src/ZF/Constructible/Relative.thy
author paulson
Wed Aug 28 13:08:34 2002 +0200 (2002-08-28)
changeset 13543 2b3c7e319d82
parent 13535 007559e981c7
child 13563 7d6c9817c432
permissions -rw-r--r--
completion of the consistency proof for AC
paulson@13505
     1
(*  Title:      ZF/Constructible/Relative.thy
paulson@13505
     2
    ID:         $Id$
paulson@13505
     3
    Author:     Lawrence C Paulson, Cambridge University Computer Laboratory
paulson@13505
     4
    Copyright   2002  University of Cambridge
paulson@13505
     5
*)
paulson@13505
     6
paulson@13223
     7
header {*Relativization and Absoluteness*}
paulson@13223
     8
paulson@13223
     9
theory Relative = Main:
paulson@13223
    10
paulson@13223
    11
subsection{* Relativized versions of standard set-theoretic concepts *}
paulson@13223
    12
paulson@13223
    13
constdefs
paulson@13223
    14
  empty :: "[i=>o,i] => o"
paulson@13254
    15
    "empty(M,z) == \<forall>x[M]. x \<notin> z"
paulson@13223
    16
paulson@13223
    17
  subset :: "[i=>o,i,i] => o"
paulson@13298
    18
    "subset(M,A,B) == \<forall>x[M]. x\<in>A --> x \<in> B"
paulson@13223
    19
paulson@13223
    20
  upair :: "[i=>o,i,i,i] => o"
paulson@13298
    21
    "upair(M,a,b,z) == a \<in> z & b \<in> z & (\<forall>x[M]. x\<in>z --> x = a | x = b)"
paulson@13223
    22
paulson@13223
    23
  pair :: "[i=>o,i,i,i] => o"
paulson@13254
    24
    "pair(M,a,b,z) == \<exists>x[M]. upair(M,a,a,x) & 
paulson@13254
    25
                          (\<exists>y[M]. upair(M,a,b,y) & upair(M,x,y,z))"
paulson@13223
    26
paulson@13306
    27
paulson@13245
    28
  union :: "[i=>o,i,i,i] => o"
paulson@13254
    29
    "union(M,a,b,z) == \<forall>x[M]. x \<in> z <-> x \<in> a | x \<in> b"
paulson@13245
    30
paulson@13306
    31
  is_cons :: "[i=>o,i,i,i] => o"
paulson@13306
    32
    "is_cons(M,a,b,z) == \<exists>x[M]. upair(M,a,a,x) & union(M,x,b,z)"
paulson@13306
    33
paulson@13223
    34
  successor :: "[i=>o,i,i] => o"
paulson@13306
    35
    "successor(M,a,z) == is_cons(M,a,a,z)"
paulson@13223
    36
paulson@13363
    37
  number1 :: "[i=>o,i] => o"
paulson@13436
    38
    "number1(M,a) == \<exists>x[M]. empty(M,x) & successor(M,x,a)"
paulson@13363
    39
paulson@13363
    40
  number2 :: "[i=>o,i] => o"
paulson@13436
    41
    "number2(M,a) == \<exists>x[M]. number1(M,x) & successor(M,x,a)"
paulson@13363
    42
paulson@13363
    43
  number3 :: "[i=>o,i] => o"
paulson@13436
    44
    "number3(M,a) == \<exists>x[M]. number2(M,x) & successor(M,x,a)"
paulson@13363
    45
paulson@13223
    46
  powerset :: "[i=>o,i,i] => o"
paulson@13254
    47
    "powerset(M,A,z) == \<forall>x[M]. x \<in> z <-> subset(M,x,A)"
paulson@13223
    48
paulson@13436
    49
  is_Collect :: "[i=>o,i,i=>o,i] => o"
paulson@13436
    50
    "is_Collect(M,A,P,z) == \<forall>x[M]. x \<in> z <-> x \<in> A & P(x)"
paulson@13436
    51
paulson@13505
    52
  is_Replace :: "[i=>o,i,[i,i]=>o,i] => o"
paulson@13505
    53
    "is_Replace(M,A,P,z) == \<forall>u[M]. u \<in> z <-> (\<exists>x[M]. x\<in>A & P(x,u))"
paulson@13505
    54
paulson@13223
    55
  inter :: "[i=>o,i,i,i] => o"
paulson@13254
    56
    "inter(M,a,b,z) == \<forall>x[M]. x \<in> z <-> x \<in> a & x \<in> b"
paulson@13223
    57
paulson@13223
    58
  setdiff :: "[i=>o,i,i,i] => o"
paulson@13254
    59
    "setdiff(M,a,b,z) == \<forall>x[M]. x \<in> z <-> x \<in> a & x \<notin> b"
paulson@13223
    60
paulson@13223
    61
  big_union :: "[i=>o,i,i] => o"
paulson@13298
    62
    "big_union(M,A,z) == \<forall>x[M]. x \<in> z <-> (\<exists>y[M]. y\<in>A & x \<in> y)"
paulson@13223
    63
paulson@13223
    64
  big_inter :: "[i=>o,i,i] => o"
paulson@13223
    65
    "big_inter(M,A,z) == 
paulson@13223
    66
             (A=0 --> z=0) &
paulson@13298
    67
	     (A\<noteq>0 --> (\<forall>x[M]. x \<in> z <-> (\<forall>y[M]. y\<in>A --> x \<in> y)))"
paulson@13223
    68
paulson@13223
    69
  cartprod :: "[i=>o,i,i,i] => o"
paulson@13223
    70
    "cartprod(M,A,B,z) == 
paulson@13298
    71
	\<forall>u[M]. u \<in> z <-> (\<exists>x[M]. x\<in>A & (\<exists>y[M]. y\<in>B & pair(M,x,y,u)))"
paulson@13223
    72
paulson@13350
    73
  is_sum :: "[i=>o,i,i,i] => o"
paulson@13350
    74
    "is_sum(M,A,B,Z) == 
paulson@13350
    75
       \<exists>A0[M]. \<exists>n1[M]. \<exists>s1[M]. \<exists>B1[M]. 
paulson@13350
    76
       number1(M,n1) & cartprod(M,n1,A,A0) & upair(M,n1,n1,s1) &
paulson@13350
    77
       cartprod(M,s1,B,B1) & union(M,A0,B1,Z)"
paulson@13350
    78
paulson@13397
    79
  is_Inl :: "[i=>o,i,i] => o"
paulson@13397
    80
    "is_Inl(M,a,z) == \<exists>zero[M]. empty(M,zero) & pair(M,zero,a,z)"
paulson@13397
    81
paulson@13397
    82
  is_Inr :: "[i=>o,i,i] => o"
paulson@13397
    83
    "is_Inr(M,a,z) == \<exists>n1[M]. number1(M,n1) & pair(M,n1,a,z)"
paulson@13397
    84
paulson@13223
    85
  is_converse :: "[i=>o,i,i] => o"
paulson@13223
    86
    "is_converse(M,r,z) == 
paulson@13299
    87
	\<forall>x[M]. x \<in> z <-> 
paulson@13299
    88
             (\<exists>w[M]. w\<in>r & (\<exists>u[M]. \<exists>v[M]. pair(M,u,v,w) & pair(M,v,u,x)))"
paulson@13223
    89
paulson@13223
    90
  pre_image :: "[i=>o,i,i,i] => o"
paulson@13223
    91
    "pre_image(M,r,A,z) == 
paulson@13299
    92
	\<forall>x[M]. x \<in> z <-> (\<exists>w[M]. w\<in>r & (\<exists>y[M]. y\<in>A & pair(M,x,y,w)))"
paulson@13223
    93
paulson@13223
    94
  is_domain :: "[i=>o,i,i] => o"
paulson@13223
    95
    "is_domain(M,r,z) == 
paulson@13436
    96
	\<forall>x[M]. x \<in> z <-> (\<exists>w[M]. w\<in>r & (\<exists>y[M]. pair(M,x,y,w)))"
paulson@13223
    97
paulson@13223
    98
  image :: "[i=>o,i,i,i] => o"
paulson@13223
    99
    "image(M,r,A,z) == 
paulson@13436
   100
        \<forall>y[M]. y \<in> z <-> (\<exists>w[M]. w\<in>r & (\<exists>x[M]. x\<in>A & pair(M,x,y,w)))"
paulson@13223
   101
paulson@13223
   102
  is_range :: "[i=>o,i,i] => o"
paulson@13223
   103
    --{*the cleaner 
paulson@13299
   104
      @{term "\<exists>r'[M]. is_converse(M,r,r') & is_domain(M,r',z)"}
paulson@13223
   105
      unfortunately needs an instance of separation in order to prove 
paulson@13223
   106
        @{term "M(converse(r))"}.*}
paulson@13223
   107
    "is_range(M,r,z) == 
paulson@13436
   108
	\<forall>y[M]. y \<in> z <-> (\<exists>w[M]. w\<in>r & (\<exists>x[M]. pair(M,x,y,w)))"
paulson@13223
   109
paulson@13245
   110
  is_field :: "[i=>o,i,i] => o"
paulson@13245
   111
    "is_field(M,r,z) == 
paulson@13436
   112
	\<exists>dr[M]. \<exists>rr[M]. is_domain(M,r,dr) & is_range(M,r,rr) & 
paulson@13436
   113
                        union(M,dr,rr,z)"
paulson@13245
   114
paulson@13223
   115
  is_relation :: "[i=>o,i] => o"
paulson@13223
   116
    "is_relation(M,r) == 
paulson@13298
   117
        (\<forall>z[M]. z\<in>r --> (\<exists>x[M]. \<exists>y[M]. pair(M,x,y,z)))"
paulson@13223
   118
paulson@13223
   119
  is_function :: "[i=>o,i] => o"
paulson@13223
   120
    "is_function(M,r) == 
paulson@13299
   121
	\<forall>x[M]. \<forall>y[M]. \<forall>y'[M]. \<forall>p[M]. \<forall>p'[M]. 
paulson@13299
   122
           pair(M,x,y,p) --> pair(M,x,y',p') --> p\<in>r --> p'\<in>r --> y=y'"
paulson@13223
   123
paulson@13223
   124
  fun_apply :: "[i=>o,i,i,i] => o"
paulson@13223
   125
    "fun_apply(M,f,x,y) == 
paulson@13352
   126
        (\<exists>xs[M]. \<exists>fxs[M]. 
paulson@13352
   127
         upair(M,x,x,xs) & image(M,f,xs,fxs) & big_union(M,fxs,y))"
paulson@13223
   128
paulson@13223
   129
  typed_function :: "[i=>o,i,i,i] => o"
paulson@13223
   130
    "typed_function(M,A,B,r) == 
paulson@13223
   131
        is_function(M,r) & is_relation(M,r) & is_domain(M,r,A) &
paulson@13306
   132
        (\<forall>u[M]. u\<in>r --> (\<forall>x[M]. \<forall>y[M]. pair(M,x,y,u) --> y\<in>B))"
paulson@13223
   133
paulson@13268
   134
  is_funspace :: "[i=>o,i,i,i] => o"
paulson@13268
   135
    "is_funspace(M,A,B,F) == 
paulson@13268
   136
        \<forall>f[M]. f \<in> F <-> typed_function(M,A,B,f)"
paulson@13268
   137
paulson@13245
   138
  composition :: "[i=>o,i,i,i] => o"
paulson@13245
   139
    "composition(M,r,s,t) == 
paulson@13306
   140
        \<forall>p[M]. p \<in> t <-> 
paulson@13323
   141
               (\<exists>x[M]. \<exists>y[M]. \<exists>z[M]. \<exists>xy[M]. \<exists>yz[M]. 
paulson@13323
   142
                pair(M,x,z,p) & pair(M,x,y,xy) & pair(M,y,z,yz) & 
paulson@13323
   143
                xy \<in> s & yz \<in> r)"
paulson@13245
   144
paulson@13223
   145
  injection :: "[i=>o,i,i,i] => o"
paulson@13223
   146
    "injection(M,A,B,f) == 
paulson@13223
   147
	typed_function(M,A,B,f) &
paulson@13306
   148
        (\<forall>x[M]. \<forall>x'[M]. \<forall>y[M]. \<forall>p[M]. \<forall>p'[M]. 
