11 Theorems about lists

ALL_EL (list)
  |- (!P. ALL_EL P[] = T) /\
     (!P x l. ALL_EL P(CONS x l) = P x /\ ALL_EL P l)
ALL_EL_APPEND (list)
  |- !P l1 l2. ALL_EL P(APPEND l1 l2) = ALL_EL P l1 /\ ALL_EL P l2
ALL_EL_BUTFIRSTN (list)
  |- !P l.
      ALL_EL P l ==> (!m. m <= (LENGTH l) ==> ALL_EL P(BUTFIRSTN m l))
ALL_EL_BUTLASTN (list)
  |- !P l. ALL_EL P l ==> (!m. m <= (LENGTH l) ==> ALL_EL P(BUTLASTN m l))
ALL_EL_CONJ (list)
  |- !P Q l. ALL_EL(\x. P x /\ Q x)l = ALL_EL P l /\ ALL_EL Q l
ALL_EL_FIRSTN (list)
  |- !P l. ALL_EL P l ==> (!m. m <= (LENGTH l) ==> ALL_EL P(FIRSTN m l))
ALL_EL_FOLDL (list)
  |- !P l. ALL_EL P l = FOLDL(\l' x. l' /\ P x)T l
ALL_EL_FOLDL_MAP (list)
  |- !P l. ALL_EL P l = FOLDL $/\ T(MAP P l)
ALL_EL_FOLDR (list)
  |- !P l. ALL_EL P l = FOLDR(\x l'. P x /\ l')T l
ALL_EL_FOLDR_MAP (list)
  |- !P l. ALL_EL P l = FOLDR $/\ T(MAP P l)
ALL_EL_LASTN (list)
  |- !P l. ALL_EL P l ==> (!m. m <= (LENGTH l) ==> ALL_EL P(LASTN m l))
ALL_EL_MAP (list)
  |- !P f l. ALL_EL P(MAP f l) = ALL_EL(P o f)l
ALL_EL_REPLICATE (list)
  |- !x n. ALL_EL($= x)(REPLICATE n x)
ALL_EL_REVERSE (list)
  |- !P l. ALL_EL P(REVERSE l) = ALL_EL P l

2.11. Theorems about lists 635

ALL_EL_SEG (list)
  |- !P l.
      ALL_EL P l ==> (!m k. (m + k) <= (LENGTH l) ==> ALL_EL P(SEG m k l))
ALL_EL_SNOC (list)
  |- !P x l. ALL_EL P(SNOC x l) = ALL_EL P l /\ P x
AND_EL_DEF (list)
  |- AND_EL = ALL_EL I
AND_EL_FOLDL (list)
  |- !l. AND_EL l = FOLDL $/\ T l
AND_EL_FOLDR (list)
  |- !l. AND_EL l = FOLDR $/\ T l
AP (ltree)
  |- (!l. AP[]l = []) /\
     (!h t l. AP(CONS h t)l = CONS(h(HD l))(AP t(TL l)))
APPEND (list)
  |- (!l. APPEND[]l = l) /\
     (!l1 l2 h. APPEND(CONS h l1)l2 = CONS h(APPEND l1 l2))
APPEND_ASSOC (list)
  |- !l1 l2 l3. APPEND l1(APPEND l2 l3) = APPEND(APPEND l1 l2)l3
APPEND_BUTLASTN_BUTFIRSTN (list)
  |- !m n l.
      (m + n = LENGTH l) ==> (APPEND(BUTLASTN m l)(BUTFIRSTN n l) = l)
APPEND_BUTLASTN_LASTN (list)
  |- !n l. n <= (LENGTH l) ==> (APPEND(BUTLASTN n l)(LASTN n l) = l)
APPEND_BUTLAST_LAST (list)
  |- !l. ~(l = []) ==> (APPEND(BUTLAST l)[LAST l] = l)
APPEND_FIRSTN_BUTFIRSTN (list)
  |- !n l. n <= (LENGTH l) ==> (APPEND(FIRSTN n l)(BUTFIRSTN n l) = l)
APPEND_FIRSTN_LASTN (list)
  |- !m n l. (m + n = LENGTH l) ==> (APPEND(FIRSTN n l)(LASTN m l) = l)
APPEND_FOLDL (list)
  |- !l1 l2. APPEND l1 l2 = FOLDL(\l' x. SNOC x l')l1 l2

APPEND_FOLDR (list)
  |- !l1 l2. APPEND l1 l2 = FOLDR CONS l2 l1
APPEND_LENGTH_EQ (list)
  |- !l1 l1'.
      (LENGTH l1 = LENGTH l1') ==>
      (!l2 l2'.
        (LENGTH l2 = LENGTH l2') ==>
        ((APPEND l1 l2 = APPEND l1' l2') = (l1 = l1') /\ (l2 = l2')))
APPEND_NIL (list)
  |- (!l. APPEND l[] = l) /\ (!l. APPEND[]l = l)
APPEND_SNOC (list)
  |- !l1 x l2. APPEND l1(SNOC x l2) = SNOC x(APPEND l1 l2)
ASSOC_APPEND (list)
  |- ASSOC APPEND
ASSOC_FOLDL_FLAT (list)
  |- !f.
      ASSOC f ==>
      (!e.
        RIGHT_ID f e ==>
        (!l. FOLDL f e(FLAT l) = FOLDL f e(MAP(FOLDL f e)l)))
ASSOC_FOLDR_FLAT (list)
  |- !f.
      ASSOC f ==>
      (!e.
        LEFT_ID f e ==>
        (!l. FOLDR f e(FLAT l) = FOLDR f e(MAP(FOLDR f e)l)))
BUTFIRSTN (list)
  |- (!l. BUTFIRSTN 0 l = l) /\
     (!n x l. BUTFIRSTN(SUC n)(CONS x l) = BUTFIRSTN n l)
BUTFIRSTN_APPEND1 (list)
  |- !n l1.
      n <= (LENGTH l1) ==>
      (!l2. BUTFIRSTN n(APPEND l1 l2) = APPEND(BUTFIRSTN n l1)l2)
BUTFIRSTN_APPEND2 (list)
  |- !l1 n.
      (LENGTH l1) <= n ==>
      (!l2. BUTFIRSTN n(APPEND l1 l2) = BUTFIRSTN(n - (LENGTH l1))l2)

BUTFIRSTN_BUTFIRSTN (list)
  |- !n m l.
      (n + m) <= (LENGTH l) ==>
      (BUTFIRSTN n(BUTFIRSTN m l) = BUTFIRSTN(n + m)l)
BUTFIRSTN_LASTN (list)
  |- !n l. n <= (LENGTH l) ==> (BUTFIRSTN n l = LASTN((LENGTH l) - n)l)
BUTFIRSTN_LENGTH_APPEND (list)
  |- !l1 l2. BUTFIRSTN(LENGTH l1)(APPEND l1 l2) = l2
BUTFIRSTN_LENGTH_NIL (list)
  |- !l. BUTFIRSTN(LENGTH l)l = []
BUTFIRSTN_REVERSE (list)
  |- !n l.
      n <= (LENGTH l) ==> (BUTFIRSTN n(REVERSE l) = REVERSE(BUTLASTN n l))
BUTFIRSTN_SEG (list)
  |- !n l. n <= (LENGTH l) ==> (BUTFIRSTN n l = SEG((LENGTH l) - n)n l)
BUTFIRSTN_SNOC (list)
  |- !n l.
      n <= (LENGTH l) ==>
      (!x. BUTFIRSTN n(SNOC x l) = SNOC x(BUTFIRSTN n l))
BUTLAST (list)
  |- !x l. BUTLAST(SNOC x l) = l
BUTLASTN (list)
  |- (!l. BUTLASTN 0 l = l) /\
     (!n x l. BUTLASTN(SUC n)(SNOC x l) = BUTLASTN n l)
BUTLASTN_1 (list)
  |- !l. ~(l = []) ==> (BUTLASTN 1 l = BUTLAST l)
BUTLASTN_APPEND1 (list)
  |- !l2 n.
      (LENGTH l2) <= n ==>
      (!l1. BUTLASTN n(APPEND l1 l2) = BUTLASTN(n - (LENGTH l2))l1)
BUTLASTN_APPEND2 (list)
  |- !n l1 l2.
      n <= (LENGTH l2) ==>
      (BUTLASTN n(APPEND l1 l2) = APPEND l1(BUTLASTN n l2))

BUTLASTN_BUTLAST (list)
  |- !n l.
      n < (LENGTH l) ==> (BUTLASTN n(BUTLAST l) = BUTLAST(BUTLASTN n l))
BUTLASTN_BUTLASTN (list)
  |- !m n l.
      (n + m) <= (LENGTH l) ==>
      (BUTLASTN n(BUTLASTN m l) = BUTLASTN(n + m)l)
BUTLASTN_CONS (list)
  |- !n l.
      n <= (LENGTH l) ==>
      (!x. BUTLASTN n(CONS x l) = CONS x(BUTLASTN n l))
BUTLASTN_FIRSTN (list)
  |- !n l. n <= (LENGTH l) ==> (BUTLASTN n l = FIRSTN((LENGTH l) - n)l)
BUTLASTN_LASTN (list)
  |- !m n l.
      m <= n /\ n <= (LENGTH l) ==>
      (BUTLASTN m(LASTN n l) = LASTN(n - m)(BUTLASTN m l))
BUTLASTN_LASTN_NIL (list)
  |- !n l. n <= (LENGTH l) ==> (BUTLASTN n(LASTN n l) = [])
BUTLASTN_LENGTH_APPEND (list)
  |- !l2 l1. BUTLASTN(LENGTH l2)(APPEND l1 l2) = l1
BUTLASTN_LENGTH_CONS (list)
  |- !l x. BUTLASTN(LENGTH l)(CONS x l) = [x]
BUTLASTN_LENGTH_NIL (list)
  |- !l. BUTLASTN(LENGTH l)l = []
BUTLASTN_MAP (list)
  |- !n l.
      n <= (LENGTH l) ==> (!f. BUTLASTN n(MAP f l) = MAP f(BUTLASTN n l))
BUTLASTN_REVERSE (list)
  |- !n l.
      n <= (LENGTH l) ==> (BUTLASTN n(REVERSE l) = REVERSE(BUTFIRSTN n l))
BUTLASTN_SEG (list)
  |- !n l. n <= (LENGTH l) ==> (BUTLASTN n l = SEG((LENGTH l) - n)0 l)
BUTLASTN_SUC_BUTLAST (list)
  |- !n l. n < (LENGTH l) ==> (BUTLASTN(SUC n)l = BUTLASTN n(BUTLAST l))

BUTLAST_DEF (list)
  |- !l. BUTLAST l = SEG(PRE(LENGTH l))0 l
COMM_ASSOC_FOLDL_REVERSE (list)
  |- !f. COMM f ==> ASSOC f ==> (!e l. FOLDL f e(REVERSE l) = FOLDL f e l)
COMM_ASSOC_FOLDR_REVERSE (list)
  |- !f. COMM f ==> ASSOC f ==> (!e l. FOLDR f e(REVERSE l) = FOLDR f e l)
COMM_MONOID_FOLDL (list)
  |- !f.
      COMM f ==>
      (!e'. MONOID f e' ==> (!e l. FOLDL f e l = f e(FOLDL f e' l)))
COMM_MONOID_FOLDR (list)
  |- !f.
      COMM f ==>
      (!e'. MONOID f e' ==> (!e l. FOLDR f e l = f e(FOLDR f e' l)))
CONS (list)
  |- !l. ~NULL l ==> (CONS(HD l)(TL l) = l)
CONS_11 (list)
  |- !h t h' t'. (CONS h t = CONS h' t') = (h = h') /\ (t = t')
CONS_APPEND (list)
  |- !x l. CONS x l = APPEND[x]l
CONS_DEF (list)
  |- !h t.
      CONS h t =
      ABS_list
      ((\m. ((m = 0) => h | FST(REP_list t)(PRE m))),SUC(SND(REP_list t)))
EL (list)
  |- (!l. EL 0 l = HD l) /\ (!l n. EL(SUC n)l = EL n(TL l))
ELL (list)
  |- (!l. ELL 0 l = LAST l) /\ (!n l. ELL(SUC n)l = ELL n(BUTLAST l))
ELL_0_SNOC (list)
  |- !l x. ELL 0(SNOC x l) = x
ELL_APPEND1 (list)
  |- !l2 n.
      (LENGTH l2) <= n ==>
      (!l1. ELL n(APPEND l1 l2) = ELL(n - (LENGTH l2))l1)

