theory Demo8 = Main: text{*A manual proof in set theory:*} thm equalityI subsetI thm UnI1 UnI2 UnE lemma "A \ B = B \ A" apply(rule equalityI) apply(rule subsetI) apply(erule UnE) apply(rule UnI2) apply(assumption) apply(rule UnI1) apply(assumption) apply(rule subsetI) apply(erule UnE) apply(rule UnI2) apply(assumption) apply(rule UnI1) apply(assumption) done text{* Most simple proofs in set theory are automatic: *} lemma "-(A \ B) = (-A \ -B)" by blast lemma "{x. P x \ Q x} = {x. P x} \ {x. Q x}" by blast -- ------------------------------------------------------------------------ subsection{*Inductive definition of finite sets*} consts Fin :: "'a set set" inductive Fin intros emptyI: "{} \ Fin" insertI: "A \ Fin \ insert a A \ Fin" subsection{*Inductive definition of the even numbers*} consts Ev :: "nat set" inductive Ev intros ZeroI: "0 \ Ev" Add2I: "n \ Ev \ Suc(Suc n) \ Ev" print_theorems text{* Using the introduction rules: *} lemma "Suc(Suc(Suc(Suc 0))) \ Ev" apply(rule Add2I) apply(rule Add2I) apply(rule ZeroI) done text{* Using the elimination rules: *} lemma "n \ Ev \ n = 0 \ (\n' \ Ev. n = Suc (Suc n'))" apply (erule Ev.elims) apply blast apply blast done text{*A simple inductive proof: *} lemma "n \ Ev \ n+n \ Ev" apply(erule Ev.induct) apply(simp) apply(rule ZeroI) apply(simp) apply(rule Add2I) apply(rule Add2I) apply(assumption) done text{* You can also use the rules for Ev as conditional simplification rules. This can shorten proofs considerably. \emph{Warning}: conditional rules can lead to nontermination of the simplifier. The rules for Ev are OK because the premises are always `smaller' than the conclusion. The list of rules for Ev is contained in Ev.intrs. *} declare Ev.intros[simp] text{* A shorter proof: *} lemma "n \ Ev \ n+n \ Ev" apply(erule Ev.induct) apply(auto) done text{* Nice example, but overkill: don't need assumption @{prop"n \ Ev"} because @{prop"n+n \ Ev"} is true for all @{text n}. However, here we really need the assumptions: *} lemma "\ m \ Ev; n \ Ev \ \ m+n \ Ev" apply(erule Ev.induct) apply(auto) done text{* An inductive proof of @{prop"1 \ Ev"}: *} lemma "n \ Ev \ n \ 1" apply(erule Ev.induct) apply(auto) done text{* The general case: *} lemma "n \ Ev \ \(\k. n = 2*k+1)" apply(erule Ev.induct) apply(simp) apply arith done subsection{* Proofs about finite sets *} text{* Above we declared @{text Ev.intrs} as simplification rules. Now we declare @{text Fin.intrs} as introduction rules (via attribute ``intro''). Then fast and blast use them automatically.*} declare Fin.intros [intro] lemma "\ A \ Fin; B \ Fin \ \ A \ B \ Fin"; apply(erule Fin.induct) apply(auto) done lemma "\ A \ Fin; B \ A \ \ B \ Fin" apply(erule Fin.induct) txt{* The base case looks funny: why is the premise not @{prop"B \ {}"}? Because @{prop"B \ A"} was not part of the conclusion we prove. Relief: pull @{prop"B \ A"} into the conclusion with the help of @{text"\"}. *} oops lemma "A \ Fin \ B \ A \ B \ Fin" apply(erule Fin.induct) apply(auto) txt{* We need to strengthen the theorem: quantify @{text B}. *} oops lemma "A \ Fin \ \B. B \ A \ B \ Fin" apply(erule Fin.induct) thm subset_empty apply(simp add: subset_empty) apply(rule Fin.emptyI) apply(rule allI) apply(rule impI) apply(simp add:subset_insert_iff split:split_if_asm) apply(drule_tac A = B in insert_Diff) apply(erule subst) apply(blast) done -- ------------------------------------------------------------------- text {* Cases (elimination) in Isar *} lemma "n \ Ev \ n = 0 \ (\n' \ Ev. n = Suc (Suc n'))" proof - assume "n \ Ev" from this show "n = 0 \ (\n' \ Ev. n = Suc (Suc n'))" proof cases assume "n = 0" thus ?thesis .. next fix n' assume "n = Suc (Suc n')" "n' \ Ev" thus ?thesis by blast qed qed lemma assumes n: "n \ Ev" shows "n = 0 \ (\n' \ Ev. n = Suc (Suc n'))" using n proof cases case ZeroI thus ?thesis .. next case Add2I thus ?thesis by blast qed text {* Rule induction in Isar *} lemma "n \ Ev \ \k. n = 2*k" proof (induct rule: Ev.induct) case ZeroI thus ?case by simp next case Add2I thus ?case by arith qed lemma assumes n: "n \ Ev" shows "\k. n = 2*k" using n proof induct case ZeroI thus ?case by simp next case Add2I thus ?case by arith qed lemma assumes n: "n \ Ev" shows "\k. n = 2*k" using n proof induct case ZeroI thus ?case by simp next case (Add2I m) then obtain k where "m = 2*k" by blast hence "Suc (Suc m) = 2*(k+1)" by simp thus "\k. Suc (Suc m) = 2*k" .. qed end