paulson@13306
   149
          pair(M,x,y,p) --> pair(M,x',y,p') --> p\<in>f --> p'\<in>f --> x=x')"
paulson@13223
   150
paulson@13223
   151
  surjection :: "[i=>o,i,i,i] => o"
paulson@13223
   152
    "surjection(M,A,B,f) == 
paulson@13223
   153
        typed_function(M,A,B,f) &
paulson@13299
   154
        (\<forall>y[M]. y\<in>B --> (\<exists>x[M]. x\<in>A & fun_apply(M,f,x,y)))"
paulson@13223
   155
paulson@13223
   156
  bijection :: "[i=>o,i,i,i] => o"
paulson@13223
   157
    "bijection(M,A,B,f) == injection(M,A,B,f) & surjection(M,A,B,f)"
paulson@13223
   158
paulson@13223
   159
  restriction :: "[i=>o,i,i,i] => o"
paulson@13223
   160
    "restriction(M,r,A,z) == 
paulson@13306
   161
	\<forall>x[M]. x \<in> z <-> (x \<in> r & (\<exists>u[M]. u\<in>A & (\<exists>v[M]. pair(M,u,v,x))))"
paulson@13223
   162
paulson@13223
   163
  transitive_set :: "[i=>o,i] => o"
paulson@13299
   164
    "transitive_set(M,a) == \<forall>x[M]. x\<in>a --> subset(M,x,a)"
paulson@13223
   165
paulson@13223
   166
  ordinal :: "[i=>o,i] => o"
paulson@13223
   167
     --{*an ordinal is a transitive set of transitive sets*}
paulson@13299
   168
    "ordinal(M,a) == transitive_set(M,a) & (\<forall>x[M]. x\<in>a --> transitive_set(M,x))"
paulson@13223
   169
paulson@13223
   170
  limit_ordinal :: "[i=>o,i] => o"
paulson@13223
   171
    --{*a limit ordinal is a non-empty, successor-closed ordinal*}
paulson@13223
   172
    "limit_ordinal(M,a) == 
paulson@13223
   173
	ordinal(M,a) & ~ empty(M,a) & 
paulson@13299
   174
        (\<forall>x[M]. x\<in>a --> (\<exists>y[M]. y\<in>a & successor(M,x,y)))"
paulson@13223
   175
paulson@13223
   176
  successor_ordinal :: "[i=>o,i] => o"
paulson@13223
   177
    --{*a successor ordinal is any ordinal that is neither empty nor limit*}
paulson@13223
   178
    "successor_ordinal(M,a) == 
paulson@13223
   179
	ordinal(M,a) & ~ empty(M,a) & ~ limit_ordinal(M,a)"
paulson@13223
   180
paulson@13223
   181
  finite_ordinal :: "[i=>o,i] => o"
paulson@13223
   182
    --{*an ordinal is finite if neither it nor any of its elements are limit*}
paulson@13223
   183
    "finite_ordinal(M,a) == 
paulson@13223
   184
	ordinal(M,a) & ~ limit_ordinal(M,a) & 
paulson@13299
   185
        (\<forall>x[M]. x\<in>a --> ~ limit_ordinal(M,x))"
paulson@13223
   186
paulson@13223
   187
  omega :: "[i=>o,i] => o"
paulson@13223
   188
    --{*omega is a limit ordinal none of whose elements are limit*}
paulson@13299
   189
    "omega(M,a) == limit_ordinal(M,a) & (\<forall>x[M]. x\<in>a --> ~ limit_ordinal(M,x))"
paulson@13223
   190
paulson@13350
   191
  is_quasinat :: "[i=>o,i] => o"
paulson@13350
   192
    "is_quasinat(M,z) == empty(M,z) | (\<exists>m[M]. successor(M,m,z))"
paulson@13350
   193
paulson@13350
   194
  is_nat_case :: "[i=>o, i, [i,i]=>o, i, i] => o"
paulson@13350
   195
    "is_nat_case(M, a, is_b, k, z) == 
paulson@13350
   196
       (empty(M,k) --> z=a) &
paulson@13350
   197
       (\<forall>m[M]. successor(M,m,k) --> is_b(m,z)) &
paulson@13363
   198
       (is_quasinat(M,k) | empty(M,z))"
paulson@13350
   199
paulson@13353
   200
  relativize1 :: "[i=>o, [i,i]=>o, i=>i] => o"
paulson@13353
   201
    "relativize1(M,is_f,f) == \<forall>x[M]. \<forall>y[M]. is_f(x,y) <-> y = f(x)"
paulson@13353
   202
paulson@13423
   203
  Relativize1 :: "[i=>o, i, [i,i]=>o, i=>i] => o"
paulson@13423
   204
    --{*as above, but typed*}
paulson@13423
   205
    "Relativize1(M,A,is_f,f) == 
paulson@13423
   206
        \<forall>x[M]. \<forall>y[M]. x\<in>A --> is_f(x,y) <-> y = f(x)"
paulson@13423
   207
paulson@13353
   208
  relativize2 :: "[i=>o, [i,i,i]=>o, [i,i]=>i] => o"
paulson@13353
   209
    "relativize2(M,is_f,f) == \<forall>x[M]. \<forall>y[M]. \<forall>z[M]. is_f(x,y,z) <-> z = f(x,y)"
paulson@13353
   210
paulson@13423
   211
  Relativize2 :: "[i=>o, i, i, [i,i,i]=>o, [i,i]=>i] => o"
paulson@13423
   212
    "Relativize2(M,A,B,is_f,f) ==
paulson@13423
   213
        \<forall>x[M]. \<forall>y[M]. \<forall>z[M]. x\<in>A --> y\<in>B --> is_f(x,y,z) <-> z = f(x,y)"
paulson@13423
   214
paulson@13353
   215
  relativize3 :: "[i=>o, [i,i,i,i]=>o, [i,i,i]=>i] => o"
paulson@13353
   216
    "relativize3(M,is_f,f) == 
paulson@13353
   217
       \<forall>x[M]. \<forall>y[M]. \<forall>z[M]. \<forall>u[M]. is_f(x,y,z,u) <-> u = f(x,y,z)"
paulson@13353
   218
paulson@13423
   219
  Relativize3 :: "[i=>o, i, i, i, [i,i,i,i]=>o, [i,i,i]=>i] => o"
paulson@13423
   220
    "Relativize3(M,A,B,C,is_f,f) == 
paulson@13423
   221
       \<forall>x[M]. \<forall>y[M]. \<forall>z[M]. \<forall>u[M]. 
paulson@13423
   222
         x\<in>A --> y\<in>B --> z\<in>C --> is_f(x,y,z,u) <-> u = f(x,y,z)"
paulson@13423
   223
paulson@13423
   224
  relativize4 :: "[i=>o, [i,i,i,i,i]=>o, [i,i,i,i]=>i] => o"
paulson@13423
   225
    "relativize4(M,is_f,f) == 
paulson@13423
   226
       \<forall>u[M]. \<forall>x[M]. \<forall>y[M]. \<forall>z[M]. \<forall>a[M]. is_f(u,x,y,z,a) <-> a = f(u,x,y,z)"
paulson@13423
   227
paulson@13423
   228
paulson@13423
   229
text{*Useful when absoluteness reasoning has replaced the predicates by terms*}
paulson@13423
   230
lemma triv_Relativize1:
paulson@13423
   231
     "Relativize1(M, A, \<lambda>x y. y = f(x), f)"
paulson@13423
   232
by (simp add: Relativize1_def) 
paulson@13423
   233
paulson@13423
   234
lemma triv_Relativize2:
paulson@13423
   235
     "Relativize2(M, A, B, \<lambda>x y a. a = f(x,y), f)"
paulson@13423
   236
by (simp add: Relativize2_def) 
paulson@13423
   237
paulson@13223
   238
paulson@13223
   239
subsection {*The relativized ZF axioms*}
paulson@13223
   240
constdefs
paulson@13223
   241
paulson@13223
   242
  extensionality :: "(i=>o) => o"
paulson@13223
   243
    "extensionality(M) == 
paulson@13290
   244
	\<forall>x[M]. \<forall>y[M]. (\<forall>z[M]. z \<in> x <-> z \<in> y) --> x=y"
paulson@13223
   245
paulson@13223
   246
  separation :: "[i=>o, i=>o] => o"
paulson@13223
   247
    --{*Big problem: the formula @{text P} should only involve parameters
paulson@13223
   248
        belonging to @{text M}.  Don't see how to enforce that.*}
paulson@13223
   249
    "separation(M,P) == 
paulson@13290
   250
	\<forall>z[M]. \<exists>y[M]. \<forall>x[M]. x \<in> y <-> x \<in> z & P(x)"
paulson@13223
   251
paulson@13223
   252
  upair_ax :: "(i=>o) => o"
paulson@13299
   253
    "upair_ax(M) == \<forall>x y. M(x) --> M(y) --> (\<exists>z[M]. upair(M,x,y,z))"
paulson@13223
   254
paulson@13223
   255
  Union_ax :: "(i=>o) => o"
paulson@13514
   256
    "Union_ax(M) == \<forall>x[M]. \<exists>z[M]. big_union(M,x,z)"
paulson@13223
   257
paulson@13223
   258
  power_ax :: "(i=>o) => o"
paulson@13514
   259
    "power_ax(M) == \<forall>x[M]. \<exists>z[M]. powerset(M,x,z)"
paulson@13223
   260
paulson@13223
   261
  univalent :: "[i=>o, i, [i,i]=>o] => o"
paulson@13223
   262
    "univalent(M,A,P) == 
paulson@13299
   263
	(\<forall>x[M]. x\<in>A --> (\<forall>y z. M(y) --> M(z) --> P(x,y) & P(x,z) --> y=z))"
paulson@13223
   264
paulson@13223
   265
  replacement :: "[i=>o, [i,i]=>o] => o"
paulson@13223
   266
    "replacement(M,P) == 
paulson@13299
   267
      \<forall>A[M]. univalent(M,A,P) -->
paulson@13514
   268
      (\<exists>Y[M]. \<forall>b[M]. (\<exists>x[M]. x\<in>A & P(x,b)) --> b \<in> Y)"
paulson@13223
   269
paulson@13223
   270
  strong_replacement :: "[i=>o, [i,i]=>o] => o"
paulson@13223
   271
    "strong_replacement(M,P) == 
paulson@13299
   272
      \<forall>A[M]. univalent(M,A,P) -->
paulson@13514
   273
      (\<exists>Y[M]. \<forall>b[M]. b \<in> Y <-> (\<exists>x[M]. x\<in>A & P(x,b)))"
paulson@13223
   274
paulson@13223
   275
  foundation_ax :: "(i=>o) => o"
paulson@13223
   276
    "foundation_ax(M) == 
paulson@13514
   277
	\<forall>x[M]. (\<exists>y\<in>x. M(y)) --> (\<exists>y[M]. y\<in>x & ~(\<exists>z[M]. z\<in>x & z \<in> y))"
paulson@13223
   278
paulson@13223
   279
paulson@13223
   280
subsection{*A trivial consistency proof for $V_\omega$ *}
paulson@13223
   281
paulson@13223
   282
text{*We prove that $V_\omega$ 
paulson@13223
   283
      (or @{text univ} in Isabelle) satisfies some ZF axioms.
paulson@13223
   284
     Kunen, Theorem IV 3.13, page 123.*}
paulson@13223
   285
paulson@13223
   286
lemma univ0_downwards_mem: "[| y \<in> x; x \<in> univ(0) |] ==> y \<in> univ(0)"
paulson@13223
   287
apply (insert Transset_univ [OF Transset_0])  
paulson@13223
   288
apply (simp add: Transset_def, blast) 
paulson@13223
   289
done
paulson@13223
   290
paulson@13223
   291
lemma univ0_Ball_abs [simp]: 
paulson@13223
   292
     "A \<in> univ(0) ==> (\<forall>x\<in>A. x \<in> univ(0) --> P(x)) <-> (\<forall>x\<in>A. P(x))" 
paulson@13223
   293
by (blast intro: univ0_downwards_mem) 
paulson@13223
   294
paulson@13223
   295
lemma univ0_Bex_abs [simp]: 
paulson@13223
   296
     "A \<in> univ(0) ==> (\<exists>x\<in>A. x \<in> univ(0) & P(x)) <-> (\<exists>x\<in>A. P(x))" 
paulson@13223
   297
by (blast intro: univ0_downwards_mem) 
paulson@13223
   298
paulson@13223
   299
text{*Congruence rule for separation: can assume the variable is in @{text M}*}
paulson@13254
   300
lemma separation_cong [cong]:
paulson@13339
   301
     "(!!x. M(x) ==> P(x) <-> P'(x)) 
paulson@13339
   302
      ==> separation(M, %x. P(x)) <-> separation(M, %x. P'(x))"
paulson@13223
   303
by (simp add: separation_def) 
paulson@13223
   304
paulson@13254
   305
lemma univalent_cong [cong]:
paulson@13223
   306
     "[| A=A'; !!x y. [| x\<in>A; M(x); M(y) |] ==> P(x,y) <-> P'(x,y) |] 
paulson@13339
   307
      ==> univalent(M, A, %x y. P(x,y)) <-> univalent(M, A', %x y. P'(x,y))"
paulson@13223
   308
by (simp add: univalent_def) 
paulson@13223
   309
paulson@13505
   310
lemma univalent_triv [intro,simp]:
paulson@13505
   311
     "univalent(M, A, \<lambda>x y. y = f(x))"
paulson@13505
   312
by (simp add: univalent_def) 
paulson@13505
   313
paulson@13505
   314
lemma univalent_conjI2 [intro,simp]:
paulson@13505
   315
     "univalent(M,A,Q) ==> univalent(M, A, \<lambda>x y. P(x,y) & Q(x,y))"
paulson@13505
   316
by (simp add: univalent_def, blast) 
paulson@13505
   317
paulson@13505
   318
text{*Congruence rule for replacement*}
paulson@13254
   319
lemma strong_replacement_cong [cong]:
paulson@13223
   320
     "[| !!x y. [| M(x); M(y) |] ==> P(x,y) <-> P'(x,y) |] 
paulson@13339
   321
      ==> strong_replacement(M, %x y. P(x,y)) <-> 
paulson@13339
   322
          strong_replacement(M, %x y. P'(x,y))" 
paulson@13223
   323
by (simp add: strong_replacement_def) 
paulson@13223
   324
paulson@13223
   325
text{*The extensionality axiom*}
paulson@13223
   326
lemma "extensionality(\<lambda>x. x \<in> univ(0))"
paulson@13223
   327
apply (simp add: extensionality_def)
paulson@13223
   328
apply (blast intro: univ0_downwards_mem) 
paulson@13223
   329
done
paulson@13223
   330
paulson@13223
   331
text{*The separation axiom requires some lemmas*}
paulson@13223
   332
lemma Collect_in_Vfrom:
paulson@13223
   333
     "[| X \<in> Vfrom(A,j);  Transset(A) |] ==> Collect(X,P) \<in> Vfrom(A, succ(j))"
paulson@13223
   334
apply (drule Transset_Vfrom)
paulson@13223
   335
apply (rule subset_mem_Vfrom)
paulson@13223
   336
apply (unfold Transset_def, blast)
paulson@13223
   337
done
paulson@13223
   338
paulson@13223
   339
lemma Collect_in_VLimit:
paulson@13223
   340
