I find myself solving a goal that with safe splits to 32 subgoals. It is a quite algebraic goal so overall I need to use argo, algebra and auto. I was wondering if there is a way to specify that auto should be applied say 2 times, then algebra 10 times etc. Where should I look for this syntax in the future? Is it part of eisbach?
There is the REPEAT_DETERM_N tactical in $ISABELLE_HOME/src/Pure/tactical.ML I never used it so I'm not 100% sure it's what you need.
Alternatively your functionality can be done somewhat like that:
theory NTimes
imports
Main
"~~/src/HOL/Eisbach/Eisbach"
begin
ML ‹
infixr 2 TIMES
fun 0 TIMES _ = all_tac
| n TIMES tac = tac THEN (n - 1) TIMES tac
›
notepad
begin
fix A B C D
have test1: "A ∧ B ∧ C ∧ D ⟹ True"
apply (tactic ‹3 TIMES eresolve_tac #{context} [#{thm conjE}] 1›)
apply (rule TrueI)
done
fix E
have test2: "A ∧ B ∧ C ∧ D ∧ E ⟹ True"
apply (tactic ‹2 TIMES 2 TIMES eresolve_tac #{context} [#{thm conjE}] 1›)
apply (rule TrueI)
done
end
(* For good examples for working
with higher order methods in ML see $ISABELLE_HOME/src/HOL/Eisbach/Eisbach.thy *)
method_setup ntimes = ‹
Scan.lift Parse.nat -- Method.text_closure >>
(fn (n, closure) => fn ctxt => fn facts =>
let
val tac = method_evaluate closure ctxt facts
in
SIMPLE_METHOD (n TIMES tac) facts
end)
›
notepad
begin
fix A B C D
have test1: "A ∧ B ∧ C ∧ D ⟹ True"
apply (ntimes 3 ‹erule conjE›)
apply (rule TrueI)
done
fix E
have test2: "A ∧ B ∧ C ∧ D ∧ E ⟹ True"
apply (ntimes 2 ‹ntimes 2 ‹erule conjE››)
apply (rule TrueI)
done
have test3: "A ∧ B ∧ C ∧ D ∧ E ⟹ True"
apply (ntimes 3 ‹erule conjE›)
apply (rule TrueI)
done
have test4: "A = A" "B = B" "C = C"
apply -
apply (ntimes 2 ‹fastforce›)
apply (rule refl)
done
(* in some examples one can instead use subgoal ranges *)
have test5: "A = A" "B = B" "C = C"
apply -
apply (fastforce+)[2]
apply (rule refl)
done
end
end
I'm not an expert in Isabelle/ML Programming so this code is likely of low quality, but I hope it's a good starting point for you!
I'm trying to write a custom induction rule for an inductive set. Unfortunately, when I try to apply it with induction rule: my_induct_rule, I get an extra, impossible to prove case. I have the following:
inductive iterate :: "('a ⇒ 'a ⇒ bool) ⇒ 'a ⇒ 'a ⇒ bool" for f where
iter_refl [simp]: "iterate f a a"
| iter_step [elim]: "f a b ⟹ iterate f b c ⟹ iterate f a c"
theorem my_iterate_induct: "iterate f x y ⟹ (⋀a. P a a) ⟹
(⋀a b c. f a b ⟹ iterate f b c ⟹ P b c ⟹ P a c) ⟹ P x y"
by (induction x y rule: iterate.induct) simp_all
lemma iter_step_backwards: "iterate f a b ⟹ f b c ⟹ iterate f a c"
proof (induction a b rule: my_iterate_induct)
...
qed
Obviously the custom induction rule doesn't give me any new power (my real use case is more complicated) but that's kinda the point. my_iterate_induct is exactly the same as the autogenerated iterate.induct rule, as far as I can tell, but inside the proof block I have the following goals:
goal (3 subgoals):
1. iterate ?f a b
2. ⋀a. iterate f a a ⟹ f a c ⟹ iterate f a c
3. ⋀a b ca. ?f a b ⟹ iterate ?f b ca ⟹
(iterate f b ca ⟹ f ca c ⟹ iterate f b c) ⟹ iterate f a ca ⟹
f ca c ⟹ iterate f a c
Goal 1 seems to rise from some failure to unify ?f with the actual argument f, but if I ignore the fact that the f is fixed and try induction f a b rule: my_iterate_induct I just get Failed to apply proof method, as expected. How do I get the nice behaviour that the regular iterate.induct provides?
