(***************************************************************** 
  
  Isabelle Tutorial
  -----------------

  27th May 2009, Beijing 

  This file contains most of the material that will be covered in the 
  tutorial. The file can be "stepped through"; though it contains much 
  commented code (purple text). 

*)

(***************************************************************** 

  Proof General
  -------------

  Proof General is the front end for Isabelle.

  Proof General "paints" blue the part of the proof-script that has already
  been processed by Isabelle. You can advance or retract the "frontier" of
  this processed part using the "Next" and "Undo" buttons in the
  menubar. "Goto" will process everything up to the current cursor position,
  or retract if the cursor is inside the blue part. The key-combination
  control-c control-return is a short-cut for the "Goto"-operation.

  Proof General gives feedback inside the "Response" and "Goals" buffers.
  The response buffer will contain warning messages (in yellow) and 
  error messages (in red). Warning messages can generally be ignored. Error 
  messages must be dealt with in order to advance the proof script. The goal 
  buffer shows which goals need to be proved. The sole idea of interactive 
  theorem proving is to get the message "No subgoals." ;o)
  
*)

(***************************************************************** 

  X-Symbols
  ---------

  X-symbols provide a nice way to input non-ascii characters. For example:

  \<forall>, \<exists>, \<Down>, \<sharp>, \<And>, \<Gamma>, \<times>, \<noteq>, \<in>, \<subseteq>, \<dots>

  They need to be input via the combination \<name-of-x-symbol> 
  where name-of-x-symbol coincides with the usual latex name of
  that symbol.

  However, there are some handy short-cuts for frequently used X-symbols. 
  For example

  [|  \<dots> \<lbrakk> 
  |]  \<dots> \<rbrakk> 
  ==> \<dots> \<Longrightarrow> 
  =>  \<dots> \<Rightarrow> 
  --> \<dots> \<longrightarrow> 
  /\  \<dots> \<and>
  \/  \<dots> \<or> 
  |-> \<dots> \<mapsto>
  =_  \<dots> \<equiv>    

*)

(***************************************************************** 

  Theories
  --------

  Every Isabelle proof-script needs to have a name and must import
  some pre-existing theory. This will normally be the theory Main.

*)

theory Lec1
  imports "Main" 
begin

text {***************************************************************** 

  Types
  -----

  Isabelle is based on types including some polymorphism. It also includes 
  some overloading, which means that sometimes explicit type annotations 
  need to be given.

  - Base types include: nat, bool, string

  - Type formers include: 'a list, ('a\<times>'b), 'c set   

  - Type variables are written like in ML with an apostrophe: 'a, 'b, \<dots>

  Types known to Isabelle can be queried using:

*}

typ nat
typ bool
typ string           (* the type for alpha-equated lambda-terms *)
typ "('a \<times> 'b)"      (* pair type *)
typ "'c set"         (* set type *)
typ "'a list"        (* list type *)
typ "nat \<Rightarrow> bool"    (* the type of functions from nat to bool *)

(* These give errors: *)
(*typ boolean *) 
(*typ set*)

text {***************************************************************** 

   Terms
   -----

   Every term in Isabelle needs to be well-typed (however they can have 
   polymorphic type). Whether a term is accepted can be queried using: 

*}

term c                 (* a variable of polymorphic type *)
term "1::nat"          (* the constant 1 in natural numbers *)
term 1                 (* the constant 1 with polymorphic type *)          
term "{1, 2, 3::nat}"  (* the set containing natural numbers 1, 2 and 3 *)      
term "[1, 2, 3]"       (* the list containing the polymorphic numbers 1, 2 and 3 *)  
term "(True, ''c'')"   (* a pair consisting of true and the string "c" *)
term "Suc 0"           (* successor of 0, in other words 1 *) 

text {* 
  Isabelle provides some useful colour feedback about what are constants (in black),
  free variables (in blue) and bound variables (in green). *}

term "True"     (* a constant that is defined in HOL *)
term "true"     (* not recognised as a constant, therefore it is interpreted as a variable *)
term "\<forall>x. P x"  (* x is bound, P is free *)

