\chapter{Inference Rules}
\DOC{ABS}

\TYPE {\small\verb%ABS : term -> thm -> thm%}\egroup

\SYNOPSIS 
Primitive inference rule for extensionality.

\DESCRIBE
{\par\samepage\setseps\small\begin{verbatim}
         A |- t1 = t2
   -----------------------  (where x is not free in A)
    A |- (\x.t1) = (\x.t2)
\end{verbatim}}
\noindent The first argument to {\small\verb%ABS%} is {\small\verb%x%} and the second is the hypothesis.

\FAILURE
If the theorem is not an equation, or if the variable {\small\verb%x%} is free in the
assumptions {\small\verb%A%}.

\EXAMPLE
{\par\samepage\setseps\small\begin{verbatim}
#ABS "m:num" (REFL "m:num");;
|- (\m. m) = (\m. m)
\end{verbatim}}

\SEEALSO
ETA_CONV, EXT.

\ENDDOC
\DOC{ABS\_CONV}

\TYPE {\small\verb%ABS_CONV : (conv -> conv)%}\egroup

\SYNOPSIS
Apply a conversion to the body of an abstraction.

\DESCRIBE
If {\small\verb%c%} is a conversion that maps a term {\small\verb%"t"%} to the theorem {\small\verb%|- t = t'%}, then
the conversion {\small\verb%ABS_CONV c%} maps abstractions of the form {\small\verb%"\x.t"%} to theorems
of the form: 
{\par\samepage\setseps\small\begin{verbatim}
   |- (\x.t) = (\x.t')
\end{verbatim}}
\noindent That is, {\small\verb%ABS_CONV c "\x.t"%} applies {\small\verb%c%} to the body of the
abstraction {\small\verb%"\x.t"%}.

\FAILURE
{\small\verb%ABS_CONV c tm%} fails if {\small\verb%tm%} is not an abstraction or if {\small\verb%tm%} has the form
{\small\verb%"\x.t"%} but the conversion {\small\verb%c%} fails when applied to the term {\small\verb%t%}. The
function returned by {\small\verb%ABS_CONV c%} may also fail if the ML function
{\small\verb%c:term->thm%} is not, in fact, a conversion (i.e. a function that maps a term
{\small\verb%t%} to a theorem {\small\verb%|- t = t'%}).

\EXAMPLE
{\par\samepage\setseps\small\begin{verbatim}
#ABS_CONV SYM_CONV "\x. 1 = x";;
|- (\x. 1 = x) = (\x. x = 1)
\end{verbatim}}

\SEEALSO
RAND_CONV, RATOR_CONV, SUB_CONV.

\ENDDOC
\DOC{ADD\_ASSUM}

\TYPE {\small\verb%ADD_ASSUM : (term -> thm -> thm)%}\egroup

\SYNOPSIS
Adds an assumption to a theorem.

\DESCRIBE
When applied to a boolean term {\small\verb%s%} and a theorem {\small\verb%A |- t%}, the inference
rule {\small\verb%ADD_ASSUM%} returns the theorem {\small\verb%A u {s} |- t%}.
{\par\samepage\setseps\small\begin{verbatim}
       A |- t
   --------------  ADD_ASSUM "s"
    A u {s} |- t
\end{verbatim}}
\noindent {\small\verb%ADD_ASSUM%} performs straightforward set union with the new
assumption; it checks for identical assumptions, but not for alpha-equivalent
ones. The position at which the new assumption is inserted into the assumption
list should not be relied on.

\FAILURE
Fails unless the given term has type {\small\verb%bool%}.

\SEEALSO
ASSUME, UNDISCH.

\ENDDOC
\DOC{ADD\_CONV}

\TYPE {\small\verb%ADD_CONV : conv%}\egroup

\SYNOPSIS
Compute the sum of two natural number constants.

\DESCRIBE
If {\small\verb%n%} and {\small\verb%m%} are numeral constants (e.g. {\small\verb%0%}, {\small\verb%1%}, {\small\verb%2%}, {\small\verb%3%},...), then 
{\small\verb%ADD_CONV "n + m"%} returns the theorem:
{\par\samepage\setseps\small\begin{verbatim}
   |- n + m = s
\end{verbatim}}
\noindent where {\small\verb%s%} is the numeral that denotes the sum of the natural
numbers denoted by {\small\verb%n%} and {\small\verb%m%}.

\FAILURE
{\small\verb%ADD_CONV tm%} fails if {\small\verb%tm%} is not of the form  {\small\verb%"n + m"%}, where {\small\verb%n%} and 
{\small\verb%m%} are numerals.

\EXAMPLE
{\par\samepage\setseps\small\begin{verbatim}
#ADD_CONV "75 + 25";;
|- 75 + 25 = 100
\end{verbatim}}

\ENDDOC
\DOC{ALL\_CONV}

\TYPE {\small\verb%ALL_CONV : conv%}\egroup

\SYNOPSIS
Conversion that always succeeds and leaves a term unchanged.

\DESCRIBE
When applied to a term {\small\verb%"t"%}, the conversion {\small\verb%ALL_CONV%} returns the
theorem {\small\verb%|- t = t%}.

\FAILURE
Never fails.

\USES
Identity element for {\small\verb%THENC%}.

\SEEALSO
NO_CONV, REFL.

\ENDDOC

\DOC{ALPHA}

\TYPE {\small\verb%ALPHA : (term -> term -> thm)%}\egroup

\SYNOPSIS
Proves equality of alpha-equivalent terms.

\DESCRIBE
When applied to a pair of terms {\small\verb%t1%} and {\small\verb%t1'%} which are
alpha-equivalent, {\small\verb%ALPHA%} returns the theorem {\small\verb%|- t1 = t1'%}.
{\par\samepage\setseps\small\begin{verbatim}

   -------------  ALPHA "t1" "t1'"
    |- t1 = t1'
\end{verbatim}}
\FAILURE
Fails unless the terms provided are alpha-equivalent.

\EXAMPLE
{\par\samepage\setseps\small\begin{verbatim}
#ALPHA "!x:num. x = x" "!y:num. y = y";;
|- (!x. x = x) = (!y. y = y)
\end{verbatim}}
\COMMENTS
The system shows the type of {\small\verb%ALPHA%} as {\small\verb%term -> conv%}.

\SEEALSO
aconv, ALPHA_CONV, GEN_ALPHA_CONV.

\ENDDOC
\DOC{ALPHA\_CONV}

\TYPE {\small\verb%ALPHA_CONV : (term -> conv)%}\egroup

\SYNOPSIS
Rename the bound variable of a lambda-abstraction.

\DESCRIBE
If {\small\verb%"x"%} is a variable of type {\small\verb%:ty%} and {\small\verb%"\y.t"%} is an abstraction in which
the bound variable {\small\verb%y%} also has type {\small\verb%:ty%}, then {\small\verb%ALPHA_CONV "x" "\y.t"%}
returns the theorem:
{\par\samepage\setseps\small\begin{verbatim}
   |- (\y.t) = (\x'. t[x'/y])
\end{verbatim}}
\noindent where the variable {\small\verb%x':ty%} is a primed variant of {\small\verb%x%} chosen so
as not to be free in {\small\verb%"\y.t"%}.

\FAILURE
{\small\verb%ALPHA_CONV x tm%} fails if {\small\verb%x%} is not a variable, if {\small\verb%tm%} is not an
abstraction, or if {\small\verb%x%} is a variable {\small\verb%"v"%} and {\small\verb%tm%} is a lambda abstraction
{\small\verb%"\y.t"%} but the types of {\small\verb%v%} and {\small\verb%y%} differ.

\SEEALSO
ALPHA, GEN_ALPHA_CONV.

\ENDDOC
\DOC{AND\_EXISTS\_CONV}

\TYPE {\small\verb%AND_EXISTS_CONV : conv%}\egroup

\SYNOPSIS
Moves an existential quantification outwards through a conjunction.

\DESCRIBE
When applied to a term of the form {\small\verb%(?x.P) /\ (?x.Q)%}, where {\small\verb%x%} is free
in neither {\small\verb%P%} nor {\small\verb%Q%}, {\small\verb%AND_EXISTS_CONV%} returns the theorem:
{\par\samepage\setseps\small\begin{verbatim}
   |- (?x. P) /\ (?x. Q) = (?x. P /\ Q)
\end{verbatim}}
\FAILURE 
{\small\verb%AND_EXISTS_CONV%} fails if it is applied to a term not of the form 
{\small\verb%(?x.P) /\ (?x.Q)%}, or if it is applied to a term {\small\verb%(?x.P) /\ (?x.Q)%} 
in which the variable {\small\verb%x%} is free in either {\small\verb%P%} or {\small\verb%Q%}.

\SEEALSO
EXISTS_AND_CONV, LEFT_AND_EXISTS_CONV, RIGHT_AND_EXISTS_CONV.

\ENDDOC



\DOC{AND\_FORALL\_CONV}

\TYPE {\small\verb%AND_FORALL_CONV : conv%}\egroup

\SYNOPSIS
Moves a universal quantification outwards through a conjunction.

\DESCRIBE
When applied to a term of the form {\small\verb%(!x.P) /\ (!x.Q)%}, the conversion
{\small\verb%AND_FORALL_CONV%} returns the theorem:
{\par\samepage\setseps\small\begin{verbatim}
   |- (!x.P) /\ (!x.Q) = (!x. P /\ Q)
\end{verbatim}}
\FAILURE
Fails if applied to a term not of the form {\small\verb%(!x.P) /\ (!x.Q)%}.

\SEEALSO
FORALL_AND_CONV, LEFT_AND_FORALL_CONV, RIGHT_AND_FORALL_CONV.

\ENDDOC

\DOC{ANTE\_CONJ\_CONV}

\TYPE {\small\verb%ANTE_CONJ_CONV : conv%}\egroup

\SYNOPSIS
Eliminate a conjunctive antecedant in favour of implication.

\DESCRIBE
When applied to a term of the form {\small\verb%"(t1 /\ t2) ==> t"%}, the conversion
{\small\verb%ANTE_CONJ_CONV%} returns the theorem:
{\par\samepage\setseps\small\begin{verbatim}
   |- (t1 /\ t2 ==> t) = (t1 ==> t2 ==> t)
\end{verbatim}}
\FAILURE
Fails if applied to a term not of the form {\small\verb%"(t1 /\ t2) ==> t"%}.

\USES
Somewhat ad-hoc, but can be used (with {\small\verb%CONV_TAC%}) to transform a goal of the
form {\small\verb%?- (P /\ Q) ==> R%} into the subgoal {\small\verb%?- P ==> (Q ==> R)%}, so that only
the antecedent {\small\verb%P%} is moved into the assumptions by {\small\verb%DISCH_TAC%}.

\ENDDOC
\DOC{AP\_TERM}

\TYPE {\small\verb%AP_TERM : (term -> thm -> thm)%}\egroup

\SYNOPSIS
Applies a function to both sides of an equational theorem.

\DESCRIBE
When applied to a term {\small\verb%f%} and a theorem {\small\verb%A |- x = y%}, the
inference rule {\small\verb%AP_TERM%} returns the theorem {\small\verb%A |- f x = f y%}.
{\par\samepage\setseps\small\begin{verbatim}
      A |- x = y
   ----------------  AP_TERM "f"
    A |- f x = f y
\end{verbatim}}
\FAILURE
Fails unless the theorem is equational and the supplied term is a function
whose domain type is the same as the type of both sides of the equation.

\SEEALSO
AP_THM, MK_COMB.

\ENDDOC
\DOC{AP\_THM}

\TYPE {\small\verb%AP_THM : (thm -> term -> thm)%}\egroup

\SYNOPSIS
Proves equality of equal functions applied to a term.

\DESCRIBE
When applied to a theorem {\small\verb%A |- f = g%} and a term {\small\verb%x%}, the inference
rule {\small\verb%AP_THM%} returns the theorem {\small\verb%A |- f x = g x%}.
{\par\samepage\setseps\small\begin{verbatim}
      A |- f = g
   ----------------  AP_THM (A |- f = g) "x"
    A |- f x = g x
\end{verbatim}}
\FAILURE
Fails unless the conclusion of the theorem is an equation, both sides
of which are functions whose domain type is the same as that of the
supplied term.

\COMMENTS
The type of {\small\verb%AP_THM%} is shown by the system as {\small\verb%thm -> conv%}.

\SEEALSO
AP_TERM, ETA_CONV, EXT, MK_COMB.

\ENDDOC
\DOC{ASM\_REWRITE\_RULE}

\TYPE {\small\verb%ASM_REWRITE_RULE : (thm list -> thm -> thm)%}\egroup

\SYNOPSIS
Derived rule for rewriting a theorem with {\small\verb%basic_rewrites%}, the
theorem's hypotheses, and a list of supplied theorems.

\DESCRIBE
{\small\verb%ASM_REWRITE_RULE%} rewrites with basic tautologies, the given list of
theorems, and the set of hypotheses of the theorem. All hypotheses are
used. No ordering is specified among applicable rewrites. Matching
subterms are searched for recursively, starting with the entire 
term of the conclusion and stopping when no rewritable
expressions remain.  For more details about the rewriting process, see
{\small\verb%GEN_REWRITE_RULE%}. To avoid using the set of basic tautologies, see
{\small\verb%PURE_ASM_REWRITE_RULE%}.

\FAILURE
{\small\verb%ASM_REWRITE_RULE%} does not fail, but may result in divergence. To
prevent divergence where it would occur {\small\verb%ONCE_ASM_REWRITE_RULE%} can be
used.

\USES
For rewriting the consequence of a theorem with its hypotheses as well
as basic tautologies and a list of theorems. 

\SEEALSO
GEN_REWRITE_RULE, ONCE_ASM_REWRITE_RULE,
PURE_ASM_REWRITE_RULE, PURE_ONCE_ASM_REWRITE_RULE, REWRITE_RULE.

\ENDDOC


\DOC{ASSUME}

\TYPE {\small\verb%ASSUME : (term -> thm)%}\egroup

\SYNOPSIS
Introduces an assumption.

\DESCRIBE
When applied to a term {\small\verb%t%}, which must have type {\small\verb%bool%}, the inference rule
{\small\verb%ASSUME%} returns the theorem {\small\verb%t |- t%}.
{\par\samepage\setseps\small\begin{verbatim}
   --------  ASSUME "t"
    t |- t
\end{verbatim}}
\FAILURE
Fails unless the term {\small\verb%t%} has type {\small\verb%bool%}.

\COMMENTS
The type of {\small\verb%ASSUME%} is shown by the system as {\small\verb%conv%}.

\SEEALSO
ADD_ASSUM, REFL.

\ENDDOC
\DOC{BETA\_CONV}

\TYPE {\small\verb%BETA_CONV : conv%}\egroup

\SYNOPSIS
Primitive inference rule for beta-conversion.

\DESCRIBE
The conversion {\small\verb%BETA_CONV%} maps a beta-redex {\small\verb%"(\x.u)v"%} to the theorem 
{\par\samepage\setseps\small\begin{verbatim}
   |- (\x.u)v = u[v/x]
\end{verbatim}}
\noindent where {\small\verb%u[v/x]%} denotes the result of substituting {\small\verb%v%} for all free
occurrences of {\small\verb%x%} in {\small\verb%u%}, after renaming sufficient bound variables to avoid
variable capture.

\FAILURE
{\small\verb%BETA_CONV tm%} fails if {\small\verb%tm%} is not a beta-redex.

\EXAMPLE
{\par\samepage\setseps\small\begin{verbatim}
#BETA_CONV "(\x.x+1)y";;
|- (\x. x + 1)y = y + 1

#BETA_CONV "(\x y. x+y)y";;
|- (\x y. x + y)y = (\y'. y + y')
\end{verbatim}}

\COMMENTS 
This primitive inference rule is actually not very primitive, since it does
automatic bound variable renaming. It would be logically cleaner for this
renaming to be derived rather than built-in, but since beta-reduction is so
common this would slow the system down a lot.  It is hoped to document the
exact renaming algorithm used by {\small\verb%BETA_CONV%} in the future.

\SEEALSO
BETA_RULE, BETA_TAC, LIST_BETA_CONV, RIGHT_BETA, RIGHT_LIST_BETA.

\ENDDOC
\DOC{BETA\_RULE}

\TYPE {\small\verb%BETA_RULE : (thm -> thm)%}\egroup

\SYNOPSIS
Beta-reduces all the beta-redexes in the conclusion of a theorem.

\DESCRIBE
When applied to a theorem {\small\verb%A |- t%}, the inference rule {\small\verb%BETA_RULE%} beta-reduces
all beta-redexes, at any depth, in the conclusion {\small\verb%t%}. Variables are renamed
where necessary to avoid free variable capture.
{\par\samepage\setseps\small\begin{verbatim}
    A |- ....((\x. s1) s2)....
   ----------------------------  BETA_RULE
      A |- ....(s1[s2/x])....
\end{verbatim}}

\FAILURE
Never fails, but will have no effect if there are no beta-redexes.

\EXAMPLE
The following example is a simple reduction which illustrates variable
renaming:
{\par\samepage\setseps\small\begin{verbatim}
   #top_print print_all_thm;;
   - : (thm -> void)

   #let x = ASSUME "f = ((\x y. x + y) y)";;
   x = f = (\x y. x + y)y |- f = (\x y. x + y)y

   #BETA_RULE x;;
   f = (\x y. x + y)y |- f = (\y'. y + y')
\end{verbatim}}

\SEEALSO
BETA_CONV, BETA_TAC, RIGHT_BETA.

\ENDDOC
\DOC{BODY\_CONJUNCTS}

\TYPE {\small\verb%BODY_CONJUNCTS : (thm -> thm list)%}\egroup

\SYNOPSIS
Splits up conjuncts recursively, stripping away universal quantifiers.

\DESCRIBE
When applied to a theorem, {\small\verb%BODY_CONJUNCTS%} recursively strips off
universal quantifiers by specialization,and breaks conjunctions into a list of
conjuncts.
{\par\samepage\setseps\small\begin{verbatim}
    A |- !x1...xn. t1 /\ (!y1...ym. t2 /\ t3) /\ ...
   --------------------------------------------------  BODY_CONJUNCTS
          [A |- t1; A |- t2; A |- t3; ...]
\end{verbatim}}
\FAILURE
Never fails, but has no effect if there are no top-level universal quantifiers
or conjuncts.

\EXAMPLE
The following illustrates how a typical term will be split:
{\par\samepage\setseps\small\begin{verbatim}
   #let x = ASSUME "!x:bool. A /\ (B \/ (C /\ D)) /\ ((!y:bool. E) /\ F)";;
   x = . |- !x. A /\ (B \/ C /\ D) /\ (!y. E) /\ F

   #BODY_CONJUNCTS x;;
   [. |- A; . |- B \/ C /\ D; . |- E; . |- F] : thm list
\end{verbatim}}

\SEEALSO
CONJ, CONJUNCT1, CONJUNCT2, CONJUNCTS, CONJ_TAC.

\ENDDOC
\DOC{bool\_EQ\_CONV}

\TYPE {\small\verb%bool_EQ_CONV : conv%}\egroup

\SYNOPSIS
Decision procedure (truth-table) for boolean equality.

\DESCRIBE 
The conversion {\small\verb%bool_EQ_CONV%} simplifies equations of the form {\small\verb%"t1 = t2"%},
where {\small\verb%t1%} and {\small\verb%t2%} are of type {\small\verb%:bool%}.  When applied to a term of the form
{\small\verb%"t = t"%}, the conversion {\small\verb%bool_EQ_CONV%} returns the theorem 
{\par\samepage\setseps\small\begin{verbatim}
   |- (t = t) = T
\end{verbatim}}
\noindent When applied to a term of the form {\small\verb%"t = T"%}, the conversion returns
{\par\samepage\setseps\small\begin{verbatim}
   |- (t = T) = t
\end{verbatim}}
\noindent And when applied to a term of the form {\small\verb%"T = t"%}, it returns 
{\par\samepage\setseps\small\begin{verbatim}
   |- (T = t) = t
\end{verbatim}}
\FAILURE 
Fails unless applied to a term of the form {\small\verb%"t1 = t2"%}, where {\small\verb%t1%} and {\small\verb%t2%} are
boolean, and either {\small\verb%t1%} and {\small\verb%t2%} are syntactically identical terms or one of 
{\small\verb%t1%} and {\small\verb%t2%} is the constant {\small\verb%"T"%}.

\EXAMPLE
{\par\samepage\setseps\small\begin{verbatim}
#bool_EQ_CONV "T = F";;
|- (T = F) = F

#bool_EQ_CONV "(0 < n) = T";;
|- (0 < n = T) = 0 < n
\end{verbatim}}
\ENDDOC
\DOC{CCONTR}

\TYPE {\small\verb%CCONTR : (term -> thm -> thm)%}\egroup

\SYNOPSIS
Classical contradiction rule.

\DESCRIBE
When applied to a term {\small\verb%t%} and a theorem {\small\verb%A |- F%}, the inference rule {\small\verb%CCONTR%}
returns the theorem {\small\verb%A - {~t} |- t%}.
{\par\samepage\setseps\small\begin{verbatim}
       A |- F
   ---------------  CCONTR "t"
    A - {~t} |- t
\end{verbatim}}
\FAILURE
Fails unless the term has type {\small\verb%bool%} and the theorem has {\small\verb%F%} as its
conclusion.

\COMMENTS
The usual use will be when {\small\verb%~t%} exists in the assumption list; in this case,
{\small\verb%CCONTR%} corresponds to the classical contradiction rule: if {\small\verb%~t%} leads to
a contradiction, then {\small\verb%t%} must be true.

\SEEALSO
CONTR, CONTRAPOS, CONTR_TAC, NOT_ELIM.

\ENDDOC
\DOC{CHANGED\_CONV}

\TYPE {\small\verb%CHANGED_CONV : (conv -> conv)%}\egroup

\SYNOPSIS
Make a conversion fail if applying it leaves a term unchanged.

\DESCRIBE 
If {\small\verb%c%} is a conversion that maps a term {\small\verb%"t"%} to a theorem {\small\verb%|- t = t'%}, where
{\small\verb%t'%} is alpha-equivalent to {\small\verb%t%}, then {\small\verb%CHANGED_CONV c%} is a conversion that
fails when applied to the term {\small\verb%"t"%}. If {\small\verb%c%} maps {\small\verb%"t"%} to {\small\verb%|- t = t'%}, where
{\small\verb%t'%} is not alpha-equivalent to {\small\verb%t%}, then {\small\verb%CHANGED_CONV c%} also maps {\small\verb%"t"%} to
{\small\verb%|- t = t'%}. That is, {\small\verb%CHANGED_CONV c%} is the conversion that behaves exactly
like {\small\verb%c%}, except that it fails whenever the conversion {\small\verb%c%} would leave its
input term unchanged (up to alpha-equivalence).

\FAILURE 
{\small\verb%CHANGED_CONV c "t"%} fails if {\small\verb%c%} maps {\small\verb%"t"%} to {\small\verb%|- t = t'%}, where {\small\verb%t'%} is
alpha-equivalent to {\small\verb%t%}, or if {\small\verb%c%} fails when applied to {\small\verb%"t"%}.  The function
returned by {\small\verb%CHANGED_CONV c%} may also fail if the ML function {\small\verb%c:term->thm%} is
not, in fact, a conversion (i.e. a function that maps a term {\small\verb%t%} to a theorem
{\small\verb%|- t = t'%}).

\USES
{\small\verb%CHANGED_CONV%} is used to transform a conversion that may leave terms
unchanged, and therefore may cause a nonterminating computation if repeated,
into one that can be safely repeated until application of it fails to
substantially modify its input term.

\ENDDOC
\DOC{CHOOSE}

\TYPE {\small\verb%CHOOSE : ((term # thm) -> thm -> thm)%}\egroup

\SYNOPSIS
Eliminates existential quantification using deduction from a
particular witness.

\DESCRIBE
When applied to a term-theorem pair {\small\verb%(v,A1 |- ?x. s)%} and a second
theorem of the form {\small\verb%A2 u {s[v/x]} |- t%}, the inference rule {\small\verb%CHOOSE%}
produces the theorem {\small\verb%A1 u A2 |- t%}.
{\par\samepage\setseps\small\begin{verbatim}
    A1 |- ?x. s        A2 u {s[v/x]} |- t
   ---------------------------------------  CHOOSE ("v",(A1 |- ?x. s))
                A1 u A2 |- t
\end{verbatim}}
\noindent Where {\small\verb%v%} is not free in {\small\verb%A1%}, {\small\verb%A2%} or {\small\verb%t%}.

\FAILURE
Fails unless the terms and theorems correspond as indicated above; in
particular {\small\verb%v%} must have the same type as the variable existentially
quantified over, and must not be free in {\small\verb%A1%}, {\small\verb%A2%} or {\small\verb%t%}.

\SEEALSO
CHOOSE_TAC, EXISTS, EXISTS_TAC, SELECT_ELIM.

\ENDDOC
\DOC{COND\_CONV}

\TYPE {\small\verb%COND_CONV : conv%}\egroup

\SYNOPSIS
Simplify conditional terms.

\DESCRIBE
The conversion {\small\verb%COND_CONV%} simplifies a conditional term {\small\verb%"c => u | v"%} if 
the condition {\small\verb%c%} is either the constant "{\small\verb%T%}" or the constant "{\small\verb%F%}" or
if the two terms "{\small\verb%u%}" and "{\small\verb%v%}" are equivalent up to alpha-conversion.
The theorems returned in these three cases have the forms:
{\par\samepage\setseps\small\begin{verbatim}
   |- (T => u | v) = u

   |- (F => u | v) = u

   |- (c => u | v) = u
\end{verbatim}}
\FAILURE
{\small\verb%COND_CONV tm%} fails if {\small\verb%tm%} is not a conditional {\small\verb%"c => u | v"%}, where
{\small\verb%c%}={\small\verb%"T"%}, {\small\verb%c%}={\small\verb%"F"%} or {\small\verb%u%} and {\small\verb%v%} are alpha-equivalent.

\ENDDOC
\DOC{CONJ}

\TYPE {\small\verb%CONJ : thm -> thm -> thm%}\egroup

\SYNOPSIS
Conjunction introduction rule.

\DESCRIBE
{\par\samepage\setseps\small\begin{verbatim}
    A1 |- t1      A2 |- t2
   ------------------------  CONJ (A1 |- t1) (A2 |- t2)
     A1 u A2 |- t1 /\ t2
\end{verbatim}}

\FAILURE
Never fails.

\SEEALSO
CONJUNCT1, CONJUNCT2, CONJ_PAIR, LIST_CONJ, CONJ_LIST, CONJUNCTS.

\ENDDOC
\DOC{CONJUNCT1}

\TYPE {\small\verb%CONJUNCT1 : thm -> thm%}\egroup

\SYNOPSIS
Conjunction extraction rule (left conjunct).

\DESCRIBE
{\par\samepage\setseps\small\begin{verbatim}
    A |- t1 /\ t2
   ---------------  CONJUNCT1 (A |- t1 /\ t2)
       A |- t1
\end{verbatim}}

\FAILURE
Fails if the input theorem is not a conjunction.

\SEEALSO
CONJUNCT2, CONJ_PAIR, CONJ, LIST_CONJ, CONJ_LIST, CONJUNCTS.

\ENDDOC
\DOC{CONJUNCT2}

\TYPE {\small\verb%CONJUNCT2 : thm -> thm%}\egroup

\SYNOPSIS
Conjunction extraction rule (right conjunct).

\DESCRIBE
{\par\samepage\setseps\small\begin{verbatim}
    A |- t1 /\ t2
   ---------------  CONJUNCT2 (A |- t1 /\ t2)
       A |- t2
\end{verbatim}}

\FAILURE
Fails if the input theorem is not a conjunction.

\SEEALSO
CONJUNCT1, CONJ_PAIR, CONJ, LIST_CONJ, CONJ_LIST, CONJUNCTS.

\ENDDOC
\DOC{CONJUNCTS}

\TYPE {\small\verb%CONJUNCTS : thm -> thm list%}\egroup

\SYNOPSIS
Rule for extracting a list of conjuncts from a theorem (flattening version).

\DESCRIBE
Flattens out all conjuncts, regardless of grouping. Returns a singleton list
if the input theorem is not a conjunction.
{\par\samepage\setseps\small\begin{verbatim}
       A |- t1 /\ t2 /\ ... /\ tn
   -----------------------------------  CONJUNCTS (A |- t1 /\ ... /\ tn)
    A |- t1   A |- t2   ...   A |- tn
\end{verbatim}}

\FAILURE
Never fails.

\EXAMPLE
Suppose the identifier {\small\verb%th%} is bound to the theorem:
{\par\samepage\setseps\small\begin{verbatim}
   .... |- (x /\ y) /\ z /\ w
\end{verbatim}}
\noindent Application of {\small\verb%CONJUNCTS%} to {\small\verb%th%} returns the following list of theorems:
{\par\samepage\setseps\small\begin{verbatim}
   [.... |- x; .... |- y; .... |- z; .... |- w] : thm list
\end{verbatim}}
\SEEALSO
CONJ_LIST, LIST_CONJ, CONJ, CONJUNCT1, CONJUNCT2, CONJ_PAIR.

\ENDDOC
\DOC{CONJUNCTS\_CONV}

\TYPE {\small\verb%CONJUNCTS_CONV : ((term # term) -> thm)%}\egroup

\SYNOPSIS 
Prove equivalence under idempotence, symmetry and associativity of conjunction.

\DESCRIBE
{\small\verb%CONJUNCTS_CONV%} takes a pair of terms {\small\verb%"t1"%} and {\small\verb%"t2"%}, and proves 
{\small\verb%|- t1 = t2%} if {\small\verb%t1%} and {\small\verb%t2%} are equivalent up to idempotence, symmetry and
associativity of conjunction.  That is, if {\small\verb%t1%} and {\small\verb%t2%} are two (different)
arbitrarily-nested conjunctions of the same set of terms, then {\small\verb%CONJUNCTS_CONV
(t1,t2)%} returns {\small\verb%|- t1 = t2%}. Otherwise, it fails.

\FAILURE
Fails if {\small\verb%t1%} and {\small\verb%t2%} are not equivalent, as described above.

\EXAMPLE
{\par\samepage\setseps\small\begin{verbatim}
#CONJUNCTS_CONV ("(P /\ Q) /\ R", "R /\ (Q /\ R) /\ P");;
|- (P /\ Q) /\ R = R /\ (Q /\ R) /\ P
\end{verbatim}}
\USES
Used to reorder a conjunction.  First sort the conjuncts in a term {\small\verb%t1%} into
the desired order (e.g. lexicograpic order, for normalization) to get a new
term {\small\verb%t2%}, then call {\small\verb%CONJUNCTS_CONV(t1,t2)%}.

\COMMENTS
This is not a true {\small\verb%conv%}, so perhaps it ought to be called something else.

\SEEALSO
CONJ_SET_CONV.

\ENDDOC
\DOC{CONJ\_DISCH}

\TYPE {\small\verb%CONJ_DISCH : (term -> thm -> thm)%}\egroup

\SYNOPSIS
Discharges an assumption and conjoins it to both sides of an equation.

\DESCRIBE
Given an term {\small\verb%t%} and a theorem {\small\verb%A |- t1 = t2%}, which is an equation between
boolean terms, {\small\verb%CONJ_DISCH%} returns {\small\verb%A - {t} |- (t /\ t1) = (t /\ t2)%}, i.e.
conjoins {\small\verb%t%} to both sides of the equation, removing {\small\verb%t%} from the assumptions
if it was there.
{\par\samepage\setseps\small\begin{verbatim}
            A |- t1 = t2
   ------------------------------  CONJ_DISCH "t"
    A - {t} |- t /\ t1 = t /\ t2
\end{verbatim}}
\FAILURE
Fails unless the theorem is an equation between boolean terms, and the
term provided is also of type {\small\verb%bool%}.

\SEEALSO
CONJ_DISCHL.

\ENDDOC
\DOC{CONJ\_DISCHL}

\TYPE {\small\verb%CONJ_DISCHL : (term list -> thm -> thm)%}\egroup

\SYNOPSIS
Conjoins multiple assumptions to both sides of an equation.

\DESCRIBE
Given a term list {\small\verb%[t1;...;tn]%} and a theorem whose conclusion is an equation
between boolean terms, {\small\verb%CONJ_DISCHL%} conjoins all the terms
in the list to both sides of the equation, and removes any of the terms which
were in the assumption list.
{\par\samepage\setseps\small\begin{verbatim}
                        A |- s = t
   --------------------------------------------------------  CONJ_DISCHL
    A - {t1,...,tn} |- (t1/\.../\tn/\s) = (t1/\.../\tn/\t)     ["t1";...;"tn"]
\end{verbatim}}
\FAILURE
Fails unless the conclusion of the theorem is an equation between boolean
terms, and the terms in the list provided are also of type {\small\verb%bool%}.

\SEEALSO
CONJ_DISCH.

\ENDDOC
\DOC{CONJ\_LIST}

\TYPE {\small\verb%CONJ_LIST : int -> thm -> thm list%}\egroup

\SYNOPSIS
Rule for extracting a list of conjuncts from a theorem
(non-flattening version).

\DESCRIBE
{\small\verb%CONJ_LIST%} is the proper inverse of {\small\verb%LIST_CONJ%}. Unlike {\small\verb%CONJUNCTS%} which
recursively splits as many conjunctions as possible both to the left and to
the right, {\small\verb%CONJ_LIST%} splits the top-level conjunction and then splits
(recursively) only the right conjunct. The integer argument is required
because the term {\small\verb%tn%} may itself be a conjunction. A list of {\small\verb%n%} theorems is
returned.
{\par\samepage\setseps\small\begin{verbatim}
    A |- t1 /\ (t2 /\ ( ... /\ tn)...)
   ------------------------------------  CONJ_LIST n (A |- t1 /\ ... /\ tn)
    A |- t1   A |- t2   ...   A |- tn
\end{verbatim}}

\FAILURE
Fails if the integer argument ({\small\verb%n%}) is less than one, or if the input theorem
has less than {\small\verb%n%} conjuncts.

\EXAMPLE
Suppose the identifier {\small\verb%th%} is bound to the theorem:
{\par\samepage\setseps\small\begin{verbatim}
   .... |- (x /\ y) /\ z /\ w
\end{verbatim}}
\noindent Here are some applications of {\small\verb%CONJ_LIST%} to {\small\verb%th%}:
{\par\samepage\setseps\small\begin{verbatim}
   #CONJ_LIST 0 th;;
   evaluation failed     CONJ_LIST

   #CONJ_LIST 1 th;;
   [.... |- (x /\ y) /\ z /\ w] : thm list

   #CONJ_LIST 2 th;;
   [.... |- x /\ y; .... |- z /\ w] : thm list

   #CONJ_LIST 3 th;;
   [.... |- x /\ y; .... |- z; .... |- w] : thm list

   #CONJ_LIST 4 th;;
   evaluation failed     CONJ_LIST
\end{verbatim}}
\SEEALSO
LIST_CONJ, CONJUNCTS, CONJ, CONJUNCT1, CONJUNCT2, CONJ_PAIR.

