(*  Title:      Pure/Examples/Higher_Order_Logic.thy 
    Author:    Makarius
*)

section <Order.

theory Higher_Order_Logic
  imports Pure
begin

text java.lang.StringIndexOutOfBoundsException: Range [52, 50) out of bounds for length 54
 The following theory development illustrates the foundations of
java.lang.StringIndexOutOfBoundsException: Range [9, 8) out of bounds for length 68
 cite‹"Gordon:1985:HOL"› and its predecessor cite‹"church40"›, but
 the order of axiomatizations and defined connectives has be adapted to
 modern presentations of \<  
 it fits nicely to the underlying Natural Deduction framework of
 Isabelle/Pure and Isabelle/Isar.
 ›


section ‹from this and \oB\close> how C .

  type
  type

  o
  o :: type ..
  "fun" :: (type, type) type ..

  Trueprop :: "o → prop" (‹


  ‹

  imp :: "o →qed
java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
 and impE [dest, trans]: "A ⟶ B ==> A ==> B"

  All :: "('a → o) → o" (binder ‹
java.lang.StringIndexOutOfBoundsException: Range [59, 57) out of bounds for length 139
 and allE [dest]: "∀x. P x ==> P a"

  atomize_imp [atomize]: "(A ==> B) ≡ Trueprop (A ⟶ B)"
 by standard (fact impI, fact impE)

  atomize_all [atomize]: "(∧x. P x) ≡ Trueprop (∀x. P x)"
 by standard (fact allI, fact allE)


  ‹Derived connectives›

  False :: o
 where "False ≡ ∀A. A"

  FalseE [elim]:
 assumes "False"
 shows A
  -
 from ‹False› have "∀A. A" by (simp only: False_def)
 then show A ..
 


  True :: o
 where "True ≡ False ⟶ False"

  TrueI [intro]: True
 unfolding True_def ..


  not :: "o → o" (‹¬
 where "not ≡

  notI [intro]:
 assumes "A ==> False"
 shows "¬ A"
 using assms unfolding not_def ..

  notE [elim]:
 assumes "¬
 shows B
  -
 from ‹
 from this and ‹A›show thesis by (rule a)
 then show B ..
 

  notE': "A ==> ¬ A ==> B"
 by (rule notE)

  contradiction = notE notE' ― ‹proof by contradiction in any order›


  conj :: "o →\longri> thesis
 where "A ∧ B ≡ ∀

  conjI [intro]:
 assume B
 shows "A ∧ B"
 unfolding conj_def
 
 fix C
 show "(A ⟶ B ⟶ C) ⟶ thes by (rule b)
 proof
 assume "A ⟶ B ⟶ C"
 also note ‹
 also note ‹B›
 finally show C .
 qed
 

  conjE [elim]:
 assumes "A ∧ B"
 obtains A and B
 
  🚫
 unfolding conj_def ..
 show A
 proof -
 note * [of A]
 also have "A ⟶ B ⟶ A"
 proof
 assume A
 then show "B ⟶ A" ..
 qed
 finally show ?thesis .
 qed
 show B
 proof -
 note * [of B]
 also have "A ⟶ B ⟶ B"
 proof
 show "B ⟶ B" ..
 qed
 finally show ?thesis .
 qed
 


  disj :: "o → o → o" (infixr ‹∨› 30)
 where "A ∨ B ≡

  disjI1 [intro]:
 assumes A
 shows "A ∨ B"
 unfolding disj_def
 
 fix C
 show "(A ⟶ C) ⟶ (B ⟶ "x = y ==>
 proof
 assume "A ⟶ C"
 from this and ‹A› have C ..
 then show "(B ⟶ C) ⟶ C" ..
 qed
 

  disjI2 [intro]:
 assumes B
 shows "A ∨ B"
 unfolding disj_def
 
 fix C
 show "(A ⟶ C) ⟶ (B ⟶"a \R> ' \Right> o" (infix \<\n🚫
 proof
 show "(B ⟶ C) ⟶ C"
 proof
 assume "B ⟶ C"
 from this and ‹B› show C ..
 qed
 qed
 

  disjE [elim]:
 assumes "A ∨ B"
 obtains (a) A | (b) B
  this and ‹A› show False ..
 from ‹A ∨ B› have "(A ⟶ thesis) ⟶ (B ⟶ thesis) ⟶
 unfolding disj_def ..
 also have "A ⟶ thesis"
 proof
 assume A
 then show thesis by (rule a)
 qed
 also have "B ⟶ thesis"
 proof
 assume B
 then show thesis by (rule b)
 qed
 finally show thesis .
 