You need to declare your custom induction rule as ‘consuming’ one premise using the consumes attribute (see the Isabelle/Isar reference manual, §6.5.1):
theorem my_iterate_induct [consumes 1]: "iterate f x y ⟹ (⋀a. P a a) ⟹
(⋀a b c. f a b ⟹ iterate f b c ⟹ P b c ⟹ P a c) ⟹ P x y"
by (induction x y rule: iterate.induct) simp_all
I have been working with limits and topology in and I want to prove the following lemma:
lemma fixes f g :: "real ⇒ real"
assumes
"open S"
"∀a b. a < b <--> f a < f b"
"∀a. (f a)>0"
"continuous_on UNIV (f)"
"∀w∈S. ∀h. (w+h)∈S --> h * (f w) ≤ g (w+h) - g w"
shows "∀w∈S. eventually (λh. f w ≤ (g (w + h) - g w)/h) (at 0)"
using assms unfolding eventually_at
apply (auto simp: divide_simps mult_ac)
I have managed to prove it for two different scenerios:
Here, all instances of h in the inequalities is replaced by |h|. A solution is found almost instantly.
lemma
fixes f g :: "real ⇒ real"
assumes "open S" "∀w∈S. ∀h. (w+h)∈S --> abs(h) * (f w) ≤ g (w+abs(h)) - g w"
shows "∀w∈S. eventually (λh. f w ≤ (g (w + abs(h)) - g w)/abs(h)) (at 0)"
using assms unfolding eventually_at
apply (simp add: divide_simps mult_ac)
by (metis (no_types, hide_lams) add.commute diff_0 diff_add_cancel
diff_minus_eq_add dist_norm open_real_def)
In another scenerio, instead of having a set S, I use the set of real numbers instead (UNIV), and after (simp add: ) I am left with only one case to prove for which sledgehammer finds a solution.
lemma compuniv:
fixes f g :: "real ⇒ real"
assumes "S=UNIV" "open S"
"∀w∈S. ∀h. (w+h)∈S --> h * (f w) ≤ g (w+h) - g w"
shows "∀w∈S. eventually (λh. f w ≤ (g (w + h) - g w)/h) (at 0)"
using assms unfolding eventually_at
apply (simp add: divide_simps mult_ac)
Specifically, I am struggling to understand why when S=UNIV, a solution can be found. Even a method to reduce the problem to proving one sub-case (as when S=UNIV) will help greatly. How can I extend the proofs of the above two cases to prove the main problem?
The bigger picture
This result forms the foundation to proof a result using the real_tendsto_sandwich theorem.
lemma
fixes f g :: "real ⇒ real"
assumes
"open S"
"∀a b. a < b <-> f a < f b"
"∀a. f a > 0"
"continuous_on S (f)"
"∀w∈S. (λh. f (w+h)) -- 0 --> f w"
"∀w∈S. (λh. f w) -- 0 --> f w"
"∀w∈S. eventually (λh. (h ≥ 0 --> f (w+h) ≥ (g (w + h) - g w)/h) ∧
(h ≤ 0 --> f (w+h) ≤ (g (w + h) - g w)/h)) (at 0)"
"∀w∈S. eventually (λh. (h ≥ 0 --> f w ≤ (g (w + h) - g w)/h) ∧
(h ≤ 0 --> f w ≥ (g (w + h) - g w)/h)) (at 0)"
shows "∀w∈S. ((λh. (g (w+h) - g w)/h) ---> f w) (at 0)"
using assms real_tendsto_sandwich`
From the assumptions, it is clear (g (w + h) - g w)/h) is bounded by the f (w+h) and f w when h ≥ 0 and h ≤ 0 therefore taking the limit has h --> 0 yields the result (g (w + h) - g w)/h) --> f w in both cases. Therefore mathematically the final result would be the same. The difficulty is that how can I combine the result when h ≥ 0 and h ≤ 0 to prove the final result?
(Update: I was wrong in my informal explanation, but I think I fixed it. I added some opinions of mine, but I put them at the end, since you didn't ask for them.)
(I assume your use of <--> is a mistake, and it should be <->.)
In all this, I'm working with intuitive ideas of what I think the math means in Topological_Spaces.thy. It's good that you're working on some calculus; this give me a little hope.
(General complaining: The level of formalism in the THY is fairly high, it doesn't sync up directly with ZFC based theories, and as is typical with all the developers of src/HOL and the AFP, the authors don't explain any of it in textbook style, not even in monograph style, not in any style. Style requires the absence of a void.)
If what I give you here is not what you want, you can tell me to delete it, to keep it unanswered so that maybe someone else will come along with something better.