\ENDDOC
\DOC{CONJ\_PAIR}

\TYPE {\small\verb%CONJ_PAIR : thm -> (thm # thm)%}\egroup

\SYNOPSIS
Conjunction extraction rule (both conjuncts).

\DESCRIBE
{\par\samepage\setseps\small\begin{verbatim}
       A |- t1 /\ t2
   ----------------------  CONJ_PAIR (A |- t1 /\ t2)
    A |- t1      A |- t2
\end{verbatim}}
\noindent The two resultant theorems are returned as a pair.

\FAILURE
Fails if the input theorem is not a conjunction.

\SEEALSO
CONJUNCT1, CONJUNCT2, CONJ, LIST_CONJ, CONJ_LIST, CONJUNCTS.

\ENDDOC
\DOC{CONJ\_SET\_CONV}

\TYPE {\small\verb%CONJ_SET_CONV : (term list -> term list -> thm)%}\egroup

\SYNOPSIS 
Equivalence of the conjunctions of two equal sets of term.

\DESCRIBE
The arguments to {\small\verb%CONJ_SET_CONV%} are two lists of terms {\small\verb%[t1;...;tn]%} and
{\small\verb%[u1;...;um]%}.  If these are equal when considered as sets, that is if the sets
{\par\samepage\setseps\small\begin{verbatim}
   {t1,...,tn} and {u1,...,um}
\end{verbatim}}
\noindent are equal, then {\small\verb%CONJ_SET_CONV%} returns the theorem:
{\par\samepage\setseps\small\begin{verbatim}
   |- (t1 /\ ... /\ tn) = (u1 /\ ... /\ um)
\end{verbatim}}
\noindent Otherwise {\small\verb%CONJ_SET_CONV%} fails.

\FAILURE
{\small\verb%CONJ_SET_CONV [t1;...;tn] [u1;...;um]%} fails if {\small\verb%[t1,...,tn]%} and 
{\small\verb%[u1,...,um]%}, regarded as sets of terms, are not equal. Also fails
if any {\small\verb%ti%} or {\small\verb%ui%} does not have type {\small\verb%bool%}.

\USES
Used to order conjuncts.  First sort a list of conjuncts {\small\verb%l1%} into the
desired order to get a new list {\small\verb%l2%}, then call {\small\verb%CONJ_SET_CONV l1 l2%}.

\COMMENTS
This is not a true {\small\verb%conv%}, so perhaps it ought to be called something else.

\SEEALSO
CONJUNCTS_CONV.

\ENDDOC
\DOC{CONTR}

\TYPE {\small\verb%CONTR : (term -> thm -> thm)%}\egroup

\SYNOPSIS
Intuitionistic contradiction rule.

\DESCRIBE
When applied to a term {\small\verb%t%} and a theorem {\small\verb%A |- F%}, the inference rule {\small\verb%CONTR%}
returns the theorem {\small\verb%A |- t%}.
{\par\samepage\setseps\small\begin{verbatim}
    A |- F
   --------  CONTR "t"
    A |- t
\end{verbatim}}
\FAILURE
Fails unless the term has type {\small\verb%bool%} and the theorem has {\small\verb%F%} as its
conclusion.

\SEEALSO
CCONTR, CONTRAPOS, CONTR_TAC, NOT_ELIM.

\ENDDOC
\DOC{CONTRAPOS}

\TYPE {\small\verb%CONTRAPOS : (thm -> thm)%}\egroup

\SYNOPSIS
Deduces the contrapositive of an implication.

\DESCRIBE
When applied to a theorem {\small\verb%A |- s ==> t%}, the inference rule {\small\verb%CONTRAPOS%}
returns its contrapositive, {\small\verb%A |- ~t ==> ~s%}.
{\par\samepage\setseps\small\begin{verbatim}
     A |- s ==> t
   ----------------  CONTRAPOS
    A |- ~t ==> ~s
\end{verbatim}}
\FAILURE
Fails unless the theorem is an implication.

\SEEALSO
CCONTR, CONTR, NOT_ELIM.

\ENDDOC
\DOC{CONTRAPOS\_CONV}

\TYPE {\small\verb%CONTRAPOS_CONV : conv%}\egroup

\SYNOPSIS
Equivalence of an implication and its contrapositive.

\DESCRIBE
When applied to an implication {\small\verb%P ==> Q%}, the conversion {\small\verb%CONTRAPOS_CONV%}
returns the theorem:
{\par\samepage\setseps\small\begin{verbatim}
   |- (P ==> Q) = (~Q ==> ~P)
\end{verbatim}}
\FAILURE 
Fails if applied to a term that is not an implication.

\ENDDOC



\DOC{CONV\_RULE}

\TYPE {\small\verb%CONV_RULE : (conv -> thm -> thm)%}\egroup

\SYNOPSIS
Make an inference rule from a conversion.

\DESCRIBE
If {\small\verb%c%} is a conversion, then {\small\verb%CONV_RULE c%} is an inference rule that applies
{\small\verb%c%} to the conclusion of a theorem.  That is, if {\small\verb%c%} maps a term {\small\verb%"t"%} to the
theorem {\small\verb%|- t = t'%}, then the rule {\small\verb%CONV_RULE c%} infers {\small\verb%|- t'%} from the
theorem {\small\verb%|- t%}.  More precisely, if {\small\verb%c "t"%} returns {\small\verb%A' |- t = t'%}, then:
{\par\samepage\setseps\small\begin{verbatim}
       A |- t
   --------------   CONV_RULE c
    A u A' |- t'
\end{verbatim}}
\noindent Note that if the conversion {\small\verb%c%} returns a theorem with assumptions,
then the resulting inference rule adds these to the assumptions of the
theorem it returns.

\FAILURE 
{\small\verb%CONV_RULE c th%} fails if {\small\verb%c%} fails when applied to the conclusion of {\small\verb%th%}. The
function returned by {\small\verb%CONV_RULE c%} will also fail if the ML function
{\small\verb%c:term->thm%} is not, in fact, a conversion (i.e. a function that maps a term
{\small\verb%t%} to a theorem {\small\verb%|- t = t'%}).

\SEEALSO
CONV_TAC, RIGHT_CONV_RULE.

\ENDDOC
\DOC{define\_new\_type\_bijections}

\TYPE {\small\verb%define_new_type_bijections : (string -> string -> string -> thm -> thm)%}\egroup

\SYNOPSIS
Introduce abstraction and representation functions for a defined type constant
or type operator.


\DESCRIBE
The result of a making a type definition using {\small\verb%new_type_definition%} is a
theorem of the following form:
{\par\samepage\setseps\small\begin{verbatim}
   |- ?rep:nty->ty. TYPE_DEFINITION t rep
\end{verbatim}}
\noindent which asserts only the existence of a bijection from the type it
defines (in this case, {\small\verb%nty%}) to the corresponding subset of an existing type
(here, {\small\verb%ty%}) whose characteristic function is specified by {\small\verb%P%}.  To
automatically introduce constants that in fact denote this bijection and its
inverse, the ML function {\small\verb%define_new_type_bijections%} is provided.

This function takes three string arguments and a theorem argument.  The theorem
argument must be a definitional axiom of the form returned by
{\small\verb%new_type_definition%}.  The first string argument is the name under which the
constant definition (a constant specification, in fact) made by
{\small\verb%define_new_type_bijections%} will be stored in the current theory segment. The
second and third string arguments are user-specified names for the two
constants that are to be defined. These constants are defined so as to denote
mutually inverse bijections between the defined type, whose definition is given
by the supplied theorem, and the representing type of this defined type.

If {\small\verb%th%} is a theorem of the form returned by {\small\verb%new_type_definition%}:
{\par\samepage\setseps\small\begin{verbatim}
   |- ?rep:newty->ty. TYPE_DEFINITION P rep
\end{verbatim}}
\noindent then evaulating:
{\par\samepage\setseps\small\begin{verbatim}
   define_new_type_bijections `name` `abs` `rep` th
\end{verbatim}}
\noindent automatically defines two new constants {\small\verb%abs:ty->newty%} and
{\small\verb%rep:ty->newty%} such that:
{\par\samepage\setseps\small\begin{verbatim}
   |- (!a. abs(rep a) = a) /\ (!r. P r = (rep(abs r) = r))
\end{verbatim}}
\noindent This theorem, which is the defining property for the constants {\small\verb%abs%}
and {\small\verb%rep%}, is stored under the name {\small\verb%`name`%} in the current theory segment.  It
is also the value returned by {\small\verb%define_new_type_bijections%}.  The theorem states
that {\small\verb%abs%} is the left inverse of {\small\verb%rep%} and, for values satisfying {\small\verb%P%}, that
{\small\verb%rep%} is the left inverse of {\small\verb%abs%}.

\FAILURE
A call to {\small\verb%define_new_type_bijections name abs rep th%} fails if {\small\verb%th%} is not a
theorem of the form returned by {\small\verb%new_type_definition%}, or if either {\small\verb%abs%} or
{\small\verb%rep%} is already the name of a constant in the current theory, or there already
exists a constant definition, constant specification, type definition or axiom
named {\small\verb%name%} in the current theory, or HOL is not in draft mode.

\SEEALSO
new_type_definition, prove_abs_fn_one_one, prove_abs_fn_onto,
prove_rep_fn_one_one, prove_rep_fn_onto.

\ENDDOC
\DOC{define\_type}

\TYPE {\small\verb%define_type : (string -> string -> thm)%}\egroup

\SYNOPSIS
Automatically define a user-specified concrete recursive data type.

\DESCRIBE 
The ML function {\small\verb%define_type%} automatically defines any required concrete
recursive type in the logic.  The first argument is the name under which the
results of making the definition will be stored in the current theory segment.
The second argument is a user-supplied specification of the type to be defined.
This specification (explained below) simply states the names of the new type's
constructors and the logical types of their arguments.  The theorem returned by
{\small\verb%define_type%} is an automatically-proved abstract characterization of the
concrete data type described by this specification.

The type specification given as the second argument to {\small\verb%define_type%} must be a
string of the form:
{\par\samepage\setseps\small\begin{verbatim}
   `op = C1 ty ... ty | C2 ty ... ty | ... | Cn ty ... ty` 
\end{verbatim}}
\noindent where {\small\verb%op%} is the name of the type constant or type operator to be
defined, {\small\verb%C1%}, ..., {\small\verb%Cn%} are identifiers, and each {\small\verb%ty%} is either a (logical)
type expression valid in the current theory (in which case {\small\verb%ty%} must not
contain {\small\verb%op%}) or just the identifier `{\small\verb%op%}' itself.

A string of this form describes an n-ary type operator {\small\verb%op%}, where n is the
number of distinct type variables in the types {\small\verb%ty%} on the right hand side of
the equation.  If n is zero then {\small\verb%op%} is a type constant; otherwise {\small\verb%op%} is an
n-ary type operator.  The type described by the specification has {\small\verb%n%} distinct
constructors {\small\verb%C1%}, ..., {\small\verb%Cn%}.  Each constructor {\small\verb%Ci%} is a function that takes
arguments whose types are given by the associated type expressions {\small\verb%ty%} in the
specification. If one or more of the type expressions {\small\verb%ty%} is the type {\small\verb%op%}
itself, then the equation specifies a recursive data type.  In any
specification, at least one constructor must be non-recursive, i.e. all its
arguments must have types which already exist in the current theory.

Given a type specification of the form described above, {\small\verb%define_type%} makes an
appropriate type definition for the type operator {\small\verb%op%}.  It then makes
appropriate definitions for the constants {\small\verb%C1%}, ..., {\small\verb%Cn%}, and automatically
proves a theorem that states an abstract characterization of the newly-defined
type {\small\verb%op%}.  This theorem, which is stored in the current theory segment under
the name supplied as the first argument and also returned by {\small\verb%define_type%}, has
the form of a `primitive recursion theorem' for the concrete type {\small\verb%op%} (see the
examples given below). This property provides an abstract characterization of
the type {\small\verb%op%} which is both succinct and complete, in the sense that it
completely determines the structure of the values of {\small\verb%op%} up to isomorphism.


\FAILURE
Evaluating 
{\par\samepage\setseps\small\begin{verbatim}
   define_type `name` `op = C1 ty ... ty | ... | Cn ty ... ty`
\end{verbatim}}
\noindent fails if HOL is not in draft mode; if {\small\verb%op%} is already the name of a
type constant or type operator in the current theory; if the supplied constant
names {\small\verb%C1%}, ..., {\small\verb%Cn%} are not distinct; if any one of {\small\verb%C1%}, ..., {\small\verb%Cn%} is
already a constant in the current theory or is not an allowed name for a
constant; if {\small\verb%ABS_op%} or {\small\verb%REP_op%} are already constants in the current theory;
if there is already an axiom, definition, constant specification or type
definition stored under either the name {\small\verb%op_TY_DEF%} or the name {\small\verb%op_ISO_DEF%} in
the current theory segment; if there is already a theorem stored under the name
{\small\verb%`name`%} in the current theory segment; or (finally) if the input type
specification does not conform in any other respect to the syntax described
above.

\EXAMPLE
The following call to {\small\verb%define_type%} defines {\small\verb%tri%} to be a simple enumerated
type with exactly three distinct values:
{\par\samepage\setseps\small\begin{verbatim}
   #define_type `tri_DEF` `tri = ONE | TWO | THREE`;;
   |- !e0 e1 e2. ?! fn. (fn ONE = e0) /\ (fn TWO = e1) /\ (fn THREE = e2)
\end{verbatim}}
\noindent The theorem returned is a degenerate `primitive recursion' theorem
for the concrete type {\small\verb%tri%}.  An example of a recursive type that can be
defined using {\small\verb%define_type%} is a type of binary trees:
{\par\samepage\setseps\small\begin{verbatim}
   #define_type `btree_DEF` `btree = LEAF * | NODE btree btree`;;
   |- !f0 f1.
        ?! fn.
        (!x. fn(LEAF x) = f0 x) /\
        (!b1 b2. fn(NODE b1 b2) = f1(fn b1)(fn b2)b1 b2)
\end{verbatim}}
\noindent The theorem returned by {\small\verb%define_type%} in this case asserts the unique
existence of functions defined by primitive recursion over labelled binary
trees.

Note that the type being defined may not occur as a proper subtype in
any of the types of the arguments of the constructors:
{\par\samepage\setseps\small\begin{verbatim}
   #define_type `name` `ty = NUM num | FUN (ty -> ty)`;;
   evaluation failed     ill-formed type expression(s)
\end{verbatim}}
\noindent In this example, there is an error because {\small\verb%ty%} occurs within the
type expression {\small\verb%(ty -> ty)%}.

\SEEALSO
INDUCT_THEN, new_recursive_definition, prove_cases_thm,
prove_constructors_distinct, prove_constructors_one_one, prove_induction_thm,
prove_rec_fn_exists.


\ENDDOC
\DOC{DEPTH\_CONV}

\TYPE {\small\verb%DEPTH_CONV : (conv -> conv)%}\egroup

\SYNOPSIS 
Applies a conversion repeatedly to all the sub-terms of a term, in bottom-up
order.

\DESCRIBE
{\small\verb%DEPTH_CONV c tm%} repeatedly applies the conversion {\small\verb%c%} to all the subterms of
the term {\small\verb%tm%}, including the term {\small\verb%tm%} itself.  The supplied conversion is
applied repeatedly (zero or more times, as is done by {\small\verb%REPEATC%}) to each
subterm until it fails. The conversion is applied to subterms in bottom-up
order.

\FAILURE 
{\small\verb%DEPTH_CONV c tm%} never fails but can diverge if the conversion {\small\verb%c%} can be
applied repeatedly to some subterm of {\small\verb%tm%} without failing.

\EXAMPLE
The following example shows how {\small\verb%DEPTH_CONV%} applies a conversion to all
subterms to which it applies:
{\par\samepage\setseps\small\begin{verbatim}
   #DEPTH_CONV BETA_CONV "(\x. (\y. y + x) 1) 2";;
   |- (\x. (\y. y + x)1)2 = 1 + 2
\end{verbatim}}
\noindent Here, there are two beta-redexes in the input term, one of which
occurs within the other. {\small\verb%DEPTH_CONV BETA_CONV%} applies beta-conversion to
innermost beta-redex {\small\verb%(\y. y + x) 1%} first.  The outermost beta-redex is then
{\small\verb%(\x. 1 + x) 2%}, and beta-conversion of this redex gives {\small\verb%1 + 2%}.

Because {\small\verb%DEPTH_CONV%} applies a conversion bottom-up, the final result may still
contain subterms to which the supplied conversion applies.  For example, in:
{\par\samepage\setseps\small\begin{verbatim}
   #DEPTH_CONV BETA_CONV "(\f x. (f x) + 1) (\y.y) 2";;
   |- (\f x. (f x) + 1)(\y. y)2 = ((\y. y)2) + 1
\end{verbatim}}
\noindent the right-hand side of the result still contains a beta-redex,
because the redex {\small\verb%"(\y.y)2"%} is introduced by virtue an application of
{\small\verb%BETA_CONV%} higher-up in the structure of the input term.  By contrast, in the
example:
{\par\samepage\setseps\small\begin{verbatim}
   #DEPTH_CONV BETA_CONV "(\f x. (f x)) (\y.y) 2";;
   |- (\f x. f x)(\y. y)2 = 2
\end{verbatim}}
\noindent all beta-redexes are eliminated, because {\small\verb%DEPTH_CONV%} repeats the
supplied conversion (in this case, {\small\verb%BETA_CONV%}) at each subterm (in this case,
at the top-level term).

\USES
If the conversion {\small\verb%c%} implements the evaluation of a function in logic, then
{\small\verb%DEPTH_CONV c%} will do bottom-up evaluation of nested applications of it.
For example, the conversion {\small\verb%ADD_CONV%} implements addition of natural number 
constants within the logic. Thus, the effect of:
{\par\samepage\setseps\small\begin{verbatim}
   #DEPTH_CONV ADD_CONV "(1 + 2) + (3 + 4 + 5)";;
   |- (1 + 2) + (3 + (4 + 5)) = 15
\end{verbatim}}
\noindent is to compute the sum represented by the input term.

\SEEALSO
ONCE_DEPTH_CONV, REDEPTH_CONV, TOP_DEPTH_CONV.

\ENDDOC
\DOC{DISCH}

\TYPE {\small\verb%DISCH : (term -> thm -> thm)%}\egroup

\SYNOPSIS
Primitive inference rule, discharges a hypothesis.

\DESCRIBE
{\par\samepage\setseps\small\begin{verbatim}
       A |- t
--------------------  DISCH "u"
 A - {u} |- u ==> t
\end{verbatim}}
\FAILURE
{\small\verb%DISCH%} will fail if {\small\verb%"u"%} is not boolean.

\COMMENTS
The term {\small\verb%"u"%} need not be a hypothesis.  Discharging {\small\verb%"u"%} will remove all
identical and alpha-equivalent hypotheses.

\SEEALSO
DISCH_ALL, DISCH_TAC, DISCH_THEN, FILTER_DISCH_TAC, FILTER_DISCH_THEN,
NEG_DISCH, STRIP_TAC, UNDISCH, UNDISCH_ALL, UNDISCH_TAC.

\ENDDOC
\DOC{DISCH\_ALL}

\TYPE {\small\verb%DISCH_ALL : (thm -> thm)%}\egroup

\SYNOPSIS
HOL derived rule, discharges all hypotheses of a theorem.

\DESCRIBE
{\par\samepage\setseps\small\begin{verbatim}
         A1, ..., An |- t       
   ----------------------------  DISCH_ALL
    |- A1 ==> ... ==> An ==> t
\end{verbatim}}
\FAILURE
{\small\verb%DISCH_ALL%} will not fail if there are no hypotheses to discharge, it will
simply return the theorem unchanged.

\COMMENTS
Users should not rely on the hypotheses being discharged in any particular
order.  Two or more alpha-convertible hypotheses will be discharged by a
single implication; users should not rely on which hypothesese appears in the
implication.

\SEEALSO
DISCH, DISCH_TAC, DISCH_THEN, NEG_DISCH, FILTER_DISCH_TAC, FILTER_DISCH_THEN,
STRIP_TAC, UNDISCH, UNDISCH_ALL, UNDISCH_TAC.

\ENDDOC
\DOC{DISJ1}

\TYPE {\small\verb%DISJ1 : (thm -> conv)%}\egroup

\SYNOPSIS
Right disjunction introduction.

\DESCRIBE
{\par\samepage\setseps\small\begin{verbatim}
       A |- t1
   ---------------  DISJ1 (A |- t1) "t2"
    A |- t1 \/ t2
\end{verbatim}}

\FAILURE
Fails if the term argument is not boolean.

\EXAMPLE
{\par\samepage\setseps\small\begin{verbatim}
   #DISJ1 TRUTH "F";;
   |- T \/ F
\end{verbatim}}

\COMMENTS
The type can be equivalently given by {\small\verb%DISJ1 : (thm -> term -> thm)%}.

\SEEALSO
DISJ1_TAC, DISJ2, DISJ2_TAC, DISJ_CASES.

\ENDDOC
\DOC{DISJ2}

\TYPE {\small\verb%DISJ2 : (term -> thm -> thm)%}\egroup

\SYNOPSIS
Left disjunction introduction.

\DESCRIBE
{\par\samepage\setseps\small\begin{verbatim}
      A |- t2
   ---------------  DISJ2 "t1" (A |- t2)
    A |- t1 \/ t2
\end{verbatim}}

\FAILURE
Fails if the term argument is not boolean.

\EXAMPLE
{\par\samepage\setseps\small\begin{verbatim}
   #DISJ2 "F" TRUTH;;
   |- F \/ T
\end{verbatim}}

\SEEALSO
DISJ1, DISJ1_TAC, DISJ2_TAC, DISJ_CASES.

\ENDDOC
\DOC{DISJ\_CASES}

\TYPE {\small\verb%DISJ_CASES : (thm -> thm -> thm -> thm)%}\egroup

\SYNOPSIS
Derived inference rule for disjunction elimination by cases.

\DESCRIBE
The rule {\small\verb%DISJ_CASES%} takes a disjunctive theorem, and two `case'
theorems, each with one of the disjuncts as a hypothesis while sharing
alpha-equivalent conclusions.  A new theorem is returned with the same
conclusion as the `case' theorems, and the union of all assumptions
excepting the disjuncts.  
{\par\samepage\setseps\small\begin{verbatim}
    A |- t1 \/ t2     A1 u {t1} |- t      A2 u {t2} |- t
   ------------------------------------------------------  DISJ_CASES
                   A u A1 u A2 |- t
\end{verbatim}}

\FAILURE
Fails if the first argument is not a disjunctive theorem, or if the
conclusions of the other two theorems are not alpha-convertible.

\EXAMPLE
Specializing the built-in theorem {\small\verb%num_CASES%} gives the theorem:
{\par\samepage\setseps\small\begin{verbatim}
   th = |- (m = 0) \/ (?n. m = SUC n)
\end{verbatim}}
\noindent Using two additional theorems, each having one disjunct as a hypothesis:
{\par\samepage\setseps\small\begin{verbatim}
   th1 = {"m = 0"}, "|- (PRE m = m) = (m = 0)"
   th2 = {"?n. m = SUC n"}, "|- (PRE m = m) = (m = 0)"
\end{verbatim}}
\noindent a new theorem can be derived:
{\par\samepage\setseps\small\begin{verbatim}
   #DISJ_CASES th th1 th2;;
   |- (PRE m = m) = (m = 0)
\end{verbatim}}

\COMMENTS
Neither `case' theorem is required to have either disjunct as a
hypothesis, but this use is degenerate. 

\SEEALSO
DISJ_CASES_TAC, DISJ_CASES_THEN, DISJ_CASES_THEN2, DISJ_CASES_UNION,
DISJ1, DISJ2. 

\ENDDOC
\DOC{DISJ\_CASES\_UNION}

\TYPE {\small\verb%DISJ_CASES_UNION : (thm -> thm -> thm -> thm)%}\egroup

\SYNOPSIS
Derive a new disjunctive theorem from a given disjunctive theorem and
theorems giving conclusions which hold under the assumption of either
disjunct. 

\DESCRIBE
Given a disjunctive theorem, and two additional theorems each having
one disjuct as a hypothesis, a new theorem with a conclusion that is
the disjunction of the conclusions of the latter two theorems is
produced. The hypotheses include the union of hypotheses of all three
theorems less the two disjuncts.  
{\par\samepage\setseps\small\begin{verbatim}
    A |- t1 \/ t2    A1 u {t1} |- t3     A2 u {t2} |- t4
   ------------------------------------------------------  DISJ_CASES_UNION
                 A u A1 u A2 |- t3 \/ t4
\end{verbatim}}

\FAILURE
Fails if the first theorem is not a disjunction.

\EXAMPLE
The built-in theorem {\small\verb%LESS_CASES%} can be specialized as:
{\par\samepage\setseps\small\begin{verbatim}
   th1 = |- m < n \/ n <= m
\end{verbatim}}
\noindent and used with two additional theorems:
{\par\samepage\setseps\small\begin{verbatim}
   th2 = ["m < n"] |- (m MOD n = m)
   th3 = ["0 < n"; "n <= m"] |- (m MOD n) = ((m - n) MOD n)
\end{verbatim}}
\noindent to derive a new theorem:
{\par\samepage\setseps\small\begin{verbatim}
   #DISJ_CASES_UNION th1 th2 th3;;
   ["0 < n"] |- (m MOD n = m) \/ (m MOD n = (m - n) MOD n)
\end{verbatim}}

\SEEALSO
DISJ_CASES, DISJ_CASES_TAC, DISJ1, DISJ2.

\ENDDOC
\DOC{DISJ\_IMP}

\TYPE {\small\verb%DISJ_IMP : (thm -> thm)%}\egroup

\SYNOPSIS
Converts a disjunctive theorem to an equivalent implicative theorem.

\DESCRIBE
The left disjunct of a disjunctive theorem becomes the negated
antecedent of the newly generated theorem.
{\par\samepage\setseps\small\begin{verbatim}
     A |- t1 \/ t2
   -----------------  DISJ_IMP
    A |- ~t1 ==> t2
\end{verbatim}}

\FAILURE
Fails if the theorem is not a disjunction.

\EXAMPLE
Specializing the built-in theorem {\small\verb%LESS_CASES%} gives the theorem:
{\par\samepage\setseps\small\begin{verbatim}
   th = |- m < n \/ n <= m
\end{verbatim}}
\noindent to which {\small\verb%DISJ_IMP%} may be applied:
{\par\samepage\setseps\small\begin{verbatim}
   #DISJ_IMP th;;
   |- ~m < n ==> n <= m
\end{verbatim}}

\SEEALSO
DISJ_CASES, DISJ_SYM, IMP_DISJ_THM, OR_DEF.

\ENDDOC
\DOC{EQF\_ELIM}

\TYPE {\small\verb%EQF_ELIM : thm -> thm%}\egroup

\SYNOPSIS
Inference rule for eliminating equality with {\small\verb%"F"%}.

\DESCRIBE
{\par\samepage\setseps\small\begin{verbatim}
    A |- tm = F
   -------------  EQF_ELIM (A |- tm = F)
     A |- ~tm
\end{verbatim}}

\FAILURE
Fails if the argument theorem is not of the form {\small\verb%A |- tm = F%}.

\SEEALSO
EQF_INTRO, EQT_ELIM, EQT_INTRO.

\ENDDOC
\DOC{EQF\_INTRO}

\TYPE {\small\verb%EQF_INTRO : thm -> thm%}\egroup

\SYNOPSIS
Inference rule for introducing equality with {\small\verb%"F"%}.

\DESCRIBE
{\par\samepage\setseps\small\begin{verbatim}
     A |- ~tm
   -------------  EQF_INTRO (A |- ~tm)
    A |- tm = F
\end{verbatim}}

\FAILURE
Fails if the argument theorem is not a negation.

\SEEALSO
EQF_ELIM, EQT_ELIM, EQT_INTRO.

\ENDDOC
\DOC{EQT\_ELIM}

\TYPE {\small\verb%EQT_ELIM : thm -> thm%}\egroup

\SYNOPSIS
Inference rule for eliminating equality with {\small\verb%"T"%}.

\DESCRIBE
{\par\samepage\setseps\small\begin{verbatim}
    A |- tm = T
   -------------  EQT_ELIM (A |- tm = T)
      A |- tm
\end{verbatim}}

\FAILURE
Fails if the argument theorem is not of the form {\small\verb%A |- tm = T%}.

\SEEALSO
EQT_INTRO, EQF_ELIM, EQF_INTRO.

\ENDDOC
\DOC{EQT\_INTRO}

\TYPE {\small\verb%EQT_INTRO : thm -> thm%}\egroup

\SYNOPSIS
Inference rule for introducing equality with {\small\verb%"T"%}.

\DESCRIBE
{\par\samepage\setseps\small\begin{verbatim}
      A |- tm
   -------------  EQF_INTRO (A |- tm)
    A |- tm = T
\end{verbatim}}

\FAILURE
Never fails.

\SEEALSO
EQT_ELIM, EQF_ELIM, EQF_INTRO.

\ENDDOC
\DOC{EQ\_IMP\_RULE}

\TYPE {\small\verb%EQ_IMP_RULE : (thm -> (thm # thm))%}\egroup

\SYNOPSIS
Derives forward and backward implication from equality of boolean terms.

\DESCRIBE
When applied to a theorem {\small\verb%A |- t1 = t2%}, where {\small\verb%t1%} and {\small\verb%t2%} both have
type {\small\verb%bool%}, the inference rule {\small\verb%EQ_IMP_RULE%} returns the
theorems {\small\verb%A |- t1 ==> t2%} and {\small\verb%A |- t2 ==> t1%}.
{\par\samepage\setseps\small\begin{verbatim}
              A |- t1 = t2
   -----------------------------------  EQ_IMP_RULE
    A |- t1 ==> t2     A |- t2 ==> t1
\end{verbatim}}
\FAILURE
Fails unless the conclusion of the given theorem is an equation between
boolean terms.

\SEEALSO
EQ_MP, EQ_TAC, IMP_ANTISYM_RULE.

\ENDDOC
\DOC{EQ\_MP}

\TYPE {\small\verb%EQ_MP : (thm -> thm -> thm)%}\egroup

\SYNOPSIS
Equality version of the Modus Ponens rule.

\DESCRIBE
When applied to theorems {\small\verb%A1 |- t1 = t2%} and {\small\verb%A2 |- t1%}, the inference
rule {\small\verb%EQ_MP%} returns the theorem {\small\verb%A1 u A2 |- t2%}.
{\par\samepage\setseps\small\begin{verbatim}
    A1 |- t1 = t2   A2 |- t1
   --------------------------  EQ_MP
         A1 u A2 |- t2
\end{verbatim}}
\FAILURE
Fails unless the first theorem is equational and its left side
is the same as the conclusion of the second theorem (and is therefore
of type {\small\verb%bool%}), up to alpha-conversion.

\SEEALSO
EQ_IMP_RULE, IMP_ANTISYM_RULE, MP.

\ENDDOC
\DOC{ETA\_CONV}

\TYPE {\small\verb%ETA_CONV : conv%}\egroup

\SYNOPSIS
Derived rule for eta-conversion.

\DESCRIBE
{\small\verb%ETA_CONV%} maps an eta-redex {\small\verb%"\x. t x"%}, where {\small\verb%x%} does not occur free in {\small\verb%t%},
to the theorem {\small\verb%|- (\x. t x) = t%}.

\FAILURE
Fails if the input term is not an eta-redex.

\ENDDOC
\DOC{EVERY\_CONV}

\TYPE {\small\verb%EVERY_CONV : (conv list -> conv)%}\egroup

\SYNOPSIS
Apply in sequence all the conversions in a given list of conversions.

\DESCRIBE 

{\small\verb%EVERY_CONV [c1;...;cn] "t"%} returns the result of applying the conversions
{\small\verb%c1%}, ..., {\small\verb%cn%} in sequence to the term {\small\verb%"t"%}. The conversions are applied in
the order in which they are given in the list. In particular, if {\small\verb%ci "ti"%}
returns {\small\verb%|- ti=ti+1%} for {\small\verb%i%} from {\small\verb%1%} to {\small\verb%n%}, then 
{\small\verb%EVERY_CONV [c1;...;cn] "t1"%} returns {\small\verb%|- t1=t(n+1)%}.  If the supplied list of
conversions is empty, then {\small\verb%EVERY_CONV%} returns the identity conversion.  That
is, {\small\verb%EVERY_CONV [] "t"%} returns {\small\verb%|- t=t%}.

\FAILURE 
{\small\verb%EVERY_CONV [c1;...;cn] "t"%} fails if any one of the conversions {\small\verb%c1%}, ...,
{\small\verb%cn%} fails when applied in sequence as specified above.  

\SEEALSO
THENC.

\ENDDOC
\DOC{EXISTENCE}

\TYPE {\small\verb%EXISTENCE : (thm -> thm)%}\egroup

\SYNOPSIS
Deduces existence from unique existence.

\DESCRIBE
When applied to a theorem with a unique-existentially quantified
conclusion, {\small\verb%EXISTENCE%} returns the same theorem with normal existential
quantification over the same variable.
{\par\samepage\setseps\small\begin{verbatim}
    A |- ?!x. p
   -------------  EXISTENCE
    A |- ?x. p
\end{verbatim}}
\FAILURE
Fails unless the conclusion of the theorem is unique-existentially quantified.

\SEEALSO
EXISTS_UNIQUE_CONV.

\ENDDOC
\DOC{EXISTS}

\TYPE {\small\verb%EXISTS : ((term # term) -> thm -> thm)%}\egroup

\SYNOPSIS
Introduces existential quantification given a particular witness.

\DESCRIBE
When applied to a pair of terms and a theorem, the first term an existentially
quantified pattern indicating the desired form of the result, and the second a
witness whose substitution for the quantified variable gives a term which is
the same as the conclusion of the theorem, {\small\verb%EXISTS%} gives the desired theorem.
{\par\samepage\setseps\small\begin{verbatim}
    A |- p[u/x]
   -------------  EXISTS ("?x. p","u")
    A |- ?x. p
\end{verbatim}}
\FAILURE
Fails unless the substituted pattern is the same as the conclusion of the
theorem.

