1 (***************************************************************** 

     2   

     3   Nominal Isabelle Tutorial

     4   -------------------------

     5 

     6   11th August 2008, Sydney 

     7 

     8   This file contains most of the material that will be covered in the 

     9   tutorial. The file can be "stepped through"; though it contains much 

    10   commented code (purple text). 

    11 

    12 *)

    13 

    14 (***************************************************************** 

    15 

    16   Proof General

    17   -------------

    18 

    19   Proof General is the front end for Isabelle.

    20 

    21   To run Nominal Isabelle proof-scripts you must have HOL-Nominal enabled in

    22   the menu Isabelle -> Logics. You also need to enable X-Symbols in the menu 

    23   Proof-General -> Options (make sure to save this option once enabled).

    24 

    25   Proof General "paints" blue the part of the proof-script that has already

    26   been processed by Isabelle. You can advance or retract the "frontier" of

    27   this processed part using the "Next" and "Undo" buttons in the

    28   menubar. "Goto" will process everything up to the current cursor position,

    29   or retract if the cursor is inside the blue part. The key-combination

    30   control-c control-return is a short-cut for the "Goto"-operation.

    31 

    32   Proof General gives feedback inside the "Response" and "Goals" buffers.

    33   The response buffer will contain warning messages (in yellow) and 

    34   error messages (in red). Warning messages can generally be ignored. Error 

    35   messages must be dealt with in order to advance the proof script. The goal 

    36   buffer shows which goals need to be proved. The sole idea of interactive 

    37   theorem proving is to get the message "No subgoals." ;o)

    38   

    39 *)

    40 

    41 (***************************************************************** 

    42 

    43   X-Symbols

    44   ---------

    45 

    46   X-symbols provide a nice way to input non-ascii characters. For example:

    47 

    48   \<forall>, \<exists>, \<Down>, \<sharp>, \<And>, \<Gamma>, \<times>, \<noteq>, \<in>, \<subseteq>, \<dots>

    49 

    50   They need to be input via the combination \<name-of-x-symbol> 

    51   where name-of-x-symbol coincides with the usual latex name of

    52   that symbol.

    53 

    54   However, there are some handy short-cuts for frequently used X-symbols. 

    55   For example

    56 

    57   [|  \<dots> \<lbrakk> 

    58   |]  \<dots> \<rbrakk> 

    59   ==> \<dots> \<Longrightarrow> 

    60   =>  \<dots> \<Rightarrow> 

    61   --> \<dots> \<longrightarrow> 

    62   /\  \<dots> \<and>

    63   \/  \<dots> \<or> 

    64   |-> \<dots> \<mapsto>

    65   =_  \<dots> \<equiv>    

    66 

    67 *)

    68 

    69 (***************************************************************** 

    70 

    71   Theories

    72   --------

    73 

    74   Every Isabelle proof-script needs to have a name and must import

    75   some pre-existing theory. For Nominal Isabelle proof-scripts this will 

    76   normally be the theory Nominal, but we use here the theory Lambda.thy, 

    77   which extends Nominal with a definition for lambda-terms and capture-

    78   avoiding substitution.

    79 

    80   BTW, the Nominal theory builds directly on Isabelle/HOL and extends it

    81   only with some definitions and some reasoning infrastructure. It does not 

    82   add any new axiom to Isabelle/HOL. So you can trust what you are doing. ;o)

    83 

    84 *)

    85 

    86 theory CK_Machine

    87   imports "Lambda" 

    88 begin

    89 

    90 text {***************************************************************** 

    91 

    92   Types

    93   -----

    94 

    95   Isabelle is based, roughly, on the theory of simple types including some 

    96   polymorphism. It also includes some overloading, which means that sometimes 

    97   explicit type annotations need to be given.

    98 

    99   - Base types include: nat, bool, string, lam 

   100 

   101   - Type formers include: 'a list, ('a\<times>'b), 'c set   

   102 

   103   - Type variables are written like in ML with an apostrophe: 'a, 'b, \<dots>

   104 

   105   Types known to Isabelle can be queried using:

   106 

   107 *}

   108 

   109 typ nat

   110 typ bool

   111 typ lam              (* the type for alpha-equated lambda-terms *)

   112 typ "('a \<times> 'b)"      (* product type *)

   113 typ "'c set"         (* set type *)

   114 typ "nat \<Rightarrow> bool"    (* the type for functions from nat to bool *)

   115 

   116 (* These give errors: *)

   117 (*typ boolean *) 

   118 (*typ set*)

   119 

   120 

   121 text {***************************************************************** 

   122 

   123    Terms

   124    -----

   125 

   126    Every term in Isabelle needs to be well-typed (however they can have polymorphic

   127    type). Whether a term is accepted can be queried using: 

   128 

   129 *}

   130 

   131 term c                 (* a variable of polymorphic type *)

   132 term "1::nat"          (* the constant 1 in natural numbers *)

   133 term 1                 (* the constant 1 with polymorphic type *)          

   134 term "{1, 2, 3::nat}"  (* the set containing natural numbers 1, 2 and 3 *)      

   135 term "[1, 2, 3]"       (* the list containing the polymorphic numbers 1, 2 and 3 *)  

   136 term "Lam [x].(Var x)" (* a lambda-term *)

   137 term "App t1 t2"       (* another lambda-term *)

   138 

   139 text {* 

   140   Isabelle provides some useful colour feedback about what are constants (in black),

   141   free variables (in blue) and bound variables (in green). *}

   142 

   143 term "True"     (* a constant that is defined in HOL *)

   144 term "true"     (* not recognised as a constant, therefore it is interpreted as a variable *)

   145 term "\<forall>x. P x"  (* x is bound, P is free *)

   146 

   147 text {* Every formula in Isabelle needs to have type bool *}

   148 

   149 term "True"

   150 term "True \<and> False"

   151 term "{1,2,3} = {3,2,1}"

   152 term "\<forall>x. P x"

   153 term "A \<longrightarrow> B"

   154 

   155 text {* 

   156   When working with Isabelle, one is confronted with an object logic (that is HOL)

   157   and Isabelle's meta-logic (called Pure). Sometimes one has to pay attention 

   158   to this fact. *}

   159 

   160 term "A \<longrightarrow> B" (* versus *)

   161 term "A \<Longrightarrow> B"

   162 

   163 term "\<forall>x. P x" (* versus *)

   164 term "\<And>x. P x"

   165 

   166 term "A \<Longrightarrow> B \<Longrightarrow> C" (* is synonymous with *)

   167 term "\<lbrakk>A; B\<rbrakk> \<Longrightarrow> C"

