src/ZF/Constructible/Relative.thy
author berghofe
Mon Sep 30 16:47:03 2002 +0200 (2002-09-30)
changeset 13611 2edf034c902a
parent 13564 1500a2e48d44
child 13615 449a70d88b38
permissions -rw-r--r--
Adapted to new simplifier.
     1 (*  Title:      ZF/Constructible/Relative.thy
     2     ID:         $Id$
     3     Author:     Lawrence C Paulson, Cambridge University Computer Laboratory
     4     Copyright   2002  University of Cambridge
     5 *)
     6 
     7 header {*Relativization and Absoluteness*}
     8 
     9 theory Relative = Main:
    10 
    11 subsection{* Relativized versions of standard set-theoretic concepts *}
    12 
    13 constdefs
    14   empty :: "[i=>o,i] => o"
    15     "empty(M,z) == \<forall>x[M]. x \<notin> z"
    16 
    17   subset :: "[i=>o,i,i] => o"
    18     "subset(M,A,B) == \<forall>x[M]. x\<in>A --> x \<in> B"
    19 
    20   upair :: "[i=>o,i,i,i] => o"
    21     "upair(M,a,b,z) == a \<in> z & b \<in> z & (\<forall>x[M]. x\<in>z --> x = a | x = b)"
    22 
    23   pair :: "[i=>o,i,i,i] => o"
    24     "pair(M,a,b,z) == \<exists>x[M]. upair(M,a,a,x) & 
    25                           (\<exists>y[M]. upair(M,a,b,y) & upair(M,x,y,z))"
    26 
    27 
    28   union :: "[i=>o,i,i,i] => o"
    29     "union(M,a,b,z) == \<forall>x[M]. x \<in> z <-> x \<in> a | x \<in> b"
    30 
    31   is_cons :: "[i=>o,i,i,i] => o"
    32     "is_cons(M,a,b,z) == \<exists>x[M]. upair(M,a,a,x) & union(M,x,b,z)"
    33 
    34   successor :: "[i=>o,i,i] => o"
    35     "successor(M,a,z) == is_cons(M,a,a,z)"
    36 
    37   number1 :: "[i=>o,i] => o"
    38     "number1(M,a) == \<exists>x[M]. empty(M,x) & successor(M,x,a)"
    39 
    40   number2 :: "[i=>o,i] => o"
    41     "number2(M,a) == \<exists>x[M]. number1(M,x) & successor(M,x,a)"
    42 
    43   number3 :: "[i=>o,i] => o"
    44     "number3(M,a) == \<exists>x[M]. number2(M,x) & successor(M,x,a)"
    45 
    46   powerset :: "[i=>o,i,i] => o"
    47     "powerset(M,A,z) == \<forall>x[M]. x \<in> z <-> subset(M,x,A)"
    48 
    49   is_Collect :: "[i=>o,i,i=>o,i] => o"
    50     "is_Collect(M,A,P,z) == \<forall>x[M]. x \<in> z <-> x \<in> A & P(x)"
    51 
    52   is_Replace :: "[i=>o,i,[i,i]=>o,i] => o"
    53     "is_Replace(M,A,P,z) == \<forall>u[M]. u \<in> z <-> (\<exists>x[M]. x\<in>A & P(x,u))"
    54 
    55   inter :: "[i=>o,i,i,i] => o"
    56     "inter(M,a,b,z) == \<forall>x[M]. x \<in> z <-> x \<in> a & x \<in> b"
    57 
    58   setdiff :: "[i=>o,i,i,i] => o"
    59     "setdiff(M,a,b,z) == \<forall>x[M]. x \<in> z <-> x \<in> a & x \<notin> b"
    60 
    61   big_union :: "[i=>o,i,i] => o"
    62     "big_union(M,A,z) == \<forall>x[M]. x \<in> z <-> (\<exists>y[M]. y\<in>A & x \<in> y)"
    63 
    64   big_inter :: "[i=>o,i,i] => o"
    65     "big_inter(M,A,z) == 
    66              (A=0 --> z=0) &
    67 	     (A\<noteq>0 --> (\<forall>x[M]. x \<in> z <-> (\<forall>y[M]. y\<in>A --> x \<in> y)))"
    68 
    69   cartprod :: "[i=>o,i,i,i] => o"
    70     "cartprod(M,A,B,z) == 
    71 	\<forall>u[M]. u \<in> z <-> (\<exists>x[M]. x\<in>A & (\<exists>y[M]. y\<in>B & pair(M,x,y,u)))"
    72 
    73   is_sum :: "[i=>o,i,i,i] => o"
    74     "is_sum(M,A,B,Z) == 
    75        \<exists>A0[M]. \<exists>n1[M]. \<exists>s1[M]. \<exists>B1[M]. 
    76        number1(M,n1) & cartprod(M,n1,A,A0) & upair(M,n1,n1,s1) &
    77        cartprod(M,s1,B,B1) & union(M,A0,B1,Z)"
    78 
    79   is_Inl :: "[i=>o,i,i] => o"
    80     "is_Inl(M,a,z) == \<exists>zero[M]. empty(M,zero) & pair(M,zero,a,z)"
    81 
    82   is_Inr :: "[i=>o,i,i] => o"
    83     "is_Inr(M,a,z) == \<exists>n1[M]. number1(M,n1) & pair(M,n1,a,z)"
    84 
    85   is_converse :: "[i=>o,i,i] => o"
    86     "is_converse(M,r,z) == 
    87 	\<forall>x[M]. x \<in> z <-> 
    88              (\<exists>w[M]. w\<in>r & (\<exists>u[M]. \<exists>v[M]. pair(M,u,v,w) & pair(M,v,u,x)))"
    89 
    90   pre_image :: "[i=>o,i,i,i] => o"
    91     "pre_image(M,r,A,z) == 
    92 	\<forall>x[M]. x \<in> z <-> (\<exists>w[M]. w\<in>r & (\<exists>y[M]. y\<in>A & pair(M,x,y,w)))"
    93 
    94   is_domain :: "[i=>o,i,i] => o"
    95     "is_domain(M,r,z) == 
    96 	\<forall>x[M]. x \<in> z <-> (\<exists>w[M]. w\<in>r & (\<exists>y[M]. pair(M,x,y,w)))"
    97 
    98   image :: "[i=>o,i,i,i] => o"
    99     "image(M,r,A,z) == 
   100         \<forall>y[M]. y \<in> z <-> (\<exists>w[M]. w\<in>r & (\<exists>x[M]. x\<in>A & pair(M,x,y,w)))"
   101 
   102   is_range :: "[i=>o,i,i] => o"
   103     --{*the cleaner 
   104       @{term "\<exists>r'[M]. is_converse(M,r,r') & is_domain(M,r',z)"}
   105       unfortunately needs an instance of separation in order to prove 
   106         @{term "M(converse(r))"}.*}
   107     "is_range(M,r,z) == 
   108 	\<forall>y[M]. y \<in> z <-> (\<exists>w[M]. w\<in>r & (\<exists>x[M]. pair(M,x,y,w)))"
   109 
   110   is_field :: "[i=>o,i,i] => o"
   111     "is_field(M,r,z) == 
   112 	\<exists>dr[M]. \<exists>rr[M]. is_domain(M,r,dr) & is_range(M,r,rr) & 
   113                         union(M,dr,rr,z)"
   114 
   115   is_relation :: "[i=>o,i] => o"
   116     "is_relation(M,r) == 
   117         (\<forall>z[M]. z\<in>r --> (\<exists>x[M]. \<exists>y[M]. pair(M,x,y,z)))"
   118 
   119   is_function :: "[i=>o,i] => o"
   120     "is_function(M,r) == 
   121 	\<forall>x[M]. \<forall>y[M]. \<forall>y'[M]. \<forall>p[M]. \<forall>p'[M]. 
   122            pair(M,x,y,p) --> pair(M,x,y',p') --> p\<in>r --> p'\<in>r --> y=y'"
   123 
   124   fun_apply :: "[i=>o,i,i,i] => o"
   125     "fun_apply(M,f,x,y) == 
   126         (\<exists>xs[M]. \<exists>fxs[M]. 
   127          upair(M,x,x,xs) & image(M,f,xs,fxs) & big_union(M,fxs,y))"
   128 
   129   typed_function :: "[i=>o,i,i,i] => o"
   130     "typed_function(M,A,B,r) == 
   131         is_function(M,r) & is_relation(M,r) & is_domain(M,r,A) &
   132         (\<forall>u[M]. u\<in>r --> (\<forall>x[M]. \<forall>y[M]. pair(M,x,y,u) --> y\<in>B))"
   133 
   134   is_funspace :: "[i=>o,i,i,i] => o"
   135     "is_funspace(M,A,B,F) == 
   136         \<forall>f[M]. f \<in> F <-> typed_function(M,A,B,f)"
   137 
   138   composition :: "[i=>o,i,i,i] => o"
   139     "composition(M,r,s,t) == 
   140         \<forall>p[M]. p \<in> t <-> 
   141                (\<exists>x[M]. \<exists>y[M]. \<exists>z[M]. \<exists>xy[M]. \<exists>yz[M]. 
