# Theory List

Up to index of Isabelle/HOL

theory List
imports PreList
uses [List.ML]
begin

    (*  Title:      HOL/List.thy
        ID:         $Id: List.thy,v 1.147 2005/09/29 15:02:57 paulson Exp $
        Author:     Tobias Nipkow
    *)

    header {* The datatype of finite lists *}

    theory List
    imports PreList
    begin

    datatype 'a list =
        Nil    ("[]")
      | Cons 'a  "'a list"    (infixr "#" 65)

    subsection{*Basic list processing functions*}

    consts
      "@" :: "'a list => 'a list => 'a list"    (infixr 65)
      filter:: "('a => bool) => 'a list => 'a list"
      concat:: "'a list list => 'a list"
      foldl :: "('b => 'a => 'b) => 'b => 'a list => 'b"
      foldr :: "('a => 'b => 'b) => 'a list => 'b => 'b"
      hd:: "'a list => 'a"
      tl:: "'a list => 'a list"
      last:: "'a list => 'a"
      butlast :: "'a list => 'a list"
      set :: "'a list => 'a set"
      list_all2 :: "('a => 'b => bool) => 'a list => 'b list => bool"
      map :: "('a=>'b) => ('a list => 'b list)"
      nth :: "'a list => nat => 'a"    (infixl "!" 100)
      list_update :: "'a list => nat => 'a => 'a list"
      take:: "nat => 'a list => 'a list"
      drop:: "nat => 'a list => 'a list"
      takeWhile :: "('a => bool) => 'a list => 'a list"
      dropWhile :: "('a => bool) => 'a list => 'a list"
      rev :: "'a list => 'a list"
      zip :: "'a list => 'b list => ('a * 'b) list"
      upt :: "nat => nat => nat list" ("(1[_..</_'])")
      remdups :: "'a list => 'a list"
      remove1 :: "'a => 'a list => 'a list"
      null:: "'a list => bool"
      "distinct":: "'a list => bool"
      replicate :: "nat => 'a => 'a list"
      rotate1 :: "'a list => 'a list"
      rotate :: "nat => 'a list => 'a list"
      sublist :: "'a list => nat set => 'a list"
    (* For efficiency *)
      mem :: "'a => 'a list => bool"    (infixl 55)
      list_inter :: "'a list => 'a list => 'a list"
      list_ex :: "('a => bool) => 'a list => bool"
      list_all:: "('a => bool) => ('a list => bool)"
      itrev :: "'a list => 'a list => 'a list"
      filtermap :: "('a => 'b option) => 'a list => 'b list"
      map_filter :: "('a => 'b) => ('a => bool) => 'a list => 'b list"

    nonterminals lupdbinds lupdbind

    syntax
      -- {* list Enumeration *}
      "@list" :: "args => 'a list"    ("[(_)]")

      -- {* Special syntax for filter *}
      "@filter" :: "[pttrn, 'a list, bool] => 'a list"    ("(1[_:_./ _])")

      -- {* list update *}
      "_lupdbind":: "['a, 'a] => lupdbind"    ("(2_ :=/ _)")
      "" :: "lupdbind => lupdbinds"    ("_")
      "_lupdbinds" :: "[lupdbind, lupdbinds] => lupdbinds"    ("_,/ _")
      "_LUpdate" :: "['a, lupdbinds] => 'a"    ("_/[(_)]" [900,0] 900)

      upto:: "nat => nat => nat list"    ("(1[_../_])")

    translations
      "[x, xs]" == "x#[xs]"
      "[x]" == "x#[]"
      "[x:xs . P]"== "filter (%x. P) xs"

      "_LUpdate xs (_lupdbinds b bs)"== "_LUpdate (_LUpdate xs b) bs"
      "xs[i:=x]" == "list_update xs i x"

      "[i..j]" == "[i..<(Suc j)]"

    syntax (xsymbols)
      "@filter" :: "[pttrn, 'a list, bool] => 'a list"("(1[_∈_ ./ _])")
    syntax (HTML output)
      "@filter" :: "[pttrn, 'a list, bool] => 'a list"("(1[_∈_ ./ _])")

    text {*
      Function @{text size} is overloaded for all datatypes. Users may
      refer to the list version as @{text length}. *}

    syntax length :: "'a list => nat"
    translations "length" => "size :: _ list => nat"

    typed_print_translation {*
      let
        fun size_tr' _ (Type ("fun", (Type ("list", _) :: _))) [t] =
              Syntax.const "length" $ t
          | size_tr' _ _ _ = raise Match;
      in [("size", size_tr')] end
    *}

    primrec
      "hd(x#xs) = x"

    primrec
      "tl([]) = []"
      "tl(x#xs) = xs"

    primrec
      "null([]) = True"
      "null(x#xs) = False"

    primrec
      "last(x#xs) = (if xs=[] then x else last xs)"

    primrec
      "butlast []= []"
      "butlast(x#xs) = (if xs=[] then [] else x#butlast xs)"

    primrec
      "set [] = {}"
      "set (x#xs) = insert x (set xs)"

    primrec
      "map f [] = []"
      "map f (x#xs) = f(x)#map f xs"

    primrec
      append_Nil:"[]@ys = ys"
      append_Cons: "(x#xs)@ys = x#(xs@ys)"

    primrec
      "rev([]) = []"
      "rev(x#xs) = rev(xs) @ [x]"

    primrec
      "filter P [] = []"
      "filter P (x#xs) = (if P x then x#filter P xs else filter P xs)"

    primrec
      foldl_Nil:"foldl f a [] = a"
      foldl_Cons: "foldl f a (x#xs) = foldl f (f a x) xs"

    primrec
      "foldr f [] a = a"
      "foldr f (x#xs) a = f x (foldr f xs a)"

    primrec
      "concat([]) = []"
      "concat(x#xs) = x @ concat(xs)"

    primrec
      drop_Nil:"drop n [] = []"
      drop_Cons: "drop n (x#xs) = (case n of 0 => x#xs | Suc(m) => drop m xs)"
      -- {*Warning: simpset does not contain this definition, but separate
           theorems for @{text "n = 0"} and @{text "n = Suc k"} *}

    primrec
      take_Nil:"take n [] = []"
      take_Cons: "take n (x#xs) = (case n of 0 => [] | Suc(m) => x # take m xs)"
      -- {*Warning: simpset does not contain this definition, but separate
           theorems for @{text "n = 0"} and @{text "n = Suc k"} *}

    primrec
      nth_Cons:"(x#xs)!n = (case n of 0 => x | (Suc k) => xs!k)"
      -- {*Warning: simpset does not contain this definition, but separate
           theorems for @{text "n = 0"} and @{text "n = Suc k"} *}

    primrec
      "[][i:=v] = []"
      "(x#xs)[i:=v] = (case i of 0 => v # xs | Suc j => x # xs[j:=v])"

    primrec
      "takeWhile P [] = []"
      "takeWhile P (x#xs) = (if P x then x#takeWhile P xs else [])"

    primrec
      "dropWhile P [] = []"
      "dropWhile P (x#xs) = (if P x then dropWhile P xs else x#xs)"

    primrec
      "zip xs [] = []"
      zip_Cons: "zip xs (y#ys) = (case xs of [] => [] | z#zs => (z,y)#zip zs ys)"
      -- {*Warning: simpset does not contain this definition, but separate
           theorems for @{text "xs = []"} and @{text "xs = z # zs"} *}

    primrec
      upt_0: "[i..<0] = []"
      upt_Suc: "[i..<(Suc j)] = (if i <= j then [i..<j] @ [j] else [])"

    primrec
      "distinct [] = True"
      "distinct (x#xs) = (x ~: set xs ∧ distinct xs)"

    primrec
      "remdups [] = []"
      "remdups (x#xs) = (if x : set xs then remdups xs else x # remdups xs)"

    primrec
      "remove1 x [] = []"
      "remove1 x (y#xs) = (if x=y then xs else y # remove1 x xs)"

    primrec
      replicate_0: "replicate 0 x = []"
      replicate_Suc: "replicate (Suc n) x = x # replicate n x"

    defs
    rotate1_def: "rotate1 xs == (case xs of [] => [] | x#xs => xs @ [x])"
    rotate_def:  "rotate n == rotate1 ^ n"

    list_all2_def:
     "list_all2 P xs ys ==
      length xs = length ys ∧ (∀(x, y) ∈ set (zip xs ys). P x y)"

    sublist_def:
     "sublist xs A == map fst (filter (%p. snd p : A) (zip xs [0..<size xs]))"

    primrec
      "x mem [] = False"
      "x mem (y#ys) = (if y=x then True else x mem ys)"

    primrec
     "list_inter [] bs = []"
     "list_inter (a#as) bs =
      (if a ∈ set bs then a#(list_inter as bs) else list_inter as bs)"

    primrec
      "list_all P [] = True"
      "list_all P (x#xs) = (P(x) ∧ list_all P xs)"

    primrec
    "list_ex P [] = False"
    "list_ex P (x#xs) = (P x ∨ list_ex P xs)"

    primrec
     "filtermap f [] = []"
     "filtermap f (x#xs) =
        (case f x of None => filtermap f xs
         | Some y => y # (filtermap f xs))"

    primrec
      "map_filter f P [] = []"
      "map_filter f P (x#xs) = (if P x then f x # map_filter f P xs else
                   map_filter f P xs)"

    primrec
    "itrev [] ys = ys"
    "itrev (x#xs) ys = itrev xs (x#ys)"

    lemma not_Cons_self [simp]: "xs ≠ x # xs"
    by (induct xs) auto

    lemmas not_Cons_self2 [simp] = not_Cons_self [symmetric]

    lemma neq_Nil_conv: "(xs ≠ []) = (∃y ys. xs = y # ys)"
    by (induct xs) auto

    lemma length_induct:
    "(!!xs. ∀ys. length ys < length xs --> P ys ==> P xs) ==> P xs"
    by (rule measure_induct [of length]) iprover

    subsubsection {* @{text length} *}

    text {*
    Needs to come before @{text "@"} because of theorem @{text
    append_eq_append_conv}.
    *}

    lemma length_append [simp]: "length (xs @ ys) = length xs + length ys"
    by (induct xs) auto

    lemma length_map [simp]: "length (map f xs) = length xs"
    by (induct xs) auto

    lemma length_rev [simp]: "length (rev xs) = length xs"
    by (induct xs) auto

    lemma length_tl [simp]: "length (tl xs) = length xs - 1"
    by (cases xs) auto

    lemma length_0_conv [iff]: "(length xs = 0) = (xs = [])"
    by (induct xs) auto

    lemma length_greater_0_conv [iff]: "(0 < length xs) = (xs ≠ [])"
    by (induct xs) auto

    lemma length_Suc_conv:
    "(length xs = Suc n) = (∃y ys. xs = y # ys ∧ length ys = n)"
    by (induct xs) auto

    lemma Suc_length_conv:
    "(Suc n = length xs) = (∃y ys. xs = y # ys ∧ length ys = n)"
    apply (induct xs, simp, simp)
    apply blast
    done

    lemma impossible_Cons [rule_format]:
      "length xs <= length ys --> xs = x # ys = False"
    apply (induct xs, auto)
    done

    lemma list_induct2[consumes 1]: "!!ys.
     [| length xs = length ys;
       P [] [];
       !!x xs y ys. [| length xs = length ys; P xs ys |] ==> P (x#xs) (y#ys) |]
     ==> P xs ys"
    apply(induct xs)
     apply simp
    apply(case_tac ys)
     apply simp
    apply(simp)
    done

    subsubsection {* @{text "@"} -- append *}

    lemma append_assoc [simp]: "(xs @ ys) @ zs = xs @ (ys @ zs)"
    by (induct xs) auto

    lemma append_Nil2 [simp]: "xs @ [] = xs"
    by (induct xs) auto

    lemma append_is_Nil_conv [iff]: "(xs @ ys = []) = (xs = [] ∧ ys = [])"
    by (induct xs) auto

    lemma Nil_is_append_conv [iff]: "([] = xs @ ys) = (xs = [] ∧ ys = [])"
    by (induct xs) auto

    lemma append_self_conv [iff]: "(xs @ ys = xs) = (ys = [])"
    by (induct xs) auto

    lemma self_append_conv [iff]: "(xs = xs @ ys) = (ys = [])"
    by (induct xs) auto

    lemma append_eq_append_conv [simp]:
     "!!ys. length xs = length ys ∨ length us = length vs
     ==> (xs@us = ys@vs) = (xs=ys ∧ us=vs)"
    apply (induct xs)
     apply (case_tac ys, simp, force)
    apply (case_tac ys, force, simp)
    done

    lemma append_eq_append_conv2: "!!ys zs ts.
     (xs @ ys = zs @ ts) =
     (EX us. xs = zs @ us & us @ ys = ts | xs @ us = zs & ys = us@ ts)"
    apply (induct xs)
     apply fastsimp
    apply(case_tac zs)
     apply simp
    apply fastsimp
    done

    lemma same_append_eq [iff]: "(xs @ ys = xs @ zs) = (ys = zs)"
    by simp

    lemma append1_eq_conv [iff]: "(xs @ [x] = ys @ [y]) = (xs = ys ∧ x = y)"
    by simp

    lemma append_same_eq [iff]: "(ys @ xs = zs @ xs) = (ys = zs)"
    by simp

    lemma append_self_conv2 [iff]: "(xs @ ys = ys) = (xs = [])"
    using append_same_eq [of _ _ "[]"] by auto

    lemma self_append_conv2 [iff]: "(ys = xs @ ys) = (xs = [])"
    using append_same_eq [of "[]"] by auto

    lemma hd_Cons_tl [simp]: "xs ≠ [] ==> hd xs # tl xs = xs"
    by (induct xs) auto

    lemma hd_append: "hd (xs @ ys) = (if xs = [] then hd ys else hd xs)"
    by (induct xs) auto

    lemma hd_append2 [simp]: "xs ≠ [] ==> hd (xs @ ys) = hd xs"
    by (simp add: hd_append split: list.split)

    lemma tl_append: "tl (xs @ ys) = (case xs of [] => tl ys | z#zs => zs @ ys)"
    by (simp split: list.split)

    lemma tl_append2 [simp]: "xs ≠ [] ==> tl (xs @ ys) = tl xs @ ys"
    by (simp add: tl_append split: list.split)

    lemma Cons_eq_append_conv: "x#xs = ys@zs =
     (ys = [] & x#xs = zs | (EX ys'. x#ys' = ys & xs = ys'@zs))"
    by(cases ys) auto

    lemma append_eq_Cons_conv: "(ys@zs = x#xs) =
     (ys = [] & zs = x#xs | (EX ys'. ys = x#ys' & ys'@zs = xs))"
    by(cases ys) auto

    text {* Trivial rules for solving @{text "@"}-equations automatically. *}

    lemma eq_Nil_appendI: "xs = ys ==> xs = [] @ ys"
    by simp

    lemma Cons_eq_appendI:
    "[| x # xs1 = ys; xs = xs1 @ zs |] ==> x # xs = ys @ zs"
    by (drule sym) simp

    lemma append_eq_appendI:
    "[| xs @ xs1 = zs; ys = xs1 @ us |] ==> xs @ ys = zs @ us"
    by (drule sym) simp

    text {*
    Simplification procedure for all list equalities.
    Currently only tries to rearrange @{text "@"} to see if
    - both lists end in a singleton list,
    - or both lists end in the same list.
    *}

    ML_setup {*
    local

    val append_assoc = thm "append_assoc";
    val append_Nil = thm "append_Nil";
    val append_Cons = thm "append_Cons";
    val append1_eq_conv = thm "append1_eq_conv";
    val append_same_eq = thm "append_same_eq";

    fun last (cons as Const("List.list.Cons",_) $ _ $ xs) =
      (case xs of Const("List.list.Nil",_) => cons | _ => last xs)
      | last (Const("List.op @",_) $ _ $ ys) = last ys
      | last t = t;

    fun list1 (Const("List.list.Cons",_) $ _ $ Const("List.list.Nil",_)) = true
      | list1 _ = false;

    fun butlast ((cons as Const("List.list.Cons",_) $ x) $ xs) =
      (case xs of Const("List.list.Nil",_) => xs | _ => cons $ butlast xs)
      | butlast ((app as Const("List.op @",_) $ xs) $ ys) = app $ butlast ys
      | butlast xs = Const("List.list.Nil",fastype_of xs);

    val rearr_ss = HOL_basic_ss addsimps [append_assoc, append_Nil, append_Cons];

    fun list_eq sg ss (F as (eq as Const(_,eqT)) $ lhs $ rhs) =
      let
        val lastl = last lhs and lastr = last rhs;
        fun rearr conv =
          let
            val lhs1 = butlast lhs and rhs1 = butlast rhs;
            val Type(_,listT::_) = eqT
            val appT = [listT,listT] ---> listT
            val app = Const("List.op @",appT)
            val F2 = eq $ (app$lhs1$lastl) $ (app$rhs1$lastr)
            val eq = HOLogic.mk_Trueprop (HOLogic.mk_eq (F,F2));
            val thm = Tactic.prove sg [] [] eq
              (K (simp_tac (Simplifier.inherit_bounds ss rearr_ss) 1));
          in SOME ((conv RS (thm RS trans)) RS eq_reflection) end;

      in
        if list1 lastl andalso list1 lastr then rearr append1_eq_conv
        else if lastl aconv lastr then rearr append_same_eq
        else NONE
      end;

    in

    val list_eq_simproc =
      Simplifier.simproc (Theory.sign_of (the_context ())) "list_eq" ["(xs::'a list) = ys"] list_eq;

    end;