     "[| X \<in> Vfrom(A,i);  Limit(i);  Transset(A) |] 
paulson@13223
   341
      ==> Collect(X,P) \<in> Vfrom(A,i)"
paulson@13223
   342
apply (rule Limit_VfromE, assumption+)
paulson@13223
   343
apply (blast intro: Limit_has_succ VfromI Collect_in_Vfrom)
paulson@13223
   344
done
paulson@13223
   345
paulson@13223
   346
lemma Collect_in_univ:
paulson@13223
   347
     "[| X \<in> univ(A);  Transset(A) |] ==> Collect(X,P) \<in> univ(A)"
paulson@13223
   348
by (simp add: univ_def Collect_in_VLimit Limit_nat)
paulson@13223
   349
paulson@13223
   350
lemma "separation(\<lambda>x. x \<in> univ(0), P)"
paulson@13290
   351
apply (simp add: separation_def, clarify) 
paulson@13339
   352
apply (rule_tac x = "Collect(z,P)" in bexI) 
paulson@13290
   353
apply (blast intro: Collect_in_univ Transset_0)+
paulson@13223
   354
done
paulson@13223
   355
paulson@13223
   356
text{*Unordered pairing axiom*}
paulson@13223
   357
lemma "upair_ax(\<lambda>x. x \<in> univ(0))"
paulson@13223
   358
apply (simp add: upair_ax_def upair_def)  
paulson@13223
   359
apply (blast intro: doubleton_in_univ) 
paulson@13223
   360
done
paulson@13223
   361
paulson@13223
   362
text{*Union axiom*}
paulson@13223
   363
lemma "Union_ax(\<lambda>x. x \<in> univ(0))"  
paulson@13299
   364
apply (simp add: Union_ax_def big_union_def, clarify) 
paulson@13299
   365
apply (rule_tac x="\<Union>x" in bexI)  
paulson@13299
   366
 apply (blast intro: univ0_downwards_mem)
paulson@13299
   367
apply (blast intro: Union_in_univ Transset_0) 
paulson@13223
   368
done
paulson@13223
   369
paulson@13223
   370
text{*Powerset axiom*}
paulson@13223
   371
paulson@13223
   372
lemma Pow_in_univ:
paulson@13223
   373
     "[| X \<in> univ(A);  Transset(A) |] ==> Pow(X) \<in> univ(A)"
paulson@13223
   374
apply (simp add: univ_def Pow_in_VLimit Limit_nat)
paulson@13223
   375
done
paulson@13223
   376
paulson@13223
   377
lemma "power_ax(\<lambda>x. x \<in> univ(0))"  
paulson@13299
   378
apply (simp add: power_ax_def powerset_def subset_def, clarify) 
paulson@13299
   379
apply (rule_tac x="Pow(x)" in bexI)
paulson@13299
   380
 apply (blast intro: univ0_downwards_mem)
paulson@13299
   381
apply (blast intro: Pow_in_univ Transset_0) 
paulson@13223
   382
done
paulson@13223
   383
paulson@13223
   384
text{*Foundation axiom*}
paulson@13223
   385
lemma "foundation_ax(\<lambda>x. x \<in> univ(0))"  
paulson@13223
   386
apply (simp add: foundation_ax_def, clarify)
paulson@13299
   387
apply (cut_tac A=x in foundation) 
paulson@13299
   388
apply (blast intro: univ0_downwards_mem)
paulson@13223
   389
done
paulson@13223
   390
paulson@13223
   391
lemma "replacement(\<lambda>x. x \<in> univ(0), P)"  
paulson@13223
   392
apply (simp add: replacement_def, clarify) 
paulson@13223
   393
oops
paulson@13223
   394
text{*no idea: maybe prove by induction on the rank of A?*}
paulson@13223
   395
paulson@13223
   396
text{*Still missing: Replacement, Choice*}
paulson@13223
   397
paulson@13223
   398
subsection{*lemmas needed to reduce some set constructions to instances
paulson@13223
   399
      of Separation*}
paulson@13223
   400
paulson@13223
   401
lemma image_iff_Collect: "r `` A = {y \<in> Union(Union(r)). \<exists>p\<in>r. \<exists>x\<in>A. p=<x,y>}"
paulson@13223
   402
apply (rule equalityI, auto) 
paulson@13223
   403
apply (simp add: Pair_def, blast) 
paulson@13223
   404
done
paulson@13223
   405
paulson@13223
   406
lemma vimage_iff_Collect:
paulson@13223
   407
     "r -`` A = {x \<in> Union(Union(r)). \<exists>p\<in>r. \<exists>y\<in>A. p=<x,y>}"
paulson@13223
   408
apply (rule equalityI, auto) 
paulson@13223
   409
apply (simp add: Pair_def, blast) 
paulson@13223
   410
done
paulson@13223
   411
paulson@13223
   412
text{*These two lemmas lets us prove @{text domain_closed} and 
paulson@13223
   413
      @{text range_closed} without new instances of separation*}
paulson@13223
   414
paulson@13223
   415
lemma domain_eq_vimage: "domain(r) = r -`` Union(Union(r))"
paulson@13223
   416
apply (rule equalityI, auto)
paulson@13223
   417
apply (rule vimageI, assumption)
paulson@13223
   418
apply (simp add: Pair_def, blast) 
paulson@13223
   419
done
paulson@13223
   420
paulson@13223
   421
lemma range_eq_image: "range(r) = r `` Union(Union(r))"
paulson@13223
   422
apply (rule equalityI, auto)
paulson@13223
   423
apply (rule imageI, assumption)
paulson@13223
   424
apply (simp add: Pair_def, blast) 
paulson@13223
   425
done
paulson@13223
   426
paulson@13223
   427
lemma replacementD:
paulson@13223
   428
    "[| replacement(M,P); M(A);  univalent(M,A,P) |]
paulson@13299
   429
     ==> \<exists>Y[M]. (\<forall>b[M]. ((\<exists>x[M]. x\<in>A & P(x,b)) --> b \<in> Y))"
paulson@13223
   430
by (simp add: replacement_def) 
paulson@13223
   431
paulson@13223
   432
lemma strong_replacementD:
paulson@13223
   433
    "[| strong_replacement(M,P); M(A);  univalent(M,A,P) |]
paulson@13299
   434
     ==> \<exists>Y[M]. (\<forall>b[M]. (b \<in> Y <-> (\<exists>x[M]. x\<in>A & P(x,b))))"
paulson@13223
   435
by (simp add: strong_replacement_def) 
paulson@13223
   436
paulson@13223
   437
lemma separationD:
paulson@13290
   438
    "[| separation(M,P); M(z) |] ==> \<exists>y[M]. \<forall>x[M]. x \<in> y <-> x \<in> z & P(x)"
paulson@13223
   439
by (simp add: separation_def) 
paulson@13223
   440
paulson@13223
   441
paulson@13223
   442
text{*More constants, for order types*}
paulson@13223
   443
constdefs
paulson@13223
   444
paulson@13223
   445
  order_isomorphism :: "[i=>o,i,i,i,i,i] => o"
paulson@13223
   446
    "order_isomorphism(M,A,r,B,s,f) == 
paulson@13223
   447
        bijection(M,A,B,f) & 
paulson@13306
   448
        (\<forall>x[M]. x\<in>A --> (\<forall>y[M]. y\<in>A -->
paulson@13306
   449
          (\<forall>p[M]. \<forall>fx[M]. \<forall>fy[M]. \<forall>q[M].
paulson@13223
   450
            pair(M,x,y,p) --> fun_apply(M,f,x,fx) --> fun_apply(M,f,y,fy) --> 
paulson@13306
   451
            pair(M,fx,fy,q) --> (p\<in>r <-> q\<in>s))))"
paulson@13223
   452
paulson@13223
   453
  pred_set :: "[i=>o,i,i,i,i] => o"
paulson@13223
   454
    "pred_set(M,A,x,r,B) == 
paulson@13299
   455
	\<forall>y[M]. y \<in> B <-> (\<exists>p[M]. p\<in>r & y \<in> A & pair(M,y,x,p))"
paulson@13223
   456
paulson@13223
   457
  membership :: "[i=>o,i,i] => o" --{*membership relation*}
paulson@13223
   458
    "membership(M,A,r) == 
paulson@13306
   459
	\<forall>p[M]. p \<in> r <-> (\<exists>x[M]. x\<in>A & (\<exists>y[M]. y\<in>A & x\<in>y & pair(M,x,y,p)))"
paulson@13223
   460
paulson@13223
   461
paulson@13418
   462
subsection{*Introducing a Transitive Class Model*}
paulson@13223
   463
paulson@13223
   464
text{*The class M is assumed to be transitive and to satisfy some
paulson@13223
   465
      relativized ZF axioms*}
wenzelm@13428
   466
locale M_triv_axioms =
paulson@13223
   467
  fixes M
paulson@13223
   468
  assumes transM:           "[| y\<in>x; M(x) |] ==> M(y)"
paulson@13223
   469
      and nonempty [simp]:  "M(0)"
paulson@13223
   470
      and upair_ax:	    "upair_ax(M)"
paulson@13223
   471
      and Union_ax:	    "Union_ax(M)"
paulson@13223
   472
      and power_ax:         "power_ax(M)"
paulson@13223
   473
      and replacement:      "replacement(M,P)"
paulson@13268
   474
      and M_nat [iff]:      "M(nat)"           (*i.e. the axiom of infinity*)
paulson@13290
   475
paulson@13290
   476
lemma (in M_triv_axioms) rall_abs [simp]: 
paulson@13290
   477
     "M(A) ==> (\<forall>x[M]. x\<in>A --> P(x)) <-> (\<forall>x\<in>A. P(x))" 
paulson@13290
   478
by (blast intro: transM) 
paulson@13290
   479
paulson@13290
   480
lemma (in M_triv_axioms) rex_abs [simp]: 
paulson@13290
   481
     "M(A) ==> (\<exists>x[M]. x\<in>A & P(x)) <-> (\<exists>x\<in>A. P(x))" 
paulson@13290
   482
by (blast intro: transM) 
paulson@13290
   483
paulson@13290
   484
lemma (in M_triv_axioms) ball_iff_equiv: 
paulson@13299
   485
     "M(A) ==> (\<forall>x[M]. (x\<in>A <-> P(x))) <-> 
paulson@13290
   486
               (\<forall>x\<in>A. P(x)) & (\<forall>x. P(x) --> M(x) --> x\<in>A)" 
paulson@13290
   487
by (blast intro: transM)
paulson@13290
   488
paulson@13290
   489
text{*Simplifies proofs of equalities when there's an iff-equality
paulson@13290
   490
      available for rewriting, universally quantified over M. *}
paulson@13290
   491
lemma (in M_triv_axioms) M_equalityI: 
paulson@13290
   492
     "[| !!x. M(x) ==> x\<in>A <-> x\<in>B; M(A); M(B) |] ==> A=B"
paulson@13290
   493
by (blast intro!: equalityI dest: transM) 
paulson@13290
   494
paulson@13418
   495
paulson@13418
   496
subsubsection{*Trivial Absoluteness Proofs: Empty Set, Pairs, etc.*}
paulson@13418
   497
paulson@13290
   498
lemma (in M_triv_axioms) empty_abs [simp]: 
paulson@13290
   499
     "M(z) ==> empty(M,z) <-> z=0"
paulson@13290
   500
apply (simp add: empty_def)
paulson@13290
   501
apply (blast intro: transM) 
paulson@13290
   502
done
paulson@13290
   503
paulson@13290
   504
lemma (in M_triv_axioms) subset_abs [simp]: 
paulson@13290
   505
     "M(A) ==> subset(M,A,B) <-> A \<subseteq> B"
paulson@13290
   506
apply (simp add: subset_def) 
paulson@13290
   507
apply (blast intro: transM) 
paulson@13290
   508
done
paulson@13290
   509
paulson@13290
   510
lemma (in M_triv_axioms) upair_abs [simp]: 
paulson@13290
   511
     "M(z) ==> upair(M,a,b,z) <-> z={a,b}"
paulson@13290
   512
apply (simp add: upair_def) 
paulson@13290
   513
apply (blast intro: transM) 
paulson@13290
   514
done
paulson@13290
   515
paulson@13290
   516
lemma (in M_triv_axioms) upair_in_M_iff [iff]:
paulson@13290
   517
     "M({a,b}) <-> M(a) & M(b)"
paulson@13290
   518
apply (insert upair_ax, simp add: upair_ax_def) 
paulson@13290
   519
apply (blast intro: transM) 
paulson@13290
   520
done
paulson@13290
   521
paulson@13290
   522
lemma (in M_triv_axioms) singleton_in_M_iff [iff]:
paulson@13290
   523
     "M({a}) <-> M(a)"
paulson@13290
   524
by (insert upair_in_M_iff [of a a], simp) 
paulson@13290
   525
paulson@13290
   526
lemma (in M_triv_axioms) pair_abs [simp]: 
paulson@13290
   527
     "M(z) ==> pair(M,a,b,z) <-> z=<a,b>"
paulson@13290
   528
apply (simp add: pair_def ZF.Pair_def)
paulson@13290
   529
apply (blast intro: transM) 
paulson@13290
   530
done
paulson@13290
   531
paulson@13290
   532
lemma (in M_triv_axioms) pair_in_M_iff [iff]:
paulson@13290
   533
     "M(<a,b>) <-> M(a) & M(b)"
paulson@13290
   534
by (simp add: ZF.Pair_def)
paulson@13290
   535
paulson@13290
   536
lemma (in M_triv_axioms) pair_components_in_M:
paulson@13290
   537
     "[| <x,y> \<in> A; M(A) |] ==> M(x) & M(y)"
paulson@13290
   538
apply (simp add: Pair_def)
paulson@13290
   539
apply (blast dest: transM) 
paulson@13290
   540
done
paulson@13290
   541
paulson@13290
   542
lemma (in M_triv_axioms) cartprod_abs [simp]: 
paulson@13290
   543
     "[| M(A); M(B); M(z) |] ==> cartprod(M,A,B,z) <-> z = A*B"
paulson@13290
   544
apply (simp add: cartprod_def)
paulson@13290
   545
apply (rule iffI) 
paulson@13290
   546
 apply (blast intro!: equalityI intro: transM dest!: rspec) 
paulson@13290
   547
apply (blast dest: transM) 
paulson@13290
   548
done
paulson@13290
   549
paulson@13418
   550
subsubsection{*Absoluteness for Unions and Intersections*}
paulson@13418
   551
paulson@13290
   552