\EXAMPLE
The following examples illustrate how it is possible to deduce different
things from the same theorem:
{\par\samepage\setseps\small\begin{verbatim}
   #EXISTS ("?x. x=T","T") (REFL "T");;
   |- ?x. x = T

   #EXISTS ("?x:bool. x=x","T") (REFL "T");;
   |- ?x. x = x
\end{verbatim}}
\SEEALSO
CHOOSE, EXISTS_TAC.

\ENDDOC
\DOC{EXISTS\_AND\_CONV}

\TYPE {\small\verb%EXISTS_AND_CONV : conv%}\egroup

\SYNOPSIS
Moves an existential quantification inwards through a conjunction.

\DESCRIBE
When applied to a term of the form {\small\verb%?x. P /\ Q%}, where {\small\verb%x%} is not free in both
{\small\verb%P%} and {\small\verb%Q%}, {\small\verb%EXISTS_AND_CONV%} returns a theorem of one of three forms,
depending on occurrences of the variable {\small\verb%x%} in {\small\verb%P%} and {\small\verb%Q%}.  If {\small\verb%x%} is free
in {\small\verb%P%} but not in {\small\verb%Q%}, then the theorem:
{\par\samepage\setseps\small\begin{verbatim}
   |- (?x. P /\ Q) = (?x.P) /\ Q
\end{verbatim}}
\noindent is returned.  If {\small\verb%x%} is free in {\small\verb%Q%} but not in {\small\verb%P%}, then the
result is:
{\par\samepage\setseps\small\begin{verbatim}
   |- (?x. P /\ Q) = P /\ (?x.Q)
\end{verbatim}}
\noindent And if {\small\verb%x%} is free in neither {\small\verb%P%} nor {\small\verb%Q%}, then the result is:
{\par\samepage\setseps\small\begin{verbatim}
   |- (?x. P /\ Q) = (?x.P) /\ (?x.Q)
\end{verbatim}}
\FAILURE 
{\small\verb%EXISTS_AND_CONV%} fails if it is applied to a term not of the form 
{\small\verb%?x. P /\ Q%}, or if it is applied to a term {\small\verb%?x. P /\ Q%} in which the 
variable {\small\verb%x%} is free in both {\small\verb%P%} and {\small\verb%Q%}.

\SEEALSO
AND_EXISTS_CONV, LEFT_AND_EXISTS_CONV, RIGHT_AND_EXISTS_CONV.

\ENDDOC



\DOC{EXISTS\_EQ}

\TYPE {\small\verb%EXISTS_EQ : (term -> thm -> thm)%}\egroup

\SYNOPSIS
Existentially quantifies both sides of an equational theorem.

\DESCRIBE
When applied to a variable {\small\verb%x%} and a theorem whose conclusion is
equational, {\small\verb%A |- t1 = t2%}, the inference rule
{\small\verb%EXISTS_EQ%} returns the theorem {\small\verb%A |- (?x. t1) = (?x. t2)%}, provided
the variable {\small\verb%x%} is not free in any of the assumptions.
{\par\samepage\setseps\small\begin{verbatim}
         A |- t1 = t2
   ------------------------  EXISTS_EQ "x"      [provided x is not free in A]
    A |- (?x.t1) = (?x.t2)
\end{verbatim}}
\FAILURE
Fails unless the theorem is equational with both sides having type {\small\verb%bool%},
or if the term is not a variable, or if the variable to be quantified
over is free in any of the assumptions.

\SEEALSO
AP_TERM, EXISTS_IMP, FORALL_EQ, MK_EXISTS, SELECT_EQ.

\ENDDOC
\DOC{EXISTS\_IMP}

\TYPE {\small\verb%EXISTS_IMP : (term -> thm -> thm)%}\egroup

\SYNOPSIS
Existentially quantifies both the antecedent and consequent of an implication.

\DESCRIBE
When applied to a variable {\small\verb%x%} and a theorem {\small\verb%A |- t1 ==> t2%}, the
inference rule {\small\verb%EXISTS_IMP%} returns the theorem {\small\verb%A |- (?x. t1) ==> (?x. t2)%},
provided {\small\verb%x%} is not free in the assumptions.
{\par\samepage\setseps\small\begin{verbatim}
         A |- t1 ==> t2
   --------------------------  EXISTS_IMP "x"   [provided x is not free in A]
    A |- (?x.t1) ==> (?x.t2)
\end{verbatim}}

\FAILURE
Fails unless the theorem is implicative and the term is a variable, or
if the variable is free in any of the assumptions.

\SEEALSO
EXISTS_EQ.

\ENDDOC
\DOC{EXISTS\_IMP\_CONV}

\TYPE {\small\verb%EXISTS_IMP_CONV : conv%}\egroup

\SYNOPSIS
Moves a universal quantification inwards through an implication.

\DESCRIBE
When applied to a term of the form {\small\verb%?x. P ==> Q%}, where {\small\verb%x%} is not free in 
both {\small\verb%P%} and {\small\verb%Q%}, {\small\verb%EXISTS_IMP_CONV%} returns a theorem of one of three forms,
depending on occurrences of the variable {\small\verb%x%} in {\small\verb%P%} and {\small\verb%Q%}.  If {\small\verb%x%} is free
in {\small\verb%P%} but not in {\small\verb%Q%}, then the theorem:
{\par\samepage\setseps\small\begin{verbatim}
   |- (?x. P ==> Q) = (!x.P) ==> Q
\end{verbatim}}
\noindent is returned.  If {\small\verb%x%} is free in {\small\verb%Q%} but not in {\small\verb%P%}, then the
result is:
{\par\samepage\setseps\small\begin{verbatim}
   |- (?x. P ==> Q) = P ==> (?x.Q)
\end{verbatim}}
\noindent And if {\small\verb%x%} is free in neither {\small\verb%P%} nor {\small\verb%Q%}, then the result is:
{\par\samepage\setseps\small\begin{verbatim}
   |- (?x. P ==> Q) = (!x.P) ==> (?x.Q)
\end{verbatim}}
\FAILURE 
{\small\verb%EXISTS_IMP_CONV%} fails if it is applied to a term not of the form 
{\small\verb%?x. P ==> Q%}, or if it is applied to a term {\small\verb%?x. P ==> Q%} in which the 
variable {\small\verb%x%} is free in both {\small\verb%P%} and {\small\verb%Q%}.

\SEEALSO
LEFT_IMP_FORALL_CONV, RIGHT_IMP_EXISTS_CONV.

\ENDDOC



\DOC{EXISTS\_LEAST\_CONV}

\TYPE {\small\verb%EXISTS_LEAST_CONV : conv%}\egroup

\SYNOPSIS
Apply the well-ordering property of the natural numbers.

\DESCRIBE
Given a term of the form {\small\verb%"?n:num.P[n]"%}, the conversion {\small\verb%EXISTS_LEAST_CONV%}
proves that this assertion is equivalent to the statement that there is a 
least number {\small\verb%n%} such that {\small\verb%P[n]%} holds.  The theorem returned is:
{\par\samepage\setseps\small\begin{verbatim}
   |- (?n. P[n]) = ?n. P[n] /\ !n'. (n' < n) ==> ~P[n']
\end{verbatim}}
\noindent where {\small\verb%n'%} is a primed variant of {\small\verb%n%} that does not appear free in
the input term.  Note that the variable {\small\verb%n%} need not in fact appear free in
the body of the existentially-quantified input term.  For example, 
{\small\verb%EXISTS_LEAST_CONV "?n:num.T"%} returns the theorem:
{\par\samepage\setseps\small\begin{verbatim}
   |- (?n. T) = (?n. T /\ (!n'. n' < n ==> ~T))
\end{verbatim}}

\FAILURE
{\small\verb%EXISTS_LEAST_CONV tm%} fails if {\small\verb%tm%} is not of the form {\small\verb%"?n:num.P"%}.

\ENDDOC
\DOC{EXISTS\_NOT\_CONV}

\TYPE {\small\verb%EXISTS_NOT_CONV : conv%}\egroup

\SYNOPSIS
Moves an existential quantification inwards through a negation.

\DESCRIBE
When applied to a term of the form {\small\verb%?x.~P%}, the conversion {\small\verb%EXISTS_NOT_CONV%}
returns the theorem:
{\par\samepage\setseps\small\begin{verbatim}
   |- (?x.~P) = ~(!x. P)
\end{verbatim}}
\FAILURE
Fails if applied to a term not of the form {\small\verb%?x.~P%}.

\SEEALSO
FORALL_NOT_CONV, NOT_EXISTS_CONV, NOT_FORALL_CONV.

\ENDDOC
\DOC{EXISTS\_OR\_CONV}

\TYPE {\small\verb%EXISTS_OR_CONV : conv%}\egroup

\SYNOPSIS
Moves an existential quantification inwards through a disjunction.

\DESCRIBE
When applied to a term of the form {\small\verb%?x. P \/ Q%}, the conversion 
{\small\verb%EXISTS_OR_CONV%} returns the theorem:
{\par\samepage\setseps\small\begin{verbatim}
   |- (?x. P \/ Q) = (?x.P) \/ (?x.Q)
\end{verbatim}}
\FAILURE
Fails if applied to a term not of the form {\small\verb%?x. P \/ Q%}.

\SEEALSO
OR_EXISTS_CONV, LEFT_OR_EXISTS_CONV, RIGHT_OR_EXISTS_CONV.

\ENDDOC



\DOC{EXISTS\_UNIQUE\_CONV}

\TYPE {\small\verb%EXISTS_UNIQUE_CONV : conv%}\egroup

\SYNOPSIS
Expand with the definition of unique existence.

\DESCRIBE
Given a term of the form {\small\verb%"?!x.P[x]"%}, the conversion {\small\verb%EXISTS_UNIQUE_CONV%}
proves that this assertion is equivalent to the conjunction of two statements,
namely that there exists at least one value {\small\verb%x%} such that {\small\verb%P[x]%}, and that
there is at most one value {\small\verb%x%} for which {\small\verb%P[x]%} holds. The theorem returned is:
{\par\samepage\setseps\small\begin{verbatim}
   |- (?! x. P[x]) = (?x. P[x]) /\ (!x x'. P[x] /\ P[x'] ==> (x = x'))
\end{verbatim}}
\noindent where {\small\verb%x'%} is a primed variant of {\small\verb%x%} that does not appear free in
the input term.  Note that the quantified variable {\small\verb%x%} need not in fact appear
free in the body of the input term.  For example, {\small\verb%EXISTS_UNIQUE_CONV "?!x.T"%}
returns the theorem:
{\par\samepage\setseps\small\begin{verbatim}
   |- (?! x. T) = (?x. T) /\ (!x x'. T /\ T ==> (x = x'))
\end{verbatim}}
\FAILURE
{\small\verb%EXISTS_UNIQUE_CONV tm%} fails if {\small\verb%tm%} does not have the form {\small\verb%"?!x.P"%}.

\SEEALSO
EXISTENCE.

\ENDDOC
\DOC{EXT}

\TYPE {\small\verb%EXT : (thm -> thm)%}\egroup

\SYNOPSIS
Derives equality of functions from extentional equivalence.

\DESCRIBE
When applied to a theorem {\small\verb%A |- !x. t1 x = t2 x%}, the inference rule
{\small\verb%EXT%} returns the theorem {\small\verb%A |- t1 = t2%}.
{\par\samepage\setseps\small\begin{verbatim}
    A |- !x. t1 x = t2 x
   ----------------------  EXT      [provided x is not free in A, t1 or t2]
        A |- t1 = t2
\end{verbatim}}
\FAILURE
Fails if the theorem does not have the form indicated above, or
if the variable {\small\verb%x%} is free either in the assumption list {\small\verb%A%}, or one
of the functions {\small\verb%t1%} and {\small\verb%t2%}.

\SEEALSO
AP_THM, ETA_CONV, FUN_EQ_CONV.

\ENDDOC
\DOC{FIRST\_CONV}

\TYPE {\small\verb%FIRST_CONV : (conv list -> conv)%}\egroup

\SYNOPSIS
Apply the first of the conversions in a given list that succeeds.

\DESCRIBE 
{\small\verb%FIRST_CONV [c1;...;cn] "t"%} returns the result of applying to the term {\small\verb%"t"%}
the first conversion {\small\verb%ci%} that suceeds when applied to {\small\verb%"t"%}.  The conversions
are tried in the order in which they are given in the list.

\FAILURE 
{\small\verb%FIRST_CONV [c1;...;cn] "t"%} fails if all the conversions {\small\verb%c1%}, ..., {\small\verb%cn%} fail
when applied to the term {\small\verb%"t"%}.  {\small\verb%FIRST_CONV cs "t"%} also fails if {\small\verb%cs%} is the
empty list.

\SEEALSO
ORELSEC.

\ENDDOC
\DOC{FORALL\_AND\_CONV}

\TYPE {\small\verb%FORALL_AND_CONV : conv%}\egroup

\SYNOPSIS
Moves a universal quantification inwards through a conjunction.

\DESCRIBE
When applied to a term of the form {\small\verb%!x. P /\ Q%}, the conversion 
{\small\verb%FORALL_AND_CONV%} returns the theorem:
{\par\samepage\setseps\small\begin{verbatim}
   |- (!x. P /\ Q) = (!x.P) /\ (!x.Q)
\end{verbatim}}
\FAILURE
Fails if applied to a term not of the form {\small\verb%!x. P /\ Q%}.

\SEEALSO
AND_FORALL_CONV, LEFT_AND_FORALL_CONV, RIGHT_AND_FORALL_CONV.

\ENDDOC



\DOC{FORALL\_EQ}

\TYPE {\small\verb%FORALL_EQ : (term -> thm -> thm)%}\egroup

\SYNOPSIS
Universally quantifies both sides of an equational theorem.

\DESCRIBE
When applied to a variable {\small\verb%x%} and a theorem {\small\verb%A |- t1 = t2%}, whose conclusion
is an equation between boolean terms, {\small\verb%FORALL_EQ%} returns the
theorem {\small\verb%A |- (!x. t1) = (!x. t2)%}, unless the variable {\small\verb%x%} is free in any
of the assumptions.
{\par\samepage\setseps\small\begin{verbatim}
         A |- t1 = t2
   ------------------------  FORALL_EQ "x"      [provided x is not free in A]
    A |- (!x.t1) = (!x.t2)
\end{verbatim}}
\FAILURE
Fails unless the theorem is an equation between boolean terms and the supplied
term is simply a variable, or if the variable is free in any of the
assumptions.

\SEEALSO
AP_TERM, EXISTS_EQ, SELECT_EQ.

\ENDDOC
\DOC{FORALL\_IMP\_CONV}

\TYPE {\small\verb%FORALL_IMP_CONV : conv%}\egroup

\SYNOPSIS
Moves a universal quantification inwards through an implication.

\DESCRIBE
When applied to a term of the form {\small\verb%!x. P ==> Q%}, where {\small\verb%x%} is not free in 
both {\small\verb%P%} and {\small\verb%Q%}, {\small\verb%FORALL_IMP_CONV%} returns a theorem of one of three forms,
depending on occurrences of the variable {\small\verb%x%} in {\small\verb%P%} and {\small\verb%Q%}.  If {\small\verb%x%} is free
in {\small\verb%P%} but not in {\small\verb%Q%}, then the theorem:
{\par\samepage\setseps\small\begin{verbatim}
   |- (!x. P ==> Q) = (?x.P) ==> Q
\end{verbatim}}
\noindent is returned.  If {\small\verb%x%} is free in {\small\verb%Q%} but not in {\small\verb%P%}, then the
result is:
{\par\samepage\setseps\small\begin{verbatim}
   |- (!x. P ==> Q) = P ==> (!x.Q)
\end{verbatim}}
\noindent And if {\small\verb%x%} is free in neither {\small\verb%P%} nor {\small\verb%Q%}, then the result is:
{\par\samepage\setseps\small\begin{verbatim}
   |- (!x. P ==> Q) = (?x.P) ==> (!x.Q)
\end{verbatim}}
\FAILURE 
{\small\verb%FORALL_IMP_CONV%} fails if it is applied to a term not of the form 
{\small\verb%!x. P ==> Q%}, or if it is applied to a term {\small\verb%!x. P ==> Q%} in which the 
variable {\small\verb%x%} is free in both {\small\verb%P%} and {\small\verb%Q%}.

\SEEALSO
LEFT_IMP_EXISTS_CONV, RIGHT_IMP_FORALL_CONV.

\ENDDOC



\DOC{FORALL\_NOT\_CONV}

\TYPE {\small\verb%FORALL_NOT_CONV : conv%}\egroup

\SYNOPSIS
Moves a universal quantification inwards through a negation.

\DESCRIBE
When applied to a term of the form {\small\verb%!x.~P%}, the conversion {\small\verb%FORALL_NOT_CONV%}
returns the theorem:
{\par\samepage\setseps\small\begin{verbatim}
   |- (!x.~P) = ~(?x. P)
\end{verbatim}}
\FAILURE
Fails if applied to a term not of the form {\small\verb%!x.~P%}.

\SEEALSO
EXISTS_NOT_CONV, NOT_EXISTS_CONV, NOT_FORALL_CONV.

\ENDDOC
\DOC{FORALL\_OR\_CONV}

\TYPE {\small\verb%FORALL_OR_CONV : conv%}\egroup

\SYNOPSIS
Moves a universal quantification inwards through a disjunction.

\DESCRIBE
When applied to a term of the form {\small\verb%!x. P \/ Q%}, where {\small\verb%x%} is not free in both
{\small\verb%P%} and {\small\verb%Q%}, {\small\verb%FORALL_OR_CONV%} returns a theorem of one of three forms,
depending on occurrences of the variable {\small\verb%x%} in {\small\verb%P%} and {\small\verb%Q%}.  If {\small\verb%x%} is free
in {\small\verb%P%} but not in {\small\verb%Q%}, then the theorem:
{\par\samepage\setseps\small\begin{verbatim}
   |- (!x. P \/ Q) = (!x.P) \/ Q
\end{verbatim}}
\noindent is returned.  If {\small\verb%x%} is free in {\small\verb%Q%} but not in {\small\verb%P%}, then the
result is:
{\par\samepage\setseps\small\begin{verbatim}
   |- (!x. P \/ Q) = P \/ (!x.Q)
\end{verbatim}}
\noindent And if {\small\verb%x%} is free in neither {\small\verb%P%} nor {\small\verb%Q%}, then the result is:
{\par\samepage\setseps\small\begin{verbatim}
   |- (!x. P \/ Q) = (!x.P) \/ (!x.Q)
\end{verbatim}}
\FAILURE 
{\small\verb%FORALL_OR_CONV%} fails if it is applied to a term not of the form 
{\small\verb%!x. P \/ Q%}, or if it is applied to a term {\small\verb%!x. P \/ Q%} in which the 
variable {\small\verb%x%} is free in both {\small\verb%P%} and {\small\verb%Q%}.

\SEEALSO
OR_FORALL_CONV, LEFT_OR_FORALL_CONV, RIGHT_OR_FORALL_CONV.

\ENDDOC



\DOC{FRONT\_CONJ\_CONV}

\TYPE {\small\verb%FRONT_CONJ_CONV: term list -> term -> thm%}\egroup

\SYNOPSIS 
Move a specified conjunct to the beginning of a conjunction. 

\DESCRIBE
Given a list of boolean terms {\small\verb%[t1;...;t;...;tn]%} and a term {\small\verb%t%} which occurs
in the list, {\small\verb%FRONT_CONJ_CONV%} returns:
{\par\samepage\setseps\small\begin{verbatim}
   |- (t1 /\ ... /\ t /\ ... /\ tn) = (t /\ t1 /\ ... /\ tn)
\end{verbatim}}
\noindent That is, {\small\verb%FRONT_CONJ_CONV%} proves that {\small\verb%t%} can be moved to the
`front' of a conjunction of several terms.

\FAILURE
{\small\verb%FRONT_CONJ_CONV [t1;...;tn] "t"%} fails if {\small\verb%t%} does not occur in the list
{\small\verb%[t1,...,tn]%} or if any of {\small\verb%t1%}, ..., {\small\verb%tn%} does not have type {\small\verb%bool%}.

\COMMENTS
This is not a true {\small\verb%conv%}, so perhaps it ought to be called something else.
The system shows its type as {\small\verb%(term list -> conv)%}.

\ENDDOC
\DOC{FUN\_EQ\_CONV}

\TYPE {\small\verb%FUN_EQ_CONV : conv%}\egroup

\SYNOPSIS
Extensionality conversion for functions (function equality).

\DESCRIBE
The conversion {\small\verb%FUN_EQ_CONV%} embodies the fact that two functions are equal
precisely when they give the same results for all values to which they can be
applied. When supplied with a term argument of the form {\small\verb%f = g%}, where {\small\verb%f%} and
{\small\verb%g%} are functions of type {\small\verb%:ty1->ty2%}, {\small\verb%FUN_EQ_CONV%} returns the theorem:
{\par\samepage\setseps\small\begin{verbatim}
   |- (f = g) = (!x. f x = g x)
\end{verbatim}}
\noindent where {\small\verb%x%} is a variable of type {\small\verb%:ty1%} chosen by the conversion.

\FAILURE 
{\small\verb%FUN_EQ_CONV tm%} fails if {\small\verb%tm%} is not an equation {\small\verb%f = g%}, where {\small\verb%f%} and {\small\verb%g%}
are functions.

\USES
Used for proving equality of functions.

\SEEALSO
EXT, X_FUN_EQ_CONV.

\ENDDOC



\DOC{GEN}

\TYPE {\small\verb%GEN : (term -> thm -> thm)%}\egroup

\SYNOPSIS
Generalizes the conclusion of a theorem.

\DESCRIBE
When applied to a term {\small\verb%x%} and a theorem {\small\verb%A |- t%}, the inference rule
{\small\verb%GEN%} returns the theorem {\small\verb%A |- !x. t%}, provided {\small\verb%x%} is a variable not
free in any of the assumptions. There is no compulsion that {\small\verb%x%} should
be free in {\small\verb%t%}.
{\par\samepage\setseps\small\begin{verbatim}
      A |- t
   ------------  GEN "x"               [provided x is not free in A]
    A |- !x. t
\end{verbatim}}
\FAILURE
Fails if {\small\verb%x%} is not a variable, or if it is free in any of the assumptions.

\EXAMPLE
The following example shows how the above side-condition prevents
the derivation of the theorem {\small\verb%x=T |- !x. x=T%}, which is clearly invalid.
{\par\samepage\setseps\small\begin{verbatim}
   #top_print print_all_thm;;
   - : (thm -> void)

   #let t = ASSUME "x=T";;
   t = x = T |- x = T

   #GEN "x:bool" t;;
   evaluation failed     GEN
\end{verbatim}}
\SEEALSO
GENL, GEN_ALL, GEN_TAC, SPEC, SPECL, SPEC_ALL, SPEC_TAC.

\ENDDOC
\DOC{GENL}

\TYPE {\small\verb%GENL : (term list -> thm -> thm)%}\egroup

\SYNOPSIS
Generalizes zero or more variables in the conclusion of a theorem.

\DESCRIBE
When applied to a term list {\small\verb%[x1;...;xn]%} and a theorem {\small\verb%A |- t%}, the inference
rule {\small\verb%GENL%} returns the theorem {\small\verb%A |- !x1...xn. t%}, provided none of the
variables {\small\verb%xi%} are free in any of the assumptions. It is not necessary that
any or all of the {\small\verb%xi%} should be free in {\small\verb%t%}.
{\par\samepage\setseps\small\begin{verbatim}
         A |- t
   ------------------  GENL "[x1;...;xn]"       [provided no xi is free in A]
    A |- !x1...xn. t
\end{verbatim}}
\FAILURE
Fails unless all the terms in the list are variables, none of which are
free in the assumption list.

\SEEALSO
GEN, GEN_ALL, GEN_TAC, SPEC, SPECL, SPEC_ALL, SPEC_TAC.

\ENDDOC
\DOC{GEN\_ALL}

\TYPE {\small\verb%GEN_ALL : (thm -> thm)%}\egroup

\SYNOPSIS
Generalizes the conclusion of a theorem over its own free variables.

\DESCRIBE
When applied to a theorem {\small\verb%A |- t%}, the inference rule {\small\verb%GEN_ALL%} returns
the theorem {\small\verb%A |- !x1...xn. t%}, where the {\small\verb%xi%} are all the variables,
if any, which are free in {\small\verb%t%} but not in the assumptions.
{\par\samepage\setseps\small\begin{verbatim}
         A |- t
   ------------------  GEN_ALL
    A |- !x1...xn. t
\end{verbatim}}
\FAILURE
Never fails.

\SEEALSO
GEN, GENL, GEN_ALL, SPEC, SPECL, SPEC_ALL, SPEC_TAC.

\ENDDOC
\DOC{GEN\_ALPHA\_CONV}

\TYPE {\small\verb%GEN_ALPHA_CONV : (term -> conv)%}\egroup

\SYNOPSIS
Rename the bound variable of a quantified term or an epsilon term.

\DESCRIBE
The conversion {\small\verb%GEN_ALPHA_CONV%} provides alpha conversion for lambda
abstractions of the form {\small\verb%"\y.t"%}, quantified terms of the forms {\small\verb%"!y.t"%},
{\small\verb%"?y.t"%} or {\small\verb%"?!y.t"%}, and epsilon terms of the form {\small\verb%"@y.t"%}.  If {\small\verb%tm%} is a
term of one of these five forms, where the bound variable {\small\verb%y%} has type {\small\verb%":ty"%}
and {\small\verb%"x"%} is a variable also of type {\small\verb%:ty%}, then {\small\verb%GEN_ALPHA_CONV "x" tm%}
returns one of the theorems:
{\par\samepage\setseps\small\begin{verbatim}
   |- (\y.t)  = (\x'. t[x'/y])
   |- (!y.t)  = (!x'. t[x'/y])
   |- (?y.t)  = (?x'. t[x'/y])
   |- (?!y.t) = (?!x'. t[x'/y])
   |- (@y.t)  = (@x'. t[x'/y])
\end{verbatim}}
\noindent depending on whether the input term is {\small\verb%"\y.t"%}, {\small\verb%"!y.t"%}, {\small\verb%"?y.t"%},
{\small\verb%"?!y.t"%}, or {\small\verb%"@y.t"%}, respectively.  The variable {\small\verb%x':ty%} in the resulting
theorem is a primed variant of {\small\verb%x%} chosen so as not to be free in the term
provided as the second argument to {\small\verb%GEN_ALPHA_CONV%}.

\FAILURE 
{\small\verb%GEN_ALPHA_CONV x tm%} fails if {\small\verb%x%} is not a variable, or if {\small\verb%tm%} does not have
one of the following five forms: {\small\verb%"\y.t"%}, {\small\verb%"!y.t"%}, {\small\verb%"?y.t"%}, {\small\verb%"?!y.t"%}, or
{\small\verb%"@y.t"%}.  {\small\verb%GEN_ALPHA_CONV x tm%} also fails if {\small\verb%tm%} does have one of these
forms, but types of the variables {\small\verb%x%} and {\small\verb%y%} differ.

\SEEALSO
ALPHA, ALPHA_CONV.

\ENDDOC
\DOC{GEN\_REWRITE\_RULE}

\TYPE {\small\verb%GEN_REWRITE_RULE : ((conv -> conv) -> thm list -> thm list -> thm -> thm)%}\egroup

\SYNOPSIS
General rule for rewriting theorems.

\DESCRIBE
Rewriting in HOL is based on the use of equational theorems as
left-to-right replacements on the subterms of an object theorem.  This
replacement is mediated by the use of {\small\verb%REWRITE_CONV%}, which finds
matches between left-hand sides of given equations in a term and
applies the substitution. 

The source of equations used in rewriting are obtained from the
theorem lists given as arguments to the function. These are at first
transformed into a form suitable for rewriting. Conjunctions are
separated into individual rewrites. Theorems with conclusions of the
form {\small\verb%"~t"%} are transformed into the corresponding equations
{\small\verb%"t = F"%}. Theorems {\small\verb%"t"%} which are not equations are cast as
equations of form {\small\verb%"t = T"%}.

If a theorem is used to rewrite the object theorem, its assumptions
are added to the assumptions of the returned theorem, unless they are
alpha-convertible to existing assumptions.  The matching involved uses
variable instantiation. Thus, all free variables are generalized, and
terms are instantiated before substitution. Theorems may have
universally quantified variables.

The theorems with which rewriting is done are divided
into two groups, to facilitate implementing other rewriting tools.
However, they are considered in an order-independent fashion. (That
is, the ordering is an implementation detail which is not specified.)

The search strategy for finding matching subterms is the first
argument to the rule. Matching and substitution may occur at any
level of the term, according to the specified search strategy: the
whole term, or starting from any subterm. The search strategy also
specifies the depth of the search: recursively up to an arbitrary
depth until no matches occur, once over the selected subterm, or any
more complex scheme.

\FAILURE
{\small\verb%GEN_REWRITE_RULE%} fails if the search strategy fails. It may also
cause a non-terminating sequence of rewrites, depending on the search
strategy used.

\USES
This rule is used in the system to implement all other rewriting
rules, and may provide a user with a method to fine-tune rewriting of
theorems.

\EXAMPLE
Suppose we have a theorem of the form:
{\par\samepage\setseps\small\begin{verbatim}
   thm = |- (1 + 2) + 3 = (3 + 1) + 2
\end{verbatim}}
\noindent and we would like to rewrite the left-hand side with the
theorem {\small\verb%ADD_SYM%} without changing the right hand side. This can be
done by using:
{\par\samepage\setseps\small\begin{verbatim}
   GEN_REWRITE_RULE (RATOR_CONV o ONCE_DEPTH_CONV) []  [ADD_SYM] mythm
\end{verbatim}}
\noindent Other rules, such as {\small\verb%ONCE_REWRITE_RULE%}, would match and
substitute on both sides, which would not be the desirable result.

As another example, {\small\verb%REWRITE_RULE%} is implemented as
{\par\samepage\setseps\small\begin{verbatim}
    GEN_REWRITE_RULE TOP_DEPTH_CONV basic_rewrites
\end{verbatim}}
\noindent which specifies that matches should be searched recursively
starting from the whole term of the theorem, and {\small\verb%basic_rewrites%} must
be added to the user defined set of theorems employed in rewriting.

\SEEALSO
ASM_REWRITE_RULE, ONCE_REWRITE_RULE, PURE_REWRITE_RULE, REWRITE_CONV,
REWRITE_RULE.

\ENDDOC

\DOC{GSPEC}

\TYPE {\small\verb%GSPEC : (thm -> thm)%}\egroup

\SYNOPSIS
Specializes the conclusion of a theorem with unique variables.

\DESCRIBE
When applied to a theorem {\small\verb%A |- !x1...xn. t%}, where the number of universally
quantified variables may be zero, {\small\verb%GSPEC%} returns {\small\verb%A |- t[g1/x1]...[gn/xn]%},
where the {\small\verb%gi%} are distinct variable names of the appropriate type, chosen by
{\small\verb%genvar%}.
{\par\samepage\setseps\small\begin{verbatim}
        A |- !x1...xn. t
   -------------------------  GSPEC
    A |- t[g1/x1]...[gn/xn]
\end{verbatim}}
\FAILURE
Never fails.

\USES
{\small\verb%GSPEC%} is useful in writing derived inference rules which need to specialize
theorems while avoiding using any variables that may be present elsewhere.

\SEEALSO
GEN, GENL, genvar, GEN_ALL, GEN_TAC, SPEC, SPECL, SPEC_ALL, SPEC_TAC.

\ENDDOC
\DOC{HALF\_MK\_ABS}

\TYPE {\small\verb%HALF_MK_ABS : (thm -> thm)%}\egroup

\SYNOPSIS
Converts function definition to lambda-form.

\DESCRIBE
When applied to a theorem {\small\verb%A |- !x. t1 x = t2%}, whose conclusion is a
universally quantified equation, {\small\verb%HALF_MK_ABS%} returns the theorem
{\small\verb%A |- t1 = \x. t2%}.
{\par\samepage\setseps\small\begin{verbatim}
    A |- !x. t1 x = t2
   --------------------  HALF_MK_ABS            [provided x is not free in t1]
    A |- t1 = (\x. t2)
\end{verbatim}}
\FAILURE
Fails unless the theorem is a singly universally quantified equation whose
left-hand side is a function applied to the quantified variable, or if the
variable is free in that function.

\SEEALSO
ETA_CONV, MK_ABS, MK_COMB, MK_EXISTS.

\ENDDOC
\DOC{IMP\_ANTISYM\_RULE}

\TYPE {\small\verb%IMP_ANTISYM_RULE : (thm -> thm -> thm)%}\egroup

\SYNOPSIS
Deduces equality of boolean terms from forward and backward implications.

\DESCRIBE
When applied to the theorems {\small\verb%A1 |- t1 ==> t2%} and {\small\verb%A2 |- t2 ==> t1%},
the inference rule {\small\verb%IMP_ANTISYM_RULE%} returns the theorem {\small\verb%A1 u A2 |- t1 = t2%}.
{\par\samepage\setseps\small\begin{verbatim}
   A1 |- t1 ==> t2     A2 |- t2 ==> t1
  -------------------------------------  IMP_ANTISYM_RULE
           A1 u A2 |- t1 = t2
\end{verbatim}}
\FAILURE
Fails unless the theorems supplied are a complementary implicative
pair as indicated above.

\SEEALSO
EQ_IMP_RULE, EQ_MP, EQ_TAC.

\ENDDOC
\DOC{IMP\_CANON}

\TYPE {\small\verb%IMP_CANON : (thm -> thm list)%}\egroup

\SYNOPSIS
Puts theorem into a `canonical' form.

\DESCRIBE
{\small\verb%IMP_CANON%} puts a theorem in `canonical' form by removing quantifiers
and breaking apart conjunctions, as well as disjunctions which form the
antecedent of implications. It applies the following transformation rules:
{\par\samepage\setseps\small\begin{verbatim}
      A |- t1 /\ t2           A |- !x. t           A |- (t1 /\ t2) ==> t
   -------------------       ------------         ------------------------
    A |- t1   A |- t2           A |- t             A |- t1 ==> (t2 ==> t)


        A |- (t1 \/ t2) ==> t              A |- (?x. t1) ==> t2
   -------------------------------        ----------------------
    A |- t1 ==> t   A |- t2 ==> t          A |- t1[x'/x] ==> t2
\end{verbatim}}

\FAILURE
Never fails, but if there is no scope for one of the above reductions,
merely gives a list whose only member is the original theorem.

\COMMENTS
This is a rather ad-hoc inference rule, and its use is not recommended.

\SEEALSO
CONJ1, CONJ2, CONJUNCTS, DISJ1, DISJ2, EXISTS, SPEC.