   142                 pair(M,x,z,p) & pair(M,x,y,xy) & pair(M,y,z,yz) & 
   143                 xy \<in> s & yz \<in> r)"
   144 
   145   injection :: "[i=>o,i,i,i] => o"
   146     "injection(M,A,B,f) == 
   147 	typed_function(M,A,B,f) &
   148         (\<forall>x[M]. \<forall>x'[M]. \<forall>y[M]. \<forall>p[M]. \<forall>p'[M]. 
   149           pair(M,x,y,p) --> pair(M,x',y,p') --> p\<in>f --> p'\<in>f --> x=x')"
   150 
   151   surjection :: "[i=>o,i,i,i] => o"
   152     "surjection(M,A,B,f) == 
   153         typed_function(M,A,B,f) &
   154         (\<forall>y[M]. y\<in>B --> (\<exists>x[M]. x\<in>A & fun_apply(M,f,x,y)))"
   155 
   156   bijection :: "[i=>o,i,i,i] => o"
   157     "bijection(M,A,B,f) == injection(M,A,B,f) & surjection(M,A,B,f)"
   158 
   159   restriction :: "[i=>o,i,i,i] => o"
   160     "restriction(M,r,A,z) == 
   161 	\<forall>x[M]. x \<in> z <-> (x \<in> r & (\<exists>u[M]. u\<in>A & (\<exists>v[M]. pair(M,u,v,x))))"
   162 
   163   transitive_set :: "[i=>o,i] => o"
   164     "transitive_set(M,a) == \<forall>x[M]. x\<in>a --> subset(M,x,a)"
   165 
   166   ordinal :: "[i=>o,i] => o"
   167      --{*an ordinal is a transitive set of transitive sets*}
   168     "ordinal(M,a) == transitive_set(M,a) & (\<forall>x[M]. x\<in>a --> transitive_set(M,x))"
   169 
   170   limit_ordinal :: "[i=>o,i] => o"
   171     --{*a limit ordinal is a non-empty, successor-closed ordinal*}
   172     "limit_ordinal(M,a) == 
   173 	ordinal(M,a) & ~ empty(M,a) & 
   174         (\<forall>x[M]. x\<in>a --> (\<exists>y[M]. y\<in>a & successor(M,x,y)))"
   175 
   176   successor_ordinal :: "[i=>o,i] => o"
   177     --{*a successor ordinal is any ordinal that is neither empty nor limit*}
   178     "successor_ordinal(M,a) == 
   179 	ordinal(M,a) & ~ empty(M,a) & ~ limit_ordinal(M,a)"
   180 
   181   finite_ordinal :: "[i=>o,i] => o"
   182     --{*an ordinal is finite if neither it nor any of its elements are limit*}
   183     "finite_ordinal(M,a) == 
   184 	ordinal(M,a) & ~ limit_ordinal(M,a) & 
   185         (\<forall>x[M]. x\<in>a --> ~ limit_ordinal(M,x))"
   186 
   187   omega :: "[i=>o,i] => o"
   188     --{*omega is a limit ordinal none of whose elements are limit*}
   189     "omega(M,a) == limit_ordinal(M,a) & (\<forall>x[M]. x\<in>a --> ~ limit_ordinal(M,x))"
   190 
   191   is_quasinat :: "[i=>o,i] => o"
   192     "is_quasinat(M,z) == empty(M,z) | (\<exists>m[M]. successor(M,m,z))"
   193 
   194   is_nat_case :: "[i=>o, i, [i,i]=>o, i, i] => o"
   195     "is_nat_case(M, a, is_b, k, z) == 
   196        (empty(M,k) --> z=a) &
   197        (\<forall>m[M]. successor(M,m,k) --> is_b(m,z)) &
   198        (is_quasinat(M,k) | empty(M,z))"
   199 
   200   relativize1 :: "[i=>o, [i,i]=>o, i=>i] => o"
   201     "relativize1(M,is_f,f) == \<forall>x[M]. \<forall>y[M]. is_f(x,y) <-> y = f(x)"
   202 
   203   Relativize1 :: "[i=>o, i, [i,i]=>o, i=>i] => o"
   204     --{*as above, but typed*}
   205     "Relativize1(M,A,is_f,f) == 
   206         \<forall>x[M]. \<forall>y[M]. x\<in>A --> is_f(x,y) <-> y = f(x)"
   207 
   208   relativize2 :: "[i=>o, [i,i,i]=>o, [i,i]=>i] => o"
   209     "relativize2(M,is_f,f) == \<forall>x[M]. \<forall>y[M]. \<forall>z[M]. is_f(x,y,z) <-> z = f(x,y)"
   210 
   211   Relativize2 :: "[i=>o, i, i, [i,i,i]=>o, [i,i]=>i] => o"
   212     "Relativize2(M,A,B,is_f,f) ==
   213         \<forall>x[M]. \<forall>y[M]. \<forall>z[M]. x\<in>A --> y\<in>B --> is_f(x,y,z) <-> z = f(x,y)"
   214 
   215   relativize3 :: "[i=>o, [i,i,i,i]=>o, [i,i,i]=>i] => o"
   216     "relativize3(M,is_f,f) == 
   217        \<forall>x[M]. \<forall>y[M]. \<forall>z[M]. \<forall>u[M]. is_f(x,y,z,u) <-> u = f(x,y,z)"
   218 
   219   Relativize3 :: "[i=>o, i, i, i, [i,i,i,i]=>o, [i,i,i]=>i] => o"
   220     "Relativize3(M,A,B,C,is_f,f) == 
   221        \<forall>x[M]. \<forall>y[M]. \<forall>z[M]. \<forall>u[M]. 
   222          x\<in>A --> y\<in>B --> z\<in>C --> is_f(x,y,z,u) <-> u = f(x,y,z)"
   223 
   224   relativize4 :: "[i=>o, [i,i,i,i,i]=>o, [i,i,i,i]=>i] => o"
   225     "relativize4(M,is_f,f) == 
   226        \<forall>u[M]. \<forall>x[M]. \<forall>y[M]. \<forall>z[M]. \<forall>a[M]. is_f(u,x,y,z,a) <-> a = f(u,x,y,z)"
   227 
   228 
   229 text{*Useful when absoluteness reasoning has replaced the predicates by terms*}
   230 lemma triv_Relativize1:
   231      "Relativize1(M, A, \<lambda>x y. y = f(x), f)"
   232 by (simp add: Relativize1_def) 
   233 
   234 lemma triv_Relativize2:
   235      "Relativize2(M, A, B, \<lambda>x y a. a = f(x,y), f)"
   236 by (simp add: Relativize2_def) 
   237 
   238 
   239 subsection {*The relativized ZF axioms*}
   240 constdefs
   241 
   242   extensionality :: "(i=>o) => o"
   243     "extensionality(M) == 
   244 	\<forall>x[M]. \<forall>y[M]. (\<forall>z[M]. z \<in> x <-> z \<in> y) --> x=y"
   245 
   246   separation :: "[i=>o, i=>o] => o"
   247     --{*The formula @{text P} should only involve parameters
   248         belonging to @{text M}.  But we can't prove separation as a scheme
   249         anyway.  Every instance that we need must individually be assumed
   250         and later proved.*}
   251     "separation(M,P) == 
   252 	\<forall>z[M]. \<exists>y[M]. \<forall>x[M]. x \<in> y <-> x \<in> z & P(x)"
   253 
   254   upair_ax :: "(i=>o) => o"
   255     "upair_ax(M) == \<forall>x[M]. \<forall>y[M]. \<exists>z[M]. upair(M,x,y,z)"
   256 
   257   Union_ax :: "(i=>o) => o"
   258     "Union_ax(M) == \<forall>x[M]. \<exists>z[M]. big_union(M,x,z)"
   259 
   260   power_ax :: "(i=>o) => o"
   261     "power_ax(M) == \<forall>x[M]. \<exists>z[M]. powerset(M,x,z)"
   262 
   263   univalent :: "[i=>o, i, [i,i]=>o] => o"
   264     "univalent(M,A,P) == 
   265 	(\<forall>x[M]. x\<in>A --> (\<forall>y[M]. \<forall>z[M]. P(x,y) & P(x,z) --> y=z))"
   266 
   267   replacement :: "[i=>o, [i,i]=>o] => o"
   268     "replacement(M,P) == 
   269       \<forall>A[M]. univalent(M,A,P) -->
   270       (\<exists>Y[M]. \<forall>b[M]. (\<exists>x[M]. x\<in>A & P(x,b)) --> b \<in> Y)"
   271 
   272   strong_replacement :: "[i=>o, [i,i]=>o] => o"
   273     "strong_replacement(M,P) == 
   274       \<forall>A[M]. univalent(M,A,P) -->
   275       (\<exists>Y[M]. \<forall>b[M]. b \<in> Y <-> (\<exists>x[M]. x\<in>A & P(x,b)))"
   276 
   277   foundation_ax :: "(i=>o) => o"
   278     "foundation_ax(M) == 
   279 	\<forall>x[M]. (\<exists>y[M]. y\<in>x) --> (\<exists>y[M]. y\<in>x & ~(\<exists>z[M]. z\<in>x & z \<in> y))"
   280 
   281 
   282 subsection{*A trivial consistency proof for $V_\omega$ *}
   283 
   284 text{*We prove that $V_\omega$ 
   285       (or @{text univ} in Isabelle) satisfies some ZF axioms.