lemma (in M_triv_axioms) union_abs [simp]: 
paulson@13290
   553
     "[| M(a); M(b); M(z) |] ==> union(M,a,b,z) <-> z = a Un b"
paulson@13290
   554
apply (simp add: union_def) 
paulson@13290
   555
apply (blast intro: transM) 
paulson@13290
   556
done
paulson@13290
   557
paulson@13290
   558
lemma (in M_triv_axioms) inter_abs [simp]: 
paulson@13290
   559
     "[| M(a); M(b); M(z) |] ==> inter(M,a,b,z) <-> z = a Int b"
paulson@13290
   560
apply (simp add: inter_def) 
paulson@13290
   561
apply (blast intro: transM) 
paulson@13290
   562
done
paulson@13290
   563
paulson@13290
   564
lemma (in M_triv_axioms) setdiff_abs [simp]: 
paulson@13290
   565
     "[| M(a); M(b); M(z) |] ==> setdiff(M,a,b,z) <-> z = a-b"
paulson@13290
   566
apply (simp add: setdiff_def) 
paulson@13290
   567
apply (blast intro: transM) 
paulson@13290
   568
done
paulson@13290
   569
paulson@13290
   570
lemma (in M_triv_axioms) Union_abs [simp]: 
paulson@13290
   571
     "[| M(A); M(z) |] ==> big_union(M,A,z) <-> z = Union(A)"
paulson@13290
   572
apply (simp add: big_union_def) 
paulson@13290
   573
apply (blast intro!: equalityI dest: transM) 
paulson@13290
   574
done
paulson@13290
   575
paulson@13290
   576
lemma (in M_triv_axioms) Union_closed [intro,simp]:
paulson@13290
   577
     "M(A) ==> M(Union(A))"
paulson@13290
   578
by (insert Union_ax, simp add: Union_ax_def) 
paulson@13290
   579
paulson@13290
   580
lemma (in M_triv_axioms) Un_closed [intro,simp]:
paulson@13290
   581
     "[| M(A); M(B) |] ==> M(A Un B)"
paulson@13290
   582
by (simp only: Un_eq_Union, blast) 
paulson@13290
   583
paulson@13290
   584
lemma (in M_triv_axioms) cons_closed [intro,simp]:
paulson@13290
   585
     "[| M(a); M(A) |] ==> M(cons(a,A))"
paulson@13290
   586
by (subst cons_eq [symmetric], blast) 
paulson@13290
   587
paulson@13306
   588
lemma (in M_triv_axioms) cons_abs [simp]: 
paulson@13306
   589
     "[| M(b); M(z) |] ==> is_cons(M,a,b,z) <-> z = cons(a,b)"
paulson@13306
   590
by (simp add: is_cons_def, blast intro: transM)  
paulson@13306
   591
paulson@13290
   592
lemma (in M_triv_axioms) successor_abs [simp]: 
paulson@13306
   593
     "[| M(a); M(z) |] ==> successor(M,a,z) <-> z = succ(a)"
paulson@13290
   594
by (simp add: successor_def, blast)  
paulson@13290
   595
paulson@13290
   596
lemma (in M_triv_axioms) succ_in_M_iff [iff]:
paulson@13290
   597
     "M(succ(a)) <-> M(a)"
paulson@13290
   598
apply (simp add: succ_def) 
paulson@13290
   599
apply (blast intro: transM) 
paulson@13290
   600
done
paulson@13290
   601
paulson@13418
   602
subsubsection{*Absoluteness for Separation and Replacement*}
paulson@13418
   603
paulson@13290
   604
lemma (in M_triv_axioms) separation_closed [intro,simp]:
paulson@13290
   605
     "[| separation(M,P); M(A) |] ==> M(Collect(A,P))"
paulson@13290
   606
apply (insert separation, simp add: separation_def) 
paulson@13290
   607
apply (drule rspec, assumption, clarify) 
paulson@13290
   608
apply (subgoal_tac "y = Collect(A,P)", blast)
paulson@13290
   609
apply (blast dest: transM) 
paulson@13290
   610
done
paulson@13290
   611
paulson@13436
   612
lemma separation_iff:
paulson@13436
   613
     "separation(M,P) <-> (\<forall>z[M]. \<exists>y[M]. is_Collect(M,z,P,y))"
paulson@13436
   614
by (simp add: separation_def is_Collect_def) 
paulson@13436
   615
paulson@13436
   616
lemma (in M_triv_axioms) Collect_abs [simp]: 
paulson@13436
   617
     "[| M(A); M(z) |] ==> is_Collect(M,A,P,z) <-> z = Collect(A,P)"
paulson@13436
   618
apply (simp add: is_Collect_def)
paulson@13436
   619
apply (blast intro!: equalityI dest: transM)
paulson@13436
   620
done
paulson@13436
   621
paulson@13290
   622
text{*Probably the premise and conclusion are equivalent*}
paulson@13348
   623
lemma (in M_triv_axioms) strong_replacementI [rule_format]:
paulson@13306
   624
    "[| \<forall>A[M]. separation(M, %u. \<exists>x[M]. x\<in>A & P(x,u)) |]
paulson@13290
   625
     ==> strong_replacement(M,P)"
paulson@13290
   626
apply (simp add: strong_replacement_def, clarify) 
paulson@13290
   627
apply (frule replacementD [OF replacement], assumption, clarify) 
paulson@13299
   628
apply (drule_tac x=A in rspec, clarify)  
paulson@13290
   629
apply (drule_tac z=Y in separationD, assumption, clarify) 
paulson@13299
   630
apply (rule_tac x=y in rexI) 
paulson@13299
   631
apply (blast dest: transM)+
paulson@13290
   632
done
paulson@13290
   633
paulson@13290
   634
paulson@13505
   635
subsubsection{*The Operator @{term is_Replace}*}
paulson@13505
   636
paulson@13505
   637
paulson@13505
   638
lemma is_Replace_cong [cong]:
paulson@13505
   639
     "[| A=A'; 
paulson@13505
   640
         !!x y. [| M(x); M(y) |] ==> P(x,y) <-> P'(x,y);
paulson@13505
   641
         z=z' |] 
paulson@13505
   642
      ==> is_Replace(M, A, %x y. P(x,y), z) <-> 
paulson@13505
   643
          is_Replace(M, A', %x y. P'(x,y), z')" 
paulson@13505
   644
by (simp add: is_Replace_def) 
paulson@13505
   645
paulson@13505
   646
lemma (in M_triv_axioms) univalent_Replace_iff: 
paulson@13505
   647
     "[| M(A); univalent(M,A,P);
paulson@13505
   648
         !!x y. [| x\<in>A; P(x,y) |] ==> M(y) |] 
paulson@13505
   649
      ==> u \<in> Replace(A,P) <-> (\<exists>x. x\<in>A & P(x,u))"
paulson@13505
   650
apply (simp add: Replace_iff univalent_def) 
paulson@13505
   651
apply (blast dest: transM)
paulson@13505
   652
done
paulson@13505
   653
paulson@13290
   654
(*The last premise expresses that P takes M to M*)
paulson@13290
   655
lemma (in M_triv_axioms) strong_replacement_closed [intro,simp]:
paulson@13290
   656
     "[| strong_replacement(M,P); M(A); univalent(M,A,P); 
paulson@13505
   657
         !!x y. [| x\<in>A; P(x,y) |] ==> M(y) |] ==> M(Replace(A,P))"
paulson@13290
   658
apply (simp add: strong_replacement_def) 
paulson@13505
   659
apply (drule_tac x=A in rspec, safe) 
paulson@13290
   660
apply (subgoal_tac "Replace(A,P) = Y")
paulson@13290
   661
 apply simp 
paulson@13505
   662
apply (rule equality_iffI)
paulson@13505
   663
apply (simp add: univalent_Replace_iff)
paulson@13505
   664
apply (blast dest: transM) 
paulson@13505
   665
done
paulson@13505
   666
paulson@13505
   667
lemma (in M_triv_axioms) Replace_abs: 
paulson@13505
   668
     "[| M(A); M(z); univalent(M,A,P); strong_replacement(M, P);
paulson@13505
   669
         !!x y. [| x\<in>A; P(x,y) |] ==> M(y)  |] 
paulson@13505
   670
      ==> is_Replace(M,A,P,z) <-> z = Replace(A,P)"
paulson@13505
   671
apply (simp add: is_Replace_def)
paulson@13505
   672
apply (rule iffI) 
paulson@13505
   673
apply (rule M_equalityI) 
paulson@13505
   674
apply (simp_all add: univalent_Replace_iff, blast, blast) 
paulson@13290
   675
done
paulson@13290
   676
paulson@13290
   677
(*The first premise can't simply be assumed as a schema.
paulson@13290
   678
  It is essential to take care when asserting instances of Replacement.
paulson@13290
   679
  Let K be a nonconstructible subset of nat and define
paulson@13290
   680
  f(x) = x if x:K and f(x)=0 otherwise.  Then RepFun(nat,f) = cons(0,K), a 
paulson@13290
   681
  nonconstructible set.  So we cannot assume that M(X) implies M(RepFun(X,f))
paulson@13290
   682
  even for f : M -> M.
paulson@13290
   683
*)
paulson@13353
   684
lemma (in M_triv_axioms) RepFun_closed:
paulson@13290
   685
     "[| strong_replacement(M, \<lambda>x y. y = f(x)); M(A); \<forall>x\<in>A. M(f(x)) |]
paulson@13290
   686
      ==> M(RepFun(A,f))"
paulson@13290
   687
apply (simp add: RepFun_def) 
paulson@13290
   688
apply (rule strong_replacement_closed) 
paulson@13290
   689
apply (auto dest: transM  simp add: univalent_def) 
paulson@13290
   690
done
paulson@13290
   691
paulson@13353
   692
lemma Replace_conj_eq: "{y . x \<in> A, x\<in>A & y=f(x)} = {y . x\<in>A, y=f(x)}"
paulson@13353
   693
by simp
paulson@13353
   694
paulson@13353
   695
text{*Better than @{text RepFun_closed} when having the formula @{term "x\<in>A"}
paulson@13353
   696
      makes relativization easier.*}
paulson@13353
   697
lemma (in M_triv_axioms) RepFun_closed2:
paulson@13353
   698
     "[| strong_replacement(M, \<lambda>x y. x\<in>A & y = f(x)); M(A); \<forall>x\<in>A. M(f(x)) |]
paulson@13353
   699
      ==> M(RepFun(A, %x. f(x)))"
paulson@13353
   700
apply (simp add: RepFun_def)
paulson@13353
   701
apply (frule strong_replacement_closed, assumption)
paulson@13353
   702
apply (auto dest: transM  simp add: Replace_conj_eq univalent_def) 
paulson@13353
   703
done
paulson@13353
   704
paulson@13418
   705
subsubsection {*Absoluteness for @{term Lambda}*}
paulson@13418
   706
paulson@13418
   707
constdefs
paulson@13418
   708
 is_lambda :: "[i=>o, i, [i,i]=>o, i] => o"
paulson@13418
   709
    "is_lambda(M, A, is_b, z) == 
paulson@13418
   710
       \<forall>p[M]. p \<in> z <->
paulson@13418
   711
        (\<exists>u[M]. \<exists>v[M]. u\<in>A & pair(M,u,v,p) & is_b(u,v))"
paulson@13418
   712
paulson@13418
   713
lemma (in M_triv_axioms) lam_closed:
paulson@13290
   714
     "[| strong_replacement(M, \<lambda>x y. y = <x,b(x)>); M(A); \<forall>x\<in>A. M(b(x)) |]
paulson@13290
   715
      ==> M(\<lambda>x\<in>A. b(x))"
paulson@13353
   716
by (simp add: lam_def, blast intro: RepFun_closed dest: transM) 
paulson@13290
   717
paulson@13418
   718
text{*Better than @{text lam_closed}: has the formula @{term "x\<in>A"}*}
paulson@13418
   719
lemma (in M_triv_axioms) lam_closed2:
paulson@13418
   720
  "[|strong_replacement(M, \<lambda>x y. x\<in>A & y = \<langle>x, b(x)\<rangle>);
paulson@13418
   721
     M(A); \<forall>m[M]. m\<in>A --> M(b(m))|] ==> M(Lambda(A,b))"
paulson@13418
   722
apply (simp add: lam_def)
paulson@13418
   723
apply (blast intro: RepFun_closed2 dest: transM)  
paulson@13418
   724
done
paulson@13418
   725
paulson@13418
   726
lemma (in M_triv_axioms) lambda_abs2 [simp]: 
paulson@13418
   727
     "[| strong_replacement(M, \<lambda>x y. x\<in>A & y = \<langle>x, b(x)\<rangle>);
paulson@13423
   728
         Relativize1(M,A,is_b,b); M(A); \<forall>m[M]. m\<in>A --> M(b(m)); M(z) |] 
paulson@13418
   729
      ==> is_lambda(M,A,is_b,z) <-> z = Lambda(A,b)"
paulson@13423
   730
apply (simp add: Relativize1_def is_lambda_def)
paulson@13418
   731
apply (rule iffI)
paulson@13418
   732
 prefer 2 apply (simp add: lam_def) 
paulson@13418
   733
apply (rule M_equalityI)
paulson@13418
   734
  apply (simp add: lam_def) 
paulson@13418
   735
 apply (simp add: lam_closed2)+
paulson@13418
   736
done
paulson@13418
   737
paulson@13423
   738
lemma is_lambda_cong [cong]:
paulson@13423
   739
     "[| A=A';  z=z'; 
paulson@13423
   740
         !!x y. [| x\<in>A; M(x); M(y) |] ==> is_b(x,y) <-> is_b'(x,y) |] 
paulson@13423
   741
      ==> is_lambda(M, A, %x y. is_b(x,y), z) <-> 
paulson@13423
   742
          is_lambda(M, A', %x y. is_b'(x,y), z')" 
paulson@13423
   743
by (simp add: is_lambda_def) 
paulson@13423
   744
paulson@13290
   745
lemma (in M_triv_axioms) image_abs [simp]: 
paulson@13290
   746
     "[| M(r); M(A); M(z) |] ==> image(M,r,A,z) <-> z = r``A"
paulson@13290
   747
apply (simp add: image_def)
paulson@13290
   748
apply (rule iffI) 
paulson@13290
   749
 apply (blast intro!: equalityI dest: transM, blast) 
paulson@13290
   750
done
paulson@13290
   751
paulson@13290
   752
text{*What about @{text Pow_abs}?  Powerset is NOT absolute!