\ENDDOC
\DOC{IMP\_CONJ}

\TYPE {\small\verb%IMP_CONJ : (thm -> thm -> thm)%}\egroup

\SYNOPSIS
Conjoins antecedents and consequents of two implications.

\DESCRIBE
When applied to theorems {\small\verb%A1 |- p ==> r%} and {\small\verb%A2 |- q ==> s%}, the {\small\verb%IMP_CONJ%}
inference rule returns the theorem {\small\verb%A1 u A2 |- p /\ q ==> r /\ s%}.
{\par\samepage\setseps\small\begin{verbatim}
    A1 |- p ==> r    A2 |- q ==> s
   --------------------------------  IMP_CONJ
     A1 u A2 |- p /\ q ==> r /\ s
\end{verbatim}}
\FAILURE
Fails unless the conclusions of both theorems are implicative.

\SEEALSO
CONJ.

\ENDDOC
\DOC{IMP\_ELIM}

\TYPE {\small\verb%IMP_ELIM : (thm -> thm)%}\egroup

\SYNOPSIS
Transforms {\small\verb%|- s ==> t%} into {\small\verb%|- ~s \/ t%}.

\DESCRIBE
When applied to a theorem {\small\verb%A |- s ==> t%}, the inference rule {\small\verb%IMP_ELIM%}
returns the theorem {\small\verb%A |- ~s \/ t%}.
{\par\samepage\setseps\small\begin{verbatim}
    A |- s ==> t
   --------------  IMP_ELIM
    A |- ~s \/ t
\end{verbatim}}
\FAILURE
Fails unless the theorem is implicative.

\SEEALSO
NOT_INTRO, NOT_ELIM.

\ENDDOC
\DOC{IMP\_TRANS}

\TYPE {\small\verb%IMP_TRANS : (thm -> thm -> thm)%}\egroup

\SYNOPSIS
Transitivity of implication.

\DESCRIBE
When applied to theorems {\small\verb%A1 |- t1 ==> t2%} and {\small\verb%A2 |- t2 ==> t3%},
the inference rule {\small\verb%IMP_TRANS%} returns the theorem {\small\verb%A1 u A2 |- t1 ==> t3%}.
{\par\samepage\setseps\small\begin{verbatim}
    A1 |- t1 ==> t2   A2 |- t2 ==> t3
   -----------------------------------  IMP_TRANS
         A1 u A2 |- t1 ==> t3
\end{verbatim}}
\FAILURE
Fails unless the theorems are both implicative, with the consequent of the
first being the same as the antecedent of the  second (up to alpha-conversion).

\SEEALSO
IMP_ANTISYM_RULE, SYM, TRANS.

\ENDDOC
\DOC{INDUCT}

\TYPE {\small\verb%INDUCT : ((thm # thm) -> thm)%}\egroup

\SYNOPSIS
Inference rule for proof by mathematical induction on the natural numbers.

\DESCRIBE
The derived inference rule {\small\verb%INDUCT%} implements the rule of mathematical
induction:
{\par\samepage\setseps\small\begin{verbatim}
      A1 |- P[0]      A2 |- !n. P[n] ==> P[SUC n]
    -----------------------------------------------    INDUCT
               A1 u A2 |- !n. P[n]
\end{verbatim}}

\noindent When supplied with a theorem {\small\verb%A1 |- P[0]%}, which asserts the base
case of a proof of the proposition {\small\verb%P[n]%} by induction on {\small\verb%n%}, and the theorem
{\small\verb%A2 |- !n. P[n] ==> P[SUC n]%}, which asserts the step case in the induction on
{\small\verb%n%}, the inference rulle {\small\verb%INDUCT%} returns {\small\verb%A1 u A2 |- !n. P[n]%}.

\FAILURE
{\small\verb%INDUCT th1 th2%} fails if the theorems {\small\verb%th1%} and {\small\verb%th2%} do not have the forms
{\small\verb%A1 |- P[0]%} and {\small\verb%A2 |- !n. P[n] ==> P[SUC n]%} respectively.

\SEEALSO
INDUCT_TAC.

\ENDDOC
\DOC{INST}

\TYPE {\small\verb%INST : ((term # term) list -> thm -> thm)%}\egroup

\SYNOPSIS
HOL derived rule that instantiates free variables in a theorem.

\DESCRIBE
{\small\verb%INST%} is a rule for substituting arbitrary terms for free variables
in a theorem:
{\par\samepage\setseps\small\begin{verbatim}
         A |- t[x1,...,xn]
   -----------------------------  INST [(t1,x1);...;(tn,xn)] 
    A |- t[t1,...,tn/x1,...,xn]
\end{verbatim}}
\noindent where the variables {\small\verb%x1, ..., xn%} are not free in the
assumptions {\small\verb%A%}.

\FAILURE
{\small\verb%INST%} fails if a variable being instantiated is free in the
assumptions.

\EXAMPLE
In the following example a theorem is instantiated for a specific term:
{\par\samepage\setseps\small\begin{verbatim}
   #CONJUNCT1 ADD_CLAUSES ;;
   |- 0 + m = m

   #INST [("2 * x","m:num")] (CONJUNCT1 ADD_CLAUSES) ;;
   |- 0 + (2 * x) = 2 * x
\end{verbatim}}

\SEEALSO
INST_TY_TERM, INST_TYPE, ISPEC, ISPECL, SPEC; SPECL, SUBS, subst, SUBST.

\ENDDOC
\DOC{INST\_TYPE}

\TYPE {\small\verb%INST_TYPE : ((type # type) list -> thm -> thm)%}\egroup

\SYNOPSIS
Rule to instantiate types in a theorem.

\DESCRIBE
{\small\verb%INST_TYPE%} is a primitive rule in the HOL logic, which allows
instantiation of type variables.
{\par\samepage\setseps\small\begin{verbatim}
               A |- t
   -----------------------------------  INST_TYPE [(ty1,vty1);...;(tyn,vtyn)]
    A |- t[ty1,...,tyn/vty1,...,vtyn]
\end{verbatim}}

\FAILURE
{\small\verb%INST_TYPE%} fails if any of the type variables occurs free in the
hypotheses of the theorem, or if upon instantiation two distinct
variables (with the same name) become equal.

\USES
{\small\verb%INST_TYPE%} is employed to make use of polymorphic theorems.

\EXAMPLE
Suppose one wanted to specialize the theorem {\small\verb%EQ_SYM_EQ%} for
particular values, the first attempt could be to use {\small\verb%SPECL%} as
follows:
{\par\samepage\setseps\small\begin{verbatim}
   #SPECL ["a:num"; "b:num"] EQ_SYM_EQ ;;
   evaluation failed     SPECL
\end{verbatim}}
The failure occurred because {\small\verb%EQ_SYM_EQ%} contains polymorphic types.
The desired specialization can be obtained by using {\small\verb%INST_TYPE%}:
{\par\samepage\setseps\small\begin{verbatim}
   #SPECL ["a:num"; "b:num"] (INST_TYPE [":num",":*"] EQ_SYM_EQ) ;;
   |- (a = b) = (b = a)
\end{verbatim}}

\SEEALSO
INST, INST_TY_TERM.

\ENDDOC
\DOC{INST\_TY\_TERM}

\TYPE {\small\verb%INST_TY_TERM : (((term # term) list # (type # type) list) -> thm -> thm)%}\egroup

\SYNOPSIS
Instantiates terms and types of a theorem.

\DESCRIBE
{\small\verb%INST_TY_TERM%} instantiates types in a theorem, in the same way
{\small\verb%INST_TYPE%} does. Then it instantiates some or all of the free
variables in the resulting theorem, akin to {\small\verb%INST%}.

\FAILURE
{\small\verb%INST_TY_TERM%} fails in the same conditions as either {\small\verb%INST%} or
{\small\verb%INST_TYPE%} fail.

\SEEALSO
INST, INST_TYPE, ISPEC, SPEC, SUBS, SUBST.

\ENDDOC
\DOC{ISPEC}

\TYPE {\small\verb%ISPEC : (term -> thm -> thm)%}\egroup

\SYNOPSIS
Specialization, with type instantiation if necessary.

\DESCRIBE
This rule specializes a quantified variable as in {\small\verb%SPEC%}; it differs
from the latter in also instantiating the type if needed:
{\par\samepage\setseps\small\begin{verbatim}
     A |- !x:ty.tm
  -----------------------   ISPEC "t:ty'"
      A |- tm[t/x]
\end{verbatim}}
\noindent (where {\small\verb%t%} is free for {\small\verb%x%} in {\small\verb%tm%}, and {\small\verb%ty'%} is an instance
of {\small\verb%ty%}).

\FAILURE
{\small\verb%ISPEC%} fails if the input theorem is not universally quantified, if
the type of the given variable is not an instance of the type of the
quantified variable, or if the type variable is free in the
assumptions.

\SEEALSO
INST_TY_TERM, INST_TYPE, ISPEC, SPEC, match.

\ENDDOC


\DOC{ISPECL}

\TYPE {\small\verb%ISPECL : (term list -> thm -> thm)%}\egroup

\SYNOPSIS
Iterated specialization, with type instantiation if necessary.

\DESCRIBE
{\small\verb%ISPECL%} is an iterative version of {\small\verb%ISPEC%}
{\par\samepage\setseps\small\begin{verbatim}
         A |- !x1...xn.t
   ----------------------------   ISPECL ["t1",...,"tn"]
    A |- t[t1,...tn/x1,...,xn]
\end{verbatim}}
\noindent (where {\small\verb%ti%} is free for {\small\verb%xi%} in {\small\verb%tm%}).

\FAILURE
{\small\verb%ISPECL%} fails if the list of terms is longer than the number of
quantified variables in the term, if the type instantiation fails, or
if the type variable being instantiated is free in the assumptions.

\SEEALSO
INST_TYPE, INST_TY_TERM, ISPEC, MATCH, SPEC, SPECL.

\ENDDOC
\DOC{LEFT\_AND\_EXISTS\_CONV}

\TYPE {\small\verb%LEFT_AND_EXISTS_CONV : conv%}\egroup

\SYNOPSIS
Moves an existential quantification of the left conjunct outwards through a
conjunction.

\DESCRIBE
When applied to a term of the form {\small\verb%(?x.P) /\ Q%}, the conversion
{\small\verb%LEFT_AND_EXISTS_CONV%} returns the theorem:
{\par\samepage\setseps\small\begin{verbatim}
   |- (?x.P) /\ Q = (?x'. P[x'/x] /\ Q)
\end{verbatim}}
\noindent where {\small\verb%x'%} is a primed variant of {\small\verb%x%} that does not appear free in
the input term.

\FAILURE
Fails if applied to a term not of the form {\small\verb%(?x.P) /\ Q%}.

\SEEALSO
AND_EXISTS_CONV, EXISTS_AND_CONV, RIGHT_AND_EXISTS_CONV.

\ENDDOC

\DOC{LEFT\_AND\_FORALL\_CONV}

\TYPE {\small\verb%LEFT_AND_FORALL_CONV : conv%}\egroup

\SYNOPSIS
Moves a universal quantification of the left conjunct outwards through a
conjunction.

\DESCRIBE
When applied to a term of the form {\small\verb%(!x.P) /\ Q%}, the conversion
{\small\verb%LEFT_AND_FORALL_CONV%} returns the theorem:
{\par\samepage\setseps\small\begin{verbatim}
   |- (!x.P) /\ Q = (!x'. P[x'/x] /\ Q)
\end{verbatim}}
\noindent where {\small\verb%x'%} is a primed variant of {\small\verb%x%} that does not appear free in
the input term.

\FAILURE
Fails if applied to a term not of the form {\small\verb%(!x.P) /\ Q%}.

\SEEALSO
AND_FORALL_CONV, FORALL_AND_CONV, RIGHT_AND_FORALL_CONV.

\ENDDOC

\DOC{LEFT\_IMP\_EXISTS\_CONV}

\TYPE {\small\verb%LEFT_IMP_EXISTS_CONV : conv%}\egroup

\SYNOPSIS
Moves an existential quantification of the antecedent outwards through an 
implication.

\DESCRIBE
When applied to a term of the form {\small\verb%(?x.P) ==> Q%}, the cconversion
{\small\verb%LEFT_IMP_EXISTS_CONV%} returns the theorem:
{\par\samepage\setseps\small\begin{verbatim}
   |- (?x.P) ==> Q = (!x'. P[x'/x] ==> Q)
\end{verbatim}}
\noindent where {\small\verb%x'%} is a primed variant of {\small\verb%x%} that does not appear free in
the input term.

\FAILURE
Fails if applied to a term not of the form {\small\verb%(?x.P) ==> Q%}.

\SEEALSO
FORALL_IMP_CONV, RIGHT_IMP_FORALL_CONV.

\ENDDOC

\DOC{LEFT\_IMP\_FORALL\_CONV}

\TYPE {\small\verb%LEFT_IMP_FORALL_CONV : conv%}\egroup

\SYNOPSIS
Moves a universal quantification of the antecedent outwards through an 
implication.

\DESCRIBE
When applied to a term of the form {\small\verb%(!x.P) ==> Q%}, the conversion
{\small\verb%LEFT_IMP_FORALL_CONV%} returns the theorem:
{\par\samepage\setseps\small\begin{verbatim}
   |- (!x.P) ==> Q = (?x'. P[x'/x] ==> Q)
\end{verbatim}}
\noindent where {\small\verb%x'%} is a primed variant of {\small\verb%x%} that does not appear free in
the input term.

\FAILURE
Fails if applied to a term not of the form {\small\verb%(!x.P) ==> Q%}.

\SEEALSO
EXISTS_IMP_CONV, RIGHT_IMP_FORALL_CONV.

\ENDDOC

\DOC{LEFT\_OR\_EXISTS\_CONV}

\TYPE {\small\verb%LEFT_OR_EXISTS_CONV : conv%}\egroup

\SYNOPSIS
Moves an existential quantification of the left disjunct outwards through a
disjunction.

\DESCRIBE
When applied to a term of the form {\small\verb%(?x.P) \/ Q%}, the conversion
{\small\verb%LEFT_OR_EXISTS_CONV%} returns the theorem:
{\par\samepage\setseps\small\begin{verbatim}
   |- (?x.P) \/ Q = (?x'. P[x'/x] \/ Q)
\end{verbatim}}
\noindent where {\small\verb%x'%} is a primed variant of {\small\verb%x%} that does not appear free in
the input term.

\FAILURE
Fails if applied to a term not of the form {\small\verb%(?x.P) \/ Q%}.

\SEEALSO
EXISTS_OR_CONV, OR_EXISTS_CONV, RIGHT_OR_EXISTS_CONV.

\ENDDOC

\DOC{LEFT\_OR\_FORALL\_CONV}

\TYPE {\small\verb%LEFT_OR_FORALL_CONV : conv%}\egroup

\SYNOPSIS
Moves a universal quantification of the left disjunct outwards through a 
disjunction.

\DESCRIBE
When applied to a term of the form {\small\verb%(!x.P) \/ Q%}, the conversion
{\small\verb%LEFT_OR_FORALL_CONV%} returns the theorem:
{\par\samepage\setseps\small\begin{verbatim}
   |- (!x.P) \/ Q = (!x'. P[x'/x] \/ Q)
\end{verbatim}}
\noindent where {\small\verb%x'%} is a primed variant of {\small\verb%x%} that does not appear free in
the input term.

\FAILURE
Fails if applied to a term not of the form {\small\verb%(!x.P) \/ Q%}.

\SEEALSO
OR_FORALL_CONV, FORALL_OR_CONV, RIGHT_OR_FORALL_CONV.

\ENDDOC

\DOC{LENGTH\_CONV}

\TYPE {\small\verb%LENGTH_CONV : conv%}\egroup

\SYNOPSIS
Compute the length of an object-language list.

\DESCRIBE
For any object language list of the form {\small\verb%"[x1;x2;...;xn]"%}, where {\small\verb%x1%},
{\small\verb%x2%}, ..., {\small\verb%xn%} are arbitrary terms of the same type, the result of evaulating
{\par\samepage\setseps\small\begin{verbatim}
   LENGTH_CONV "LENGTH [x1;x2;...;xn]"
\end{verbatim}}
\noindent is the theorem
{\par\samepage\setseps\small\begin{verbatim}
   |- LENGTH [x1;x2;...;xn] = n
\end{verbatim}}
\noindent where {\small\verb%n%} is the numeral constant that denotes the length of the
list.

\FAILURE
{\small\verb%LENGTH_CONV tm%} fails if {\small\verb%tm%} is not of the form {\small\verb%"LENGTH [x1;x2;...;xn]"%},
where {\small\verb%n%} is greater than or equal to 0.

\ENDDOC
\DOC{let\_CONV}

\TYPE {\small\verb%let_CONV : conv%}\egroup

\SYNOPSIS
Evaluate {\small\verb%let%}-terms in the HOL logic.

\DESCRIBE
The conversion {\small\verb%let_CONV%} implements evaluation of object-language {\small\verb%let%}-terms.
When applied to a {\small\verb%let%}-term of the form:
{\par\samepage\setseps\small\begin{verbatim}
   let v1 = t1 and ... and vn = tn in t
\end{verbatim}}
\noindent where {\small\verb%v1%}, ..., {\small\verb%vn%} are variables, {\small\verb%let_CONV%} proves and returns
the theorem:
{\par\samepage\setseps\small\begin{verbatim}
   |- (let v1 = t1 and ... and vn = tn in t) = t[t1,...,tn/v1,...,vn]
\end{verbatim}}
\noindent where {\small\verb%t[t1,...,tn/v1,...,vn]%} denotes the result of substituting
{\small\verb%ti%} for {\small\verb%v1%} in parallel in {\small\verb%t%}, with automatic renaming of bound variables
to prevent free variable capture.

{\small\verb%let_CONV%} also works on {\small\verb%let%}-terms that bind tuples of variables to tuples of
values.  That is, if {\small\verb%<tup>%} is an arbitrarily-nested tuple of distinct
variables {\small\verb%v1%}, ..., {\small\verb%vn%} and {\small\verb%<val>%} is a structurally similar tuple of
values, that is {\small\verb%<val>%} equals {\small\verb%<tup>[t1,...,tn/v1,...,vn]%} for some terms
{\small\verb%t1%}, ..., {\small\verb%tn%}, then:
{\par\samepage\setseps\small\begin{verbatim}
   let_CONV "let <tup> = <val> in t"
\end{verbatim}}
\noindent returns
{\par\samepage\setseps\small\begin{verbatim}
  |- (let <tup> = <val> in t) = t[t1,...,tn/v1,...,vn]
\end{verbatim}}
\noindent That is, the term {\small\verb%ti%} is substituted for the corresponding variable
{\small\verb%vi%} in {\small\verb%t%}.  This form of {\small\verb%let%}-reduction also works with simultaneous binding
of tuples using {\small\verb%and%}.  

Finally, {\small\verb%let_CONV%} also handles {\small\verb%let%}-terms that introduce local definitions
of functions. When applied to a term of the form:
{\par\samepage\setseps\small\begin{verbatim}
   "let f v1 ... vn = tm in t"
\end{verbatim}}
\noindent {\small\verb%let_CONV%} returns:
{\par\samepage\setseps\small\begin{verbatim}
   |- (let f v1 ... vn = tm in t) = t'
\end{verbatim}}
\noindent where {\small\verb%t'%} is obtained by rewriting all applications of the function
{\small\verb%f%} in {\small\verb%t%} using the defining equation {\small\verb%f v1 ... vn = tm%}. Partial applications
of the form {\small\verb%f x1 ... xm%} where {\small\verb%m%} is less that {\small\verb%n%} are rewritten to
lambda-abstractions (see the example given below).  Simultaneous introduction
of functions using {\small\verb%and%} is handled, and each of {\small\verb%v1%}, ..., {\small\verb%vn%} in the pattern
shown above can be either a variable or a tuple of variables.

\FAILURE
{\small\verb%let_CONV tm%} fails if {\small\verb%tm%} is not a reducible {\small\verb%let%}-term of one of the forms
specified above.

\EXAMPLE
A simple example of the use of {\small\verb%let_CONV%} to eliminate a single local variable
is the following:
{\par\samepage\setseps\small\begin{verbatim}
   #let_CONV "let x = 1 in x+y";;
   |- (let x = 1 in x + y) = 1 + y
\end{verbatim}}
\noindent and an example showing a tupled binding is:
{\par\samepage\setseps\small\begin{verbatim}
   #let_CONV "let (x,y) = (1,2) in x+y";;
   |- (let (x,y) = 1,2 in x + y) = 1 + 2
\end{verbatim}}
\noindent Simultaneous introduction of two local functions {\small\verb%f%} and {\small\verb%g%}
and rewriting is illustrated by:
{\par\samepage\setseps\small\begin{verbatim}
   #let_CONV "let f x = x + 1 and g x = x + 2 in !x. g(f(g x)) = x + 5";;
   |- (let f x = x + 1 and g x = x + 2 in (!x. g(f(g x)) = x + 5)) =
      (!x. ((x + 2) + 1) + 2 = x + 5)
\end{verbatim}}
\noindent and an example of partial application is:
{\par\samepage\setseps\small\begin{verbatim}
   #let_CONV "let f x y = x+y in f 1";; 	
   |- (let f x y = x + y in f 1) = (\y. 1 + y)
\end{verbatim}}
\noindent Note the introduction of a lambda-abstraction in the result.

\SEEALSO
BETA_CONV, PAIRED_BETA_CONV.

\ENDDOC
\DOC{LIST\_BETA\_CONV}

\TYPE {\small\verb%LIST_BETA_CONV : conv%}\egroup

\SYNOPSIS
Iterated beta conversion.

\DESCRIBE
The conversion {\small\verb%LIST_BETA_CONV%} maps terms of the form
{\par\samepage\setseps\small\begin{verbatim}
   "(\x1 x2 ... xn. u) v1 v2 ... vn"
\end{verbatim}}
\noindent to the theorems of the form
{\par\samepage\setseps\small\begin{verbatim}
   |- (\x1 x2 ... xn. u) v1 v2 ... vn = u[v1/x1][v2/x2] ... [vn/xn]
\end{verbatim}}
\noindent where {\small\verb%u[vi/xi]%} denotes the result of substituting {\small\verb%vi%} for all free
occurrences of {\small\verb%xi%} in {\small\verb%u%}, after renaming sufficient bound variables to avoid
variable capture.

\FAILURE
{\small\verb%LIST_BETA_CONV tm%} fails if {\small\verb%tm%} does not have the form 
{\small\verb%"(\x1 ... xn. u) v1 ... vn"%} for {\small\verb%n%} greater than 0.

\EXAMPLE
{\par\samepage\setseps\small\begin{verbatim}
#LIST_BETA_CONV "(\x y. x+y) 1 2";;
|- (\x y. x + y)1 2 = 1 + 2
\end{verbatim}}

\SEEALSO
BETA_CONV, BETA_RULE, BETA_TAC, RIGHT_BETA, RIGHT_LIST_BETA.

\ENDDOC
\DOC{LIST\_CONJ}

\TYPE {\small\verb%LIST_CONJ : proof%}\egroup

\SYNOPSIS
{\small\verb%LIST_CONJ%} takes a list of theorems and returns a theorem.
The conclusion of the resulting theorem is the conjunction of all the 
conclusions of the premises.
The hypotheses of the resulting theorem are the union of all the 
hypotheses of the premises.

\DESCRIBE
{\par\samepage\setseps\small\begin{verbatim}
         A1 |- t1 ... An |- tn
   ----------------------------------  LIST_CONJ
    A1 u ... u An |- t1 /\ ... /\ tn
\end{verbatim}}
\FAILURE
{\small\verb%LIST_CONJ%} will fail with {\small\verb%`end_itlist`%} if applied to an empty list 
of theorems.

\COMMENTS
Some users may find {\small\verb%(thm list -> thm)%} to be a more illuminating 
type description for {\small\verb%LIST_CONJ%}.
{\small\verb%LIST_CONJ%} does not check for alpha-equivalence of assumptions when
forming their union.
If a particular assumption is duplicated within one of the input theorems
assumption lists, then it may be duplicated in the resulting assumption list.

\SEEALSO
CONJ, CONJUNCT1, CONJUNCT2, CONJUNCTS, CONJ_PAIR, CONJ_TAC.

\ENDDOC
\DOC{list\_EQ\_CONV}

\TYPE {\small\verb%list_EQ_CONV : (conv -> conv)%}\egroup

\SYNOPSIS
Prove equality or inequality of two lists.

\DESCRIBE
{\small\verb%list_EQ_CONV c%} implements a decision procedure for equality of lists of type
{\small\verb%(ty)list%} where the conversion {\small\verb%c%} decides equality of values of type {\small\verb%ty%}.
More precisely, the argument to {\small\verb%list_EQ_CONV%} is expected to be a conversion
{\small\verb%c%} which implements a decision procedure for values of some base type {\small\verb%ty%}, in
the sense that {\small\verb%c "t1 = t2"%} returns {\small\verb%|- (t1 = t2) = T%} if {\small\verb%t1%} denotes the
same value as {\small\verb%t2%} and {\small\verb%|- (t1 = t2) = F%} if {\small\verb%t1%} and {\small\verb%t2%} denote diferent
values.  Given such a conversion {\small\verb%c%}, evaluating:
{\par\samepage\setseps\small\begin{verbatim}
   list_EQ_CONV c "[t1;...;tn] = [u1;...;um]"
\end{verbatim}}
\noindent where all the {\small\verb%ti%} and {\small\verb%ui%} have type {\small\verb%ty%}, returns:
{\par\samepage\setseps\small\begin{verbatim}
   |- ([t1;...;tn] = [u1;...;um]) = F
\end{verbatim}}
\noindent if {\small\verb%n%} is not equal to {\small\verb%m%} (i.e. if the two lists have different
lengths) or if {\small\verb%n%} = {\small\verb%m%} and the conversion {\small\verb%c%} proves {\small\verb%|- (ti = ui) = F%} for
some {\small\verb%i%} between {\small\verb%1%} and {\small\verb%n%}. The theorem:
{\par\samepage\setseps\small\begin{verbatim}
   |- ([t1;...;tn] = [u1;...;um]) = T
\end{verbatim}}
\noindent is returned if {\small\verb%n%} equals {\small\verb%m%} and for all {\small\verb%i%} from {\small\verb%1%} to {\small\verb%n%} either
{\small\verb%ti%} is syntactically identical to {\small\verb%ui%} or {\small\verb%c%} proves {\small\verb%|- (ti = ui) = T%}

\FAILURE
{\small\verb%list_EQ_CONV t%} fails if {\small\verb%t%} is not a term of the form 
{\small\verb%"[t1;...;tn] = [u1;...;um]"%}, or if {\small\verb%n%} equals {\small\verb%m%} and some {\small\verb%ti%} is not
syntactically identical to {\small\verb%ui%} but {\small\verb%c%} fails to prove either of the
theorems {\small\verb%|- (ti = ui) = T%} or {\small\verb%|- (ti = ui) = F%} when applied to {\small\verb%"ti = ui"%}.

\EXAMPLE
{\par\samepage\setseps\small\begin{verbatim}
   #list_EQ_CONV num_EQ_CONV "[1;SUC 1;3] = [1;2;3]";;
   |- ([1;SUC 1;3] = [1;2;3]) = T			
\end{verbatim}}
\ENDDOC
\DOC{LIST\_INDUCT}

\TYPE {\small\verb%LIST_INDUCT : ((thm # thm) -> thm)%}\egroup

\SYNOPSIS
Inference rule for proof by structural induction on lists.

\DESCRIBE
The derived inference rule {\small\verb%LIST_INDUCT%} implements the rule of mathematical
induction:
{\par\samepage\setseps\small\begin{verbatim}
      A1 |- P[NIL]      A2 |- !t. P[t] ==> !h. P[CONS h t]
    ---------------------------------------------------------- LIST_INDUCT
                   A1 u A2 |- !l. P[l]
\end{verbatim}}
\noindent When supplied with a theorem {\small\verb%A1 |- P[NIL]%}, which asserts the base
case of a proof of the proposition {\small\verb%P[l]%} by structural induction on the list
{\small\verb%l%}, and the theorem 
{\par\samepage\setseps\small\begin{verbatim}
   A2 |- !t. P[t] ==> !h. P[CONS h t]
\end{verbatim}}
\noindent which asserts the step case in the induction on {\small\verb%l%}, the inference
rulle {\small\verb%LIST_INDUCT%} returns {\small\verb%A1 u A2 |- !l. P[l]%}.

\FAILURE
{\small\verb%LIST_INDUCT th1 th2%} fails if the theorems {\small\verb%th1%} and {\small\verb%th2%} do not have the
forms {\small\verb%A1 |- P[NIL]%} and {\small\verb%A2 |- !t. P[t] ==> !h. P[CONS h t]%} respectively
(where the empty list {\small\verb%NIL%} in {\small\verb%th1%} and the list {\small\verb%CONS h t%} in {\small\verb%th2%} have
the same type).

\SEEALSO
LIST_INDUCT_TAC.

\ENDDOC
\DOC{LIST\_MK\_EXISTS}

\TYPE {\small\verb%LIST_MK_EXISTS : (term list -> thm -> thm)%}\egroup

\SYNOPSIS
Multiply existentially quantifies both sides of an equation using the given
variables.

\DESCRIBE
When applied to a list of terms {\small\verb%[x1;...;xn]%}, where the {\small\verb%ti%} are all
variables, and a theorem {\small\verb%A |- t1 = t2%}, the inference rule
{\small\verb%LIST_MK_EXISTS%} existentially quantifies both sides of the equation
using the variables given, none of which should be free in the assumption
list.
{\par\samepage\setseps\small\begin{verbatim}
                A |- t1 = t2
   --------------------------------------  LIST_MK_EXISTS ["x1";...;"xn"]
    A |- (?x1...xn. t1) = (?x1...xn. t2)
\end{verbatim}}
\FAILURE
Fails if any term in the list is not a variable or is free in the assumption
list, or if the theorem is not equational.

\SEEALSO
EXISTS_EQ, MK_EXISTS.

\ENDDOC
\DOC{LIST\_MP}

\TYPE {\small\verb%LIST_MP : (thm list -> thm -> thm)%}\egroup

\SYNOPSIS
Performs a chain of Modus Ponens inferences.

\DESCRIBE
When applied to theorems {\small\verb%A1 |- t1, ..., An |- tn%} and a theorem which is a
chain of implications with the successive antecedents the same as the
conclusions of the theorems in the list (up to alpha-conversion),
{\small\verb%A |- t1 ==> ... ==> tn ==> t%}, the {\small\verb%LIST_MP%} inference rule performs a chain
of {\small\verb%MP%} inferences to deduce {\small\verb%A u A1 u ... u An |- t%}.
{\par\samepage\setseps\small\begin{verbatim}
    A1 |- t1 ... An |- tn      A |- t1 ==> ... ==> tn ==> t
   ---------------------------------------------------------  LIST_MP
                    A u A1 u ... u An |- t
\end{verbatim}}
\FAILURE
Fails unless the theorem is a chain of implications whose consequents are the
same as the conclusions of the list of theorems (up to alpha-conversion), in
sequence.

\SEEALSO
EQ_MP, MATCH_MP, MATCH_MP_TAC, MP, MP_TAC.

\ENDDOC
\DOC{MATCH\_MP}

\TYPE {\small\verb%MATCH_MP : (thm -> thm -> thm)%}\egroup

\SYNOPSIS
Modus Ponens inference rule with automatic matching.

\DESCRIBE
When applied to theorems {\small\verb%A1 |- !x1...xn. t1 ==> t2%} and {\small\verb%A2 |- t1'%}, the
inference rule {\small\verb%MATCH_MP%} matches {\small\verb%t1%} to {\small\verb%t1'%} by instantiating free or
universally quantified variables in the first theorem (only), and returns a
theorem {\small\verb%A1 u A2 |- t2'%}, where {\small\verb%t2'%} is a correspondingly instantiated version
of {\small\verb%t2%}. Polymorphic types will also be instantiated if necessary.
{\par\samepage\setseps\small\begin{verbatim}
    A1 |- t1 ==> t2   A2 |- t1'
   -----------------------------  MATCH_MP
          A1 u A2 |- t2'
\end{verbatim}}
\FAILURE
Fails unless the first theorem is a (possibly repeatedly universally
quantified) implication whose antecedent can be instantiated to match
the conclusion of the second theorem, without instantiating any variables
which are free in {\small\verb%A1%}, the first theorem's assumption list.

\EXAMPLE
The following is a simple example, where {\small\verb%x%} is matched to {\small\verb%T%}.
{\par\samepage\setseps\small\begin{verbatim}
   #let t1 = DISCH "x=T" (EQT_ELIM (ASSUME "x=T")) and t2 = REFL "T";;
   t1 = |- (x = T) ==> t
   t2 = |- T = T

   #MATCH_MP t1 t2;;
   |- T
\end{verbatim}}
\SEEALSO
EQ_MP, MATCH_MP_TAC, MP, MP_TAC.

\ENDDOC
\DOC{MK\_ABS}

\TYPE {\small\verb%MK_ABS : (thm -> thm)%}\egroup

\SYNOPSIS
Abstracts both sides of an equation.

\DESCRIBE
When applied to a theorem {\small\verb%A |- !x. t1 = t2%}, whose conclusion is a
universally quantified equation, {\small\verb%MK_ABS%} returns the theorem
{\small\verb%A |- \x. t1 = \x. t2%}.
{\par\samepage\setseps\small\begin{verbatim}
        A |- !x. t1 = t2
   --------------------------  MK_ABS
    A |- (\x. t1) = (\x. t2)
\end{verbatim}}
\FAILURE
Fails unless the theorem is a (singly) universally quantified equation.

\SEEALSO
HALF_MK_ABS, MK_COMB, MK_EXISTS.

\ENDDOC
\DOC{MK\_COMB}

\TYPE {\small\verb%MK_COMB : ((thm # thm) -> thm)%}\egroup

\SYNOPSIS
Proves equality of combinations constructed from equal
functions and operands.

\DESCRIBE
When applied to theorems {\small\verb%A1 |- f = g%} and {\small\verb%A2 |- x = y%}, the inference
rule {\small\verb%MK_COMB%} returns the theorem {\small\verb%A1 u A2 |- f x = g y%}.
{\par\samepage\setseps\small\begin{verbatim}
    A1 |- f = g   A2 |- x = y
   ---------------------------  MK_COMB
       A1 u A2 |- f x = g y
\end{verbatim}}
\FAILURE
Fails unless both theorems are equational and {\small\verb%f%} and {\small\verb%g%} are
functions whose domain types are the same as the types of {\small\verb%x%} and {\small\verb%y%}
respectively.

\SEEALSO
AP_TERM, AP_THM.

