Tutorial on Isabelle/HOL

apply(auto)done2.5 Datatypes 21In fact, all proofs in this case study look exactly like this. Hence we do notshow them below.More interesting is the transformation of If-expressions into a normalform where the first argument of IF cannot be another IF but must be aconstant or variable. Such a normal form can be computed by repeatedlyreplacing a subterm of the form IF (IF b x y) z u by IF b (IF x z u) (IFy z u), which has the same value. The following primitive recursive functionsperform this task:primrec normif :: "ifex ⇒ ifex ⇒ ifex ⇒ ifex" where"normif (CIF b) t e = IF (CIF b) t e" |"normif (VIF x) t e = IF (VIF x) t e" |"normif (IF b t e) u f = normif b (normif t u f) (normif e u f)"primrec norm :: "ifex ⇒ ifex" where"norm (CIF b) = CIF b" |"norm (VIF x) = VIF x" |"norm (IF b t e) = normif b (norm t) (norm e)"Their interplay is tricky; we leave it to you to develop an intuitive understanding.Fortunately, Isabelle can help us to verify that the transformationpreserves the value of the expression:theorem "valif (norm b) env = valif b env"The proof is canonical, provided we first show the following simplificationlemma, which also helps to understand what normif does:lemma [simp]:"∀ t e. valif (normif b t e) env = valif (IF b t e) env"Note that the lemma does not have a name, but is implicitly used in theproof of the theorem shown above because of the [simp] attribute.But how can we be sure that norm really produces a normal form in theabove sense? We define a function that tests If-expressions for normality:primrec normal :: "ifex ⇒ bool" where"normal(CIF b) = True" |"normal(VIF x) = True" |"normal(IF b t e) = (normal t ∧ normal e ∧(case b of CIF b ⇒ True | VIF x ⇒ True | IF x y z ⇒ False))"Now we prove normal (norm b). Of course, this requires a lemma about normalityof normif:lemma [simp]: "∀ t e. normal(normif b t e) = (normal t ∧ normal e)"How do we come up with the required lemmas? Try to prove the maintheorems without them and study carefully what auto leaves unproved. Thiscan provide the clue. The necessity of universal quantification (∀ t e) in thetwo lemmas is explained in Sect. 3.2