ELL_APPEND2 (list)
  |- !n l2. n < (LENGTH l2) ==> (!l1. ELL n(APPEND l1 l2) = ELL n l2)
ELL_CONS (list)
  |- !n l. n < (LENGTH l) ==> (!x. ELL n(CONS x l) = ELL n l)
ELL_EL (list)
  |- !n l. n < (LENGTH l) ==> (ELL n l = EL(PRE((LENGTH l) - n))l)
ELL_IS_EL (list)
  |- !n l. n < (LENGTH l) ==> IS_EL(EL n l)l
ELL_LAST (list)
  |- !l. ~NULL l ==> (ELL 0 l = LAST l)
ELL_LENGTH_APPEND (list)
  |- !l1 l2. ~NULL l1 ==> (ELL(LENGTH l2)(APPEND l1 l2) = LAST l1)
ELL_LENGTH_CONS (list)
  |- !l x. ELL(LENGTH l)(CONS x l) = x
ELL_LENGTH_SNOC (list)
  |- !l x. ELL(LENGTH l)(SNOC x l) = (NULL l => x | HD l)
ELL_MAP (list)
  |- !n l f. n < (LENGTH l) ==> (ELL n(MAP f l) = f(ELL n l))
ELL_PRE_LENGTH (list)
  |- !l. ~(l = []) ==> (ELL(PRE(LENGTH l))l = HD l)
ELL_REVERSE (list)
  |- !n l.
      n < (LENGTH l) ==> (ELL n(REVERSE l) = ELL(PRE((LENGTH l) - n))l)
ELL_REVERSE_EL (list)
  |- !n l. n < (LENGTH l) ==> (ELL n(REVERSE l) = EL n l)
ELL_SEG (list)
  |- !n l. n < (LENGTH l) ==> (ELL n l = HD(SEG 1(PRE((LENGTH l) - n))l))
ELL_SNOC (list)
  |- !n. 0 < n ==> (!x l. ELL n(SNOC x l) = ELL(PRE n)l)
ELL_SUC_SNOC (list)
  |- !n x l. ELL(SUC n)(SNOC x l) = ELL n l

EL_APPEND1 (list)
  |- !n l1 l2. n < (LENGTH l1) ==> (EL n(APPEND l1 l2) = EL n l1)
EL_APPEND2 (list)
  |- !l1 n.
      (LENGTH l1) <= n ==>
      (!l2. EL n(APPEND l1 l2) = EL(n - (LENGTH l1))l2)
EL_CONS (list)
  |- !n. 0 < n ==> (!x l. EL n(CONS x l) = EL(PRE n)l)
EL_ELL (list)
  |- !n l. n < (LENGTH l) ==> (EL n l = ELL(PRE((LENGTH l) - n))l)
EL_IS_EL (list)
  |- !n l. n < (LENGTH l) ==> IS_EL(EL n l)l
EL_LENGTH_APPEND (list)
  |- !l2 l1. ~NULL l2 ==> (EL(LENGTH l1)(APPEND l1 l2) = HD l2)
EL_LENGTH_SNOC (list)
  |- !l x. EL(LENGTH l)(SNOC x l) = x
EL_MAP (list)
  |- !n l. n < (LENGTH l) ==> (!f. EL n(MAP f l) = f(EL n l))
EL_PRE_LENGTH (list)
  |- !l. ~(l = []) ==> (EL(PRE(LENGTH l))l = LAST l)
EL_REVERSE (list)
  |- !n l. n < (LENGTH l) ==> (EL n(REVERSE l) = EL(PRE((LENGTH l) - n))l)
EL_REVERSE_ELL (list)
  |- !n l. n < (LENGTH l) ==> (EL n(REVERSE l) = ELL n l)
EL_SEG (list)
  |- !n l. n < (LENGTH l) ==> (EL n l = HD(SEG 1 n l))
EL_SNOC (list)
  |- !n l. n < (LENGTH l) ==> (!x. EL n(SNOC x l) = EL n l)
EQ_LIST (list)
  |- !h1 h2.
      (h1 = h2) ==> (!l1 l2. (l1 = l2) ==> (CONS h1 l1 = CONS h2 l2))

FCOMM_FOLDL_APPEND (list)
  |- !f g.
      FCOMM f g ==>
      (!e.
        RIGHT_ID g e ==>
        (!l1 l2. FOLDL f e(APPEND l1 l2) = g(FOLDL f e l1)(FOLDL f e l2)))
FCOMM_FOLDL_FLAT (list)
  |- !f g.
      FCOMM f g ==>
      (!e.
        RIGHT_ID g e ==>
        (!l. FOLDL f e(FLAT l) = FOLDL g e(MAP(FOLDL f e)l)))
FCOMM_FOLDR_APPEND (list)
  |- !g f.
      FCOMM g f ==>
      (!e.
        LEFT_ID g e ==>
        (!l1 l2. FOLDR f e(APPEND l1 l2) = g(FOLDR f e l1)(FOLDR f e l2)))
FCOMM_FOLDR_FLAT (list)
  |- !g f.
      FCOMM g f ==>
      (!e.
        LEFT_ID g e ==>
        (!l. FOLDR f e(FLAT l) = FOLDR g e(MAP(FOLDR f e)l)))
FILTER (list)
  |- (!P. FILTER P[] = []) /\
     (!P x l.
       FILTER P(CONS x l) = (P x => CONS x(FILTER P l) | FILTER P l))
FILTER_APPEND (list)
  |- !f l1 l2. FILTER f(APPEND l1 l2) = APPEND(FILTER f l1)(FILTER f l2)
FILTER_COMM (list)
  |- !f1 f2 l. FILTER f1(FILTER f2 l) = FILTER f2(FILTER f1 l)
FILTER_FILTER (list)
  |- !P Q l. FILTER P(FILTER Q l) = FILTER(\x. P x /\ Q x)l
FILTER_FLAT (list)
  |- !P l. FILTER P(FLAT l) = FLAT(MAP(FILTER P)l)
FILTER_FOLDL (list)
  |- !P l. FILTER P l = FOLDL(\l' x. (P x => SNOC x l' | l'))[]l

FILTER_FOLDR (list)
  |- !P l. FILTER P l = FOLDR(\x l'. (P x => CONS x l' | l'))[]l
FILTER_IDEM (list)
  |- !f l. FILTER f(FILTER f l) = FILTER f l
FILTER_MAP (list)
  |- !f1 f2 l. FILTER f1(MAP f2 l) = MAP f2(FILTER(f1 o f2)l)
FILTER_REVERSE (list)
  |- !P l. FILTER P(REVERSE l) = REVERSE(FILTER P l)
FILTER_SNOC (list)
  |- !P x l. FILTER P(SNOC x l) = (P x => SNOC x(FILTER P l) | FILTER P l)
FIRSTN (list)
  |- (!l. FIRSTN 0 l = []) /\
     (!n x l. FIRSTN(SUC n)(CONS x l) = CONS x(FIRSTN n l))
FIRSTN_APPEND1 (list)
  |- !n l1.
      n <= (LENGTH l1) ==> (!l2. FIRSTN n(APPEND l1 l2) = FIRSTN n l1)
FIRSTN_APPEND2 (list)
  |- !l1 n.
      (LENGTH l1) <= n ==>
      (!l2. FIRSTN n(APPEND l1 l2) = APPEND l1(FIRSTN(n - (LENGTH l1))l2))
FIRSTN_BUTLASTN (list)
  |- !n l. n <= (LENGTH l) ==> (FIRSTN n l = BUTLASTN((LENGTH l) - n)l)
FIRSTN_FIRSTN (list)
  |- !m l.
      m <= (LENGTH l) ==>
      (!n. n <= m ==> (FIRSTN n(FIRSTN m l) = FIRSTN n l))
FIRSTN_LENGTH_APPEND (list)
  |- !l1 l2. FIRSTN(LENGTH l1)(APPEND l1 l2) = l1
FIRSTN_LENGTH_ID (list)
  |- !l. FIRSTN(LENGTH l)l = l
FIRSTN_REVERSE (list)
  |- !n l. n <= (LENGTH l) ==> (FIRSTN n(REVERSE l) = REVERSE(LASTN n l))
FIRSTN_SEG (list)
  |- !n l. n <= (LENGTH l) ==> (FIRSTN n l = SEG n 0 l)

FIRSTN_SNOC (list)
  |- !n l. n <= (LENGTH l) ==> (!x. FIRSTN n(SNOC x l) = FIRSTN n l)
FLAT (list)
  |- (FLAT[] = []) /\ (!h t. FLAT(CONS h t) = APPEND h(FLAT t))
FLAT_APPEND (list)
  |- !l1 l2. FLAT(APPEND l1 l2) = APPEND(FLAT l1)(FLAT l2)
FLAT_FLAT (list)
  |- !l. FLAT(FLAT l) = FLAT(MAP FLAT l)
FLAT_FOLDL (list)
  |- !l. FLAT l = FOLDL APPEND[]l
FLAT_FOLDR (list)
  |- !l. FLAT l = FOLDR APPEND[]l
FLAT_REVERSE (list)
  |- !l. FLAT(REVERSE l) = REVERSE(FLAT(MAP REVERSE l))
FLAT_SNOC (list)
  |- !x l. FLAT(SNOC x l) = APPEND(FLAT l)x
FOLDL (list)
  |- (!f e. FOLDL f e[] = e) /\
     (!f e x l. FOLDL f e(CONS x l) = FOLDL f(f e x)l)
FOLDL_APPEND (list)
  |- !f e l1 l2. FOLDL f e(APPEND l1 l2) = FOLDL f(FOLDL f e l1)l2
FOLDL_FILTER (list)
  |- !f e P l. FOLDL f e(FILTER P l) = FOLDL(\x y. (P y => f x y | x))e l
FOLDL_FOLDR_REVERSE (list)
  |- !f e l. FOLDL f e l = FOLDR(\x y. f y x)e(REVERSE l)
FOLDL_MAP (list)
  |- !f e g l. FOLDL f e(MAP g l) = FOLDL(\x y. f x(g y))e l
FOLDL_REVERSE (list)
  |- !f e l. FOLDL f e(REVERSE l) = FOLDR(\x y. f y x)e l
FOLDL_SINGLE (list)
  |- !f e x. FOLDL f e[x] = f e x

FOLDL_SNOC (list)
  |- !f e x l. FOLDL f e(SNOC x l) = f(FOLDL f e l)x
FOLDL_SNOC_NIL (list)
  |- !l. FOLDL(\xs x. SNOC x xs)[]l = l
FOLDR (list)
  |- (!f e. FOLDR f e[] = e) /\
     (!f e x l. FOLDR f e(CONS x l) = f x(FOLDR f e l))
FOLDR_APPEND (list)
  |- !f e l1 l2. FOLDR f e(APPEND l1 l2) = FOLDR f(FOLDR f e l2)l1
FOLDR_CONS_NIL (list)
  |- !l. FOLDR CONS[]l = l
FOLDR_FILTER (list)
  |- !f e P l. FOLDR f e(FILTER P l) = FOLDR(\x y. (P x => f x y | y))e l
FOLDR_FILTER_REVERSE (list)
  |- !f.
      (!a b c. f a(f b c) = f b(f a c)) ==>
      (!e P l. FOLDR f e(FILTER P(REVERSE l)) = FOLDR f e(FILTER P l))
FOLDR_FOLDL (list)
  |- !f e. MONOID f e ==> (!l. FOLDR f e l = FOLDL f e l)
FOLDR_FOLDL_REVERSE (list)
  |- !f e l. FOLDR f e l = FOLDL(\x y. f y x)e(REVERSE l)
FOLDR_MAP (list)
  |- !f e g l. FOLDR f e(MAP g l) = FOLDR(\x y. f(g x)y)e l
FOLDR_MAP_REVERSE (list)
  |- !f.
      (!a b c. f a(f b c) = f b(f a c)) ==>
      (!e g l. FOLDR f e(MAP g(REVERSE l)) = FOLDR f e(MAP g l))
FOLDR_REVERSE (list)
  |- !f e l. FOLDR f e(REVERSE l) = FOLDL(\x y. f y x)e l
FOLDR_SINGLE (list)
  |- !f e x. FOLDR f e[x] = f x e
FOLDR_SNOC (list)
  |- !f e x l. FOLDR f e(SNOC x l) = FOLDR f(f x e)l