paulson@13290
   753
      This result is one direction of absoluteness.*}
paulson@13290
   754
paulson@13290
   755
lemma (in M_triv_axioms) powerset_Pow: 
paulson@13290
   756
     "powerset(M, x, Pow(x))"
paulson@13290
   757
by (simp add: powerset_def)
paulson@13290
   758
paulson@13290
   759
text{*But we can't prove that the powerset in @{text M} includes the
paulson@13290
   760
      real powerset.*}
paulson@13290
   761
lemma (in M_triv_axioms) powerset_imp_subset_Pow: 
paulson@13290
   762
     "[| powerset(M,x,y); M(y) |] ==> y <= Pow(x)"
paulson@13290
   763
apply (simp add: powerset_def) 
paulson@13290
   764
apply (blast dest: transM) 
paulson@13290
   765
done
paulson@13290
   766
paulson@13418
   767
subsubsection{*Absoluteness for the Natural Numbers*}
paulson@13418
   768
paulson@13290
   769
lemma (in M_triv_axioms) nat_into_M [intro]:
paulson@13290
   770
     "n \<in> nat ==> M(n)"
paulson@13290
   771
by (induct n rule: nat_induct, simp_all)
paulson@13290
   772
paulson@13350
   773
lemma (in M_triv_axioms) nat_case_closed [intro,simp]:
paulson@13290
   774
  "[|M(k); M(a); \<forall>m[M]. M(b(m))|] ==> M(nat_case(a,b,k))"
paulson@13290
   775
apply (case_tac "k=0", simp) 
paulson@13290
   776
apply (case_tac "\<exists>m. k = succ(m)", force)
paulson@13290
   777
apply (simp add: nat_case_def) 
paulson@13290
   778
done
paulson@13290
   779
paulson@13350
   780
lemma (in M_triv_axioms) quasinat_abs [simp]: 
paulson@13350
   781
     "M(z) ==> is_quasinat(M,z) <-> quasinat(z)"
paulson@13350
   782
by (auto simp add: is_quasinat_def quasinat_def)
paulson@13350
   783
paulson@13350
   784
lemma (in M_triv_axioms) nat_case_abs [simp]: 
paulson@13353
   785
     "[| relativize1(M,is_b,b); M(k); M(z) |] 
paulson@13353
   786
      ==> is_nat_case(M,a,is_b,k,z) <-> z = nat_case(a,b,k)"
paulson@13350
   787
apply (case_tac "quasinat(k)") 
paulson@13350
   788
 prefer 2 
paulson@13350
   789
 apply (simp add: is_nat_case_def non_nat_case) 
paulson@13350
   790
 apply (force simp add: quasinat_def) 
paulson@13350
   791
apply (simp add: quasinat_def is_nat_case_def)
paulson@13350
   792
apply (elim disjE exE) 
paulson@13353
   793
 apply (simp_all add: relativize1_def) 
paulson@13350
   794
done
paulson@13350
   795
paulson@13363
   796
(*NOT for the simplifier.  The assumption M(z') is apparently necessary, but 
paulson@13363
   797
  causes the error "Failed congruence proof!"  It may be better to replace
paulson@13363
   798
  is_nat_case by nat_case before attempting congruence reasoning.*)
paulson@13434
   799
lemma is_nat_case_cong:
paulson@13352
   800
     "[| a = a'; k = k';  z = z';  M(z');
paulson@13352
   801
       !!x y. [| M(x); M(y) |] ==> is_b(x,y) <-> is_b'(x,y) |]
paulson@13352
   802
      ==> is_nat_case(M, a, is_b, k, z) <-> is_nat_case(M, a', is_b', k', z')"
paulson@13352
   803
by (simp add: is_nat_case_def) 
paulson@13352
   804
paulson@13290
   805
paulson@13418
   806
subsection{*Absoluteness for Ordinals*}
paulson@13290
   807
text{*These results constitute Theorem IV 5.1 of Kunen (page 126).*}
paulson@13290
   808
paulson@13290
   809
lemma (in M_triv_axioms) lt_closed:
paulson@13290
   810
     "[| j<i; M(i) |] ==> M(j)" 
paulson@13290
   811
by (blast dest: ltD intro: transM) 
paulson@13290
   812
paulson@13290
   813
lemma (in M_triv_axioms) transitive_set_abs [simp]: 
paulson@13290
   814
     "M(a) ==> transitive_set(M,a) <-> Transset(a)"
paulson@13290
   815
by (simp add: transitive_set_def Transset_def)
paulson@13290
   816
paulson@13290
   817
lemma (in M_triv_axioms) ordinal_abs [simp]: 
paulson@13290
   818
     "M(a) ==> ordinal(M,a) <-> Ord(a)"
paulson@13290
   819
by (simp add: ordinal_def Ord_def)
paulson@13290
   820
paulson@13290
   821
lemma (in M_triv_axioms) limit_ordinal_abs [simp]: 
paulson@13543
   822
     "M(a) ==> limit_ordinal(M,a) <-> Limit(a)" 
paulson@13543
   823
apply (unfold Limit_def limit_ordinal_def) 
paulson@13543
   824
apply (simp add: Ord_0_lt_iff) 
paulson@13290
   825
apply (simp add: lt_def, blast) 
paulson@13290
   826
done
paulson@13290
   827
paulson@13290
   828
lemma (in M_triv_axioms) successor_ordinal_abs [simp]: 
paulson@13299
   829
     "M(a) ==> successor_ordinal(M,a) <-> Ord(a) & (\<exists>b[M]. a = succ(b))"
paulson@13290
   830
apply (simp add: successor_ordinal_def, safe)
paulson@13290
   831
apply (drule Ord_cases_disj, auto) 
paulson@13290
   832
done
paulson@13290
   833
paulson@13290
   834
lemma finite_Ord_is_nat:
paulson@13290
   835
      "[| Ord(a); ~ Limit(a); \<forall>x\<in>a. ~ Limit(x) |] ==> a \<in> nat"
paulson@13290
   836
by (induct a rule: trans_induct3, simp_all)
paulson@13290
   837
paulson@13290
   838
lemma naturals_not_limit: "a \<in> nat ==> ~ Limit(a)"
paulson@13290
   839
by (induct a rule: nat_induct, auto)
paulson@13290
   840
paulson@13290
   841
lemma (in M_triv_axioms) finite_ordinal_abs [simp]: 
paulson@13290
   842
     "M(a) ==> finite_ordinal(M,a) <-> a \<in> nat"
paulson@13290
   843
apply (simp add: finite_ordinal_def)
paulson@13290
   844
apply (blast intro: finite_Ord_is_nat intro: nat_into_Ord 
paulson@13290
   845
             dest: Ord_trans naturals_not_limit)
paulson@13290
   846
done
paulson@13290
   847
paulson@13290
   848
lemma Limit_non_Limit_implies_nat:
paulson@13290
   849
     "[| Limit(a); \<forall>x\<in>a. ~ Limit(x) |] ==> a = nat"
paulson@13290
   850
apply (rule le_anti_sym) 
paulson@13290
   851
apply (rule all_lt_imp_le, blast, blast intro: Limit_is_Ord)  
paulson@13290
   852
 apply (simp add: lt_def)  
paulson@13290
   853
 apply (blast intro: Ord_in_Ord Ord_trans finite_Ord_is_nat) 
paulson@13290
   854
apply (erule nat_le_Limit)
paulson@13290
   855
done
paulson@13290
   856
paulson@13290
   857
lemma (in M_triv_axioms) omega_abs [simp]: 
paulson@13290
   858
     "M(a) ==> omega(M,a) <-> a = nat"
paulson@13290
   859
apply (simp add: omega_def) 
paulson@13290
   860
apply (blast intro: Limit_non_Limit_implies_nat dest: naturals_not_limit)
paulson@13290
   861
done
paulson@13290
   862
paulson@13290
   863
lemma (in M_triv_axioms) number1_abs [simp]: 
paulson@13290
   864
     "M(a) ==> number1(M,a) <-> a = 1"
paulson@13290
   865
by (simp add: number1_def) 
paulson@13290
   866
wenzelm@13428
   867
lemma (in M_triv_axioms) number2_abs [simp]: 
paulson@13290
   868
     "M(a) ==> number2(M,a) <-> a = succ(1)"
paulson@13290
   869
by (simp add: number2_def) 
paulson@13290
   870
paulson@13290
   871
lemma (in M_triv_axioms) number3_abs [simp]: 
paulson@13290
   872
     "M(a) ==> number3(M,a) <-> a = succ(succ(1))"
paulson@13290
   873
by (simp add: number3_def) 
paulson@13290
   874
paulson@13290
   875
text{*Kunen continued to 20...*}
paulson@13290
   876
paulson@13290
   877
(*Could not get this to work.  The \<lambda>x\<in>nat is essential because everything 
paulson@13290
   878
  but the recursion variable must stay unchanged.  But then the recursion
paulson@13290
   879
  equations only hold for x\<in>nat (or in some other set) and not for the 
paulson@13290
   880
  whole of the class M.
paulson@13290
   881
  consts
paulson@13290
   882
    natnumber_aux :: "[i=>o,i] => i"
paulson@13290
   883
paulson@13290
   884
  primrec
paulson@13290
   885
      "natnumber_aux(M,0) = (\<lambda>x\<in>nat. if empty(M,x) then 1 else 0)"
paulson@13290
   886
      "natnumber_aux(M,succ(n)) = 
paulson@13299
   887
	   (\<lambda>x\<in>nat. if (\<exists>y[M]. natnumber_aux(M,n)`y=1 & successor(M,y,x)) 
paulson@13290
   888
		     then 1 else 0)"
paulson@13290
   889
paulson@13290
   890
  constdefs
paulson@13290
   891
    natnumber :: "[i=>o,i,i] => o"
paulson@13290
   892
      "natnumber(M,n,x) == natnumber_aux(M,n)`x = 1"
paulson@13290
   893
paulson@13290
   894
  lemma (in M_triv_axioms) [simp]: 
paulson@13290
   895
       "natnumber(M,0,x) == x=0"
paulson@13290
   896
*)
paulson@13290
   897
paulson@13290
   898
subsection{*Some instances of separation and strong replacement*}
paulson@13290
   899
wenzelm@13428
   900
locale M_axioms = M_triv_axioms +
paulson@13290
   901
assumes Inter_separation:
paulson@13268
   902
     "M(A) ==> separation(M, \<lambda>x. \<forall>y[M]. y\<in>A --> x\<in>y)"
paulson@13436
   903
  and Diff_separation:
paulson@13436
   904
     "M(B) ==> separation(M, \<lambda>x. x \<notin> B)"
paulson@13223
   905
  and cartprod_separation:
paulson@13223
   906
     "[| M(A); M(B) |] 
paulson@13298
   907
      ==> separation(M, \<lambda>z. \<exists>x[M]. x\<in>A & (\<exists>y[M]. y\<in>B & pair(M,x,y,z)))"
paulson@13223
   908
  and image_separation:
paulson@13223
   909
     "[| M(A); M(r) |] 
paulson@13268
   910
      ==> separation(M, \<lambda>y. \<exists>p[M]. p\<in>r & (\<exists>x[M]. x\<in>A & pair(M,x,y,p)))"
paulson@13223
   911
  and converse_separation:
paulson@13298
   912
     "M(r) ==> separation(M, 
paulson@13298
   913
         \<lambda>z. \<exists>p[M]. p\<in>r & (\<exists>x[M]. \<exists>y[M]. pair(M,x,y,p) & pair(M,y,x,z)))"
paulson@13223
   914
  and restrict_separation:
paulson@13268
   915
     "M(A) ==> separation(M, \<lambda>z. \<exists>x[M]. x\<in>A & (\<exists>y[M]. pair(M,x,y,z)))"
paulson@13223
   916
  and comp_separation:
paulson@13223
   917
     "[| M(r); M(s) |]
paulson@13268
   918
      ==> separation(M, \<lambda>xz. \<exists>x[M]. \<exists>y[M]. \<exists>z[M]. \<exists>xy[M]. \<exists>yz[M]. 
paulson@13268
   919
		  pair(M,x,z,xz) & pair(M,x,y,xy) & pair(M,y,z,yz) & 
paulson@13268
   920
                  xy\<in>s & yz\<in>r)"
paulson@13223
   921
  and pred_separation:
paulson@13298
   922
     "[| M(r); M(x) |] ==> separation(M, \<lambda>y. \<exists>p[M]. p\<in>r & pair(M,y,x,p))"
paulson@13223
   923
  and Memrel_separation:
paulson@13298
   924
     "separation(M, \<lambda>z. \<exists>x[M]. \<exists>y[M]. pair(M,x,y,z) & x \<in> y)"
paulson@13268
   925
  and funspace_succ_replacement:
paulson@13268
   926
     "M(n) ==> 
paulson@13306
   927
      strong_replacement(M, \<lambda>p z. \<exists>f[M]. \<exists>b[M]. \<exists>nb[M]. \<exists>cnbf[M]. 
paulson@13306
   928
                pair(M,f,b,p) & pair(M,n,b,nb) & is_cons(M,nb,f,cnbf) &
paulson@13306
   929
                upair(M,cnbf,cnbf,z))"
paulson@13223
   930
  and well_ord_iso_separation:
paulson@13223
   931
     "[| M(A); M(f); M(r) |] 
paulson@13299
   932
      ==> separation (M, \<lambda>x. x\<in>A --> (\<exists>y[M]. (\<exists>p[M]. 
paulson@13245
   933
		     fun_apply(M,f,x,y) & pair(M,y,x,p) & p \<in> r)))"
paulson@13306
   934
  and obase_separation:
paulson@13306
   935
     --{*part of the order type formalization*}
paulson@13306
   936
     "[| M(A); M(r) |] 
paulson@13306
   937
      ==> separation(M, \<lambda>a. \<exists>x[M]. \<exists>g[M]. \<exists>mx[M]. \<exists>par[M]. 
paulson@13306
   938
	     ordinal(M,x) & membership(M,x,mx) & pred_set(M,A,a,r,par) &
paulson@13306
   939
	     order_isomorphism(M,par,r,x,mx,g))"
paulson@13223
   940
  and obase_equals_separation:
paulson@13223
   941
     "[| M(A); M(r) |] 
paulson@13316
   942
      ==> separation (M, \<lambda>x. x\<in>A --> ~(\<exists>y[M]. \<exists>g[M]. 
paulson@13316
   943
			      ordinal(M,y) & (\<exists>my[M]. \<exists>pxr[M]. 
paulson@13316
   944
			      membership(M,y,my) & pred_set(M,A,x,r,pxr) &
paulson@13316
   945
			      order_isomorphism(M,pxr,r,y,my,g))))"
paulson@13306
   946
  and omap_replacement:
paulson@13306
   947
     "[| M(A); M(r) |] 
paulson@13306
   948
      ==> strong_replacement(M,
paulson@13306
   949
             \<lambda>a z. \<exists>x[M]. \<exists>g[M]. \<exists>mx[M]. \<exists>par[M]. 
paulson@13306
   950
	     ordinal(M,x) & pair(M,a,x,z) & membership(M,x,mx) & 
paulson@13306
   951
	     pred_set(M,A,a,r,par) & order_isomorphism(M,par,r,x,mx,g))"
paulson@13223
   952
  and is_recfun_separation:
paulson@13319
   953
     --{*for well-founded recursion*}
paulson@13319
   954
     "[| M(r); M(f); M(g); M(a); M(b) |] 
paulson@13319
   955
     ==> separation(M, 
paulson@13319
   956
            \<lambda>x. \<exists>xa[M]. \<exists>xb[M]. 