   286      Kunen, Theorem IV 3.13, page 123.*}
   287 
   288 lemma univ0_downwards_mem: "[| y \<in> x; x \<in> univ(0) |] ==> y \<in> univ(0)"
   289 apply (insert Transset_univ [OF Transset_0])  
   290 apply (simp add: Transset_def, blast) 
   291 done
   292 
   293 lemma univ0_Ball_abs [simp]: 
   294      "A \<in> univ(0) ==> (\<forall>x\<in>A. x \<in> univ(0) --> P(x)) <-> (\<forall>x\<in>A. P(x))" 
   295 by (blast intro: univ0_downwards_mem) 
   296 
   297 lemma univ0_Bex_abs [simp]: 
   298      "A \<in> univ(0) ==> (\<exists>x\<in>A. x \<in> univ(0) & P(x)) <-> (\<exists>x\<in>A. P(x))" 
   299 by (blast intro: univ0_downwards_mem) 
   300 
   301 text{*Congruence rule for separation: can assume the variable is in @{text M}*}
   302 lemma separation_cong [cong]:
   303      "(!!x. M(x) ==> P(x) <-> P'(x)) 
   304       ==> separation(M, %x. P(x)) <-> separation(M, %x. P'(x))"
   305 by (simp add: separation_def) 
   306 
   307 lemma univalent_cong [cong]:
   308      "[| A=A'; !!x y. [| x\<in>A; M(x); M(y) |] ==> P(x,y) <-> P'(x,y) |] 
   309       ==> univalent(M, A, %x y. P(x,y)) <-> univalent(M, A', %x y. P'(x,y))"
   310 by (simp add: univalent_def) 
   311 
   312 lemma univalent_triv [intro,simp]:
   313      "univalent(M, A, \<lambda>x y. y = f(x))"
   314 by (simp add: univalent_def) 
   315 
   316 lemma univalent_conjI2 [intro,simp]:
   317      "univalent(M,A,Q) ==> univalent(M, A, \<lambda>x y. P(x,y) & Q(x,y))"
   318 by (simp add: univalent_def, blast) 
   319 
   320 text{*Congruence rule for replacement*}
   321 lemma strong_replacement_cong [cong]:
   322      "[| !!x y. [| M(x); M(y) |] ==> P(x,y) <-> P'(x,y) |] 
   323       ==> strong_replacement(M, %x y. P(x,y)) <-> 
   324           strong_replacement(M, %x y. P'(x,y))" 
   325 by (simp add: strong_replacement_def) 
   326 
   327 text{*The extensionality axiom*}
   328 lemma "extensionality(\<lambda>x. x \<in> univ(0))"
   329 apply (simp add: extensionality_def)
   330 apply (blast intro: univ0_downwards_mem) 
   331 done
   332 
   333 text{*The separation axiom requires some lemmas*}
   334 lemma Collect_in_Vfrom:
   335      "[| X \<in> Vfrom(A,j);  Transset(A) |] ==> Collect(X,P) \<in> Vfrom(A, succ(j))"
   336 apply (drule Transset_Vfrom)
   337 apply (rule subset_mem_Vfrom)
   338 apply (unfold Transset_def, blast)
   339 done
   340 
   341 lemma Collect_in_VLimit:
   342      "[| X \<in> Vfrom(A,i);  Limit(i);  Transset(A) |] 
   343       ==> Collect(X,P) \<in> Vfrom(A,i)"
   344 apply (rule Limit_VfromE, assumption+)
   345 apply (blast intro: Limit_has_succ VfromI Collect_in_Vfrom)
   346 done
   347 
   348 lemma Collect_in_univ:
   349      "[| X \<in> univ(A);  Transset(A) |] ==> Collect(X,P) \<in> univ(A)"
   350 by (simp add: univ_def Collect_in_VLimit Limit_nat)
   351 
   352 lemma "separation(\<lambda>x. x \<in> univ(0), P)"
   353 apply (simp add: separation_def, clarify) 
   354 apply (rule_tac x = "Collect(z,P)" in bexI) 
   355 apply (blast intro: Collect_in_univ Transset_0)+
   356 done
   357 
   358 text{*Unordered pairing axiom*}
   359 lemma "upair_ax(\<lambda>x. x \<in> univ(0))"
   360 apply (simp add: upair_ax_def upair_def)  
   361 apply (blast intro: doubleton_in_univ) 
   362 done
   363 
   364 text{*Union axiom*}
   365 lemma "Union_ax(\<lambda>x. x \<in> univ(0))"  
   366 apply (simp add: Union_ax_def big_union_def, clarify) 
   367 apply (rule_tac x="\<Union>x" in bexI)  
   368  apply (blast intro: univ0_downwards_mem)
   369 apply (blast intro: Union_in_univ Transset_0) 
   370 done
   371 
   372 text{*Powerset axiom*}
   373 
   374 lemma Pow_in_univ:
   375      "[| X \<in> univ(A);  Transset(A) |] ==> Pow(X) \<in> univ(A)"
   376 apply (simp add: univ_def Pow_in_VLimit Limit_nat)
   377 done
   378 
   379 lemma "power_ax(\<lambda>x. x \<in> univ(0))"  
   380 apply (simp add: power_ax_def powerset_def subset_def, clarify) 
   381 apply (rule_tac x="Pow(x)" in bexI)
   382  apply (blast intro: univ0_downwards_mem)
   383 apply (blast intro: Pow_in_univ Transset_0) 
   384 done
   385 
   386 text{*Foundation axiom*}
   387 lemma "foundation_ax(\<lambda>x. x \<in> univ(0))"  
   388 apply (simp add: foundation_ax_def, clarify)
   389 apply (cut_tac A=x in foundation) 
   390 apply (blast intro: univ0_downwards_mem)
   391 done
   392 
   393 lemma "replacement(\<lambda>x. x \<in> univ(0), P)"  
   394 apply (simp add: replacement_def, clarify) 
   395 oops
   396 text{*no idea: maybe prove by induction on the rank of A?*}
   397 
   398 text{*Still missing: Replacement, Choice*}
   399 
   400 subsection{*lemmas needed to reduce some set constructions to instances
   401       of Separation*}
   402 
   403 lemma image_iff_Collect: "r `` A = {y \<in> Union(Union(r)). \<exists>p\<in>r. \<exists>x\<in>A. p=<x,y>}"
   404 apply (rule equalityI, auto) 
   405 apply (simp add: Pair_def, blast) 
   406 done
   407 
   408 lemma vimage_iff_Collect:
   409      "r -`` A = {x \<in> Union(Union(r)). \<exists>p\<in>r. \<exists>y\<in>A. p=<x,y>}"
   410 apply (rule equalityI, auto) 
   411 apply (simp add: Pair_def, blast) 
   412 done
   413 
   414 text{*These two lemmas lets us prove @{text domain_closed} and 
   415       @{text range_closed} without new instances of separation*}
   416 
   417 lemma domain_eq_vimage: "domain(r) = r -`` Union(Union(r))"
   418 apply (rule equalityI, auto)
   419 apply (rule vimageI, assumption)
   420 apply (simp add: Pair_def, blast) 
   421 done
   422 
   423 lemma range_eq_image: "range(r) = r `` Union(Union(r))"
   424 apply (rule equalityI, auto)
   425 apply (rule imageI, assumption)
   426 apply (simp add: Pair_def, blast) 
   427 done
   428 
   429 lemma replacementD:
   430     "[| replacement(M,P); M(A);  univalent(M,A,P) |]
   431      ==> \<exists>Y[M]. (\<forall>b[M]. ((\<exists>x[M]. x\<in>A & P(x,b)) --> b \<in> Y))"
   432 by (simp add: replacement_def) 
   433 
   434 lemma strong_replacementD:
   435     "[| strong_replacement(M,P); M(A);  univalent(M,A,P) |]
   436      ==> \<exists>Y[M]. (\<forall>b[M]. (b \<in> Y <-> (\<exists>x[M]. x\<in>A & P(x,b))))"
   437 by (simp add: strong_replacement_def) 
   438 
   439 lemma separationD:
   440     "[| separation(M,P); M(z) |] ==> \<exists>y[M]. \<forall>x[M]. x \<in> y <-> x \<in> z & P(x)"
   441 by (simp add: separation_def) 
   442 
   443 
   444 text{*More constants, for order types*}
   445 constdefs
   446 
   447   order_isomorphism :: "[i=>o,i,i,i,i,i] => o"
   448     "order_isomorphism(M,A,r,B,s,f) == 
   449         bijection(M,A,B,f) & 
   450         (\<forall>x[M]. x\<in>A --> (\<forall>y[M]. y\<in>A -->
   451           (\<forall>p[M]. \<forall>fx[M]. \<forall>fy[M]. \<forall>q[M].