GENLIST (list)
  |- (!f. GENLIST f 0 = []) /\
     (!f n. GENLIST f(SUC n) = SNOC(f n)(GENLIST f n))
HD (list)
  |- !h t. HD(CONS h t) = h
IS_EL (list)
  |- (!x. IS_EL x[] = F) /\
     (!y x l. IS_EL y(CONS x l) = (y = x) \/ IS_EL y l)
IS_EL_APPEND (list)
  |- !l1 l2 x. IS_EL x(APPEND l1 l2) = IS_EL x l1 \/ IS_EL x l2
IS_EL_BUTFIRSTN (list)
  |- !m l. m <= (LENGTH l) ==> (!x. IS_EL x(BUTFIRSTN m l) ==> IS_EL x l)
IS_EL_BUTLASTN (list)
  |- !m l. m <= (LENGTH l) ==> (!x. IS_EL x(BUTLASTN m l) ==> IS_EL x l)
IS_EL_DEF (list)
  |- !x l. IS_EL x l = SOME_EL($= x)l
IS_EL_FILTER (list)
  |- !P x. P x ==> (!l. IS_EL x(FILTER P l) = IS_EL x l)
IS_EL_FIRSTN (list)
  |- !m l. m <= (LENGTH l) ==> (!x. IS_EL x(FIRSTN m l) ==> IS_EL x l)
IS_EL_FOLDL (list)
  |- !y l. IS_EL y l = FOLDL(\l' x. l' \/ (y = x))F l
IS_EL_FOLDL_MAP (list)
  |- !x l. IS_EL x l = FOLDL $\/ F(MAP($= x)l)
IS_EL_FOLDR (list)
  |- !y l. IS_EL y l = FOLDR(\x l'. (y = x) \/ l')F l
IS_EL_FOLDR_MAP (list)
  |- !x l. IS_EL x l = FOLDR $\/ F(MAP($= x)l)
IS_EL_LASTN (list)
  |- !m l. m <= (LENGTH l) ==> (!x. IS_EL x(LASTN m l) ==> IS_EL x l)
IS_EL_REPLICATE (list)
  |- !n. 0 < n ==> (!x. IS_EL x(REPLICATE n x))

IS_EL_REVERSE (list)
  |- !x l. IS_EL x(REVERSE l) = IS_EL x l
IS_EL_SEG (list)
  |- !n m l.
      (n + m) <= (LENGTH l) ==> (!x. IS_EL x(SEG n m l) ==> IS_EL x l)
IS_EL_SNOC (list)
  |- !y x l. IS_EL y(SNOC x l) = (y = x) \/ IS_EL y l
IS_EL_SOME_EL (list)
  |- !x l. IS_EL x l = SOME_EL($= x)l
IS_list_REP (list)
  |- !r. IS_list_REP r = (?f n. r = (\m. (m < n => f m | (@x. T))),n)
IS_PREFIX (list)
  |- (!l. IS_PREFIX l[] = T) /\
     (!x l. IS_PREFIX[](CONS x l) = F) /\
     (!x1 l1 x2 l2.
       IS_PREFIX(CONS x1 l1)(CONS x2 l2) = (x1 = x2) /\ IS_PREFIX l1 l2)
IS_PREFIX_APPEND (list)
  |- !l1 l2. IS_PREFIX l1 l2 = (?l. l1 = APPEND l2 l)
IS_PREFIX_IS_SUBLIST (list)
  |- !l1 l2. IS_PREFIX l1 l2 ==> IS_SUBLIST l1 l2
IS_PREFIX_PREFIX (list)
  |- !P l. IS_PREFIX l(PREFIX P l)
IS_PREFIX_REVERSE (list)
  |- !l1 l2. IS_PREFIX(REVERSE l1)(REVERSE l2) = IS_SUFFIX l1 l2
IS_SUBLIST (list)
  |- (!l. IS_SUBLIST l[] = T) /\
     (!x l. IS_SUBLIST[](CONS x l) = F) /\
     (!x1 l1 x2 l2.
       IS_SUBLIST(CONS x1 l1)(CONS x2 l2) =
       (x1 = x2) /\ IS_PREFIX l1 l2 \/ IS_SUBLIST l1(CONS x2 l2))
IS_SUBLIST_APPEND (list)
  |- !l1 l2. IS_SUBLIST l1 l2 = (?l l'. l1 = APPEND l(APPEND l2 l'))
IS_SUBLIST_REVERSE (list)
  |- !l1 l2. IS_SUBLIST(REVERSE l1)(REVERSE l2) = IS_SUBLIST l1 l2

IS_SUFFIX (list)
  |- (!l. IS_SUFFIX l[] = T) /\
     (!x l. IS_SUFFIX[](SNOC x l) = F) /\
     (!x1 l1 x2 l2.
       IS_SUFFIX(SNOC x1 l1)(SNOC x2 l2) = (x1 = x2) /\ IS_SUFFIX l1 l2)
IS_SUFFIX_APPEND (list)
  |- !l1 l2. IS_SUFFIX l1 l2 = (?l. l1 = APPEND l l2)
IS_SUFFIX_IS_SUBLIST (list)
  |- !l1 l2. IS_SUFFIX l1 l2 ==> IS_SUBLIST l1 l2
IS_SUFFIX_REVERSE (list)
  |- !l1 l2. IS_SUFFIX(REVERSE l1)(REVERSE l2) = IS_PREFIX l1 l2
LAST (list)
  |- !x l. LAST(SNOC x l) = x
LASTN (list)
  |- (!l. LASTN 0 l = []) /\
     (!n x l. LASTN(SUC n)(SNOC x l) = SNOC x(LASTN n l))
LASTN_1 (list)
  |- !l. ~(l = []) ==> (LASTN 1 l = [LAST l])
LASTN_APPEND1 (list)
  |- !l2 n.
      (LENGTH l2) <= n ==>
      (!l1. LASTN n(APPEND l1 l2) = APPEND(LASTN(n - (LENGTH l2))l1)l2)
LASTN_APPEND2 (list)
  |- !n l2. n <= (LENGTH l2) ==> (!l1. LASTN n(APPEND l1 l2) = LASTN n l2)
LASTN_BUTFIRSTN (list)
  |- !n l. n <= (LENGTH l) ==> (LASTN n l = BUTFIRSTN((LENGTH l) - n)l)
LASTN_BUTLASTN (list)
  |- !n m l.
      (n + m) <= (LENGTH l) ==>
      (LASTN n(BUTLASTN m l) = BUTLASTN m(LASTN(n + m)l))
LASTN_CONS (list)
  |- !n l. n <= (LENGTH l) ==> (!x. LASTN n(CONS x l) = LASTN n l)
LASTN_LASTN (list)
  |- !l n m.
      m <= (LENGTH l) ==> n <= m ==> (LASTN n(LASTN m l) = LASTN n l)

LASTN_LENGTH_APPEND (list)
  |- !l1 l2. LASTN(LENGTH l2)(APPEND l1 l2) = l2
LASTN_LENGTH_ID (list)
  |- !l. LASTN(LENGTH l)l = l
LASTN_MAP (list)
  |- !n l. n <= (LENGTH l) ==> (!f. LASTN n(MAP f l) = MAP f(LASTN n l))
LASTN_REVERSE (list)
  |- !n l. n <= (LENGTH l) ==> (LASTN n(REVERSE l) = REVERSE(FIRSTN n l))
LASTN_SEG (list)
  |- !n l. n <= (LENGTH l) ==> (LASTN n l = SEG n((LENGTH l) - n)l)
LAST_DEF (list)
  |- !l. LAST l = HD(SEG 1(PRE(LENGTH l))l)
LAST_LASTN_LAST (list)
  |- !n l. n <= (LENGTH l) ==> 0 < n ==> (LAST(LASTN n l) = LAST l)
LENGTH (list)
  |- (LENGTH[] = 0) /\ (!h t. LENGTH(CONS h t) = SUC(LENGTH t))
LENGTH_APPEND (list)
  |- !l1 l2. LENGTH(APPEND l1 l2) = (LENGTH l1) + (LENGTH l2)
LENGTH_BUTFIRSTN (list)
  |- !n l. n <= (LENGTH l) ==> (LENGTH(BUTFIRSTN n l) = (LENGTH l) - n)
LENGTH_BUTLAST (list)
  |- !l. ~(l = []) ==> (LENGTH(BUTLAST l) = PRE(LENGTH l))
LENGTH_BUTLASTN (list)
  |- !n l. n <= (LENGTH l) ==> (LENGTH(BUTLASTN n l) = (LENGTH l) - n)
LENGTH_CONS (list)
  |- !l n.
      (LENGTH l = SUC n) = (?h l'. (LENGTH l' = n) /\ (l = CONS h l'))
LENGTH_EQ (list)
  |- !x y. (x = y) ==> (LENGTH x = LENGTH y)
LENGTH_EQ_CONS (list)
  |- !P n.
      (!l. (LENGTH l = SUC n) ==> P l) =
      (!l. (LENGTH l = n) ==> (\l. !x. P(CONS x l))l)

LENGTH_EQ_NIL (list)
  |- !P. (!l. (LENGTH l = 0) ==> P l) = P[]
LENGTH_FIRSTN (list)
  |- !n l. n <= (LENGTH l) ==> (LENGTH(FIRSTN n l) = n)
LENGTH_FLAT (list)
  |- !l. LENGTH(FLAT l) = SUM(MAP LENGTH l)
LENGTH_FOLDL (list)
  |- !l. LENGTH l = FOLDL(\l' x. SUC l')0 l
LENGTH_FOLDR (list)
  |- !l. LENGTH l = FOLDR(\x l'. SUC l')0 l
LENGTH_GENLIST (list)
  |- !f n. LENGTH(GENLIST f n) = n
LENGTH_LASTN (list)
  |- !n l. n <= (LENGTH l) ==> (LENGTH(LASTN n l) = n)
LENGTH_MAP (list)
  |- !l f. LENGTH(MAP f l) = LENGTH l
LENGTH_MAP2 (list)
  |- !l1 l2.
      (LENGTH l1 = LENGTH l2) ==>
      (!f.
        (LENGTH(MAP2 f l1 l2) = LENGTH l1) /\
        (LENGTH(MAP2 f l1 l2) = LENGTH l2))
LENGTH_NIL (list)
  |- !l. (LENGTH l = 0) = (l = [])
LENGTH_NOT_NULL (list)
  |- !l. 0 < (LENGTH l) = ~NULL l
LENGTH_REPLICATE (list)
  |- !n x. LENGTH(REPLICATE n x) = n
LENGTH_REVERSE (list)
  |- !l. LENGTH(REVERSE l) = LENGTH l
LENGTH_SCANL (list)
  |- !f e l. LENGTH(SCANL f e l) = SUC(LENGTH l)

LENGTH_SCANR (list)
  |- !f e l. LENGTH(SCANR f e l) = SUC(LENGTH l)
LENGTH_SEG (list)
  |- !n k l. (n + k) <= (LENGTH l) ==> (LENGTH(SEG n k l) = n)
LENGTH_SNOC (list)
  |- !x l. LENGTH(SNOC x l) = SUC(LENGTH l)
LENGTH_UNZIP_FST (list)
  |- !l. LENGTH(UNZIP_FST l) = LENGTH l
LENGTH_UNZIP_SND (list)
  |- !l. LENGTH(UNZIP_SND l) = LENGTH l
LENGTH_ZIP (list)
  |- !l1 l2.
      (LENGTH l1 = LENGTH l2) ==>
      (LENGTH(ZIP(l1,l2)) = LENGTH l1) /\ (LENGTH(ZIP(l1,l2)) = LENGTH l2)
list_Axiom (list)
  |- !x f. ?! fn. (fn[] = x) /\ (!h t. fn(CONS h t) = f(fn t)h t)
list_CASES (list)
  |- !l. (l = []) \/ (?t h. l = CONS h t)
list_INDUCT (list)
  |- !P. P[] /\ (!t. P t ==> (!h. P(CONS h t))) ==> (!l. P l)
list_ISO_DEF (list)
  |- (!a. ABS_list(REP_list a) = a) /\
     (!r. IS_list_REP r = (REP_list(ABS_list r) = r))
LIST_NOT_EQ (list)
  |- !l1 l2. ~(l1 = l2) ==> (!h1 h2. ~(CONS h1 l1 = CONS h2 l2))
list_TY_DEF (list)
  |- ?rep. TYPE_DEFINITION IS_list_REP rep
MAP (list)
  |- (!f. MAP f[] = []) /\ (!f h t. MAP f(CONS h t) = CONS(f h)(MAP f t))
MAP2 (list)
  |- (!f. MAP2 f[][] = []) /\
     (!f h1 t1 h2 t2.
       MAP2 f(CONS h1 t1)(CONS h2 t2) = CONS(f h1 h2)(MAP2 f t1 t2))

MAP2_ZIP (list)
  |- !l1 l2.
      (LENGTH l1 = LENGTH l2) ==>
      (!f. MAP2 f l1 l2 = MAP(UNCURRY f)(ZIP(l1,l2)))
MAP_APPEND (list)
  |- !f l1 l2. MAP f(APPEND l1 l2) = APPEND(MAP f l1)(MAP f l2)
MAP_FILTER (list)
  |- !f P l.
      (!x. P(f x) = P x) ==> (MAP f(FILTER P l) = FILTER P(MAP f l))
MAP_FLAT (list)
  |- !f l. MAP f(FLAT l) = FLAT(MAP(MAP f)l)
MAP_FOLDL (list)
  |- !f l. MAP f l = FOLDL(\l' x. SNOC(f x)l')[]l
MAP_FOLDR (list)
  |- !f l. MAP f l = FOLDR(\x l'. CONS(f x)l')[]l
MAP_MAP_o (list)
  |- !f g l. MAP f(MAP g l) = MAP(f o g)l
MAP_o (list)
  |- !f g. MAP(f o g) = (MAP f) o (MAP g)
MAP_REVERSE (list)
  |- !f l. MAP f(REVERSE l) = REVERSE(MAP f l)
MAP_SNOC (list)
  |- !f x l. MAP f(SNOC x l) = SNOC(f x)(MAP f l)
MONOID_APPEND_NIL (list)
  |- MONOID APPEND[]
NIL_DEF (list)
  |- [] = ABS_list((\n. @e. T),0)
NOT_ALL_EL_SOME_EL (list)
  |- !P l. ~ALL_EL P l = SOME_EL($~ o P)l
NOT_CONS_NIL (list)
  |- !h t. ~(CONS h t = [])
NOT_EQ_LIST (list)
  |- !h1 h2. ~(h1 = h2) ==> (!l1 l2. ~(CONS h1 l1 = CONS h2 l2))