    Addsimprocs [list_eq_simproc];
    *}

    subsubsection {* @{text map} *}

    lemma map_ext: "(!!x. x : set xs --> f x = g x) ==> map f xs = map g xs"
    by (induct xs) simp_all

    lemma map_ident [simp]: "map (λx. x) = (λxs. xs)"
    by (rule ext, induct_tac xs) auto

    lemma map_append [simp]: "map f (xs @ ys) = map f xs @ map f ys"
    by (induct xs) auto

    lemma map_compose: "map (f o g) xs = map f (map g xs)"
    by (induct xs) (auto simp add: o_def)

    lemma rev_map: "rev (map f xs) = map f (rev xs)"
    by (induct xs) auto

    lemma map_eq_conv[simp]: "(map f xs = map g xs) = (!x : set xs. f x = g x)"
    by (induct xs) auto

    lemma map_cong [recdef_cong]:
    "xs = ys ==> (!!x. x : set ys ==> f x = g x) ==> map f xs = map g ys"
    -- {* a congruence rule for @{text map} *}
    by simp

    lemma map_is_Nil_conv [iff]: "(map f xs = []) = (xs = [])"
    by (cases xs) auto

    lemma Nil_is_map_conv [iff]: "([] = map f xs) = (xs = [])"
    by (cases xs) auto

    lemma map_eq_Cons_conv[iff]:
     "(map f xs = y#ys) = (∃z zs. xs = z#zs ∧ f z = y ∧ map f zs = ys)"
    by (cases xs) auto

    lemma Cons_eq_map_conv[iff]:
     "(x#xs = map f ys) = (∃z zs. ys = z#zs ∧ x = f z ∧ xs = map f zs)"
    by (cases ys) auto

    lemma ex_map_conv:
      "(EX xs. ys = map f xs) = (ALL y : set ys. EX x. y = f x)"
    by(induct ys, auto)

    lemma map_eq_imp_length_eq:
      "!!xs. map f xs = map f ys ==> length xs = length ys"
    apply (induct ys)
     apply simp
    apply(simp (no_asm_use))
    apply clarify
    apply(simp (no_asm_use))
    apply fast
    done

    lemma map_inj_on:
     "[| map f xs = map f ys; inj_on f (set xs Un set ys) |]
      ==> xs = ys"
    apply(frule map_eq_imp_length_eq)
    apply(rotate_tac -1)
    apply(induct rule:list_induct2)
     apply simp
    apply(simp)
    apply (blast intro:sym)
    done

    lemma inj_on_map_eq_map:
     "inj_on f (set xs Un set ys) ==> (map f xs = map f ys) = (xs = ys)"
    by(blast dest:map_inj_on)

    lemma map_injective:
     "!!xs. map f xs = map f ys ==> inj f ==> xs = ys"
    by (induct ys) (auto dest!:injD)

    lemma inj_map_eq_map[simp]: "inj f ==> (map f xs = map f ys) = (xs = ys)"
    by(blast dest:map_injective)

    lemma inj_mapI: "inj f ==> inj (map f)"
    by (iprover dest: map_injective injD intro: inj_onI)

    lemma inj_mapD: "inj (map f) ==> inj f"
    apply (unfold inj_on_def, clarify)
    apply (erule_tac x = "[x]" in ballE)
     apply (erule_tac x = "[y]" in ballE, simp, blast)
    apply blast
    done

    lemma inj_map[iff]: "inj (map f) = inj f"
    by (blast dest: inj_mapD intro: inj_mapI)

    lemma inj_on_mapI: "inj_on f (\<Union>(set ` A)) ==> inj_on (map f) A"
    apply(rule inj_onI)
    apply(erule map_inj_on)
    apply(blast intro:inj_onI dest:inj_onD)
    done

    lemma map_idI: "(!!x. x ∈ set xs ==> f x = x) ==> map f xs = xs"
    by (induct xs, auto)

    lemma map_fun_upd [simp]: "y ∉ set xs ==> map (f(y:=v)) xs = map f xs"
    by (induct xs) auto

    lemma map_fst_zip[simp]:
      "length xs = length ys ==> map fst (zip xs ys) = xs"
    by (induct rule:list_induct2, simp_all)

    lemma map_snd_zip[simp]:
      "length xs = length ys ==> map snd (zip xs ys) = ys"
    by (induct rule:list_induct2, simp_all)

    subsubsection {* @{text rev} *}

    lemma rev_append [simp]: "rev (xs @ ys) = rev ys @ rev xs"
    by (induct xs) auto

    lemma rev_rev_ident [simp]: "rev (rev xs) = xs"
    by (induct xs) auto

    lemma rev_swap: "(rev xs = ys) = (xs = rev ys)"
    by auto

    lemma rev_is_Nil_conv [iff]: "(rev xs = []) = (xs = [])"
    by (induct xs) auto

    lemma Nil_is_rev_conv [iff]: "([] = rev xs) = (xs = [])"
    by (induct xs) auto

    lemma rev_singleton_conv [simp]: "(rev xs = [x]) = (xs = [x])"
    by (cases xs) auto

    lemma singleton_rev_conv [simp]: "([x] = rev xs) = (xs = [x])"
    by (cases xs) auto

    lemma rev_is_rev_conv [iff]: "!!ys. (rev xs = rev ys) = (xs = ys)"
    apply (induct xs, force)
    apply (case_tac ys, simp, force)
    done

    lemma inj_on_rev[iff]: "inj_on rev A"
    by(simp add:inj_on_def)

    lemma rev_induct [case_names Nil snoc]:
      "[| P []; !!x xs. P xs ==> P (xs @ [x]) |] ==> P xs"
    apply(simplesubst rev_rev_ident[symmetric])
    apply(rule_tac list = "rev xs" in list.induct, simp_all)
    done

    ML {* val rev_induct_tac = induct_thm_tac (thm "rev_induct") *}-- "compatibility"

    lemma rev_exhaust [case_names Nil snoc]:
      "(xs = [] ==> P) ==>(!!ys y. xs = ys @ [y] ==> P) ==> P"
    by (induct xs rule: rev_induct) auto

    lemmas rev_cases = rev_exhaust

    subsubsection {* @{text set} *}

    lemma finite_set [iff]: "finite (set xs)"
    by (induct xs) auto

    lemma set_append [simp]: "set (xs @ ys) = (set xs ∪ set ys)"
    by (induct xs) auto

    lemma hd_in_set: "l = x#xs ==> x∈set l"
    by (case_tac l, auto)

    lemma set_subset_Cons: "set xs ⊆ set (x # xs)"
    by auto

    lemma set_ConsD: "y ∈ set (x # xs) ==> y=x ∨ y ∈ set xs"
    by auto

    lemma set_empty [iff]: "(set xs = {}) = (xs = [])"
    by (induct xs) auto

    lemma set_empty2[iff]: "({} = set xs) = (xs = [])"
    by(induct xs) auto

    lemma set_rev [simp]: "set (rev xs) = set xs"
    by (induct xs) auto

    lemma set_map [simp]: "set (map f xs) = f`(set xs)"
    by (induct xs) auto

    lemma set_filter [simp]: "set (filter P xs) = {x. x : set xs ∧ P x}"
    by (induct xs) auto

    lemma set_upt [simp]: "set[i..<j] = {k. i ≤ k ∧ k < j}"
    apply (induct j, simp_all)
    apply (erule ssubst, auto)
    done

    lemma in_set_conv_decomp: "(x : set xs) = (∃ys zs. xs = ys @ x # zs)"
    proof (induct xs)
      case Nil show ?case by simp
      case (Cons a xs)
      show ?case
      proof
        assume "x ∈ set (a # xs)"
        with prems show "∃ys zs. a # xs = ys @ x # zs"
          by (simp, blast intro: Cons_eq_appendI)
      next
        assume "∃ys zs. a # xs = ys @ x # zs"
        then obtain ys zs where eq: "a # xs = ys @ x # zs" by blast
        show "x ∈ set (a # xs)"
          by (cases ys, auto simp add: eq)
      qed
    qed

    lemma finite_list: "finite A ==> EX l. set l = A"
    apply (erule finite_induct, auto)
    apply (rule_tac x="x#l" in exI, auto)
    done

    lemma card_length: "card (set xs) ≤ length xs"
    by (induct xs) (auto simp add: card_insert_if)

    subsubsection {* @{text filter} *}

    lemma filter_append [simp]: "filter P (xs @ ys) = filter P xs @ filter P ys"
    by (induct xs) auto

    lemma rev_filter: "rev (filter P xs) = filter P (rev xs)"
    by (induct xs) simp_all

    lemma filter_filter [simp]: "filter P (filter Q xs) = filter (λx. Q x ∧ P x) xs"
    by (induct xs) auto

    lemma length_filter_le [simp]: "length (filter P xs) ≤ length xs"
    by (induct xs) (auto simp add: le_SucI)

    lemma filter_True [simp]: "∀x ∈ set xs. P x ==> filter P xs = xs"
    by (induct xs) auto

    lemma filter_False [simp]: "∀x ∈ set xs. ¬ P x ==> filter P xs = []"
    by (induct xs) auto

    lemma filter_empty_conv: "(filter P xs = []) = (∀x∈set xs. ¬ P x)"
      by (induct xs) simp_all

    lemma filter_id_conv: "(filter P xs = xs) = (∀x∈set xs. P x)"
    apply (induct xs)
     apply auto
    apply(cut_tac P=P and xs=xs in length_filter_le)
    apply simp
    done

    lemma filter_map:
      "filter P (map f xs) = map f (filter (P o f) xs)"
    by (induct xs) simp_all

    lemma length_filter_map[simp]:
      "length (filter P (map f xs)) = length(filter (P o f) xs)"
    by (simp add:filter_map)

    lemma filter_is_subset [simp]: "set (filter P xs) ≤ set xs"
    by auto

    lemma length_filter_less:
      "[| x : set xs; ~ P x |] ==> length(filter P xs) < length xs"
    proof (induct xs)
      case Nil thus ?case by simp
    next
      case (Cons x xs) thus ?case
        apply (auto split:split_if_asm)
        using length_filter_le[of P xs] apply arith
      done
    qed

    lemma length_filter_conv_card:
     "length(filter p xs) = card{i. i < length xs & p(xs!i)}"
    proof (induct xs)
      case Nil thus ?case by simp
    next
      case (Cons x xs)
      let ?S = "{i. i < length xs & p(xs!i)}"
      have fin: "finite ?S" by(fast intro: bounded_nat_set_is_finite)
      show ?case (is "?l = card ?S'")
      proof (cases)
        assume "p x"
        hence eq: "?S' = insert 0 (Suc ` ?S)"
          by(auto simp add: nth_Cons image_def split:nat.split elim:lessE)
        have "length (filter p (x # xs)) = Suc(card ?S)"
          using Cons by simp
        also have "… = Suc(card(Suc ` ?S))" using fin
          by (simp add: card_image inj_Suc)
        also have "… = card ?S'" using eq fin
          by (simp add:card_insert_if) (simp add:image_def)
        finally show ?thesis .
      next
        assume "¬ p x"
        hence eq: "?S' = Suc ` ?S"
          by(auto simp add: nth_Cons image_def split:nat.split elim:lessE)
        have "length (filter p (x # xs)) = card ?S"
          using Cons by simp
        also have "… = card(Suc ` ?S)" using fin
          by (simp add: card_image inj_Suc)
        also have "… = card ?S'" using eq fin
          by (simp add:card_insert_if)
        finally show ?thesis .
      qed
    qed

    lemma Cons_eq_filterD:
     "x#xs = filter P ys ==>
      ∃us vs. ys = us @ x # vs ∧ (∀u∈set us. ¬ P u) ∧ P x ∧ xs = filter P vs"
      (concl is "∃us vs. ?P ys us vs")
    proof(induct ys)
      case Nil thus ?case by simp
    next
      case (Cons y ys)
      show ?case (is "∃x. ?Q x")
      proof cases
        assume Py: "P y"
        show ?thesis
        proof cases
          assume xy: "x = y"
          show ?thesis
          proof from Py xy Cons(2) show "?Q []" by simp qed
        next
          assume "x ≠ y" with Py Cons(2) show ?thesis by simp
        qed
      next
        assume Py: "¬ P y"
        with Cons obtain us vs where 1 : "?P (y#ys) (y#us) vs" by fastsimp
        show ?thesis (is "? us. ?Q us")
        proof show "?Q (y#us)" using 1 by simp qed
      qed
    qed

    lemma filter_eq_ConsD:
     "filter P ys = x#xs ==>
      ∃us vs. ys = us @ x # vs ∧ (∀u∈set us. ¬ P u) ∧ P x ∧ xs = filter P vs"
    by(rule Cons_eq_filterD) simp

    lemma filter_eq_Cons_iff:
     "(filter P ys = x#xs) =
      (∃us vs. ys = us @ x # vs ∧ (∀u∈set us. ¬ P u) ∧ P x ∧ xs = filter P vs)"
    by(auto dest:filter_eq_ConsD)

    lemma Cons_eq_filter_iff:
     "(x#xs = filter P ys) =
      (∃us vs. ys = us @ x # vs ∧ (∀u∈set us. ¬ P u) ∧ P x ∧ xs = filter P vs)"
    by(auto dest:Cons_eq_filterD)

    lemma filter_cong:
     "xs = ys ==> (!!x. x ∈ set ys ==> P x = Q x) ==> filter P xs = filter Q ys"
    apply simp
    apply(erule thin_rl)
    by (induct ys) simp_all

    subsubsection {* @{text concat} *}

    lemma concat_append [simp]: "concat (xs @ ys) = concat xs @ concat ys"
    by (induct xs) auto

    lemma concat_eq_Nil_conv [iff]: "(concat xss = []) = (∀xs ∈ set xss. xs = [])"
    by (induct xss) auto

    lemma Nil_eq_concat_conv [iff]: "([] = concat xss) = (∀xs ∈ set xss. xs = [])"
    by (induct xss) auto

    lemma set_concat [simp]: "set (concat xs) = \<Union>(set ` set xs)"
    by (induct xs) auto

    lemma map_concat: "map f (concat xs) = concat (map (map f) xs)"
    by (induct xs) auto

    lemma filter_concat: "filter p (concat xs) = concat (map (filter p) xs)"
    by (induct xs) auto

    lemma rev_concat: "rev (concat xs) = concat (map rev (rev xs))"
    by (induct xs) auto

    subsubsection {* @{text nth} *}

    lemma nth_Cons_0 [simp]: "(x # xs)!0 = x"
    by auto

    lemma nth_Cons_Suc [simp]: "(x # xs)!(Suc n) = xs!n"
    by auto

    declare nth.simps [simp del]

    lemma nth_append:
    "!!n. (xs @ ys)!n = (if n < length xs then xs!n else ys!(n - length xs))"
    apply (induct "xs", simp)
    apply (case_tac n, auto)
    done

    lemma nth_append_length [simp]: "(xs @ x # ys) ! length xs = x"
    by (induct "xs") auto

    lemma nth_append_length_plus[simp]: "(xs @ ys) ! (length xs + n) = ys ! n"
    by (induct "xs") auto

    lemma nth_map [simp]: "!!n. n < length xs ==> (map f xs)!n = f(xs!n)"
    apply (induct xs, simp)
    apply (case_tac n, auto)
    done

    lemma set_conv_nth: "set xs = {xs!i | i. i < length xs}"
    apply (induct xs, simp, simp)
    apply safe
    apply (rule_tac x = 0 in exI, simp)
     apply (rule_tac x = "Suc i" in exI, simp)
    apply (case_tac i, simp)
    apply (rename_tac j)
    apply (rule_tac x = j in exI, simp)
    done

    lemma in_set_conv_nth: "(x ∈ set xs) = (∃i < length xs. xs!i = x)"
    by(auto simp:set_conv_nth)

    lemma list_ball_nth: "[| n < length xs; !x : set xs. P x|] ==> P(xs!n)"
    by (auto simp add: set_conv_nth)

    lemma nth_mem [simp]: "n < length xs ==> xs!n : set xs"
    by (auto simp add: set_conv_nth)

    lemma all_nth_imp_all_set:
    "[| !i < length xs. P(xs!i); x : set xs|] ==> P x"
    by (auto simp add: set_conv_nth)

    lemma all_set_conv_all_nth:
    "(∀x ∈ set xs. P x) = (∀i. i < length xs --> P (xs ! i))"
    by (auto simp add: set_conv_nth)

    subsubsection {* @{text list_update} *}

    lemma length_list_update [simp]: "!!i. length(xs[i:=x]) = length xs"
    by (induct xs) (auto split: nat.split)

    lemma nth_list_update:
    "!!i j. i < length xs==> (xs[i:=x])!j = (if i = j then x else xs!j)"
    by (induct xs) (auto simp add: nth_Cons split: nat.split)

    lemma nth_list_update_eq [simp]: "i < length xs ==> (xs[i:=x])!i = x"
    by (simp add: nth_list_update)

    lemma nth_list_update_neq [simp]: "!!i j. i ≠ j ==> xs[i:=x]!j = xs!j"
    by (induct xs) (auto simp add: nth_Cons split: nat.split)

    lemma list_update_overwrite [simp]:
    "!!i. i < size xs ==> xs[i:=x, i:=y] = xs[i:=y]"
    by (induct xs) (auto split: nat.split)

    lemma list_update_id[simp]: "!!i. i < length xs ==> xs[i := xs!i] = xs"
    apply (induct xs, simp)
    apply(simp split:nat.splits)
    done

    lemma list_update_beyond[simp]: "!!i. length xs ≤ i ==> xs[i:=x] = xs"
    apply (induct xs)
     apply simp
    apply (case_tac i)
    apply simp_all
    done

    lemma list_update_same_conv:
    "!!i. i < length xs ==> (xs[i := x] = xs) = (xs!i = x)"
    by (induct xs) (auto split: nat.split)

    lemma list_update_append1:
     "!!i. i < size xs ==> (xs @ ys)[i:=x] = xs[i:=x] @ ys"
    apply (induct xs, simp)
    apply(simp split:nat.split)
    done

    lemma list_update_append:
      "!!n. (xs @ ys) [n:= x] =
      (if n < length xs then xs[n:= x] @ ys else xs @ (ys [n-length xs:= x]))"
    by (induct xs) (auto split:nat.splits)

    lemma list_update_length [simp]:
     "(xs @ x # ys)[length xs := y] = (xs @ y # ys)"
    by (induct xs, auto)

    lemma update_zip:
    "!!i xy xs. length xs = length ys ==>
    (zip xs ys)[i:=xy] = zip (xs[i:=fst xy]) (ys[i:=snd xy])"
    by (induct ys) (auto, case_tac xs, auto split: nat.split)

    lemma set_update_subset_insert: "!!i. set(xs[i:=x]) <= insert x (set xs)"
    by (induct xs) (auto split: nat.split)

    lemma set_update_subsetI: "[| set xs <= A; x:A |] ==> set(xs[i := x]) <= A"
    by (blast dest!: set_update_subset_insert [THEN subsetD])