paulson@13319
   957
                pair(M,x,a,xa) & xa \<in> r & pair(M,x,b,xb) & xb \<in> r & 
paulson@13319
   958
                (\<exists>fx[M]. \<exists>gx[M]. fun_apply(M,f,x,fx) & fun_apply(M,g,x,gx) & 
paulson@13319
   959
                                   fx \<noteq> gx))"
paulson@13223
   960
paulson@13223
   961
lemma (in M_axioms) cartprod_iff_lemma:
paulson@13254
   962
     "[| M(C);  \<forall>u[M]. u \<in> C <-> (\<exists>x\<in>A. \<exists>y\<in>B. u = {{x}, {x,y}}); 
paulson@13254
   963
         powerset(M, A \<union> B, p1); powerset(M, p1, p2);  M(p2) |]
paulson@13223
   964
       ==> C = {u \<in> p2 . \<exists>x\<in>A. \<exists>y\<in>B. u = {{x}, {x,y}}}"
paulson@13223
   965
apply (simp add: powerset_def) 
paulson@13254
   966
apply (rule equalityI, clarify, simp)
paulson@13254
   967
 apply (frule transM, assumption) 
paulson@13223
   968
 apply (frule transM, assumption, simp) 
paulson@13223
   969
 apply blast 
paulson@13223
   970
apply clarify
paulson@13223
   971
apply (frule transM, assumption, force) 
paulson@13223
   972
done
paulson@13223
   973
paulson@13223
   974
lemma (in M_axioms) cartprod_iff:
paulson@13223
   975
     "[| M(A); M(B); M(C) |] 
paulson@13223
   976
      ==> cartprod(M,A,B,C) <-> 
paulson@13223
   977
          (\<exists>p1 p2. M(p1) & M(p2) & powerset(M,A Un B,p1) & powerset(M,p1,p2) &
paulson@13223
   978
                   C = {z \<in> p2. \<exists>x\<in>A. \<exists>y\<in>B. z = <x,y>})"
paulson@13223
   979
apply (simp add: Pair_def cartprod_def, safe)
paulson@13223
   980
defer 1 
paulson@13223
   981
  apply (simp add: powerset_def) 
paulson@13223
   982
 apply blast 
paulson@13223
   983
txt{*Final, difficult case: the left-to-right direction of the theorem.*}
paulson@13223
   984
apply (insert power_ax, simp add: power_ax_def) 
paulson@13299
   985
apply (frule_tac x="A Un B" and P="\<lambda>x. rex(M,?Q(x))" in rspec) 
paulson@13299
   986
apply (blast, clarify) 
paulson@13299
   987
apply (drule_tac x=z and P="\<lambda>x. rex(M,?Q(x))" in rspec)
paulson@13299
   988
apply assumption
paulson@13223
   989
apply (blast intro: cartprod_iff_lemma) 
paulson@13223
   990
done
paulson@13223
   991
paulson@13223
   992
lemma (in M_axioms) cartprod_closed_lemma:
paulson@13299
   993
     "[| M(A); M(B) |] ==> \<exists>C[M]. cartprod(M,A,B,C)"
paulson@13223
   994
apply (simp del: cartprod_abs add: cartprod_iff)
paulson@13223
   995
apply (insert power_ax, simp add: power_ax_def) 
paulson@13299
   996
apply (frule_tac x="A Un B" and P="\<lambda>x. rex(M,?Q(x))" in rspec) 
paulson@13299
   997
apply (blast, clarify) 
paulson@13299
   998
apply (drule_tac x=z and P="\<lambda>x. rex(M,?Q(x))" in rspec) 
paulson@13299
   999
apply (blast, clarify)
paulson@13299
  1000
apply (intro rexI exI conjI) 
paulson@13299
  1001
prefer 5 apply (rule refl) 
paulson@13299
  1002
prefer 3 apply assumption
paulson@13299
  1003
prefer 3 apply assumption
paulson@13245
  1004
apply (insert cartprod_separation [of A B], auto)
paulson@13223
  1005
done
paulson@13223
  1006
paulson@13223
  1007
text{*All the lemmas above are necessary because Powerset is not absolute.
paulson@13223
  1008
      I should have used Replacement instead!*}
paulson@13245
  1009
lemma (in M_axioms) cartprod_closed [intro,simp]: 
paulson@13223
  1010
     "[| M(A); M(B) |] ==> M(A*B)"
paulson@13223
  1011
by (frule cartprod_closed_lemma, assumption, force)
paulson@13223
  1012
paulson@13268
  1013
lemma (in M_axioms) sum_closed [intro,simp]: 
paulson@13268
  1014
     "[| M(A); M(B) |] ==> M(A+B)"
paulson@13268
  1015
by (simp add: sum_def)
paulson@13268
  1016
paulson@13350
  1017
lemma (in M_axioms) sum_abs [simp]:
paulson@13350
  1018
     "[| M(A); M(B); M(Z) |] ==> is_sum(M,A,B,Z) <-> (Z = A+B)"
paulson@13350
  1019
by (simp add: is_sum_def sum_def singleton_0 nat_into_M)
paulson@13350
  1020
paulson@13397
  1021
lemma (in M_triv_axioms) Inl_in_M_iff [iff]:
paulson@13397
  1022
     "M(Inl(a)) <-> M(a)"
paulson@13397
  1023
by (simp add: Inl_def) 
paulson@13397
  1024
paulson@13397
  1025
lemma (in M_triv_axioms) Inl_abs [simp]:
paulson@13397
  1026
     "M(Z) ==> is_Inl(M,a,Z) <-> (Z = Inl(a))"
paulson@13397
  1027
by (simp add: is_Inl_def Inl_def)
paulson@13397
  1028
paulson@13397
  1029
lemma (in M_triv_axioms) Inr_in_M_iff [iff]:
paulson@13397
  1030
     "M(Inr(a)) <-> M(a)"
paulson@13397
  1031
by (simp add: Inr_def) 
paulson@13397
  1032
paulson@13397
  1033
lemma (in M_triv_axioms) Inr_abs [simp]:
paulson@13397
  1034
     "M(Z) ==> is_Inr(M,a,Z) <-> (Z = Inr(a))"
paulson@13397
  1035
by (simp add: is_Inr_def Inr_def)
paulson@13397
  1036
paulson@13290
  1037
paulson@13290
  1038
subsubsection {*converse of a relation*}
paulson@13290
  1039
paulson@13290
  1040
lemma (in M_axioms) M_converse_iff:
paulson@13290
  1041
     "M(r) ==> 
paulson@13290
  1042
      converse(r) = 
paulson@13290
  1043
      {z \<in> Union(Union(r)) * Union(Union(r)). 
paulson@13290
  1044
       \<exists>p\<in>r. \<exists>x[M]. \<exists>y[M]. p = \<langle>x,y\<rangle> & z = \<langle>y,x\<rangle>}"
paulson@13290
  1045
apply (rule equalityI)
paulson@13290
  1046
 prefer 2 apply (blast dest: transM, clarify, simp) 
paulson@13290
  1047
apply (simp add: Pair_def) 
paulson@13290
  1048
apply (blast dest: transM) 
paulson@13290
  1049
done
paulson@13290
  1050
paulson@13290
  1051
lemma (in M_axioms) converse_closed [intro,simp]: 
paulson@13290
  1052
     "M(r) ==> M(converse(r))"
paulson@13290
  1053
apply (simp add: M_converse_iff)
paulson@13290
  1054
apply (insert converse_separation [of r], simp)
paulson@13290
  1055
done
paulson@13290
  1056
paulson@13290
  1057
lemma (in M_axioms) converse_abs [simp]: 
paulson@13290
  1058
     "[| M(r); M(z) |] ==> is_converse(M,r,z) <-> z = converse(r)"
paulson@13290
  1059
apply (simp add: is_converse_def)
paulson@13290
  1060
apply (rule iffI)
paulson@13290
  1061
 prefer 2 apply blast 
paulson@13290
  1062
apply (rule M_equalityI)
paulson@13290
  1063
  apply simp
paulson@13290
  1064
  apply (blast dest: transM)+
paulson@13290
  1065
done
paulson@13290
  1066
paulson@13290
  1067
paulson@13290
  1068
subsubsection {*image, preimage, domain, range*}
paulson@13290
  1069
paulson@13245
  1070
lemma (in M_axioms) image_closed [intro,simp]: 
paulson@13223
  1071
     "[| M(A); M(r) |] ==> M(r``A)"
paulson@13223
  1072
apply (simp add: image_iff_Collect)
paulson@13245
  1073
apply (insert image_separation [of A r], simp) 
paulson@13223
  1074
done
paulson@13223
  1075
paulson@13223
  1076
lemma (in M_axioms) vimage_abs [simp]: 
paulson@13223
  1077
     "[| M(r); M(A); M(z) |] ==> pre_image(M,r,A,z) <-> z = r-``A"
paulson@13223
  1078
apply (simp add: pre_image_def)
paulson@13223
  1079
apply (rule iffI) 
paulson@13223
  1080
 apply (blast intro!: equalityI dest: transM, blast) 
paulson@13223
  1081
done
paulson@13223
  1082
paulson@13245
  1083
lemma (in M_axioms) vimage_closed [intro,simp]: 
paulson@13223
  1084
     "[| M(A); M(r) |] ==> M(r-``A)"
paulson@13290
  1085
by (simp add: vimage_def)
paulson@13290
  1086
paulson@13290
  1087
paulson@13290
  1088
subsubsection{*Domain, range and field*}
paulson@13223
  1089
paulson@13223
  1090
lemma (in M_axioms) domain_abs [simp]: 
paulson@13223
  1091
     "[| M(r); M(z) |] ==> is_domain(M,r,z) <-> z = domain(r)"
paulson@13223
  1092
apply (simp add: is_domain_def) 
paulson@13223
  1093
apply (blast intro!: equalityI dest: transM) 
paulson@13223
  1094
done
paulson@13223
  1095
paulson@13245
  1096
lemma (in M_axioms) domain_closed [intro,simp]: 
paulson@13223
  1097
     "M(r) ==> M(domain(r))"
paulson@13223
  1098
apply (simp add: domain_eq_vimage)
paulson@13223
  1099
done
paulson@13223
  1100
paulson@13223
  1101
lemma (in M_axioms) range_abs [simp]: 
paulson@13223
  1102
     "[| M(r); M(z) |] ==> is_range(M,r,z) <-> z = range(r)"
paulson@13223
  1103
apply (simp add: is_range_def)
paulson@13223
  1104
apply (blast intro!: equalityI dest: transM)
paulson@13223
  1105
done
paulson@13223
  1106
paulson@13245
  1107
lemma (in M_axioms) range_closed [intro,simp]: 
paulson@13223
  1108
     "M(r) ==> M(range(r))"
paulson@13223
  1109
apply (simp add: range_eq_image)
paulson@13223
  1110
done
paulson@13223
  1111
paulson@13245
  1112
lemma (in M_axioms) field_abs [simp]: 
paulson@13245
  1113
     "[| M(r); M(z) |] ==> is_field(M,r,z) <-> z = field(r)"
paulson@13245
  1114
by (simp add: domain_closed range_closed is_field_def field_def)
paulson@13245
  1115
paulson@13245
  1116
lemma (in M_axioms) field_closed [intro,simp]: 
paulson@13245
  1117
     "M(r) ==> M(field(r))"
paulson@13245
  1118
by (simp add: domain_closed range_closed Un_closed field_def) 
paulson@13245
  1119
paulson@13245
  1120
paulson@13290
  1121
subsubsection{*Relations, functions and application*}
paulson@13254
  1122
paulson@13223
  1123
lemma (in M_axioms) relation_abs [simp]: 
paulson@13223
  1124
     "M(r) ==> is_relation(M,r) <-> relation(r)"
paulson@13223
  1125
apply (simp add: is_relation_def relation_def) 
paulson@13223
  1126
apply (blast dest!: bspec dest: pair_components_in_M)+
paulson@13223
  1127
done
paulson@13223
  1128
paulson@13223
  1129
lemma (in M_axioms) function_abs [simp]: 
paulson@13223
  1130
     "M(r) ==> is_function(M,r) <-> function(r)"
paulson@13223
  1131
apply (simp add: is_function_def function_def, safe) 
paulson@13223
  1132
   apply (frule transM, assumption) 
paulson@13223
  1133
  apply (blast dest: pair_components_in_M)+
paulson@13223
  1134
done
paulson@13223
  1135
paulson@13245
  1136
lemma (in M_axioms) apply_closed [intro,simp]: 
paulson@13223
  1137
     "[|M(f); M(a)|] ==> M(f`a)"
paulson@13290
  1138
by (simp add: apply_def)
paulson@13223
  1139
paulson@13352
  1140
lemma (in M_axioms) apply_abs [simp]: 
paulson@13352
  1141
     "[| M(f); M(x); M(y) |] ==> fun_apply(M,f,x,y) <-> f`x = y"
paulson@13353
  1142
apply (simp add: fun_apply_def apply_def, blast) 
paulson@13223
  1143
done
paulson@13223
  1144
paulson@13223
  1145
lemma (in M_axioms) typed_function_abs [simp]: 
paulson@13223
  1146
     "[| M(A); M(f) |] ==> typed_function(M,A,B,f) <-> f \<in> A -> B"
paulson@13223
  1147
apply (auto simp add: typed_function_def relation_def Pi_iff) 
paulson@13223
  1148
apply (blast dest: pair_components_in_M)+
paulson@13223
  1149
done
paulson@13223
  1150
paulson@13223
  1151
lemma (in M_axioms) injection_abs [simp]: 
paulson@13223
  1152
     "[| M(A); M(f) |] ==> injection(M,A,B,f) <-> f \<in> inj(A,B)"
paulson@13223
  1153
apply (simp add: injection_def apply_iff inj_def apply_closed)
paulson@13247
  1154
apply (blast dest: transM [of _ A]) 
paulson@13223
  1155
done
paulson@13223
  1156
paulson@13223
  1157
lemma (in M_axioms) surjection_abs [simp]: 
paulson@13223
  1158
     "[| M(A); M(B); M(f) |] ==> surjection(M,A,B,f) <-> f \<in> surj(A,B)"
paulson@13352
  1159
by (simp add: surjection_def surj_def)
paulson@13223
  1160
paulson@13223
  1161
lemma (in M_axioms) bijection_abs [simp]: 
paulson@13223
  1162
     "[| M(A); M(B); M(f) |] ==> bijection(M,A,B,f) <-> f \<in> bij(A,B)"
paulson@13223
  1163
by (simp add: bijection_def bij_def)
paulson@13223
  1164
paulson@13223
  1165
paulson@13290
  1166
subsubsection{*Composition of relations*}
paulson@13223
  1167
paulson@13223
  1168
lemma (in M_axioms) M_comp_iff:
paulson@13223
  1169
     "[| M(r); M(s) |] 
paulson@13223
  1170
      ==> r O s = 
paulson@13223
  1171
          {xz \<in> domain(s) * range(r).  