NOT_NIL_CONS (list)
  |- !h t. ~([] = CONS h t)
NOT_NIL_SNOC (list)
  |- !x l. ~([] = SNOC x l)
NOT_SNOC_NIL (list)
  |- !x l. ~(SNOC x l = [])
NOT_SOME_EL_ALL_EL (list)
  |- !P l. ~SOME_EL P l = ALL_EL($~ o P)l
NULL (list)
  |- NULL[] /\ (!h t. ~NULL(CONS h t))
NULL_DEF (list)
  |- (NULL[] = T) /\ (!h t. NULL(CONS h t) = F)
NULL_EQ_NIL (list)
  |- !l. NULL l = (l = [])
NULL_FOLDL (list)
  |- !l. NULL l = FOLDL(\x l'. F)T l
NULL_FOLDR (list)
  |- !l. NULL l = FOLDR(\x l'. F)T l
OR_EL_DEF (list)
  |- OR_EL = SOME_EL I
OR_EL_FOLDL (list)
  |- !l. OR_EL l = FOLDL $\/ F l
OR_EL_FOLDR (list)
  |- !l. OR_EL l = FOLDR $\/ F l
PART (ltree)
  |- (!l. PART[]l = []) /\
     (!n t l.
       PART(CONS n t)l = CONS(FST(SPLIT n l))(PART t(SND(SPLIT n l))))
PREFIX (list)
  |- (!P. PREFIX P[] = []) /\
     (!P x l. PREFIX P(CONS x l) = (P x => CONS x(PREFIX P l) | []))
PREFIX_DEF (list)
  |- !P l. PREFIX P l = FST(SPLITP($~ o P)l)

PREFIX_FOLDR (list)
  |- !P l. PREFIX P l = FOLDR(\x l'. (P x => CONS x l' | []))[]l
REPLICATE (list)
  |- (!x. REPLICATE 0 x = []) /\
     (!n x. REPLICATE(SUC n)x = CONS x(REPLICATE n x))
REVERSE (list)
  |- (REVERSE[] = []) /\ (!x l. REVERSE(CONS x l) = SNOC x(REVERSE l))
REVERSE_APPEND (list)
  |- !l1 l2. REVERSE(APPEND l1 l2) = APPEND(REVERSE l2)(REVERSE l1)
REVERSE_EQ_NIL (list)
  |- !l. (REVERSE l = []) = (l = [])
REVERSE_FLAT (list)
  |- !l. REVERSE(FLAT l) = FLAT(REVERSE(MAP REVERSE l))
REVERSE_FOLDL (list)
  |- !l. REVERSE l = FOLDL(\l' x. CONS x l')[]l
REVERSE_FOLDR (list)
  |- !l. REVERSE l = FOLDR SNOC[]l
REVERSE_REVERSE (list)
  |- !l. REVERSE(REVERSE l) = l
REVERSE_SNOC (list)
  |- !x l. REVERSE(SNOC x l) = CONS x(REVERSE l)
SCANL (list)
  |- (!f e. SCANL f e[] = [e]) /\
     (!f e x l. SCANL f e(CONS x l) = CONS e(SCANL f(f e x)l))
SCANR (list)
  |- (!f e. SCANR f e[] = [e]) /\
     (!f e x l.
       SCANR f e(CONS x l) = CONS(f x(HD(SCANR f e l)))(SCANR f e l))
SEG (list)
  |- (!k l. SEG 0 k l = []) /\
     (!m x l. SEG(SUC m)0(CONS x l) = CONS x(SEG m 0 l)) /\
     (!m k x l. SEG(SUC m)(SUC k)(CONS x l) = SEG(SUC m)k l)
SEG_0_SNOC (list)
  |- !m l x. m <= (LENGTH l) ==> (SEG m 0(SNOC x l) = SEG m 0 l)

SEG_APPEND (list)
|- !m l1 n l2.
m < (LENGTH l1) /\
(LENGTH l1) <= (n + m) /\
(n + m) <= ((LENGTH l1) + (LENGTH l2)) ==>
(SEG n m(APPEND l1 l2) =
 APPEND(SEG((LENGTH l1) - m)m l1)(SEG((n + m) - (LENGTH l1))0 l2))
SEG_APPEND1 (list)
|- !n m l1.
(n + m) <= (LENGTH l1) ==> (!l2. SEG n m(APPEND l1 l2) = SEG n m l1)
SEG_APPEND2 (list)
|- !l1 m n l2.
(LENGTH l1) <= m /\ n <= (LENGTH l2) ==>
(SEG n m(APPEND l1 l2) = SEG n(m - (LENGTH l1))l2)
SEG_FIRSTN_BUTFISTN (list)
|- !n m l.
(n + m) <= (LENGTH l) ==> (SEG n m l = FIRSTN n(BUTFIRSTN m l))
SEG_LASTN_BUTLASTN (list)
|- !n m l.
(n + m) <= (LENGTH l) ==>
(SEG n m l = LASTN n(BUTLASTN((LENGTH l) - (n + m))l))
SEG_LENGTH_ID (list)
|- !l. SEG(LENGTH l)0 l = l
SEG_LENGTH_SNOC (list)
|- !l x. SEG 1(LENGTH l)(SNOC x l) = [x]
SEG_REVERSE (list)
|- !n m l.
(n + m) <= (LENGTH l) ==>
(SEG n m(REVERSE l) = REVERSE(SEG n((LENGTH l) - (n + m))l))
SEG_SEG (list)
|- !n1 m1 n2 m2 l.
(n1 + m1) <= (LENGTH l) /\ (n2 + m2) <= n1 ==>
(SEG n2 m2(SEG n1 m1 l) = SEG n2(m1 + m2)l)
SEG_SNOC (list)
|- !n m l. (n + m) <= (LENGTH l) ==> (!x. SEG n m(SNOC x l) = SEG n m l)
SEG_SUC_CONS (list)
|- !m n l x. SEG m(SUC n)(CONS x l) = SEG m n l

SNOC (list)
  |- (!x. SNOC x[] = [x]) /\
     (!x x' l. SNOC x(CONS x' l) = CONS x'(SNOC x l))
SNOC_11 (list)
  |- !x l x' l'. (SNOC x l = SNOC x' l') = (x = x') /\ (l = l')
SNOC_APPEND (list)
  |- !x l. SNOC x l = APPEND l[x]
SNOC_Axiom (list)
  |- !e f. ?! fn. (fn[] = e) /\ (!x l. fn(SNOC x l) = f(fn l)x l)
SNOC_CASES (list)
  |- !l. (l = []) \/ (?l' x. l = SNOC x l')
SNOC_EQ_LENGTH_EQ (list)
  |- !x1 l1 x2 l2. (SNOC x1 l1 = SNOC x2 l2) ==> (LENGTH l1 = LENGTH l2)
SNOC_FOLDR (list)
  |- !x l. SNOC x l = FOLDR CONS[x]l
SNOC_INDUCT (list)
  |- !P. P[] /\ (!l. P l ==> (!x. P(SNOC x l))) ==> (!l. P l)
SNOC_REVERSE_CONS (list)
  |- !x l. SNOC x l = REVERSE(CONS x(REVERSE l))
SOME_EL (list)
  |- (!P. SOME_EL P[] = F) /\
     (!P x l. SOME_EL P(CONS x l) = P x \/ SOME_EL P l)
SOME_EL_APPEND (list)
  |- !P l1 l2. SOME_EL P(APPEND l1 l2) = SOME_EL P l1 \/ SOME_EL P l2
SOME_EL_BUTFIRSTN (list)
  |- !m l.
      m <= (LENGTH l) ==> (!P. SOME_EL P(BUTFIRSTN m l) ==> SOME_EL P l)
SOME_EL_BUTLASTN (list)
  |- !m l.
      m <= (LENGTH l) ==> (!P. SOME_EL P(BUTLASTN m l) ==> SOME_EL P l)
SOME_EL_DISJ (list)
  |- !P Q l. SOME_EL(\x. P x \/ Q x)l = SOME_EL P l \/ SOME_EL Q l

SOME_EL_FIRSTN (list)
  |- !m l. m <= (LENGTH l) ==> (!P. SOME_EL P(FIRSTN m l) ==> SOME_EL P l)
SOME_EL_FOLDL (list)
  |- !P l. SOME_EL P l = FOLDL(\l' x. l' \/ P x)F l
SOME_EL_FOLDL_MAP (list)
  |- !P l. SOME_EL P l = FOLDL $\/ F(MAP P l)
SOME_EL_FOLDR (list)
  |- !P l. SOME_EL P l = FOLDR(\x l'. P x \/ l')F l
SOME_EL_FOLDR_MAP (list)
  |- !P l. SOME_EL P l = FOLDR $\/ F(MAP P l)
SOME_EL_LASTN (list)
  |- !m l. m <= (LENGTH l) ==> (!P. SOME_EL P(LASTN m l) ==> SOME_EL P l)
SOME_EL_MAP (list)
  |- !P f l. SOME_EL P(MAP f l) = SOME_EL(P o f)l
SOME_EL_REVERSE (list)
  |- !P l. SOME_EL P(REVERSE l) = SOME_EL P l
SOME_EL_SEG (list)
  |- !m k l.
      (m + k) <= (LENGTH l) ==> (!P. SOME_EL P(SEG m k l) ==> SOME_EL P l)
SOME_EL_SNOC (list)
  |- !P x l. SOME_EL P(SNOC x l) = P x \/ SOME_EL P l
SPLIT (ltree)
  |- (!l. SPLIT 0 l = [],l) /\
     (!n l.
       SPLIT(SUC n)l =
       CONS(HD l)(FST(SPLIT n(TL l))),SND(SPLIT n(TL l)))
SPLITP (list)
  |- (!P. SPLITP P[] = [],[]) /\
     (!P x l.
       SPLITP P(CONS x l) =
       (P x => ([],CONS x l) | (CONS x(FST(SPLITP P l)),SND(SPLITP P l))))
SUFFIX_DEF (list)
  |- !P l. SUFFIX P l = FOLDL(\l' x. (P x => SNOC x l' | []))[]l

SUM (list)
  |- (SUM[] = 0) /\ (!h t. SUM(CONS h t) = h + (SUM t))
SUM_APPEND (list)
  |- !l1 l2. SUM(APPEND l1 l2) = (SUM l1) + (SUM l2)
SUM_FLAT (list)
  |- !l. SUM(FLAT l) = SUM(MAP SUM l)
SUM_FOLDL (list)
  |- !l. SUM l = FOLDL $+ 0 l
SUM_FOLDR (list)
  |- !l. SUM l = FOLDR $+ 0 l
SUM_REVERSE (list)
  |- !l. SUM(REVERSE l) = SUM l
SUM_SNOC (list)
  |- !x l. SUM(SNOC x l) = (SUM l) + x
TL (list)
  |- !h t. TL(CONS h t) = t
TL_SNOC (list)
  |- !x l. TL(SNOC x l) = (NULL l => [] | SNOC x(TL l))
UNZIP (list)
  |- (UNZIP[] = [],[]) /\
     (!x l.
       UNZIP(CONS x l) =
       CONS(FST x)(FST(UNZIP l)),CONS(SND x)(SND(UNZIP l)))
UNZIP_FST_DEF (list)
  |- !l. UNZIP_FST l = FST(UNZIP l)
UNZIP_SND_DEF (list)
  |- !l. UNZIP_SND l = SND(UNZIP l)
UNZIP_SNOC (list)
  |- !x l.
      UNZIP(SNOC x l) =
      SNOC(FST x)(FST(UNZIP l)),SNOC(SND x)(SND(UNZIP l))
UNZIP_ZIP (list)
  |- !l1 l2. (LENGTH l1 = LENGTH l2) ==> (UNZIP(ZIP(l1,l2)) = l1,l2)

2.12. Theorems about trees 659

ZIP (list)
  |- (ZIP([],[]) = []) /\
     (!x1 l1 x2 l2. ZIP(CONS x1 l1,CONS x2 l2) = CONS(x1,x2)(ZIP(l1,l2)))
ZIP_SNOC (list)
  |- !l1 l2.
      (LENGTH l1 = LENGTH l2) ==>
      (!x1 x2. ZIP(SNOC x1 l1,SNOC x2 l2) = SNOC(x1,x2)(ZIP(l1,l2)))
ZIP_UNZIP (list)
  |- !l. ZIP(UNZIP l) = l