    lemma set_update_memI: "!!n. n < length xs ==> x ∈ set (xs[n := x])"
    by (induct xs) (auto split:nat.splits)

    subsubsection {* @{text last} and @{text butlast} *}

    lemma last_snoc [simp]: "last (xs @ [x]) = x"
    by (induct xs) auto

    lemma butlast_snoc [simp]: "butlast (xs @ [x]) = xs"
    by (induct xs) auto

    lemma last_ConsL: "xs = [] ==> last(x#xs) = x"
    by(simp add:last.simps)

    lemma last_ConsR: "xs ≠ [] ==> last(x#xs) = last xs"
    by(simp add:last.simps)

    lemma last_append: "last(xs @ ys) = (if ys = [] then last xs else last ys)"
    by (induct xs) (auto)

    lemma last_appendL[simp]: "ys = [] ==> last(xs @ ys) = last xs"
    by(simp add:last_append)

    lemma last_appendR[simp]: "ys ≠ [] ==> last(xs @ ys) = last ys"
    by(simp add:last_append)

    lemma length_butlast [simp]: "length (butlast xs) = length xs - 1"
    by (induct xs rule: rev_induct) auto

    lemma butlast_append:
    "!!ys. butlast (xs @ ys) = (if ys = [] then butlast xs else xs @ butlast ys)"
    by (induct xs) auto

    lemma append_butlast_last_id [simp]:
    "xs ≠ [] ==> butlast xs @ [last xs] = xs"
    by (induct xs) auto

    lemma in_set_butlastD: "x : set (butlast xs) ==> x : set xs"
    by (induct xs) (auto split: split_if_asm)

    lemma in_set_butlast_appendI:
    "x : set (butlast xs) | x : set (butlast ys) ==> x : set (butlast (xs @ ys))"
    by (auto dest: in_set_butlastD simp add: butlast_append)

    lemma last_drop[simp]: "!!n. n < length xs ==> last (drop n xs) = last xs"
    apply (induct xs)
     apply simp
    apply (auto split:nat.split)
    done

    lemma last_conv_nth: "xs≠[] ==> last xs = xs!(length xs - 1)"
    by(induct xs)(auto simp:neq_Nil_conv)

    subsubsection {* @{text take} and @{text drop} *}

    lemma take_0 [simp]: "take 0 xs = []"
    by (induct xs) auto

    lemma drop_0 [simp]: "drop 0 xs = xs"
    by (induct xs) auto

    lemma take_Suc_Cons [simp]: "take (Suc n) (x # xs) = x # take n xs"
    by simp

    lemma drop_Suc_Cons [simp]: "drop (Suc n) (x # xs) = drop n xs"
    by simp

    declare take_Cons [simp del] and drop_Cons [simp del]

    lemma take_Suc: "xs ~= [] ==> take (Suc n) xs = hd xs # take n (tl xs)"
    by(clarsimp simp add:neq_Nil_conv)

    lemma drop_Suc: "drop (Suc n) xs = drop n (tl xs)"
    by(cases xs, simp_all)

    lemma drop_tl: "!!n. drop n (tl xs) = tl(drop n xs)"
    by(induct xs, simp_all add:drop_Cons drop_Suc split:nat.split)

    lemma nth_via_drop: "!!n. drop n xs = y#ys ==> xs!n = y"
    apply (induct xs, simp)
    apply(simp add:drop_Cons nth_Cons split:nat.splits)
    done

    lemma take_Suc_conv_app_nth:
     "!!i. i < length xs ==> take (Suc i) xs = take i xs @ [xs!i]"
    apply (induct xs, simp)
    apply (case_tac i, auto)
    done

    lemma drop_Suc_conv_tl:
      "!!i. i < length xs ==> (xs!i) # (drop (Suc i) xs) = drop i xs"
    apply (induct xs, simp)
    apply (case_tac i, auto)
    done

    lemma length_take [simp]: "!!xs. length (take n xs) = min (length xs) n"
    by (induct n) (auto, case_tac xs, auto)

    lemma length_drop [simp]: "!!xs. length (drop n xs) = (length xs - n)"
    by (induct n) (auto, case_tac xs, auto)

    lemma take_all [simp]: "!!xs. length xs <= n ==> take n xs = xs"
    by (induct n) (auto, case_tac xs, auto)

    lemma drop_all [simp]: "!!xs. length xs <= n ==> drop n xs = []"
    by (induct n) (auto, case_tac xs, auto)

    lemma take_append [simp]:
    "!!xs. take n (xs @ ys) = (take n xs @ take (n - length xs) ys)"
    by (induct n) (auto, case_tac xs, auto)

    lemma drop_append [simp]:
    "!!xs. drop n (xs @ ys) = drop n xs @ drop (n - length xs) ys"
    by (induct n) (auto, case_tac xs, auto)

    lemma take_take [simp]: "!!xs n. take n (take m xs) = take (min n m) xs"
    apply (induct m, auto)
    apply (case_tac xs, auto)
    apply (case_tac n, auto)
    done

    lemma drop_drop [simp]: "!!xs. drop n (drop m xs) = drop (n + m) xs"
    apply (induct m, auto)
    apply (case_tac xs, auto)
    done

    lemma take_drop: "!!xs n. take n (drop m xs) = drop m (take (n + m) xs)"
    apply (induct m, auto)
    apply (case_tac xs, auto)
    done

    lemma drop_take: "!!m n. drop n (take m xs) = take (m-n) (drop n xs)"
    apply(induct xs)
     apply simp
    apply(simp add: take_Cons drop_Cons split:nat.split)
    done

    lemma append_take_drop_id [simp]: "!!xs. take n xs @ drop n xs = xs"
    apply (induct n, auto)
    apply (case_tac xs, auto)
    done

    lemma take_eq_Nil[simp]: "!!n. (take n xs = []) = (n = 0 ∨ xs = [])"
    apply(induct xs)
     apply simp
    apply(simp add:take_Cons split:nat.split)
    done

    lemma drop_eq_Nil[simp]: "!!n. (drop n xs = []) = (length xs <= n)"
    apply(induct xs)
    apply simp
    apply(simp add:drop_Cons split:nat.split)
    done

    lemma take_map: "!!xs. take n (map f xs) = map f (take n xs)"
    apply (induct n, auto)
    apply (case_tac xs, auto)
    done

    lemma drop_map: "!!xs. drop n (map f xs) = map f (drop n xs)"
    apply (induct n, auto)
    apply (case_tac xs, auto)
    done

    lemma rev_take: "!!i. rev (take i xs) = drop (length xs - i) (rev xs)"
    apply (induct xs, auto)
    apply (case_tac i, auto)
    done

    lemma rev_drop: "!!i. rev (drop i xs) = take (length xs - i) (rev xs)"
    apply (induct xs, auto)
    apply (case_tac i, auto)
    done

    lemma nth_take [simp]: "!!n i. i < n ==> (take n xs)!i = xs!i"
    apply (induct xs, auto)
    apply (case_tac n, blast)
    apply (case_tac i, auto)
    done

    lemma nth_drop [simp]:
    "!!xs i. n + i <= length xs ==> (drop n xs)!i = xs!(n + i)"
    apply (induct n, auto)
    apply (case_tac xs, auto)
    done

    lemma set_take_subset: "!!n. set(take n xs) ⊆ set xs"
    by(induct xs)(auto simp:take_Cons split:nat.split)

    lemma set_drop_subset: "!!n. set(drop n xs) ⊆ set xs"
    by(induct xs)(auto simp:drop_Cons split:nat.split)

    lemma in_set_takeD: "x : set(take n xs) ==> x : set xs"
    using set_take_subset by fast

    lemma in_set_dropD: "x : set(drop n xs) ==> x : set xs"
    using set_drop_subset by fast

    lemma append_eq_conv_conj:
    "!!zs. (xs @ ys = zs) = (xs = take (length xs) zs ∧ ys = drop (length xs) zs)"
    apply (induct xs, simp, clarsimp)
    apply (case_tac zs, auto)
    done

    lemma take_add [rule_format]:
        "∀i. i+j ≤ length(xs) --> take (i+j) xs = take i xs @ take j (drop i xs)"
    apply (induct xs, auto)
    apply (case_tac i, simp_all)
    done

    lemma append_eq_append_conv_if:
     "!! ys1. (xs1 @ xs2 = ys1 @ ys2) =
      (if size xs1 ≤ size ys1
       then xs1 = take (size xs1) ys1 ∧ xs2 = drop (size xs1) ys1 @ ys2
       else take (size ys1) xs1 = ys1 ∧ drop (size ys1) xs1 @ xs2 = ys2)"
    apply(induct xs1)
     apply simp
    apply(case_tac ys1)
    apply simp_all
    done

    lemma take_hd_drop:
      "!!n. n < length xs ==> take n xs @ [hd (drop n xs)] = take (n+1) xs"
    apply(induct xs)
    apply simp
    apply(simp add:drop_Cons split:nat.split)
    done

    lemma id_take_nth_drop:
     "i < length xs ==> xs = take i xs @ xs!i # drop (Suc i) xs"
    proof -
      assume si: "i < length xs"
      hence "xs = take (Suc i) xs @ drop (Suc i) xs" by auto
      moreover
      from si have "take (Suc i) xs = take i xs @ [xs!i]"
        apply (rule_tac take_Suc_conv_app_nth) by arith
      ultimately show ?thesis by auto
    qed

    lemma upd_conv_take_nth_drop:
     "i < length xs ==> xs[i:=a] = take i xs @ a # drop (Suc i) xs"
    proof -
      assume i: "i < length xs"
      have "xs[i:=a] = (take i xs @ xs!i # drop (Suc i) xs)[i:=a]"
        by(rule arg_cong[OF id_take_nth_drop[OF i]])
      also have "… = take i xs @ a # drop (Suc i) xs"
        using i by (simp add: list_update_append)
      finally show ?thesis .
    qed

    subsubsection {* @{text takeWhile} and @{text dropWhile} *}

    lemma takeWhile_dropWhile_id [simp]: "takeWhile P xs @ dropWhile P xs = xs"
    by (induct xs) auto

    lemma takeWhile_append1 [simp]:
    "[| x:set xs; ~P(x)|] ==> takeWhile P (xs @ ys) = takeWhile P xs"
    by (induct xs) auto

    lemma takeWhile_append2 [simp]:
    "(!!x. x : set xs ==> P x) ==> takeWhile P (xs @ ys) = xs @ takeWhile P ys"
    by (induct xs) auto

    lemma takeWhile_tail: "¬ P x ==> takeWhile P (xs @ (x#l)) = takeWhile P xs"
    by (induct xs) auto

    lemma dropWhile_append1 [simp]:
    "[| x : set xs; ~P(x)|] ==> dropWhile P (xs @ ys) = (dropWhile P xs)@ys"
    by (induct xs) auto

    lemma dropWhile_append2 [simp]:
    "(!!x. x:set xs ==> P(x)) ==> dropWhile P (xs @ ys) = dropWhile P ys"
    by (induct xs) auto

    lemma set_take_whileD: "x : set (takeWhile P xs) ==> x : set xs ∧ P x"
    by (induct xs) (auto split: split_if_asm)

    lemma takeWhile_eq_all_conv[simp]:
     "(takeWhile P xs = xs) = (∀x ∈ set xs. P x)"
    by(induct xs, auto)

    lemma dropWhile_eq_Nil_conv[simp]:
     "(dropWhile P xs = []) = (∀x ∈ set xs. P x)"
    by(induct xs, auto)

    lemma dropWhile_eq_Cons_conv:
     "(dropWhile P xs = y#ys) = (xs = takeWhile P xs @ y # ys & ¬ P y)"
    by(induct xs, auto)

    text{* The following two lemmmas could be generalized to an arbitrary
    property. *}

    lemma takeWhile_neq_rev: "[|distinct xs; x ∈ set xs|] ==>
     takeWhile (λy. y ≠ x) (rev xs) = rev (tl (dropWhile (λy. y ≠ x) xs))"
    by(induct xs) (auto simp: takeWhile_tail[where l="[]"])

    lemma dropWhile_neq_rev: "[|distinct xs; x ∈ set xs|] ==>
      dropWhile (λy. y ≠ x) (rev xs) = x # rev (takeWhile (λy. y ≠ x) xs)"
    apply(induct xs)
     apply simp
    apply auto
    apply(subst dropWhile_append2)
    apply auto
    done

    subsubsection {* @{text zip} *}

    lemma zip_Nil [simp]: "zip [] ys = []"
    by (induct ys) auto

    lemma zip_Cons_Cons [simp]: "zip (x # xs) (y # ys) = (x, y) # zip xs ys"
    by simp

    declare zip_Cons [simp del]

    lemma zip_Cons1:
     "zip (x#xs) ys = (case ys of [] => [] | y#ys => (x,y)#zip xs ys)"
    by(auto split:list.split)

    lemma length_zip [simp]:
    "!!xs. length (zip xs ys) = min (length xs) (length ys)"
    apply (induct ys, simp)
    apply (case_tac xs, auto)
    done

    lemma zip_append1:
    "!!xs. zip (xs @ ys) zs =
    zip xs (take (length xs) zs) @ zip ys (drop (length xs) zs)"
    apply (induct zs, simp)
    apply (case_tac xs, simp_all)
    done

    lemma zip_append2:
    "!!ys. zip xs (ys @ zs) =
    zip (take (length ys) xs) ys @ zip (drop (length ys) xs) zs"
    apply (induct xs, simp)
    apply (case_tac ys, simp_all)
    done

    lemma zip_append [simp]:
     "[| length xs = length us; length ys = length vs |] ==>
    zip (xs@ys) (us@vs) = zip xs us @ zip ys vs"
    by (simp add: zip_append1)

    lemma zip_rev:
    "length xs = length ys ==> zip (rev xs) (rev ys) = rev (zip xs ys)"
    by (induct rule:list_induct2, simp_all)

    lemma nth_zip [simp]:
    "!!i xs. [| i < length xs; i < length ys|] ==> (zip xs ys)!i = (xs!i, ys!i)"
    apply (induct ys, simp)
    apply (case_tac xs)
     apply (simp_all add: nth.simps split: nat.split)
    done

    lemma set_zip:
    "set (zip xs ys) = {(xs!i, ys!i) | i. i < min (length xs) (length ys)}"
    by (simp add: set_conv_nth cong: rev_conj_cong)

    lemma zip_update:
    "length xs = length ys ==> zip (xs[i:=x]) (ys[i:=y]) = (zip xs ys)[i:=(x,y)]"
    by (rule sym, simp add: update_zip)

    lemma zip_replicate [simp]:
    "!!j. zip (replicate i x) (replicate j y) = replicate (min i j) (x,y)"
    apply (induct i, auto)
    apply (case_tac j, auto)
    done

    subsubsection {* @{text list_all2} *}

    lemma list_all2_lengthD [intro?]:
      "list_all2 P xs ys ==> length xs = length ys"
    by (simp add: list_all2_def)

    lemma list_all2_Nil [iff,code]: "list_all2 P [] ys = (ys = [])"
    by (simp add: list_all2_def)

    lemma list_all2_Nil2[iff]: "list_all2 P xs [] = (xs = [])"
    by (simp add: list_all2_def)

    lemma list_all2_Cons [iff,code]:
    "list_all2 P (x # xs) (y # ys) = (P x y ∧ list_all2 P xs ys)"
    by (auto simp add: list_all2_def)

    lemma list_all2_Cons1:
    "list_all2 P (x # xs) ys = (∃z zs. ys = z # zs ∧ P x z ∧ list_all2 P xs zs)"
    by (cases ys) auto

    lemma list_all2_Cons2:
    "list_all2 P xs (y # ys) = (∃z zs. xs = z # zs ∧ P z y ∧ list_all2 P zs ys)"
    by (cases xs) auto

    lemma list_all2_rev [iff]:
    "list_all2 P (rev xs) (rev ys) = list_all2 P xs ys"
    by (simp add: list_all2_def zip_rev cong: conj_cong)

    lemma list_all2_rev1:
    "list_all2 P (rev xs) ys = list_all2 P xs (rev ys)"
    by (subst list_all2_rev [symmetric]) simp

    lemma list_all2_append1:
    "list_all2 P (xs @ ys) zs =
    (EX us vs. zs = us @ vs ∧ length us = length xs ∧ length vs = length ys ∧
    list_all2 P xs us ∧ list_all2 P ys vs)"
    apply (simp add: list_all2_def zip_append1)
    apply (rule iffI)
     apply (rule_tac x = "take (length xs) zs" in exI)
     apply (rule_tac x = "drop (length xs) zs" in exI)
     apply (force split: nat_diff_split simp add: min_def, clarify)
    apply (simp add: ball_Un)
    done

    lemma list_all2_append2:
    "list_all2 P xs (ys @ zs) =
    (EX us vs. xs = us @ vs ∧ length us = length ys ∧ length vs = length zs ∧
    list_all2 P us ys ∧ list_all2 P vs zs)"
    apply (simp add: list_all2_def zip_append2)
    apply (rule iffI)
     apply (rule_tac x = "take (length ys) xs" in exI)
     apply (rule_tac x = "drop (length ys) xs" in exI)
     apply (force split: nat_diff_split simp add: min_def, clarify)
    apply (simp add: ball_Un)
    done

    lemma list_all2_append:
      "length xs = length ys ==>
      list_all2 P (xs@us) (ys@vs) = (list_all2 P xs ys ∧ list_all2 P us vs)"
    by (induct rule:list_induct2, simp_all)

    lemma list_all2_appendI [intro?, trans]:
      "[| list_all2 P a b; list_all2 P c d |] ==> list_all2 P (a@c) (b@d)"
      by (simp add: list_all2_append list_all2_lengthD)

    lemma list_all2_conv_all_nth:
    "list_all2 P xs ys =
    (length xs = length ys ∧ (∀i < length xs. P (xs!i) (ys!i)))"
    by (force simp add: list_all2_def set_zip)

    lemma list_all2_trans:
      assumes tr: "!!a b c. P1 a b ==> P2 b c ==> P3 a c"
      shows "!!bs cs. list_all2 P1 as bs ==> list_all2 P2 bs cs ==> list_all2 P3 as cs"
            (is "!!bs cs. PROP ?Q as bs cs")
    proof (induct as)
      fix x xs bs assume I1: "!!bs cs. PROP ?Q xs bs cs"
      show "!!cs. PROP ?Q (x # xs) bs cs"
      proof (induct bs)
        fix y ys cs assume I2: "!!cs. PROP ?Q (x # xs) ys cs"
        show "PROP ?Q (x # xs) (y # ys) cs"
          by (induct cs) (auto intro: tr I1 I2)
      qed simp
    qed simp