   452             pair(M,x,y,p) --> fun_apply(M,f,x,fx) --> fun_apply(M,f,y,fy) --> 
   453             pair(M,fx,fy,q) --> (p\<in>r <-> q\<in>s))))"
   454 
   455   pred_set :: "[i=>o,i,i,i,i] => o"
   456     "pred_set(M,A,x,r,B) == 
   457 	\<forall>y[M]. y \<in> B <-> (\<exists>p[M]. p\<in>r & y \<in> A & pair(M,y,x,p))"
   458 
   459   membership :: "[i=>o,i,i] => o" --{*membership relation*}
   460     "membership(M,A,r) == 
   461 	\<forall>p[M]. p \<in> r <-> (\<exists>x[M]. x\<in>A & (\<exists>y[M]. y\<in>A & x\<in>y & pair(M,x,y,p)))"
   462 
   463 
   464 subsection{*Introducing a Transitive Class Model*}
   465 
   466 text{*The class M is assumed to be transitive and to satisfy some
   467       relativized ZF axioms*}
   468 locale M_trivial =
   469   fixes M
   470   assumes transM:           "[| y\<in>x; M(x) |] ==> M(y)"
   471       and nonempty [simp]:  "M(0)"
   472       and upair_ax:	    "upair_ax(M)"
   473       and Union_ax:	    "Union_ax(M)"
   474       and power_ax:         "power_ax(M)"
   475       and replacement:      "replacement(M,P)"
   476       and M_nat [iff]:      "M(nat)"           (*i.e. the axiom of infinity*)
   477 
   478 lemma (in M_trivial) rall_abs [simp]: 
   479      "M(A) ==> (\<forall>x[M]. x\<in>A --> P(x)) <-> (\<forall>x\<in>A. P(x))" 
   480 by (blast intro: transM) 
   481 
   482 lemma (in M_trivial) rex_abs [simp]: 
   483      "M(A) ==> (\<exists>x[M]. x\<in>A & P(x)) <-> (\<exists>x\<in>A. P(x))" 
   484 by (blast intro: transM) 
   485 
   486 lemma (in M_trivial) ball_iff_equiv: 
   487      "M(A) ==> (\<forall>x[M]. (x\<in>A <-> P(x))) <-> 
   488                (\<forall>x\<in>A. P(x)) & (\<forall>x. P(x) --> M(x) --> x\<in>A)" 
   489 by (blast intro: transM)
   490 
   491 text{*Simplifies proofs of equalities when there's an iff-equality
   492       available for rewriting, universally quantified over M. *}
   493 lemma (in M_trivial) M_equalityI: 
   494      "[| !!x. M(x) ==> x\<in>A <-> x\<in>B; M(A); M(B) |] ==> A=B"
   495 by (blast intro!: equalityI dest: transM) 
   496 
   497 
   498 subsubsection{*Trivial Absoluteness Proofs: Empty Set, Pairs, etc.*}
   499 
   500 lemma (in M_trivial) empty_abs [simp]: 
   501      "M(z) ==> empty(M,z) <-> z=0"
   502 apply (simp add: empty_def)
   503 apply (blast intro: transM) 
   504 done
   505 
   506 lemma (in M_trivial) subset_abs [simp]: 
   507      "M(A) ==> subset(M,A,B) <-> A \<subseteq> B"
   508 apply (simp add: subset_def) 
   509 apply (blast intro: transM) 
   510 done
   511 
   512 lemma (in M_trivial) upair_abs [simp]: 
   513      "M(z) ==> upair(M,a,b,z) <-> z={a,b}"
   514 apply (simp add: upair_def) 
   515 apply (blast intro: transM) 
   516 done
   517 
   518 lemma (in M_trivial) upair_in_M_iff [iff]:
   519      "M({a,b}) <-> M(a) & M(b)"
   520 apply (insert upair_ax, simp add: upair_ax_def) 
   521 apply (blast intro: transM) 
   522 done
   523 
   524 lemma (in M_trivial) singleton_in_M_iff [iff]:
   525      "M({a}) <-> M(a)"
   526 by (insert upair_in_M_iff [of a a], simp) 
   527 
   528 lemma (in M_trivial) pair_abs [simp]: 
   529      "M(z) ==> pair(M,a,b,z) <-> z=<a,b>"
   530 apply (simp add: pair_def ZF.Pair_def)
   531 apply (blast intro: transM) 
   532 done
   533 
   534 lemma (in M_trivial) pair_in_M_iff [iff]:
   535      "M(<a,b>) <-> M(a) & M(b)"
   536 by (simp add: ZF.Pair_def)
   537 
   538 lemma (in M_trivial) pair_components_in_M:
   539      "[| <x,y> \<in> A; M(A) |] ==> M(x) & M(y)"
   540 apply (simp add: Pair_def)
   541 apply (blast dest: transM) 
   542 done
   543 
   544 lemma (in M_trivial) cartprod_abs [simp]: 
   545      "[| M(A); M(B); M(z) |] ==> cartprod(M,A,B,z) <-> z = A*B"
   546 apply (simp add: cartprod_def)
   547 apply (rule iffI) 
   548  apply (blast intro!: equalityI intro: transM dest!: rspec) 
   549 apply (blast dest: transM) 
   550 done
   551 
   552 subsubsection{*Absoluteness for Unions and Intersections*}
   553 
   554 lemma (in M_trivial) union_abs [simp]: 
   555      "[| M(a); M(b); M(z) |] ==> union(M,a,b,z) <-> z = a Un b"
   556 apply (simp add: union_def) 
   557 apply (blast intro: transM) 
   558 done
   559 
   560 lemma (in M_trivial) inter_abs [simp]: 
   561      "[| M(a); M(b); M(z) |] ==> inter(M,a,b,z) <-> z = a Int b"
   562 apply (simp add: inter_def) 
   563 apply (blast intro: transM) 
   564 done
   565 
   566 lemma (in M_trivial) setdiff_abs [simp]: 
   567      "[| M(a); M(b); M(z) |] ==> setdiff(M,a,b,z) <-> z = a-b"
   568 apply (simp add: setdiff_def) 
   569 apply (blast intro: transM) 
   570 done
   571 
   572 lemma (in M_trivial) Union_abs [simp]: 
   573      "[| M(A); M(z) |] ==> big_union(M,A,z) <-> z = Union(A)"
   574 apply (simp add: big_union_def) 
   575 apply (blast intro!: equalityI dest: transM) 
   576 done
   577 
   578 lemma (in M_trivial) Union_closed [intro,simp]:
   579      "M(A) ==> M(Union(A))"
   580 by (insert Union_ax, simp add: Union_ax_def) 
   581 
   582 lemma (in M_trivial) Un_closed [intro,simp]:
   583      "[| M(A); M(B) |] ==> M(A Un B)"
   584 by (simp only: Un_eq_Union, blast) 
   585 
   586 lemma (in M_trivial) cons_closed [intro,simp]:
   587      "[| M(a); M(A) |] ==> M(cons(a,A))"
   588 by (subst cons_eq [symmetric], blast) 
   589 
   590 lemma (in M_trivial) cons_abs [simp]: 
   591      "[| M(b); M(z) |] ==> is_cons(M,a,b,z) <-> z = cons(a,b)"
   592 by (simp add: is_cons_def, blast intro: transM)  
   593 
   594 lemma (in M_trivial) successor_abs [simp]: 
   595      "[| M(a); M(z) |] ==> successor(M,a,z) <-> z = succ(a)"
   596 by (simp add: successor_def, blast)  
   597 
   598 lemma (in M_trivial) succ_in_M_iff [iff]:
   599      "M(succ(a)) <-> M(a)"
   600 apply (simp add: succ_def) 
   601 apply (blast intro: transM) 
   602 done
   603 
   604 subsubsection{*Absoluteness for Separation and Replacement*}
   605 
   606 lemma (in M_trivial) separation_closed [intro,simp]:
   607      "[| separation(M,P); M(A) |] ==> M(Collect(A,P))"
   608 apply (insert separation, simp add: separation_def) 
   609 apply (drule rspec, assumption, clarify) 
   610 apply (subgoal_tac "y = Collect(A,P)", blast)
   611 apply (blast dest: transM) 
   612 done
   613 
   614 lemma separation_iff:
   615      "separation(M,P) <-> (\<forall>z[M]. \<exists>y[M]. is_Collect(M,z,P,y))"
   616 by (simp add: separation_def is_Collect_def) 
   617 
   618 lemma (in M_trivial) Collect_abs [simp]: 
   619      "[| M(A); M(z) |] ==> is_Collect(M,A,P,z) <-> z = Collect(A,P)"
   620 apply (simp add: is_Collect_def)
   621 apply (blast intro!: equalityI dest: transM)
   622 done
   623 
   624 text{*Probably the premise and conclusion are equivalent*}
   625 lemma (in M_trivial) strong_replacementI [rule_format]:
   626     "[| \<forall>A[M]. separation(M, %u. \<exists>x[M]. x\<in>A & P(x,u)) |]
   627      ==> strong_replacement(M,P)"
   628 apply (simp add: strong_replacement_def, clarify) 
   629 apply (frule replacementD [OF replacement], assumption, clarify) 
   630 apply (drule_tac x=A in rspec, clarify)  
   631 apply (drule_tac z=Y in separationD, assumption, clarify) 
   632 apply (rule_tac x=y in rexI) 
   633 apply (blast dest: transM)+
   634 done
   635 
   636 
   637 subsubsection{*The Operator @{term is_Replace}*}
   638 
   639 
   640 lemma is_Replace_cong [cong]:
   641      "[| A=A'; 
   642          !!x y. [| M(x); M(y) |] ==> P(x,y) <-> P'(x,y);
   643          z=z' |] 
   644       ==> is_Replace(M, A, %x y. P(x,y), z) <-> 
   645           is_Replace(M, A', %x y. P'(x,y), z')" 
   646 by (simp add: is_Replace_def) 
   647 
   648 lemma (in M_trivial) univalent_Replace_iff: 
   649      "[| M(A); univalent(M,A,P);
   650          !!x y. [| x\<in>A; P(x,y) |] ==> M(y) |] 
   651       ==> u \<in> Replace(A,P) <-> (\<exists>x. x\<in>A & P(x,u))"
   652 apply (simp add: Replace_iff univalent_def) 
   653 apply (blast dest: transM)
   654 done
   655 
   656 (*The last premise expresses that P takes M to M*)
   657 lemma (in M_trivial) strong_replacement_closed [intro,simp]:
   658      "[| strong_replacement(M,P); M(A); univalent(M,A,P); 
   659          !!x y. [| x\<in>A; P(x,y) |] ==> M(y) |] ==> M(Replace(A,P))"
   660 apply (simp add: strong_replacement_def) 
   661 apply (drule_tac x=A in rspec, safe) 
   662 apply (subgoal_tac "Replace(A,P) = Y")
   663  apply simp 
   664 apply (rule equality_iffI)
   665 apply (simp add: univalent_Replace_iff)
   666 apply (blast dest: transM) 
   667 done
   668 
   669 lemma (in M_trivial) Replace_abs: 
   670      "[| M(A); M(z); univalent(M,A,P); strong_replacement(M, P);
   671          !!x y. [| x\<in>A; P(x,y) |] ==> M(y)  |] 
   672       ==> is_Replace(M,A,P,z) <-> z = Replace(A,P)"
   673 apply (simp add: is_Replace_def)
   674 apply (rule iffI) 
   675 apply (rule M_equalityI) 
   676 apply (simp_all add: univalent_Replace_iff, blast, blast) 
   677 done
   678 
   679 (*The first premise can't simply be assumed as a schema.