\ENDDOC
\DOC{MK\_EXISTS}

\TYPE {\small\verb%MK_EXISTS : (thm -> thm)%}\egroup

\SYNOPSIS
Existentially quantifies both sides of a universally quantified
equational theorem.

\DESCRIBE
When applied to a theorem {\small\verb%A |- !x. t1 = t2%}, the inference rule {\small\verb%MK_EXISTS%}
returns the theorem {\small\verb%A |- (?x. t1) = (?x. t2)%}.
{\par\samepage\setseps\small\begin{verbatim}
       A |- !x. t1 = t2
   --------------------------  MK_EXISTS
    A |- (?x. t1) = (?x. t2)
\end{verbatim}}
\FAILURE
Fails unless the theorem is a singly universally quantified equation.

\SEEALSO
AP_TERM, EXISTS_EQ, GEN, LIST_MK_EXISTS, MK_ABS.

\ENDDOC
\DOC{MP}

\TYPE {\small\verb%MP : (thm -> thm -> thm)%}\egroup

\SYNOPSIS
Modus Ponens inference rule.

\DESCRIBE
When applied to theorems {\small\verb%A1 |- t1 ==> t2%} and {\small\verb%A2 |- t1%},
the inference rule {\small\verb%MP%} returns the theorem {\small\verb%A1 u A2 |- t2%}.
{\par\samepage\setseps\small\begin{verbatim}
    A1 |- t1 ==> t2   A2 |- t1
   ----------------------------  MP
          A1 u A2 |- t2
\end{verbatim}}
\FAILURE
Fails unless the first theorem is an implication whose antecedent is the
same as the conclusion of the second theorem (up to alpha-conversion).

\SEEALSO
EQ_MP, LIST_MP, MATCH_MP, MATCH_MP_TAC, MP_TAC.

\ENDDOC
\DOC{NEG\_DISCH}

\TYPE {\small\verb%NEG_DISCH : (term -> thm -> thm)%}\egroup

\SYNOPSIS
Discharges an assumption, transforming an implication having consequent {\small\verb%F%}
into a negation.

\DESCRIBE
When applied to a term {\small\verb%s%} and a theorem {\small\verb%A |- t%}, the inference
rule {\small\verb%NEG_DISCH%} returns the theorem {\small\verb%A - {s} |- s ==> t%}, or if {\small\verb%t%}
is just {\small\verb%F%}, returns the theorem {\small\verb%A - {s} |- ~s%}.
{\par\samepage\setseps\small\begin{verbatim}
          A |- F
   --------------------  NEG_DISCH    [special case]
      A - {s} |- ~s

          A |- t
   --------------------  NEG_DISCH    [general case]
    A - {s} |- s ==> t

\end{verbatim}}
\FAILURE
Fails unless the supplied term has type {\small\verb%bool%}.

\SEEALSO
DISCH, NOT_ELIM, NOT_INTRO.

\ENDDOC
\DOC{new\_recursive\_definition}

\TYPE {\small\verb%new_recursive_definition : (bool -> thm -> string -> conv)%}\egroup

\SYNOPSIS
Define a primitive recursive function over a concrete recursive type.

\DESCRIBE 
{\small\verb%new_recursive_definition%} provides the facility for defining primitive
recursive functions on arbitrary concrete recursive types.  It takes four
arguments.  The first is a boolean flag which indicates if the recursive
function to be defined will be an infix or not.  The second is the primitive
recursion theorem for the concrete type in question; this must be a theorem
obtained from {\small\verb%define_type%}. The third argument is a name under which the
resulting definition will be saved in the current theory segment. And the
fourth argument is a term giving the desired primitive recursive function
definition.  The value returned by {\small\verb%new_recursive_definition%} is a theorem
which states the primitive recursive definition requested by the user.  This
theorem is derived by formal proof from an instance of the general primitive
recursion theorem given as the second argument.

A theorem {\small\verb%th%} of the form returned by {\small\verb%define_type%} is a primitive recursion
theorem for an automatically-defined concrete type {\small\verb%ty%}.  Let {\small\verb%C1%}, ..., {\small\verb%Cn%}
be the constructors of this type, and let `{\small\verb%(Ci vs)%}' represent a (curried)
application of the {\small\verb%i%}th constructor to a sequence of variables.  Then a
curried primitive recursive function {\small\verb%fn%} over {\small\verb%ty%} can be specified by a
conjunction of (optionally universally-quantified) clauses of the form:
{\par\samepage\setseps\small\begin{verbatim}
   fn v1 ... (C1 vs1) ... vm  =  body1   /\
   fn v1 ... (C2 vs2) ... vm  =  body2   /\
                             .
                             .
   fn v1 ... (Cn vsn) ... vm  =  bodyn
\end{verbatim}}
\noindent where the variables {\small\verb%v1%}, ..., {\small\verb%vm%}, {\small\verb%vs%} are distinct in each
clause, and where in the {\small\verb%i%}th clause {\small\verb%fn%} appears (free) in {\small\verb%bodyi%} only
as part of an application of the form:
{\par\samepage\setseps\small\begin{verbatim}
   "fn t1 ... v ... tm"
\end{verbatim}}
\noindent in which the variable {\small\verb%v%} of type {\small\verb%ty%} also occurs among the
variables {\small\verb%vsi%}.

If {\small\verb%<definition>%} is a conjunction of clauses, as described above, then
evaluating:
{\par\samepage\setseps\small\begin{verbatim}
   new_recursive_definition flag th `name` tm "<definition>";;
\end{verbatim}}
\noindent automatically proves the existence of a function {\small\verb%fn%} that satisfies
the defining equations supplied as the fourth argument, and then declares a new
constant in the current theory with this definition as its specification. This
constant specification is returned as a theorem and is saved in the current
theory segment under the name {\small\verb%name%}. If {\small\verb%flag%} is {\small\verb%true%}, the constant is
given infix status.

{\small\verb%new_recursive_definition%} also allows the supplied definition to omit clauses
for any number of constructors.  If a defining equation for the {\small\verb%i%}th
constructor is omitted, then the value of {\small\verb%fn%} at that constructor:
{\par\samepage\setseps\small\begin{verbatim}
   fn v1 ... (Ci vsi) ... vn  
\end{verbatim}}
\noindent is left unspecified ({\small\verb%fn%}, however, is still a total function).

\FAILURE
A call to {\small\verb%new_recursive_definition%} fails if the supplied theorem is not a
primitive recursion theorem of the form returned by {\small\verb%define_type%}; if the term
argument supplied is not a well-formed primitive recursive definition; or if
any other condition for making a constant specification is violated (see the
failure conditions for {\small\verb%new_specification%}).

\EXAMPLE
Given the following primitive recursion theorem for labelled binary trees:
{\par\samepage\setseps\small\begin{verbatim}
   |- !f0 f1.
        ?! fn.
        (!x. fn(LEAF x) = f0 x) /\
        (!b1 b2. fn(NODE b1 b2) = f1(fn b1)(fn b2)b1 b2)
\end{verbatim}}
\noindent {\small\verb%new_recursive_definition%} can be used to define primitive recursive
functions over binary trees.  Suppose the value of {\small\verb%th%} is this theorem.  Then
a recursive function {\small\verb%Leaves%}, which computes the number of leaves in a
binary tree, can be defined recursively as shown below:
{\par\samepage\setseps\small\begin{verbatim}
   #let Leaves = 
   #    new_recursive_definition false th `Leaves` 
   #      "(Leaves (LEAF (x:*)) = 1) /\
   #       (Leaves (NODE t1 t2) = (Leaves t1) + (Leaves t2))";;
   Leaves = 
   |- (!x. Leaves(LEAF x) = 1) /\
      (!t1 t2. Leaves(NODE t1 t2) = (Leaves t1) + (Leaves t2))
\end{verbatim}}
\noindent The result is a theorem which states that the constant {\small\verb%Leaves%}
satisfies the primitive-recursive defining equations supplied by the user.

The function defined using {\small\verb%new_recursive_definition%} need not, in fact, be
recursive.  Here is the definition of a predicate {\small\verb%IsLeaf%}, which is true of
binary trees which are leaves, but is false of the internal nodes in a binary
tree:
{\par\samepage\setseps\small\begin{verbatim}
   #let IsLeaf = 
   #    new_recursive_definition false th `IsLeaf` 
   #      "(IsLeaf (NODE t1 t2) = F) /\ (IsLeaf (LEAF (x:*)) = T)";;
   IsLeaf = |- (!t1 t2. IsLeaf(NODE t1 t2) = F) /\ (!x. IsLeaf(LEAF x) = T)
\end{verbatim}}
\noindent Note that the equations defining a (recursive or non-recursive)
function on binary trees by cases can be given in either order.  Here, the
{\small\verb%NODE%} case is given first, and the {\small\verb%LEAF%} case second.  The reverse order was
used in the above definition of {\small\verb%Leaves%}.

{\small\verb%new_recursive_definition%} also allows the user to partially specify the value
of a function defined on a concrete type, by allowing defining equations for
some of the constructors to be omitted.  Here, for example, is the definition
of a function {\small\verb%Label%} which extracts the label from a leaf node.  The value of
{\small\verb%Label%} applied to an internal node is left unspecified:
{\par\samepage\setseps\small\begin{verbatim}
   #let Label = 
   #    new_recursive_definition false th `Label` 
   #      "Label (LEAF (x:*)) = x";;
   Label = |- !x. Label(LEAF x) = x
\end{verbatim}}
\noindent Curried functions can also be defined, and the recursion can be on
any argument.  The next definition defines an infix (curried) function {\small\verb%<<%}
which expresses the idea that one tree is a proper subtree of another.
{\par\samepage\setseps\small\begin{verbatim}
   #let Subtree = 
   #    new_recursive_definition true th `Subtree` 
   #      "(<< (t:(*)btree) (LEAF (x:*)) = F) /\
   #       (<< t (NODE t1 t2) = ((t=t1)\/(t=t2)\/(<< t t1)\/(<< t t2)))";;
   Subtree = 
   |- (!t x. t << (LEAF x) = F) /\
      (!t t1 t2.
        t << (NODE t1 t2) = (t = t1) \/ (t = t2) \/ t << t1 \/ t << t2)
\end{verbatim}}
\noindent Note that the first argument is {\small\verb%true%}, to indicate that the function
being defined is to have infix status, and that the constant {\small\verb%<<%} is an infix
after the definition has been made.  Furthermore, the function {\small\verb%<<%} is
recursive on its second argument.

\SEEALSO
define_type, prove_rec_fn_exists.

\ENDDOC
\DOC{new\_specification}

\TYPE {\small\verb%new_specification : (string -> (string # string) list -> thm -> thm)%}\egroup

\SYNOPSIS
Introduce a constant or constants satisfying a given property.

\DESCRIBE 
The ML function {\small\verb%new_specification%} implements the primitive rule of
constant specification for the HOL logic.
Evaluating:
{\par\samepage\setseps\small\begin{verbatim}
   new_specification `name` [f1,`c1`;...;fn,`cn`] |- ?x1...xn. t
\end{verbatim}}
\noindent simultaneously introduces new constants named {\small\verb%c1%}, ..., {\small\verb%cn%}
satisfying the property:
{\par\samepage\setseps\small\begin{verbatim}
   |- t[c1,...,cn/x1,...,xn]
\end{verbatim}}
\noindent This theorem is stored, with name {\small\verb%name%}, as a definition in the
current theory segment. It is also returned by the call to {\small\verb%new_specification%}
The strings {\small\verb%f1%}, ..., {\small\verb%fn%} are flags which determine whether the new constants
are infixes or binders or neither.  If {\small\verb%fi%} is {\small\verb%`constant`%} then {\small\verb%ci%} is
declared an ordinary constant, if it is {\small\verb%`infix`%} then {\small\verb%ci%} is declared an
infix, and if it is {\small\verb%`binder`%} then {\small\verb%ci%} is declared a binder.  A flag of any
other value causes failure.

\FAILURE
{\small\verb%new_specification%} fails if called when HOL is not in draft mode. It also
fails if there is already an axiom, definition or specification of the given
name in the current theory segment; if the theorem argument has assumptions or
free variables; if the supplied constant names {\small\verb%`c1`%}, ..., {\small\verb%`cn`%} are not
distinct; if any one of {\small\verb%`c1`%}, ..., {\small\verb%`cn`%} is already a constant in the
current theory or is not an allowed name for a constant.  Failure also occurs
if any of {\small\verb%f1%}, ..., {\small\verb%fn%} is not either {\small\verb%`constant`%}, {\small\verb%`infix`%} or {\small\verb%`binder`%}
or if the type of {\small\verb%ci%} is not suitable for a constant with the syntactic status
specified by the flag {\small\verb%fi%}.  Finally, failure occurs if some {\small\verb%ci%} does not
contain all the type variables that occur in the term {\small\verb%?x1...xn. t%}.

\USES
{\small\verb%new_specification%} can be used to introduce constants that satisfy a given
property without having to make explicit equational constant definitions for
them.  For example, the built-in constants {\small\verb%MOD%} and {\small\verb%DIV%} are defined in the
system by first proving the theorem:
{\par\samepage\setseps\small\begin{verbatim}
   th |- ?MOD DIV. 
         !n. (0 < n) ==>
             !k. ((k = (((DIV k n) * n) + (MOD k n))) /\ ((MOD k n) < n))
\end{verbatim}}
\noindent and then making the constant specification:
{\par\samepage\setseps\small\begin{verbatim}
   #new_specification `DIVISION` [`infix`,`MOD`;`infix`,`DIV`] th;;
   |- !n. (0 < n) ==>
          !k. ((k = (((DIV k n) * n) + (MOD k n))) /\ ((MOD k n) < n))
\end{verbatim}}
\noindent This introduces the constants {\small\verb%MOD%} and {\small\verb%DIV%} with the defining
property shown above.


\SEEALSO
new_definition, new_binder_definition, new_gen_definition,
new_infix_definition.

\ENDDOC
\DOC{new\_type\_definition}

\TYPE {\small\verb%new_type_definition : ((string # term # thm) -> thm)%}\egroup

\SYNOPSIS
Define a new type constant or type operator.

\DESCRIBE 
The ML function {\small\verb%new_type_definition%} implements the primitive HOL rule of
definition for introducing new type constants or type operators into the logic.
If {\small\verb%"t"%} is a term of type {\small\verb%ty->bool%} containing {\small\verb%n%} distinct type variables,
then evaluating:
{\par\samepage\setseps\small\begin{verbatim}
   new_type_definition(`op`, "t", |- ?x. t x) 
\end{verbatim}}
\noindent results in {\small\verb%op%} being declared as a new {\small\verb%n%}-ary type operator in the
current theory and returned by the call to {\small\verb%new_type_definition%}. This new type
operator is characterized by a definitional axiom of the form:
{\par\samepage\setseps\small\begin{verbatim}
   |- ?rep:(*1,...,*n)op->ty. TYPE_DEFINITION t rep
\end{verbatim}}
\noindent which is stored as a definition in the current theory segment with
under the automatically-generated name {\small\verb%`op_TY_DEF`%}. The constant
{\small\verb%TYPE_DEFINITION%} in this axiomatic characterization of {\small\verb%op%} is defined by:
{\par\samepage\setseps\small\begin{verbatim}
   |- TYPE_DEFINITION (P:*->bool) (rep:**->*) =
         (!x' x''. (rep x' = rep x'') ==> (x' = x'')) /\	
         (!x. P x = (?x'. x = rep x'))
\end{verbatim}}
\noindent Thus {\small\verb%|- ?rep. TYPE_DEFINITION P rep%} asserts that there is a
bijection between the newly defined type {\small\verb%(*1,...,*n)op%} and the set of values
of type {\small\verb%ty%} that satisfy {\small\verb%P%}.

\FAILURE
Executing {\small\verb%new_type_definition(`op`,"t",th)%} fails if {\small\verb%op%} is already the name
of a type or type operator in the current theory, if {\small\verb%"t"%} does not have a type
of the form {\small\verb%ty->bool%} or {\small\verb%th%} is a not theorem without assumptions of the form
{\small\verb%|- ?x. t x%}, if there already exists a constant definition, constant
specification, type definition or axiom named {\small\verb%op_TY_DEF%} in the current theory
segment, or if HOL is not in draft mode.

\SEEALSO
define_new_type_bijections, prove_abs_fn_one_one, prove_abs_fn_onto,
prove_rep_fn_one_one, prove_rep_fn_onto.

\ENDDOC
\DOC{NOT\_ELIM}

\TYPE {\small\verb%NOT_ELIM : (thm -> thm)%}\egroup

\SYNOPSIS
Transforms {\small\verb%|- ~t%} into {\small\verb%|- t ==> F%}.

\DESCRIBE
When applied to a theorem {\small\verb%A |- ~t%}, the inference rule {\small\verb%NOT_ELIM%} returns the
theorem {\small\verb%A |- t ==> F%}.
{\par\samepage\setseps\small\begin{verbatim}
      A |- ~t
   --------------  NOT_ELIM
    A |- t ==> F
\end{verbatim}}
\FAILURE
Fails unless the theorem has a negated conclusion.

\SEEALSO
IMP_ELIM, NOT_INTRO.

\ENDDOC
\DOC{NOT\_EQ\_SYM}

\TYPE {\small\verb%NOT_EQ_SYM : (thm -> thm)%}\egroup

\SYNOPSIS
Swaps left-hand and right-hand sides of a negated equation.

\DESCRIBE
When applied to a theorem {\small\verb%A |- ~(t1 = t2)%}, the inference rule {\small\verb%NOT_EQ_SYM%}
returns the theorem {\small\verb%A |- ~(t2 = t1)%}.
{\par\samepage\setseps\small\begin{verbatim}
    A |- ~(t1 = t2)
   -----------------  NOT_EQ_SYM
    A |- ~(t2 = t1)
\end{verbatim}}
\FAILURE
Fails unless the theorem's conclusion is a negated equation.

\SEEALSO
DEPTH_CONV, REFL, SYM, TRANS.

\ENDDOC
\DOC{NOT\_EXISTS\_CONV}

\TYPE {\small\verb%NOT_EXISTS_CONV : conv%}\egroup

\SYNOPSIS
Moves negation inwards through an existential quantification.

\DESCRIBE
When applied to a term of the form {\small\verb%~(?x.P)%}, the conversion 
{\small\verb%NOT_EXISTS_CONV%} returns the theorem:
{\par\samepage\setseps\small\begin{verbatim}
   |- ~(?x.P) = !x.~P
\end{verbatim}}
\FAILURE
Fails if applied to a term not of the form {\small\verb%~(?x.P)%}.

\SEEALSO
EXISTS_NOT_CONV, FORALL_NOT_CONV, NOT_FORALL_CONV.

\ENDDOC
\DOC{NOT\_FORALL\_CONV}

\TYPE {\small\verb%NOT_FORALL_CONV : conv%}\egroup

\SYNOPSIS
Moves negation inwards through a universal quantification.

\DESCRIBE
When applied to a term of the form {\small\verb%~(!x.P)%}, the conversion
{\small\verb%NOT_FORALL_CONV%} returns the theorem:
{\par\samepage\setseps\small\begin{verbatim}
   |- ~(!x.P) = ?x.~P
\end{verbatim}}
\noindent It is irrelevant whether {\small\verb%x%} occurs free in {\small\verb%P%}.

\FAILURE
Fails if applied to a term not of the form {\small\verb%~(!x.P)%}.

\SEEALSO
EXISTS_NOT_CONV, FORALL_NOT_CONV, NOT_EXISTS_CONV.

\ENDDOC
\DOC{NOT\_INTRO}

\TYPE {\small\verb%NOT_INTRO : (thm -> thm)%}\egroup

\SYNOPSIS
Transforms {\small\verb%|- t ==> F%} into {\small\verb%|- ~t%}.

\DESCRIBE
When applied to a theorem {\small\verb%A |- t ==> F%}, the inference rule {\small\verb%NOT_INTRO%}
returns the theorem {\small\verb%A |- ~t%}.
{\par\samepage\setseps\small\begin{verbatim}
    A |- t ==> F
   --------------  NOT_INTRO
      A |- ~t
\end{verbatim}}
\FAILURE
Fails unless the theorem has an implicative conclusion with {\small\verb%F%}
as the consequent.

\SEEALSO
IMP_ELIM, NOT_ELIM.

\ENDDOC
\DOC{NO\_CONV}

\TYPE {\small\verb%NO_CONV : conv%}\egroup

\SYNOPSIS
Conversion that always fails.

\FAILURE
{\small\verb%NO_CONV%} always fails.

\USES
Identity element for {\small\verb%ORELSEC%}.

\SEEALSO
ALL_CONV.

\ENDDOC
\DOC{num\_CONV}

\TYPE {\small\verb%num_CONV : conv%}\egroup

\SYNOPSIS
Axiom-scheme for the definitions of natural number constants.

\DESCRIBE
{\small\verb%num_CONV%} is an axiom-scheme from which one may obtain a defining equation for
any natural number constant not equal {\small\verb%0%} (i.e. {\small\verb%1%}, {\small\verb%2%}, {\small\verb%3%},...).  If {\small\verb%"n"%}
is such a constant, then {\small\verb%num_CONV "n"%} returns the theorem:
{\par\samepage\setseps\small\begin{verbatim}
   |- n = SUC m
\end{verbatim}}
\noindent where {\small\verb%m%} is the numeral that denotes the predecessor of the 
number denoted by {\small\verb%n%}.

\FAILURE
{\small\verb%num_CONV tm%} fails if {\small\verb%tm%} is {\small\verb%"0"%} or if not {\small\verb%tm%} is not a numeral constant.

\EXAMPLE
{\par\samepage\setseps\small\begin{verbatim}
#num_CONV "3";;
|- 3 = SUC 2
\end{verbatim}}

\ENDDOC
\DOC{num\_EQ\_CONV}

\TYPE {\small\verb%num_EQ_CONV : conv%}\egroup

\SYNOPSIS
Prove equality or inequality of two natural number constants.

\DESCRIBE
If {\small\verb%n%} and {\small\verb%m%} are two distinct numeral constants (e.g. {\small\verb%0%}, {\small\verb%1%}, {\small\verb%2%},
{\small\verb%3%},...), then {\small\verb%num_EQ_CONV "n = m"%} returns the theorem:
{\par\samepage\setseps\small\begin{verbatim}
   |- (n = m) = F
\end{verbatim}}
\noindent If {\small\verb%n%} and {\small\verb%m%} are successors of numeral constants (e.g. {\small\verb%SUC 0%},
{\small\verb%SUC 1%}, {\small\verb%SUC(SUC 1)%} etc.), then {\small\verb%num_EQ_CONV "n = m"%} returns one of:
{\par\samepage\setseps\small\begin{verbatim}
   |- (n = m) = T       or       |- (n = m) = F
\end{verbatim}}
\noindent depending on whether the natural numbers represented by {\small\verb%n%} and {\small\verb%m%}
are equal or not equal, respectively. Finally, for any term {\small\verb%"n"%} of type
{\small\verb%num%}, evaluating {\small\verb%num_EQ_CONV "n = n"%} returns {\small\verb%|- (n = n) = T%}.

\FAILURE
{\small\verb%num_EQ_CONV tm%} fails if {\small\verb%tm%} is not of the form {\small\verb%"n = m"%}, where {\small\verb%n%} and {\small\verb%m%}
are either numerals or repeated applications of {\small\verb%SUC%} to numerals unless {\small\verb%n%}
and {\small\verb%m%} are syntactically identical terms of type {\small\verb%num%}.

\EXAMPLE
{\par\samepage\setseps\small\begin{verbatim}
#num_EQ_CONV "1 = SUC 2";;
|- (1 = SUC 2) = F

#num_EQ_CONV "SUC 1 = 2";;
|- (SUC 1 = 2) = T
\end{verbatim}}

\ENDDOC
\DOC{ONCE\_ASM\_REWRITE\_RULE}

\TYPE {\small\verb%ONCE_ASM_REWRITE_RULE : (thm list -> thm -> thm)%}\egroup

\SYNOPSIS
Rewrites a theorem only once with {\small\verb%basic_rewrites%}, the given list of
theorems, and the hypotheses of the theorem.

\DESCRIBE
{\small\verb%ONCE_ASM_REWRITE_RULE%} applies all possible rewrites in one step
over the subterms in the conclusion of the theorem, but stops after
rewriting at most once at each subterm. This strategy is specified as
for {\small\verb%ONCE_DEPTH_CONV%}. For more details see {\small\verb%ASM_REWRITE_RULE%}, which
does search recursively (to any depth) for matching subterms. The
general strategy for rewriting theorems is described under
{\small\verb%GEN_REWRITE_RULE%}.

\FAILURE
It does not fail when given arguments of the correct type. It does not
diverge.

\USES
This tactic is used when rewriting with the hypotheses of a theorem
(as well as a given list of theorems and {\small\verb%basic_rewrites%}), when more
than one pass is not required or would result in divergence.

\SEEALSO
ASM_REWRITE_RULE, FILTER_ASM_REWRITE_RULE,
FILTER_ONCE_ASM_REWRITE_RULE, GEN_REWRITE_RULE, ONCE_DEPTH_CONV,
ONCE_REWRITE_RULE, PURE_ASM_REWRITE_RULE, PURE_ONCE_ASM_REWRITE_RULE,
PURE_REWRITE_RULE, REWRITE_RULE.

\ENDDOC
\DOC{ONCE\_DEPTH\_CONV}

\TYPE {\small\verb%ONCE_DEPTH_CONV : (conv -> conv)%}\egroup

\SYNOPSIS
Applies a conversion once to the first suitable sub-term(s) encountered in
top-down order.

\DESCRIBE
{\small\verb%ONCE_DEPTH_CONV c tm%} applies the conversion {\small\verb%c%} once to the first subterm or
subterms encountered in a top-down `parallel' search of the term {\small\verb%tm%} for which
{\small\verb%c%} succeeds.  If the conversion {\small\verb%c%} fails on all subterms of {\small\verb%tm%}, the theorem
returned is {\small\verb%|- tm = tm%}.

\FAILURE 
Never fails.

\EXAMPLE
The following example shows how {\small\verb%ONCE_DEPTH_CONV%} applies a conversion to only
the first suitable subterm(s) found in a top-down search:
{\par\samepage\setseps\small\begin{verbatim}
   #ONCE_DEPTH_CONV BETA_CONV "(\x. (\y. y + x) 1) 2";;
   |- (\x. (\y. y + x)1)2 = (\y. y + 2)1
\end{verbatim}}
\noindent Here, there are two beta-redexes in the input term. One of these
occurs within the other, so {\small\verb%BETA_CONV%} is applied only to the outermost one.

Note that the supplied conversion is applied by {\small\verb%ONCE_DEPTH_CONV%} to all
independent subterms at which it succeeds.  That is, the conversion is applied
to every suitable subterm not contained in some other subterm for which the
conversions also succeeds, as illustrated by the following example:
{\par\samepage\setseps\small\begin{verbatim}
   #ONCE_DEPTH_CONV num_CONV "(\x. (\y. y + x) 1) 2";;
   |- (\x. (\y. y + x)1)2 = (\x. (\y. y + x)(SUC 0))(SUC 1)
\end{verbatim}}
\noindent Here {\small\verb%num_CONV%} is applied to both {\small\verb%1%} and {\small\verb%2%}, since neither term
occurs within a larger subterm for which the conversion {\small\verb%num_CONV%} succeeds.

\USES 
{\small\verb%ONCE_DEPTH_CONV%} is frequently used when there is only one subterm to which
the desired conversion applies. This can be much faster than using other
functions that attempt to apply a conversion to all subterms of a term (e.g.
{\small\verb%DEPTH_CONV%}).  If, for example, the current goal in a goal-directed proof
contains only one beta-redex, and one wishes to apply {\small\verb%BETA_CONV%} to it, then
the tactic
{\par\samepage\setseps\small\begin{verbatim}
   CONV_TAC (ONCE_DEPTH_CONV BETA_CONV)
\end{verbatim}}
\noindent may, depending on where the beta-redex occurs, be much faster than
{\par\samepage\setseps\small\begin{verbatim}
   CONV_TAC (TOP_DEPTH_CONV BETA_CONV)
\end{verbatim}}
{\small\verb%ONCE_DEPTH_CONV c%} may also be used when the supplied conversion {\small\verb%c%} never
fails, in which case using a conversion such as {\small\verb%DEPTH_CONV c%}, which
applies {\small\verb%c%} repeatedly would never terminate.

\SEEALSO
DEPTH_CONV, REDEPTH_CONV, TOP_DEPTH_CONV.

\ENDDOC
\DOC{ONCE\_REWRITE\_RULE}

\TYPE {\small\verb%ONCE_REWRITE_RULE : (thm list -> thm -> thm)%}\egroup

\SYNOPSIS
Rule for rewriting only once a theorem with {\small\verb%basic_rewrites%} and a
list of theorems.

\DESCRIBE
{\small\verb%ONCE_REWRITE_RULE%} searches for matching subterms and applies
rewrites once at each subterm, in the manner specified for
{\small\verb%ONCE_DEPTH_CONV%}. The rewrites which are used are obtained from the
given list of theorems and the set of tautologies stored in
{\small\verb%basic_rewrites%}. See {\small\verb%GEN_REWRITE_RULE%} for the general method of
using theorems to rewrite an object theorem.

\FAILURE
{\small\verb%ONCE_REWRITE_RULE%} does not fail; it does not diverge.

\USES
{\small\verb%ONCE_REWRITE_RULE%} can be used to rewrite a theorem when recursive
rewriting is not desired.

\SEEALSO
ASM_REWRITE_RULE, GEN_REWRITE_RULE, ONCE_ASM_REWRITE_RULE,
PURE_ONCE_REWRITE_RULE, PURE_REWRITE_RULE, REWRITE_RULE.

\ENDDOC
\DOC{ORELSEC}

\TYPE {\small\verb%$ORELSEC : (conv -> conv -> conv)%}\egroup

\SYNOPSIS
Apply the first of two conversions that succeeds.

\DESCRIBE 
{\small\verb%(c1 ORELSEC c2) "t"%} returns the result of applying the conversion {\small\verb%c1%} to
the term {\small\verb%"t"%} if this succeeds.  Otherwise {\small\verb%(c1 ORELSEC c2) "t"%} returns the
result of applying the conversion {\small\verb%c2%} to the term {\small\verb%"t"%}.

\FAILURE 
{\small\verb%(c1 ORELSEC c2) "t"%} fails both {\small\verb%c1%} and {\small\verb%c2%}  fail when applied to {\small\verb%"t"%}.

\SEEALSO
FIRST_CONV.

\ENDDOC
\DOC{OR\_EXISTS\_CONV}

\TYPE {\small\verb%OR_EXISTS_CONV : conv%}\egroup

\SYNOPSIS
Moves an existential quantification outwards through a disjunction.

\DESCRIBE
When applied to a term of the form {\small\verb%(?x.P) \/ (?x.Q)%}, the conversion
{\small\verb%OR_EXISTS_CONV%} returns the theorem:
{\par\samepage\setseps\small\begin{verbatim}
   |- (?x.P) \/ (?x.Q) = (?x. P \/ Q)
\end{verbatim}}
\FAILURE
Fails if applied to a term not of the form {\small\verb%(?x.P) \/ (?x.Q)%}.

\SEEALSO
EXISTS_OR_CONV, LEFT_OR_EXISTS_CONV, RIGHT_OR_EXISTS_CONV.

\ENDDOC

\DOC{OR\_FORALL\_CONV}

\TYPE {\small\verb%OR_FORALL_CONV : conv%}\egroup

\SYNOPSIS
Moves a universal quantification outwards through a disjunction.

\DESCRIBE
When applied to a term of the form {\small\verb%(!x.P) \/ (!x.Q)%}, where {\small\verb%x%} is free
in neither {\small\verb%P%} nor {\small\verb%Q%}, {\small\verb%OR_FORALL_CONV%} returns the theorem:
{\par\samepage\setseps\small\begin{verbatim}
   |- (!x. P) \/ (!x. Q) = (!x. P \/ Q)
\end{verbatim}}
\FAILURE 
{\small\verb%OR_FORALL_CONV%} fails if it is applied to a term not of the form 
{\small\verb%(!x.P) \/ (!x.Q)%}, or if it is applied to a term {\small\verb%(!x.P) \/ (!x.Q)%} 
in which the variable {\small\verb%x%} is free in either {\small\verb%P%} or {\small\verb%Q%}.

\SEEALSO
FORALL_OR_CONV, LEFT_OR_FORALL_CONV, RIGHT_OR_FORALL_CONV.

\ENDDOC



\DOC{PAIRED\_BETA\_CONV}

\TYPE {\small\verb%PAIRED_BETA_CONV : conv%}\egroup

\SYNOPSIS
Generalized beta conversion for tupled beta-redexes.

\DESCRIBE
The conversion {\small\verb%PAIRED_BETA_CONV%} implements beta-reduction for certain
applications of tupled lambda abstractions called `tupled beta-redexes`.
Tupled lambda abstractions have the form {\small\verb%"\<vs>.tm"%}, where {\small\verb%<vs>%} is an
arbitrarily-nested tuple of variables called a `varstruct'. For the purposes of
{\small\verb%PAIRED_BETA_CONV%}, the syntax of varstructs is given by:
{\par\samepage\setseps\small\begin{verbatim}
   <vs>  ::=   (v1,v2)  |  (<vs>,v)  |  (v,<vs>)  |  (<vs>,<vs>)
\end{verbatim}}
\noindent where {\small\verb%v%}, {\small\verb%v1%}, and {\small\verb%v2%} range over variables.  A tupled beta-redex
is an application of the form {\small\verb%"(\<vs>.tm) t"%}, where the term {\small\verb%"t"%} is a
nested tuple of values having the same structure as the varstruct {\small\verb%<vs>%}. For
example, the term:
{\par\samepage\setseps\small\begin{verbatim}
   "(\((a,b),(c,d)). a + b + c + d)  ((1,2),(3,4))"
\end{verbatim}}
\noindent is a tupled beta-redex, but the term:
{\par\samepage\setseps\small\begin{verbatim}
   "(\((a,b),(c,d)). a + b + c + d)  ((1,2),p)"
\end{verbatim}}
\noindent is not, since {\small\verb%p%} is not a pair of terms.