text {* Every formula in Isabelle needs to have type bool *}

term "True"
term "True \<and> False"
term "True \<or> B"
term "{1,2,3} = {3,2,1}"
term "\<forall>x. P x"
term "A \<longrightarrow> B"

text {* 
  When working with Isabelle, one is confronted with an object logic (that is HOL)
  and Isabelle's meta-logic (called Pure). Sometimes one has to pay attention 
  to this fact. *}

term "A \<longrightarrow> B" (* versus *)
term "A \<Longrightarrow> B"

term "\<forall>x. P x" (* versus *)
term "\<And>x. P x"

term "A \<Longrightarrow> B \<Longrightarrow> C" (* is synonymous with *)
term "\<lbrakk>A; B\<rbrakk> \<Longrightarrow> C"

text {***************************************************************** 

  Inductive Definitions: The even predicate
  -----------------------------------------

  Inductive definitions start with the keyword "inductive" and a predicate name. 
  One also needs to provide a type for the predicate. Clauses of the inductive
  predicate are introduced by "where" and more than two clauses need to be 
  separated by "|". Optionally one can give a name to each clause and indicate 
  that it should be added to the hints database ("[intro]"). A typical clause
  has some premises and a conclusion. This is written in Isabelle as:

  "premise \<Longrightarrow> conclusion"
  "\<lbrakk>premise1; premise2; \<dots> \<rbrakk> \<Longrightarrow> conclusion"

  If no premise is present, then one just writes

  "conclusion"

  Below we define the even predicate for natural numbers. 

*}

inductive
 even :: "nat \<Rightarrow> bool"
where
  eZ[intro]:  "even 0"
| eSS[intro]: "even n \<Longrightarrow> even (Suc (Suc n))"

text {***************************************************************** 

  Theorems
  --------

  A central concept in Isabelle is that of theorems. Isabelle's theorem
  database can be queried using 

*}

thm eZ
thm eSS
thm conjI
thm conjunct1

text {* 
  Notice that theorems usually contain schematic variables (e.g. ?P, ?Q, \<dots>). 
  These schematic variables can be substituted with any term (of the right type 
  of course). It is sometimes useful to suppress the "?" from the schematic 
  variables. This can be achieved by using the attribute "[no_vars]". *}

thm eZ[no_vars]
thm eSS[no_vars]
thm conjI[no_vars]
thm conjunct1[no_vars]


text {* 
  When defining the predicate eval, Isabelle provides us automatically with 
  the following theorems that state how the even predicate can be introduced 
  and what constitutes an induction over the predicate even. *}

thm even.intros[no_vars]
thm even.induct[no_vars]

text {***************************************************************** 

  Lemma / Theorem / Corollary Statements 
  --------------------------------------

  Whether to use lemma, theorem or corollary makes no semantic difference 
  in Isabelle. A lemma starts with "lemma" and consists of a statement 
  ("shows \<dots>") and optionally a lemma name, some type-information for 
  variables ("fixes \<dots>") and some assumptions ("assumes \<dots>"). Lemmas 
  also need to have a proof, but ignore this 'detail' for the moment.
  
*}

lemma even_double:
  shows "even (2 * n)"
by (induct n) (auto)

lemma even_add_n_m:
  assumes a: "even n"
  and     b: "even m"
  shows "even (n + m)"
using a b by (induct) (auto)

lemma neutral_element:
  fixes x::"nat"
  shows "x + 0 = x"
by simp

text {***************************************************************** 
  
  Isar Proofs
  -----------

  Isar is a language for writing down proofs that can be understood by humans 
  and by Isabelle. An Isar proof can be thought of as a sequence of 'stepping stones' 
  that start with the assumptions and lead to the goal to be established. Every such 
  stepping stone is introduced by "have" followed by the statement of the stepping 
  stone. An exception is the goal to be proved, which need to be introduced with "show".