    lemma list_all2_all_nthI [intro?]:
      "length a = length b ==> (!!n. n < length a ==> P (a!n) (b!n)) ==> list_all2 P a b"
      by (simp add: list_all2_conv_all_nth)

    lemma list_all2I:
      "∀x ∈ set (zip a b). split P x ==> length a = length b ==> list_all2 P a b"
      by (simp add: list_all2_def)

    lemma list_all2_nthD:
      "[| list_all2 P xs ys; p < size xs |] ==> P (xs!p) (ys!p)"
      by (simp add: list_all2_conv_all_nth)

    lemma list_all2_nthD2:
      "[|list_all2 P xs ys; p < size ys|] ==> P (xs!p) (ys!p)"
      by (frule list_all2_lengthD) (auto intro: list_all2_nthD)

    lemma list_all2_map1:
      "list_all2 P (map f as) bs = list_all2 (λx y. P (f x) y) as bs"
      by (simp add: list_all2_conv_all_nth)

    lemma list_all2_map2:
      "list_all2 P as (map f bs) = list_all2 (λx y. P x (f y)) as bs"
      by (auto simp add: list_all2_conv_all_nth)

    lemma list_all2_refl [intro?]:
      "(!!x. P x x) ==> list_all2 P xs xs"
      by (simp add: list_all2_conv_all_nth)

    lemma list_all2_update_cong:
      "[| i<size xs; list_all2 P xs ys; P x y |] ==> list_all2 P (xs[i:=x]) (ys[i:=y])"
      by (simp add: list_all2_conv_all_nth nth_list_update)

    lemma list_all2_update_cong2:
      "[|list_all2 P xs ys; P x y; i < length ys|] ==> list_all2 P (xs[i:=x]) (ys[i:=y])"
      by (simp add: list_all2_lengthD list_all2_update_cong)

    lemma list_all2_takeI [simp,intro?]:
      "!!n ys. list_all2 P xs ys ==> list_all2 P (take n xs) (take n ys)"
      apply (induct xs)
       apply simp
      apply (clarsimp simp add: list_all2_Cons1)
      apply (case_tac n)
      apply auto
      done

    lemma list_all2_dropI [simp,intro?]:
      "!!n bs. list_all2 P as bs ==> list_all2 P (drop n as) (drop n bs)"
      apply (induct as, simp)
      apply (clarsimp simp add: list_all2_Cons1)
      apply (case_tac n, simp, simp)
      done

    lemma list_all2_mono [intro?]:
      "!!y. list_all2 P x y ==> (!!x y. P x y ==> Q x y) ==> list_all2 Q x y"
      apply (induct x, simp)
      apply (case_tac y, auto)
      done

    subsubsection {* @{text foldl} and @{text foldr} *}

    lemma foldl_append [simp]:
    "!!a. foldl f a (xs @ ys) = foldl f (foldl f a xs) ys"
    by (induct xs) auto

    lemma foldr_append[simp]: "foldr f (xs @ ys) a = foldr f xs (foldr f ys a)"
    by (induct xs) auto

    lemma foldr_foldl: "foldr f xs a = foldl (%x y. f y x) a (rev xs)"
    by (induct xs) auto

    lemma foldl_foldr: "foldl f a xs = foldr (%x y. f y x) (rev xs) a"
    by (simp add: foldr_foldl [of "%x y. f y x" "rev xs"])

    text {*
    Note: @{text "n ≤ foldl (op +) n ns"} looks simpler, but is more
    difficult to use because it requires an additional transitivity step.
    *}

    lemma start_le_sum: "!!n::nat. m <= n ==> m <= foldl (op +) n ns"
    by (induct ns) auto

    lemma elem_le_sum: "!!n::nat. n : set ns ==> n <= foldl (op +) 0 ns"
    by (force intro: start_le_sum simp add: in_set_conv_decomp)

    lemma sum_eq_0_conv [iff]:
    "!!m::nat. (foldl (op +) m ns = 0) = (m = 0 ∧ (∀n ∈ set ns. n = 0))"
    by (induct ns) auto

    subsubsection {* @{text upto} *}

    lemma upt_rec[code]: "[i..<j] = (if i<j then i#[Suc i..<j] else [])"
    -- {* simp does not terminate! *}
    by (induct j) auto

    lemma upt_conv_Nil [simp]: "j <= i ==> [i..<j] = []"
    by (subst upt_rec) simp

    lemma upt_eq_Nil_conv[simp]: "([i..<j] = []) = (j = 0 ∨ j <= i)"
    by(induct j)simp_all

    lemma upt_eq_Cons_conv:
     "!!x xs. ([i..<j] = x#xs) = (i < j & i = x & [i+1..<j] = xs)"
    apply(induct j)
     apply simp
    apply(clarsimp simp add: append_eq_Cons_conv)
    apply arith
    done

    lemma upt_Suc_append: "i <= j ==> [i..<(Suc j)] = [i..<j]@[j]"
    -- {* Only needed if @{text upt_Suc} is deleted from the simpset. *}
    by simp

    lemma upt_conv_Cons: "i < j ==> [i..<j] = i # [Suc i..<j]"
    apply(rule trans)
    apply(subst upt_rec)
     prefer 2 apply (rule refl, simp)
    done

    lemma upt_add_eq_append: "i<=j ==> [i..<j+k] = [i..<j]@[j..<j+k]"
    -- {* LOOPS as a simprule, since @{text "j <= j"}. *}
    by (induct k) auto

    lemma length_upt [simp]: "length [i..<j] = j - i"
    by (induct j) (auto simp add: Suc_diff_le)

    lemma nth_upt [simp]: "i + k < j ==> [i..<j] ! k = i + k"
    apply (induct j)
    apply (auto simp add: less_Suc_eq nth_append split: nat_diff_split)
    done

    lemma take_upt [simp]: "!!i. i+m <= n ==> take m [i..<n] = [i..<i+m]"
    apply (induct m, simp)
    apply (subst upt_rec)
    apply (rule sym)
    apply (subst upt_rec)
    apply (simp del: upt.simps)
    done

    lemma drop_upt[simp]: "drop m [i..<j] = [i+m..<j]"
    apply(induct j)
    apply auto
    apply arith
    done

    lemma map_Suc_upt: "map Suc [m..<n] = [Suc m..n]"
    by (induct n) auto

    lemma nth_map_upt: "!!i. i < n-m ==> (map f [m..<n]) ! i = f(m+i)"
    apply (induct n m rule: diff_induct)
    prefer 3 apply (subst map_Suc_upt[symmetric])
    apply (auto simp add: less_diff_conv nth_upt)
    done

    lemma nth_take_lemma:
      "!!xs ys. k <= length xs ==> k <= length ys ==>
         (!!i. i < k --> xs!i = ys!i) ==> take k xs = take k ys"
    apply (atomize, induct k)
    apply (simp_all add: less_Suc_eq_0_disj all_conj_distrib, clarify)
    txt {* Both lists must be non-empty *}
    apply (case_tac xs, simp)
    apply (case_tac ys, clarify)
     apply (simp (no_asm_use))
    apply clarify
    txt {* prenexing's needed, not miniscoping *}
    apply (simp (no_asm_use) add: all_simps [symmetric] del: all_simps)
    apply blast
    done

    lemma nth_equalityI:
     "[| length xs = length ys; ALL i < length xs. xs!i = ys!i |] ==> xs = ys"
    apply (frule nth_take_lemma [OF le_refl eq_imp_le])
    apply (simp_all add: take_all)
    done

    (* needs nth_equalityI *)
    lemma list_all2_antisym:
      "[| (!!x y. [|P x y; Q y x|] ==> x = y); list_all2 P xs ys; list_all2 Q ys xs |]
      ==> xs = ys"
      apply (simp add: list_all2_conv_all_nth)
      apply (rule nth_equalityI, blast, simp)
      done

    lemma take_equalityI: "(∀i. take i xs = take i ys) ==> xs = ys"
    -- {* The famous take-lemma. *}
    apply (drule_tac x = "max (length xs) (length ys)" in spec)
    apply (simp add: le_max_iff_disj take_all)
    done

    lemma take_Cons':
         "take n (x # xs) = (if n = 0 then [] else x # take (n - 1) xs)"
    by (cases n) simp_all

    lemma drop_Cons':
         "drop n (x # xs) = (if n = 0 then x # xs else drop (n - 1) xs)"
    by (cases n) simp_all

    lemma nth_Cons': "(x # xs)!n = (if n = 0 then x else xs!(n - 1))"
    by (cases n) simp_all

    lemmas [simp] = take_Cons'[of "number_of v",standard]
                    drop_Cons'[of "number_of v",standard]
                    nth_Cons'[of _ _ "number_of v",standard]

    subsubsection {* @{text "distinct"} and @{text remdups} *}

    lemma distinct_append [simp]:
    "distinct (xs @ ys) = (distinct xs ∧ distinct ys ∧ set xs ∩ set ys = {})"
    by (induct xs) auto

    lemma distinct_rev[simp]: "distinct(rev xs) = distinct xs"
    by(induct xs) auto

    lemma set_remdups [simp]: "set (remdups xs) = set xs"
    by (induct xs) (auto simp add: insert_absorb)

    lemma distinct_remdups [iff]: "distinct (remdups xs)"
    by (induct xs) auto

    lemma remdups_eq_nil_iff [simp]: "(remdups x = []) = (x = [])"
      by (induct x, auto)

    lemma remdups_eq_nil_right_iff [simp]: "([] = remdups x) = (x = [])"
      by (induct x, auto)

    lemma length_remdups_leq[iff]: "length(remdups xs) <= length xs"
    by (induct xs) auto

    lemma length_remdups_eq[iff]:
      "(length (remdups xs) = length xs) = (remdups xs = xs)"
    apply(induct xs)
     apply auto
    apply(subgoal_tac "length (remdups xs) <= length xs")
     apply arith
    apply(rule length_remdups_leq)
    done

    lemma distinct_filter [simp]: "distinct xs ==> distinct (filter P xs)"
    by (induct xs) auto

    lemma distinct_map_filterI:
     "distinct(map f xs) ==> distinct(map f (filter P xs))"
    apply(induct xs)
     apply simp
    apply force
    done

    lemma distinct_upt[simp]: "distinct[i..<j]"
    by (induct j) auto

    lemma distinct_take[simp]: "!!i. distinct xs ==> distinct (take i xs)"
    apply(induct xs)
     apply simp
    apply (case_tac i)
     apply simp_all
    apply(blast dest:in_set_takeD)
    done

    lemma distinct_drop[simp]: "!!i. distinct xs ==> distinct (drop i xs)"
    apply(induct xs)
     apply simp
    apply (case_tac i)
     apply simp_all
    done

    lemma distinct_list_update:
    assumes d: "distinct xs" and a: "a ∉ set xs - {xs!i}"
    shows "distinct (xs[i:=a])"
    proof (cases "i < length xs")
      case True
      with a have "a ∉ set (take i xs @ xs ! i # drop (Suc i) xs) - {xs!i}"
        apply (drule_tac id_take_nth_drop) by simp
      with d True show ?thesis
        apply (simp add: upd_conv_take_nth_drop)
        apply (drule subst [OF id_take_nth_drop]) apply assumption
        apply simp apply (cases "a = xs!i") apply simp by blast
    next
      case False with d show ?thesis by auto
    qed

    text {* It is best to avoid this indexed version of distinct, but
    sometimes it is useful. *}

    lemma distinct_conv_nth:
    "distinct xs = (∀i < size xs. ∀j < size xs. i ≠ j --> xs!i ≠ xs!j)"
    apply (induct xs, simp, simp)
    apply (rule iffI, clarsimp)
     apply (case_tac i)
    apply (case_tac j, simp)
    apply (simp add: set_conv_nth)
     apply (case_tac j)
    apply (clarsimp simp add: set_conv_nth, simp)
    apply (rule conjI)
     apply (clarsimp simp add: set_conv_nth)
     apply (erule_tac x = 0 in allE, simp)
     apply (erule_tac x = "Suc i" in allE, simp, clarsimp)
    apply (erule_tac x = "Suc i" in allE, simp)
    apply (erule_tac x = "Suc j" in allE, simp)
    done

    lemma distinct_card: "distinct xs ==> card (set xs) = size xs"
      by (induct xs) auto

    lemma card_distinct: "card (set xs) = size xs ==> distinct xs"
    proof (induct xs)
      case Nil thus ?case by simp
    next
      case (Cons x xs)
      show ?case
      proof (cases "x ∈ set xs")
        case False with Cons show ?thesis by simp
      next
        case True with Cons.prems
        have "card (set xs) = Suc (length xs)"
          by (simp add: card_insert_if split: split_if_asm)
        moreover have "card (set xs) ≤ length xs" by (rule card_length)
        ultimately have False by simp
        thus ?thesis ..
      qed
    qed

    lemma inj_on_setI: "distinct(map f xs) ==> inj_on f (set xs)"
    apply(induct xs)
     apply simp
    apply fastsimp
    done

    lemma inj_on_set_conv:
     "distinct xs ==> inj_on f (set xs) = distinct(map f xs)"
    apply(induct xs)
     apply simp
    apply fastsimp
    done

    subsubsection {* @{text remove1} *}

    lemma set_remove1_subset: "set(remove1 x xs) <= set xs"
    apply(induct xs)
     apply simp
    apply simp
    apply blast
    done

    lemma set_remove1_eq [simp]: "distinct xs ==> set(remove1 x xs) = set xs - {x}"
    apply(induct xs)
     apply simp
    apply simp
    apply blast
    done

    lemma notin_set_remove1[simp]: "x ~: set xs ==> x ~: set(remove1 y xs)"
    apply(insert set_remove1_subset)
    apply fast
    done

    lemma distinct_remove1[simp]: "distinct xs ==> distinct(remove1 x xs)"
    by (induct xs) simp_all

    subsubsection {* @{text replicate} *}

    lemma length_replicate [simp]: "length (replicate n x) = n"
    by (induct n) auto

    lemma map_replicate [simp]: "map f (replicate n x) = replicate n (f x)"
    by (induct n) auto

    lemma replicate_app_Cons_same:
    "(replicate n x) @ (x # xs) = x # replicate n x @ xs"
    by (induct n) auto

    lemma rev_replicate [simp]: "rev (replicate n x) = replicate n x"
    apply (induct n, simp)
    apply (simp add: replicate_app_Cons_same)
    done

    lemma replicate_add: "replicate (n + m) x = replicate n x @ replicate m x"
    by (induct n) auto

    text{* Courtesy of Matthias Daum: *}
    lemma append_replicate_commute:
      "replicate n x @ replicate k x = replicate k x @ replicate n x"
    apply (simp add: replicate_add [THEN sym])
    apply (simp add: add_commute)
    done

    lemma hd_replicate [simp]: "n ≠ 0 ==> hd (replicate n x) = x"
    by (induct n) auto

    lemma tl_replicate [simp]: "n ≠ 0 ==> tl (replicate n x) = replicate (n - 1) x"
    by (induct n) auto

    lemma last_replicate [simp]: "n ≠ 0 ==> last (replicate n x) = x"
    by (atomize (full), induct n) auto

    lemma nth_replicate[simp]: "!!i. i < n ==> (replicate n x)!i = x"
    apply (induct n, simp)
    apply (simp add: nth_Cons split: nat.split)
    done

    text{* Courtesy of Matthias Daum (2 lemmas): *}
    lemma take_replicate[simp]: "take i (replicate k x) = replicate (min i k) x"
    apply (case_tac "k ≤ i")
     apply  (simp add: min_def)
    apply (drule not_leE)
    apply (simp add: min_def)
    apply (subgoal_tac "replicate k x = replicate i x @ replicate (k - i) x")
     apply  simp
    apply (simp add: replicate_add [symmetric])
    done

    lemma drop_replicate[simp]: "!!i. drop i (replicate k x) = replicate (k-i) x"
    apply (induct k)
     apply simp
    apply clarsimp
    apply (case_tac i)
     apply simp
    apply clarsimp
    done

    lemma set_replicate_Suc: "set (replicate (Suc n) x) = {x}"
    by (induct n) auto

    lemma set_replicate [simp]: "n ≠ 0 ==> set (replicate n x) = {x}"
    by (fast dest!: not0_implies_Suc intro!: set_replicate_Suc)

    lemma set_replicate_conv_if: "set (replicate n x) = (if n = 0 then {} else {x})"
    by auto

    lemma in_set_replicateD: "x : set (replicate n y) ==> x = y"
    by (simp add: set_replicate_conv_if split: split_if_asm)

    subsubsection{*@{text rotate1} and @{text rotate}*}

    lemma rotate_simps[simp]: "rotate1 [] = [] ∧ rotate1 (x#xs) = xs @ [x]"
    by(simp add:rotate1_def)

    lemma rotate0[simp]: "rotate 0 = id"
    by(simp add:rotate_def)

    lemma rotate_Suc[simp]: "rotate (Suc n) xs = rotate1(rotate n xs)"
    by(simp add:rotate_def)

    lemma rotate_add:
      "rotate (m+n) = rotate m o rotate n"
    by(simp add:rotate_def funpow_add)

    lemma rotate_rotate: "rotate m (rotate n xs) = rotate (m+n) xs"
    by(simp add:rotate_add)

    lemma rotate1_length01[simp]: "length xs <= 1 ==> rotate1 xs = xs"
    by(cases xs) simp_all

    lemma rotate_length01[simp]: "length xs <= 1 ==> rotate n xs = xs"
    apply(induct n)
     apply simp
    apply (simp add:rotate_def)
    done

    lemma rotate1_hd_tl: "xs ≠ [] ==> rotate1 xs = tl xs @ [hd xs]"
    by(simp add:rotate1_def split:list.split)