2.12 Theorems about trees

AP (ltree)
  |- (!l. AP[]l = []) /\
     (!h t l. AP(CONS h t)l = CONS(h(HD l))(AP t(TL l)))
bht (tree)
  |- bht =
     PRIM_REC
     (\tr. tr = node[])
     (\res n tr. ?trl. (tr = node trl) /\ ALL_EL res trl)
dest_node (tree)
  |- !t. dest_node t = (@p. t = node p)
HT (tree)
  |- !t. HT t = (@n. bht n t /\ (!m. m < n ==> ~bht m t))
Is_ltree (ltree)
  |- !t l. Is_ltree(t,l) = (Size t = LENGTH l)
Is_tree_REP (tree)
  |- Is_tree_REP = (\t. !P. (!tl. ALL_EL P tl ==> P(node_REP tl)) ==> P t)
ltree_Axiom (ltree)
  |- !f. ?! fn. !v tl. fn(Node v tl) = f(MAP fn tl)v tl
ltree_Induct (ltree)
  |- !P. (!t. ALL_EL P t ==> (!h. P(Node h t))) ==> (!l. P l)
ltree_ISO_DEF (ltree)
  |- (!a. ABS_ltree(REP_ltree a) = a) /\
     (!r. Is_ltree r = (REP_ltree(ABS_ltree r) = r))

ltree_TY_DEF (ltree)
  |- ?rep. TYPE_DEFINITION Is_ltree rep
Node (ltree)
  |- !v tl.
      Node v tl =
      ABS_ltree
      (node(MAP(FST o REP_ltree)tl),CONS v(FLAT(MAP(SND o REP_ltree)tl)))
node (tree)
  |- !tl. node tl = ABS_tree(node_REP(MAP REP_tree tl))
Node_11 (ltree)
  |- !v1 v2 trl1 trl2.
      (Node v1 trl1 = Node v2 trl2) = (v1 = v2) /\ (trl1 = trl2)
node_11 (tree)
  |- !tl1 tl2. (node tl1 = node tl2) = (tl1 = tl2)
Node_onto (ltree)
  |- !l. ?v trl. l = Node v trl
node_REP (tree)
  |- (node_REP[] = 0) /\
     (!h t. node_REP(CONS h t) = (SUC(h + h)) * (2 EXP (node_REP t)))
PART (ltree)
  |- (!l. PART[]l = []) /\
     (!n t l.
       PART(CONS n t)l = CONS(FST(SPLIT n l))(PART t(SND(SPLIT n l))))
Size (ltree)
  |- Size = (@fn. !tl. fn(node tl) = SUC(SUM(MAP fn tl)))
SPLIT (ltree)
  |- (!l. SPLIT 0 l = [],l) /\
     (!n l.
       SPLIT(SUC n)l = CONS(HD l)(FST(SPLIT n(TL l))),SND(SPLIT n(TL l)))
tree_Axiom (tree)
  |- !f. ?! fn. !tl. fn(node tl) = f(MAP fn tl)tl
tree_Induct (tree)
  |- !P. (!tl. ALL_EL P tl ==> P(node tl)) ==> (!t. P t)

2.13. Theorems used to define types 661

tree_ISO_DEF (tree)
  |- (!a. ABS_tree(REP_tree a) = a) /\
     (!r. Is_tree_REP r = (REP_tree(ABS_tree r) = r))
tree_TY_DEF (tree)
  |- ?rep. TYPE_DEFINITION Is_tree_REP rep
trf (tree)
  |- !n f.
      trf n f =
      (@fn. !trl. (HT(node trl)) <= n ==> (fn(node trl) = f(MAP fn trl)))

2.13 Theorems used to define types

ABS_REP_THM (BASIC-HOL)
  |- !P.
      (?rep. TYPE_DEFINITION P rep) ==>
      (?rep abs. (!a. abs(rep a) = a) /\ (!r. P r = (rep(abs r) = r)))
exists_TRP (tydefs)
  |- !P. (?v. P v[]) ==> (?t. TRP P t)
TRP (tydefs)
  |- !P v tl. TRP P(Node v tl) = P v tl /\ ALL_EL(TRP P)tl
TRP_DEF (tydefs)
  |- !P. TRP P = (@trp. !v tl. trp(Node v tl) = P v tl /\ ALL_EL trp tl)
TYPE_DEFINITION (bool)
  |- !P rep.
      TYPE_DEFINITION P rep =
      (!x' x''. (rep x' = rep x'') ==> (x' = x'')) /\
      (!x. P x = (?x'. x = rep x'))
TY_DEF_THM (tydefs)
  |- !REP ABS P.
      (!a. ABS(REP a) = a) /\ (!r. TRP P r = (REP(ABS r) = r)) ==>
      (!f.
        ?! fn.
         !v tl.
          P v(MAP REP tl) ==>
          (fn(ABS(Node v(MAP REP tl))) = f(MAP fn tl)v tl))

662 Chapter 2. Pre-proved Theorems

Index

*, 1 +, 2 -, 2 /, 3 <, 4

<<, 4

=, 4 >, 6 #, 1 ., 2 @, 7 ^, 3

ABS, 7
ABS CONV, 8
abs goals, 9
ABS REP THM, 661
ABS SIMP, 614
AC CONV, 11
ACCEPT TAC, 9
achieve first, 10
achieves, 10
aconv, 10
activate binders, 11

ADD, 619

ADD1, 619
ADD 0, 619
ADD ASSOC, 619
ADD ASSUM, 12
ADD CLAUSES, 619
ADD CONV, 13
ADD EQ 0, 619
ADD EQ SUB, 619

                                       ADD INV 0, 619
                                       ADD INV 0 EQ, 619
                                       ADD MONO LESS EQ, 619
                                       ADD SUB, 619
                                       ADD SUC, 619
                                       ADD SYM, 619
                                       ALL CONV, 15
                                       ALL EL, 634
                                       ALL EL APPEND, 634
                                       ALL EL BUTFIRSTN, 634
                                       ALL EL BUTLASTN, 634
                                       ALL EL CONJ, 634
                                       ALL EL CONV, 15
                                       ALL EL FIRSTN, 634
                                       ALL EL FOLDL, 634
                                       ALL EL FOLDL MAP, 634
                                       ALL EL FOLDR, 634
                                       ALL EL FOLDR MAP, 634
                                       ALL EL LASTN, 634
                                       ALL EL MAP, 634
                                       ALL EL REPLICATE, 634
                                       ALL EL REVERSE, 634
                                       ALL EL SEG, 635
                                       ALL EL SNOC, 635
                                       ALL TAC, 16
                                       ALL THEN, 17
                                       allowed constant, 14
                                       ALPHA, 17
                                       ALPHA CONV, 18
                                       ancestors, 19
                                       ancestry, 19
                                       AND1 THM, 611

\underline{664 Index}

AND2 THM, 611
AND CLAUSES, 611
AND DEF, 609
AND EL DEF, 635
AND EL FOLDL, 635
AND EL FOLDR, 635
AND EXISTS CONV, 20
AND FORALL CONV, 20
AND IMP INTRO, 611
AND INTRO THM, 611
ANTE CONJ CONV, 21
ANTE RES THEN, 21

AP, 635, 659

AP TERM, 25
AP TERM TAC, 25
AP THM, 26
AP THM TAC, 26
APPEND, 635
append, 22
APPEND ASSOC, 635
APPEND BUTLAST LAST, 635
APPEND BUTLASTN BUTFIRSTN, 635
APPEND BUTLASTN LASTN, 635
APPEND CONV, 23
APPEND FIRSTN BUTFIRSTN, 635
APPEND FIRSTN LASTN, 635
APPEND FOLDL, 635
APPEND FOLDR, 636
APPEND LENGTH EQ, 636
APPEND NIL, 636
append openw, 23
APPEND SNOC, 636
apply proof, 24

ARB, 610

arb term, 27
ARB THM, 610
arity, 27
ascii, 28
ascii code, 28
ASM CASES TAC, 29

                                       ASM REWRITE RULE, 29
                                       ASM REWRITE TAC, 30
                                       assert, 31
                                       assignable print term, 32
                                       assoc, 34
                                       ASSOC ADD, 619
                                       ASSOC APPEND, 636
                                       ASSOC CONJ, 614
                                       ASSOC DEF, 614
                                       ASSOC DISJ, 614
                                       ASSOC FOLDL FLAT, 636
                                       ASSOC FOLDR FLAT, 636
                                       ASSOC MULT, 620
                                       associate restriction, 34
                                       ASSUM LIST, 38
                                       ASSUME, 36
                                       ASSUME TAC, 37
                                       attempt first, 39
                                       autoload, 39
                                       autoload theory, 41
                                       axiom, 41
                                       axiom lfn, 43
                                       axiom msg lfn, 44
                                       axioms, 42

B, 44 b, 45

                                       backup, 45
                                       backup limit, 47
                                       backup list, 50
                                       basic rewrites, 50
                                       BETA CONV, 52
                                       BETA RULE, 52
                                       BETA TAC, 53

bht, 659

                                       binders, 54
                                       bndvar, 55
                                       body, 55
                                       BODY CONJUNCTS, 55
                                       BOOL CASES AX, 610

\underline{Index 665}

BOOL CASES TAC, 56
bool EQ CONV, 57
BOOL EQ DISTINCT, 611
bool ty, 58
BUTFIRSTN, 636
BUTFIRSTN APPEND1, 636
BUTFIRSTN APPEND2, 636
BUTFIRSTN BUTFIRSTN, 637
BUTFIRSTN CONV, 58
BUTFIRSTN LASTN, 637
BUTFIRSTN LENGTH APPEND, 637
BUTFIRSTN LENGTH NIL, 637
BUTFIRSTN REVERSE, 637
BUTFIRSTN SEG, 637
BUTFIRSTN SNOC, 637
BUTLAST, 637
butlast, 59
BUTLAST CONV, 60
BUTLAST DEF, 639
BUTLASTN, 637
BUTLASTN 1, 637
BUTLASTN APPEND1, 637
BUTLASTN APPEND2, 637
BUTLASTN BUTLAST, 638
BUTLASTN BUTLASTN, 638
BUTLASTN CONS, 638
BUTLASTN CONV, 59
BUTLASTN FIRSTN, 638
BUTLASTN LASTN, 638
BUTLASTN LASTN NIL, 638
BUTLASTN LENGTH APPEND, 638
BUTLASTN LENGTH CONS, 638
BUTLASTN LENGTH NIL, 638
BUTLASTN MAP, 638
BUTLASTN REVERSE, 638
BUTLASTN SEG, 638
BUTLASTN SUC BUTLAST, 638

C, 60

cached theories, 61

                                       can, 61
                                       CANCEL SUB, 620
                                       CASES THENL, 62

CB, 63

                                       CCONTR, 63
                                       change state, 65
                                       CHANGED CONV, 64
                                       CHANGED TAC, 65
                                       CHECK ASSUME TAC, 65
                                       check lhs, 66
                                       check specification, 66
                                       check valid, 67
                                       check varstruct, 67
                                       chktac, 67
                                       CHOOSE, 68
                                       CHOOSE TAC, 69
                                       CHOOSE THEN, 70
                                       chop list, 71
                                       close, 72
                                       close theory, 72

Co, 73

                                       com, 73
                                       combine, 74
                                       COMM ASSOC FOLDL REVERSE, 639
                                       COMM ASSOC FOLDR REVERSE, 639
                                       COMM DEF, 615
                                       COMM MONOID FOLDL, 639
                                       COMM MONOID FOLDR, 639
                                       COMMA DEF, 617
                                       compile, 74
                                       compilef, 76
                                       compilet, 77
                                       compiling, 77
                                       compiling stack, 78
                                       concat, 79
                                       concatl, 79
                                       concl, 80
                                       COND ABS, 611
                                       COND CASES TAC, 80
                                       COND CLAUSES, 611

COND CONV, 82
COND DEF, 610
COND EXPAND, 611
COND ID, 611
COND RAND, 611
COND RATOR, 611
CONJ, 82
CONJ ASSOC, 611
CONJ DISCH, 88
CONJ DISCHL, 89
CONJ LIST, 90
CONJ PAIR, 91
CONJ SET CONV, 92
CONJ SYM, 612
CONJ TAC, 92
CONJUNCT1, 83
CONJUNCT2, 83
CONJUNCTS, 84
conjuncts, 84
CONJUNCTS CONV, 85
CONJUNCTS THEN, 86
CONJUNCTS THEN2, 87
CONS, 639
CONS 11, 639
CONS APPEND, 639
CONS DEF, 639
constants, 93
CONTR, 94
CONTR TAC, 95
CONTRAPOS, 94
CONTRAPOS CONV, 95
CONV RULE, 96
CONV TAC, 96
current theory, 97
curry, 98
CURRY DEF, 617