  Since proofs usually do not proceed in a linear fashion, a label can be given 
  to each stepping stone and then used later to refer to this stepping stone 
  ("using").

  Each stepping stone (or have-statement) needs to have a justification. The 
  simplest justification is "sorry" which admits any stepping stone, even false 
  ones (this is good during the development of proofs). Assumption can be 
  "justified" using "by fact". Derived facts can be justified using 

  - by simp    (* simplification *)
  - by auto    (* proof search and simplification *)
  - by blast   (* only proof search *)

  If facts or lemmas are needed in order to justify a have-statement, then
  one can feed these facts into the proof by using "using label \<dots>" or 
  "using theorem-name \<dots>". More than one label at the time is allowed.

  Induction proofs in Isar are set up by indicating over which predicate(s) 
  the induction proceeds ("using a b") followed by the command "proof (induct)". 
  In this way, Isabelle uses default settings for which induction should
  be performed. These default settings can be overridden by giving more
  information, like the variable over which a structural induction should
  proceed, or a specific induction principle such as well-founded inductions. 

  After the induction is set up, the proof proceeds by cases. In Isar these 
  cases can be given in any order, but must be started with "case" and the 
  name of the case, and optionally some legible names for the variables 
  referred to inside the case. 

  The possible case-names can be found by looking inside the menu "Isabelle -> 
  Show me -> cases". In each "case", we need to establish a statement introduced 
  by "show". Once this has been done, the next case can be started using "next". 
  When all cases are completed, the proof can be finished using "qed".

  This means a typical induction proof has the following pattern

     proof (induct)
       case \<dots>
       \<dots>
       show \<dots>
     next
       case \<dots>
       \<dots>
       show \<dots>
     \<dots>
     qed
  
  The four lemmas are by induction on the predicate machines. All proofs establish 
  the same property, namely a transitivity rule for machines. The complete Isar 
  proofs are given for the first three proofs. The point of these three proofs is 
  that each proof increases the readability for humans. 

*}

text {***************************************************************** 

  1.) EXERCISE
  ------------

  Remove the sorries in the proof below and fill in the correct 
  justifications. 
*}

lemma
  shows "even (2 * n)"
proof (induct n)
  case 0
  show "even (2 * 0)" sorry
next
  case (Suc n)
  have ih: "even (2 * n)" by fact
  have eq: "2 * (Suc n) = Suc (Suc (2 * n))" sorry
  have h1: "even (Suc (Suc (2 * n)))" sorry
  show "even (2 * (Suc n))" sorry
qed


text {***************************************************************** 

  2.) EXERCISE
  ------------

  Remove the sorries in the proof below and fill in the correct 
  justifications. 
*}

lemma
  shows "even (n + n)"
proof (induct n)
  case 0
  show "even (0 + 0)" sorry
next
  case (Suc n)
  have ih: "even (n + n)" by fact
  have eq: "(Suc n) + (Suc n) = Suc (Suc (n + n))" sorry
  have a: "even (Suc (Suc (n + n)))" sorry
  show "even ((Suc n) + (Suc n))" sorry
qed
  
text {* 
  Just like gotos in the Basic programming language, labels can reduce 
  the readability of proofs. Therefore one can use in Isar the notation
  "then have" in order to feed a have-statement to the proof of 
  the next have-statement. In the proof below this has been used
  in order to get rid of the labels a. 
*}

lemma even_twice:
  shows "even (n + n)"
proof (induct n)
  case 0
  show "even (0 + 0)" by auto
next
  case (Suc n)
  have ih: "even (n + n)" by fact
  have eq: "(Suc n) + (Suc n) = Suc (Suc (n + n))" by simp
  have "even (Suc (Suc (n + n)))" using ih by auto
  then show "even ((Suc n) + (Suc n))" using eq by simp
qed

text {* 
  The label eq cannot be got rid of in this way, because both 
  facts are needed to prove the show-statement. We can still avoid the
  labels by feeding a sequence of facts into a proof using the chaining
  mechanism:

   have "statement1" \<dots>
   moreover
   have "statement2" \<dots>
   \<dots>
   moreover
   have "statementn" \<dots>
   ultimately have "statement" \<dots>