Overview
Below, first I discuss some things about UNIV, and mention some other problems in your last lemma, and with what you say in the last two paragraphs.
I then focus on the fact that the key to all of this is figuring out how h > 0 and h < 0 affects the inequalities, when moving the h from one side to the other.
You might not understand what UNIV is
A key phrase you use in your 2nd to last paragraph is "instead of having a set S, I use the set of real numbers instead (UNIV)".
If you mean S::real set as any subset of the real numbers, versus UNIV::real set, which is all of the real numbers, then that makes sense, but S in all your lemmas is of type real set, type inference, as can be seen in the output panel if types are shown.
Additionally, UNIV is a polymorphic type, 'a set, as shown by this source in src/HOL/Set.thy#l60.
subsubsection {* The universal set -- UNIV *}
abbreviation UNIV :: "'a set" where
"UNIV ≡ top"
lemma UNIV_def:
"UNIV = {x. True}"
by (simp add: top_set_def top_fun_def)
I don't understand what solution you're talking about with "I am struggling to understand why when S=UNIV, a solution can be found", or what two cases you're talking about. I only see one proof goal in all the lemmas. Below, though, I end up using 2 cases as part of a conjunction.
Eliminating UNIV from your lemmas
I don't think UNIV is of key importance here. Also, there might be some conditions in your lemmas that aren't required, though I try to change things as little as possible.
I do get rid of UNIV, because if I can prove a theorem for any real set, then it's also true for UNIV::real set. Consider this:
lemma "(∀S. continuous_on S f) ==> continuous_on UNIV f"
by(simp)
There is also this:
lemma "open (UNIV::real set)"
by(simp)
The first part of your last theorem is this:
lemma
fixes f g :: "real => real"
assumes "S = UNIV"
and "open S"
...
Because you assume S = UNIV, then you don't need open S. Because of that, and because not understanding some things you've said, I now move away from your last lemma, and the last two paragraphs.
I put two use of abs in your 1st lemma, and get rid of UNIV
My goal, like your goal, is to prove theorems with no use of abs h. A mid-level point was inserting two uses of abs h in your 1st lemma, based on what you did:
lemma
fixes f g :: "real => real"
assumes "open S"
and "∀a b. a < b <-> f a < f b"
and "∀a. f a > 0"
and "continuous_on S f"
and "∀w∈S. ∀h. (w + h)∈S --> abs h * f w ≤ g (w + h) - g w"
shows "∀w∈S. eventually (λh. f w ≤ (g (w + h) - g w)/abs h) (at 0)"
using assms unfolding eventually_at
apply (auto simp: divide_simps mult_ac)
by(metis (no_types, hide_lams) add.commute add_diff_cancel add_left_cancel
assms(2) assms(3) diff_0 diff_0_right diff_minus_eq_add dist_norm
monoid_add_class.add.left_neutral mult.commute open_real_def)
There, I eliminated the use of UNIV, and used S, any set of reals.
What's positive or negative in the inequalities is a key point
Related to this is the following basic inequality:
lemma "∀h > 0::real. h * x ≤ y <-> x ≤ y/h"
by(auto simp add: mult_imp_le_div_pos less_eq_real_def mult.commute
pos_less_divide_eq)
In the equality, when the multiplier h is positive, then life is easy, because the direction of the inequality won't change, regardless of the sign of x and y.
At least with Sledgehammer, that's why it's easy to prove the theorems when abs h is used. We don't have to worry about the formula f w ≤ g (w + h) - g w, about whether either side is positive or negative.
Here's how I finally modified your 1st lemma
It's likes this:
lemma
fixes f g :: "real => real"
assumes "open S"
and "∀a b. a < b <-> f a < f b"
and "∀a. f a > 0"
and "continuous_on S f"
and "∀w∈S. ∀h. (w + h)∈S --> h * f w ≤ g (w + h) - g w"
shows "∀w∈S. eventually (λh.
(h > 0 --> f w ≤ (g (w + h) - g w)/h) ∧
(h < 0 --> f w ≥ (g (w + h) - g w)/h)) (at 0)"
using assms unfolding eventually_at
apply (auto simp: divide_simps mult_ac)
by(metis add.commute add_diff_cancel assms(3) assms(4) assms(5) diff_0_right
dist_norm not_less open_real_def)
Here's my explanation (cases: for h > 0 and h < 0)
Two of the conditions in the lemma are these, ∀a b. a < b <-> f a < f b and ∀a. f a > 0, and so f is a positive, monotone increasing function. I don't see that either of those gets used.