DA, 620

DE MORGAN THM, 612
DEF EXISTS RULE, 108

                                       define finite set syntax, 99
                                       define load lib function, 100
                                       define new type bijections, 101
                                       define set abstraction syntax, 102
                                       define type, 103
                                       definition, 105
                                       definition lfn, 107
                                       definition msg lfn, 108
                                       definitions, 106
                                       delete cache, 109
                                       delete thm, 110
                                       DEPTH CONV, 111
                                       dest abs, 112
                                       dest comb, 113
                                       dest cond, 113
                                       dest conj, 114
                                       dest cons, 114
                                       dest const, 115
                                       dest definition, 115
                                       dest disj, 115
                                       dest eq, 116
                                       dest exists, 116
                                       dest forall, 117
                                       dest form, 117
                                       dest imp, 118
                                       dest let, 118
                                       dest list, 119
                                       dest neg, 119
                                       dest neg imp, 120
                                       dest node, 659
                                       dest pabs, 121
                                       dest pair, 121
                                       dest pred, 122
                                       dest select, 122
                                       dest thm, 123
                                       dest type, 123
                                       dest var, 124
                                       dest vartype, 124
                                       DISCARD TAC, 125
                                       DISCH, 126

disch, 126
DISCH ALL, 127
DISCH TAC, 127
DISCH THEN, 128
DISJ1, 129
DISJ1 TAC, 130
DISJ2, 131
DISJ2 TAC, 131
DISJ ASSOC, 612
DISJ CASES, 133
DISJ CASES TAC, 134
DISJ CASES THEN, 135
DISJ CASES THEN2, 136
DISJ CASES THENL, 138
DISJ CASES UNION, 139
DISJ IMP, 139
DISJ SYM, 612
disjuncts, 132
distinct, 140
DIV LESS EQ, 620
DIV MULT, 620
DIV UNIQUE, 620
DIVISION, 620

do, 141

draft mode, 142
dropout, 142

e, 143 EL, 639 el, 144

EL APPEND1, 641
EL APPEND2, 641
EL CONS, 641
EL CONV, 145
EL ELL, 641
EL IS EL, 641
EL LENGTH APPEND, 641
EL LENGTH SNOC, 641
EL MAP, 641
EL PRE LENGTH, 641

                                       EL REVERSE, 641
                                       EL REVERSE ELL, 641
                                       EL SEG, 641
                                       EL SNOC, 641

ELL, 639

                                       ELL 0 SNOC, 639
                                       ELL APPEND1, 639
                                       ELL APPEND2, 640
                                       ELL CONS, 640
                                       ELL CONV, 145
                                       ELL EL, 640
                                       ELL IS EL, 640
                                       ELL LAST, 640
                                       ELL LENGTH APPEND, 640
                                       ELL LENGTH CONS, 640
                                       ELL LENGTH SNOC, 640
                                       ELL MAP, 640
                                       ELL PRE LENGTH, 640
                                       ELL REVERSE, 640
                                       ELL REVERSE EL, 640
                                       ELL SEG, 640
                                       ELL SNOC, 640
                                       ELL SUC SNOC, 640
                                       end itlist, 146
                                       enter form rep, 147
                                       enter term, 147
                                       enter term rep, 147
                                       EQ CLAUSES, 612
                                       EQ EXPAND, 612
                                       EQ EXT, 615
                                       EQ IMP RULE, 149
                                       EQ IMP THM, 612
                                       EQ LENGTH INDUCT TAC, 150
                                       EQ LENGTH SNOC INDUCT TAC, 151
                                       EQ LESS, 620
                                       EQ LESS EQ, 620
                                       EQ LIST, 641
                                       EQ MONO ADD EQ, 620
                                       EQ MP, 152
                                       EQ REFL, 612

EQ SYM, 612
EQ SYM EQ, 612
EQ TAC, 152
EQ TRANS, 612
EQF ELIM, 147
EQF INTRO, 148
EQT ELIM, 148
EQT INTRO, 149
ETA AX, 610
ETA CONV, 153
EVEN, 620
EVEN ADD, 620
EVEN AND ODD, 620
EVEN DOUBLE, 620
EVEN EXISTS, 620
EVEN MULT, 621
EVEN ODD, 621
EVEN ODD EXISTS, 621
EVEN OR ODD, 621
EVERY, 153
EVERY ASSUM, 154
EVERY CONV, 155
EVERY TCL, 155
EXCLUDED MIDDLE, 612
EXISTENCE, 156
EXISTS, 157
exists, 157
EXISTS AND CONV, 158
EXISTS DEF, 609
EXISTS EQ, 159
EXISTS GREATEST CONV, 159
EXISTS IMP, 160
EXISTS IMP CONV, 160
EXISTS LEAST CONV, 161
EXISTS NOT CONV, 162
EXISTS OR CONV, 162
EXISTS SIMP, 612
EXISTS TAC, 163
exists TRP, 661
EXISTS UNIQUE CONV, 164

                                       EXISTS UNIQUE DEF, 609

EXP, 621

                                       EXP ADD, 621
                                       expand, 164
                                       expandf, 167
                                       explode, 169

EXT, 169

                                       extend theory, 170
                                       F DEF, 609
                                       F IMP, 613
                                       FACT, 621
                                       FACT LESS, 621
                                       FAIL TAC, 171
                                       FALSITY, 612
                                       falsity, 172
                                       fast arith, 172
                                       FCOMM ASSOC, 615
                                       FCOMM DEF, 615
                                       FCOMM FOLDL APPEND, 642
                                       FCOMM FOLDL FLAT, 642
                                       FCOMM FOLDR APPEND, 642
                                       FCOMM FOLDR FLAT, 642
                                       FILTER, 642
                                       filter, 173
                                       FILTER APPEND, 642
                                       FILTER ASM REWRITE RULE, 174
                                       FILTER ASM REWRITE TAC, 174
                                       FILTER COMM, 642
                                       FILTER CONV, 175
                                       FILTER DISCH TAC, 176
                                       FILTER DISCH THEN, 177
                                       FILTER FILTER, 642
                                       FILTER FLAT, 642
                                       FILTER FOLDL, 642
                                       FILTER FOLDR, 643
                                       FILTER GEN TAC, 178
                                       FILTER IDEM, 643
                                       FILTER MAP, 643
                                       FILTER ONCE ASM REWRITE RULE, 179

FILTER ONCE ASM REWRITE TAC, 180
FILTER PURE ASM REWRITE RULE, 180
FILTER PURE ASM REWRITE TAC, 181
FILTER PURE ONCE ASM REWRITE RULE, 182
FILTER PURE ONCE ASM REWRITE TAC, 183
FILTER REVERSE, 643
FILTER SNOC, 643
FILTER STRIP TAC, 183
FILTER STRIP THEN, 185
find, 186
find file, 187
find match, 187
find ml file, 188
find term, 189
find terms, 190
find theory, 190
FIRST, 191
FIRST ASSUM, 192
FIRST CONV, 193
FIRST TCL, 193
FIRSTN, 643
FIRSTN APPEND1, 643
FIRSTN APPEND2, 643
FIRSTN BUTLASTN, 643
FIRSTN CONV, 191
FIRSTN FIRSTN, 643
FIRSTN LENGTH APPEND, 643
FIRSTN LENGTH ID, 643
FIRSTN REVERSE, 643
FIRSTN SEG, 643
FIRSTN SNOC, 644
flags, 194
FLAT, 644
flat, 194
FLAT APPEND, 644
FLAT CONV, 195
FLAT FLAT, 644
FLAT FOLDL, 644
FLAT FOLDR, 644
FLAT REVERSE, 644

                                       FLAT SNOC, 644
                                       FOLDL, 644
                                       FOLDL APPEND, 644
                                       FOLDL CONV, 196
                                       FOLDL FILTER, 644
                                       FOLDL FOLDR REVERSE, 644
                                       FOLDL MAP, 644
                                       FOLDL REVERSE, 644
                                       FOLDL SINGLE, 644
                                       FOLDL SNOC, 645
                                       FOLDL SNOC NIL, 645
                                       FOLDR, 645
                                       FOLDR APPEND, 645
                                       FOLDR CONS NIL, 645
                                       FOLDR CONV, 197
                                       FOLDR FILTER, 645
                                       FOLDR FILTER REVERSE, 645
                                       FOLDR FOLDL, 645
                                       FOLDR FOLDL REVERSE, 645
                                       FOLDR MAP, 645
                                       FOLDR MAP REVERSE, 645
                                       FOLDR REVERSE, 645
                                       FOLDR SINGLE, 645
                                       FOLDR SNOC, 645
                                       forall, 198
                                       FORALL AND CONV, 199
                                       FORALL DEF, 609
                                       FORALL EQ, 199
                                       FORALL IMP CONV, 200
                                       FORALL NOT CONV, 201
                                       FORALL OR CONV, 201
                                       FORALL SIMP, 612
                                       free in, 205
                                       frees, 202
                                       freesl, 203
                                       FREEZE THEN, 203
                                       FRONT CONJ CONV, 205

FST, 617 fst, 206

                                       FST DEF, 617

FUN EQ CONV, 207
FUN EQ LEMMA, 615, 621
funpow, 206

g, 208 GEN, 209

GEN ALL, 211
GEN ALPHA CONV, 212
GEN BETA CONV, 213
GEN REWRITE CONV, 214
GEN REWRITE RULE, 215
GEN REWRITE TAC, 217
GEN TAC, 219
GENL, 210
GENLIST, 646
genvar, 210
get const type, 220
get flag value, 221
get state, 221
get steps, 222
get type, 224
getenv, 219
goals, 224
GREATER, 621
GREATER EQ, 621
GREATER OR EQ, 621
GSPEC, 224
GSUBST TAC, 225
GSYM, 226
HALF MK ABS, 227

HD, 646 hd, 227

help, 228
help search path, 228
hide constant, 229
hol pathname, 229
host name, 230

HT, 659 hyp, 231

hyp union, 231

I, 232

                                       I DEF, 616
                                       I o ID, 616
                                       I THM, 616
                                       IMP ANTISYM AX, 610
                                       IMP ANTISYM RULE, 233
                                       IMP CANON, 234
                                       IMP CLAUSES, 613
                                       IMP CONJ, 234
                                       IMP DISJ THM, 613
                                       IMP ELIM, 235
                                       IMP F, 613
                                       IMP F EQ F, 613
                                       IMP RES TAC, 236
                                       IMP RES THEN, 237
                                       IMP TRANS, 238
                                       implode, 232
                                       INDUCT, 239
                                       INDUCT TAC, 240
                                       INDUCT THEN, 240
                                       INDUCTION, 621
                                       INFINITY AX, 610
                                       infix variable, 243
                                       infixes, 242
                                       inject input, 244

INL, 618 inl, 245

                                       INL DEF, 618

INR, 618 inr, 245

                                       INR DEF, 618
                                       INST, 246
                                       inst, 247
                                       inst check, 248
                                       inst rename list, 249
                                       INST TY TERM, 252
                                       INST TYPE, 250
                                       inst type, 251
                                       install, 248
                                       int of string, 254

int of term, 254
interface map, 252
intersect, 253
INV PRE EQ, 621
INV PRE LESS, 621
INV PRE LESS EQ, 621
INV SUC, 622
INV SUC EQ, 622
is abs, 256
is alphanum, 257
IS ASSUMPTION OF, 613
is axiom, 257
is binder, 258
is binder type, 259
is comb, 259
is cond, 260
is conj, 260
is cons, 261
is const, 261
is constant, 262
is definition, 262
is disj, 263
IS EL, 646
IS EL APPEND, 646
IS EL BUTFIRSTN, 646
IS EL BUTLASTN, 646
IS EL CONV, 263
IS EL DEF, 646
IS EL FILTER, 646
IS EL FIRSTN, 646
IS EL FOLDL, 646
IS EL FOLDL MAP, 646
IS EL FOLDR, 646
IS EL FOLDR MAP, 646
IS EL LASTN, 646
IS EL REPLICATE, 646
IS EL REVERSE, 647
IS EL SEG, 647
IS EL SNOC, 647
IS EL SOME EL, 647