Given a tupled beta-redex {\small\verb%"(\<vs>.tm) t"%}, the conversion {\small\verb%PAIRED_BETA_CONV%}
performs generalized beta-reduction and returns the theorem 
{\par\samepage\setseps\small\begin{verbatim}
   |-  (\<vs>.tm) t = t[t1,...,tn/v1,...,vn]
\end{verbatim}}
\noindent where {\small\verb%ti%} is the subterm of the tuple {\small\verb%t%} that corresponds to
the variable {\small\verb%vi%} in the varstruct {\small\verb%<vs>%}. In the simplest case, the
varstruct {\small\verb%<vs>%} is flat, as in the term:
{\par\samepage\setseps\small\begin{verbatim}
   "(\(v1,...,vn).t) (t1,...,tn)"
\end{verbatim}}
\noindent When applied to a term of this form, {\small\verb%PAIRED_BETA_CONV%} returns:
{\par\samepage\setseps\small\begin{verbatim}
   |- (\(v1, ... ,vn).t) (t1, ... ,tn) = t[t1,...,tn/v1,...,vn]
\end{verbatim}}
\noindent As with ordinary beta-conversion, bound variables may be renamed to
prevent free variable capture.  That is, the term {\small\verb%t[t1,...,tn/v1,...,vn]%} in
this theorem is the result of substituting {\small\verb%ti%} for {\small\verb%vi%} in parallel in {\small\verb%t%},
with suitable renaming of variables to prevent free variables in {\small\verb%t1%}, ...,
{\small\verb%tn%} becoming bound in the result.

\FAILURE
{\small\verb%PAIRED_BETA_CONV tm%} fails if {\small\verb%tm%} is not a tupled beta-redex, as described
above.  Note that ordinary beta-redexes are specifically excluded:
{\small\verb%PAIRED_BETA_CONV%} fails when applied to {\small\verb%"(\v.t)u"%}.  For these beta-redexes,
use {\small\verb%BETA_CONV%}.

\EXAMPLE
The following is a typical use of the conversion:
{\par\samepage\setseps\small\begin{verbatim}
   #PAIRED_BETA_CONV "(\((a,b),(c,d)). a + b + c + d)  ((1,2),(3,4))";;
   |- (\((a,b),c,d). a + (b + (c + d)))((1,2),3,4) = 1 + (2 + (3 + 4))
\end{verbatim}}
\noindent Note that the term to which the tupled lambda abstraction
is applied must have the same structure as the varstruct.  For example,
the following succeeds:
{\par\samepage\setseps\small\begin{verbatim}
   #PAIRED_BETA_CONV "(\((a,b),p). a + b)  ((1,2),(3+5,4))";;
   |- (\((a,b),p). a + b)((1,2),3 + 5,4) = 1 + 2
\end{verbatim}}
\noindent but the following call to {\small\verb%PAIRED_BETA_CONV%} fails:
{\par\samepage\setseps\small\begin{verbatim}
   #PAIRED_BETA_CONV "(\((a,b),(c,d)). a + b + c + d)  ((1,2),p)";;
   evaluation failed     PAIRED_BETA_CONV
\end{verbatim}}
\noindent because {\small\verb%p%} is not a pair.

\SEEALSO
BETA_CONV, BETA_RULE, BETA_TAC, LIST_BETA_CONV, RIGHT_BETA, RIGHT_LIST_BETA.

\ENDDOC
\DOC{PART\_MATCH}

\TYPE {\small\verb%PART_MATCH : ((term -> term) -> thm -> term -> thm)%}\egroup

\SYNOPSIS
Instantiates a theorem by matching part of it to a term.

\DESCRIBE
When applied to a `selector' function of type {\small\verb%term -> term%}, a theorem and a
term:
{\par\samepage\setseps\small\begin{verbatim}
   PART_MATCH fn (A |- !x1...xn. t) tm
\end{verbatim}}
\noindent the function {\small\verb%PART_MATCH%} applies {\small\verb%fn%} to {\small\verb%t'%} (the result
of specializing universally quantified variables in the conclusion of
the theorem), and attempts to match the resulting term to the argument term
{\small\verb%tm%}. If it succeeds, the appropriately instantiated version of the theorem is
returned.

\FAILURE
Fails if the selector function {\small\verb%fn%} fails when applied to the instantiated
theorem, or if the match fails with the term it has provided.

\EXAMPLE
Suppose that we have the following theorem:
{\par\samepage\setseps\small\begin{verbatim}
   th = |- !x. x==>x
\end{verbatim}}
\noindent
then the following:
{\par\samepage\setseps\small\begin{verbatim}
   PART_MATCH (fst o dest_imp) th "T"
\end{verbatim}}
\noindent results in the theorem:
{\par\samepage\setseps\small\begin{verbatim}
   |- T ==> T
\end{verbatim}}
\noindent because the selector function picks the antecedent of the implication
(the inbuilt specialization gets rid of the universal quantifier), and matches
it to {\small\verb%T%}.

\SEEALSO
INST_TYPE, INST_TY_TERM, match.

\ENDDOC
\DOC{prove\_abs\_fn\_one\_one}

\TYPE {\small\verb%prove_abs_fn_one_one : (thm -> thm)%}\egroup

\SYNOPSIS
Proves that a type abstraction function is one-to-one (injective).

\DESCRIBE 
If {\small\verb%th%} is a theorem of the form returned by the function
{\small\verb%define_new_type_bijections%}:
{\par\samepage\setseps\small\begin{verbatim}
   |- (!a. abs(rep a) = a) /\ (!r. P r = (rep(abs r) = r))
\end{verbatim}}
\noindent then {\small\verb%prove_abs_fn_one_one th%} proves from this theorem that the
function {\small\verb%abs%} is one-to-one for values that satisfy {\small\verb%P%}, returning the
theorem:
{\par\samepage\setseps\small\begin{verbatim}
   |- !r r'. P r ==> P r' ==> ((abs r = abs r') = (r = r'))
\end{verbatim}}

\FAILURE
Fails if applied to a theorem not of the form shown above.

\SEEALSO
new_type_definition, define_new_type_bijections, prove_abs_fn_onto,
prove_rep_fn_one_one, prove_rep_fn_onto.

\ENDDOC
\DOC{prove\_abs\_fn\_onto}

\TYPE {\small\verb%prove_abs_fn_onto : (thm -> thm)%}\egroup

\SYNOPSIS
Proves that a type abstraction function is onto (surjective).

\DESCRIBE 
If {\small\verb%th%} is a theorem of the form returned by the function
{\small\verb%define_new_type_bijections%}:
{\par\samepage\setseps\small\begin{verbatim}
   |- (!a. abs(rep a) = a) /\ (!r. P r = (rep(abs r) = r))
\end{verbatim}}
\noindent then {\small\verb%prove_abs_fn_onto th%} proves from this theorem that the
function {\small\verb%abs%} is onto, returning the theorem:
{\par\samepage\setseps\small\begin{verbatim}
   |- !a. ?r. (a = abs r) /\ P r
\end{verbatim}}
\FAILURE
Fails if applied to a theorem not of the form shown above.

\SEEALSO
new_type_definition, define_new_type_bijections, prove_abs_fn_one_one,
prove_rep_fn_one_one, prove_rep_fn_onto.

\ENDDOC
\DOC{prove\_cases\_thm}

\TYPE {\small\verb%prove_cases_thm : (thm -> thm)%}\egroup

\SYNOPSIS
Prove a structural cases theorem for an automatically-defined concrete type.

\DESCRIBE 
{\small\verb%prove_cases_thm%} takes as its argument a structural induction theorem, in the
form returned by {\small\verb%prove_induction_thm%} for an automatically-defined concrete
type.  When applied to such a theorem, {\small\verb%prove_cases_thm%} automatically proves
and returns a theorem which states that every value the concrete type in
question is denoted by the value returned by some constructor of the type.

\FAILURE
Fails if the argument is not a theorem of the form returned by
{\small\verb%prove_induction_thm%}

\EXAMPLE
Given the following structural induction theorem for labelled binary trees:
{\par\samepage\setseps\small\begin{verbatim}
   |- !P. (!x. P(LEAF x)) /\ (!b1 b2. P b1 /\ P b2 ==> P(NODE b1 b2)) ==>
          (!b. P b)
\end{verbatim}}
\noindent {\small\verb%prove_cases_thm%} proves and returns the theorem:
{\par\samepage\setseps\small\begin{verbatim}
   |- !b. (?x. b = LEAF x) \/ (?b1 b2. b = NODE b1 b2)
\end{verbatim}}
\noindent This states that every labelled binary tree {\small\verb%b%} is either a leaf node
with a label {\small\verb%x%} or a tree with two subtrees {\small\verb%b1%} and {\small\verb%b2%}. 

\SEEALSO 
define_type, INDUCT_THEN, new_recursive_definition,
prove_constructors_distinct, prove_constructors_one_one, prove_induction_thm,
prove_rec_fn_exists.


\ENDDOC
\DOC{prove\_constructors\_distinct}

\TYPE {\small\verb%prove_constructors_distinct : (thm -> thm)%}\egroup

\SYNOPSIS
Prove that the constructors of an automatically-defined concrete type yield
distinct values.

\DESCRIBE 
{\small\verb%prove_constructors_distinct%} takes as its argument a primitive recursion
theorem, in the form returned by {\small\verb%define_type%} for an automatically-defined
concrete type.  When applied to such a theorem, {\small\verb%prove_constructors_distinct%}
automatically proves and returns a theorem which states that distinct
constructors of the concrete type in question yield distinct values of this
type.

\FAILURE
Fails if the argument is not a theorem of the form returned by {\small\verb%define_type%},
or if the concrete type in question has only one constructor.

\EXAMPLE
Given the following primitive recursion theorem for labelled binary trees:
{\par\samepage\setseps\small\begin{verbatim}
   |- !f0 f1.
        ?! fn.
        (!x. fn(LEAF x) = f0 x) /\
        (!b1 b2. fn(NODE b1 b2) = f1(fn b1)(fn b2)b1 b2)
\end{verbatim}}
\noindent {\small\verb%prove_constructors_distinct%} proves and returns the theorem:
{\par\samepage\setseps\small\begin{verbatim}
   |- !x b1 b2. ~(LEAF x = NODE b1 b2)
\end{verbatim}}
\noindent This states that leaf nodes are different than internal nodes.  When
the concrete type in question has more than two constructors, the resulting
theorem is just conjunction of inequalities of this kind.

\SEEALSO 
define_type, INDUCT_THEN, new_recursive_definition, prove_cases_thm,
prove_constructors_one_one, prove_induction_thm, prove_rec_fn_exists.


\ENDDOC
\DOC{prove\_constructors\_one\_one}

\TYPE {\small\verb%prove_constructors_one_one : (thm -> thm)%}\egroup

\SYNOPSIS
Prove that the constructors of an automatically-defined concrete type are
injective.

\DESCRIBE 
{\small\verb%prove_constructors_one_one%} takes as its argument a primitive recursion
theorem, in the form returned by {\small\verb%define_type%} for an automatically-defined
concrete type.  When applied to such a theorem, {\small\verb%prove_constructors_one_one%}
automatically proves and returns a theorem which states that the constructors
of the concrete type in question are injective (one-to-one).  The resulting
theorem covers only those constructors that take arguments (i.e. that are not
just constant values).

\FAILURE
Fails if the argument is not a theorem of the form returned by {\small\verb%define_type%},
or if all the constructors of the concrete type in question are simply
constants of that type.

\EXAMPLE
Given the following primitive recursion theorem for labelled binary trees:
{\par\samepage\setseps\small\begin{verbatim}
   |- !f0 f1.
        ?! fn.
        (!x. fn(LEAF x) = f0 x) /\
        (!b1 b2. fn(NODE b1 b2) = f1(fn b1)(fn b2)b1 b2)
\end{verbatim}}
\noindent {\small\verb%prove_constructors_one_one%} proves and returns the theorem:
{\par\samepage\setseps\small\begin{verbatim}
   |- (!x x'. (LEAF x = LEAF x') = (x = x')) /\
      (!b1 b2 b1' b2'.
        (NODE b1 b2 = NODE b1' b2') = (b1 = b1') /\ (b2 = b2'))
\end{verbatim}}
\noindent This states that the constructors {\small\verb%LEAF%} and {\small\verb%NODE%} are both
injective.

\SEEALSO 
define_type, INDUCT_THEN, new_recursive_definition, prove_cases_thm,
prove_constructors_distinct, prove_induction_thm, prove_rec_fn_exists.


\ENDDOC
\DOC{PROVE\_HYP}

\TYPE {\small\verb%PROVE_HYP : (thm -> thm -> thm)%}\egroup

\SYNOPSIS
Eliminates a provable assumption from a theorem.

\DESCRIBE
When applied to two theorems, {\small\verb%PROVE_HYP%} gives a new theorem with the
conclusion of the second and the union of the assumption list minus the
conclusion of the first theorem.
{\par\samepage\setseps\small\begin{verbatim}
     A1 |- t1     A2 |- t2
   ------------------------  PROVE_HYP
    (A1 u A2) - {t1} |- t2
\end{verbatim}}
\FAILURE
Never fails.

\COMMENTS
This is the Cut rule. It is not necessary for the conclusion of the first
theorem to be the same as an assumption of the second, but {\small\verb%PROVE_HYP%} is
otherwise of doubtful value.

\SEEALSO
DISCH, MP, UNDISCH.

\ENDDOC
\DOC{prove\_induction\_thm}

\TYPE {\small\verb%prove_induction_thm : (thm -> thm)%}\egroup

\SYNOPSIS
Derive structural induction for an automatically-defined concrete type.

\DESCRIBE 
{\small\verb%prove_induction_thm%} takes as its argument a primitive recursion theorem, in
the form returned by {\small\verb%define_type%} for an automatically-defined concrete type.
When applied to such a theorem, {\small\verb%prove_induction_thm%} automatically proves and
returns a theorem that states a structural induction principle for the concrete
type described by the argument theorem. The theorem returned by
{\small\verb%prove_induction_thm%} is in a form suitable for use with the general structural
induction tactic {\small\verb%INDUCT_THEN%}.

\FAILURE
Fails if the argument is not a theorem of the form returned by {\small\verb%define_type%}.

\EXAMPLE
Given the following primitive recursion theorem for labelled binary trees:
{\par\samepage\setseps\small\begin{verbatim}
   |- !f0 f1.
        ?! fn.
        (!x. fn(LEAF x) = f0 x) /\
        (!b1 b2. fn(NODE b1 b2) = f1(fn b1)(fn b2)b1 b2)
\end{verbatim}}
\noindent {\small\verb%prove_induction_thm%} proves and returns the theorem:
{\par\samepage\setseps\small\begin{verbatim}
   |- !P. (!x. P(LEAF x)) /\ (!b1 b2. P b1 /\ P b2 ==> P(NODE b1 b2)) ==>
          (!b. P b)
\end{verbatim}}
\noindent This theorem states the principle of structural induction on labelled
binary trees: if a predicate {\small\verb%P%} is true of all leaf nodes, and if whenever it
is true of two subtrees {\small\verb%b1%} and {\small\verb%b2%} it is also true of the tree {\small\verb%NODE b1 b2%},
then {\small\verb%P%} is true of all labelled binary trees.

\SEEALSO
define_type, INDUCT_THEN, new_recursive_definition, prove_cases_thm,
prove_constructors_distinct, prove_constructors_one_one, prove_rec_fn_exists.


\ENDDOC
\DOC{prove\_rec\_fn\_exists}

\TYPE {\small\verb%prove_rec_fn_exists : (thm -> term -> thm)%}\egroup

\SYNOPSIS
Prove the existence of a primitive recursive function over a concrete recursive
type.

\DESCRIBE 
{\small\verb%prove_rec_fn_exists%} is a version of {\small\verb%new_recursive_definition%} which proves
only that the required function exists; it does not make a constant
specification.  The first argument is a theorem of the form returned by
{\small\verb%define_type%}, and the second is a user-supplied primitive recursive function
definition.  The theorem which is returned asserts the existence of the
recursively-defined function in question (if it is primitive recursive over the
type characterized by the theorem given as the first argument).  See the entry
for {\small\verb%new_recursive_definition%} for details.

\FAILURE
As for {\small\verb%new_recursive_definition%}.

\EXAMPLE
Given the following primitive recursion theorem for labelled binary trees:
{\par\samepage\setseps\small\begin{verbatim}
   |- !f0 f1.
        ?! fn.
        (!x. fn(LEAF x) = f0 x) /\
        (!b1 b2. fn(NODE b1 b2) = f1(fn b1)(fn b2)b1 b2)
\end{verbatim}}
\noindent {\small\verb%prove_rec_fn_exists%} can be used to prove the existence of primitive
recursive functions over binary trees.  Suppose the value of {\small\verb%th%} is this
theorem.  Then the existence of a recursive function {\small\verb%Leaves%}, which computes
the number of leaves in a binary tree, can be proved as shown below:
{\par\samepage\setseps\small\begin{verbatim}
   #prove_rec_fn_exists th
   #  "(Leaves (LEAF (x:*)) = 1) /\
   #   (Leaves (NODE t1 t2) = (Leaves t1) + (Leaves t2))";;
   |- ?Leaves. (!x. Leaves(LEAF x) = 1) /\
               (!t1 t2. Leaves(NODE t1 t2) = (Leaves t1) + (Leaves t2))
\end{verbatim}}
\noindent The result should be compared with the example given under
{\small\verb%new_recursive_definition%}.


\SEEALSO
define_type, new_recursive_definition.

\ENDDOC
\DOC{prove\_rep\_fn\_one\_one}

\TYPE {\small\verb%prove_rep_fn_one_one : (thm -> thm)%}\egroup

\SYNOPSIS
Proves that a type representation function is one-to-one (injective).

\DESCRIBE 
If {\small\verb%th%} is a theorem of the form returned by the function
{\small\verb%define_new_type_bijections%}:
{\par\samepage\setseps\small\begin{verbatim}
   |- (!a. abs(rep a) = a) /\ (!r. P r = (rep(abs r) = r))
\end{verbatim}}
\noindent then {\small\verb%prove_rep_fn_one_one th%} proves from this theorem that the
function {\small\verb%rep%} is one-to-one, returning the theorem:
{\par\samepage\setseps\small\begin{verbatim}
   |- !a a'. (rep a = rep a') = (a = a')
\end{verbatim}}
\FAILURE
Fails if applied to a theorem not of the form shown above.

\SEEALSO
new_type_definition, define_new_type_bijections, prove_abs_fn_one_one,
prove_abs_fn_onto, prove_rep_fn_onto.

\ENDDOC
\DOC{prove\_rep\_fn\_onto}

\TYPE {\small\verb%prove_rep_fn_onto : (thm -> thm)%}\egroup

\SYNOPSIS
Proves that a type representation function is onto (surjective).

\DESCRIBE 
If {\small\verb%th%} is a theorem of the form returned by the function
{\small\verb%define_new_type_bijections%}:
{\par\samepage\setseps\small\begin{verbatim}
   |- (!a. abs(rep a) = a) /\ (!r. P r = (rep(abs r) = r))
\end{verbatim}}
\noindent then {\small\verb%prove_rep_fn_onto th%} proves from this theorem that the
function {\small\verb%rep%} is onto the set of values that satisfy {\small\verb%P%}, returning the
theorem:
{\par\samepage\setseps\small\begin{verbatim}
   |- !r. P r = (?a. r = rep a)
\end{verbatim}}
\FAILURE
Fails if applied to a theorem not of the form shown above.

\SEEALSO
new_type_definition, define_new_type_bijections, prove_abs_fn_one_one,
prove_abs_fn_onto, prove_rep_fn_one_one.

\ENDDOC
\DOC{PURE\_ASM\_REWRITE\_RULE}

\TYPE {\small\verb%PURE_ASM_REWRITE_RULE : (thm list -> thm -> thm)%}\egroup

\SYNOPSIS
Derived rule for rewriting a theorem with its hypotheses and a given
list of theorems.

\DESCRIBE
The list of theorems supplied by the user and the assumptions of the
object theorem are used to generate a set of rewrites, without adding
implicitly the basic tautologies stored under {\small\verb%basic_rewrites%}.
The rule searches for matching subterms in a top-down recursive
fashion, stopping only when no more rewrites apply. For a general
description of rewriting strategies see {\small\verb%GEN_REWRITE_RULE%}.

\FAILURE
Rewriting with {\small\verb%PURE_ASM_REWRITE_RULE%} does not result in failure. It
may diverge, in which case {\small\verb%PURE_ONCE_ASM_REWRITE_RULE%} may be used.

\SEEALSO
ASM_REWRITE_RULE, GEN_REWRITE_RULE, ONCE_REWRITE_RULE,
PURE_REWRITE_RULE, PURE_ONCE_ASM_REWRITE_RULE.

\ENDDOC
\DOC{PURE\_ONCE\_ASM\_REWRITE\_RULE}

\TYPE {\small\verb%PURE_ONCE_ASM_REWRITE_RULE : (thm list -> thm -> thm)%}\egroup

\SYNOPSIS
Derived rule for rewriting a theorem once with its hypotheses and a
given list of theorems.

\DESCRIBE
{\small\verb%PURE_ONCE_ASM_REWRITE_RULE%} excludes the basic tautologies in
{\small\verb%basic_rewrites%} from the theorems used for rewriting. It searches for
matching subterms once only, without recursing over already rewritten
subterms. For a general introduction to rewriting tools see
{\small\verb%GEN_REWRITE_RULE%}.

\FAILURE
{\small\verb%PURE_ONCE_ASM_REWRITE_RULE%} does not fail and does not diverge.

\SEEALSO
ASM_REWRITE_RULE, GEN_REWRITE_RULE, ONCE_ASM_REWRITE_RULE,
ONCE_REWRITE_RULE, PURE_ASM_REWRITE_RULE, PURE_REWRITE_RULE,
REWRITE_RULE.

\ENDDOC
\DOC{PURE\_ONCE\_REWRITE\_RULE}

\TYPE {\small\verb%PURE_ONCE_REWRITE_RULE : (thm list -> thm -> thm)%}\egroup

\SYNOPSIS
Derived rule for rewriting a theorem once with a given list of
theorems.

\DESCRIBE
{\small\verb%PURE_ONCE_REWRITE_RULE%} generates rewrites from the list of theorems
supplied by the user, without including the tautologies given in
{\small\verb%basic_rewrites%}. The applicable rewrites are employeded once, without
entailing in a recursive search for matches over the theorem.

See {\small\verb%GEN_REWRITE_RULE%} for more details about rewriting strategies in
HOL.

\FAILURE
This rule does not fail, and it does not diverge.

\SEEALSO
ASM_REWRITE_RULE, GEN_REWRITE_RULE, ONCE_DEPTH_CONV,
ONCE_REWRITE_RULE, PURE_REWRITE_RULE, REWRITE_RULE.

\ENDDOC
\DOC{PURE\_REWRITE\_RULE}

\TYPE {\small\verb%PURE_REWRITE_RULE : (thm list -> thm -> thm)%}\egroup

\SYNOPSIS
Rule for rewriting a theorem with a given list of (equational)
theorems.

\DESCRIBE

This rule provides a method for rewriting a theorem with the theorems
given, and excluding simplification with tautologies in
{\small\verb%basic_rewrites%}. Matching subterms are found recursively starting
from the term in the conclusion part of the theorem, until no more
matches are found. For more details on rewriting see
{\small\verb%GEN_REWRITE_RULE%}.

\USES
{\small\verb%PURE_REWRITE_RULE%} is useful when the simplifications that arise by
rewriting a theorem with {\small\verb%basic_rewrites%} are not wanted.

\FAILURE
Does not fail. May result in divergence, in which case
{\small\verb%PURE_ONCE_REWRITE_RULE%} can be used.

\SEEALSO
ASM_REWRITE_RULE, GEN_REWRITE_RULE, ONCE_REWRITE_RULE,
PURE_ASM_REWRITE_RULE, PURE_ONCE_ASM_REWRITE_RULE,
PURE_ONCE_REWRITE_RULE, REWRITE_RULE.

\ENDDOC
\DOC{RAND\_CONV}

\TYPE {\small\verb%RAND_CONV : (conv -> conv)%}\egroup

\SYNOPSIS
Apply a conversion to the operand of an application.

\DESCRIBE
If {\small\verb%c%} is a conversion that maps a term {\small\verb%"t2"%} to the theorem {\small\verb%|- t2 = t2'%}, 
then the conversion {\small\verb%RAND_CONV c%} maps applications of the form {\small\verb%"t1 t2"%} to
theorems of the form:
{\par\samepage\setseps\small\begin{verbatim}
   |- (t1 t2) = (t1 t2') 
\end{verbatim}}
\noindent That is, {\small\verb%RAND_CONV c "t1 t2"%} applies {\small\verb%c%} to the operand of the
application {\small\verb%"t1 t2"%}.

\FAILURE 
{\small\verb%RAND_CONV c tm%} fails if {\small\verb%tm%} is not an application or if {\small\verb%tm%} has the form
{\small\verb%"t1 t2"%} but the conversion {\small\verb%c%} fails when applied to the term {\small\verb%t2%}. The
function returned by {\small\verb%RAND_CONV c%} may also fail if the ML function
{\small\verb%c:term->thm%} is not, in fact, a conversion (i.e. a function that maps a term
{\small\verb%t%} to a theorem {\small\verb%|- t = t'%}).

\EXAMPLE
{\par\samepage\setseps\small\begin{verbatim}
#RAND_CONV num_CONV "SUC 2";; 
|- SUC 2 = SUC(SUC 1) 
\end{verbatim}}
\SEEALSO
ABS_CONV, RATOR_CONV, SUB_CONV.

\ENDDOC
\DOC{RATOR\_CONV}

\TYPE {\small\verb%RATOR_CONV : (conv -> conv)%}\egroup

\SYNOPSIS
Apply a conversion to the operator of an application.

\DESCRIBE
If {\small\verb%c%} is a conversion that maps a term {\small\verb%"t1"%} to the theorem {\small\verb%|- t1 = t1'%},
then the conversion {\small\verb%RATOR_CONV c%} maps applications of the form {\small\verb%"t1 t2"%} to
theorems of the form: 
{\par\samepage\setseps\small\begin{verbatim}
   |- (t1 t2) = (t1' t2)
\end{verbatim}}
\noindent That is, {\small\verb%RATOR_CONV c "t1 t2"%} applies {\small\verb%c%} to the operand of the 
application {\small\verb%"t1 t2"%}.

\FAILURE
{\small\verb%RATOR_CONV c tm%} fails if {\small\verb%tm%} is not an application or if {\small\verb%tm%} has the form
{\small\verb%"t1 t2"%} but the conversion {\small\verb%c%} fails when applied to the term {\small\verb%t1%}. The
function returned by {\small\verb%RATOR_CONV c%} may also fail if the ML function
{\small\verb%c:term->thm%} is not, in fact, a conversion (i.e. a function that maps a term
{\small\verb%t%} to a theorem {\small\verb%|- t = t'%}).

\EXAMPLE
{\par\samepage\setseps\small\begin{verbatim}
#RATOR_CONV BETA_CONV "(\x y. x + y) 1 2";;
|- (\x y. x + y)1 2 = (\y. 1 + y)2
\end{verbatim}}
\SEEALSO
ABS_CONV, RAND_CONV, SUB_CONV.

\ENDDOC
\DOC{REDEPTH\_CONV}

\TYPE {\small\verb%REDEPTH_CONV : (conv -> conv)%}\egroup

\SYNOPSIS 
Applies a conversion repeatedly to all the sub-terms of a term, in bottom-up
order, and recursively retraverses each subterm at which application of 
the conversion succeeds.

\DESCRIBE 
{\small\verb%REDEPTH_CONV c tm%} applies the conversion {\small\verb%c%} repeatedly to all subterms of
the term {\small\verb%tm%} and recursively applies {\small\verb%REDEPTH_CONV c%} to each subterm at which
{\small\verb%c%} succeeds, until there is no subterm remaining for which application of {\small\verb%c%}
succeeds.

More precisely, {\small\verb%REDEPTH_CONV c tm%} repeatedly applies the conversion {\small\verb%c%} to
all the subterms of the term {\small\verb%tm%}, including the term {\small\verb%tm%} itself. The supplied
conversion {\small\verb%c%} is applied to the subterms of {\small\verb%tm%} in bottom-up order and is
applied repeatedly (zero or more times, as is done by {\small\verb%REPEATC%}) to each
subterm until it fails.  If {\small\verb%c%} is successfuly applied at least once to a
subterm, {\small\verb%t%} say, then the term into which {\small\verb%t%} is transformed is retraversed by
applying {\small\verb%REDEPTH_CONV c%} to it.

\FAILURE 
{\small\verb%REDEPTH_CONV c tm%} never fails but can diverge if the conversion {\small\verb%c%} can be
applied repeatedly to some subterm of {\small\verb%tm%} without failing.

\EXAMPLE
The following example shows how {\small\verb%REDEPTH_CONV%} retraverses subterms:
{\par\samepage\setseps\small\begin{verbatim}
   #REDEPTH_CONV BETA_CONV "(\f x. (f x) + 1) (\y.y) 2";;
   |- (\f x. (f x) + 1)(\y. y)2 = 2 + 1
\end{verbatim}}
\noindent Here, {\small\verb%BETA_CONV%} is first applied successfully to the (beta-redex)
subterm:
{\par\samepage\setseps\small\begin{verbatim}
   "(\f x. (f x) + 1) (\y.y)"
\end{verbatim}}
\noindent This application reduces this subterm to:
{\par\samepage\setseps\small\begin{verbatim}
   "(\x. ((\y.y) x) + 1)"
\end{verbatim}}
\noindent {\small\verb%REDEPTH_CONV BETA_CONV%} is then recursively applied to this
transformed subterm, eventually reducing it to {\small\verb%"(\x. x + 1)"%}. Finally, a
beta-reduction of the top-level term, now the simplified beta-redex 
{\small\verb%"(\x. x + 1) 2"%}, produces {\small\verb%"2 + 1"%}.

\SEEALSO
DEPTH_CONV, ONCE_DEPTH_CONV, TOP_DEPTH_CONV.

\ENDDOC
\DOC{REFL}

\TYPE {\small\verb%REFL : conv%}\egroup

\SYNOPSIS
Primitive inference rule for reflexivity of equality.

\DESCRIBE
{\small\verb%REFL%} maps any term {\small\verb%"t"%} to the corresponding theorem {\small\verb%|- t = t%}.

\FAILURE
Never fails.

\SEEALSO
ALL_CONV, REFL_TAC.

\ENDDOC

\DOC{REPEATC}

\TYPE {\small\verb%REPEATC : (conv -> conv)%}\egroup

\SYNOPSIS
Repeatedly apply a conversion (zero or more times) until it fails.

\DESCRIBE 
If {\small\verb%c%} is a conversion effects a transformation of a term {\small\verb%t%} to a term {\small\verb%t'%},
that is if {\small\verb%c%} maps {\small\verb%t%} to the theorem {\small\verb%|- t = t`%}, then {\small\verb%REPEATC c%} is the
conversion that repeats this transformation as often as possible.  More
exactly, if {\small\verb%c%} maps the term {\small\verb%"ti"%} to {\small\verb%|- ti=t(i+1)%} for {\small\verb%i%} from {\small\verb%1%} to {\small\verb%n%},
but fails when applied to the {\small\verb%n+1%}th term {\small\verb%"t(n+1)"%}, then {\small\verb%REPEATC c "t1"%}
returns {\small\verb%|- t1 = t(n+1)%}. And if {\small\verb%c "t"%} fails, them {\small\verb%REPEATC c "t"%} returns
{\small\verb%|- t = t%}.

\FAILURE 
Never fails, but can diverge if the supplied conversion never fails.

\ENDDOC
\DOC{RES\_CANON}

\TYPE {\small\verb%RES_CANON : (thm -> thm list)%}\egroup

\SYNOPSIS 
Put an implication into canonical form for resolution.

\DESCRIBE 
All the HOL resolution tactics (e.g. {\small\verb%IMP_RES_TAC%}) work by using modus ponens
to draw consequences from an implicative theorem and the assumptions of the
goal.  Some of these tactics derive this implication from a theorem supplied
explicitly the user (or otherwise from `outside' the goal) and some obtain it
from the assumptions of the goal itself.  But in either case, the supplied
theorem or assumption is first transformed into a list of implications in
`canonical' form by the function {\small\verb%RES_CANON%}.

The theorem argument to {\small\verb%RES_CANON%} should be either be an implication (which
can be universally quantified) or a theorem from which an implication can be
derived using the transformation rules discussed below.  Given such a theorem,
{\small\verb%RES_CANON%} returns a list of implications in canonical form.  It is the
implications in this resulting list that are used by the various resolution
tactics to infer consquences from the assumptions of a goal.

The transformations done by {\small\verb%RES_CANON th%} to the theorem {\small\verb%th%} are as follows.
First, if {\small\verb%th%} is a negation {\small\verb%A |- ~t%}, this is converted to the implication
{\small\verb%A |- t ==> F%}.  The following inference rules are then applied 
repeatedly, until no further rule applies. Conjunctions are split into their 
components and equivalence (boolean equality) is split into implication in 
both directions:
{\par\samepage\setseps\small\begin{verbatim}
       A |- t1 /\ t2                          A |- t1 = t2
   ======================           ==================================
     A |- t1    A |- t2               A |- t1 ==> t    A |- t2 ==> t
\end{verbatim}}
\noindent Conjunctive antecedents are transformed by:
{\par\samepage\setseps\small\begin{verbatim}
                 A |- (t1 /\ t2) ==> t  
   =====================================================
     A |- t1 ==> (t2 ==> t)     A |- t2 ==> (t1 ==> t)
\end{verbatim}}
\noindent and disjunctive antecedents by:
{\par\samepage\setseps\small\begin{verbatim}
         A |- (t1 \/ t2) ==> t
   ==================================
     A |- t1 ==> t    A |- t2 ==> t
\end{verbatim}}
\noindent The scope of universal quantifiers is restricted, if possible:
{\par\samepage\setseps\small\begin{verbatim}
      A |- !x. t1 ==> t2   
   =======================          (if x is not free in t1)
      A |- t1 ==> !x. t2        
\end{verbatim}}
\noindent and existentially-quantified antecedents are eliminated by:
{\par\samepage\setseps\small\begin{verbatim}
        A |- (?x. t1) ==> t2
    =============================   (x' chosen so as not to be free in t2)
      A |- !x'. t1[x'/x] ==> t2 
\end{verbatim}}

\noindent Finally, when no further applications of the above rules are
posssible, and the theorem is an implication:
{\par\samepage\setseps\small\begin{verbatim}
   A |- !x1...xn. t1 ==> t2
\end{verbatim}}
\noindent then the theorem {\small\verb%A u {t1} |- t2%} is transformed by a recursive
application of {\small\verb%RES_CANON%} to get a list of theorems:
{\par\samepage\setseps\small\begin{verbatim}
   [A u {t1} |- t21 ; ... ; A u {t1} |- t2n]
\end{verbatim}}
\noindent and the result of discharging {\small\verb%t1%} from these theorems:
{\par\samepage\setseps\small\begin{verbatim}
   [A |- !x1...xn. t1 ==> t21 ; ... ; A |- !x1...xn. t1 ==> t2n]
\end{verbatim}}
\noindent is returned. That is, the transformation rules are recursively
applied to the conclusions of all implications.