   168 

   169 

   170 text {***************************************************************** 

   171 

   172   Inductive Definitions: The Evaluation Judgement and the Value Predicate

   173   -----------------------------------------------------------------------

   174 

   175   Inductive definitions start with the keyword "inductive" and a predicate name. 

   176   One also needs to provide a type for the predicate. Clauses of the inductive

   177   predicate are introduced by "where" and more than two clauses need to be 

   178   separated by "|". Optionally one can give a name to each clause and indicate 

   179   that it should be added to the hints database ("[intro]"). A typical clause

   180   has some premises and a conclusion. This is written in Isabelle as:

   181 

   182   "premise \<Longrightarrow> conclusion"

   183   "\<lbrakk>premise1; premise2; \<dots> \<rbrakk> \<Longrightarrow> conclusion"

   184 

   185   If no premise is present, then one just writes

   186 

   187   "conclusion"

   188 

   189   Below we define the evaluation judgement for lambda-terms. This definition 

   190   introduces the predicate named "eval". After giving its type, we declare 

   191   the usual pretty syntax _ \<Down> _. In this declaration _ stands for an argument

   192   of eval.

   193 

   194 *}

   195 

   196 inductive

   197   eval :: "lam \<Rightarrow> lam \<Rightarrow> bool" ("_ \<Down> _") 

   198 where

   199   e_Lam:  "Lam [x].t \<Down> Lam [x].t"

   200 | e_App:  "\<lbrakk>t1 \<Down> Lam [x].t; t2 \<Down> v'; t[x::=v'] \<Down> v\<rbrakk> \<Longrightarrow> App t1 t2 \<Down> v"

   201 

   202 declare eval.intros[intro]

   203 

   204 text {* 

   205   Values are also defined using inductive. In our case values

   206   are just lambda-abstractions. *}

   207 

   208 inductive

   209   val :: "lam \<Rightarrow> bool" 

   210 where

   211   v_Lam[intro]:   "val (Lam [x].t)"

   212 

   213 

   214 text {***************************************************************** 

   215 

   216   Theorems

   217   --------

   218 

   219   A central concept in Isabelle is that of theorems. Isabelle's theorem

   220   database can be queried using 

   221 

   222 *}

   223 

   224 thm e_Lam

   225 thm e_App

   226 thm conjI

   227 thm conjunct1

   228 

   229 text {* 

   230   Notice that theorems usually contain schematic variables (e.g. ?P, ?Q, \<dots>). 

   231   These schematic variables can be substituted with any term (of the right type 

   232   of course). It is sometimes useful to suppress the "?" from the schematic 

   233   variables. This can be achieved by using the attribute "[no_vars]". *}

   234 

   235 thm e_Lam[no_vars]

   236 thm e_App[no_vars]

   237 thm conjI[no_vars]

   238 thm conjunct1[no_vars]

   239 

   240 

   241 text {* 

   242   When defining the predicate eval, Isabelle provides us automatically with 

   243   the following theorems that state how evaluation judgments can be introduced 

   244   and what constitutes an induction over the predicate eval. *}

   245 

   246 thm eval.intros[no_vars]

   247 thm eval.induct[no_vars]

   248 

   249 text {***************************************************************** 

   250 

   251   Lemma / Theorem / Corollary Statements 

   252   --------------------------------------

   253 

   254   Whether to use lemma, theorem or corollary makes no semantic difference 

   255   in Isabelle. A lemma starts with "lemma" and consists of a statement 

   256   ("shows \<dots>") and optionally a lemma name, some type-information for 

   257   variables ("fixes \<dots>") and some assumptions ("assumes \<dots>"). Lemmas 

   258   also need to have a proof, but ignore this 'detail' for the moment.

   259   

   260 *}

   261 

   262 lemma alpha_equ:

   263   shows "Lam [x].Var x = Lam [y].Var y"

   264 by (simp add: lam.inject alpha swap_simps fresh_atm)

   265 

   266 lemma Lam_freshness:

   267   assumes a: "x\<noteq>y"

   268   shows "y\<sharp>Lam [x].t \<Longrightarrow> y\<sharp>t"

   269 using a by (simp add: abs_fresh) 

   270 

   271 lemma neutral_element:

   272   fixes x::"nat"

   273   shows "x + 0 = x"

   274 by simp

   275 

   276 

   277 text {***************************************************************** 

   278 

   279   Datatypes: Evaluation Contexts 

   280   ------------------------------

   281 

   282   Datatypes can be defined in Isabelle as follows: we have to provide the name 

   283   of the datatype and list its type-constructors. Each type-constructor needs 

   284   to have the information about the types of its arguments, and optionally 

   285   can also contain some information about pretty syntax. For example, we like

   286   to write "\<box>" for holes.

   287 

   288 *}

   289 

   290 datatype ctx = 

   291     Hole ("\<box>")  

   292   | CAppL "ctx" "lam"

   293   | CAppR "lam" "ctx"

   294 

   295 text {* Now Isabelle knows about: *}

   296 

   297 typ ctx

   298 term "\<box>"

   299 term "CAppL"

   300 term "CAppL \<box> (Var x)"

   301 

   302 text {* 

   303 

   304   1.) MINI EXERCISE

   305   -----------------

   306 

   307   Try and see what happens if you apply a Hole to a Hole? 

   308 

   309 *}

   310 

   311 

   312 text {***************************************************************** 

   313 

   314   The CK Machine

   315   --------------

   316 

   317   The CK machine is also defined using an inductive predicate with four

   318   arguments. The idea behind this abstract machine is to transform, or reduce, 

   319   a configuration consisting of a lambda-term and a framestack (a list of 

   320   contexts), to a new configuration.

   321 

   322   We use the type abbreviation "ctxs" for the type for framestacks. 

   323 

   324   The pretty syntax for the CK machine is <_,_> \<mapsto> <_,_>.

   325 

   326 *}

   327 

   328 types ctxs = "ctx list"

   329 

   330 inductive

   331   machine :: "lam \<Rightarrow> ctxs \<Rightarrow>lam \<Rightarrow> ctxs \<Rightarrow> bool" ("<_,_> \<mapsto> <_,_>")

   332 where

   333   m1[intro]: "<App t1 t2,Es> \<mapsto> <t1,(CAppL \<box> t2)#Es>"

   334 | m2[intro]: "val v \<Longrightarrow> <v,(CAppL \<box> t2)#Es> \<mapsto> <t2,(CAppR v \<box>)#Es>"

   335 | m3[intro]: "val v \<Longrightarrow> <v,(CAppR (Lam [x].t) \<box>)#Es> \<mapsto> <t[x::=v],Es>"