   680   It is essential to take care when asserting instances of Replacement.
   681   Let K be a nonconstructible subset of nat and define
   682   f(x) = x if x:K and f(x)=0 otherwise.  Then RepFun(nat,f) = cons(0,K), a 
   683   nonconstructible set.  So we cannot assume that M(X) implies M(RepFun(X,f))
   684   even for f : M -> M.
   685 *)
   686 lemma (in M_trivial) RepFun_closed:
   687      "[| strong_replacement(M, \<lambda>x y. y = f(x)); M(A); \<forall>x\<in>A. M(f(x)) |]
   688       ==> M(RepFun(A,f))"
   689 apply (simp add: RepFun_def) 
   690 apply (rule strong_replacement_closed) 
   691 apply (auto dest: transM  simp add: univalent_def) 
   692 done
   693 
   694 lemma Replace_conj_eq: "{y . x \<in> A, x\<in>A & y=f(x)} = {y . x\<in>A, y=f(x)}"
   695 by simp
   696 
   697 text{*Better than @{text RepFun_closed} when having the formula @{term "x\<in>A"}
   698       makes relativization easier.*}
   699 lemma (in M_trivial) RepFun_closed2:
   700      "[| strong_replacement(M, \<lambda>x y. x\<in>A & y = f(x)); M(A); \<forall>x\<in>A. M(f(x)) |]
   701       ==> M(RepFun(A, %x. f(x)))"
   702 apply (simp add: RepFun_def)
   703 apply (frule strong_replacement_closed, assumption)
   704 apply (auto dest: transM  simp add: Replace_conj_eq univalent_def) 
   705 done
   706 
   707 subsubsection {*Absoluteness for @{term Lambda}*}
   708 
   709 constdefs
   710  is_lambda :: "[i=>o, i, [i,i]=>o, i] => o"
   711     "is_lambda(M, A, is_b, z) == 
   712        \<forall>p[M]. p \<in> z <->
   713         (\<exists>u[M]. \<exists>v[M]. u\<in>A & pair(M,u,v,p) & is_b(u,v))"
   714 
   715 lemma (in M_trivial) lam_closed:
   716      "[| strong_replacement(M, \<lambda>x y. y = <x,b(x)>); M(A); \<forall>x\<in>A. M(b(x)) |]
   717       ==> M(\<lambda>x\<in>A. b(x))"
   718 by (simp add: lam_def, blast intro: RepFun_closed dest: transM) 
   719 
   720 text{*Better than @{text lam_closed}: has the formula @{term "x\<in>A"}*}
   721 lemma (in M_trivial) lam_closed2:
   722   "[|strong_replacement(M, \<lambda>x y. x\<in>A & y = \<langle>x, b(x)\<rangle>);
   723      M(A); \<forall>m[M]. m\<in>A --> M(b(m))|] ==> M(Lambda(A,b))"
   724 apply (simp add: lam_def)
   725 apply (blast intro: RepFun_closed2 dest: transM)  
   726 done
   727 
   728 lemma (in M_trivial) lambda_abs2 [simp]: 
   729      "[| strong_replacement(M, \<lambda>x y. x\<in>A & y = \<langle>x, b(x)\<rangle>);
   730          Relativize1(M,A,is_b,b); M(A); \<forall>m[M]. m\<in>A --> M(b(m)); M(z) |] 
   731       ==> is_lambda(M,A,is_b,z) <-> z = Lambda(A,b)"
   732 apply (simp add: Relativize1_def is_lambda_def)
   733 apply (rule iffI)
   734  prefer 2 apply (simp add: lam_def) 
   735 apply (rule M_equalityI)
   736   apply (simp add: lam_def) 
   737  apply (simp add: lam_closed2)+
   738 done
   739 
   740 lemma is_lambda_cong [cong]:
   741      "[| A=A';  z=z'; 
   742          !!x y. [| x\<in>A; M(x); M(y) |] ==> is_b(x,y) <-> is_b'(x,y) |] 
   743       ==> is_lambda(M, A, %x y. is_b(x,y), z) <-> 
   744           is_lambda(M, A', %x y. is_b'(x,y), z')" 
   745 by (simp add: is_lambda_def) 
   746 
   747 lemma (in M_trivial) image_abs [simp]: 
   748      "[| M(r); M(A); M(z) |] ==> image(M,r,A,z) <-> z = r``A"
   749 apply (simp add: image_def)
   750 apply (rule iffI) 
   751  apply (blast intro!: equalityI dest: transM, blast) 
   752 done
   753 
   754 text{*What about @{text Pow_abs}?  Powerset is NOT absolute!
   755       This result is one direction of absoluteness.*}
   756 
   757 lemma (in M_trivial) powerset_Pow: 
   758      "powerset(M, x, Pow(x))"
   759 by (simp add: powerset_def)
   760 
   761 text{*But we can't prove that the powerset in @{text M} includes the
   762       real powerset.*}
   763 lemma (in M_trivial) powerset_imp_subset_Pow: 
   764      "[| powerset(M,x,y); M(y) |] ==> y <= Pow(x)"
   765 apply (simp add: powerset_def) 
   766 apply (blast dest: transM) 
   767 done
   768 
   769 subsubsection{*Absoluteness for the Natural Numbers*}
   770 
   771 lemma (in M_trivial) nat_into_M [intro]:
   772      "n \<in> nat ==> M(n)"
   773 by (induct n rule: nat_induct, simp_all)
   774 
   775 lemma (in M_trivial) nat_case_closed [intro,simp]:
   776   "[|M(k); M(a); \<forall>m[M]. M(b(m))|] ==> M(nat_case(a,b,k))"
   777 apply (case_tac "k=0", simp) 
   778 apply (case_tac "\<exists>m. k = succ(m)", force)
   779 apply (simp add: nat_case_def) 
   780 done
   781 
   782 lemma (in M_trivial) quasinat_abs [simp]: 
   783      "M(z) ==> is_quasinat(M,z) <-> quasinat(z)"
   784 by (auto simp add: is_quasinat_def quasinat_def)
   785 
   786 lemma (in M_trivial) nat_case_abs [simp]: 
   787      "[| relativize1(M,is_b,b); M(k); M(z) |] 
   788       ==> is_nat_case(M,a,is_b,k,z) <-> z = nat_case(a,b,k)"
   789 apply (case_tac "quasinat(k)") 
   790  prefer 2 
   791  apply (simp add: is_nat_case_def non_nat_case) 
   792  apply (force simp add: quasinat_def) 
   793 apply (simp add: quasinat_def is_nat_case_def)
   794 apply (elim disjE exE) 
   795  apply (simp_all add: relativize1_def) 
   796 done
   797 
   798 (*NOT for the simplifier.  The assumption M(z') is apparently necessary, but 
   799   causes the error "Failed congruence proof!"  It may be better to replace
   800   is_nat_case by nat_case before attempting congruence reasoning.*)
   801 lemma is_nat_case_cong:
   802      "[| a = a'; k = k';  z = z';  M(z');
   803        !!x y. [| M(x); M(y) |] ==> is_b(x,y) <-> is_b'(x,y) |]
   804       ==> is_nat_case(M, a, is_b, k, z) <-> is_nat_case(M, a', is_b', k', z')"
   805 by (simp add: is_nat_case_def) 
   806 
   807 
   808 subsection{*Absoluteness for Ordinals*}
   809 text{*These results constitute Theorem IV 5.1 of Kunen (page 126).*}
   810 
   811 lemma (in M_trivial) lt_closed:
   812      "[| j<i; M(i) |] ==> M(j)" 
   813 by (blast dest: ltD intro: transM) 
   814 
   815 lemma (in M_trivial) transitive_set_abs [simp]: 
   816      "M(a) ==> transitive_set(M,a) <-> Transset(a)"
   817 by (simp add: transitive_set_def Transset_def)
   818 
   819 lemma (in M_trivial) ordinal_abs [simp]: 
   820      "M(a) ==> ordinal(M,a) <-> Ord(a)"
   821 by (simp add: ordinal_def Ord_def)
   822 
   823 lemma (in M_trivial) limit_ordinal_abs [simp]: 