                                       is eq, 264
                                       is exists, 264
                                       is forall, 265
                                       is hidden, 265
                                       is imp, 266
                                       is infix, 267
                                       is infix type, 267
                                       is let, 268
                                       is letter, 269
                                       is list, 269
                                       IS list REP, 647
                                       Is ltree, 659
                                       is ml curried infix, 270
                                       is ml infix, 270
                                       is ml paired infix, 271
                                       is neg, 271
                                       is neg imp, 272
                                       IS NUM REP, 622
                                       is pabs, 272
                                       is pair, 273
                                       IS PAIR DEF, 617
                                       is pred, 273
                                       IS PREFIX, 647
                                       IS PREFIX APPEND, 647
                                       IS PREFIX IS SUBLIST, 647
                                       IS PREFIX PREFIX, 647
                                       IS PREFIX REVERSE, 647
                                       is recording proof, 274
                                       is select, 274
                                       IS SUBLIST, 647
                                       IS SUBLIST APPEND, 647
                                       IS SUBLIST REVERSE, 647
                                       IS SUFFIX, 648
                                       IS SUFFIX APPEND, 648
                                       IS SUFFIX IS SUBLIST, 648
                                       IS SUFFIX REVERSE, 648
                                       IS SUM REP, 618
                                       Is tree REP, 659
                                       is type, 275
                                       is var, 275

is vartype, 276

ISL, 618 isl, 255

ISL OR ISR, 618
ISPEC, 255
ISPECL, 256

ISR, 618 it, 276

itlist, 277
itlist2, 278

K, 278

K DEF, 616
K THM, 616

KI, 279

LAST, 648
last, 279
LAST CONV, 280
LAST DEF, 649
LAST LASTN LAST, 649
LASTN, 648
LASTN 1, 648
LASTN APPEND1, 648
LASTN APPEND2, 648
LASTN BUTFIRSTN, 648
LASTN BUTLASTN, 648
LASTN CONS, 648
LASTN CONV, 280
LASTN LASTN, 648
LASTN LENGTH APPEND, 649
LASTN LENGTH ID, 649
LASTN MAP, 649
LASTN REVERSE, 649
LASTN SEG, 649
LEFT ADD DISTRIB, 622
LEFT AND EXISTS CONV, 281
LEFT AND FORALL CONV, 281
LEFT AND OVER OR, 613
LEFT ID ADD 0, 622
LEFT ID DEF, 615

                                       LEFT ID MULT 1, 622
                                       LEFT IMP EXISTS CONV, 282
                                       LEFT IMP FORALL CONV, 282
                                       LEFT OR EXISTS CONV, 283
                                       LEFT OR FORALL CONV, 283
                                       LEFT OR OVER AND, 613
                                       LEFT SUB DISTRIB, 622
                                       LENGTH, 649
                                       length, 284
                                       LENGTH APPEND, 649
                                       LENGTH BUTFIRSTN, 649
                                       LENGTH BUTLAST, 649
                                       LENGTH BUTLASTN, 649
                                       LENGTH CONS, 649
                                       LENGTH CONV, 284
                                       LENGTH EQ, 649
                                       LENGTH EQ CONS, 649
                                       LENGTH EQ NIL, 650
                                       LENGTH FIRSTN, 650
                                       LENGTH FLAT, 650
                                       LENGTH FOLDL, 650
                                       LENGTH FOLDR, 650
                                       LENGTH GENLIST, 650
                                       LENGTH LASTN, 650
                                       LENGTH MAP, 650
                                       LENGTH MAP2, 650
                                       LENGTH NIL, 650
                                       LENGTH NOT NULL, 650
                                       LENGTH REPLICATE, 650
                                       LENGTH REVERSE, 650
                                       LENGTH SCANL, 650
                                       LENGTH SCANR, 651
                                       LENGTH SEG, 651
                                       LENGTH SNOC, 651
                                       LENGTH UNZIP FST, 651
                                       LENGTH UNZIP SND, 651
                                       LENGTH ZIP, 651
                                       LESS, 622
                                       LESS 0, 622
                                       LESS 0 0, 622

LESS 0 CASES, 622
LESS ADD, 622
LESS ADD 1, 622
LESS ADD NONZERO, 622
LESS ADD SUC, 622
LESS ANTISYM, 623
LESS CASES, 623
LESS CASES IMP, 623
LESS EQ, 623
LESS EQ 0, 623
LESS EQ ADD, 623
LESS EQ ADD SUB, 623
LESS EQ ANTISYM, 623
LESS EQ CASES, 623
LESS EQ EXISTS, 623
LESS EQ IMP LESS SUC, 623
LESS EQ LESS EQ MONO, 623
LESS EQ LESS TRANS, 623
LESS EQ MONO, 623
LESS EQ MONO ADD EQ, 624
LESS EQ REFL, 624
LESS EQ SUB LESS, 624
LESS EQ SUC REFL, 624
LESS EQ TRANS, 624
LESS EQUAL ADD, 623
LESS EQUAL ANTISYM, 623
LESS EXP SUC MONO, 624
LESS IMP LESS ADD, 624
LESS IMP LESS OR EQ, 624
LESS LEMMA1, 624
LESS LEMMA2, 624
LESS LESS CASES, 624
LESS LESS EQ TRANS, 624
LESS LESS SUC, 624
LESS MOD, 624
LESS MONO, 624
LESS MONO ADD, 624
LESS MONO ADD EQ, 625
LESS MONO ADD INV, 625
LESS MONO EQ, 625

                                       LESS MONO MULT, 625
                                       LESS MONO REV, 625
                                       LESS MULT2, 625
                                       LESS MULT MONO, 625
                                       LESS NOT EQ, 625
                                       LESS NOT SUC, 625
                                       LESS OR, 625
                                       LESS OR EQ, 625
                                       LESS OR EQ ADD, 625
                                       LESS REFL, 625
                                       LESS SUB ADD LESS, 625
                                       LESS SUC, 625
                                       LESS SUC EQ COR, 625
                                       LESS SUC IMP, 626
                                       LESS SUC NOT, 626
                                       LESS SUC REFL, 626
                                       LESS SUC SUC, 626
                                       LESS THM, 626
                                       LESS TRANS, 626
                                       let after, 285
                                       let before, 286
                                       let CONV, 287
                                       LET DEF, 610

lhs, 289

                                       libraries, 290
                                       library loader, 290
                                       library pathname, 292
                                       library search path, 293
                                       link, 294
                                       lisp, 294
                                       lisp dir pathname, 295
                                       list Axiom, 651
                                       LIST BETA CONV, 296
                                       list CASES, 651
                                       LIST CONJ, 297
                                       list EQ CONV, 297
                                       list FOLD CONV, 298
                                       LIST INDUCT, 299
                                       list INDUCT, 651
                                       LIST INDUCT TAC, 300

list ISO DEF, 651
list mk abs, 301
list mk comb, 301
list mk conj, 302
list mk disj, 303
LIST MK EXISTS, 304
list mk exists, 304
list mk forall, 305
list mk imp, 305
list mk pair, 306
LIST MP, 307
LIST NOT EQ, 651
list of binders, 307
list TY DEF, 651
load, 308
load axiom, 310
load axioms, 311
load definition, 312
load definitions, 313
load library, 314
load theorem, 315
load theorems, 316
load theory, 317
loadf, 308
loadt, 309
lookup form rep, 318
lookup term, 318
lookup term rep, 318

lsp, 319

ltree Axiom, 659
ltree Induct, 659
ltree ISO DEF, 659
ltree TY DEF, 660

MAP, 651 map, 320

MAP2, 651
map2, 320
MAP2 CONV, 321
MAP2 ZIP, 652

                                       MAP APPEND, 652
                                       MAP CONV, 323
                                       MAP EVERY, 324
                                       MAP FILTER, 652
                                       MAP FIRST, 325
                                       MAP FLAT, 652
                                       MAP FOLDL, 652
                                       MAP FOLDR, 652
                                       MAP MAP o, 652
                                       MAP o, 652
                                       MAP REVERSE, 652
                                       MAP SNOC, 652
                                       mapfilter, 322
                                       maptok, 322
                                       match, 326
                                       MATCH ACCEPT TAC, 327
                                       MATCH MP, 328
                                       MATCH MP TAC, 329
                                       max print depth, 330

mem, 331

                                       merge nets rep, 331
                                       merge term nets, 332
                                       message, 332
                                       MK ABS, 333
                                       mk abs, 333
                                       MK COMB, 334
                                       mk comb, 334
                                       mk cond, 335
                                       mk conj, 335
                                       mk cons, 336
                                       mk const, 336
                                       mk conv net, 337
                                       mk definition, 337
                                       mk disj, 337
                                       mk eq, 338
                                       MK EXISTS, 338
                                       mk exists, 339
                                       mk forall, 339
                                       mk form, 340
                                       mk imp, 340

mk let, 340
mk list, 341
mk neg, 342
mk pabs, 342
mk pair, 342
mk pp thm, 343
mk pred, 343
mk primed var, 344
mk select, 345
mk thm, 345
mk type, 346
mk var, 347
mk vartype, 347
ml curried infix, 348
ml dir pathname, 349
ML eval, 349
ml paired infix, 350
MOD EQ 0, 626
MOD MOD, 626
MOD MULT, 626
MOD ONE, 626
MOD PLUS, 626
MOD TIMES, 626
MOD UNIQUE, 626
MONOID ADD 0, 626
MONOID APPEND NIL, 652
MONOID CONJ T, 615
MONOID DEF, 615
MONOID DISJ F, 615
MONOID MULT 1, 626

MP, 351

MP TAC, 351
MULT, 626
MULT 0, 627
MULT ASSOC, 627
MULT CLAUSES, 627
MULT EQ 0, 627
MULT EXP MONO, 627
MULT LEFT 1, 627
MULT LESS EQ SUC, 627

                                       MULT MONO EQ, 627
                                       MULT RIGHT 1, 627
                                       MULT SUC, 627
                                       MULT SUC EQ, 627
                                       MULT SYM, 627
                                       n strip quant, 391
                                       NEG DISCH, 352
                                       new alphanum, 353
                                       new axiom, 354
                                       new binder, 355
                                       new binder definition, 355
                                       new constant, 357
                                       new definition, 358
                                       new flag, 359
                                       new gen definition, 360
                                       new infix, 361
                                       new infix definition, 362
                                       new infix list rec definition, 363
                                       new infix prim rec definition, 365
                                       new letter, 367
                                       new list rec definition, 367
                                       new open axiom, 369
                                       new parent, 369
                                       new predicate, 370
                                       new prim rec definition, 371
                                       new recursive definition, 372
                                       new special symbol, 375
                                       new specification, 376
                                       new stack, 377
                                       new syntax block, 378
                                       new theory, 379
                                       new type, 380
                                       new type abbrev, 381
                                       new type definition, 382
                                       NIL DEF, 652
                                       nil term net, 383
                                       NO CONV, 388
                                       NO TAC, 388
                                       NO THEN, 388

Node, 660
node, 660
Node 11, 660
node 11, 660
Node onto, 660
node REP, 660

not, 384

NOT ALL EL SOME EL, 652
NOT AND, 613
NOT CLAUSES, 613
NOT CONS NIL, 652
NOT DEF, 609
NOT ELIM, 384
NOT EQ LIST, 652
NOT EQ SYM, 385
NOT EXISTS CONV, 385
NOT EXP 0, 627
NOT F, 613
NOT FORALL CONV, 386
NOT GREATER, 627
NOT GREATER EQ, 628
NOT IMP, 613
NOT INTRO, 386
NOT LEQ, 628
NOT LESS, 628
NOT LESS 0, 628
NOT LESS EQ, 628
NOT LESS EQUAL, 628
NOT MP, 387
NOT NIL CONS, 653
NOT NIL SNOC, 653
NOT NUM EQ, 628
NOT ODD EQ EVEN, 628
NOT SNOC NIL, 653
NOT SOME EL ALL EL, 653
NOT SUC, 628
NOT SUC ADD LESS EQ, 628
NOT SUC LESS EQ, 628
NOT SUC LESS EQ 0, 628
NULL, 653

                                       null, 389
                                       NULL DEF, 653
                                       NULL EQ NIL, 653
                                       NULL FOLDL, 653
                                       NULL FOLDR, 653
                                       num Axiom, 628
                                       num CASES, 628
                                       num CONV, 389
                                       num EQ CONV, 390
                                       num ISO DEF, 628
                                       num TY DEF, 629

o, 391

                                       o ASSOC, 616
                                       o DEF, 616
                                       o THM, 616

ODD, 629

                                       ODD ADD, 629
                                       ODD DOUBLE, 629
                                       ODD EVEN, 629
                                       ODD EXISTS, 629
                                       ODD MULT, 629
                                       ODD OR EVEN, 629
                                       ONCE ASM REWRITE RULE, 392
                                       ONCE ASM REWRITE TAC, 392
                                       ONCE DEPTH CONV, 393
                                       ONCE REW DEPTH CONV, 397
                                       ONCE REWRITE CONV, 395
                                       ONCE REWRITE RULE, 395
                                       ONCE REWRITE TAC, 396

one, 615

                                       one Axiom, 615
                                       one axiom, 616
                                       one DEF, 616
                                       ONE ONE DEF, 615
                                       one TY DEF, 616
                                       ONTO DEF, 615

oo, 399

                                       openi, 399
                                       openw, 399

OR CLAUSES, 613
OR DEF, 609
OR EL DEF, 653
OR EL FOLDL, 653
OR EL FOLDR, 653
OR ELIM THM, 614
OR EXISTS CONV, 402
OR FORALL CONV, 402
OR IMP THM, 614
OR INTRO THM1, 614
OR INTRO THM2, 614
OR LESS, 629
ORELSE, 400
ORELSE TCL, 401
ORELSEC, 401
OUTL, 618
outl, 403
OUTR, 618
outr, 403

p, 404

PAIR, 617
pair, 405
PAIR EQ, 617
PAIR EXISTS, 617
PAIRED BETA CONV, 405
paired delete thm, 407
PAIRED ETA CONV, 407
paired new type, 408
paired theorem, 408
parents, 409
parse as binder, 410