   336 

   337 

   338 text {*

   339   Since the machine defined above only performs a single reduction,

   340   we need to define the transitive closure of this machine. *}

   341 

   342 inductive 

   343   machines :: "lam \<Rightarrow> ctxs \<Rightarrow> lam \<Rightarrow> ctxs \<Rightarrow> bool" ("<_,_> \<mapsto>* <_,_>")

   344 where

   345   ms1[intro]: "<t,Es> \<mapsto>* <t,Es>"

   346 | ms2[intro]: "\<lbrakk><t1,Es1> \<mapsto> <t2,Es2>; <t2,Es2> \<mapsto>* <t3,Es3>\<rbrakk> \<Longrightarrow> <t1,Es1> \<mapsto>* <t3,Es3>"

   347 

   348 

   349 text {***************************************************************** 

   350   

   351   Isar Proofs

   352   -----------

   353 

   354   Isar is a language for writing down proofs that can be understood by humans 

   355   and by Isabelle. An Isar proof can be thought of as a sequence of 'stepping stones' 

   356   that start with the assumptions and lead to the goal to be established. Every such 

   357   stepping stone is introduced by "have" followed by the statement of the stepping 

   358   stone. An exception is the goal to be proved, which need to be introduced with "show".

   359 

   360   Since proofs usually do not proceed in a linear fashion, a label can be given 

   361   to each stepping stone and then used later to refer to this stepping stone 

   362   ("using").

   363 

   364   Each stepping stone (or have-statement) needs to have a justification. The 

   365   simplest justification is "sorry" which admits any stepping stone, even false 

   366   ones (this is good during the development of proofs). Assumption can be 

   367   "justified" using "by fact". Derived facts can be justified using 

   368 

   369   - by simp    (* simplification *)

   370   - by auto    (* proof search and simplification *)

   371   - by blast   (* only proof search *)

   372 

   373   If facts or lemmas are needed in order to justify a have-statement, then

   374   one can feed these facts into the proof by using "using label \<dots>" or 

   375   "using theorem-name \<dots>". More than one label at the time is allowed.

   376 

   377   Induction proofs in Isar are set up by indicating over which predicate(s) 

   378   the induction proceeds ("using a b") followed by the command "proof (induct)". 

   379   In this way, Isabelle uses default settings for which induction should

   380   be performed. These default settings can be overridden by giving more

   381   information, like the variable over which a structural induction should

   382   proceed, or a specific induction principle such as well-founded inductions. 

   383 

   384   After the induction is set up, the proof proceeds by cases. In Isar these 

   385   cases can be given in any order, but must be started with "case" and the 

   386   name of the case, and optionally some legible names for the variables 

   387   referred to inside the case. 

   388 

   389   The possible case-names can be found by looking inside the menu "Isabelle -> 

   390   Show me -> cases". In each "case", we need to establish a statement introduced 

   391   by "show". Once this has been done, the next case can be started using "next". 

   392   When all cases are completed, the proof can be finished using "qed".

   393 

   394   This means a typical induction proof has the following pattern

   395 

   396      proof (induct)

   397        case \<dots>

   398        \<dots>

   399        show \<dots>

   400      next

   401        case \<dots>

   402        \<dots>

   403        show \<dots>

   404      \<dots>

   405      qed

   406   

   407   The four lemmas are by induction on the predicate machines. All proofs establish 

   408   the same property, namely a transitivity rule for machines. The complete Isar 

   409   proofs are given for the first three proofs. The point of these three proofs is 

   410   that each proof increases the readability for humans. 

   411 

   412 *}

   413 

   414 text {***************************************************************** 

   415 

   416   2.) EXERCISE

   417   ------------

   418 

   419   Remove the sorries in the proof below and fill in the correct 

   420   justifications. 

   421 *}

   422 

   423 lemma 

   424   assumes a: "<e1,Es1> \<mapsto>* <e2,Es2>" 

   425   and     b: "<e2,Es2> \<mapsto>* <e3,Es3>"

   426   shows "<e1,Es1> \<mapsto>* <e3,Es3>"

   427 using a b

   428 proof(induct)

   429   case (ms1 e1 Es1)

   430   have c: "<e1,Es1> \<mapsto>* <e3,Es3>" by fact

   431   show "<e1,Es1> \<mapsto>* <e3,Es3>" sorry

   432 next

   433   case (ms2 e1 Es1 e2 Es2 e2' Es2') 

   434   have ih: "<e2',Es2'> \<mapsto>* <e3,Es3> \<Longrightarrow> <e2,Es2> \<mapsto>* <e3,Es3>" by fact

   435   have d1: "<e2',Es2'> \<mapsto>* <e3,Es3>" by fact

   436   have d2: "<e1,Es1> \<mapsto> <e2,Es2>" by fact

   437   

   438   show "<e1,Es1> \<mapsto>* <e3,Es3>" sorry

   439 qed

   440 

   441 text {* 

   442   Just like gotos in the Basic programming language, labels can reduce 

   443   the readability of proofs. Therefore one can use in Isar the notation

   444   "then have" in order to feed a have-statement to the proof of 

   445   the next have-statement. In the proof below this has been used

   446   in order to get rid of the labels c and d1. 

   447 *}

   448 

   449 lemma 

   450   assumes a: "<e1,Es1> \<mapsto>* <e2,Es2>" 

   451   and     b: "<e2,Es2> \<mapsto>* <e3,Es3>"

   452   shows "<e1,Es1> \<mapsto>* <e3,Es3>"

   453 using a b

   454 proof(induct)

   455   case (ms1 e1 Es1)

   456   show "<e1,Es1> \<mapsto>* <e3,Es3>" by fact

   457 next

   458   case (ms2 e1 Es1 e2 Es2 e2' Es2')

   459   have ih: "<e2',Es2'> \<mapsto>* <e3,Es3> \<Longrightarrow> <e2,Es2> \<mapsto>* <e3,Es3>" by fact

   460   have "<e2',Es2'> \<mapsto>* <e3,Es3>" by fact

   461   then have d3: "<e2,Es2> \<mapsto>* <e3,Es3>" using ih by simp

   462   have d2: "<e1,Es1> \<mapsto> <e2,Es2>" by fact

   463   show "<e1,Es1> \<mapsto>* <e3,Es3>" using d2 d3 by auto

   464 qed

   465 

   466 text {* 

   467   The labels d2 and d3 cannot be got rid of in this way, because both 

   468   facts are needed to prove the show-statement. We can still avoid the

   469   labels by feeding a sequence of facts into a proof using the chaining

   470   mechanism:

   471 

   472    have "statement1" \<dots>

   473    moreover

   474    have "statement2" \<dots>

   475    \<dots>

   476    moreover

   477    have "statementn" \<dots>

   478    ultimately have "statement" \<dots>

   479 

   480   In this chain, all "statementi" can be used in the proof of the final 

   481   "statement". With this we can simplify our proof further to:

   482 *}

   483   

   484 lemma 

   485   assumes a: "<e1,Es1> \<mapsto>* <e2,Es2>" 

   486   and     b: "<e2,Es2> \<mapsto>* <e3,Es3>"

   487   shows "<e1,Es1> \<mapsto>* <e3,Es3>"

   488 using a b

   489 proof(induct)

   490   case (ms1 e1 Es1)

   491   show "<e1,Es1> \<mapsto>* <e3,Es3>" by fact

   492 next

   493   case (ms2 e1 Es1 e2 Es2 e2' Es2')

   494   have ih: "<e2',Es2'> \<mapsto>* <e3,Es3> \<Longrightarrow> <e2,Es2> \<mapsto>* <e3,Es3>" by fact

   495   have "<e2',Es2'> \<mapsto>* <e3,Es3>" by fact

   496   then have "<e2,Es2> \<mapsto>* <e3,Es3>" using ih by simp

   497   moreover

   498   have "<e1,Es1> \<mapsto> <e2,Es2>" by fact

   499   ultimately show "<e1,Es1> \<mapsto>* <e3,Es3>" by auto

   500 qed

   501 

   502 text {* 

   503   While automatic proof procedures in Isabelle are not able to prove statements

   504   like "P = NP" assuming usual definitions for P and NP, they can automatically

   505   discharge the lemma we just proved. For this we only have to set up the induction

   506   and auto will take care of the rest. This means we can write:

   507 *}

   508 

   509 lemma ms3[intro]:

   510   assumes a: "<e1,Es1> \<mapsto>* <e2,Es2>" 

   511   and     b: "<e2,Es2> \<mapsto>* <e3,Es3>"

   512   shows "<e1,Es1> \<mapsto>* <e3,Es3>"

   513 using a b by (induct) (auto)

   514 

   515 text {* 

   516   The attribute [intro] indicates that this lemma should be from now on used in

   517   any proof obtained by "auto" or "blast". 

   518 *}

   519 

   520 

   521 text {***************************************************************** 

   522 

   523   A simple fact we need later on is that if t \<Down> t' then t' is a value. 

   524 

   525 *}

   526 

   527 lemma eval_to_val:

   528   assumes a: "t \<Down> t'"

   529   shows "val t'"

   530 using a by (induct) (auto)

   531 

   532 

   533 text {***************************************************************** 

   534 

   535   3.) EXERCISE

   536   ------------

   537 

   538   Fill in the details in the proof below. The proof will establish the fact

   539   that if t \<Down> t' then <t,[]> \<mapsto>* <t',[]>. As can be seen, the proof is by 

   540   induction on the definition of eval. If you want to know how the predicates

   541   machine and machines can be introduced, then use

   542 

   543   thm machine.intros[no_vars]

   544   thm machines.intros[no_vars]

   545 

   546 *}

   547 

   548 theorem 

   549   assumes a: "t \<Down> t'"

   550   shows "<t,[]> \<mapsto>* <t',[]>"

   551 using a 

   552 proof (induct)

   553   case (e_Lam x t)

   554   (* no assumptions *)

   555   show "<Lam [x].t,[]> \<mapsto>* <Lam [x].t,[]>" sorry

   556 next

   557   case (e_App t1 x t t2 v' v)

   558   (* all assumptions in this case *)

   559   have a1: "t1 \<Down> Lam [x].t" by fact

   560   have ih1: "<t1,[]> \<mapsto>* <Lam [x].t,[]>" by fact

   561   have a2: "t2 \<Down> v'" by fact

   562   have ih2: "<t2,[]> \<mapsto>* <v',[]>" by fact

   563   have a3: "t[x::=v'] \<Down> v" by fact

   564   have ih3: "<t[x::=v'],[]> \<mapsto>* <v,[]>" by fact

   565   (* your details *)

   566   show "<App t1 t2,[]> \<mapsto>* <v,[]>" sorry

   567 qed

   568 

   569 text {* 

   570   Again the automatic tools in Isabelle can discharge automatically 

   571   of the routine work in these proofs. We can write: *}

   572 

   573 theorem eval_implies_machines_ctx:

   574   assumes a: "t \<Down> t'"

   575   shows "<t,Es> \<mapsto>* <t',Es>"

   576 using a

   577 by (induct arbitrary: Es)

   578    (metis eval_to_val machine.intros ms1 ms2 ms3 v_Lam)+

   579 

   580 corollary eval_implies_machines:

   581   assumes a: "t \<Down> t'"

   582   shows "<t,[]> \<mapsto>* <t',[]>"

   583 using a eval_implies_machines_ctx by simp

   584 

   585 text {***************************************************************** 

   586 

   587   The Weakening Lemma

   588   -------------------

   589 

   590   The proof of the weakening lemma is often said to be simple, 

   591   routine or trivial. Below we will see how this lemma can be

   592   proved in Nominal Isabelle. First we define types, which

   593   we however do not define as datatypes, but as nominal datatypes.

   594 

   595 *}

   596 

   597 nominal_datatype ty =

   598   tVar "string"

   599 | tArr "ty" "ty" ("_ \<rightarrow> _")

   600 

   601 text {* 

   602   Having defined them as nominal datatypes gives us additional

   603   definitions and theorems that come with types (see below).

   604   *}

   605 

   606 text {* 

   607   We next define the type of typing contexts, a predicate that

   608   defines valid contexts (i.e. lists that contain only unique

   609   variables) and the typing judgement.

   610 

   611 *}

   612 

   613 types ty_ctx = "(name\<times>ty) list"

   614 

   615 inductive

   616   valid :: "ty_ctx \<Rightarrow> bool"

   617 where

   618   v1[intro]: "valid []"

   619 | v2[intro]: "\<lbrakk>valid \<Gamma>; x\<sharp>\<Gamma>\<rbrakk>\<Longrightarrow> valid ((x,T)#\<Gamma>)"

   620 

   621 inductive

   622   typing :: "ty_ctx \<Rightarrow> lam \<Rightarrow> ty \<Rightarrow> bool" ("_ \<turnstile> _ : _") 

   623 where

   624   t_Var[intro]:  "\<lbrakk>valid \<Gamma>; (x,T)\<in>set \<Gamma>\<rbrakk> \<Longrightarrow> \<Gamma> \<turnstile> Var x : T"

   625 | t_App[intro]:  "\<lbrakk>\<Gamma> \<turnstile> t1 : T1\<rightarrow>T2; \<Gamma> \<turnstile> t2 : T1\<rbrakk> \<Longrightarrow> \<Gamma> \<turnstile> App t1 t2 : T2"