\FAILURE
{\small\verb%RES_CANON th%} fails if no implication(s) can be derived from {\small\verb%th%} using the
transformation rules shown above.

\EXAMPLE
The uniqueness of the remainder {\small\verb%k MOD n%} is expressed in HOL by the built-in
theorem {\small\verb%MOD_UNIQUE%}:
{\par\samepage\setseps\small\begin{verbatim}
   |- !n k r. (?q. (k = (q * n) + r) /\ r < n) ==> (k MOD n = r)
\end{verbatim}}
\noindent For this theorem, the canonical list of implications returned by
{\small\verb%RES_CANON%} is as follows:
{\par\samepage\setseps\small\begin{verbatim}
   #RES_CANON MOD_UNIQUE;;
   [|- !k q n r. (k = (q * n) + r) ==> r < n ==> (k MOD n = r);
    |- !r n. r < n ==> (!k q. (k = (q * n) + r) ==> (k MOD n = r))]
   : thm list
\end{verbatim}}
\noindent The existentially-quantified, conjunctive, antecedent has given rise
to two implications, and the scope of universal quantifiers has been restricted
to the conclusions of the resulting implications wherever possible.

\USES
The primary use of {\small\verb%RES_CANON%} is for the (internal) pre-processing phase of
the built-in resolution tactics {\small\verb%IMP_RES_TAC%}, {\small\verb%IMP_RES_THEN%}, {\small\verb%RES_TAC%}, and
{\small\verb%RES_THEN%}.  But the function {\small\verb%RES_CANON%} is also made available at top-level
so that users can call it to see the actual form of the implications used for
resolution in any particular case.  

\SEEALSO
IMP_RES_TAC, IMP_RES_THEN, RES_TAC, RES_THEN.

\ENDDOC

\DOC{REWRITE\_CONV}

\TYPE {\small\verb%REWRITE_CONV : (thm -> conv)%}\egroup

\SYNOPSIS
Use an instance of a given equation to rewrite a term.

\DESCRIBE
{\small\verb%REWRITE_CONV%} is one of the basic building blocks for the implementation of
rewriting in the HOL system. In particular, the term replacement or rewriting
done by all the built-in rewriting rules and tactics is ultimately done by
applications of {\small\verb%REWRITE_CONV%} to appropriate subterms.  The description given
here for {\small\verb%REWRITE_CONV%} may therefore be taken as a specification of the atomic
action of replacing equals by equals that is used in all these higher level
rewriting tools.

The first argument to {\small\verb%REWRITE_CONV%} is expected to be an equational theorem
which is to be used as a left-to-right rewrite rule.  The general form of this
theorem is:
{\par\samepage\setseps\small\begin{verbatim}
   A |- t[x1,...,xn] = u[x1,...,xn]
\end{verbatim}}
\noindent where {\small\verb%x1%}, ..., {\small\verb%xn%} are all the variables that occur free in the
left-hand side of the conclusion of the theorem but do not occur free in the
assumptions. Any of these variables may also be universally quantified at the
outermost level of the equation, as for example in:
{\par\samepage\setseps\small\begin{verbatim}
   A |- !x1...xn. t[x1,...,xn] = u[x1,...,xn]
\end{verbatim}}
\noindent Note that {\small\verb%REWRITE_CONV%} will also work, but will give a generally
undesirable result (see below), if the right-hand side of the equation contains
free variables that do not also occur free on the left-hand side, as for
example in:
{\par\samepage\setseps\small\begin{verbatim}
   A |- t[x1,...,xn] = u[x1,...,xn,y1,...,ym] 
\end{verbatim}}
\noindent where the variables {\small\verb%y1%}, ..., {\small\verb%ym%} do not occur free in
{\small\verb%t[x1,...,xn]%}.


If {\small\verb%th%} is an equational theorem of the kind shown above, then 
{\small\verb%REWRITE_CONV th%} returns a conversion that maps terms of the form 
{\small\verb%t[e1,...,en/x1,...,xn]%}, in which the terms {\small\verb%e1%}, ..., {\small\verb%en%} are free for 
{\small\verb%x1%}, ..., {\small\verb%xn%} in {\small\verb%t%}, to theorems of the form:
{\par\samepage\setseps\small\begin{verbatim}
   A |- t[e1,...,en/x1,...,xn] = u[e1,...,en/x1,...,xn]
\end{verbatim}}
\noindent That is, {\small\verb%REWRITE_CONV th tm%} attempts to match the left-hand side of
the rewrite rule {\small\verb%th%} to the term {\small\verb%tm%}.  If such a match is possible, then
{\small\verb%REWRITE_CONV%} returns the corresponding substitution instance of {\small\verb%th%}.

If {\small\verb%REWRITE_CONV%} is given a theorem {\small\verb%th%}:
{\par\samepage\setseps\small\begin{verbatim}
   A |- t[x1,...,xn] = u[x1,...,xn,y1,...,ym] 
\end{verbatim}}
\noindent where the variables {\small\verb%y1%}, ..., {\small\verb%ym%} do not occur free in the
left-hand side, then the result of applying the conversion {\small\verb%REWRITE_CONV th%} to
a term {\small\verb%t[e1,...,en/x1,...,xn]%} will be:
{\par\samepage\setseps\small\begin{verbatim}
   A |- t[e1,...,en/x1,...,xn] = u[e1,...,en,v1,...,vm/x1,...,xn,y1,...,ym]
\end{verbatim}}
\noindent where {\small\verb%v1%}, ..., {\small\verb%vm%} are variables chosen so as to be free nowhere
in {\small\verb%th%} or in the input term.  The user has no control over the choice of the
variables {\small\verb%v1%}, ..., {\small\verb%vm%}, and the variables actually chosen may well be
inconvenient for other purposes.  This situation is, however, relatively rare;
in most equations the free variables on the right-hand side are a subset of the
free variables on the left-hand side.

In addition to doing substitution for free variables in the supplied equational
theorem (or `rewrite rule'), {\small\verb%REWRITE_CONV th tm%} also does type instantiation,
if this is necessary in order to match the left-hand side of the given rewrite 
rule {\small\verb%th%} to the term argument {\small\verb%tm%}.  If, for example, {\small\verb%th%} is the theorem:
{\par\samepage\setseps\small\begin{verbatim}
   A |- t[x1,...,xn] = u[x1,...,xn]
\end{verbatim}}

\noindent and the input term {\small\verb%tm%} is (a substitution instance of) an instance
of {\small\verb%t[x1,...,xn]%} in which the types {\small\verb%ty1%}, ..., {\small\verb%tyi%} are substituted for the
type variables {\small\verb%vty1%}, ..., {\small\verb%vtyi%}, that is if:
{\par\samepage\setseps\small\begin{verbatim}
   tm = t[ty1,...,tyn/vty1,...,vtyn][e1,...,en/x1,...,xn]
\end{verbatim}}
\noindent then {\small\verb%REWRITE_CONV th tm%} returns:
{\par\samepage\setseps\small\begin{verbatim}
   A |- (t = u)[ty1,...,tyn/vty1,...,vtyn][e1,...,en/x1,...,xn]
\end{verbatim}}
\noindent Note that, in this case, the type variables {\small\verb%vty1%}, ..., {\small\verb%vtyi%} must
not occur anywhere in the hypotheses {\small\verb%A%}.  Otherwise, the conversion will fail.

\FAILURE
{\small\verb%REWRITE_CONV th%} fails if {\small\verb%th%} is not an equation or an equation universally
quantified at the outermost level.  If {\small\verb%th%} is such an equation:
{\par\samepage\setseps\small\begin{verbatim}
  th = A |- !v1....vi. t[x1,...,xn] = u[x1,...,xn,y1,...,yn]
\end{verbatim}}
\noindent then {\small\verb%REWRITE_CONV th tm%} fails unless the term {\small\verb%tm%} is
alpha-equivalent to an instance of the left-hand side {\small\verb%t[x1,...,xn]%} which
can be obtained by instantiation of free type variables (i.e. type variables
not occurring in the assumptions {\small\verb%A%}) and substitution for the free variables
{\small\verb%x1%}, ..., {\small\verb%xn%}.

\EXAMPLE
The following example illustrates a straightforward use of {\small\verb%REWRITE_CONV%}.
The supplied rewrite rule is polymorphic, and both substitution for free
variables and type instantiation may take place.  {\small\verb%EQ_SYM_EQ%} is the theorem:
{\par\samepage\setseps\small\begin{verbatim}
   |- !x:*. !y. (x = y) = (y = x)
\end{verbatim}}
\noindent and {\small\verb%REWRITE_CONV EQ_SYM%} behaves as follows:
{\par\samepage\setseps\small\begin{verbatim}
   #REWRITE_CONV EQ_SYM_EQ "1 = 2";;
   |- (1 = 2) = (2 = 1)

   #REWRITE_CONV EQ_SYM_EQ "1 < 2";;
   evaluation failed     REWRITE_CONV: lhs of theorem doesn't match term
\end{verbatim}}

\noindent The second application fails because the left-hand side {\small\verb%"x = y"%} of
the rewrite rule does not match the term to be rewritten, namely {\small\verb%"1 < 2"%}.

In the following example, one might expect the result to be the theorem 
{\small\verb%A |- f 2 = 2%}, where {\small\verb%A%} is the assumption of the supplied rewrite rule:
{\par\samepage\setseps\small\begin{verbatim}
   #REWRITE_CONV (ASSUME "!x:*. f x = x") "f 2:num";;
   evaluation failed     REWRITE_CONV: lhs of theorem doesn't match term
\end{verbatim}}
\noindent The application fails, however, because the type variable {\small\verb%*%} appears
in the assumption of the theorem returned by {\small\verb%ASSUME "!x:*. f x = x"%}.

Failure will also occur in situations like:
{\par\samepage\setseps\small\begin{verbatim}
   #REWRITE_CONV (ASSUME "f (n:num) = n") "f 2:num";;
   evaluation failed     REWRITE_CONV: lhs of theorem doesn't match term
\end{verbatim}}
\noindent where the left-hand side of the supplied equation contains a free
variable (in this case {\small\verb%n%}) which is also free in the assumptions, but which
must be instantiated in order to match the input term.

\ENDDOC
\DOC{REWRITE\_RULE}

\TYPE {\small\verb%REWRITE_RULE : (thm list -> thm -> thm)%}\egroup

\SYNOPSIS
Rule for rewriting a theorem with {\small\verb%basic_rewrites%} and a list of
theorems.

\DESCRIBE
Rewriting a theorem using {\small\verb%REWRITE_RULE%} utilizes as rewrites two sets
of theorems: the tautologies in the ML list {\small\verb%basic_rewrites%} and the
ones supplied by the user. The rule searches top-down and recursively
for subterms which match the left-hand side of any of the possible
rewrites, until none of the transformations is applicable. There is no
ordering specified among the set of rewrites.

Variants of this rule allow changes in the set of equations used:
{\small\verb%PURE_REWRITE_RULE%} and others in its family do not rewrite with the
theorems in {\small\verb%basic_rewrites%}. Rules such as {\small\verb%ASM_REWRITE_RULE%} add the
assumptions of the goal (or a specified subset of these assumptions)
to the set of possible rewrites.

The top-down recursive search for matches may not be desirable, as
this may increase the number of inferences being made or may result in
divergence. In this case other rewriting tools such as
{\small\verb%ONCE_REWRITE_RULE%} and {\small\verb%GEN_REWRITE_RULE%} can be used, or the set of
theorems given may be reduced.

See {\small\verb%GEN_REWRITE_RULE%} for the general strategy for simplifying
theorems in HOL using equational theorems.

\FAILURE
Does not fail, but may diverge if the sequence of rewrites is
non-terminating. 

\USES
Used to manipulate theorems by rewriting them with other theorems.
While resulting in high degree of automation, {\small\verb%REWRITE_RULE%} can
spawn a large number of inference steps. Thus, variants such
as {\small\verb%PURE_REWRITE_RULE%}, or other rules such as {\small\verb%SUBST%}, may be used
instead to improve efficiency.

\SEEALSO
ASM_REWRITE_RULE, basic_rewrites, GEN_REWRITE_RULE, ONCE_REWRITE_RULE,
PURE_REWRITE_RULE, REWRITE_CONV, SUBST.

\ENDDOC
\DOC{RIGHT\_AND\_EXISTS\_CONV}

\TYPE {\small\verb%RIGHT_AND_EXISTS_CONV : conv%}\egroup

\SYNOPSIS
Moves an existential quantification of the right conjunct outwards through a 
conjunction.

\DESCRIBE
When applied to a term of the form {\small\verb%P /\ (?x.Q)%}, the conversion
{\small\verb%RIGHT_AND_EXISTS_CONV%} returns the theorem:
{\par\samepage\setseps\small\begin{verbatim}
   |- P /\ (?x.Q) = (?x'. P /\ (Q[x'/x])
\end{verbatim}}
\noindent where {\small\verb%x'%} is a primed variant of {\small\verb%x%} that does not appear free in
the input term.

\FAILURE
Fails if applied to a term not of the form {\small\verb%P /\ (?x.Q)%}.

\SEEALSO
AND_EXISTS_CONV, EXISTS_AND_CONV, LEFT_AND_EXISTS_CONV.

\ENDDOC

\DOC{RIGHT\_AND\_FORALL\_CONV}

\TYPE {\small\verb%RIGHT_AND_FORALL_CONV : conv%}\egroup

\SYNOPSIS
Moves a universal quantification of the right conjunct outwards through a
conjunction.

\DESCRIBE
When applied to a term of the form {\small\verb%P /\ (!x.Q)%}, the conversion
{\small\verb%RIGHT_AND_FORALL_CONV%} returns the theorem:
{\par\samepage\setseps\small\begin{verbatim}
   |- P /\ (!x.Q) = (!x'. P /\ (Q[x'/x])
\end{verbatim}}
\noindent where {\small\verb%x'%} is a primed variant of {\small\verb%x%} that does not appear free in
the input term.

\FAILURE
Fails if applied to a term not of the form {\small\verb%P /\ (!x.Q)%}.

\SEEALSO
AND_FORALL_CONV, FORALL_AND_CONV, LEFT_AND_FORALL_CONV.

\ENDDOC

\DOC{RIGHT\_BETA}

\TYPE {\small\verb%RIGHT_BETA : (thm -> thm)%}\egroup

\SYNOPSIS
Beta-reduces a top-level beta-redex on the right-hand side of an equation.

\DESCRIBE
When applied to an equational theorem, {\small\verb%RIGHT_BETA%} applies beta-reduction at
top level to the right-hand side (only). Variables are renamed if necessary to
avoid free variable capture.
{\par\samepage\setseps\small\begin{verbatim}
    A |- s = (\x. t1) t2
   ----------------------  RIGHT_BETA
     A |- s = t1[t2/x]
\end{verbatim}}

\FAILURE
Fails unless the theorem is equational, with its right-hand side being
a top-level beta-redex.

\SEEALSO
BETA_CONV, BETA_RULE, BETA_TAC, RIGHT_LIST_BETA.

\ENDDOC
\DOC{RIGHT\_CONV\_RULE}

\TYPE {\small\verb%RIGHT_CONV_RULE : (conv -> thm -> thm)%}\egroup

\SYNOPSIS
Apply a conversion to the right-hand side of an equational theorem.

\DESCRIBE
If {\small\verb%c%} is a conversion that maps a term {\small\verb%"t2"%} to the theorem {\small\verb%|- t2 = t2'%}, 
then the rule {\small\verb%RIGHT_CONV_RULE c%} infers {\small\verb%|- t1 = t2'%} from the theorem
{\small\verb%|- t1 = t2%}.  That is, if  {\small\verb%c "t2"%} returns {\small\verb%A' |- t2 = t2'%}, then:
{\par\samepage\setseps\small\begin{verbatim}
       A |- t1 = t2
   ---------------------    RIGHT_CONV_RULE c
    A u A' |- t1 = t2'
\end{verbatim}}
\noindent Note that if the conversion {\small\verb%c%} returns a theorem with assumptions,
then the resulting inference rule adds these to the assumptions of the
theorem it returns.

\FAILURE 
{\small\verb%RIGHT_CONV_RULE c th%} fails if the conclusion of the theorem {\small\verb%th%} is not an
equation, or if {\small\verb%th%} is an equation but {\small\verb%c%} fails when applied its right-hand
side. The function returned by {\small\verb%RIGHT_CONV_RULE c%} will also fail if the ML
function {\small\verb%c:term->thm%} is not, in fact, a conversion (i.e. a function that maps
a term {\small\verb%t%} to a theorem {\small\verb%|- t = t'%}).

\SEEALSO
CONV_RULE.

\ENDDOC
\DOC{RIGHT\_IMP\_EXISTS\_CONV}

\TYPE {\small\verb%RIGHT_IMP_EXISTS_CONV : conv%}\egroup

\SYNOPSIS
Moves an existential quantification of the consequent outwards through an 
implication.

\DESCRIBE
When applied to a term of the form {\small\verb%P ==> (?x.Q)%}, the conversion
{\small\verb%RIGHT_IMP_EXISTS_CONV%} returns the theorem:
{\par\samepage\setseps\small\begin{verbatim}
   |- P ==> (?x.Q) = (?x'. P ==> (Q[x'/x])
\end{verbatim}}
\noindent where {\small\verb%x'%} is a primed variant of {\small\verb%x%} that does not appear free in
the input term.

\FAILURE
Fails if applied to a term not of the form {\small\verb%P ==> (?x.Q)%}.

\SEEALSO
EXISTS_IMP_CONV, LEFT_IMP_FORALL_CONV.

\ENDDOC

\DOC{RIGHT\_IMP\_FORALL\_CONV}

\TYPE {\small\verb%RIGHT_IMP_FORALL_CONV : conv%}\egroup

\SYNOPSIS
Moves a universal quantification of the consequent outwards through an 
implication.

\DESCRIBE
When applied to a term of the form {\small\verb%P ==> (!x.Q)%}, the conversion
{\small\verb%RIGHT_IMP_FORALL_CONV%} returns the theorem:
{\par\samepage\setseps\small\begin{verbatim}
   |- P ==> (!x.Q) = (!x'. P ==> (Q[x'/x])
\end{verbatim}}
\noindent where {\small\verb%x'%} is a primed variant of {\small\verb%x%} that does not appear free in
the input term.

\FAILURE
Fails if applied to a term not of the form {\small\verb%P ==> (!x.Q)%}.

\SEEALSO
FORALL_IMP_CONV, LEFT_IMP_EXISTS_CONV.

\ENDDOC

\DOC{RIGHT\_LIST\_BETA}

\TYPE {\small\verb%RIGHT_LIST_BETA : (thm -> thm)%}\egroup

\SYNOPSIS
Beta-reduces a multiply abstracted top-level beta-redex on the right-hand
side of an equation.

\DESCRIBE
When applied to an equational theorem, {\small\verb%RIGHT_LIST_BETA%} applies beta-reduction
over a top-level chain of beta-redexes to the right hand side (only). Variables are
renamed if necessary to avoid free variable capture.
{\par\samepage\setseps\small\begin{verbatim}
    A |- s = (\x1...xn. t) t1 ... tn
   ----------------------------------  RIGHT_LIST_BETA
       A |- s = t[t1/x1]...[tn/xn]
\end{verbatim}}

\FAILURE
Fails unless the theorem is equational, with its right-hand side being
a top-level beta-redex.

\SEEALSO
BETA_CONV, BETA_RULE, BETA_TAC, LIST_BETA_CONV, RIGHT_BETA.

\ENDDOC
\DOC{RIGHT\_OR\_EXISTS\_CONV}

\TYPE {\small\verb%RIGHT_OR_EXISTS_CONV : conv%}\egroup

\SYNOPSIS
Moves an existential quantification of the right disjunct outwards through a
disjunction.

\DESCRIBE
When applied to a term of the form {\small\verb%P \/ (?x.Q)%}, the conversion
{\small\verb%RIGHT_OR_EXISTS_CONV%} returns the theorem:
{\par\samepage\setseps\small\begin{verbatim}
   |- P \/ (?x.Q) = (?x'. P \/ (Q[x'/x])
\end{verbatim}}
\noindent where {\small\verb%x'%} is a primed variant of {\small\verb%x%} that does not appear free in
the input term.

\FAILURE
Fails if applied to a term not of the form {\small\verb%P \/ (?x.Q)%}.

\SEEALSO
OR_EXISTS_CONV, EXISTS_OR_CONV, LEFT_OR_EXISTS_CONV.

\ENDDOC

\DOC{RIGHT\_OR\_FORALL\_CONV}

\TYPE {\small\verb%RIGHT_OR_FORALL_CONV : conv%}\egroup

\SYNOPSIS
Moves a universal quantification of the right disjunct outwards through a
disjunction.

\DESCRIBE
When applied to a term of the form {\small\verb%P \/ (!x.Q)%}, the conversion
{\small\verb%RIGHT_OR_FORALL_CONV%} returns the theorem:
{\par\samepage\setseps\small\begin{verbatim}
   |- P \/ (!x.Q) = (!x'. P \/ (Q[x'/x])
\end{verbatim}}
\noindent where {\small\verb%x'%} is a primed variant of {\small\verb%x%} that does not appear free in
the input term.

\FAILURE
Fails if applied to a term not of the form {\small\verb%P \/ (!x.Q)%}.

\SEEALSO
OR_FORALL_CONV, FORALL_OR_CONV, LEFT_OR_FORALL_CONV.

\ENDDOC

\DOC{SELECT\_CONV}

\TYPE {\small\verb%SELECT_CONV : conv%}\egroup

\SYNOPSIS
Eliminate an epsilon term by introducing an existential quantifier.

\DESCRIBE 
The conversion {\small\verb%SELECT_CONV%} expects a boolean term of the form
{\small\verb%"P[@x.P[x]/x]"%}, which asserts that the epsilon term {\small\verb%@x.P[x]%} denotes
a value, {\small\verb%x%} say, for which {\small\verb%P[x]%} holds.  This assertion is equivalent
to saying that there exists such a value, and {\small\verb%SELECT_CONV%} applied to a
term of this form returns the theorem {\small\verb%|- P[@x.P[x]/x] = ?x. P[x]%}.

\FAILURE
Fails if applied to a term that is not of the form {\small\verb%"P[@x.P[x]/x]"%}.

\EXAMPLE
{\par\samepage\setseps\small\begin{verbatim}
#SELECT_CONV "(@n. n < m) < m";;
|- (@n. n < m) < m = (?n. n < m)
\end{verbatim}}
\USES
Particularly useful in conjunction with {\small\verb%CONV_TAC%} for proving properties
of values denoted by epsilon terms.  For example, suppose that one wishes
to prove the goal
{\par\samepage\setseps\small\begin{verbatim}
   ["0 < m"], "(@n. n < m) < SUC m"
\end{verbatim}}
\noindent Using the built-in arithmetic theorem
{\par\samepage\setseps\small\begin{verbatim}
   LESS_SUC  |- !m n. m < n ==> m < (SUC n)
\end{verbatim}}
\noindent this goal may be reduced by the tactic {\small\verb%MATCH_MP_TAC LESS_SUC%} to
the subgoal
{\par\samepage\setseps\small\begin{verbatim}
   ["0 < m"], "(@n. n < m) < m"
\end{verbatim}}
\noindent This is now in the correct form for using {\small\verb%CONV_TAC SELECT_CONV%} to
eliminate the epsilon term, resulting in the existentially quantified goal
{\par\samepage\setseps\small\begin{verbatim}
   ["0 < m"], "?n. n < m"
\end{verbatim}}
\noindent which is then straightforward to prove.

\SEEALSO
SELECT_ELIM, SELECT_INTRO, SELECT_RULE.

\ENDDOC
\DOC{SELECT\_ELIM}

\TYPE {\small\verb%SELECT_ELIM : (thm -> (term # thm) -> thm)%}\egroup

\SYNOPSIS 
Derived inference rule for epsilon elimination, using deduction from a
particular instance.

\DESCRIBE
{\small\verb%SELECT_ELIM%} expects two arguments, a theorem {\small\verb%th1%}, and a pair
{\small\verb%(v,th2):(term # thm)%}.  The conclusion of {\small\verb%th1%} must have the form {\small\verb%P($@ P)%},
which asserts that the epsilon term {\small\verb%$@ P%} denotes some value at which
{\small\verb%P%} holds.  The variable {\small\verb%v%} appears only in the assumption {\small\verb%P v%} of
the theorem {\small\verb%th2%}.  The conclusion of the resulting theorem matches
that of {\small\verb%th2%}, and the hypotheses include the union of all hypotheses
of the premises excepting {\small\verb%P v%}.    
{\par\samepage\setseps\small\begin{verbatim}
    A1 |- P($@ P)     A2 u {P v} |- t
   -----------------------------------  SELECT_ELIM th1 (v,th2)
              A1 u A2 |- t              (v not free in A2)
\end{verbatim}}
\noindent If {\small\verb%v%} appears in the conclusion of {\small\verb%th2%}, the epsilon
term will NOT be eliminated, and the conclusion will be {\small\verb%t[$@ P/v]%}.

\FAILURE
Fails if the first theorem is not of the form {\small\verb%A1 |- P($@ P)%}, or if
the variable {\small\verb%v%} occurs free in any other assumption of {\small\verb%th2%}. 

\EXAMPLE
If a property of functions is defined by:
{\par\samepage\setseps\small\begin{verbatim}
   INCR = |- !f. INCR f = (!t1 t2. t1 < t2 ==> (f t1) < (f t2))
\end{verbatim}}
\noindent The following theorem can be proved.
{\par\samepage\setseps\small\begin{verbatim}
   th1 = |- INCR(@f. INCR f)
\end{verbatim}}
\noindent Additionally, if such a function is assumed to exist, then one
can prove that there also exists a function which is {\small\verb%ONE_ONE%} but not {\small\verb%ONTO%}.
{\par\samepage\setseps\small\begin{verbatim}
   th2 = [ INCR g ] |- ?h. ONE_ONE h /\ ~ONTO h
\end{verbatim}}
\noindent These two results may be combined using {\small\verb%SELECT_ELIM%} to
give a new theorem: 
{\par\samepage\setseps\small\begin{verbatim}
   #SELECT_ELIM th1 ("g:num->num", th2);;
   |- ?h. ONE_ONE h /\ ~ONTO h
\end{verbatim}}

\USES 
This rule is rarely used.  The equivalence of {\small\verb%P($@ P)%} and {\small\verb%$? P%}
makes this rule fundamentally similar to the {\small\verb%?%}-elimination rule {\small\verb%CHOOSE%}.

\SEEALSO
CHOOSE, SELECT_AX, SELECT_CONV, SELECT_INTRO, SELECT_RULE.

\ENDDOC
\DOC{SELECT\_EQ}

\TYPE {\small\verb%SELECT_EQ : (term -> thm -> thm)%}\egroup

\SYNOPSIS
Apply epsilon abstraction to both terms of an equation.

\DESCRIBE
Effects the extensionality of the epsilon operator {\small\verb%@%}.
{\par\samepage\setseps\small\begin{verbatim}
       A |- t1 = t2
   ------------------------  SELECT_EQ "x"
    A |- (@x.t1) = (@x.t2)
\end{verbatim}}

\FAILURE
Fails if the conclusion of the theorem is not an equation, or if the
variable {\small\verb%x%} is free in {\small\verb%A%}.

\EXAMPLE
Given a theorem which shows the eqivalence of two distinct forms of
defining the property of being an even number:
{\par\samepage\setseps\small\begin{verbatim}
   th = |- (x MOD 2 = 0) = (?y. x = 2 * y)
\end{verbatim}}
\noindent A theorem giving the equivalence of the epsilon abstraction of each
form is obtained:
{\par\samepage\setseps\small\begin{verbatim}
   #SELECT_EQ "x:num" th;;
   |- (@x. x MOD 2 = 0) = (@x. ?y. x = 2 * y)
\end{verbatim}}

\SEEALSO
ABS, AP_TERM, EXISTS_EQ, FORALL_EQ, SELECT_AX, SELECT_CONV,
SELECT_ELIM, SELECT_INTRO. 

\ENDDOC
\DOC{SELECT\_INTRO}

\TYPE {\small\verb%SELECT_INTRO : (thm -> thm)%}\egroup

\SYNOPSIS
Derived inference rule for epsilon introduction.

\DESCRIBE
{\small\verb%SELECT_INTRO%} takes a theorem with an applicative conclusion, say 
{\small\verb%P x%}, and returns a theorem with the epsilon term {\small\verb%$@ P%} in place 
of the original operand {\small\verb%x%}.
{\par\samepage\setseps\small\begin{verbatim}
     A |- P x
   --------------  SELECT_INTRO
    A |- P($@ P)
\end{verbatim}}
\noindent The returned theorem asserts that {\small\verb%$@ P%} denotes some value
at which {\small\verb%P%} holds.

\FAILURE
Fails if the conclusion of the theorem is not an application.

\EXAMPLE
Given the theorem
{\par\samepage\setseps\small\begin{verbatim}
   th1 = |- (\n. m = n)m
\end{verbatim}}
\noindent applying {\small\verb%SELECT_INTRO%} replaces the second occurrence of {\small\verb%m%} with the
epsilon abstraction of the operator:
{\par\samepage\setseps\small\begin{verbatim}
   #let th2 = SELECT_INTRO th1;;
   th2 = |- (\n. m = n)(@n. m = n)
\end{verbatim}}
\noindent This theorem could now be used to derive a further result:
{\par\samepage\setseps\small\begin{verbatim}
   #EQ_MP(BETA_CONV(concl th2))th2;;
   |- m = (@n. m = n)
\end{verbatim}}

\SEEALSO
EXISTS, SELECT_AX, SELECT_CONV, SELECT_ELIM, SELECT_RULE.

\ENDDOC
\DOC{SELECT\_RULE}

\TYPE {\small\verb%SELECT_RULE : (thm -> thm)%}\egroup

\SYNOPSIS
Introduce an epsilon term in place of an existential quantifier.

\DESCRIBE
The inference rule {\small\verb%SELECT_RULE%} expects a theorem asserting the
existence of a value {\small\verb%x%} such that {\small\verb%P%} holds.  The equivalent assertion
that the epsilon term {\small\verb%@x.P%} denotes a value of {\small\verb%x%} for
which {\small\verb%P%} holds is returned as a theorem.  
{\par\samepage\setseps\small\begin{verbatim}
       A |- ?x. P
   ------------------  SELECT_RULE
    A |- P[(@x.P)/x]
\end{verbatim}}

\FAILURE
Fails if applied to a theorem the conclusion of which is not
existentially quantified.

\EXAMPLE
The axiom {\small\verb%INFINITY_AX%} in the theory {\small\verb%ind%} is of the form:
{\par\samepage\setseps\small\begin{verbatim}
   |- ?f. ONE_ONE f /\ ~ONTO f
\end{verbatim}}
\noindent Applying {\small\verb%SELECT_RULE%} to this theorem returns the following.
{\par\samepage\setseps\small\begin{verbatim}
   #SELECT_RULE INFINITY_AX;;
   |- ONE_ONE(@f. ONE_ONE f /\ ~ONTO f) /\ ~ONTO(@f. ONE_ONE f /\ ~ONTO f)
\end{verbatim}}

\USES
May be used to introduce an epsilon term to permit rewriting with a
constant defined using the epsilon operator. 

\SEEALSO
CHOOSE, SELECT_AX, SELECT_CONV, SELECT_ELIM, SELECT_INTRO.

\ENDDOC
\DOC{SKOLEM\_CONV}

\TYPE {\small\verb%SKOLEM_CONV : conv%}\egroup

\SYNOPSIS
Introduce a skolem function.

\DESCRIBE
When applied to an argument of the form {\small\verb%!x1...xn. ?y. P%}, the conversion
{\small\verb%SKOLEM_CONV%} returns the theorem:
{\par\samepage\setseps\small\begin{verbatim}
   |- (!x1...xn. ?y. P) = (?y'. !x1...xn. tm[y' x1 ... xn/y])
\end{verbatim}}
\noindent where {\small\verb%y'%} is a primed variant of {\small\verb%y%} not free in the input term.

\FAILURE 
{\small\verb%SKOLEM_CONV tm%} fails if {\small\verb%tm%} is not a term of the form {\small\verb%!x1...xn. ?y. P%}.

\SEEALSO
X_SKOLEM_CONV.

\ENDDOC



\DOC{SPEC}

\TYPE {\small\verb%SPEC : (term -> thm -> thm)%}\egroup

\SYNOPSIS
Specializes the conclusion of a theorem.

\DESCRIBE
When applied to a term {\small\verb%u%} and a theorem {\small\verb%A |- !x. t%}, then {\small\verb%SPEC%} returns
the theorem {\small\verb%A |- t[u/x]%}. If necessary, variables will be renamed prior
to the specialization to ensure that {\small\verb%u%} is free for {\small\verb%x%} in {\small\verb%t%}, that is,
no variables free in {\small\verb%u%} become bound after substitution.
{\par\samepage\setseps\small\begin{verbatim}
     A |- !x. t
   --------------  SPEC "u"
    A |- t[u/x]
\end{verbatim}}
\FAILURE
Fails unless the theorem's conclusion is universally quantified, and
{\small\verb%x%} and {\small\verb%u%} have the same type.

\EXAMPLE
The following example shows how {\small\verb%SPEC%} renames bound variables if necessary,
prior to substitution: a straightforward substitution would result in the
clearly invalid theorem {\small\verb%|- ~y ==> (!y. y ==> ~y)%}.
{\par\samepage\setseps\small\begin{verbatim}
   #let xv = "x:bool" and yv="y:bool" in
   #     (GEN xv o DISCH xv o GEN yv o DISCH yv) (ASSUME xv);;
   |- !x. x ==> (!y. y ==> x)

   #SPEC "~y" it;;
   |- ~y ==> (!y'. y' ==> ~y)
\end{verbatim}}
\SEEALSO
SPECL, SPEC_ALL, SPEC_VAR, GEN, GENL, GEN_ALL.

\ENDDOC
\DOC{SPECL}

\TYPE {\small\verb%SPECL : (term list -> thm -> thm)%}\egroup

\SYNOPSIS
Specializes zero or more variables in the conclusion of a theorem.