  In this chain, all "statementi" can be used in the proof of the final 
  "statement". With this we can simplify our proof further to:
*}

lemma
  shows "even (n + n)"
proof (induct n)
  case 0
  show "even (0 + 0)" by auto
next
  case (Suc n)
  have ih: "even (n + n)" by fact
  have "(Suc n) + (Suc n) = Suc (Suc (n + n))" by simp
  moreover
  have "even (Suc (Suc (n + n)))" using ih by auto
  ultimately show "even ((Suc n) + (Suc n))" by simp
qed

text {* 
  While automatic proof procedures in Isabelle are not able to prove statements
  like "P = NP" assuming usual definitions for P and NP, they can automatically
  discharge the lemmas we just proved. For this we only have to set up the induction
  and auto will take care of the rest. This means we can write:
*}

lemma
  shows "even (2 * n)"
by (induct n) (auto)

lemma
  shows "even (n + n)"
by (induct n) (auto)

text {***************************************************************** 

  Rule Inductions
  ---------------

  Inductive predicates are defined in terms of rules of the form

  prem1 \<dots> premn
  --------------
     concl

  In Isabelle we write such rules as

  \<lbrakk>prem1; \<dots>; premn\<rbrakk> \<Longrightarrow> concl

  You can do induction over such rules according to the following
  scheme:

  1.) Assume the property for the premises. Assume the side-conditions.
  2.) Show the property for the conclusion.

  In Isabelle the corresponding theorem is called, for example
*}

thm even.induct

text {***************************************************************** 

  3.) EXERCISE
  ------------

  Remove the sorries in the proof below and fill in the correct 
  justifications. 
*}

lemma even_add:
  assumes a: "even n"
  and     b: "even m"
  shows "even (n + m)"
using a b
proof (induct)
  case eZ
  have as: "even m" by fact
  show "even (0 + m)" sorry
next
  case (eSS n)
  have ih: "even m \<Longrightarrow> even (n + m)" by fact
  have as: "even m" by fact
  
  show "even (Suc (Suc n) + m)" sorry
qed

text {*

  Whenever a lemma is of the form

  lemma
    assumes "pred"
    and     \<dots>
    shows "something"

  then a rule induction is generally appropriate (but
  not always).

  In case of even_add it is definitely *not* appropriate.
  Compare for example what you have to prove when you attempt 
  an induction over natural numbers.

*}

lemma even_add_does_not_work:
  assumes a: "even n"
  and     b: "even m"
  shows "even (n + m)"
using a b
proof (induct n rule: nat_induct)
  case 0
  have "even m" by fact
  then show "even (0 + m)" by simp
next
  case (Suc n)
  have ih: "\<lbrakk>even n; even m\<rbrakk> \<Longrightarrow> even (n + m)" by fact
  have as1: "even (Suc n)" by fact
  have as2: "even m" by fact
  
  show "even ((Suc n) + m)" oops

text {***************************************************************** 

  4.) EXERCISE (Last fact about even)
  -----------------------------------

  Remove the sorries in the proof below and fill in the correct 
  justifications. The following two lemmas should be useful 
*}

thm even_twice[no_vars]
thm even_add[no_vars]

text {* 
  Remember you can include lemmas in the "using" statement,
  just like other facts. For example:

  have "something" using even_twice by simp

*}

lemma even_mul:
  assumes a: "even n"
  shows "even (n * m)"
using a
proof (induct)
  case eZ
  show "even (0 * m)" by auto
next
  case (eSS n)
  have as: "even n" by fact
  have ih: "even (n * m)" by fact
  
  show "even (Suc (Suc n) * m)" sorry
qed

text {***************************************************************** 

  Definitions
  -----------

  Often it is useful to define new concepts in terms of existsing
  concepts. In Isabelle you introduce definitions with the key-
  word "definition". For example

*}

definition
  divide :: "nat \<Rightarrow> nat \<Rightarrow> bool" ("_ DVD _" [100,100] 100)
where
  "m DVD n = (\<exists>k. n = m * k)"

text {*
  
  The annotation ("_ DVD _" [100,100] 100) introduces some fancier
  syntax. In this case we define this predicate as infix. The underscores 
  correspond to the to arguments. The numbers stand for precedences.