   626 | t_Lam[intro]:  "\<lbrakk>x\<sharp>\<Gamma>; (x,T1)#\<Gamma> \<turnstile> t : T2\<rbrakk> \<Longrightarrow> \<Gamma> \<turnstile> Lam [x].t : T1 \<rightarrow> T2"

   627 

   628 

   629 text {*

   630   The predicate x\<sharp>\<Gamma>, read as x fresh for \<Gamma>, is defined by Nominal Isabelle.

   631   Freshness is defined for lambda-terms, products, lists etc. For example

   632   we have:

   633   *}

   634 

   635 lemma

   636   fixes x::"name"

   637   shows "x\<sharp>Lam [x].t"

   638   and   "x\<sharp>(t1,t2) \<Longrightarrow> x\<sharp>App t1 t2"

   639   and   "x\<sharp>(Var y) \<Longrightarrow> x\<sharp>y" 

   640   and   "\<lbrakk>x\<sharp>t1; x\<sharp>t2\<rbrakk> \<Longrightarrow> x\<sharp>(t1,t2)"

   641   and   "\<lbrakk>x\<sharp>l1; x\<sharp>l2\<rbrakk> \<Longrightarrow> x\<sharp>(l1@l2)"

   642   and   "x\<sharp>y \<Longrightarrow> x\<noteq>y" 

   643 by (simp_all add: abs_fresh fresh_prod fresh_list_append fresh_atm)

   644 

   645 text {* We can also prove that every variable is fresh for a type *}

   646 

   647 lemma ty_fresh:

   648   fixes x::"name"

   649   and   T::"ty"

   650   shows "x\<sharp>T"

   651 by (induct T rule: ty.induct)

   652    (simp_all add: fresh_string)

   653 

   654 text {* 

   655   In order to state the weakening lemma in a convenient form, we overload

   656   the subset-notation and define the abbreviation below. Abbreviations behave

   657   like definitions, except that they are always automatically folded and

   658   unfolded.

   659 *}

   660 

   661 abbreviation

   662   "sub_ty_ctx" :: "ty_ctx \<Rightarrow> ty_ctx \<Rightarrow> bool" ("_ \<subseteq> _") 

   663 where

   664   "\<Gamma>1 \<subseteq> \<Gamma>2 \<equiv> \<forall>x. x \<in> set \<Gamma>1 \<longrightarrow> x \<in> set \<Gamma>2"

   665 

   666 text {***************************************************************** 

   667 

   668   4.) Exercise

   669   ------------

   670 

   671   Fill in the details and give a proof of the weakening lemma. 

   672 

   673 *}

   674 

   675 lemma 

   676   fixes \<Gamma>1 \<Gamma>2::"(name\<times>ty) list"

   677   assumes a: "\<Gamma>1 \<turnstile> t : T"

   678   and     b: "valid \<Gamma>2" 

   679   and     c: "\<Gamma>1 \<subseteq> \<Gamma>2"

   680   shows "\<Gamma>2 \<turnstile> t : T"

   681 using a b c

   682 proof (induct arbitrary: \<Gamma>2)

   683   case (t_Var \<Gamma>1 x T)

   684   have a1: "valid \<Gamma>1" by fact

   685   have a2: "(x,T) \<in> set \<Gamma>1" by fact

   686   have a3: "valid \<Gamma>2" by fact

   687   have a4: "\<Gamma>1 \<subseteq> \<Gamma>2" by fact

   688 

   689   show "\<Gamma>2 \<turnstile> Var x : T" sorry

   690 next

   691   case (t_Lam x \<Gamma>1 T1 t T2) 

   692   have ih: "\<And>\<Gamma>3. \<lbrakk>valid \<Gamma>3; (x,T1)#\<Gamma>1 \<subseteq> \<Gamma>3\<rbrakk> \<Longrightarrow> \<Gamma>3 \<turnstile> t : T2" by fact

   693   have a0: "x\<sharp>\<Gamma>1" by fact

   694   have a1: "valid \<Gamma>2" by fact

   695   have a2: "\<Gamma>1 \<subseteq> \<Gamma>2" by fact

   696 

   697   show "\<Gamma>2 \<turnstile> Lam [x].t : T1 \<rightarrow> T2" sorry

   698 qed (auto)

   699 

   700 

   701 text {* 

   702   Despite the frequent claim that the weakening lemma is trivial,

   703   routine or obvious, the proof in the lambda-case does not go 

   704   smoothly through. Painful variable renamings seem to be necessary. 

   705   But the proof using renamings is horribly complicated. It is really 

   706   interesting whether people who claim this proof is  trivial, routine 

   707   or obvious had this proof in mind. 

   708 

   709   BTW: The following two commands help already with showing that validity 

   710   and typing are invariant under variable (permutative) renamings. 

   711 *}

   712 

   713 equivariance valid

   714 equivariance typing

   715 

   716 lemma not_to_be_tried_at_home_weakening: 

   717   fixes \<Gamma>1 \<Gamma>2::"(name\<times>ty) list"

   718   assumes a: "\<Gamma>1 \<turnstile> t : T"

   719   and     b: "valid \<Gamma>2" 

   720   and     c: "\<Gamma>1 \<subseteq> \<Gamma>2"

   721   shows "\<Gamma>2 \<turnstile> t : T"

   722 using a b c

   723 proof (induct arbitrary: \<Gamma>2)

   724   case (t_Lam x \<Gamma>1 T1 t T2) (* lambda case *)

   725   have fc0: "x\<sharp>\<Gamma>1" by fact

   726   have ih: "\<And>\<Gamma>3. \<lbrakk>valid \<Gamma>3; (x,T1)#\<Gamma>1 \<subseteq> \<Gamma>3\<rbrakk> \<Longrightarrow> \<Gamma>3 \<turnstile> t : T2" by fact

   727   obtain c::"name" where fc1: "c\<sharp>(x,t,\<Gamma>1,\<Gamma>2)"  (* we obtain a fresh name *)

   728     by (rule exists_fresh) (auto simp add: fs_name1)

   729   have "Lam [c].([(c,x)]\<bullet>t) = Lam [x].t" using fc1 (* we then alpha-rename the lambda-abstraction *)

   730     by (auto simp add: lam.inject alpha fresh_prod fresh_atm)

   731   moreover

   732   have "\<Gamma>2 \<turnstile> Lam [c].([(c,x)]\<bullet>t) : T1 \<rightarrow> T2" (* we can then alpha-rename our original goal *)

   733   proof - 

   734     (* we establish (x,T1)#\<Gamma>1 \<subseteq> (x,T1)#([(c,x)]\<bullet>\<Gamma>2) and valid ((x,T1)#([(c,x)]\<bullet>\<Gamma>2)) *)