   824      "M(a) ==> limit_ordinal(M,a) <-> Limit(a)" 
   825 apply (unfold Limit_def limit_ordinal_def) 
   826 apply (simp add: Ord_0_lt_iff) 
   827 apply (simp add: lt_def, blast) 
   828 done
   829 
   830 lemma (in M_trivial) successor_ordinal_abs [simp]: 
   831      "M(a) ==> successor_ordinal(M,a) <-> Ord(a) & (\<exists>b[M]. a = succ(b))"
   832 apply (simp add: successor_ordinal_def, safe)
   833 apply (drule Ord_cases_disj, auto) 
   834 done
   835 
   836 lemma finite_Ord_is_nat:
   837       "[| Ord(a); ~ Limit(a); \<forall>x\<in>a. ~ Limit(x) |] ==> a \<in> nat"
   838 by (induct a rule: trans_induct3, simp_all)
   839 
   840 lemma naturals_not_limit: "a \<in> nat ==> ~ Limit(a)"
   841 by (induct a rule: nat_induct, auto)
   842 
   843 lemma (in M_trivial) finite_ordinal_abs [simp]: 
   844      "M(a) ==> finite_ordinal(M,a) <-> a \<in> nat"
   845 apply (simp add: finite_ordinal_def)
   846 apply (blast intro: finite_Ord_is_nat intro: nat_into_Ord 
   847              dest: Ord_trans naturals_not_limit)
   848 done
   849 
   850 lemma Limit_non_Limit_implies_nat:
   851      "[| Limit(a); \<forall>x\<in>a. ~ Limit(x) |] ==> a = nat"
   852 apply (rule le_anti_sym) 
   853 apply (rule all_lt_imp_le, blast, blast intro: Limit_is_Ord)  
   854  apply (simp add: lt_def)  
   855  apply (blast intro: Ord_in_Ord Ord_trans finite_Ord_is_nat) 
   856 apply (erule nat_le_Limit)
   857 done
   858 
   859 lemma (in M_trivial) omega_abs [simp]: 
   860      "M(a) ==> omega(M,a) <-> a = nat"
   861 apply (simp add: omega_def) 
   862 apply (blast intro: Limit_non_Limit_implies_nat dest: naturals_not_limit)
   863 done
   864 
   865 lemma (in M_trivial) number1_abs [simp]: 
   866      "M(a) ==> number1(M,a) <-> a = 1"
   867 by (simp add: number1_def) 
   868 
   869 lemma (in M_trivial) number2_abs [simp]: 
   870      "M(a) ==> number2(M,a) <-> a = succ(1)"
   871 by (simp add: number2_def) 
   872 
   873 lemma (in M_trivial) number3_abs [simp]: 
   874      "M(a) ==> number3(M,a) <-> a = succ(succ(1))"
   875 by (simp add: number3_def) 
   876 
   877 text{*Kunen continued to 20...*}
   878 
   879 (*Could not get this to work.  The \<lambda>x\<in>nat is essential because everything 
   880   but the recursion variable must stay unchanged.  But then the recursion
   881   equations only hold for x\<in>nat (or in some other set) and not for the 
   882   whole of the class M.
   883   consts
   884     natnumber_aux :: "[i=>o,i] => i"
   885 
   886   primrec
   887       "natnumber_aux(M,0) = (\<lambda>x\<in>nat. if empty(M,x) then 1 else 0)"
   888       "natnumber_aux(M,succ(n)) = 
   889 	   (\<lambda>x\<in>nat. if (\<exists>y[M]. natnumber_aux(M,n)`y=1 & successor(M,y,x)) 
   890 		     then 1 else 0)"
   891 
   892   constdefs
   893     natnumber :: "[i=>o,i,i] => o"
   894       "natnumber(M,n,x) == natnumber_aux(M,n)`x = 1"
   895 
   896   lemma (in M_trivial) [simp]: 
   897        "natnumber(M,0,x) == x=0"
   898 *)
   899 
   900 subsection{*Some instances of separation and strong replacement*}
   901 
   902 locale M_basic = M_trivial +
   903 assumes Inter_separation:
   904      "M(A) ==> separation(M, \<lambda>x. \<forall>y[M]. y\<in>A --> x\<in>y)"
   905   and Diff_separation:
   906      "M(B) ==> separation(M, \<lambda>x. x \<notin> B)"
   907   and cartprod_separation:
   908      "[| M(A); M(B) |] 
   909       ==> separation(M, \<lambda>z. \<exists>x[M]. x\<in>A & (\<exists>y[M]. y\<in>B & pair(M,x,y,z)))"
   910   and image_separation:
   911      "[| M(A); M(r) |] 
   912       ==> separation(M, \<lambda>y. \<exists>p[M]. p\<in>r & (\<exists>x[M]. x\<in>A & pair(M,x,y,p)))"
   913   and converse_separation:
   914      "M(r) ==> separation(M, 
   915          \<lambda>z. \<exists>p[M]. p\<in>r & (\<exists>x[M]. \<exists>y[M]. pair(M,x,y,p) & pair(M,y,x,z)))"
   916   and restrict_separation:
   917      "M(A) ==> separation(M, \<lambda>z. \<exists>x[M]. x\<in>A & (\<exists>y[M]. pair(M,x,y,z)))"
   918   and comp_separation:
   919      "[| M(r); M(s) |]
   920       ==> separation(M, \<lambda>xz. \<exists>x[M]. \<exists>y[M]. \<exists>z[M]. \<exists>xy[M]. \<exists>yz[M]. 
   921 		  pair(M,x,z,xz) & pair(M,x,y,xy) & pair(M,y,z,yz) & 
   922                   xy\<in>s & yz\<in>r)"
   923   and pred_separation:
   924      "[| M(r); M(x) |] ==> separation(M, \<lambda>y. \<exists>p[M]. p\<in>r & pair(M,y,x,p))"
   925   and Memrel_separation:
   926      "separation(M, \<lambda>z. \<exists>x[M]. \<exists>y[M]. pair(M,x,y,z) & x \<in> y)"
   927   and funspace_succ_replacement:
   928      "M(n) ==> 
   929       strong_replacement(M, \<lambda>p z. \<exists>f[M]. \<exists>b[M]. \<exists>nb[M]. \<exists>cnbf[M]. 
   930                 pair(M,f,b,p) & pair(M,n,b,nb) & is_cons(M,nb,f,cnbf) &
   931                 upair(M,cnbf,cnbf,z))"
   932   and well_ord_iso_separation:
   933      "[| M(A); M(f); M(r) |] 
   934       ==> separation (M, \<lambda>x. x\<in>A --> (\<exists>y[M]. (\<exists>p[M]. 
   935 		     fun_apply(M,f,x,y) & pair(M,y,x,p) & p \<in> r)))"
   936   and obase_separation:
   937      --{*part of the order type formalization*}
   938      "[| M(A); M(r) |] 
   939       ==> separation(M, \<lambda>a. \<exists>x[M]. \<exists>g[M]. \<exists>mx[M]. \<exists>par[M]. 
   940 	     ordinal(M,x) & membership(M,x,mx) & pred_set(M,A,a,r,par) &
   941 	     order_isomorphism(M,par,r,x,mx,g))"
   942   and obase_equals_separation:
   943      "[| M(A); M(r) |] 
   944       ==> separation (M, \<lambda>x. x\<in>A --> ~(\<exists>y[M]. \<exists>g[M]. 
   945 			      ordinal(M,y) & (\<exists>my[M]. \<exists>pxr[M]. 
   946 			      membership(M,y,my) & pred_set(M,A,x,r,pxr) &
   947 			      order_isomorphism(M,pxr,r,y,my,g))))"
   948   and omap_replacement:
   949      "[| M(A); M(r) |] 
   950       ==> strong_replacement(M,
   951              \<lambda>a z. \<exists>x[M]. \<exists>g[M]. \<exists>mx[M]. \<exists>par[M]. 
   952 	     ordinal(M,x) & pair(M,a,x,z) & membership(M,x,mx) & 
   953 	     pred_set(M,A,a,r,par) & order_isomorphism(M,par,r,x,mx,g))"
   954   and is_recfun_separation:
   955      --{*for well-founded recursion*}
   956      "[| M(r); M(f); M(g); M(a); M(b) |] 
   957      ==> separation(M, 
   958             \<lambda>x. \<exists>xa[M]. \<exists>xb[M]. 