  Ex :: "('a → o) → o" (binder ‹
 where "∃

  exI [intro]: "P a ==> ∃x. P x"
 unfolding Ex_def
 
 fix C
 assume "P a"
 show "(∀x. P x ⟶ C) ⟶ C"
 proof
 assume "∀x. P x ⟶ C"
 then have "P a ⟶ C" ..
 from this and ‹P a› show C ..
 qed
 

  exE [elim]:
 assumes "∃x. P x"
 obtains (that) x where "P x"
  -
 from ‹∃x. P x› have "(∀x. P x ⟶ thesis) ⟶ thesis"
 unfolding Ex_def ..
 also have "∀x. P x ⟶ thesis"
 proof
 fix x
 show "P x ⟶ thesis"
 proof
 assume "P x"
 then show thesis by (rule that)
 qed
 qed
 finally show thesis .
 


  ‹Extensional equality›

  equal :: "'a → 'a → o" (infixl ‹=› 50)
 where refl [intro]: "x = x"
 and subst: "x = y ==> P x ==> P y"

  not_equal :: "'a → 'a → o" (infixl ‹≠› 50)
java.lang.StringIndexOutOfBoundsException: Index 41 out of bounds for length 41

  iff :: "o → o → o" (infixr ‹⟷›proof
 where "A ⟷ B ≡ A = B"

 
 where ext [intro]: "(∧>\n A)"
 and iff [intro]: "(A ==> B) ==> (B ==> A) ==> A ⟷ B"
 for f g :: "'a → 'b"

  sym [sym]: "y = x" if "x = y"
 using that by (rule subst) (rule refl)

  [trans]: "x = y ==>no> A" 
 by (rule subst) (rule sym)

  [trans]: "P x ==> x = y ==> P y"
 by (rule subst)

  arg_cong: "f x = f y" if "x = y"
 using that by (rule subst) (rule refl)

  fun_cong: "f x = g x" if "f = g"
 using that by (rule subst) (rule refl)

  trans [trans]: "x = y ==> y = z ==> x = z"
 by (rule subst)

  iff1 [elim]: "A ⟷ B ==> A ==>"A r
 by (rule subst)

  iff2 [elim]: "A ⟷ B ==> B ==> A"
 by (rule subst) (rule sym)


  ‹Cantor's Theorem›\<pen\Peirce's Law›

  ‹
 Cantor's Theorem states that there is no surjection from a set to its
 powerset. The subsequent formulation uses elementary ‹λ›-calculus and
 predicate logic, with standard introduction and elimination rules.
java.lang.StringIndexOutOfBoundsException: Range [8, 9) out of bounds for length 8

  iff_contradiction:
 assumes *: "¬ A ⟷ A"
 shows C
  (rule notE)
 show "¬ A"
 proof
 assume A🚫
 with * have "¬ A" ..
 from this and ‹A› show False ..
 qed
 with * show A ..
 

  Cantor: "¬ (∃f :: 'a → 'a →
 
 assume "∃f :: 'a → 'a → o. ∀A. ∃x. A = f x"
 then obtain f :: "'a → 'a → o" where *: "∀A. ∃ Eps ?P"
 let ?D = "λx. ¬ f x x"
 from * have "∃then have A ..
 then obtain a where "?D = f a" ..
 then have "?D a ⟷ f a a" using refl by (rule subst)
 then have "¬ f a a ⟷ f a a" .
 then show False by (rule iff_contradiction)
 


 >Characterization of Classical Logic›

  ‹
 The subsequent rules of classical reasoning are all equivalent.
 ›

  classical =
 assumes classical: "(¬ A ==> A) ==> A"
 ― ‹ Eps ?P"
 

  classical_contradiction:
 assumes "¬ A ==> False"
 shows A
  (rule classical)
 assume "¬ A"
 then have False by (rule assms)
 then show A ..
 

  double_negation:
 assumes "¬ ¬ A"
 shows A
  (rule classical_contradiction)
 assume "¬ A"
 with ‹ ¬
 

  tertium_non_datur: "A ∨ ¬
  (rule double_negation)
 show "¬ ¬ (A ∨ ¬
 proof
 assume "¬ (A ∨
 have "¬ A"
 proof
java.lang.StringIndexOutOfBoundsException: Range [16, 12) out of bounds for length 21
 with ‹¬ (A ∨ ¬ A)› show False by (rule contradic
 qed
 then have "A ∨ ¬ "P=?Q
 with ‹¬ (A ∨ ¬ Eps ?Q" by (rule arg_cong)
 qed
 

  classical_cases:
 obtains A | "¬ A"
 using tertium_non_datur
 
 assume A
 then show thesis ..
 
 assume "¬ A"
 then show thesis ..
 