   735     have "(x,T1)#\<Gamma>1 \<subseteq> (x,T1)#([(c,x)]\<bullet>\<Gamma>2)" 

   736     proof -

   737       have "\<Gamma>1 \<subseteq> \<Gamma>2" by fact

   738       then have "[(c,x)]\<bullet>((x,T1)#\<Gamma>1 \<subseteq> (x,T1)#([(c,x)]\<bullet>\<Gamma>2))" using fc0 fc1 

   739 	by (perm_simp add: eqvts calc_atm perm_fresh_fresh ty_fresh)

   740       then show "(x,T1)#\<Gamma>1 \<subseteq> (x,T1)#([(c,x)]\<bullet>\<Gamma>2)" by (rule perm_boolE)

   741     qed

   742     moreover 

   743     have "valid ((x,T1)#([(c,x)]\<bullet>\<Gamma>2))" 

   744     proof -

   745       have "valid \<Gamma>2" by fact

   746       then show "valid ((x,T1)#([(c,x)]\<bullet>\<Gamma>2))" using fc1

   747 	by (auto intro!: v2 simp add: fresh_left calc_atm eqvts)

   748     qed

   749     (* these two facts give us by induction hypothesis the following *)

   750     ultimately have "(x,T1)#([(c,x)]\<bullet>\<Gamma>2) \<turnstile> t : T2" using ih by simp 

   751     (* we now apply renamings to get to our goal *)

   752     then have "[(c,x)]\<bullet>((x,T1)#([(c,x)]\<bullet>\<Gamma>2) \<turnstile> t : T2)" by (rule perm_boolI)

   753     then have "(c,T1)#\<Gamma>2 \<turnstile> ([(c,x)]\<bullet>t) : T2" using fc1 

   754       by (perm_simp add: eqvts calc_atm perm_fresh_fresh ty_fresh)

   755     then show "\<Gamma>2 \<turnstile> Lam [c].([(c,x)]\<bullet>t) : T1 \<rightarrow> T2" using fc1 by auto

   756   qed

   757   ultimately show "\<Gamma>2 \<turnstile> Lam [x].t : T1 \<rightarrow> T2" by simp

   758 qed (auto) (* var and app cases *)

   759 

   760 

   761 text {* 

   762   The remedy to the complicated proof of the weakening proof

   763   shown above is to use a stronger induction principle that

   764   has the usual variable convention already build in. The

   765   following command derives this induction principle for us.

   766   (We shall explain what happens here later.)

   767 

   768 *}

   769 

   770 nominal_inductive typing

   771   by (simp_all add: abs_fresh ty_fresh)

   772 

   773 text {* Compare the two induction principles *}

   774 thm typing.induct[no_vars]

   775 thm typing.strong_induct[no_vars]

   776 

   777 text {* 

   778   We can use the stronger induction principle by replacing

   779   the line

   780 

   781   proof (induct arbitrary: \<Gamma>2)

   782 

   783   with 

   784   

   785   proof (nominal_induct avoiding: \<Gamma>2 rule: typing.strong_induct)

   786 

   787   Try now the proof.

   788 

   789 *}

   790   

   791 

   792 lemma  

   793   fixes \<Gamma>1 \<Gamma>2::"(name\<times>ty) list"

   794   and   t ::"lam"

   795   and   \<tau> ::"ty"

   796   assumes a: "\<Gamma>1 \<turnstile> t : T"

   797   and     b: "valid \<Gamma>2" 

   798   and     c: "\<Gamma>1 \<subseteq> \<Gamma>2"

   799   shows "\<Gamma>2 \<turnstile> t : T"

   800 using a b c

   801 proof (nominal_induct avoiding: \<Gamma>2 rule: typing.strong_induct)

   802   case (t_Var \<Gamma>1 x T)  (* variable case *)

   803   have "\<Gamma>1 \<subseteq> \<Gamma>2" by fact 

   804   moreover  

   805   have "valid \<Gamma>2" by fact 

   806   moreover 

   807   have "(x,T)\<in> set \<Gamma>1" by fact

   808   ultimately show "\<Gamma>2 \<turnstile> Var x : T" by auto

   809 next

   810   case (t_Lam x \<Gamma>1 T1 t T2) 

   811   have vc: "x\<sharp>\<Gamma>2" by fact   (* additional fact *)

   812   have ih: "\<And>\<Gamma>3. \<lbrakk>valid \<Gamma>3; (x,T1)#\<Gamma>1 \<subseteq> \<Gamma>3\<rbrakk> \<Longrightarrow> \<Gamma>3 \<turnstile> t : T2" by fact

   813   have a0: "x\<sharp>\<Gamma>1" by fact

   814   have a1: "valid \<Gamma>2" by fact

   815   have a2: "\<Gamma>1 \<subseteq> \<Gamma>2" by fact

   816 

   817   show "\<Gamma>2 \<turnstile> Lam [x].t : T1 \<rightarrow> T2" sorry

   818 qed (auto) (* app case *)

   819 

   820 text {*

   821   Since we can use the stronger induction principle, the

   822   proof of the weakening lemma can actually be found 

   823   automatically by Isabelle. Maybe the weakening lemma

   824   is actually trivial (in Nominal Isabelle ;o). 

   825 *}

   826 

   827 lemma weakening: 

   828   fixes \<Gamma>1 \<Gamma>2::"ty_ctx"

   829   assumes a: "\<Gamma>1 \<turnstile> t : T" 

   830   and     b: "valid \<Gamma>2" 

   831   and     c: "\<Gamma>1 \<subseteq> \<Gamma>2"

   832   shows "\<Gamma>2 \<turnstile> t : T"

   833 using a b c

   834 by (nominal_induct avoiding: \<Gamma>2 rule: typing.strong_induct)

   835    (auto)

   836 

   837 

   838 text {***************************************************************** 

   839 

   840   Function Definitions: Filling a Lambda-Term into a Context

   841   ----------------------------------------------------------

   842 

   843   Many functions over datatypes can be defined by recursion on the

   844   structure. For this purpose, Isabelle provides "fun". To use it one needs 

   845   to give a name for the function, its type, optionally some pretty-syntax 

   846   and then some equations defining the function. Like in "inductive",

   847   "fun" expects that more than one such equation is separated by "|".