  Once this definition is stated, it can be accessed as a normal
  theorem. For example
*}

thm divide_def

text {* 
  Below we prove the really last fact about even. Note
  how we deal with existential quantified formulas, where
  we have to use

  obtain \<dots> where \<dots>

  in order to obtain a witness with which we can reason further.
*}

lemma even_divide:
  assumes a: "even n"
  shows "2 DVD n"
using a
proof (induct)
  case eZ
  have "0 = 2 * (0::nat)" by simp
  then show "2 DVD 0" by (auto simp add: divide_def)
next
  case (eSS n)
  have "2 DVD n" by fact
  then have "\<exists>k. n = 2 * k" by (simp add: divide_def)
  then obtain k where eq: "n = 2 * k" by (auto)
  have "Suc (Suc n) = 2 * (Suc k)" using eq by simp
  then have "\<exists>k. Suc (Suc n) = 2 * k" by blast
  then show "2 DVD (Suc (Suc n))" by (simp add: divide_def)
qed

text {***************************************************************** 

  Function Definitions
  --------------------

  Many functions over datatypes can be defined by recursion on the
  structure. For this purpose, Isabelle provides "fun". To use it one needs 
  to give a name for the function, its type, optionally some pretty-syntax 
  and then some equations defining the function. Like in "inductive",
  "fun" expects that more than one such equation is separated by "|".

  Below we define function iteration using function composition
  defined as "o".
*}

fun
  iter :: "('a \<Rightarrow> 'a) \<Rightarrow> nat \<Rightarrow> ('a \<Rightarrow> 'a)" ("_ !! _")
where 
  "f !! 0 = (\<lambda>x. x)"
| "f !! (Suc n) = (f !! n) o f"

text {*
  5.) EXERCISE

  Prove the following property by induction over n.

*}

lemma 
  shows "f !! (m + n) = (f !! m) o (f !! n)"
sorry

text {*
  A textbook proof of this lemma usually goes:

  Case 0: Trivial

  Case (Suc n): We have to prove that 
    
      "f !! (m + (Suc n)) = f !! m o (f !! (Suc n))"
  
  holds. The induction hypothesis is

      "f !! (m + n) = (f !! m) o (f !! n)"

  The proof is as follows 

      "f !! (m + (Suc n)) = f !! (Suc (m + n))"
                          = f !! (m + n) o f            
                          = (f !! m) o (f !! n) o f     (by ih) 
                          = (f !! m) o ((f !! n) o f)   (by o_assoc)
                          = (f !! m) o (f !! (Suc n))   
       Done.

*}  

lemma 
  shows "f !! (m + n) = (f !! m) o (f !! n)"
proof (induct n)
  case 0
  show "f !! (m + 0) = (f !! m) o (f !! 0)" sorry
next
  case (Suc n)
  have ih: "f !! (m + n) = (f !! m) o (f !! n)" by fact

  show "f !! (m + (Suc n)) = f !! m o (f !! (Suc n))" sorry
qed


text {* 
  The following proof involves several steps of equational reasoning.
  Isar provides some convenient means to express such equational 
  reasoning in a much cleaner fashion using the "also have" 
  construction. *}