   959                 pair(M,x,a,xa) & xa \<in> r & pair(M,x,b,xb) & xb \<in> r & 
   960                 (\<exists>fx[M]. \<exists>gx[M]. fun_apply(M,f,x,fx) & fun_apply(M,g,x,gx) & 
   961                                    fx \<noteq> gx))"
   962 
   963 lemma (in M_basic) cartprod_iff_lemma:
   964      "[| M(C);  \<forall>u[M]. u \<in> C <-> (\<exists>x\<in>A. \<exists>y\<in>B. u = {{x}, {x,y}}); 
   965          powerset(M, A \<union> B, p1); powerset(M, p1, p2);  M(p2) |]
   966        ==> C = {u \<in> p2 . \<exists>x\<in>A. \<exists>y\<in>B. u = {{x}, {x,y}}}"
   967 apply (simp add: powerset_def) 
   968 apply (rule equalityI, clarify, simp)
   969  apply (frule transM, assumption) 
   970  apply (frule transM, assumption, simp (no_asm_simp))
   971  apply blast 
   972 apply clarify
   973 apply (frule transM, assumption, force) 
   974 done
   975 
   976 lemma (in M_basic) cartprod_iff:
   977      "[| M(A); M(B); M(C) |] 
   978       ==> cartprod(M,A,B,C) <-> 
   979           (\<exists>p1 p2. M(p1) & M(p2) & powerset(M,A Un B,p1) & powerset(M,p1,p2) &
   980                    C = {z \<in> p2. \<exists>x\<in>A. \<exists>y\<in>B. z = <x,y>})"
   981 apply (simp add: Pair_def cartprod_def, safe)
   982 defer 1 
   983   apply (simp add: powerset_def) 
   984  apply blast 
   985 txt{*Final, difficult case: the left-to-right direction of the theorem.*}
   986 apply (insert power_ax, simp add: power_ax_def) 
   987 apply (frule_tac x="A Un B" and P="\<lambda>x. rex(M,?Q(x))" in rspec) 
   988 apply (blast, clarify) 
   989 apply (drule_tac x=z and P="\<lambda>x. rex(M,?Q(x))" in rspec)
   990 apply assumption
   991 apply (blast intro: cartprod_iff_lemma) 
   992 done
   993 
   994 lemma (in M_basic) cartprod_closed_lemma:
   995      "[| M(A); M(B) |] ==> \<exists>C[M]. cartprod(M,A,B,C)"
   996 apply (simp del: cartprod_abs add: cartprod_iff)
   997 apply (insert power_ax, simp add: power_ax_def) 
   998 apply (frule_tac x="A Un B" and P="\<lambda>x. rex(M,?Q(x))" in rspec) 
   999 apply (blast, clarify) 
  1000 apply (drule_tac x=z and P="\<lambda>x. rex(M,?Q(x))" in rspec) 
  1001 apply (blast, clarify)
  1002 apply (intro rexI exI conjI) 
  1003 prefer 5 apply (rule refl) 
  1004 prefer 3 apply assumption
  1005 prefer 3 apply assumption
  1006 apply (insert cartprod_separation [of A B], auto)
  1007 done
  1008 
  1009 text{*All the lemmas above are necessary because Powerset is not absolute.
  1010       I should have used Replacement instead!*}
  1011 lemma (in M_basic) cartprod_closed [intro,simp]: 
  1012      "[| M(A); M(B) |] ==> M(A*B)"
  1013 by (frule cartprod_closed_lemma, assumption, force)
  1014 
  1015 lemma (in M_basic) sum_closed [intro,simp]: 
  1016      "[| M(A); M(B) |] ==> M(A+B)"
  1017 by (simp add: sum_def)
  1018 
  1019 lemma (in M_basic) sum_abs [simp]:
  1020      "[| M(A); M(B); M(Z) |] ==> is_sum(M,A,B,Z) <-> (Z = A+B)"
  1021 by (simp add: is_sum_def sum_def singleton_0 nat_into_M)
  1022 
  1023 lemma (in M_trivial) Inl_in_M_iff [iff]:
  1024      "M(Inl(a)) <-> M(a)"
  1025 by (simp add: Inl_def) 
  1026 
  1027 lemma (in M_trivial) Inl_abs [simp]:
  1028      "M(Z) ==> is_Inl(M,a,Z) <-> (Z = Inl(a))"
  1029 by (simp add: is_Inl_def Inl_def)
  1030 
  1031 lemma (in M_trivial) Inr_in_M_iff [iff]:
  1032      "M(Inr(a)) <-> M(a)"
  1033 by (simp add: Inr_def) 
  1034 
  1035 lemma (in M_trivial) Inr_abs [simp]:
  1036      "M(Z) ==> is_Inr(M,a,Z) <-> (Z = Inr(a))"
  1037 by (simp add: is_Inr_def Inr_def)
  1038 
  1039 
  1040 subsubsection {*converse of a relation*}
  1041 
  1042 lemma (in M_basic) M_converse_iff:
  1043      "M(r) ==> 
  1044       converse(r) = 
  1045       {z \<in> Union(Union(r)) * Union(Union(r)). 
  1046        \<exists>p\<in>r. \<exists>x[M]. \<exists>y[M]. p = \<langle>x,y\<rangle> & z = \<langle>y,x\<rangle>}"
  1047 apply (rule equalityI)
  1048  prefer 2 apply (blast dest: transM, clarify, simp) 
  1049 apply (simp add: Pair_def) 
  1050 apply (blast dest: transM) 
  1051 done
  1052 
  1053 lemma (in M_basic) converse_closed [intro,simp]: 
  1054      "M(r) ==> M(converse(r))"
  1055 apply (simp add: M_converse_iff)
  1056 apply (insert converse_separation [of r], simp)
  1057 done
  1058 
  1059 lemma (in M_basic) converse_abs [simp]: 
  1060      "[| M(r); M(z) |] ==> is_converse(M,r,z) <-> z = converse(r)"
  1061 apply (simp add: is_converse_def)
  1062 apply (rule iffI)
  1063  prefer 2 apply blast 
  1064 apply (rule M_equalityI)
  1065   apply simp
  1066   apply (blast dest: transM)+
  1067 done
  1068 
  1069 
  1070 subsubsection {*image, preimage, domain, range*}
  1071 
  1072 lemma (in M_basic) image_closed [intro,simp]: 
  1073      "[| M(A); M(r) |] ==> M(r``A)"
  1074 apply (simp add: image_iff_Collect)
  1075 apply (insert image_separation [of A r], simp) 
  1076 done
  1077 
  1078 lemma (in M_basic) vimage_abs [simp]: 
  1079      "[| M(r); M(A); M(z) |] ==> pre_image(M,r,A,z) <-> z = r-``A"
  1080 apply (simp add: pre_image_def)
  1081 apply (rule iffI) 
  1082  apply (blast intro!: equalityI dest: transM, blast) 
  1083 done
  1084 
  1085 lemma (in M_basic) vimage_closed [intro,simp]: 
  1086      "[| M(A); M(r) |] ==> M(r-``A)"
  1087 by (simp add: vimage_def)
  1088 
  1089 
  1090 subsubsection{*Domain, range and field*}
  1091 
  1092 lemma (in M_basic) domain_abs [simp]: 
  1093      "[| M(r); M(z) |] ==> is_domain(M,r,z) <-> z = domain(r)"
  1094 apply (simp add: is_domain_def) 
  1095 apply (blast intro!: equalityI dest: transM) 
  1096 done
  1097 
  1098 lemma (in M_basic) domain_closed [intro,simp]: 
  1099      "M(r) ==> M(domain(r))"
  1100 apply (simp add: domain_eq_vimage)
  1101 done
  1102 
  1103 lemma (in M_basic) range_abs [simp]: 
  1104      "[| M(r); M(z) |] ==> is_range(M,r,z) <-> z = range(r)"
  1105 apply (simp add: is_range_def)
  1106 apply (blast intro!: equalityI dest: transM)
  1107 done
  1108 
  1109 lemma (in M_basic) range_closed [intro,simp]: 
  1110      "M(r) ==> M(range(r))"
  1111 apply (simp add: range_eq_image)
  1112 done
  1113 
  1114 lemma (in M_basic) field_abs [simp]: 
  1115      "[| M(r); M(z) |] ==> is_field(M,r,z) <-> z = field(r)"
  1116 by (simp add: domain_closed range_closed is_field_def field_def)
  1117 
  1118 lemma (in M_basic) field_closed [intro,simp]: 
  1119      "M(r) ==> M(field(r))"
  1120 by (simp add: domain_closed range_closed Un_closed field_def) 
  1121 
  1122 
  1123 subsubsection{*Relations, functions and application*}
  1124 
  1125 lemma (in M_basic) relation_abs [simp]: 
  1126      "M(r) ==> is_relation(M,r) <-> relation(r)"
  1127 apply (simp add: is_relation_def relation_def) 
  1128 apply (blast dest!: bspec dest: pair_components_in_M)+
  1129 done
  1130 
  1131 lemma (in M_basic) function_abs [simp]: 
  1132      "M(r) ==> is_function(M,r) <-> function(r)"
  1133 apply (simp add: is_function_def function_def, safe) 
  1134    apply (frule transM, assumption) 
  1135   apply (blast dest: pair_components_in_M)+
  1136 done
  1137 
  1138 lemma (in M_basic) apply_closed [intro,simp]: 
  1139      "[|M(f); M(a)|] ==> M(f`a)"
  1140 by (simp add: apply_def)
  1141 
  1142 lemma (in M_basic) apply_abs [simp]: 
  1143      "[| M(f); M(x); M(y) |] ==> fun_apply(M,f,x,y) <-> f`x = y"
  1144 apply (simp add: fun_apply_def apply_def, blast) 
  1145 done
  1146 
  1147 lemma (in M_basic) typed_function_abs [simp]: 
  1148      "[| M(A); M(f) |] ==> typed_function(M,A,B,f) <-> f \<in> A -> B"
  1149 apply (auto simp add: typed_function_def relation_def Pi_iff) 
  1150 apply (blast dest: pair_components_in_M)+
  1151 done
  1152 
  1153 lemma (in M_basic) injection_abs [simp]: 
  1154      "[| M(A); M(f) |] ==> injection(M,A,B,f) <-> f \<in> inj(A,B)"
  1155 apply (simp add: injection_def apply_iff inj_def apply_closed)
  1156 apply (blast dest: transM [of _ A]) 
  1157 done
  1158 
  1159 lemma (in M_basic) surjection_abs [simp]: 
  1160      "[| M(A); M(B); M(f) |] ==> surjection(M,A,B,f) <-> f \<in> surj(A,B)"
  1161 by (simp add: surjection_def surj_def)
  1162 
  1163 lemma (in M_basic) bijection_abs [simp]: 
  1164      "[| M(A); M(B); M(f) |] ==> bijection(M,A,B,f) <-> f \<in> bij(A,B)"
  1165 by (simp add: bijection_def bij_def)
  1166 
  1167 
  1168 subsubsection{*Composition of relations*}
  1169 
  1170 lemma (in M_basic) M_comp_iff:
  1171      "[| M(r); M(s) |] 
  1172       ==> r O s = 
  1173           {xz \<in> domain(s) * range(r).  