   848 

   849 *}

   850 

   851 fun

   852   filling :: "ctx \<Rightarrow> lam \<Rightarrow> lam" ("_\<lbrakk>_\<rbrakk>")

   853 where

   854   "\<box>\<lbrakk>t\<rbrakk> = t"

   855 | "(CAppL E t')\<lbrakk>t\<rbrakk> = App (E\<lbrakk>t\<rbrakk>) t'"

   856 | "(CAppR t' E)\<lbrakk>t\<rbrakk> = App t' (E\<lbrakk>t\<rbrakk>)"

   857 

   858 text {* 

   859   After this definition Isabelle will be able to simplify

   860   statements like: *}

   861 

   862 lemma 

   863   shows "(CAppL \<box> (Var x))\<lbrakk>Var y\<rbrakk> = App (Var y) (Var x)"

   864   by simp

   865 

   866 

   867 fun 

   868  ctx_compose :: "ctx \<Rightarrow> ctx \<Rightarrow> ctx" ("_ \<circ> _" [101,100] 100)

   869 where

   870   "\<box> \<circ> E' = E'"

   871 | "(CAppL E t') \<circ> E' = CAppL (E \<circ> E') t'"

   872 | "(CAppR t' E) \<circ> E' = CAppR t' (E \<circ> E')"

   873 

   874 fun

   875   ctx_composes :: "ctxs \<Rightarrow> ctx" ("_\<down>" [110] 110)

   876 where

   877     "[]\<down> = \<box>"

   878   | "(E#Es)\<down> = (Es\<down>) \<circ> E"

   879 

   880 text {*  

   881   Notice that we not just have given a pretty syntax for the functions, but

   882   also some precedences..The numbers inside the [\<dots>] stand for the precedences

   883   of the arguments; the one next to it the precedence of the whole term.

   884   

   885   This means we have to write (Es1 \<circ> Es2) \<circ> Es3 otherwise Es1 \<circ> Es2 \<circ> Es3 is

   886   interpreted as Es1 \<circ> (Es2 \<circ> Es3).

   887 *}

   888 

   889 text {******************************************************************

   890   

   891   Structural Inductions over Contexts

   892   ------------------------------------

   893 

   894   So far we have had a look at an induction over an inductive predicate. 

   895   Another important induction principle is structural inductions for 

   896   datatypes. To illustrate structural inductions we prove some facts

   897   about context composition, some of which we will need later on.

   898 

   899 *}

   900 

   901 text {******************************************************************

   902 

   903   5.) EXERCISE

   904   ------------

   905 

   906   Complete the proof and remove the sorries.

   907 

   908 *}

   909 

   910 lemma ctx_compose:

   911   shows "(E1 \<circ> E2)\<lbrakk>t\<rbrakk> = E1\<lbrakk>E2\<lbrakk>t\<rbrakk>\<rbrakk>"

   912 proof (induct E1)

   913   case Hole

   914   show "\<box> \<circ> E2\<lbrakk>t\<rbrakk> = \<box>\<lbrakk>E2\<lbrakk>t\<rbrakk>\<rbrakk>" sorry

   915 next

   916   case (CAppL E1 t')

   917   have ih: "(E1 \<circ> E2)\<lbrakk>t\<rbrakk> = E1\<lbrakk>E2\<lbrakk>t\<rbrakk>\<rbrakk>" by fact

   918   show "((CAppL E1 t') \<circ> E2)\<lbrakk>t\<rbrakk> = (CAppL E1 t')\<lbrakk>E2\<lbrakk>t\<rbrakk>\<rbrakk>" sorry

   919 next

   920   case (CAppR t' E1)

   921   have ih: "(E1 \<circ> E2)\<lbrakk>t\<rbrakk> = E1\<lbrakk>E2\<lbrakk>t\<rbrakk>\<rbrakk>" by fact

   922   show "((CAppR t' E1) \<circ> E2)\<lbrakk>t\<rbrakk> = (CAppR t' E1)\<lbrakk>E2\<lbrakk>t\<rbrakk>\<rbrakk>" sorry

   923 qed

   924 

   925 

   926 text {******************************************************************

   927 

   928   6.) EXERCISE

   929   ------------

   930 

   931   Prove associativity of \<circ> using the lemmas neut_hole and circ_assoc. 

   932 

   933 *}

   934 

   935 lemma neut_hole:

   936   shows "E \<circ> \<box> = E"

   937 by (induct E) (simp_all)

   938 

   939 lemma circ_assoc:

   940   fixes E1 E2 E3::"ctx"

   941   shows "(E1 \<circ> E2) \<circ> E3 = E1 \<circ> (E2 \<circ> E3)"

   942 by (induct E1) (simp_all)

   943 

   944 lemma

   945   shows "(Es1@Es2)\<down> = (Es2\<down>) \<circ> (Es1\<down>)"

   946 proof (induct Es1)

   947   case Nil

   948   show "([]@Es2)\<down> = Es2\<down> \<circ> []\<down>" sorry

   949 next

   950   case (Cons E Es1)

   951   have ih: "(Es1@Es2)\<down> = Es2\<down> \<circ> Es1\<down>" by fact

   952 

   953   show "((E#Es1)@Es2)\<down> = Es2\<down> \<circ> (E#Es1)\<down>" sorry

   954 qed

   955 

   956 

   957 text {* 

   958   The last proof involves several steps of equational reasoning.

   959   Isar provides some convenient means to express such equational 

   960   reasoning in a much cleaner fashion using the "also have" 

   961   construction. *}

   962 

   963 lemma 

   964   shows "(Es1@Es2)\<down> = (Es2\<down>) \<circ> (Es1\<down>)"

   965 proof (induct Es1)

   966   case Nil

   967   show "([]@Es2)\<down> = Es2\<down> \<circ> []\<down>" using neut_hole by simp

   968 next

   969   case (Cons E Es1)

   970   have ih: "(Es1@Es2)\<down> = Es2\<down> \<circ> Es1\<down>" by fact

   971   have "((E#Es1)@Es2)\<down> = (Es1@Es2)\<down> \<circ> E" by simp

   972   also have "\<dots> = (Es2\<down> \<circ> Es1\<down>) \<circ> E" using ih by simp

   973   also have "\<dots> = Es2\<down> \<circ> (Es1\<down> \<circ> E)" using circ_assoc by simp

   974   also have "\<dots> = Es2\<down> \<circ> (E#Es1)\<down>" by simp

   975   finally show "((E#Es1)@Es2)\<down> = Es2\<down> \<circ> (E#Es1)\<down>" by simp

   976 qed

   977 

   978 

   979 text {******************************************************************

   980   

   981   Formalising Barendregt's Proof of the Substitution Lemma

   982   --------------------------------------------------------

   983 

   984   Barendregt's proof needs in the variable case a case distinction.

   985   One way to do this in Isar is to use blocks. A block is some sequent

   986   or reasoning steps enclosed in curly braces

   987 

   988   { \<dots>

   989 

   990     have "statement"