lemma 
  shows "f !! (m + n) = (f !! m) o (f !! n)"
proof (induct n)
  case 0
  show "f !! (m + 0) = (f !! m) o (f !! 0)" by (simp add: comp_def)
next
  case (Suc n)
  have ih: "f !! (m + n) = (f !! m) o (f !! n)" by fact
  have eq1: "f !! (m + (Suc n)) = f !! (Suc (m + n))" by simp
  have eq2: "f !! (Suc (m + n)) = f !! (m + n) o f" by simp
  have eq3: "f !! (m + n) o f = (f !! m) o (f !! n) o f" using ih by simp
  have eq4: "(f !! m) o (f !! n) o f = (f !! m) o ((f !! n) o f)" by (simp add: o_assoc)
  have eq5: "(f !! m) o ((f !! n) o f) = (f !! m) o (f !! (Suc n))" by simp
  show "f !! (m + (Suc n)) = f !! m o (f !! (Suc n))" 
    using eq1 eq2 eq3 eq4 eq5 by (simp only:)
qed    
  
text {* 
  The equations can be stringed together with "also have" and "\<dots>",
  as shown below. *}

lemma 
  shows "f !! (m + n) = (f !! m) o (f !! n)"
proof (induct n)
  case 0
  show "f !! (m + 0) = (f !! m) o (f !! 0)" by (simp add: comp_def)
next
  case (Suc n)
  have ih: "f !! (m + n) = (f !! m) o (f !! n)" by fact
  have "f !! (m + (Suc n)) = f !! (Suc (m + n))" by simp
  also have "\<dots> = f !! (m + n) o f" by simp
  also have "\<dots> = (f !! m) o (f !! n) o f" using ih by simp
  also have "\<dots> = (f !! m) o ((f !! n) o f)" by (simp add: o_assoc)
  also have "\<dots> = (f !! m) o (f !! (Suc n))" by simp
  finally show "f !! (m + (Suc n)) = f !! m o (f !! (Suc n))" by simp
qed    

text {*
  This type of equational reasoning also extends to relations.
  For this consider the following power function and the auxiliary
  fact about less-equal and multiplication. *}

fun 
 pow :: "nat \<Rightarrow> nat \<Rightarrow> nat" ("_ \<up> _")
where
  "m \<up> 0 = 1"
| "m \<up> (Suc n) = m * (m \<up> n)"

lemma aux: 
  fixes a b c::"nat"
  assumes a: "a \<le> b" 
  shows " (c * a) \<le> (c * b)"
using a by (auto)

text {*
  With this you can easily implement the following proof
  which is straight taken out of Velleman's "How To Prove It".
*}

lemma
  shows "1 + n * x \<le> (1 + x) \<up> n"
proof (induct n)
  case 0
  show "1 + 0 * x \<le> (1 + x) \<up> 0" by simp
next
  case (Suc n)
  have ih: "1 + n * x \<le> (1 + x) \<up> n" by fact
  have "1 + (Suc n) * x \<le> 1 + x + (n * x) + (n * x * x)" by (simp)
  also have "\<dots> = (1 + x) * (1 + n * x)" by simp
  also have "\<dots> \<le> (1 + x) * ((1 + x) \<up> n)" using ih aux by blast
  also have "\<dots> = (1 + x) \<up> (Suc n)" by simp
  finally show "1 + (Suc n) * x \<le> (1 + x) \<up> (Suc n)" by simp
qed

text {*
  What Velleman actually wants to prove is a proper
  inequality. For this we can nest proofs.
*}

lemma
  shows "n * x < (1 + x) \<up> n"
proof -
  have "1 + n * x \<le> (1 + x) \<up> n"
  proof (induct n)
    case 0
    show "1 + 0 * x \<le> (1 + x) \<up> 0" by simp
  next
    case (Suc n)
    have ih: "1 + n * x \<le> (1 + x) \<up> n" by fact
    have "1 + (Suc n) * x \<le> 1 + x + (n * x) + (n * x * x)" by (simp)
    also have "\<dots> = (1 + x) * (1 + n * x)" by simp
    also have "\<dots> \<le> (1 + x) * ((1 + x) \<up> n)" using ih aux by blast
    also have "\<dots> = (1 + x) \<up> (Suc n)" by simp
    finally show "1 + (Suc n) * x \<le> (1 + x) \<up> (Suc n)" by simp
  qed
  then show "n * x < (1 + x) \<up> n" by simp
qed


end