\DESCRIBE
When applied to a term list {\small\verb%[u1;...;un]%} and a theorem
{\small\verb%A |- !x1...xn. t%}, the inference rule {\small\verb%SPECL%} returns the theorem
{\small\verb%A |- t[u1/x1]...[un/xn]%}, where the substitutions are made
sequentially left-to-right in the same way as for {\small\verb%SPEC%}, with the same
sort of alpha-conversions applied to {\small\verb%t%} if necessary to ensure that no
variables which are free in {\small\verb%ui%} become bound after substitution.
{\par\samepage\setseps\small\begin{verbatim}
       A |- !x1...xn. t
   --------------------------  SPECL "[u1;...;un]"
     A |- t[u1/x1]...[un/xn]
\end{verbatim}}
\noindent It is permissible for the term-list to be empty, in which case
the application of {\small\verb%SPECL%} has no effect.

\FAILURE
Fails unless each of the terms is a variable whose type
is the same as that of the appropriate quantified variable in the original
theorem.

\EXAMPLE
The following is a specialization of a theorem from theory {\small\verb%arithmetic%}.
{\par\samepage\setseps\small\begin{verbatim}
   #let t = theorem `arithmetic` `LESS_EQ_LESS_EQ_MONO`;;
   t = |- !m n p q. m <= p /\ n <= q ==> (m + n) <= (p + q)

   #SPECL ["1"; "2"; "3"; "4"] t;;
   |- 1 <= 3 /\ 2 <= 4 ==> (1 + 2) <= (3 + 4)
\end{verbatim}}
\SEEALSO
GEN, GENL, GEN_ALL, GEN_TAC, SPEC, SPEC_ALL, SPEC_TAC.

\ENDDOC
\DOC{SPEC\_ALL}

\TYPE {\small\verb%SPEC_ALL : (thm -> thm)%}\egroup

\SYNOPSIS
Specializes the conclusion of a theorem with its own quantified variables.

\DESCRIBE
When applied to a theorem {\small\verb%A |- !x1...xn. t%}, the inference rule {\small\verb%SPEC_ALL%}
returns the theorem {\small\verb%A |- t[x1'/x1]...[xn'/xn]%} where the {\small\verb%xi'%} are distinct
variants of the corresponding {\small\verb%xi%}, chosen to avoid clashes with any variables
free in the assumption list and with the names of constants. Normally {\small\verb%xi'%} is
just {\small\verb%xi%}, in which case {\small\verb%SPEC_ALL%} simply removes all universal quantifiers.
{\par\samepage\setseps\small\begin{verbatim}
       A |- !x1...xn. t
   ---------------------------  SPEC_ALL
    A |- t[x1'/x1]...[xn'/xn]
\end{verbatim}}
\FAILURE
Never fails.

\EXAMPLE
The following example shows how variables are also renamed to avoid clashing
with the names of constants.
{\par\samepage\setseps\small\begin{verbatim}
   #let v=mk_var(`T`,":bool") in ASSUME "!^v. ^v \/ ~^v";;
   !T. T \/ ~T |- !T. T \/ ~T

   #SPEC_ALL it;;
   !T. T \/ ~T |- T' \/ ~T'
\end{verbatim}}
\SEEALSO
GEN, GENL, GEN_ALL, GEN_TAC, SPEC, SPECL, SPEC_ALL, SPEC_TAC.

\ENDDOC
\DOC{SPEC\_VAR}

\TYPE {\small\verb%SPEC_VAR : (thm -> (term # thm))%}\egroup

\SYNOPSIS
Specializes the conclusion of a theorem, returning the chosen variant.

\DESCRIBE
When applied to a theorem {\small\verb%A |- !x. t%}, the inference rule {\small\verb%SPEC_VAR%} returns
the term {\small\verb%x'%} and the theorem {\small\verb%A |- t[x'/x]%}, where {\small\verb%x'%} is a variant
of {\small\verb%x%} chosen to avoid free variable capture.
{\par\samepage\setseps\small\begin{verbatim}
     A |- !x. t
   --------------  SPEC_VAR
    A |- t[x'/x]
\end{verbatim}}
\FAILURE
Fails unless the theorem's conclusion is universally quantified.

\COMMENTS
This rule is very similar to plain {\small\verb%SPEC%}, except that it returns the
variant chosen, which may be useful information under some circumstances.

\SEEALSO
GEN, GENL, GEN_ALL, GEN_TAC, SPEC, SPECL, SPEC_ALL.

\ENDDOC
\DOC{SUBS   }

\TYPE {\small\verb%SUBS : (thm list -> thm -> thm)%}\egroup

\SYNOPSIS
Makes simple term substitutions in a theorem using a given list of theorems.

\DESCRIBE 
Term substitution in HOL is performed by replacing free subterms according to
the transformations specified by a list of equational theorems.  Given a list
of theorems {\small\verb%A1|-t1=v1,...,An|-tn=vn%} and a theorem {\small\verb%A|-t%}, {\small\verb%SUBS%}
simultaneously replaces each free occurrence of {\small\verb%ti%} in {\small\verb%t%} with {\small\verb%vi%}:
{\par\samepage\setseps\small\begin{verbatim}
          A1|-t1=v1 ... An|-tn=vn    A|-t  
   ---------------------------------------------  SUBS[A1|-t1=v1;...;An|-tn=vn]
    A1 u ... u An u A |- t[v1,...,vn/t1,...,tn]       (A|-t)  
\end{verbatim}}
\noindent No matching is involved; the occurrence of each {\small\verb%ti%} being
substituted for must be a free in {\small\verb%t%} (see {\small\verb%SUBST_MATCH%}).  An occurrence which
is not free can be substituted by using rewriting rules such as {\small\verb%REWRITE_RULE%},
{\small\verb%PURE_REWRITE_RULE%} and {\small\verb%ONCE_REWRITE_RULE%}.

\FAILURE
{\small\verb%SUBS [th1;...;thn] (A|-t)%} fails if the conclusion of each theorem in the list
is not an equation.  No change is made to the theorem {\small\verb%A |- t%} if no occurrence
of any left-hand side of the supplied equations appears in {\small\verb%t%}.

\EXAMPLE
Substitutions are made with the theorems 
{\par\samepage\setseps\small\begin{verbatim}
   #let thm1 = SPECL ["m:num"; "n:num"] ADD_SYM
   #and thm2 = CONJUNCT1 ADD_CLAUSES;;
   thm1 = |- m + n = n + m
   thm2 = |- 0 + m = m
\end{verbatim}}
\noindent depending on the occurrence of free subterms  
{\par\samepage\setseps\small\begin{verbatim}
   #SUBS [thm1; thm2] (ASSUME "(n + 0) + (0 + m) = m + n");;  
   . |- (n + 0) + m = n + m  

   #SUBS [thm1; thm2] (ASSUME "!n. (n + 0) + (0 + m) = m + n");;
   . |- !n. (n + 0) + m = m + n
\end{verbatim}}

\USES
{\small\verb%SUBS%} can sometimes be used when rewriting (for example, with {\small\verb%REWRITE_RULE%})
would diverge and term instantiation is not needed.  Moreover, applying the
substitution rules is often much faster than using the rewriting rules.

\SEEALSO
ONCE_REWRITE_RULE, PURE_REWRITE_RULE, REWRITE_RULE, SUBST, SUBST_MATCH, 
SUBS_OCCS. 

\ENDDOC


\DOC{SUBST}

\TYPE {\small\verb%SUBST : (thm # term) list -> term -> thm -> thm%}\egroup

\SYNOPSIS
Primitive inference rule for substitution.

\DESCRIBE
Implements the following rule of simultaneous substitution
{\par\samepage\setseps\small\begin{verbatim}
    A1 |- t1 = u1 ,  ... , An |- tn = un ,    A |- t[t1,...,tn]
   -------------------------------------------------------------
                  A u A1 u ... u An |- t[ui]
\end{verbatim}}
\noindent Evaluating
{\par\samepage\setseps\small\begin{verbatim}
   SUBST [((A1 |- t1=u1), x1); ... ;((An |- tn=un), xn)] 
         t[x1,...,xn] 
         (A |- t[t1,...,tn])
\end{verbatim}}
\noindent returns the theorem {\small\verb%A |- t[u1,...,un]%}.  The term argument
{\small\verb%t[x1,...,xn]%} is a template which should match the conclusion of the theorem
being substituted into, with the variables {\small\verb%x1%}, ... , {\small\verb%xn%} marking those
places where occurrences of {\small\verb%t1%}, ... , {\small\verb%tn%} are to be replaced by the terms
{\small\verb%u1%}, ... , {\small\verb%un%}, respectively.  The occurence of {\small\verb%ti%} at the places marked by
{\small\verb%xi%} must be free (i.e. {\small\verb%ti%} must not contain any bound variables).  {\small\verb%SUBST%}
automatically renames bound variables to prevent free variables in {\small\verb%ui%}
becoming bound after substitution.

{\small\verb%SUBST%} is a complex primitive because it performs both parallel simultaneous
substitution and renaming of variables. This is for efficiency reasons, but it
would be logically cleaner if {\small\verb%SUBST%} were simpler.

\FAILURE
If the template does not match the conclusion of the hypothesis, or the terms
in the conclusion marked by the variables {\small\verb%x1%}, ... , {\small\verb%xn%} in the template are
not identical to the left hand sides of the supplied equations (i.e. the terms
{\small\verb%t1%}, ... , {\small\verb%tn%}).

\EXAMPLE
{\par\samepage\setseps\small\begin{verbatim}
#let th0 = SPEC "0" ADD1 and th1 = SPEC "1" ADD1;;
th0 = |- SUC 0 = 0 + 1
th1 = |- SUC 1 = 1 + 1

#SUBST [(th0,"x:num");(th1,"y:num")] 
#      "(x+y) > SUC 0" 
#      (ASSUME "(SUC 0 + SUC 1) > SUC 0");;
. |- ((0 + 1) + (1 + 1)) > (SUC 0)

#SUBST [(th0,"x:num");(th1,"y:num")] 
#      "(SUC 0 + y) > SUC 0" 
#      (ASSUME "(SUC 0 + SUC 1) > SUC 0");;
. |- ((SUC 0) + (1 + 1)) > (SUC 0)

#SUBST [(th0,"x:num");(th1,"y:num")] 
#      "(x+y) > x" 
#      (ASSUME "(SUC 0 + SUC 1) > SUC 0");;
. |- ((0 + 1) + (1 + 1)) > (0 + 1)
\end{verbatim}}

\USES
For substituting at selected occurrences. Often useful
for writing special purpose derived inference rules.

\SEEALSO
SUBS.

\ENDDOC
\DOC{SUBST\_CONV   }

\TYPE {\small\verb%SUBST_CONV : ((thm # term) list -> term -> conv)%}\egroup

\SYNOPSIS
{\small\verb%SUBST_CONV%} is a conversion which makes substitutions in a term 
at selected occurrences of subterms, using a list of theorems.      

\DESCRIBE
{\small\verb%SUBST_CONV%} implements the following rule of simultaneous substitution
{\par\samepage\setseps\small\begin{verbatim}
                    A1 |- t1 = v1 ... An |- tn = vn
   ------------------------------------------------------------------  
    A1 u ... u An |- t[t1,...,tn/x1,...,xn] = t[v1,...,vn/x1,...,xn] 
\end{verbatim}}
\noindent The first argument to {\small\verb%SUBST_CONV%} is a list 
{\small\verb%[(A1|-t1=v1, x1);...;(An|-tn=vn, xn)]%}. 
The second argument is a template term {\small\verb%t[x1,...,xn]%}, in which 
the variables {\small\verb%x1,...,xn%} are used to mark those places where 
occurrences of {\small\verb%t1,...,tn%} are to be replaced with the terms 
{\small\verb%v1,...,vn%}, respectively. 
Thus, evaluating  
{\par\samepage\setseps\small\begin{verbatim}
   SUBST_CONV [(A1|-t1=v1, x1);...;(An|-tn=vn, xn)] 
              t[x1,...,xn] 
              t[t1,...,tn/x1,...,xn] 
\end{verbatim}}
\noindent returns the theorem 
{\par\samepage\setseps\small\begin{verbatim}
   A1 u ... u An |- t[t1,...,tn/x1,...,xn] = t[v1,...,vn/x1,...,xn]
\end{verbatim}}
    
The occurrence of {\small\verb%ti%} at the places marked by the variable  
{\small\verb%xi%} must be free (i.e. {\small\verb%ti%} must not contain any bound variables).  
{\small\verb%SUBST_CONV%} automatically renames bound variables to prevent free 
variables in {\small\verb%vi%} becoming bound after substitution.      

\FAILURE
{\small\verb%SUBST_CONV [(th1,x1);...;(thn,xn)] t[x1,...,xn] t'%} fails if the conclusion of
any theorem {\small\verb%thi%} in the list is not an equation; or if the template
{\small\verb%t[x1,...,xn]%} does not match the term {\small\verb%t'%}; or if and term {\small\verb%ti%} in {\small\verb%t'%}
marked by the variable {\small\verb%xi%} in the template, is not identical to the left-hand
side of the conclusion of the theorem {\small\verb%thi%}.

\EXAMPLE
The theorems 
{\par\samepage\setseps\small\begin{verbatim}
   #let thm0 = SPEC "0" ADD1 and thm1 = SPEC "1" ADD1;;
   thm0 = |- SUC 0 = 0 + 1
   thm1 = |- SUC 1 = 1 + 1
\end{verbatim}}
\noindent can be used to substitute selected occurrences of the terms {\small\verb%SUC 0%} 
and {\small\verb%SUC 1%}   
{\par\samepage\setseps\small\begin{verbatim}
   #SUBST_CONV [(thm0,"x:num");(thm1,"y:num")]
   #           "(x + y) > SUC 1"
   #           "(SUC 0 + SUC 1) > SUC 1";;
   |- ((SUC 0) + (SUC 1)) > (SUC 1) = ((0 + 1) + (1 + 1)) > (SUC 1) 
\end{verbatim}}
\USES
{\small\verb%SUBST_CONV%} is used when substituting at selected occurrences of terms 
and using rewriting rules/conversions is too extensive.  

\SEEALSO
REWRITE_CONV, SUBS, SUBST, SUBS_OCCS. 

\ENDDOC

\DOC{SUBST\_MATCH   }

\TYPE {\small\verb%SUBST_MATCH : (thm -> thm -> thm)%}\egroup

\SYNOPSIS
{\small\verb%SUBST_MATCH th1 th2%} applies term substitutions in the theorem 
{\small\verb%th2%} using the theorem {\small\verb%th1%}. 

\DESCRIBE
Given the theorems {\small\verb%A|-u=v%} and {\small\verb%A'|-t%}, {\small\verb%SUBST_MATCH (A|-u=v) (A'|-t)%}
searches for one free instance of {\small\verb%u%} in {\small\verb%t%}, according to a top-down
left-to-right search strategy, and then substitutes the corresponding instance
of {\small\verb%v%}.  
{\par\samepage\setseps\small\begin{verbatim}
    A |- u=v   A' |- t    
   --------------------  SUBST_MATCH (A|-u=v) (A'|-t)     
     A u A' |- t[v/u]
\end{verbatim}}
{\small\verb%SUBST_MATCH%} allows only a free instance of {\small\verb%u%} to be substituted for
in {\small\verb%t%}. An instance which contain bound variables can be substituted for
by using rewriting rules such as {\small\verb%REWRITE_RULE%}, {\small\verb%PURE_REWRITE_RULE%} and 
{\small\verb%ONCE_REWRITE_RULE%}. 

\FAILURE
{\small\verb%SUBST_MATCH th1 th2%} fails if the conclusion of the theorem {\small\verb%th1%} is not an
equation.  Moreover, {\small\verb%SUBST_MATCH (A|-u=v) (A'|-t)%} fails if no instance of {\small\verb%u%}
occurs in {\small\verb%t%}, since the matching algorithm fails.  No change is made to the
theorem {\small\verb%(A'|-t)%} if instances of {\small\verb%u%} occur in {\small\verb%t%}, but they are not free (see
{\small\verb%SUBS%}).

\EXAMPLE
The commutative law for addition    
{\par\samepage\setseps\small\begin{verbatim}
   #let thm1 = SPECL ["m:num"; "n:num"] ADD_SYM;;
   thm1 = |- m + n = n + m
\end{verbatim}}
\noindent is used to apply substitutions, depending on the occurrence of free 
instances
{\par\samepage\setseps\small\begin{verbatim}
   #SUBST_MATCH thm1 (ASSUME "(n + 1) + (m - 1) = m + n");;
   . |- (m - 1) + (n + 1) = m + n
   
   #SUBST_MATCH thm1 (ASSUME "!n. (n + 1) + (m - 1) = m + n");;
   . |- !n. (n + 1) + (m - 1) = m + n
\end{verbatim}}
\USES
{\small\verb%SUBST_MATCH%} is used when rewriting with the rules such as {\small\verb%REWRITE_RULE%},
using a single theorem is too extensive or would diverge.  Moreover, applying
{\small\verb%SUBST_MATCH%} can be much faster than using the rewriting rules.

\SEEALSO
ONCE_REWRITE_RULE, PURE_REWRITE_RULE, REWRITE_RULE, SUBS, SUBST. 

\ENDDOC


\DOC{SUBS\_OCCS }

\TYPE {\small\verb%SUBS_OCCS : ((int list # thm) list -> thm -> thm)%} \egroup

\SYNOPSIS
Makes substitutions in a theorem at specific occurrences of a term, using a
list of equational theorems.

\DESCRIBE
Given a list {\small\verb%(l1,A1|-t1=v1),...,(ln,An|-tn=vn)%} and a theorem 
{\small\verb%(A|-t)%}, {\small\verb%SUBS_OCCS%} simultaneously replaces each {\small\verb%ti%} in {\small\verb%t%} with {\small\verb%vi%},   
at the occurrences specified by the integers 
in the list {\small\verb%li = [o1;...;ok]%} for each theorem {\small\verb%Ai|-ti=vi%}.   
{\par\samepage\setseps\small\begin{verbatim}
     (l1,A1|-t1=v1) ... (ln,An|-tn=vn)  A|-t   
   -------------------------------------------  SUBS_OCCS[(l1,A1|-t1=v1);...; 
    A1 u ... An u A |- t[v1,...,vn/t1,...,tn]            (ln,An|-tn=vn)] (A|-t)
\end{verbatim}}
\FAILURE
{\small\verb%SUBS_OCCS [(l1,th1);...;(ln,thn)] (A|-t)%} fails if 
the conclusion of any theorem in the list is not an equation.
No change is made to the theorem if the supplied occurrences {\small\verb%li%} of the 
left-hand side of the conclusion of {\small\verb%thi%} do not appear in {\small\verb%t%}.    

\EXAMPLE
The commutative law for addition 
{\par\samepage\setseps\small\begin{verbatim}
   #let thm = SPECL ["m:num"; "n:num"] ADD_SYM;;
   thm = |- m + n = n + m
\end{verbatim}}
\noindent can be used for substituting only the second occurrence of 
the subterm {\small\verb%m + n%}  
{\par\samepage\setseps\small\begin{verbatim}
   #SUBS_OCCS [([2],thm)] (ASSUME "(n + m) + (m + n) = (m + n) + (m + n)");;
   . |- (n + m) + (m + n) = (n + m) + (m + n)
\end{verbatim}}
\USES
{\small\verb%SUBS_OCCS%} is used when rewriting at specific occurrences of a term, and rules
such as {\small\verb%REWRITE_RULE%}, {\small\verb%PURE_bREWRITE_RULE%}, {\small\verb%ONCE_REWRITE_RULE%}, and {\small\verb%SUBS%}
are too extensive or would diverge.

\SEEALSO
ONCE_REWRITE_RULE, PURE_REWRITE_RULE, REWRITE_RULE, SUBS, SUBST, SUBST_MATCH. 

\ENDDOC

\DOC{SUB\_CONV}

\TYPE {\small\verb%SUB_CONV : (conv -> conv)%}\egroup

\SYNOPSIS
Apply a conversion to the top-level subterms of a term.

\DESCRIBE
For any conversion {\small\verb%c%}, the function returned by {\small\verb%SUB_CONV c%} is a conversion
that applies {\small\verb%c%} to all the top-level subterms of a term.  If the conversion
{\small\verb%c%} maps {\small\verb%t%} to {\small\verb%|- t = t'%}, then {\small\verb%SUB_CONV c%} maps an abstraction {\small\verb%"\x.t"%} to
the theorem:
{\par\samepage\setseps\small\begin{verbatim}
   |- (\x.t) = (\x.t')
\end{verbatim}}

\noindent That is, {\small\verb%SUB_CONV c "\x.t"%} applies {\small\verb%c%} to the body of the
abstraction {\small\verb%"\x.t"%}.  If {\small\verb%c%} is a conversion that maps {\small\verb%"t1"%} to the theorem
{\small\verb%|- t1 = t1'%} and {\small\verb%"t2"%} to the theorem {\small\verb%|- t2 = t2'%}, then the conversion
{\small\verb%SUB_CONV c%} maps an application {\small\verb%"t1 t2"%} to the theorem:
{\par\samepage\setseps\small\begin{verbatim}
   |- (t1 t2) = (t1' t2') 
\end{verbatim}}
\noindent That is, {\small\verb%SUB_CONV c "t1 t2"%} applies {\small\verb%c%} to the both the operator
{\small\verb%t1%} and the operand {\small\verb%t2%} of the application {\small\verb%"t1 t2"%}.  Finally, for any
conversion {\small\verb%c%}, the function returned by {\small\verb%SUB_CONV c%} acts as the identity
conversion on variables and constants.  That is, if {\small\verb%"t"%} is a variable or
constant, then {\small\verb%SUB_CONV c "t"%} returns {\small\verb%|- t = t%}.

\FAILURE 
{\small\verb%SUB_CONV c tm%} fails if {\small\verb%tm%} is an abstraction {\small\verb%"\x.t"%} and the conversion {\small\verb%c%}
fails when applied to {\small\verb%t%}, or if {\small\verb%tm%} is an application {\small\verb%"t1 t2"%} and the
conversion {\small\verb%c%} fails when applied to either {\small\verb%t1%} or {\small\verb%t2%}.  The function
returned by {\small\verb%SUB_CONV c%} may also fail if the ML function {\small\verb%c:term->thm%} is not,
in fact, a conversion (i.e. a function that maps a term {\small\verb%t%} to a theorem 
{\small\verb%|- t = t'%}).

\SEEALSO
ABS_CONV, RAND_CONV, RATOR_CONV.

\ENDDOC
\DOC{SWAP\_EXISTS\_CONV}

\TYPE {\small\verb%SWAP_EXISTS_CONV : conv%}\egroup

\SYNOPSIS
Interchange the order of two existentially quantified variables.

\DESCRIBE
When applied to a term argument of the form {\small\verb%?x y. P%}, the conversion
{\small\verb%SWAP_EXISTS_CONV%} returns the theorem:
{\par\samepage\setseps\small\begin{verbatim}
   |- (?x y. P) = (?y x. P)
\end{verbatim}}
\FAILURE 
{\small\verb%SWAP_EXISTS_CONV%} fails if applied to a term that is not of the form
{\small\verb%?x y. P%}.

\ENDDOC



\DOC{SYM}

\TYPE {\small\verb%SYM : (thm -> thm)%}\egroup

\SYNOPSIS
Swaps left-hand and right-hand sides of an equation.

\DESCRIBE
When applied to a theorem {\small\verb%A |- t1 = t2%}, the inference rule {\small\verb%SYM%} returns
{\small\verb%A |- t2 = t1%}.
{\par\samepage\setseps\small\begin{verbatim}
    A |- t1 = t2
   --------------  SYM
    A |- t2 = t1
\end{verbatim}}
\FAILURE
Fails unless the theorem is equational.

\SEEALSO
NOT_EQ_SYM, REFL, TRANS.

\ENDDOC
\DOC{SYM\_CONV}

\TYPE {\small\verb%SYM_CONV : conv%}\egroup

\SYNOPSIS
Interchange the left and right-hand sides of an equation.

\DESCRIBE
When applied to an equational term {\small\verb%t1 = t2%}, the conversion
{\small\verb%SYM_CONV%} returns the theorem:
{\par\samepage\setseps\small\begin{verbatim}
   |- (t1 = t2) = (t2 = t1)
\end{verbatim}}
\FAILURE
Fails if applied to a term that is not an equation.

\SEEALSO
SYM.

\ENDDOC
\DOC{THENC}

\TYPE {\small\verb%$THENC : (conv -> conv -> conv)%}\egroup

\SYNOPSIS
Apply two conversions in sequence.

\DESCRIBE 
If the conversion {\small\verb%c1%} returns {\small\verb%|- t = t'%} when applied to a term {\small\verb%"t"%}, and
{\small\verb%c2%} returns {\small\verb%|- t' = t''%} when applied to {\small\verb%"t'"%}, then the composite
conversion {\small\verb%(c1 THENC c2) "t"%} returns {\small\verb%|- t = t''%}.  That is, {\small\verb%(c1 THENC c2)
"t"%} has the effect of transforming the term {\small\verb%"t"%} first with the conversion
{\small\verb%c1%} and then with the conversion {\small\verb%c2%}.

\FAILURE 
{\small\verb%(c1 THENC c2) "t"%} fails if either the cojnversion {\small\verb%c1%} fails when applied to
{\small\verb%"t"%}, or if {\small\verb%c1 "t"%} succeeds and returns {\small\verb%|- t = t'%} but {\small\verb%c2%} fails when
applied to {\small\verb%"t'"%}.  {\small\verb%(c1 THENC c2) "t"%} may also fail if either of {\small\verb%c1%} or {\small\verb%c2%}
is not, in fact, a conversion (i.e. a function that maps a term {\small\verb%t%} to a
theorem {\small\verb%|- t = t'%}).

\SEEALSO
EVERY_CONV.

\ENDDOC
\DOC{TOP\_DEPTH\_CONV}

\TYPE {\small\verb%TOP_DEPTH_CONV : (conv -> conv)%}\egroup

\SYNOPSIS 
Applies a conversion repeatedly to all the sub-terms of a term, in top-down
order, recursively retraversing any subterms that are changed (up to
alpha-equivalence).

\DESCRIBE 
{\small\verb%TOP_DEPTH_CONV c tm%} repeatedly applies the conversion {\small\verb%c%} to all the subterms
of the term {\small\verb%tm%}, including the term {\small\verb%tm%} itself. The supplied conversion {\small\verb%c%}
is applied to the subterms of {\small\verb%tm%} in top-down order and is applied repeatedly
(zero or more times, as is done by {\small\verb%REPEATC%}) at each subterm until it fails.
If a subterm {\small\verb%t%} is changed (up to alpha-equivalence) by virtue of the
application of {\small\verb%c%} to its own subterms, then then the term into which {\small\verb%t%} is
transformed is retraversed by applying {\small\verb%TOP_DEPTH_CONV c%} to it.

\FAILURE 
{\small\verb%TOP_DEPTH_CONV c tm%} never fails but can diverge.

\SEEALSO
DEPTH_CONV, ONCE_DEPTH_CONV, REDEPTH_CONV.

\ENDDOC
\DOC{TRANS}

\TYPE {\small\verb%$TRANS : (thm -> thm -> thm)%}\egroup

\SYNOPSIS
Uses transitivity of equality on two equational theorems.

\DESCRIBE
When applied to a theorem {\small\verb%A1 |- t1 = t2%} and a theorem {\small\verb%A2 |- t2 = t3%}, the
inference rule {\small\verb%TRANS%} returns the theorem {\small\verb%A1 u A2 |- t1 = t3%}. Note that
{\small\verb%TRANS%} can also be used as a infix (see example below).
{\par\samepage\setseps\small\begin{verbatim}
    A1 |- t1 = t2   A2 |- t2 = t3
   -------------------------------  TRANS
         A1 u A2 |- t1 = t3
\end{verbatim}}
\FAILURE
Fails unless the theorems are equational, with the right side of the first
being the same as the left side of the second.

\EXAMPLE
The following shows identical uses of {\small\verb%TRANS%}, one as a prefix, one an infix.
{\par\samepage\setseps\small\begin{verbatim}
   #let t1 = ASSUME "a:bool = b" and t2 = ASSUME "b:bool = c";;
   t1 = . |- a = b
   t2 = . |- b = c

   #TRANS t1 t2;;
   .. |- a = c

   #t1 TRANS t2;;
   .. |- a = c
\end{verbatim}}
\SEEALSO
EQ_MP, IMP_TRANS, REFL, SYM.

\ENDDOC
\DOC{TRY\_CONV}

\TYPE {\small\verb%TRY_CONV : (conv -> conv)%}\egroup

\SYNOPSIS
Attempt to apply a conversion; apply identity conversion in case of failure.

\DESCRIBE 
{\small\verb%TRY_CONV c "t"%} attempts to apply the conversion {\small\verb%c%} to the term {\small\verb%"t"%}; if
this fails, then the identity conversion applied instead.  That is, if {\small\verb%c%} is a
conversion that maps a term {\small\verb%"t"%} to the theorem {\small\verb%|- t = t'%}, then the
conversion {\small\verb%TRY_CONV c%} also maps {\small\verb%"t"%} to {\small\verb%|- t = t'%}. But if {\small\verb%c%} fails when
applied to {\small\verb%"t"%}, then {\small\verb%TRY_CONV c "t"%} returns {\small\verb%|- t = t%}.

\FAILURE 
Never fails.

\SEEALSO
ALL_CONV.

\ENDDOC
\DOC{UNDISCH}

\TYPE {\small\verb%UNDISCH : (thm -> thm)%}\egroup

\SYNOPSIS
HOL derived rule, undischarges the antecedent of the conclusion of a theorem.

\DESCRIBE
{\par\samepage\setseps\small\begin{verbatim}
    A |- t1 ==> t2
   ----------------  UNDISCH
     A, t1 |- t2
\end{verbatim}}
\noindent Note that {\small\verb%UNDISCH%} treats {\small\verb%"~u"%} as {\small\verb%"u ==> F"%}.

\FAILURE
{\small\verb%UNDISCH%} will fail on theorems which are not implications or negations.

\COMMENTS
If the antecedent already appears in the hypotheses, it will not be duplicated.
However, unlike {\small\verb%DISCH%}, 
if the antecedent is alpha-equivalent to one of the hypotheses,
it will still be added to the hypotheses.

\SEEALSO
DISCH, DISCH_ALL, DISCH_TAC, DISCH_THEN, FILTER_DISCH_TAC, FILTER_DISCH_THEN, 
NEG_DISCH, STRIP_TAC, UNDISCH_ALL, UNDISCH_TAC.

\ENDDOC
\DOC{UNDISCH\_ALL}

\TYPE {\small\verb%UNDISCH_ALL : (thm -> thm)%}\egroup

\SYNOPSIS
HOL derived rule, undischarges all antecedents of the conclusion of a theorem.

\DESCRIBE
{\par\samepage\setseps\small\begin{verbatim}
    A |- t1 ==> ... ==> tn ==> t
   ------------------------------  UNDISCH_ALL
        A, t1, ..., tn |- t       
\end{verbatim}}
\noindent Note that {\small\verb%UNDISCH_ALL%} treats {\small\verb%"~u"%} as {\small\verb%"u ==> F"%}.

\FAILURE
Unlike {\small\verb%UNDISCH%}, {\small\verb%UNDISCH_ALL%} will, 
when called on something other than an implication or negation, 
return its argument unchanged rather than failing.

\COMMENTS
Identical terms which are repeated in {\small\verb%A, "t1", ..., "tn"%} will
not be duplicated in the hypotheses of the resulting theorem.
However, if two or more alpha-equivalent terms appear in {\small\verb%A, "t1", ..., "tn"%},
then each distinct term will appear in the result.

\SEEALSO
DISCH, DISCH_ALL, DISCH_TAC, DISCH_THEN, NEG_DISCH, FILTER_DISCH_TAC, 
FILTER_DISCH_THEN, STRIP_TAC, UNDISCH, UNDISCH_TAC.

\ENDDOC
\DOC{X\_FUN\_EQ\_CONV}

\TYPE {\small\verb%X_FUN_EQ_CONV : (term -> conv)%}\egroup

\SYNOPSIS
Extensionality conversion for functions (function equality).

\DESCRIBE 
The conversion {\small\verb%X_FUN_EQ_CONV%} embodies the fact that two functions are equal
precisely when they give the same results for all values to which they can be
applied. For any variable {\small\verb%"x"%} and equation {\small\verb%"f = g"%}, where {\small\verb%x%} is of type
{\small\verb%:ty1%} and {\small\verb%f%} and {\small\verb%g%} are functions of type {\small\verb%:ty1->ty2%}, a call to
{\small\verb%X_FUN_EQ_CONV "x" "f = g"%} returns the theorem:
{\par\samepage\setseps\small\begin{verbatim}
   |- (f = g) = (!x. f x = g x)
\end{verbatim}}
\FAILURE 
{\small\verb%X_FUN_EQ_CONV x tm%} fails if {\small\verb%x%} is not a variable or if {\small\verb%tm%} is not an
equation {\small\verb%f = g%} where {\small\verb%f%} and {\small\verb%g%} are functions.  Furthermore, if {\small\verb%f%} and {\small\verb%g%}
are functions of type {\small\verb%:ty1->ty2%}, then the variable {\small\verb%x%} must have type {\small\verb%:ty1%};
otherwise the conversion fails.  Finally, failure also occurs if {\small\verb%x%} is free in
either {\small\verb%f%} or {\small\verb%g%}.

\SEEALSO
EXT, FUN_EQ_CONV.

\ENDDOC



\DOC{X\_SKOLEM\_CONV}

\TYPE {\small\verb%X_SKOLEM_CONV : (term -> conv)%}\egroup

\SYNOPSIS
Introduce a user-supplied skolem function.

\DESCRIBE
{\small\verb%X_SKOLEM_CONV%} takes two arguments.  The first is a variable {\small\verb%f%}, which
must range over functions of the appropriate type, and the second is a term of
the form {\small\verb%!x1...xn. ?y. P%}.  Given these arguments, {\small\verb%X_SKOLEM_CONV%} returns
the theorem:
{\par\samepage\setseps\small\begin{verbatim}
   |- (!x1...xn. ?y. P) = (?f. !x1...xn. tm[f x1 ... xn/y])
\end{verbatim}}
\noindent which expresses the fact that a skolem function {\small\verb%f%} of the
universally quantified variables {\small\verb%x1...xn%} may be introduced in place of the
the existentially quantified value {\small\verb%y%}.

\FAILURE 
{\small\verb%X_SKOLEM_CONV f tm%} fails if {\small\verb%f%} is not a variable, or if the input term {\small\verb%tm%}
is not a term of the form {\small\verb%!x1...xn. ?y. P%}, or if the variable {\small\verb%f%} is free in
{\small\verb%tm%}, or if the type of {\small\verb%f%} does not match its intended use as an {\small\verb%n%}-place
curried function from the variables {\small\verb%x1...xn%} to a value having the same type
as {\small\verb%y%}. 

\SEEALSO
SKOLEM_CONV.

\ENDDOC