paulson@13268
  1172
            \<exists>x[M]. \<exists>y[M]. \<exists>z[M]. xz = \<langle>x,z\<rangle> & \<langle>x,y\<rangle> \<in> s & \<langle>y,z\<rangle> \<in> r}"
paulson@13223
  1173
apply (simp add: comp_def)
paulson@13223
  1174
apply (rule equalityI) 
paulson@13247
  1175
 apply clarify 
paulson@13247
  1176
 apply simp 
paulson@13223
  1177
 apply  (blast dest:  transM)+
paulson@13223
  1178
done
paulson@13223
  1179
paulson@13245
  1180
lemma (in M_axioms) comp_closed [intro,simp]: 
paulson@13223
  1181
     "[| M(r); M(s) |] ==> M(r O s)"
paulson@13223
  1182
apply (simp add: M_comp_iff)
paulson@13245
  1183
apply (insert comp_separation [of r s], simp) 
paulson@13245
  1184
done
paulson@13245
  1185
paulson@13245
  1186
lemma (in M_axioms) composition_abs [simp]: 
paulson@13245
  1187
     "[| M(r); M(s); M(t) |] 
paulson@13245
  1188
      ==> composition(M,r,s,t) <-> t = r O s"
paulson@13247
  1189
apply safe
paulson@13245
  1190
 txt{*Proving @{term "composition(M, r, s, r O s)"}*}
paulson@13245
  1191
 prefer 2 
paulson@13245
  1192
 apply (simp add: composition_def comp_def)
paulson@13245
  1193
 apply (blast dest: transM) 
paulson@13245
  1194
txt{*Opposite implication*}
paulson@13245
  1195
apply (rule M_equalityI)
paulson@13245
  1196
  apply (simp add: composition_def comp_def)
paulson@13245
  1197
  apply (blast del: allE dest: transM)+
paulson@13223
  1198
done
paulson@13223
  1199
paulson@13290
  1200
text{*no longer needed*}
paulson@13290
  1201
lemma (in M_axioms) restriction_is_function: 
paulson@13290
  1202
     "[| restriction(M,f,A,z); function(f); M(f); M(A); M(z) |] 
paulson@13290
  1203
      ==> function(z)"
paulson@13290
  1204
apply (rotate_tac 1)
paulson@13290
  1205
apply (simp add: restriction_def ball_iff_equiv) 
paulson@13290
  1206
apply (unfold function_def, blast) 
paulson@13269
  1207
done
paulson@13269
  1208
paulson@13290
  1209
lemma (in M_axioms) restriction_abs [simp]: 
paulson@13290
  1210
     "[| M(f); M(A); M(z) |] 
paulson@13290
  1211
      ==> restriction(M,f,A,z) <-> z = restrict(f,A)"
paulson@13290
  1212
apply (simp add: ball_iff_equiv restriction_def restrict_def)
paulson@13290
  1213
apply (blast intro!: equalityI dest: transM) 
paulson@13290
  1214
done
paulson@13290
  1215
paulson@13223
  1216
paulson@13290
  1217
lemma (in M_axioms) M_restrict_iff:
paulson@13290
  1218
     "M(r) ==> restrict(r,A) = {z \<in> r . \<exists>x\<in>A. \<exists>y[M]. z = \<langle>x, y\<rangle>}"
paulson@13290
  1219
by (simp add: restrict_def, blast dest: transM)
paulson@13290
  1220
paulson@13290
  1221
lemma (in M_axioms) restrict_closed [intro,simp]: 
paulson@13290
  1222
     "[| M(A); M(r) |] ==> M(restrict(r,A))"
paulson@13290
  1223
apply (simp add: M_restrict_iff)
paulson@13290
  1224
apply (insert restrict_separation [of A], simp) 
paulson@13290
  1225
done
paulson@13223
  1226
paulson@13223
  1227
lemma (in M_axioms) Inter_abs [simp]: 
paulson@13223
  1228
     "[| M(A); M(z) |] ==> big_inter(M,A,z) <-> z = Inter(A)"
paulson@13223
  1229
apply (simp add: big_inter_def Inter_def) 
paulson@13223
  1230
apply (blast intro!: equalityI dest: transM) 
paulson@13223
  1231
done
paulson@13223
  1232
paulson@13245
  1233
lemma (in M_axioms) Inter_closed [intro,simp]:
paulson@13223
  1234
     "M(A) ==> M(Inter(A))"
paulson@13245
  1235
by (insert Inter_separation, simp add: Inter_def)
paulson@13223
  1236
paulson@13245
  1237
lemma (in M_axioms) Int_closed [intro,simp]:
paulson@13223
  1238
     "[| M(A); M(B) |] ==> M(A Int B)"
paulson@13223
  1239
apply (subgoal_tac "M({A,B})")
paulson@13247
  1240
apply (frule Inter_closed, force+) 
paulson@13223
  1241
done
paulson@13223
  1242
paulson@13436
  1243
lemma (in M_axioms) Diff_closed [intro,simp]:
paulson@13436
  1244
     "[|M(A); M(B)|] ==> M(A-B)"
paulson@13436
  1245
by (insert Diff_separation, simp add: Diff_def)
paulson@13436
  1246
paulson@13436
  1247
subsubsection{*Some Facts About Separation Axioms*}
paulson@13436
  1248
paulson@13436
  1249
lemma (in M_axioms) separation_conj:
paulson@13436
  1250
     "[|separation(M,P); separation(M,Q)|] ==> separation(M, \<lambda>z. P(z) & Q(z))"
paulson@13436
  1251
by (simp del: separation_closed
paulson@13436
  1252
         add: separation_iff Collect_Int_Collect_eq [symmetric]) 
paulson@13436
  1253
paulson@13436
  1254
(*???equalities*)
paulson@13436
  1255
lemma Collect_Un_Collect_eq:
paulson@13436
  1256
     "Collect(A,P) Un Collect(A,Q) = Collect(A, %x. P(x) | Q(x))"
paulson@13436
  1257
by blast
paulson@13436
  1258
paulson@13436
  1259
lemma Diff_Collect_eq:
paulson@13436
  1260
     "A - Collect(A,P) = Collect(A, %x. ~ P(x))"
paulson@13436
  1261
by blast
paulson@13436
  1262
paulson@13436
  1263
lemma (in M_triv_axioms) Collect_rall_eq:
paulson@13436
  1264
     "M(Y) ==> Collect(A, %x. \<forall>y[M]. y\<in>Y --> P(x,y)) = 
paulson@13436
  1265
               (if Y=0 then A else (\<Inter>y \<in> Y. {x \<in> A. P(x,y)}))"
paulson@13436
  1266
apply simp 
paulson@13436
  1267
apply (blast intro!: equalityI dest: transM) 
paulson@13436
  1268
done
paulson@13436
  1269
paulson@13436
  1270
lemma (in M_axioms) separation_disj:
paulson@13436
  1271
     "[|separation(M,P); separation(M,Q)|] ==> separation(M, \<lambda>z. P(z) | Q(z))"
paulson@13436
  1272
by (simp del: separation_closed
paulson@13436
  1273
         add: separation_iff Collect_Un_Collect_eq [symmetric]) 
paulson@13436
  1274
paulson@13436
  1275
lemma (in M_axioms) separation_neg:
paulson@13436
  1276
     "separation(M,P) ==> separation(M, \<lambda>z. ~P(z))"
paulson@13436
  1277
by (simp del: separation_closed
paulson@13436
  1278
         add: separation_iff Diff_Collect_eq [symmetric]) 
paulson@13436
  1279
paulson@13436
  1280
lemma (in M_axioms) separation_imp:
paulson@13436
  1281
     "[|separation(M,P); separation(M,Q)|] 
paulson@13436
  1282
      ==> separation(M, \<lambda>z. P(z) --> Q(z))"
paulson@13436
  1283
by (simp add: separation_neg separation_disj not_disj_iff_imp [symmetric]) 
paulson@13436
  1284
paulson@13436
  1285
text{*This result is a hint of how little can be done without the Reflection 
paulson@13436
  1286
  Theorem.  The quantifier has to be bounded by a set.  We also need another
paulson@13436
  1287
  instance of Separation!*}
paulson@13436
  1288
lemma (in M_axioms) separation_rall:
paulson@13436
  1289
     "[|M(Y); \<forall>y[M]. separation(M, \<lambda>x. P(x,y)); 
paulson@13436
  1290
        \<forall>z[M]. strong_replacement(M, \<lambda>x y. y = {u \<in> z . P(u,x)})|]
paulson@13436
  1291
      ==> separation(M, \<lambda>x. \<forall>y[M]. y\<in>Y --> P(x,y))" 
paulson@13436
  1292
apply (simp del: separation_closed rall_abs
paulson@13436
  1293
         add: separation_iff Collect_rall_eq) 
paulson@13436
  1294
apply (blast intro!: Inter_closed RepFun_closed dest: transM) 
paulson@13436
  1295
done
paulson@13436
  1296
paulson@13436
  1297
paulson@13290
  1298
subsubsection{*Functions and function space*}
paulson@13268
  1299
paulson@13245
  1300
text{*M contains all finite functions*}
paulson@13245
  1301
lemma (in M_axioms) finite_fun_closed_lemma [rule_format]: 
paulson@13245
  1302
     "[| n \<in> nat; M(A) |] ==> \<forall>f \<in> n -> A. M(f)"
paulson@13245
  1303
apply (induct_tac n, simp)
paulson@13245
  1304
apply (rule ballI)  
paulson@13245
  1305
apply (simp add: succ_def) 
paulson@13245
  1306
apply (frule fun_cons_restrict_eq)
paulson@13245
  1307
apply (erule ssubst) 
paulson@13245
  1308
apply (subgoal_tac "M(f`x) & restrict(f,x) \<in> x -> A") 
paulson@13245
  1309
 apply (simp add: cons_closed nat_into_M apply_closed) 
paulson@13245
  1310
apply (blast intro: apply_funtype transM restrict_type2) 
paulson@13245
  1311
done
paulson@13245
  1312
paulson@13245
  1313
lemma (in M_axioms) finite_fun_closed [rule_format]: 
paulson@13245
  1314
     "[| f \<in> n -> A; n \<in> nat; M(A) |] ==> M(f)"
paulson@13245
  1315
by (blast intro: finite_fun_closed_lemma) 
paulson@13245
  1316
paulson@13268
  1317
text{*The assumption @{term "M(A->B)"} is unusual, but essential: in 
paulson@13268
  1318
all but trivial cases, A->B cannot be expected to belong to @{term M}.*}
paulson@13268
  1319
lemma (in M_axioms) is_funspace_abs [simp]:
paulson@13268
  1320
     "[|M(A); M(B); M(F); M(A->B)|] ==> is_funspace(M,A,B,F) <-> F = A->B";
paulson@13268
  1321
apply (simp add: is_funspace_def)
paulson@13268
  1322
apply (rule iffI)
paulson@13268
  1323
 prefer 2 apply blast 
paulson@13268
  1324
apply (rule M_equalityI)
paulson@13268
  1325
  apply simp_all
paulson@13268
  1326
done
paulson@13268
  1327
paulson@13268
  1328
lemma (in M_axioms) succ_fun_eq2:
paulson@13268
  1329
     "[|M(B); M(n->B)|] ==>
paulson@13268
  1330
      succ(n) -> B = 
paulson@13268
  1331
      \<Union>{z. p \<in> (n->B)*B, \<exists>f[M]. \<exists>b[M]. p = <f,b> & z = {cons(<n,b>, f)}}"
paulson@13268
  1332
apply (simp add: succ_fun_eq)
paulson@13268
  1333
apply (blast dest: transM)  
paulson@13268
  1334
done
paulson@13268
  1335
paulson@13268
  1336
lemma (in M_axioms) funspace_succ:
paulson@13268
  1337
     "[|M(n); M(B); M(n->B) |] ==> M(succ(n) -> B)"
paulson@13306
  1338
apply (insert funspace_succ_replacement [of n], simp) 
paulson@13268
  1339
apply (force simp add: succ_fun_eq2 univalent_def) 
paulson@13268
  1340
done
paulson@13268
  1341
paulson@13268
  1342
text{*@{term M} contains all finite function spaces.  Needed to prove the
paulson@13268
  1343
absoluteness of transitive closure.*}
paulson@13268
  1344
lemma (in M_axioms) finite_funspace_closed [intro,simp]:
paulson@13268
  1345
     "[|n\<in>nat; M(B)|] ==> M(n->B)"
paulson@13268
  1346
apply (induct_tac n, simp)
paulson@13268
  1347
apply (simp add: funspace_succ nat_into_M) 
paulson@13268
  1348
done
paulson@13268
  1349
paulson@13350
  1350
paulson@13423
  1351
subsection{*Relativization and Absoluteness for Boolean Operators*}
paulson@13423
  1352
paulson@13423
  1353
constdefs
paulson@13423
  1354
  is_bool_of_o :: "[i=>o, o, i] => o"
paulson@13423
  1355
   "is_bool_of_o(M,P,z) == (P & number1(M,z)) | (~P & empty(M,z))"
paulson@13423
  1356
paulson@13423
  1357
  is_not :: "[i=>o, i, i] => o"
paulson@13423
  1358
   "is_not(M,a,z) == (number1(M,a)  & empty(M,z)) | 
paulson@13423
  1359
                     (~number1(M,a) & number1(M,z))"
paulson@13423
  1360
paulson@13423
  1361
  is_and :: "[i=>o, i, i, i] => o"
paulson@13423
  1362
   "is_and(M,a,b,z) == (number1(M,a)  & z=b) | 
paulson@13423
  1363
                       (~number1(M,a) & empty(M,z))"
paulson@13423
  1364
paulson@13423
  1365
  is_or :: "[i=>o, i, i, i] => o"
paulson@13423
  1366
   "is_or(M,a,b,z) == (number1(M,a)  & number1(M,z)) | 
paulson@13423
  1367
                      (~number1(M,a) & z=b)"
paulson@13423
  1368
paulson@13423
  1369
lemma (in M_triv_axioms) bool_of_o_abs [simp]: 
paulson@13423
  1370
     "M(z) ==> is_bool_of_o(M,P,z) <-> z = bool_of_o(P)" 
paulson@13423
  1371
by (simp add: is_bool_of_o_def bool_of_o_def) 