   991   }

   992 

   993   Such a block can contain local assumptions like

   994 

   995   { assume "A"

   996     assume "B"

   997     \<dots>

   998     have "C" by \<dots>

   999   }

  1000 

  1001   Where "C" is the last have-statement in this block. The behaviour 

  1002   of such a block to the 'outside' is the implication

  1003 

  1004    \<lbrakk>A; B\<rbrakk> \<Longrightarrow> "C" 

  1005 

  1006   Now if we want to prove a property "smth" using the case-distinctions

  1007   P\<^isub>1, P\<^isub>2 and P\<^isub>3 then we can use the following reasoning:

  1008 

  1009     { assume "P\<^isub>1"

  1010       \<dots>

  1011       have "smth"

  1012     }

  1013     moreover

  1014     { assume "P\<^isub>2"

  1015       \<dots>

  1016       have "smth"

  1017     }

  1018     moreover

  1019     { assume "P\<^isub>3"

  1020       \<dots>

  1021       have "smth"

  1022     }

  1023     ultimately have "smth" by blast

  1024 

  1025   The blocks establish the implications

  1026 

  1027     P\<^isub>1 \<Longrightarrow> smth

  1028     P\<^isub>2 \<Longrightarrow> smth

  1029     P\<^isub>3 \<Longrightarrow> smth

  1030 

  1031   If we know that P\<^isub>1, P\<^isub>2 and P\<^isub>3 cover all the cases, that is P\<^isub>1 \<or> P\<^isub>2 \<or> P\<^isub>3 is

  1032   true, then we have 'ultimately' established the property "smth" 

  1033   

  1034 *}

  1035 

  1036 text {******************************************************************

  1037   

  1038   7.) Exercise

  1039   ------------

  1040 

  1041   Fill in the cases 1.2 and 1.3 and the equational reasoning 

  1042   in the lambda-case.

  1043 *}

  1044 

  1045 thm forget[no_vars] 

  1046 thm fresh_fact[no_vars] 

  1047 

  1048 lemma 

  1049   assumes a: "x\<noteq>y"

  1050   and     b: "x\<sharp>L"

  1051   shows "M[x::=N][y::=L] = M[y::=L][x::=N[y::=L]]"

  1052 using a b

  1053 proof (nominal_induct M avoiding: x y N L rule: lam.strong_induct)

  1054   case (Var z)

  1055   have a1: "x\<noteq>y" by fact

  1056   have a2: "x\<sharp>L" by fact

  1057   show "Var z[x::=N][y::=L] = Var z[y::=L][x::=N[y::=L]]" (is "?LHS = ?RHS")

  1058   proof -

  1059     { (*Case 1.1*)

  1060       assume c1: "z=x"

  1061       have "(1)": "?LHS = N[y::=L]" using c1 by simp

  1062       have "(2)": "?RHS = N[y::=L]" using c1 a1 by simp

  1063       have "?LHS = ?RHS" using "(1)" "(2)" by simp

  1064     }

  1065     moreover 

  1066     { (*Case 1.2*)

  1067       assume c2: "z=y" "z\<noteq>x" 

  1068       

  1069       have "?LHS = ?RHS" sorry

  1070     }

  1071     moreover 

  1072     { (*Case 1.3*)

  1073       assume c3: "z\<noteq>x" "z\<noteq>y"

  1074       

  1075       have "?LHS = ?RHS" sorry

  1076     }

  1077     ultimately show "?LHS = ?RHS" by blast

  1078   qed

  1079 next

  1080   case (Lam z M1) (* case 2: lambdas *)

  1081   have ih: "\<lbrakk>x\<noteq>y; x\<sharp>L\<rbrakk> \<Longrightarrow> M1[x::=N][y::=L] = M1[y::=L][x::=N[y::=L]]" by fact

  1082   have a1: "x\<noteq>y" by fact

  1083   have a2: "x\<sharp>L" by fact

  1084   have fs: "z\<sharp>x" "z\<sharp>y" "z\<sharp>N" "z\<sharp>L" by fact+

  1085   then have b: "z\<sharp>N[y::=L]" by (simp add: fresh_fact)

  1086   show "(Lam [z].M1)[x::=N][y::=L] = (Lam [z].M1)[y::=L][x::=N[y::=L]]" (is "?LHS=?RHS") 

  1087   proof - 

  1088     have "?LHS = \<dots>" sorry

  1089 

  1090     also have "\<dots> = ?RHS" sorry

  1091     finally show "?LHS = ?RHS" by simp

  1092   qed

  1093 next

  1094   case (App M1 M2) (* case 3: applications *)

  1095   then show "(App M1 M2)[x::=N][y::=L] = (App M1 M2)[y::=L][x::=N[y::=L]]" by simp

  1096 qed

  1097 

  1098 text {* 

  1099   Again the strong induction principle enables Isabelle to find

  1100   the proof of the substitution lemma automatically. 

  1101 *}

  1102 

  1103 lemma substitution_lemma_version:  

  1104   assumes asm: "x\<noteq>y" "x\<sharp>L"

  1105   shows "M[x::=N][y::=L] = M[y::=L][x::=N[y::=L]]"

  1106   using asm 

  1107 by (nominal_induct M avoiding: x y N L rule: lam.strong_induct)

  1108    (auto simp add: fresh_fact forget)

  1109 

  1110 text {******************************************************************

  1111   

  1112   The CBV Reduction Relation (Small-Step Semantics) 

  1113   -------------------------------------------------

  1114 

  1115   In order to establish the property that the CK Machine

  1116   calculates a nomrmalform which corresponds to the

  1117   evaluation relation, we introduce the call-by-value

  1118   small-step semantics.

  1119 

  1120 *}

  1121 

  1122 inductive

  1123   cbv :: "lam\<Rightarrow>lam\<Rightarrow>bool" ("_ \<longrightarrow>cbv _") 

  1124 where

  1125   cbv1: "\<lbrakk>val v; x\<sharp>v\<rbrakk> \<Longrightarrow> App (Lam [x].t) v \<longrightarrow>cbv t[x::=v]"

  1126 | cbv2[intro]: "t \<longrightarrow>cbv t' \<Longrightarrow> App t t2 \<longrightarrow>cbv App t' t2"

  1127 | cbv3[intro]: "t \<longrightarrow>cbv t' \<Longrightarrow> App t2 t \<longrightarrow>cbv App t2 t'"

  1128 

  1129 equivariance val

  1130 equivariance cbv

  1131 nominal_inductive cbv

  1132  by (simp_all add: abs_fresh fresh_fact)

  1133 

  1134 text {*

  1135   In order to satisfy the vc-condition we have to formulate