Case: h > 0 and (w + h) an element of S
Because ∀w ∈ S. ∀h. (w + h) ∈ S --> h * f w ≤ g (w + h) - g w, then when h > 0 and (w + h) ∈ S, then
h * f w ≤ g (w + h) - g w.
We can multiply by 1/h, if h is not equal to 0, and the direction of the inequality stays the same. In the eventually, I assume the dummy variable is never equal to 0, so the first half the conjunction will eventually be true as h goes to 0.
Case: h < 0 and (w + h) an element of S
Likewise, when h < 0 and (w + h) ∈ S, then
h * f w ≤ g (w + h) - g w.
But because h < 0, if we multiply by 1/h, we have to reverse the direction of the inequality.
Therefore, the second half of the conjunction in the lambda function will eventually be true, as h goes to 0.
Obnoxious update: You didn't ask for my opinion about Stackoverflow etiquette, and I can be an abuser of etiquette myself, such as maybe with this answer, but I think each "tag community" should work to police their own. Unfortunately, etiquette rules aren't clearly stated here, such as at the reddit Rust site, reddit.com/r/rust. I end up doing this, and that's no good either, but maybe it could help influence someone who actually has some influence.
I don't care if you accept my answer here, and you may have reasons for not accepting some of the answers already given to you, but as an example, it's my opinion that you should accept the answer given by R. Thiemann for Substitution in Isabelle.
By not accepting an answer, you're basically saying, "I've not yet received an answer which gives me the information that I want". Additionally, answers not accepted show under the Isabelle tag unanswered category.
I think everyone should understand how few people there are in the world who can answer questions about non-trivial math problems, when implemented in Isabelle/HOL. I'll guess that's there's about 200 people worldwide who actively use Isabelle, who can be considered knowledgeable, proficient users. Out of those, there are fewer even who keep calculus, real analysis, and topology fresh on their mind, and as it's implemented in Isabelle/HOL
The use of Isabelle is a hybrid discipline, combining formal math, logic, and computer science, and at a level of formalism that would typically be at the post-4-year-degree level, partly because there aren't textbooks that explain the Isabelle/HOL logic and math, at an undergraduate level, and partly because it's just hard, graduate-level logic and mathematics.
The quantity of people needed, who have graduate-level knowledge about topology, and who have the time and desire to answers questions about topology, are more likely to operate on mathoverflow.net (this links to a question), and math.stackexchange.com. (Note: I picked that question and answer to show that many answers, on that site, are long or longish, because they try to explain the underlying math of proofs. With Isabelle, if a person is into that kind of thing, like me, then there's even more to explain many times. There can be the math to explain, and then the details of what the Isabelle/HOL syntax means mathematically, such as my comments about UNIV below.)
I say the above because, personally, when I ask a question, I start out with the assumption that I'm not going to get an answer, if a person has to think more than, lets say, 15 minutes. No, make that 5 minutes.
If I get useful information that gives me some insight, then I accept the answer. I would not accept an answer if it was extremely important I get the right information. For math problems, there are always more questions to ask than can be explained by people, so at best, generally, you can only expect to be pointed in the right direction.
You didn't ask for 8 paragraphs of my opinion, but I'm sort of not just talking to you. The problem of people trying to learn to do mathematics in Isabelle/HOL is a big problem, as I see it. We can't say, "Oh, you need to look at Topology in Isabelle/HOL, by James Munkres. There are things like Topology on the AFP, but that's a far cry from a decently written textbook or monograph.
I can delete this answer, or this part of the answer, if that ends up being what I should do.
I have the following lemma to show the derivative of f at x is D.
lemma lm1:
assumes "(∀h. (f (x + h) - f x) = D*h)"
shows "DERIV f x :> D"
proof cases
assume notzero: "∀h. h ≠ 0"
have cs1: "(λh. (f (x + h) - f x) / h) -- 0 --> D" using assms notzero by auto
from this DERIV_def show ?thesis by auto
From the assumptions, I can easily prove the lemma by taking the limit then using DERIV_def. For this I have to assume that h ≠ 0. Continuing with the proof by cases I have to show that even when h = 0, the goal is true, however this can't be done when h = 0 as the assumption becomes 0 = 0. The lemma becomes trivial.
Is there a way I can prove the goal, which is this case is that f has derivative D at x, without the additional assumption that h ≠ 0?
edit: After further research, I came across the use of elimination rules in Isabelle which may be helpful. Also, I understand that the lemma is correct as the if the function is continuous, then the derivative at 0 also exists.
I have been searching for the correct use and implementation of the the above information. How can I improve my search, and where should I be looking?