    lemma rotate_drop_take:
      "rotate n xs = drop (n mod length xs) xs @ take (n mod length xs) xs"
    apply(induct n)
     apply simp
    apply(simp add:rotate_def)
    apply(cases "xs = []")
     apply (simp)
    apply(case_tac "n mod length xs = 0")
     apply(simp add:mod_Suc)
     apply(simp add: rotate1_hd_tl drop_Suc take_Suc)
    apply(simp add:mod_Suc rotate1_hd_tl drop_Suc[symmetric] drop_tl[symmetric]
                    take_hd_drop linorder_not_le)
    done

    lemma rotate_conv_mod: "rotate n xs = rotate (n mod length xs) xs"
    by(simp add:rotate_drop_take)

    lemma rotate_id[simp]: "n mod length xs = 0 ==> rotate n xs = xs"
    by(simp add:rotate_drop_take)

    lemma length_rotate1[simp]: "length(rotate1 xs) = length xs"
    by(simp add:rotate1_def split:list.split)

    lemma length_rotate[simp]: "!!xs. length(rotate n xs) = length xs"
    by (induct n) (simp_all add:rotate_def)

    lemma distinct1_rotate[simp]: "distinct(rotate1 xs) = distinct xs"
    by(simp add:rotate1_def split:list.split) blast

    lemma distinct_rotate[simp]: "distinct(rotate n xs) = distinct xs"
    by (induct n) (simp_all add:rotate_def)

    lemma rotate_map: "rotate n (map f xs) = map f (rotate n xs)"
    by(simp add:rotate_drop_take take_map drop_map)

    lemma set_rotate1[simp]: "set(rotate1 xs) = set xs"
    by(simp add:rotate1_def split:list.split)

    lemma set_rotate[simp]: "set(rotate n xs) = set xs"
    by (induct n) (simp_all add:rotate_def)

    lemma rotate1_is_Nil_conv[simp]: "(rotate1 xs = []) = (xs = [])"
    by(simp add:rotate1_def split:list.split)

    lemma rotate_is_Nil_conv[simp]: "(rotate n xs = []) = (xs = [])"
    by (induct n) (simp_all add:rotate_def)

    lemma rotate_rev:
      "rotate n (rev xs) = rev(rotate (length xs - (n mod length xs)) xs)"
    apply(simp add:rotate_drop_take rev_drop rev_take)
    apply(cases "length xs = 0")
     apply simp
    apply(cases "n mod length xs = 0")
     apply simp
    apply(simp add:rotate_drop_take rev_drop rev_take)
    done

    subsubsection {* @{text sublist} --- a generalization of @{text nth} to sets *}

    lemma sublist_empty [simp]: "sublist xs {} = []"
    by (auto simp add: sublist_def)

    lemma sublist_nil [simp]: "sublist [] A = []"
    by (auto simp add: sublist_def)

    lemma length_sublist:
      "length(sublist xs I) = card{i. i < length xs ∧ i : I}"
    by(simp add: sublist_def length_filter_conv_card cong:conj_cong)

    lemma sublist_shift_lemma_Suc:
      "!!is. map fst (filter (%p. P(Suc(snd p))) (zip xs is)) =
             map fst (filter (%p. P(snd p)) (zip xs (map Suc is)))"
    apply(induct xs)
     apply simp
    apply (case_tac "is")
     apply simp
    apply simp
    done

    lemma sublist_shift_lemma:
         "map fst [p:zip xs [i..<i + length xs] . snd p : A] =
          map fst [p:zip xs [0..<length xs] . snd p + i : A]"
    by (induct xs rule: rev_induct) (simp_all add: add_commute)

    lemma sublist_append:
         "sublist (l @ l') A = sublist l A @ sublist l' {j. j + length l : A}"
    apply (unfold sublist_def)
    apply (induct l' rule: rev_induct, simp)
    apply (simp add: upt_add_eq_append[of 0] zip_append sublist_shift_lemma)
    apply (simp add: add_commute)
    done

    lemma sublist_Cons:
    "sublist (x # l) A = (if 0:A then [x] else []) @ sublist l {j. Suc j : A}"
    apply (induct l rule: rev_induct)
     apply (simp add: sublist_def)
    apply (simp del: append_Cons add: append_Cons[symmetric] sublist_append)
    done

    lemma set_sublist: "!!I. set(sublist xs I) = {xs!i|i. i<size xs ∧ i ∈ I}"
    apply(induct xs)
     apply simp
    apply(auto simp add:sublist_Cons nth_Cons split:nat.split elim: lessE)
     apply(erule lessE)
      apply auto
    apply(erule lessE)
    apply auto
    done

    lemma set_sublist_subset: "set(sublist xs I) ⊆ set xs"
    by(auto simp add:set_sublist)

    lemma notin_set_sublistI[simp]: "x ∉ set xs ==> x ∉ set(sublist xs I)"
    by(auto simp add:set_sublist)

    lemma in_set_sublistD: "x ∈ set(sublist xs I) ==> x ∈ set xs"
    by(auto simp add:set_sublist)

    lemma sublist_singleton [simp]: "sublist [x] A = (if 0 : A then [x] else [])"
    by (simp add: sublist_Cons)

    lemma distinct_sublistI[simp]: "!!I. distinct xs ==> distinct(sublist xs I)"
    apply(induct xs)
     apply simp
    apply(auto simp add:sublist_Cons)
    done

    lemma sublist_upt_eq_take [simp]: "sublist l {..<n} = take n l"
    apply (induct l rule: rev_induct, simp)
    apply (simp split: nat_diff_split add: sublist_append)
    done

    lemma filter_in_sublist: "!!s. distinct xs ==>
      filter (%x. x ∈ set(sublist xs s)) xs = sublist xs s"
    proof (induct xs)
      case Nil thus ?case by simp
    next
      case (Cons a xs)
      moreover hence "!x. x: set xs --> x ≠ a" by auto
      ultimately show ?case by(simp add: sublist_Cons cong:filter_cong)
    qed

    subsubsection{*Sets of Lists*}

    subsubsection {* @{text lists}: the list-forming operator over sets *}

    consts lists :: "'a set => 'a list set"
    inductive "lists A"
     intros
      Nil [intro!]: "[]: lists A"
      Cons [intro!]: "[| a: A;l: lists A|] ==> a#l : lists A"

    inductive_cases listsE [elim!]: "x#l : lists A"

    lemma lists_mono [mono]: "A ⊆ B ==> lists A ⊆ lists B"
    by (unfold lists.defs) (blast intro!: lfp_mono)

    lemma lists_IntI:
      assumes l: "l: lists A" shows "l: lists B ==> l: lists (A Int B)" using l
      by induct blast+

    lemma lists_Int_eq [simp]: "lists (A ∩ B) = lists A ∩ lists B"
    proof (rule mono_Int [THEN equalityI])
      show "mono lists" by (simp add: mono_def lists_mono)
      show "lists A ∩ lists B ⊆ lists (A ∩ B)" by (blast intro: lists_IntI)
    qed

    lemma append_in_lists_conv [iff]:
         "(xs @ ys : lists A) = (xs : lists A ∧ ys : lists A)"
    by (induct xs) auto

    lemma in_lists_conv_set: "(xs : lists A) = (∀x ∈ set xs. x : A)"
    -- {* eliminate @{text lists} in favour of @{text set} *}
    by (induct xs) auto

    lemma in_listsD [dest!]: "xs ∈ lists A ==> ∀x∈set xs. x ∈ A"
    by (rule in_lists_conv_set [THEN iffD1])

    lemma in_listsI [intro!]: "∀x∈set xs. x ∈ A ==> xs ∈ lists A"
    by (rule in_lists_conv_set [THEN iffD2])

    lemma lists_UNIV [simp]: "lists UNIV = UNIV"
    by auto

    subsubsection {* For efficiency *}

    text{* Only use @{text mem} for generating executable code.  Otherwise
    use @{prop"x : set xs"} instead --- it is much easier to reason about.
    The same is true for @{const list_all} and @{const list_ex}: write
    @{text"∀x∈set xs"} and @{text"∃x∈set xs"} instead because the HOL
    quantifiers are aleady known to the automatic provers. In fact, the declarations in the Code subsection make sure that @{text"∈"}, @{text"∀x∈set xs"}
    and @{text"∃x∈set xs"} are implemented efficiently.

    The functions @{const itrev}, @{const filtermap} and @{const
    map_filter} are just there to generate efficient code. Do not use them
    for modelling and proving. *}

    lemma mem_iff: "(x mem xs) = (x : set xs)"
    by (induct xs) auto

    lemma list_inter_conv: "set(list_inter xs ys) = set xs ∩ set ys"
    by (induct xs) auto

    lemma list_all_iff: "list_all P xs = (∀x ∈ set xs. P x)"
    by (induct xs) auto

    lemma list_all_append [simp]:
    "list_all P (xs @ ys) = (list_all P xs ∧ list_all P ys)"
    by (induct xs) auto

    lemma list_all_rev [simp]: "list_all P (rev xs) = list_all P xs"
    by (simp add: list_all_iff)

    lemma list_ex_iff: "list_ex P xs = (∃x ∈ set xs. P x)"
    by (induct xs) simp_all

    lemma itrev[simp]: "ALL ys. itrev xs ys = rev xs @ ys"
    by (induct xs) simp_all

    lemma filtermap_conv:
     "filtermap f xs = map (%x. the(f x)) (filter (%x. f x ≠ None) xs)"
    by (induct xs) auto

    lemma map_filter_conv[simp]: "map_filter f P xs = map f (filter P xs)"
    by (induct xs) auto

    subsubsection {* Code generation *}

    text{* Defaults for generating efficient code for some standard functions. *}

    lemmas in_set_code[code unfold] = mem_iff[symmetric, THEN eq_reflection]

    lemma rev_code[code unfold]: "rev xs == itrev xs []"
    by simp

    lemma distinct_Cons_mem[code]: "distinct (x#xs) = (~(x mem xs) ∧ distinct xs)"
    by (simp add:mem_iff)

    lemma remdups_Cons_mem[code]:
     "remdups (x#xs) = (if x mem xs then remdups xs else x # remdups xs)"
    by (simp add:mem_iff)

    lemma list_inter_Cons_mem[code]:  "list_inter (a#as) bs =
      (if a mem bs then a#(list_inter as bs) else list_inter as bs)"
    by(simp add:mem_iff)

    text{* For implementing bounded quantifiers over lists by
    @{const list_ex}/@{const list_all}: *}

    lemmas list_bex_code[code unfold] = list_ex_iff[symmetric, THEN eq_reflection]
    lemmas list_ball_code[code unfold] = list_all_iff[symmetric, THEN eq_reflection]

    subsubsection{* Inductive definition for membership *}

    consts ListMem :: "('a × 'a list)set"
    inductive ListMem
    intros
     elem:  "(x,x#xs) ∈ ListMem"
     insert:  "(x,xs) ∈ ListMem ==> (x,y#xs) ∈ ListMem"

    lemma ListMem_iff: "((x,xs) ∈ ListMem) = (x ∈ set xs)"
    apply (rule iffI)
     apply (induct set: ListMem)
      apply auto
    apply (induct xs)
     apply (auto intro: ListMem.intros)
    done

    subsubsection{*Lists as Cartesian products*}

    text{*@{text"set_Cons A Xs"}: the set of lists with head drawn from
    @{term A} and tail drawn from @{term Xs}.*}

    constdefs
      set_Cons :: "'a set => 'a list set => 'a list set"
      "set_Cons A XS == {z. ∃x xs. z = x#xs & x ∈ A & xs ∈ XS}"

    lemma set_Cons_sing_Nil [simp]: "set_Cons A {[]} = (%x. [x])`A"
    by (auto simp add: set_Cons_def)

    text{*Yields the set of lists, all of the same length as the argument and
    with elements drawn from the corresponding element of the argument.*}

    consts  listset :: "'a set list => 'a list set"
    primrec
       "listset []    = {[]}"
       "listset(A#As) = set_Cons A (listset As)"

    subsection{*Relations on Lists*}

    subsubsection {* Length Lexicographic Ordering *}

    text{*These orderings preserve well-foundedness: shorter lists
      precede longer lists. These ordering are not used in dictionaries.*}

    consts lexn :: "('a * 'a)set => nat => ('a list * 'a list)set"
            --{*The lexicographic ordering for lists of the specified length*}
    primrec
      "lexn r 0 = {}"
      "lexn r (Suc n) =
        (prod_fun (%(x,xs). x#xs) (%(x,xs). x#xs) ` (r <*lex*> lexn r n)) Int
        {(xs,ys). length xs = Suc n ∧ length ys = Suc n}"

    constdefs
      lex :: "('a × 'a) set => ('a list × 'a list) set"
        "lex r == \<Union>n. lexn r n"
            --{*Holds only between lists of the same length*}

      lenlex :: "('a × 'a) set => ('a list × 'a list) set"
        "lenlex r == inv_image (less_than <*lex*> lex r) (%xs. (length xs, xs))"
            --{*Compares lists by their length and then lexicographically*}

    lemma wf_lexn: "wf r ==> wf (lexn r n)"
    apply (induct n, simp, simp)
    apply(rule wf_subset)
     prefer 2 apply (rule Int_lower1)
    apply(rule wf_prod_fun_image)
     prefer 2 apply (rule inj_onI, auto)
    done

    lemma lexn_length:
         "!!xs ys. (xs, ys) : lexn r n ==> length xs = n ∧ length ys = n"
    by (induct n) auto

    lemma wf_lex [intro!]: "wf r ==> wf (lex r)"
    apply (unfold lex_def)
    apply (rule wf_UN)
    apply (blast intro: wf_lexn, clarify)
    apply (rename_tac m n)
    apply (subgoal_tac "m ≠ n")
     prefer 2 apply blast
    apply (blast dest: lexn_length not_sym)
    done

    lemma lexn_conv:
      "lexn r n =
        {(xs,ys). length xs = n ∧ length ys = n ∧
        (∃xys x y xs' ys'. xs= xys @ x#xs' ∧ ys= xys @ y # ys' ∧ (x, y):r)}"
    apply (induct n, simp, blast)
    apply (simp add: image_Collect lex_prod_def, safe, blast)
     apply (rule_tac x = "ab # xys" in exI, simp)
    apply (case_tac xys, simp_all, blast)
    done

    lemma lex_conv:
      "lex r =
        {(xs,ys). length xs = length ys ∧
        (∃xys x y xs' ys'. xs = xys @ x # xs' ∧ ys = xys @ y # ys' ∧ (x, y):r)}"
    by (force simp add: lex_def lexn_conv)

    lemma wf_lenlex [intro!]: "wf r ==> wf (lenlex r)"
    by (unfold lenlex_def) blast

    lemma lenlex_conv:
        "lenlex r = {(xs,ys). length xs < length ys |
                     length xs = length ys ∧ (xs, ys) : lex r}"
    by (simp add: lenlex_def diag_def lex_prod_def measure_def inv_image_def)

    lemma Nil_notin_lex [iff]: "([], ys) ∉ lex r"
    by (simp add: lex_conv)

    lemma Nil2_notin_lex [iff]: "(xs, []) ∉ lex r"
    by (simp add:lex_conv)

    lemma Cons_in_lex [iff]:
        "((x # xs, y # ys) : lex r) =
          ((x, y) : r ∧ length xs = length ys | x = y ∧ (xs, ys) : lex r)"
    apply (simp add: lex_conv)
    apply (rule iffI)
     prefer 2 apply (blast intro: Cons_eq_appendI, clarify)
    apply (case_tac xys, simp, simp)
    apply blast
    done

    subsubsection {* Lexicographic Ordering *}

    text {* Classical lexicographic ordering on lists, ie. "a" < "ab" < "b".
        This ordering does \emph{not} preserve well-foundedness.
         Author: N. Voelker, March 2005. *}

    constdefs
      lexord :: "('a * 'a)set => ('a list * 'a list) set"
      "lexord  r == {(x,y). ∃ a v. y = x @ a # v ∨
                (∃ u a b v w. (a,b) ∈ r ∧ x = u @ (a # v) ∧ y = u @ (b # w))}"

    lemma lexord_Nil_left[simp]:  "([],y) ∈ lexord r = (∃ a x. y = a # x)"
      by (unfold lexord_def, induct_tac y, auto)

    lemma lexord_Nil_right[simp]: "(x,[]) ∉ lexord r"
      by (unfold lexord_def, induct_tac x, auto)

    lemma lexord_cons_cons[simp]:
         "((a # x, b # y) ∈ lexord r) = ((a,b)∈ r | (a = b & (x,y)∈ lexord r))"
      apply (unfold lexord_def, safe, simp_all)
      apply (case_tac u, simp, simp)
      apply (case_tac u, simp, clarsimp, blast, blast, clarsimp)
      apply (erule_tac x="b # u" in allE)
      by force

    lemmas lexord_simps = lexord_Nil_left lexord_Nil_right lexord_cons_cons

    lemma lexord_append_rightI: "∃ b z. y = b # z ==> (x, x @ y) ∈ lexord r"
      by (induct_tac x, auto)

    lemma lexord_append_left_rightI:
         "(a,b) ∈ r ==> (u @ a # x, u @ b # y) ∈ lexord r"
      by (induct_tac u, auto)

    lemma lexord_append_leftI: " (u,v) ∈ lexord r ==> (x @ u, x @ v) ∈ lexord r"
      by (induct x, auto)

    lemma lexord_append_leftD:
         "[| (x @ u, x @ v) ∈ lexord r; (! a. (a,a) ∉ r) |] ==> (u,v) ∈ lexord r"
      by (erule rev_mp, induct_tac x, auto)

    lemma lexord_take_index_conv:
       "((x,y) : lexord r) =
        ((length x < length y ∧ take (length x) y = x) ∨
         (∃i. i < min(length x)(length y) & take i x = take i y & (x!i,y!i) ∈ r))"
      apply (unfold lexord_def Let_def, clarsimp)
      apply (rule_tac f = "(% a b. a ∨ b)" in arg_cong2)
      apply auto
      apply (rule_tac x="hd (drop (length x) y)" in exI)
      apply (rule_tac x="tl (drop (length x) y)" in exI)
      apply (erule subst, simp add: min_def)
      apply (rule_tac x ="length u" in exI, simp)
      apply (rule_tac x ="take i x" in exI)
      apply (rule_tac x ="x ! i" in exI)
      apply (rule_tac x ="y ! i" in exI, safe)
      apply (rule_tac x="drop (Suc i) x" in exI)
      apply (drule sym, simp add: drop_Suc_conv_tl)
      apply (rule_tac x="drop (Suc i) y" in exI)
      by (simp add: drop_Suc_conv_tl)