paulson@13423
  1372
paulson@13423
  1373
paulson@13423
  1374
lemma (in M_triv_axioms) not_abs [simp]: 
paulson@13423
  1375
     "[| M(a); M(z)|] ==> is_not(M,a,z) <-> z = not(a)"
paulson@13423
  1376
by (simp add: Bool.not_def cond_def is_not_def) 
paulson@13423
  1377
paulson@13423
  1378
lemma (in M_triv_axioms) and_abs [simp]: 
paulson@13423
  1379
     "[| M(a); M(b); M(z)|] ==> is_and(M,a,b,z) <-> z = a and b"
paulson@13423
  1380
by (simp add: Bool.and_def cond_def is_and_def) 
paulson@13423
  1381
paulson@13423
  1382
lemma (in M_triv_axioms) or_abs [simp]: 
paulson@13423
  1383
     "[| M(a); M(b); M(z)|] ==> is_or(M,a,b,z) <-> z = a or b"
paulson@13423
  1384
by (simp add: Bool.or_def cond_def is_or_def)
paulson@13423
  1385
paulson@13423
  1386
paulson@13423
  1387
lemma (in M_triv_axioms) bool_of_o_closed [intro,simp]:
paulson@13423
  1388
     "M(bool_of_o(P))"
paulson@13423
  1389
by (simp add: bool_of_o_def) 
paulson@13423
  1390
paulson@13423
  1391
lemma (in M_triv_axioms) and_closed [intro,simp]:
paulson@13423
  1392
     "[| M(p); M(q) |] ==> M(p and q)"
paulson@13423
  1393
by (simp add: and_def cond_def) 
paulson@13423
  1394
paulson@13423
  1395
lemma (in M_triv_axioms) or_closed [intro,simp]:
paulson@13423
  1396
     "[| M(p); M(q) |] ==> M(p or q)"
paulson@13423
  1397
by (simp add: or_def cond_def) 
paulson@13423
  1398
paulson@13423
  1399
lemma (in M_triv_axioms) not_closed [intro,simp]:
paulson@13423
  1400
     "M(p) ==> M(not(p))"
paulson@13423
  1401
by (simp add: Bool.not_def cond_def) 
paulson@13423
  1402
paulson@13423
  1403
paulson@13397
  1404
subsection{*Relativization and Absoluteness for List Operators*}
paulson@13397
  1405
paulson@13397
  1406
constdefs
paulson@13397
  1407
paulson@13397
  1408
  is_Nil :: "[i=>o, i] => o"
paulson@13397
  1409
     --{* because @{term "[] \<equiv> Inl(0)"}*}
paulson@13397
  1410
    "is_Nil(M,xs) == \<exists>zero[M]. empty(M,zero) & is_Inl(M,zero,xs)"
paulson@13397
  1411
paulson@13397
  1412
  is_Cons :: "[i=>o,i,i,i] => o"
paulson@13397
  1413
     --{* because @{term "Cons(a, l) \<equiv> Inr(\<langle>a,l\<rangle>)"}*}
paulson@13397
  1414
    "is_Cons(M,a,l,Z) == \<exists>p[M]. pair(M,a,l,p) & is_Inr(M,p,Z)"
paulson@13397
  1415
paulson@13397
  1416
paulson@13397
  1417
lemma (in M_triv_axioms) Nil_in_M [intro,simp]: "M(Nil)"
paulson@13397
  1418
by (simp add: Nil_def)
paulson@13397
  1419
paulson@13397
  1420
lemma (in M_triv_axioms) Nil_abs [simp]: "M(Z) ==> is_Nil(M,Z) <-> (Z = Nil)"
paulson@13397
  1421
by (simp add: is_Nil_def Nil_def)
paulson@13397
  1422
paulson@13397
  1423
lemma (in M_triv_axioms) Cons_in_M_iff [iff]: "M(Cons(a,l)) <-> M(a) & M(l)"
paulson@13397
  1424
by (simp add: Cons_def) 
paulson@13397
  1425
paulson@13397
  1426
lemma (in M_triv_axioms) Cons_abs [simp]:
paulson@13397
  1427
     "[|M(a); M(l); M(Z)|] ==> is_Cons(M,a,l,Z) <-> (Z = Cons(a,l))"
paulson@13397
  1428
by (simp add: is_Cons_def Cons_def)
paulson@13397
  1429
paulson@13397
  1430
paulson@13397
  1431
constdefs
paulson@13397
  1432
paulson@13397
  1433
  quasilist :: "i => o"
paulson@13397
  1434
    "quasilist(xs) == xs=Nil | (\<exists>x l. xs = Cons(x,l))"
paulson@13397
  1435
paulson@13397
  1436
  is_quasilist :: "[i=>o,i] => o"
paulson@13397
  1437
    "is_quasilist(M,z) == is_Nil(M,z) | (\<exists>x[M]. \<exists>l[M]. is_Cons(M,x,l,z))"
paulson@13397
  1438
paulson@13397
  1439
  list_case' :: "[i, [i,i]=>i, i] => i"
paulson@13397
  1440
    --{*A version of @{term list_case} that's always defined.*}
paulson@13397
  1441
    "list_case'(a,b,xs) == 
paulson@13397
  1442
       if quasilist(xs) then list_case(a,b,xs) else 0"  
paulson@13397
  1443
paulson@13397
  1444
  is_list_case :: "[i=>o, i, [i,i,i]=>o, i, i] => o"
paulson@13397
  1445
    --{*Returns 0 for non-lists*}
paulson@13397
  1446
    "is_list_case(M, a, is_b, xs, z) == 
paulson@13397
  1447
       (is_Nil(M,xs) --> z=a) &
paulson@13397
  1448
       (\<forall>x[M]. \<forall>l[M]. is_Cons(M,x,l,xs) --> is_b(x,l,z)) &
paulson@13397
  1449
       (is_quasilist(M,xs) | empty(M,z))"
paulson@13397
  1450
paulson@13397
  1451
  hd' :: "i => i"
paulson@13397
  1452
    --{*A version of @{term hd} that's always defined.*}
paulson@13397
  1453
    "hd'(xs) == if quasilist(xs) then hd(xs) else 0"  
paulson@13397
  1454
paulson@13397
  1455
  tl' :: "i => i"
paulson@13397
  1456
    --{*A version of @{term tl} that's always defined.*}
paulson@13397
  1457
    "tl'(xs) == if quasilist(xs) then tl(xs) else 0"  
paulson@13397
  1458
paulson@13397
  1459
  is_hd :: "[i=>o,i,i] => o"
paulson@13397
  1460
     --{* @{term "hd([]) = 0"} no constraints if not a list.
paulson@13397
  1461
          Avoiding implication prevents the simplifier's looping.*}
paulson@13397
  1462
    "is_hd(M,xs,H) == 
paulson@13397
  1463
       (is_Nil(M,xs) --> empty(M,H)) &
paulson@13397
  1464
       (\<forall>x[M]. \<forall>l[M]. ~ is_Cons(M,x,l,xs) | H=x) &
paulson@13397
  1465
       (is_quasilist(M,xs) | empty(M,H))"
paulson@13397
  1466
paulson@13397
  1467
  is_tl :: "[i=>o,i,i] => o"
paulson@13397
  1468
     --{* @{term "tl([]) = []"}; see comments about @{term is_hd}*}
paulson@13397
  1469
    "is_tl(M,xs,T) == 
paulson@13397
  1470
       (is_Nil(M,xs) --> T=xs) &
paulson@13397
  1471
       (\<forall>x[M]. \<forall>l[M]. ~ is_Cons(M,x,l,xs) | T=l) &
paulson@13397
  1472
       (is_quasilist(M,xs) | empty(M,T))"
paulson@13397
  1473
paulson@13397
  1474
subsubsection{*@{term quasilist}: For Case-Splitting with @{term list_case'}*}
paulson@13397
  1475
paulson@13397
  1476
lemma [iff]: "quasilist(Nil)"
paulson@13397
  1477
by (simp add: quasilist_def)
paulson@13397
  1478
paulson@13397
  1479
lemma [iff]: "quasilist(Cons(x,l))"
paulson@13397
  1480
by (simp add: quasilist_def)
paulson@13397
  1481
paulson@13397
  1482
lemma list_imp_quasilist: "l \<in> list(A) ==> quasilist(l)"
paulson@13397
  1483
by (erule list.cases, simp_all)
paulson@13397
  1484
paulson@13397
  1485
subsubsection{*@{term list_case'}, the Modified Version of @{term list_case}*}
paulson@13397
  1486
paulson@13397
  1487
lemma list_case'_Nil [simp]: "list_case'(a,b,Nil) = a"
paulson@13397
  1488
by (simp add: list_case'_def quasilist_def)
paulson@13397
  1489
paulson@13397
  1490
lemma list_case'_Cons [simp]: "list_case'(a,b,Cons(x,l)) = b(x,l)"
paulson@13397
  1491
by (simp add: list_case'_def quasilist_def)
paulson@13397
  1492
paulson@13397
  1493
lemma non_list_case: "~ quasilist(x) ==> list_case'(a,b,x) = 0" 
paulson@13397
  1494
by (simp add: quasilist_def list_case'_def) 
paulson@13397
  1495
paulson@13397
  1496
lemma list_case'_eq_list_case [simp]:
paulson@13397
  1497
     "xs \<in> list(A) ==>list_case'(a,b,xs) = list_case(a,b,xs)"
paulson@13397
  1498
by (erule list.cases, simp_all)
paulson@13397
  1499
paulson@13397
  1500
lemma (in M_axioms) list_case'_closed [intro,simp]:
paulson@13397
  1501
  "[|M(k); M(a); \<forall>x[M]. \<forall>y[M]. M(b(x,y))|] ==> M(list_case'(a,b,k))"
paulson@13397
  1502
apply (case_tac "quasilist(k)") 
paulson@13397
  1503
 apply (simp add: quasilist_def, force) 
paulson@13397
  1504
apply (simp add: non_list_case) 
paulson@13397
  1505
done
paulson@13397
  1506
paulson@13397
  1507
lemma (in M_triv_axioms) quasilist_abs [simp]: 
paulson@13397
  1508
     "M(z) ==> is_quasilist(M,z) <-> quasilist(z)"
paulson@13397
  1509
by (auto simp add: is_quasilist_def quasilist_def)
paulson@13397
  1510
paulson@13397
  1511
lemma (in M_triv_axioms) list_case_abs [simp]: 
paulson@13397
  1512
     "[| relativize2(M,is_b,b); M(k); M(z) |] 
paulson@13397
  1513
      ==> is_list_case(M,a,is_b,k,z) <-> z = list_case'(a,b,k)"
paulson@13397
  1514
apply (case_tac "quasilist(k)") 
paulson@13397
  1515
 prefer 2 
paulson@13397
  1516
 apply (simp add: is_list_case_def non_list_case) 
paulson@13397
  1517
 apply (force simp add: quasilist_def) 
paulson@13397
  1518
apply (simp add: quasilist_def is_list_case_def)
paulson@13397
  1519
apply (elim disjE exE) 
paulson@13397
  1520
 apply (simp_all add: relativize2_def) 
paulson@13397
  1521
done
paulson@13397
  1522
paulson@13397
  1523
paulson@13397
  1524
subsubsection{*The Modified Operators @{term hd'} and @{term tl'}*}
paulson@13397
  1525
paulson@13397
  1526
lemma (in M_triv_axioms) is_hd_Nil: "is_hd(M,[],Z) <-> empty(M,Z)"
paulson@13505
  1527
by (simp add: is_hd_def)
paulson@13397
  1528
paulson@13397
  1529
lemma (in M_triv_axioms) is_hd_Cons:
paulson@13397
  1530
     "[|M(a); M(l)|] ==> is_hd(M,Cons(a,l),Z) <-> Z = a"
paulson@13505
  1531
by (force simp add: is_hd_def) 
paulson@13397
  1532
paulson@13397
  1533
lemma (in M_triv_axioms) hd_abs [simp]:
paulson@13397
  1534
     "[|M(x); M(y)|] ==> is_hd(M,x,y) <-> y = hd'(x)"
paulson@13397
  1535
apply (simp add: hd'_def)
paulson@13397
  1536
apply (intro impI conjI)
paulson@13397
  1537
 prefer 2 apply (force simp add: is_hd_def) 
paulson@13505
  1538
apply (simp add: quasilist_def is_hd_def)
paulson@13397
  1539
apply (elim disjE exE, auto)
paulson@13397
  1540
done 
paulson@13397
  1541
paulson@13397
  1542
lemma (in M_triv_axioms) is_tl_Nil: "is_tl(M,[],Z) <-> Z = []"
paulson@13505
  1543
by (simp add: is_tl_def)
paulson@13397
  1544
paulson@13397
  1545
lemma (in M_triv_axioms) is_tl_Cons:
paulson@13397
  1546
     "[|M(a); M(l)|] ==> is_tl(M,Cons(a,l),Z) <-> Z = l"
paulson@13505
  1547
by (force simp add: is_tl_def) 
paulson@13397
  1548
paulson@13397
  1549
lemma (in M_triv_axioms) tl_abs [simp]:
paulson@13397
  1550
     "[|M(x); M(y)|] ==> is_tl(M,x,y) <-> y = tl'(x)"
paulson@13397
  1551
apply (simp add: tl'_def)
paulson@13397
  1552
apply (intro impI conjI)
paulson@13397
  1553
 prefer 2 apply (force simp add: is_tl_def) 
paulson@13505
  1554
apply (simp add: quasilist_def is_tl_def)
paulson@13397
  1555
apply (elim disjE exE, auto)
paulson@13397
  1556
done 
paulson@13397
  1557
paulson@13397
  1558
lemma (in M_triv_axioms) relativize1_tl: "relativize1(M, is_tl(M), tl')"  
paulson@13397
  1559
by (simp add: relativize1_def)
paulson@13397
  1560
paulson@13397
  1561
lemma hd'_Nil: "hd'([]) = 0"
paulson@13397
  1562
by (simp add: hd'_def)
paulson@13397
  1563
paulson@13397
  1564
lemma hd'_Cons: "hd'(Cons(a,l)) = a"
paulson@13397
  1565
by (simp add: hd'_def)
paulson@13397
  1566
paulson@13397
  1567
lemma tl'_Nil: "tl'([]) = []"
paulson@13397
  1568
by (simp add: tl'_def)
paulson@13397
  1569
paulson@13397
  1570
lemma tl'_Cons: "tl'(Cons(a,l)) = l"
paulson@13397
  1571
by (simp add: tl'_def)
paulson@13397
  1572
paulson@13397
  1573
lemma iterates_tl_Nil: "n \<in> nat ==> tl'^n ([]) = []"
paulson@13397
  1574
apply (induct_tac n) 
paulson@13397
  1575
apply (simp_all add: tl'_Nil) 
paulson@13397
  1576
done
paulson@13397
  1577
paulson@13397
  1578
lemma (in M_axioms) tl'_closed: "M(x) ==> M(tl'(x))"
paulson@13397
  1579
apply (simp add: tl'_def)
paulson@13397
  1580
apply (force simp add: quasilist_def)
paulson@13397
  1581
done
paulson@13397
  1582
paulson@13397
  1583
paulson@13223
  1584
end