PART, 653, 660

PART MATCH, 412
partition, 411
POP ASSUM, 413
POP ASSUM LIST, 414
pop proofs, 415
pop proofs print, 416
pp axiom, 416

PRE, 629

                                       PRE DEF, 629
                                       PRE SUB, 629
                                       PRE SUB1, 629
                                       PRE SUC EQ, 629
                                       PREFIX, 653
                                       PREFIX DEF, 653
                                       PREFIX FOLDR, 654
                                       preterm abs, 416
                                       preterm antiquot, 417
                                       preterm comb, 418
                                       preterm const, 419
                                       preterm to term, 419
                                       preterm typed, 420
                                       preterm var, 421
                                       PRIM REC, 629
                                       PRIM REC EQN, 630
                                       PRIM REC FUN, 630
                                       PRIM REC THM, 630
                                       print all thm, 422
                                       print begin, 423
                                       print bool, 425
                                       print break, 425
                                       print defined types, 427
                                       print end, 427
                                       print goal, 428
                                       print hyps, 429
                                       print ibegin, 429
                                       print int, 430
                                       print list, 431
                                       print newline, 432
                                       print stack, 433
                                       print state, 433
                                       print string, 435
                                       print subgoals, 435
                                       print term, 435
                                       print theory, 436
                                       print thm, 437
                                       print tok, 437
                                       print type, 438

print unquoted term, 439
print unquoted type, 439
print void, 440
prod TY DEF, 617
prompt, 441
PROVE, 441
prove, 442
prove abs fn one one, 442
prove abs fn onto, 443
prove cases thm, 443
prove constructors distinct, 444
prove constructors one one, 445
PROVE HYP, 446
prove induction thm, 447
prove rec fn exists, 448
prove rep fn one one, 449
prove rep fn onto, 449
prove thm, 450
PURE ASM REWRITE RULE, 451
PURE ASM REWRITE TAC, 451
PURE ONCE ASM REWRITE RULE, 452
PURE ONCE ASM REWRITE TAC, 452
PURE ONCE REWRITE CONV, 453
PURE ONCE REWRITE RULE, 454
PURE ONCE REWRITE TAC, 454
PURE REWRITE CONV, 455
PURE REWRITE RULE, 455
PURE REWRITE TAC, 456
push fsubgoals, 457
push print, 457
push subgoals, 458
quit, 458

r, 458

rand, 459
RAND CONV, 459
rator, 460
RATOR CONV, 460
read, 461
record proof, 463

                                       RecordStep, 462
                                       REDEPTH CONV, 464
                                       REFL, 466
                                       REFL CLAUSE, 614
                                       REFL TAC, 466
                                       remove, 467
                                       remove sticky type, 467
                                       rep goals, 470
                                       REP prod, 617
                                       REPEAT, 468
                                       REPEAT GTCL, 469
                                       REPEAT TCL, 469
                                       REPEATC, 468
                                       REPLICATE, 654
                                       replicate, 470
                                       RES ABSTRACT, 610
                                       RES CANON, 471
                                       RES EXISTS, 610
                                       RES FORALL, 610
                                       RES SELECT, 610
                                       RES TAC, 474
                                       RES THEN, 475
                                       resume recording, 471

rev, 477

                                       rev assoc, 478
                                       rev itlist, 478
                                       REVERSE, 654
                                       REVERSE APPEND, 654
                                       REVERSE CONV, 477
                                       REVERSE EQ NIL, 654
                                       REVERSE FLAT, 654
                                       REVERSE FOLDL, 654
                                       REVERSE FOLDR, 654
                                       REVERSE REVERSE, 654
                                       REVERSE SNOC, 654
                                       REW DEPTH CONV, 485
                                       REWR CONV, 482
                                       REWRITE CONV, 479
                                       REWRITE RULE, 480
                                       REWRITE TAC, 481

rhs, 487

RIGHT ADD DISTRIB, 630
RIGHT AND EXISTS CONV, 487
RIGHT AND FORALL CONV, 488
RIGHT AND OVER OR, 614
RIGHT BETA, 488
RIGHT CONV RULE, 489
RIGHT ID ADD 0, 630
RIGHT ID DEF, 615
RIGHT ID MULT 1, 630
RIGHT IMP EXISTS CONV, 490
RIGHT IMP FORALL CONV, 490
RIGHT LIST BETA, 491
RIGHT OR EXISTS CONV, 491
RIGHT OR FORALL CONV, 492
RIGHT OR OVER AND, 614
RIGHT SUB DISTRIB, 630
root goal, 492
rotate, 493
rotate goals, 494
rotate top, 495
RULE ASSUM TAC, 495

S, 496

S DEF, 616
S THM, 616
save, 496
save thm, 497
save top thm, 498
SCANL, 654
SCANL CONV, 499
SCANR, 654
SCANR CONV, 500
search path, 501

SEG, 654

SEG 0 SNOC, 654
SEG APPEND, 655
SEG APPEND1, 655
SEG APPEND2, 655
SEG CONV, 502

                                       SEG FIRSTN BUTFISTN, 655
                                       SEG LASTN BUTLASTN, 655
                                       SEG LENGTH ID, 655
                                       SEG LENGTH SNOC, 655
                                       SEG REVERSE, 655
                                       SEG SEG, 655
                                       SEG SNOC, 655
                                       SEG SUC CONS, 655
                                       SELECT AX, 610
                                       SELECT CONV, 503
                                       SELECT ELIM, 504
                                       SELECT EQ, 505
                                       SELECT INTRO, 506
                                       SELECT REFL, 614
                                       SELECT RULE, 507
                                       SELECT UNIQUE, 614
                                       set equal, 509
                                       set fail, 509
                                       set fail prefix, 510
                                       set flag, 511
                                       set goal, 512
                                       set help, 513
                                       set help search path, 514
                                       set interface map, 514
                                       set lambda, 515
                                       set library search path, 516
                                       set margin, 517
                                       set pretty mode, 517
                                       set prompt, 518
                                       set search path, 519
                                       set state, 520
                                       set sticky type, 521
                                       set string escape, 522
                                       set thm count, 523
                                       set turnstile, 523
                                       setify, 508
                                       show types, 524
                                       SIMP REC, 630
                                       SIMP REC EXISTS, 630
                                       SIMP REC FUN, 630

SIMP REC FUN LEMMA, 630
SIMP REC REL, 630
SIMP REC THM, 631
Size, 660
SKOLEM CONV, 525

SND, 617 snd, 526

SND DEF, 617
SNOC, 656
SNOC 11, 656
SNOC APPEND, 656
SNOC Axiom, 656
SNOC CASES, 656
SNOC CONV, 526
SNOC EQ LENGTH EQ, 656
SNOC FOLDR, 656
SNOC INDUCT, 656
SNOC INDUCT TAC, 527
SNOC REVERSE CONS, 656
SOME EL, 656
SOME EL APPEND, 656
SOME EL BUTFIRSTN, 656
SOME EL BUTLASTN, 656
SOME EL CONV, 528
SOME EL DISJ, 656
SOME EL FIRSTN, 657
SOME EL FOLDL, 657
SOME EL FOLDL MAP, 657
SOME EL FOLDR, 657
SOME EL FOLDR MAP, 657
SOME EL LASTN, 657
SOME EL MAP, 657
SOME EL REVERSE, 657
SOME EL SEG, 657
SOME EL SNOC, 657
sort, 529
SPEC, 530
SPEC ALL, 532
SPEC TAC, 533
SPEC VAR, 534

                                       special symbols, 531
                                       SPECL, 531

SPLIT, 657, 660

                                       split, 534
                                       SPLITP, 657
                                       splitp, 535
                                       sticky list, 535
                                       store binders, 536
                                       store definition, 536
                                       string of int, 536
                                       strip abs, 537
                                       STRIP ASSUME TAC, 537
                                       strip comb, 539
                                       strip exists, 540
                                       strip forall, 540
                                       STRIP GOAL THEN, 541
                                       strip imp, 543
                                       strip pair, 543
                                       STRIP TAC, 544
                                       STRIP THM THEN, 545
                                       STRUCT CASES TAC, 547

SUB, 631

                                       SUB 0, 631
                                       SUB ADD, 631
                                       SUB CANCEL, 631
                                       SUB CONV, 563
                                       SUB EQ 0, 631
                                       SUB EQ EQ 0, 631
                                       SUB EQUAL 0, 631
                                       SUB LEFT ADD, 631
                                       SUB LEFT EQ, 631
                                       SUB LEFT GREATER, 631
                                       SUB LEFT GREATER EQ, 631
                                       SUB LEFT LESS, 631
                                       SUB LEFT LESS EQ, 631
                                       SUB LEFT SUB, 631
                                       SUB LEFT SUC, 632
                                       SUB LESS 0, 632
                                       SUB LESS EQ, 632
                                       SUB LESS EQ ADD, 632

SUB LESS OR, 632
SUB MONO EQ, 632
SUB PLUS, 632
SUB RIGHT ADD, 632
SUB RIGHT EQ, 632
SUB RIGHT GREATER, 632
SUB RIGHT GREATER EQ, 632
SUB RIGHT LESS, 632
SUB RIGHT LESS EQ, 632
SUB RIGHT SUB, 632
SUB SUB, 632
SUBGOAL THEN, 548
SUBS, 549
SUBS OCCS, 561
SUBST, 551
subst, 552
SUBST1 TAC, 553
SUBST ALL TAC, 554
SUBST CONV, 555
SUBST MATCH, 557
subst occs, 558
SUBST OCCS TAC, 559
SUBST TAC, 560
subtract, 562
SUC ADD SYM, 632
SUC DEF, 633
SUC ID, 633
SUC LESS, 633
SUC NOT, 633
SUC ONE ADD, 633
SUC REP DEF, 633
SUC SUB1, 633
SUFFIX DEF, 657

SUM, 658

SUM APPEND, 658
sum Axiom, 618
sum axiom, 618
SUM FLAT, 658
SUM FOLDL, 658
SUM FOLDR, 658

                                       sum ISO DEF, 618
                                       SUM REVERSE, 658
                                       SUM SNOC, 658
                                       sum TY DEF, 618
                                       suspend recording, 564
                                       SWAP EXISTS CONV, 565

SYM, 565

                                       SYM CONV, 566
                                       syserror, 566
                                       system, 567
                                       T DEF, 609
                                       TAC PROOF, 567
                                       term of int, 568
                                       THEN, 568
                                       THEN TCL, 570
                                       THENC, 569
                                       THENL, 570
                                       theorem, 571
                                       theorem lfn, 573
                                       theorem msg lfn, 573
                                       theorems, 572
                                       thm count, 574
                                       thm frees, 575
                                       timer, 575
                                       TIMES2, 633

TL, 658 tl, 576

                                       TL SNOC, 658
                                       TOP DEPTH CONV, 577
                                       top goal, 578
                                       top print, 578
                                       top proof, 579
                                       top thm, 580
                                       TRANS, 580
                                       tree Axiom, 660
                                       tree Induct, 660
                                       tree ISO DEF, 661
                                       tree TY DEF, 661

trf, 661 TRP, 661

TRP DEF, 661
TRUTH, 614

TRY, 581

TRY CONV, 582
tryfind, 582
tty read, 583
tty write, 583
TY DEF THM, 661
type abbrevs, 585
TYPE DEFINITION, 661
type in, 586
type in type, 587
type of, 587
type tyvars, 588
types, 584
tyvars, 588
tyvarsl, 589
uncurry, 590
UNCURRY DEF, 617
UNDISCH, 590
UNDISCH ALL, 591
UNDISCH TAC, 592
undo autoload, 592
unhide constant, 593
union, 593
unlink, 594
UNZIP, 658
UNZIP FST DEF, 658
UNZIP SND DEF, 658
UNZIP SNOC, 658
UNZIP ZIP, 658
VALID, 594
variant, 595
vars, 596
varsl, 597
version, 598

W, 598 WOP, 633

                                       word separators, 600
                                       words, 598
                                       words2, 599
                                       write, 600
                                       X CASES THEN, 601
                                       X CASES THENL, 603
                                       X CHOOSE TAC, 604
                                       X CHOOSE THEN, 605
                                       X FUN EQ CONV, 607
                                       X GEN TAC, 607
                                       X SKOLEM CONV, 608
                                       ZERO DEF, 633
                                       ZERO DIV, 633
                                       ZERO LESS EQ, 633
                                       ZERO LESS EXP, 633
                                       ZERO MOD, 633
                                       ZERO REP DEF, 633

ZIP, 659

                                       ZIP SNOC, 659
                                       ZIP UNZIP, 659