    -- {* lexord is extension of partial ordering List.lex *}
    lemma lexord_lex: " (x,y) ∈ lex r = ((x,y) ∈ lexord r ∧ length x = length y)"
      apply (rule_tac x = y in spec)
      apply (induct_tac x, clarsimp)
      by (clarify, case_tac x, simp, force)

    lemma lexord_irreflexive: "(! x. (x,x) ∉ r) ==> (y,y) ∉ lexord r"
      by (induct y, auto)

    lemma lexord_trans:
        "[| (x, y) ∈ lexord r; (y, z) ∈ lexord r; trans r |] ==> (x, z) ∈ lexord r"
       apply (erule rev_mp)+
       apply (rule_tac x = x in spec)
      apply (rule_tac x = z in spec)
      apply ( induct_tac y, simp, clarify)
      apply (case_tac xa, erule ssubst)
      apply (erule allE, erule allE) -- {* avoid simp recursion *}
      apply (case_tac x, simp, simp)
      apply (case_tac x, erule allE, erule allE, simp)
      apply (erule_tac x = listb in allE)
      apply (erule_tac x = lista in allE, simp)
      apply (unfold trans_def)
      by blast

    lemma lexord_transI:  "trans r ==> trans (lexord r)"
      by (rule transI, drule lexord_trans, blast)

    lemma lexord_linear: "(! a b. (a,b)∈ r | a = b | (b,a) ∈ r) ==> (x,y) : lexord r | x = y | (y,x) : lexord r"
      apply (rule_tac x = y in spec)
      apply (induct_tac x, rule allI)
      apply (case_tac x, simp, simp)
      apply (rule allI, case_tac x, simp, simp)
      by blast

    subsubsection{*Lifting a Relation on List Elements to the Lists*}

    consts  listrel :: "('a * 'a)set => ('a list * 'a list)set"

    inductive "listrel(r)"
     intros
       Nil:  "([],[]) ∈ listrel r"
       Cons: "[| (x,y) ∈ r; (xs,ys) ∈ listrel r |] ==> (x#xs, y#ys) ∈ listrel r"

    inductive_cases listrel_Nil1 [elim!]: "([],xs) ∈ listrel r"
    inductive_cases listrel_Nil2 [elim!]: "(xs,[]) ∈ listrel r"
    inductive_cases listrel_Cons1 [elim!]: "(y#ys,xs) ∈ listrel r"
    inductive_cases listrel_Cons2 [elim!]: "(xs,y#ys) ∈ listrel r"

    lemma listrel_mono: "r ⊆ s ==> listrel r ⊆ listrel s"
    apply clarify
    apply (erule listrel.induct)
    apply (blast intro: listrel.intros)+
    done

    lemma listrel_subset: "r ⊆ A × A ==> listrel r ⊆ lists A × lists A"
    apply clarify
    apply (erule listrel.induct, auto)
    done

    lemma listrel_refl: "refl A r ==> refl (lists A) (listrel r)"
    apply (simp add: refl_def listrel_subset Ball_def)
    apply (rule allI)
    apply (induct_tac x)
    apply (auto intro: listrel.intros)
    done

    lemma listrel_sym: "sym r ==> sym (listrel r)"
    apply (auto simp add: sym_def)
    apply (erule listrel.induct)
    apply (blast intro: listrel.intros)+
    done

    lemma listrel_trans: "trans r ==> trans (listrel r)"
    apply (simp add: trans_def)
    apply (intro allI)
    apply (rule impI)
    apply (erule listrel.induct)
    apply (blast intro: listrel.intros)+
    done

    theorem equiv_listrel: "equiv A r ==> equiv (lists A) (listrel r)"
    by (simp add: equiv_def listrel_refl listrel_sym listrel_trans)

    lemma listrel_Nil [simp]: "listrel r `` {[]} = {[]}"
    by (blast intro: listrel.intros)

    lemma listrel_Cons:
         "listrel r `` {x#xs} = set_Cons (r``{x}) (listrel r `` {xs})";
    by (auto simp add: set_Cons_def intro: listrel.intros)

    subsection{*Miscellany*}

    subsubsection {* Characters and strings *}

    datatype nibble =
        Nibble0 | Nibble1 | Nibble2 | Nibble3 | Nibble4 | Nibble5 | Nibble6 | Nibble7
      | Nibble8 | Nibble9 | NibbleA | NibbleB | NibbleC | NibbleD | NibbleE | NibbleF

    datatype char = Char nibble nibble
      -- "Note: canonical order of character encoding coincides with standard term ordering"

    types string = "char list"

    syntax
      "_Char" :: "xstr => char"    ("CHR _")
      "_String" :: "xstr => string"    ("_")

    parse_ast_translation {*
      let
        val constants = Syntax.Appl o map Syntax.Constant;

        fun mk_nib n = "Nibble" ^ chr (n + (if n <= 9 then ord "0" else ord "A" - 10));
        fun mk_char c =
          if Symbol.is_ascii c andalso Symbol.is_printable c then
            constants ["Char", mk_nib (ord c div 16), mk_nib (ord c mod 16)]
          else error ("Printable ASCII character expected: " ^ quote c);

        fun mk_string [] = Syntax.Constant "Nil"
          | mk_string (c :: cs) = Syntax.Appl [Syntax.Constant "Cons", mk_char c, mk_string cs];

        fun char_ast_tr [Syntax.Variable xstr] =
            (case Syntax.explode_xstr xstr of
              [c] => mk_char c
            | _ => error ("Single character expected: " ^ xstr))
          | char_ast_tr asts = raise AST ("char_ast_tr", asts);

        fun string_ast_tr [Syntax.Variable xstr] =
            (case Syntax.explode_xstr xstr of
              [] => constants [Syntax.constrainC, "Nil", "string"]
            | cs => mk_string cs)
          | string_ast_tr asts = raise AST ("string_tr", asts);
      in [("_Char", char_ast_tr), ("_String", string_ast_tr)] end;
    *}

    ML {*
    fun int_of_nibble h =
      if "0" <= h andalso h <= "9" then ord h - ord "0"
      else if "A" <= h andalso h <= "F" then ord h - ord "A" + 10
      else raise Match;

    fun nibble_of_int i =
      if i <= 9 then chr (ord "0" + i) else chr (ord "A" + i - 10);
    *}

    print_ast_translation {*
      let
        fun dest_nib (Syntax.Constant c) =
            (case explode c of
              ["N", "i", "b", "b", "l", "e", h] => int_of_nibble h
            | _ => raise Match)
          | dest_nib _ = raise Match;

        fun dest_chr c1 c2 =
          let val c = chr (dest_nib c1 * 16 + dest_nib c2)
          in if Symbol.is_printable c then c else raise Match end;

        fun dest_char (Syntax.Appl [Syntax.Constant "Char", c1, c2]) = dest_chr c1 c2
          | dest_char _ = raise Match;

        fun xstr cs = Syntax.Appl [Syntax.Constant "_xstr", Syntax.Variable (Syntax.implode_xstr cs)];

        fun char_ast_tr' [c1, c2] = Syntax.Appl [Syntax.Constant "_Char", xstr [dest_chr c1 c2]]
          | char_ast_tr' _ = raise Match;

        fun list_ast_tr' [args] = Syntax.Appl [Syntax.Constant "_String",
                xstr (map dest_char (Syntax.unfold_ast "_args" args))]
          | list_ast_tr' ts = raise Match;
      in [("Char", char_ast_tr'), ("@list", list_ast_tr')] end;
    *}

    subsubsection {* Code generator setup *}

    ML {*
    local

    fun list_codegen thy defs gr dep thyname b t =
      let val (gr', ps) = foldl_map (Codegen.invoke_codegen thy defs dep thyname false)
        (gr, HOLogic.dest_list t)
      in SOME (gr', Pretty.list "[" "]" ps) end handle TERM _ => NONE;

    fun dest_nibble (Const (s, _)) = int_of_nibble (unprefix "List.nibble.Nibble" s)
      | dest_nibble _ = raise Match;

    fun char_codegen thy defs gr dep thyname b (Const ("List.char.Char", _) $ c1 $ c2) =
        (let val c = chr (dest_nibble c1 * 16 + dest_nibble c2)
         in if Symbol.is_printable c then SOME (gr, Pretty.quote (Pretty.str c))
           else NONE
         end handle Fail _ => NONE | Match => NONE)
      | char_codegen thy defs gr dep thyname b _ = NONE;

    in

    val list_codegen_setup =
      [Codegen.add_codegen "list_codegen" list_codegen,
       Codegen.add_codegen "char_codegen" char_codegen];

    end;
    *}

    types_code
      "list" ("_ list")
    attach (term_of) {*
    val term_of_list = HOLogic.mk_list;
    *}
    attach (test) {*
    fun gen_list' aG i j = frequency
      [(i, fn () => aG j :: gen_list' aG (i-1) j), (1, fn () => [])] ()
    and gen_list aG i = gen_list' aG i i;
    *}
      "char" ("string")
    attach (term_of) {*
    val nibbleT = Type ("List.nibble", []);

    fun term_of_char c =
      Const ("List.char.Char", nibbleT --> nibbleT --> Type ("List.char", [])) $
        Const ("List.nibble.Nibble" ^ nibble_of_int (ord c div 16), nibbleT) $
        Const ("List.nibble.Nibble" ^ nibble_of_int (ord c mod 16), nibbleT);
    *}
    attach (test) {*
    fun gen_char i = chr (random_range (ord "a") (Int.min (ord "a" + i, ord "z")));
    *}

    consts_code "Cons" ("(_ ::/ _)")

    setup list_codegen_setup

    end

### Basic list processing functions

lemma not_Cons_self:

      xs ≠ x # xs

lemmas not_Cons_self2:

      x1 # t ≠ t

lemmas not_Cons_self2:

      x1 # t ≠ t

lemma neq_Nil_conv:

      (xs ≠ []) = (∃y ys. xs = y # ys)

lemma length_induct:

      (!!xs. ∀ys. length ys < length xs --> P ys ==> P xs) ==> P xs

#### @{text length}

lemma length_append:

      length (xs @ ys) = length xs + length ys

lemma length_map:

      length (map f xs) = length xs

lemma length_rev:

      length (rev xs) = length xs

lemma length_tl:

      length (tl xs) = length xs - 1

lemma length_0_conv:

      (length xs = 0) = (xs = [])

lemma length_greater_0_conv:

      (0 < length xs) = (xs ≠ [])

lemma length_Suc_conv:

      (length xs = Suc n) = (∃y ys. xs = y # ys ∧ length ys = n)

lemma Suc_length_conv:

      (Suc n = length xs) = (∃y ys. xs = y # ys ∧ length ys = n)

lemma impossible_Cons:

      length xs ≤ length ys ==> (xs = x # ys) = False

lemma list_induct2:

      [| length xs = length ys; P [] [];
         !!x xs y ys. [| length xs = length ys; P xs ys |] ==> P (x # xs) (y # ys) |]
      ==> P xs ys

#### @{text "@"} -- append

lemma append_assoc:

      (xs @ ys) @ zs = xs @ ys @ zs

lemma append_Nil2:

      xs @ [] = xs

lemma append_is_Nil_conv:

      (xs @ ys = []) = (xs = [] ∧ ys = [])

lemma Nil_is_append_conv:

      ([] = xs @ ys) = (xs = [] ∧ ys = [])

lemma append_self_conv:

      (xs @ ys = xs) = (ys = [])

lemma self_append_conv:

      (xs = xs @ ys) = (ys = [])

lemma append_eq_append_conv:

      length xs = length ys ∨ length us = length vs
      ==> (xs @ us = ys @ vs) = (xs = ys ∧ us = vs)

lemma append_eq_append_conv2:

      (xs @ ys = zs @ ts) =
      (∃us. xs = zs @ us ∧ us @ ys = ts ∨ xs @ us = zs ∧ ys = us @ ts)

lemma same_append_eq:

      (xs @ ys = xs @ zs) = (ys = zs)

lemma append1_eq_conv:

      (xs @ [x] = ys @ [y]) = (xs = ys ∧ x = y)

lemma append_same_eq:

      (ys @ xs = zs @ xs) = (ys = zs)

lemma append_self_conv2:

      (xs @ ys = ys) = (xs = [])

lemma self_append_conv2:

      (ys = xs @ ys) = (xs = [])

lemma hd_Cons_tl:

      xs ≠ [] ==> hd xs # tl xs = xs

lemma hd_append:

      hd (xs @ ys) = (if xs = [] then hd ys else hd xs)

lemma hd_append2:

      xs ≠ [] ==> hd (xs @ ys) = hd xs

lemma tl_append:

      tl (xs @ ys) = (case xs of [] => tl ys | z # zs => zs @ ys)

lemma tl_append2:

      xs ≠ [] ==> tl (xs @ ys) = tl xs @ ys

lemma Cons_eq_append_conv:

      (x # xs = ys @ zs) =
      (ys = [] ∧ x # xs = zs ∨ (∃ys'. x # ys' = ys ∧ xs = ys' @ zs))

lemma append_eq_Cons_conv:

      (ys @ zs = x # xs) =
      (ys = [] ∧ zs = x # xs ∨ (∃ys'. ys = x # ys' ∧ ys' @ zs = xs))

lemma eq_Nil_appendI:

      xs = ys ==> xs = [] @ ys

lemma Cons_eq_appendI:

      [| x # xs1.0 = ys; xs = xs1.0 @ zs |] ==> x # xs = ys @ zs

lemma append_eq_appendI:

      [| xs @ xs1.0 = zs; ys = xs1.0 @ us |] ==> xs @ ys = zs @ us

#### @{text map}

lemma map_ext:

      (!!x. x ∈ set xs --> f x = g x) ==> map f xs = map g xs

lemma map_ident:

      map (%x. x) = (%xs. xs)

lemma map_append:

      map f (xs @ ys) = map f xs @ map f ys

lemma map_compose:

      map (f o g) xs = map f (map g xs)

lemma rev_map:

      rev (map f xs) = map f (rev xs)

lemma map_eq_conv:

      (map f xs = map g xs) = (∀x∈set xs. f x = g x)

lemma map_cong:

      [| xs = ys; !!x. x ∈ set ys ==> f x = g x |] ==> map f xs = map g ys

lemma map_is_Nil_conv:

      (map f xs = []) = (xs = [])

lemma Nil_is_map_conv:

      ([] = map f xs) = (xs = [])

lemma map_eq_Cons_conv:

      (map f xs = y # ys) = (∃z zs. xs = z # zs ∧ f z = y ∧ map f zs = ys)

lemma Cons_eq_map_conv:

      (x # xs = map f ys) = (∃z zs. ys = z # zs ∧ x = f z ∧ xs = map f zs)

lemma ex_map_conv:

      (∃xs. ys = map f xs) = (∀y∈set ys. ∃x. y = f x)

lemma map_eq_imp_length_eq:

      map f xs = map f ys ==> length xs = length ys

lemma map_inj_on:

      [| map f xs = map f ys; inj_on f (set xs ∪ set ys) |] ==> xs = ys

lemma inj_on_map_eq_map:

      inj_on f (set xs ∪ set ys) ==> (map f xs = map f ys) = (xs = ys)

lemma map_injective:

      [| map f xs = map f ys; inj f |] ==> xs = ys

lemma inj_map_eq_map:

      inj f ==> (map f xs = map f ys) = (xs = ys)

lemma inj_mapI:

      inj f ==> inj (map f)

lemma inj_mapD:

      inj (map f) ==> inj f

lemma inj_map:

      inj (map f) = inj f

lemma inj_on_mapI:

      inj_on f (Union (set ` A)) ==> inj_on (map f) A

lemma map_idI:

      (!!x. x ∈ set xs ==> f x = x) ==> map f xs = xs

lemma map_fun_upd:

      y ∉ set xs ==> map (f(y := v)) xs = map f xs

lemma map_fst_zip:

      length xs = length ys ==> map fst (zip xs ys) = xs

lemma map_snd_zip:

      length xs = length ys ==> map snd (zip xs ys) = ys

#### @{text rev}

lemma rev_append:

      rev (xs @ ys) = rev ys @ rev xs

lemma rev_rev_ident:

      rev (rev xs) = xs

lemma rev_swap:

      (rev xs = ys) = (xs = rev ys)

lemma rev_is_Nil_conv:

      (rev xs = []) = (xs = [])

lemma Nil_is_rev_conv:

      ([] = rev xs) = (xs = [])

lemma rev_singleton_conv:

      (rev xs = [x]) = (xs = [x])

lemma singleton_rev_conv:

      ([x] = rev xs) = (xs = [x])

lemma rev_is_rev_conv:

      (rev xs = rev ys) = (xs = ys)

lemma inj_on_rev:

      inj_on rev A

lemma rev_induct:

      [| P []; !!x xs. P xs ==> P (xs @ [x]) |] ==> P xs

lemma rev_exhaust:

      [| xs = [] ==> P; !!ys y. xs = ys @ [y] ==> P |] ==> P

lemmas rev_cases:

      [| xs = [] ==> P; !!ys y. xs = ys @ [y] ==> P |] ==> P

lemmas rev_cases:

      [| xs = [] ==> P; !!ys y. xs = ys @ [y] ==> P |] ==> P

#### @{text set}

lemma finite_set:

      finite (set xs)

lemma set_append:

      set (xs @ ys) = set xs ∪ set ys

lemma hd_in_set:

      l = x # xs ==> x ∈ set l

lemma set_subset_Cons:

      set xs ⊆ set (x # xs)

lemma set_ConsD:

      y ∈ set (x # xs) ==> y = x ∨ y ∈ set xs

lemma set_empty:

      (set xs = {}) = (xs = [])

lemma set_empty2:

      ({} = set xs) = (xs = [])

lemma set_rev:

      set (rev xs) = set xs

lemma set_map:

      set (map f xs) = f ` set xs

lemma set_filter:

      set (filter P xs) = {x : set xs. P x}

lemma set_upt:

      set [i..<j] = {k. i ≤ k ∧ k < j}

lemma in_set_conv_decomp:

      (x ∈ set xs) = (∃ys zs. xs = ys @ x # zs)

lemma finite_list:

      finite A ==> ∃l. set l = A

lemma card_length:

      card (set xs) ≤ length xs

#### @{text filter}

lemma filter_append:

      filter P (xs @ ys) = filter P xs @ filter P ys

lemma rev_filter:

      rev (filter P xs) = filter P (rev xs)

lemma filter_filter:

      filter P (filter Q xs) = [x∈xs . Q x ∧ P x]

lemma length_filter_le:

      length (filter P xs) ≤ length xs

lemma filter_True:

      ∀x∈set xs. P x ==> filter P xs = xs

lemma filter_False:

      ∀x∈set xs. ¬ P x ==> filter P xs = []

lemma filter_empty_conv:

      (filter P xs = []) = (∀x∈set xs. ¬ P x)

lemma filter_id_conv:

      (filter P xs = xs) = (∀x∈set xs. P x)

lemma filter_map:

      filter P (map f xs) = map f (filter (P o f) xs)

lemma length_filter_map:

      length (filter P (map f xs)) = length (filter (P o f) xs)

lemma filter_is_subset:

      set (filter P xs) ⊆ set xs

lemma length_filter_less:

      [| x ∈ set xs; ¬ P x |] ==> length (filter P xs) < length xs

lemma length_filter_conv_card:

      length (filter p xs) = card {i. i < length xs ∧ p (xs ! i)}

lemma Cons_eq_filterD:

      x # xs = filter P ys
      ==> ∃us vs. ys = us @ x # vs ∧ (∀u∈set us. ¬ P u) ∧ P x ∧ xs = filter P vs

lemma filter_eq_ConsD:

      filter P ys = x # xs
      ==> ∃us vs. ys = us @ x # vs ∧ (∀u∈set us. ¬ P u) ∧ P x ∧ xs = filter P vs

lemma filter_eq_Cons_iff:

      (filter P ys = x # xs) =
      (∃us vs. ys = us @ x # vs ∧ (∀u∈set us. ¬ P u) ∧ P x ∧ xs = filter P vs)

lemma Cons_eq_filter_iff:

      (x # xs = filter P ys) =
      (∃us vs. ys = us @ x # vs ∧ (∀u∈set us. ¬ P u) ∧ P x ∧ xs = filter P vs)

lemma filter_cong:

      [| xs = ys; !!x. x ∈ set ys ==> P x = Q x |] ==> filter P xs = filter Q ys

#### @{text concat}

lemma concat_append:

      concat (xs @ ys) = concat xs @ concat ys

lemma concat_eq_Nil_conv:

      (concat xss = []) = (∀xs∈set xss. xs = [])

lemma Nil_eq_concat_conv:

      ([] = concat xss) = (∀xs∈set xss. xs = [])

lemma set_concat:

      set (concat xs) = Union (set ` set xs)

lemma map_concat:

      map f (concat xs) = concat (map (map f) xs)

lemma filter_concat:

      filter p (concat xs) = concat (map (filter p) xs)

lemma rev_concat:

      rev (concat xs) = concat (map rev (rev xs))

#### @{text nth}

lemma nth_Cons_0:

      (x # xs) ! 0 = x

lemma nth_Cons_Suc:

      (x # xs) ! Suc n = xs ! n

lemma nth_append:

      (xs @ ys) ! n = (if n < length xs then xs ! n else ys ! (n - length xs))

lemma nth_append_length:

      (xs @ x # ys) ! length xs = x

lemma nth_append_length_plus:

      (xs @ ys) ! (length xs + n) = ys ! n

lemma nth_map:

      n < length xs ==> map f xs ! n = f (xs ! n)

lemma set_conv_nth:

      set xs = {xs ! i |i. i < length xs}

lemma in_set_conv_nth:

      (x ∈ set xs) = (∃i<length xs. xs ! i = x)

lemma list_ball_nth:

      [| n < length xs; ∀x∈set xs. P x |] ==> P (xs ! n)

lemma nth_mem:

      n < length xs ==> xs ! n ∈ set xs

lemma all_nth_imp_all_set:

      [| ∀i<length xs. P (xs ! i); x ∈ set xs |] ==> P x

lemma all_set_conv_all_nth:

      (∀x∈set xs. P x) = (∀i<length xs. P (xs ! i))

#### @{text list_update}

lemma length_list_update:

      length (xs[i := x]) = length xs

lemma nth_list_update:

      i < length xs ==> xs[i := x] ! j = (if i = j then x else xs ! j)

lemma nth_list_update_eq:

      i < length xs ==> xs[i := x] ! i = x

lemma nth_list_update_neq:

      i ≠ j ==> xs[i := x] ! j = xs ! j

lemma list_update_overwrite:

      i < length xs ==> xs[i := x, i := y] = xs[i := y]

lemma list_update_id:

      i < length xs ==> xs[i := xs ! i] = xs

lemma list_update_beyond:

      length xs ≤ i ==> xs[i := x] = xs

lemma list_update_same_conv:

      i < length xs ==> (xs[i := x] = xs) = (xs ! i = x)

lemma list_update_append1:

      i < length xs ==> (xs @ ys)[i := x] = xs[i := x] @ ys

lemma list_update_append:

      (xs @ ys)[n := x] =
      (if n < length xs then xs[n := x] @ ys else xs @ ys[n - length xs := x])

lemma list_update_length:

      (xs @ x # ys)[length xs := y] = xs @ y # ys

lemma update_zip:

      length xs = length ys
      ==> zip xs ys[i := xy] = zip (xs[i := fst xy]) (ys[i := snd xy])

lemma set_update_subset_insert:

      set (xs[i := x]) ⊆ insert x (set xs)

lemma set_update_subsetI:

      [| set xs ⊆ A; x ∈ A |] ==> set (xs[i := x]) ⊆ A

lemma set_update_memI:

      n < length xs ==> x ∈ set (xs[n := x])

#### @{text last} and @{text butlast}

lemma last_snoc:

      last (xs @ [x]) = x

lemma butlast_snoc:

      butlast (xs @ [x]) = xs

lemma last_ConsL:

      xs = [] ==> last (x # xs) = x

lemma last_ConsR:

      xs ≠ [] ==> last (x # xs) = last xs

lemma last_append:

      last (xs @ ys) = (if ys = [] then last xs else last ys)

lemma last_appendL:

      ys = [] ==> last (xs @ ys) = last xs

lemma last_appendR:

      ys ≠ [] ==> last (xs @ ys) = last ys

lemma length_butlast:

      length (butlast xs) = length xs - 1

lemma butlast_append:

      butlast (xs @ ys) = (if ys = [] then butlast xs else xs @ butlast ys)

lemma append_butlast_last_id:

      xs ≠ [] ==> butlast xs @ [last xs] = xs

lemma in_set_butlastD:

      x ∈ set (butlast xs) ==> x ∈ set xs

lemma in_set_butlast_appendI:

      x ∈ set (butlast xs) ∨ x ∈ set (butlast ys) ==> x ∈ set (butlast (xs @ ys))

lemma last_drop:

      n < length xs ==> last (drop n xs) = last xs

lemma last_conv_nth:

      xs ≠ [] ==> last xs = xs ! (length xs - 1)

#### @{text take} and @{text drop}

lemma take_0:

      take 0 xs = []

lemma drop_0:

      drop 0 xs = xs

lemma take_Suc_Cons:

      take (Suc n) (x # xs) = x # take n xs

lemma drop_Suc_Cons:

      drop (Suc n) (x # xs) = drop n xs

lemma take_Suc:

      xs ≠ [] ==> take (Suc n) xs = hd xs # take n (tl xs)

lemma drop_Suc:

      drop (Suc n) xs = drop n (tl xs)

lemma drop_tl:

      drop n (tl xs) = tl (drop n xs)

lemma nth_via_drop:

      drop n xs = y # ys ==> xs ! n = y

lemma take_Suc_conv_app_nth:

      i < length xs ==> take (Suc i) xs = take i xs @ [xs ! i]

lemma drop_Suc_conv_tl:

      i < length xs ==> xs ! i # drop (Suc i) xs = drop i xs

lemma length_take:

      length (take n xs) = min (length xs) n

lemma length_drop:

      length (drop n xs) = length xs - n

lemma take_all:

      length xs ≤ n ==> take n xs = xs

lemma drop_all:

      length xs ≤ n ==> drop n xs = []

lemma take_append:

      take n (xs @ ys) = take n xs @ take (n - length xs) ys

lemma drop_append:

      drop n (xs @ ys) = drop n xs @ drop (n - length xs) ys

lemma take_take:

      take n (take m xs) = take (min n m) xs

lemma drop_drop:

      drop n (drop m xs) = drop (n + m) xs

lemma take_drop:

      take n (drop m xs) = drop m (take (n + m) xs)

lemma drop_take:

      drop n (take m xs) = take (m - n) (drop n xs)

lemma append_take_drop_id:

      take n xs @ drop n xs = xs

lemma take_eq_Nil:

      (take n xs = []) = (n = 0 ∨ xs = [])

lemma drop_eq_Nil:

      (drop n xs = []) = (length xs ≤ n)

lemma take_map:

      take n (map f xs) = map f (take n xs)

lemma drop_map:

      drop n (map f xs) = map f (drop n xs)

lemma rev_take:

      rev (take i xs) = drop (length xs - i) (rev xs)

lemma rev_drop:

      rev (drop i xs) = take (length xs - i) (rev xs)

lemma nth_take:

      i < n ==> take n xs ! i = xs ! i

lemma nth_drop:

      n + i ≤ length xs ==> drop n xs ! i = xs ! (n + i)

lemma set_take_subset:

      set (take n xs) ⊆ set xs

lemma set_drop_subset:

      set (drop n xs) ⊆ set xs

lemma in_set_takeD:

      x ∈ set (take n xs) ==> x ∈ set xs

lemma in_set_dropD:

      x ∈ set (drop n xs) ==> x ∈ set xs

lemma append_eq_conv_conj:

      (xs @ ys = zs) = (xs = take (length xs) zs ∧ ys = drop (length xs) zs)

lemma take_add:

      i + j ≤ length xs ==> take (i + j) xs = take i xs @ take j (drop i xs)

lemma append_eq_append_conv_if:

      (xs1 @ xs2 = ys1 @ ys2) =
      (if length xs1 ≤ length ys1
       then xs1 = take (length xs1) ys1 ∧ xs2 = drop (length xs1) ys1 @ ys2
       else take (length ys1) xs1 = ys1 ∧ drop (length ys1) xs1 @ xs2 = ys2)

lemma take_hd_drop:

      n < length xs ==> take n xs @ [hd (drop n xs)] = take (n + 1) xs

lemma id_take_nth_drop:

      i < length xs ==> xs = take i xs @ xs ! i # drop (Suc i) xs

lemma upd_conv_take_nth_drop:

      i < length xs ==> xs[i := a] = take i xs @ a # drop (Suc i) xs

#### @{text takeWhile} and @{text dropWhile}

lemma takeWhile_dropWhile_id:

      takeWhile P xs @ dropWhile P xs = xs

lemma takeWhile_append1:

      [| x ∈ set xs; ¬ P x |] ==> takeWhile P (xs @ ys) = takeWhile P xs

lemma takeWhile_append2:

      (!!x. x ∈ set xs ==> P x) ==> takeWhile P (xs @ ys) = xs @ takeWhile P ys

lemma takeWhile_tail:

      ¬ P x ==> takeWhile P (xs @ x # l) = takeWhile P xs

lemma dropWhile_append1:

      [| x ∈ set xs; ¬ P x |] ==> dropWhile P (xs @ ys) = dropWhile P xs @ ys

lemma dropWhile_append2:

      (!!x. x ∈ set xs ==> P x) ==> dropWhile P (xs @ ys) = dropWhile P ys

lemma set_take_whileD:

      x ∈ set (takeWhile P xs) ==> x ∈ set xs ∧ P x

lemma takeWhile_eq_all_conv:

      (takeWhile P xs = xs) = (∀x∈set xs. P x)

lemma dropWhile_eq_Nil_conv:

      (dropWhile P xs = []) = (∀x∈set xs. P x)

lemma dropWhile_eq_Cons_conv:

      (dropWhile P xs = y # ys) = (xs = takeWhile P xs @ y # ys ∧ ¬ P y)

lemma takeWhile_neq_rev:

      [| distinct xs; x ∈ set xs |]
      ==> takeWhile (%y. y ≠ x) (rev xs) = rev (tl (dropWhile (%y. y ≠ x) xs))

lemma dropWhile_neq_rev:

      [| distinct xs; x ∈ set xs |]
      ==> dropWhile (%y. y ≠ x) (rev xs) = x # rev (takeWhile (%y. y ≠ x) xs)

#### @{text zip}

lemma zip_Nil:

      zip [] ys = []

lemma zip_Cons_Cons:

      zip (x # xs) (y # ys) = (x, y) # zip xs ys

lemma zip_Cons1:

      zip (x # xs) ys = (case ys of [] => [] | y # ys => (x, y) # zip xs ys)

lemma length_zip:

      length (zip xs ys) = min (length xs) (length ys)

lemma zip_append1:

      zip (xs @ ys) zs = zip xs (take (length xs) zs) @ zip ys (drop (length xs) zs)

lemma zip_append2:

      zip xs (ys @ zs) = zip (take (length ys) xs) ys @ zip (drop (length ys) xs) zs

lemma zip_append:

      [| length xs = length us; length ys = length vs |]
      ==> zip (xs @ ys) (us @ vs) = zip xs us @ zip ys vs

lemma zip_rev:

      length xs = length ys ==> zip (rev xs) (rev ys) = rev (zip xs ys)

lemma nth_zip:

      [| i < length xs; i < length ys |] ==> zip xs ys ! i = (xs ! i, ys ! i)

lemma set_zip:

      set (zip xs ys) = {(xs ! i, ys ! i) |i. i < min (length xs) (length ys)}

lemma zip_update:

      length xs = length ys ==> zip (xs[i := x]) (ys[i := y]) = zip xs ys[i := (x, y)]

lemma zip_replicate:

      zip (replicate i x) (replicate j y) = replicate (min i j) (x, y)

#### @{text list_all2}

lemma list_all2_lengthD:

      list_all2 P xs ys ==> length xs = length ys

lemma list_all2_Nil:

      list_all2 P [] ys = (ys = [])

lemma list_all2_Nil2:

      list_all2 P xs [] = (xs = [])

lemma list_all2_Cons:

      list_all2 P (x # xs) (y # ys) = (P x y ∧ list_all2 P xs ys)

lemma list_all2_Cons1:

      list_all2 P (x # xs) ys = (∃z zs. ys = z # zs ∧ P x z ∧ list_all2 P xs zs)

lemma list_all2_Cons2:

      list_all2 P xs (y # ys) = (∃z zs. xs = z # zs ∧ P z y ∧ list_all2 P zs ys)

lemma list_all2_rev:

      list_all2 P (rev xs) (rev ys) = list_all2 P xs ys

lemma list_all2_rev1:

      list_all2 P (rev xs) ys = list_all2 P xs (rev ys)

lemma list_all2_append1:

      list_all2 P (xs @ ys) zs =
      (∃us vs.
          zs = us @ vs ∧
          length us = length xs ∧
          length vs = length ys ∧ list_all2 P xs us ∧ list_all2 P ys vs)

lemma list_all2_append2:

      list_all2 P xs (ys @ zs) =
      (∃us vs.
          xs = us @ vs ∧
          length us = length ys ∧
          length vs = length zs ∧ list_all2 P us ys ∧ list_all2 P vs zs)

lemma list_all2_append:

      length xs = length ys
      ==> list_all2 P (xs @ us) (ys @ vs) = (list_all2 P xs ys ∧ list_all2 P us vs)

lemma list_all2_appendI:

      [| list_all2 P a b; list_all2 P c d |] ==> list_all2 P (a @ c) (b @ d)

lemma list_all2_conv_all_nth:

      list_all2 P xs ys =
      (length xs = length ys ∧ (∀i<length xs. P (xs ! i) (ys ! i)))

lemma list_all2_trans:

      [| !!a b c. [| P1.0 a b; P2.0 b c |] ==> P3.0 a c; list_all2 P1.0 as bs;
         list_all2 P2.0 bs cs |]
      ==> list_all2 P3.0 as cs

lemma list_all2_all_nthI:

      [| length a = length b; !!n. n < length a ==> P (a ! n) (b ! n) |]
      ==> list_all2 P a b

lemma list_all2I:

      [| ∀x∈set (zip a b). split P x; length a = length b |] ==> list_all2 P a b

lemma list_all2_nthD:

      [| list_all2 P xs ys; p < length xs |] ==> P (xs ! p) (ys ! p)

lemma list_all2_nthD2:

      [| list_all2 P xs ys; p < length ys |] ==> P (xs ! p) (ys ! p)

lemma list_all2_map1:

      list_all2 P (map f as) bs = list_all2 (%x. P (f x)) as bs

lemma list_all2_map2:

      list_all2 P as (map f bs) = list_all2 (%x y. P x (f y)) as bs

lemma list_all2_refl:

      (!!x. P x x) ==> list_all2 P xs xs

lemma list_all2_update_cong:

      [| i < length xs; list_all2 P xs ys; P x y |]
      ==> list_all2 P (xs[i := x]) (ys[i := y])

lemma list_all2_update_cong2:

      [| list_all2 P xs ys; P x y; i < length ys |]
      ==> list_all2 P (xs[i := x]) (ys[i := y])

lemma list_all2_takeI:

      list_all2 P xs ys ==> list_all2 P (take n xs) (take n ys)

lemma list_all2_dropI:

      list_all2 P as bs ==> list_all2 P (drop n as) (drop n bs)

lemma list_all2_mono:

      [| list_all2 P x y; !!x y. P x y ==> Q x y |] ==> list_all2 Q x y

#### @{text foldl} and @{text foldr}

lemma foldl_append:

      foldl f a (xs @ ys) = foldl f (foldl f a xs) ys

lemma foldr_append:

      foldr f (xs @ ys) a = foldr f xs (foldr f ys a)

lemma foldr_foldl:

      foldr f xs a = foldl (%x y. f y x) a (rev xs)

lemma foldl_foldr:

      foldl f a xs = foldr (%x y. f y x) (rev xs) a

lemma start_le_sum:

      m ≤ n ==> m ≤ foldl op + n ns

lemma elem_le_sum:

      n ∈ set ns ==> n ≤ foldl op + 0 ns

lemma sum_eq_0_conv:

      (foldl op + m ns = 0) = (m = 0 ∧ (∀n∈set ns. n = 0))

#### @{text upto}

lemma upt_rec:

      [i..<j] = (if i < j then i # [Suc i..<j] else [])

lemma upt_conv_Nil:

      j ≤ i ==> [i..<j] = []

lemma upt_eq_Nil_conv:

      ([i..<j] = []) = (j = 0 ∨ j ≤ i)

lemma upt_eq_Cons_conv:

      ([i..<j] = x # xs) = (i < j ∧ i = x ∧ [i + 1..<j] = xs)

lemma upt_Suc_append:

      i ≤ j ==> [i..j] = [i..<j] @ [j]

lemma upt_conv_Cons:

      i < j ==> [i..<j] = i # [Suc i..<j]

lemma upt_add_eq_append:

      i ≤ j ==> [i..<j + k] = [i..<j] @ [j..<j + k]

lemma length_upt:

      length [i..<j] = j - i

lemma nth_upt:

      i + k < j ==> [i..<j] ! k = i + k

lemma take_upt:

      i + m ≤ n ==> take m [i..<n] = [i..<i + m]

lemma drop_upt:

      drop m [i..<j] = [i + m..<j]

lemma map_Suc_upt:

      map Suc [m..<n] = [Suc m..n]

lemma nth_map_upt:

      i < n - m ==> map f [m..<n] ! i = f (m + i)

lemma nth_take_lemma:

      [| k ≤ length xs; k ≤ length ys; !!i. i < k --> xs ! i = ys ! i |]
      ==> take k xs = take k ys

lemma nth_equalityI:

      [| length xs = length ys; ∀i<length xs. xs ! i = ys ! i |] ==> xs = ys

lemma list_all2_antisym:

      [| !!x y. [| P x y; Q y x |] ==> x = y; list_all2 P xs ys; list_all2 Q ys xs |]
      ==> xs = ys

lemma take_equalityI:

      ∀i. take i xs = take i ys ==> xs = ys

lemma take_Cons':

      take n (x # xs) = (if n = 0 then [] else x # take (n - 1) xs)

lemma drop_Cons':

      drop n (x # xs) = (if n = 0 then x # xs else drop (n - 1) xs)

lemma nth_Cons':

      (x # xs) ! n = (if n = 0 then x else xs ! (n - 1))

lemmas

      take (number_of v) (x # xs) =
      (if number_of v = 0 then [] else x # take (number_of v - 1) xs)

      drop (number_of v) (x # xs) =
      (if number_of v = 0 then x # xs else drop (number_of v - 1) xs)

      (x # xs) ! number_of v = (if number_of v = 0 then x else xs ! (number_of v - 1))

lemmas

      take (number_of v) (x # xs) =
      (if number_of v = 0 then [] else x # take (number_of v - 1) xs)

      drop (number_of v) (x # xs) =
      (if number_of v = 0 then x # xs else drop (number_of v - 1) xs)

      (x # xs) ! number_of v = (if number_of v = 0 then x else xs ! (number_of v - 1))

#### @{text "distinct"} and @{text remdups}

lemma distinct_append:

      distinct (xs @ ys) = (distinct xs ∧ distinct ys ∧ set xs ∩ set ys = {})

lemma distinct_rev:

      distinct (rev xs) = distinct xs

lemma set_remdups:

      set (remdups xs) = set xs

lemma distinct_remdups:

      distinct (remdups xs)

lemma remdups_eq_nil_iff:

      (remdups x = []) = (x = [])

lemma remdups_eq_nil_right_iff:

      ([] = remdups x) = (x = [])

lemma length_remdups_leq:

      length (remdups xs) ≤ length xs

lemma length_remdups_eq:

      (length (remdups xs) = length xs) = (remdups xs = xs)

lemma distinct_filter:

      distinct xs ==> distinct (filter P xs)

lemma distinct_map_filterI:

      distinct (map f xs) ==> distinct (map f (filter P xs))

lemma distinct_upt:

      distinct [i..<j]

lemma distinct_take:

      distinct xs ==> distinct (take i xs)

lemma distinct_drop:

      distinct xs ==> distinct (drop i xs)

lemma distinct_list_update:

      [| distinct xs; a ∉ set xs - {xs ! i} |] ==> distinct (xs[i := a])

lemma distinct_conv_nth:

      distinct xs = (∀i<length xs. ∀j<length xs. i ≠ j --> xs ! i ≠ xs ! j)

lemma distinct_card:

      distinct xs ==> card (set xs) = length xs

lemma card_distinct:

      card (set xs) = length xs ==> distinct xs

lemma inj_on_setI:

      distinct (map f xs) ==> inj_on f (set xs)

lemma inj_on_set_conv:

      distinct xs ==> inj_on f (set xs) = distinct (map f xs)

#### @{text remove1}

lemma set_remove1_subset:

      set (remove1 x xs) ⊆ set xs

lemma set_remove1_eq:

      distinct xs ==> set (remove1 x xs) = set xs - {x}

lemma notin_set_remove1:

      x ∉ set xs ==> x ∉ set (remove1 y xs)

lemma distinct_remove1:

      distinct xs ==> distinct (remove1 x xs)

#### @{text replicate}

lemma length_replicate:

      length (replicate n x) = n

lemma map_replicate:

      map f (replicate n x) = replicate n (f x)

lemma replicate_app_Cons_same:

      replicate n x @ x # xs = x # replicate n x @ xs

lemma rev_replicate:

      rev (replicate n x) = replicate n x

lemma replicate_add:

      replicate (n + m) x = replicate n x @ replicate m x

lemma append_replicate_commute:

      replicate n x @ replicate k x = replicate k x @ replicate n x

lemma hd_replicate:

      n ≠ 0 ==> hd (replicate n x) = x

lemma tl_replicate:

      n ≠ 0 ==> tl (replicate n x) = replicate (n - 1) x

lemma last_replicate:

      n ≠ 0 ==> last (replicate n x) = x

lemma nth_replicate:

      i < n ==> replicate n x ! i = x

lemma take_replicate:

      take i (replicate k x) = replicate (min i k) x

lemma drop_replicate:

      drop i (replicate k x) = replicate (k - i) x

lemma set_replicate_Suc:

      set (replicate (Suc n) x) = {x}

lemma set_replicate:

      n ≠ 0 ==> set (replicate n x) = {x}

lemma set_replicate_conv_if:

      set (replicate n x) = (if n = 0 then {} else {x})

lemma in_set_replicateD:

      x ∈ set (replicate n y) ==> x = y

#### @{text rotate1} and @{text rotate}

lemma rotate_simps:

      rotate1 [] = [] ∧ rotate1 (x # xs) = xs @ [x]

lemma rotate0:

      rotate 0 = id

lemma rotate_Suc:

      rotate (Suc n) xs = rotate1 (rotate n xs)

lemma rotate_add:

      rotate (m + n) = rotate m o rotate n

lemma rotate_rotate:

      rotate m (rotate n xs) = rotate (m + n) xs

lemma rotate1_length01:

      length xs ≤ 1 ==> rotate1 xs = xs

lemma rotate_length01:

      length xs ≤ 1 ==> rotate n xs = xs

lemma rotate1_hd_tl:

      xs ≠ [] ==> rotate1 xs = tl xs @ [hd xs]

lemma rotate_drop_take:

      rotate n xs = drop (n mod length xs) xs @ take (n mod length xs) xs

lemma rotate_conv_mod:

      rotate n xs = rotate (n mod length xs) xs

lemma rotate_id:

      n mod length xs = 0 ==> rotate n xs = xs

lemma length_rotate1:

      length (rotate1 xs) = length xs

lemma length_rotate:

      length (rotate n xs) = length xs

lemma distinct1_rotate:

      distinct (rotate1 xs) = distinct xs

lemma distinct_rotate:

      distinct (rotate n xs) = distinct xs

lemma rotate_map:

      rotate n (map f xs) = map f (rotate n xs)

lemma set_rotate1:

      set (rotate1 xs) = set xs

lemma set_rotate:

      set (rotate n xs) = set xs

lemma rotate1_is_Nil_conv:

      (rotate1 xs = []) = (xs = [])

lemma rotate_is_Nil_conv:

      (rotate n xs = []) = (xs = [])

lemma rotate_rev:

      rotate n (rev xs) = rev (rotate (length xs - n mod length xs) xs)

#### @{text sublist} --- a generalization of @{text nth} to sets

lemma sublist_empty:

      sublist xs {} = []

lemma sublist_nil:

      sublist [] A = []

lemma length_sublist:

      length (sublist xs I) = card {i. i < length xs ∧ i ∈ I}

lemma sublist_shift_lemma_Suc:

      map fst [p∈zip xs is . P (Suc (snd p))] =
      map fst [p∈zip xs (map Suc is) . P (snd p)]

lemma sublist_shift_lemma:

      map fst [p∈zip xs [i..<i + length xs] . snd p ∈ A] =
      map fst [p∈zip xs [0..<length xs] . snd p + i ∈ A]

lemma sublist_append:

      sublist (l @ l') A = sublist l A @ sublist l' {j. j + length l ∈ A}

lemma sublist_Cons:

      sublist (x # l) A = (if 0 ∈ A then [x] else []) @ sublist l {j. Suc j ∈ A}

lemma set_sublist:

      set (sublist xs I) = {xs ! i |i. i < length xs ∧ i ∈ I}

lemma set_sublist_subset:

      set (sublist xs I) ⊆ set xs

lemma notin_set_sublistI:

      x ∉ set xs ==> x ∉ set (sublist xs I)

lemma in_set_sublistD:

      x ∈ set (sublist xs I) ==> x ∈ set xs

lemma sublist_singleton:

      sublist [x] A = (if 0 ∈ A then [x] else [])

lemma distinct_sublistI:

      distinct xs ==> distinct (sublist xs I)

lemma sublist_upt_eq_take:

      sublist l {..<n} = take n l

lemma filter_in_sublist:

      distinct xs ==> [x∈xs . x ∈ set (sublist xs s)] = sublist xs s

#### Sets of Lists

#### @{text lists}: the list-forming operator over sets

lemmas listsE:

      [| x # l ∈ lists A; [| x ∈ A; l ∈ lists A |] ==> P |] ==> P

lemma lists_mono:

      A ⊆ B ==> lists A ⊆ lists B

lemma lists_IntI:

      [| l ∈ lists A; l ∈ lists B |] ==> l ∈ lists (A ∩ B)

lemma lists_Int_eq:

      lists (A ∩ B) = lists A ∩ lists B

lemma append_in_lists_conv:

      (xs @ ys ∈ lists A) = (xs ∈ lists A ∧ ys ∈ lists A)

lemma in_lists_conv_set:

      (xs ∈ lists A) = (∀x∈set xs. x ∈ A)

lemma in_listsD:

      xs ∈ lists A ==> ∀x∈set xs. x ∈ A

lemma in_listsI:

      ∀x∈set xs. x ∈ A ==> xs ∈ lists A

lemma lists_UNIV:

      lists UNIV = UNIV

#### For efficiency

lemma mem_iff:

      x mem xs = (x ∈ set xs)

lemma list_inter_conv:

      set (list_inter xs ys) = set xs ∩ set ys

lemma list_all_iff:

      list_all P xs = (∀x∈set xs. P x)

lemma list_all_append:

      list_all P (xs @ ys) = (list_all P xs ∧ list_all P ys)

lemma list_all_rev:

      list_all P (rev xs) = list_all P xs

lemma list_ex_iff:

      list_ex P xs = (∃x∈set xs. P x)

lemma itrev:

      ∀ys. itrev xs ys = rev xs @ ys

lemma filtermap_conv:

      filtermap f xs = map (%x. the (f x)) [x∈xs . f x ≠ None]

lemma map_filter_conv:

      map_filter f P xs = map f (filter P xs)

#### Code generation

lemmas in_set_code:

      x2 ∈ set xs2 == x2 mem xs2

lemmas in_set_code:

      x2 ∈ set xs2 == x2 mem xs2

lemma rev_code:

      rev xs == itrev xs []

lemma distinct_Cons_mem:

      distinct (x # xs) = (¬ x mem xs ∧ distinct xs)

lemma remdups_Cons_mem:

      remdups (x # xs) = (if x mem xs then remdups xs else x # remdups xs)

lemma list_inter_Cons_mem:

      list_inter (a # as) bs =
      (if a mem bs then a # list_inter as bs else list_inter as bs)

lemmas list_bex_code:

      ∃x∈set xs2. P2 x == list_ex P2 xs2

lemmas list_bex_code:

      ∃x∈set xs2. P2 x == list_ex P2 xs2

lemmas list_ball_code:

      ∀x∈set xs2. P2 x == list_all P2 xs2

lemmas list_ball_code:

      ∀x∈set xs2. P2 x == list_all P2 xs2

#### Inductive definition for membership

lemma ListMem_iff:

      ((x, xs) ∈ ListMem) = (x ∈ set xs)

#### Lists as Cartesian products

lemma set_Cons_sing_Nil:

      set_Cons A {[]} = (%x. [x]) ` A

### Relations on Lists

#### Length Lexicographic Ordering

lemma wf_lexn:

      wf r ==> wf (lexn r n)

lemma lexn_length:

      (xs, ys) ∈ lexn r n ==> length xs = n ∧ length ys = n

lemma wf_lex:

      wf r ==> wf (lex r)

lemma lexn_conv:

      lexn r n =
      {(xs, ys).
       length xs = n ∧
       length ys = n ∧
       (∃xys x y xs' ys'. xs = xys @ x # xs' ∧ ys = xys @ y # ys' ∧ (x, y) ∈ r)}

lemma lex_conv:

      lex r =
      {(xs, ys).
       length xs = length ys ∧
       (∃xys x y xs' ys'. xs = xys @ x # xs' ∧ ys = xys @ y # ys' ∧ (x, y) ∈ r)}

lemma wf_lenlex:

      wf r ==> wf (lenlex r)

lemma lenlex_conv:

      lenlex r =
      {(xs, ys). length xs < length ys ∨ length xs = length ys ∧ (xs, ys) ∈ lex r}

lemma Nil_notin_lex:

      ([], ys) ∉ lex r

lemma Nil2_notin_lex:

      (xs, []) ∉ lex r

lemma Cons_in_lex:

      ((x # xs, y # ys) ∈ lex r) =
      ((x, y) ∈ r ∧ length xs = length ys ∨ x = y ∧ (xs, ys) ∈ lex r)

#### Lexicographic Ordering

lemma lexord_Nil_left:

      (([], y) ∈ lexord r) = (∃a x. y = a # x)

lemma lexord_Nil_right:

      (x, []) ∉ lexord r

lemma lexord_cons_cons:

      ((a # x, b # y) ∈ lexord r) = ((a, b) ∈ r ∨ a = b ∧ (x, y) ∈ lexord r)

lemmas lexord_simps:

      (([], y) ∈ lexord r) = (∃a x. y = a # x)

      (x, []) ∉ lexord r

      ((a # x, b # y) ∈ lexord r) = ((a, b) ∈ r ∨ a = b ∧ (x, y) ∈ lexord r)

lemmas lexord_simps:

      (([], y) ∈ lexord r) = (∃a x. y = a # x)

      (x, []) ∉ lexord r

      ((a # x, b # y) ∈ lexord r) = ((a, b) ∈ r ∨ a = b ∧ (x, y) ∈ lexord r)

lemma lexord_append_rightI:

      ∃b z. y = b # z ==> (x, x @ y) ∈ lexord r

lemma lexord_append_left_rightI:

      (a, b) ∈ r ==> (u @ a # x, u @ b # y) ∈ lexord r

lemma lexord_append_leftI:

      (u, v) ∈ lexord r ==> (x @ u, x @ v) ∈ lexord r

lemma lexord_append_leftD:

      [| (x @ u, x @ v) ∈ lexord r; ∀a. (a, a) ∉ r |] ==> (u, v) ∈ lexord r

lemma lexord_take_index_conv:

      ((x, y) ∈ lexord r) =
      (length x < length y ∧ take (length x) y = x ∨
       (∃i<min (length x) (length y). take i x = take i y ∧ (x ! i, y ! i) ∈ r))

lemma lexord_lex:

      ((x, y) ∈ lex r) = ((x, y) ∈ lexord r ∧ length x = length y)

lemma lexord_irreflexive:

      ∀x. (x, x) ∉ r ==> (y, y) ∉ lexord r

lemma lexord_trans:

      [| (x, y) ∈ lexord r; (y, z) ∈ lexord r; trans r |] ==> (x, z) ∈ lexord r

lemma lexord_transI:

      trans r ==> trans (lexord r)

lemma lexord_linear:

      ∀a b. (a, b) ∈ r ∨ a = b ∨ (b, a) ∈ r
      ==> (x, y) ∈ lexord r ∨ x = y ∨ (y, x) ∈ lexord r

#### Lifting a Relation on List Elements to the Lists

lemmas listrel_Nil1:

      [| ([], xs) ∈ listrel r; xs = [] ==> P |] ==> P

lemmas listrel_Nil2:

      [| (xs, []) ∈ listrel r; xs = [] ==> P |] ==> P

lemmas listrel_Cons1:

      [| (y # ys, xs) ∈ listrel r;
         !!y ys. [| (y, y) ∈ r; (ys, ys) ∈ listrel r; xs = y # ys |] ==> P |]
      ==> P

lemmas listrel_Cons2:

      [| (xs, y # ys) ∈ listrel r;
         !!x xs. [| (x, y) ∈ r; (xs, ys) ∈ listrel r; xs = x # xs |] ==> P |]
      ==> P

lemma listrel_mono:

      r ⊆ s ==> listrel r ⊆ listrel s

lemma listrel_subset:

      r ⊆ A × A ==> listrel r ⊆ lists A × lists A

lemma listrel_refl:

      refl A r ==> refl (lists A) (listrel r)

lemma listrel_sym:

      sym r ==> sym (listrel r)

lemma listrel_trans:

      trans r ==> trans (listrel r)

theorem equiv_listrel:

      equiv A r ==> equiv (lists A) (listrel r)

lemma listrel_Nil:

      listrel r `` {[]} = {[]}

lemma listrel_Cons:

      listrel r `` {x # xs} = set_Cons (r `` {x}) (listrel r `` {xs})

### Miscellany

#### Characters and strings

#### Code generator setup