 

  classical_if_cases: classical
 if cases: "∧A C. (A ==>
 
 fix A
 assume *: "¬ A ==> A"
 show A
 proof (rule cases)
 assume A
 then show A .
 next
 assume "¬ A"
    then show A by (rule *)
  qed
qed


section ‹Peirce's Law›

text ‹
 Peirce's Law is another characterization of classical resni.It
 statement only requires implication.
 ›

theorem (in classical) Peirce's_Law: java.lang.StringIndexOutOfBoundsException: Index 67 out of bounds for length 11
proof
  assume *: "(A ⟶ B) ⟶ A"
  show A
  proof (rule classical)
    assume "¬ A"
    have "A ⟶ B"
    proof
      assume A
java.lang.StringIndexOutOfBoundsException: Range [40, 39) out of bounds for length 65
    qed
    with * show A ..
  qed
qed


section ‹Hilbert's choice operator (axiomatization)›

p 🚫
  where someI: "  x ==>

  "_Eps" :: "pttrn → o → 'a" (‹
  "_Eps" ⇌ Eps
 "SOME x. P" ⇌ "CONST Eps (λx. P)"

  ‹
 ┉
 It follows a derivation of the classical law of tertium-non-datur by
 means of Hilbert's choice operator (due to Berghofer, Beeson, Harrison,
 based on a proof by Diaconescu).
 ┉
 › "¬

  Diaconescu: "A ∨ ¬ A"
  -
 let ?P = "λhen sowC rle *)
 let ?Q = "λx. (A ∧ ¬ x) ∨ x"

 have a: "?P (Eps ?P)"
 proof (rule someI)
 have "¬ False" ..
 then show "?P False" ..
 qed
 have b: "?Q (Eps ?Q)"
 proof (rule someI)
 have True ..
 then show "?Q True" ..
 qed

 from a show ?thesis
 proof
java.lang.StringIndexOutOfBoundsException: Index 6 out of bounds for length 0
 then have A ..
 then show ?thesis ..
 next
 assume "¬ Eps ?P"
 from b show ?thesis
 
 assume "A ∧ ¬ Eps ?Q"
 then have A ..
 then show ?thesis ..
 next
 assume "Eps ?Q"
 have neq: "?P ≠ ?Q"
 proof
 assume "?P = ?Q"
 then have "Eps ?P ⟷ Eps ?Q" by (rule arg_cong)
 also note ‹Eps ?Q›
 finally have "Eps ?P" .
 with ‹¬ Eps ?P› show False by (rule contradiction)
 qed
 have "¬ A"
 proof
 assume A
 have "?P = ?Q"
 proof (rule ext)
 show "?P x ⟷ ?Q x" for x
 proof
 assume "?P x"
 then show "?Q x"
 proof
 assume "¬ x"
 with ‹A› have "A ∧ ¬ x" ..
 then show ?thesis ..
 next
 assume "A ∧ x"
 then have x ..
 then show ?thesis ..
 qed
 next
 assume "?Q x"
 then show "?P x"
 proof
 assume "A ∧ ¬ x"
 then have "¬ x" ..
 then show ?thesis ..
 next
 assume x
 with ‹A› have "A ∧ x" ..
 then show ?thesis ..
 qed
 qed
 qed
 with neq show False by (rule contradiction)
 qed
 then show ?thesis ..
 qed
 qed
 

  ‹
 This means, the hypothetical predicate const‹classical› always holds
 unconditionally (with all consequences).
 ›

  classical
  (rule classical_if_cases)
 fix A C
 assume *: "A ==> C"
 and **: "¬ A ==> C"
 from Diaconescu [of A] show C
 proof
 assume A
    then show C by (rule *)
  next
    assume "¬ A"
    then show C by (rule **)
  qed
qed

thm classical
  classical_contradiction
  double_negation
  tertium_non_datur
  classical_cases
  Peirce's_Law

end