  1174             \<exists>x[M]. \<exists>y[M]. \<exists>z[M]. xz = \<langle>x,z\<rangle> & \<langle>x,y\<rangle> \<in> s & \<langle>y,z\<rangle> \<in> r}"
  1175 apply (simp add: comp_def)
  1176 apply (rule equalityI) 
  1177  apply clarify 
  1178  apply simp 
  1179  apply  (blast dest:  transM)+
  1180 done
  1181 
  1182 lemma (in M_basic) comp_closed [intro,simp]: 
  1183      "[| M(r); M(s) |] ==> M(r O s)"
  1184 apply (simp add: M_comp_iff)
  1185 apply (insert comp_separation [of r s], simp) 
  1186 done
  1187 
  1188 lemma (in M_basic) composition_abs [simp]: 
  1189      "[| M(r); M(s); M(t) |] 
  1190       ==> composition(M,r,s,t) <-> t = r O s"
  1191 apply safe
  1192  txt{*Proving @{term "composition(M, r, s, r O s)"}*}
  1193  prefer 2 
  1194  apply (simp add: composition_def comp_def)
  1195  apply (blast dest: transM) 
  1196 txt{*Opposite implication*}
  1197 apply (rule M_equalityI)
  1198   apply (simp add: composition_def comp_def)
  1199   apply (blast del: allE dest: transM)+
  1200 done
  1201 
  1202 text{*no longer needed*}
  1203 lemma (in M_basic) restriction_is_function: 
  1204      "[| restriction(M,f,A,z); function(f); M(f); M(A); M(z) |] 
  1205       ==> function(z)"
  1206 apply (rotate_tac 1)
  1207 apply (simp add: restriction_def ball_iff_equiv) 
  1208 apply (unfold function_def, blast) 
  1209 done
  1210 
  1211 lemma (in M_basic) restriction_abs [simp]: 
  1212      "[| M(f); M(A); M(z) |] 
  1213       ==> restriction(M,f,A,z) <-> z = restrict(f,A)"
  1214 apply (simp add: ball_iff_equiv restriction_def restrict_def)
  1215 apply (blast intro!: equalityI dest: transM) 
  1216 done
  1217 
  1218 
  1219 lemma (in M_basic) M_restrict_iff:
  1220      "M(r) ==> restrict(r,A) = {z \<in> r . \<exists>x\<in>A. \<exists>y[M]. z = \<langle>x, y\<rangle>}"
  1221 by (simp add: restrict_def, blast dest: transM)
  1222 
  1223 lemma (in M_basic) restrict_closed [intro,simp]: 
  1224      "[| M(A); M(r) |] ==> M(restrict(r,A))"
  1225 apply (simp add: M_restrict_iff)
  1226 apply (insert restrict_separation [of A], simp) 
  1227 done
  1228 
  1229 lemma (in M_basic) Inter_abs [simp]: 
  1230      "[| M(A); M(z) |] ==> big_inter(M,A,z) <-> z = Inter(A)"
  1231 apply (simp add: big_inter_def Inter_def) 
  1232 apply (blast intro!: equalityI dest: transM) 
  1233 done
  1234 
  1235 lemma (in M_basic) Inter_closed [intro,simp]:
  1236      "M(A) ==> M(Inter(A))"
  1237 by (insert Inter_separation, simp add: Inter_def)
  1238 
  1239 lemma (in M_basic) Int_closed [intro,simp]:
  1240      "[| M(A); M(B) |] ==> M(A Int B)"
  1241 apply (subgoal_tac "M({A,B})")
  1242 apply (frule Inter_closed, force+) 
  1243 done
  1244 
  1245 lemma (in M_basic) Diff_closed [intro,simp]:
  1246      "[|M(A); M(B)|] ==> M(A-B)"
  1247 by (insert Diff_separation, simp add: Diff_def)
  1248 
  1249 subsubsection{*Some Facts About Separation Axioms*}
  1250 
  1251 lemma (in M_basic) separation_conj:
  1252      "[|separation(M,P); separation(M,Q)|] ==> separation(M, \<lambda>z. P(z) & Q(z))"
  1253 by (simp del: separation_closed
  1254          add: separation_iff Collect_Int_Collect_eq [symmetric]) 
  1255 
  1256 (*???equalities*)
  1257 lemma Collect_Un_Collect_eq:
  1258      "Collect(A,P) Un Collect(A,Q) = Collect(A, %x. P(x) | Q(x))"
  1259 by blast
  1260 
  1261 lemma Diff_Collect_eq:
  1262      "A - Collect(A,P) = Collect(A, %x. ~ P(x))"
  1263 by blast
  1264 
  1265 lemma (in M_trivial) Collect_rall_eq:
  1266      "M(Y) ==> Collect(A, %x. \<forall>y[M]. y\<in>Y --> P(x,y)) = 
  1267                (if Y=0 then A else (\<Inter>y \<in> Y. {x \<in> A. P(x,y)}))"
  1268 apply simp 
  1269 apply (blast intro!: equalityI dest: transM) 
  1270 done
  1271 
  1272 lemma (in M_basic) separation_disj:
  1273      "[|separation(M,P); separation(M,Q)|] ==> separation(M, \<lambda>z. P(z) | Q(z))"
  1274 by (simp del: separation_closed
  1275          add: separation_iff Collect_Un_Collect_eq [symmetric]) 
  1276 
  1277 lemma (in M_basic) separation_neg:
  1278      "separation(M,P) ==> separation(M, \<lambda>z. ~P(z))"
  1279 by (simp del: separation_closed
  1280          add: separation_iff Diff_Collect_eq [symmetric]) 
  1281 
  1282 lemma (in M_basic) separation_imp:
  1283      "[|separation(M,P); separation(M,Q)|] 
  1284       ==> separation(M, \<lambda>z. P(z) --> Q(z))"
  1285 by (simp add: separation_neg separation_disj not_disj_iff_imp [symmetric]) 
  1286 
  1287 text{*This result is a hint of how little can be done without the Reflection 
  1288   Theorem.  The quantifier has to be bounded by a set.  We also need another
  1289   instance of Separation!*}
  1290 lemma (in M_basic) separation_rall:
  1291      "[|M(Y); \<forall>y[M]. separation(M, \<lambda>x. P(x,y)); 
  1292         \<forall>z[M]. strong_replacement(M, \<lambda>x y. y = {u \<in> z . P(u,x)})|]
  1293       ==> separation(M, \<lambda>x. \<forall>y[M]. y\<in>Y --> P(x,y))" 
  1294 apply (simp del: separation_closed rall_abs
  1295          add: separation_iff Collect_rall_eq) 
  1296 apply (blast intro!: Inter_closed RepFun_closed dest: transM) 
  1297 done
  1298 
  1299 
  1300 subsubsection{*Functions and function space*}
  1301 
  1302 text{*M contains all finite functions*}
  1303 lemma (in M_basic) finite_fun_closed_lemma [rule_format]: 
  1304      "[| n \<in> nat; M(A) |] ==> \<forall>f \<in> n -> A. M(f)"
  1305 apply (induct_tac n, simp)
  1306 apply (rule ballI)  
  1307 apply (simp add: succ_def) 
  1308 apply (frule fun_cons_restrict_eq)
  1309 apply (erule ssubst) 
  1310 apply (subgoal_tac "M(f`x) & restrict(f,x) \<in> x -> A") 
  1311  apply (simp add: cons_closed nat_into_M apply_closed) 
  1312 apply (blast intro: apply_funtype transM restrict_type2) 
  1313 done
  1314 
  1315 lemma (in M_basic) finite_fun_closed [rule_format]: 
  1316      "[| f \<in> n -> A; n \<in> nat; M(A) |] ==> M(f)"
  1317 by (blast intro: finite_fun_closed_lemma) 
  1318 
  1319 text{*The assumption @{term "M(A->B)"} is unusual, but essential: in 
  1320 all but trivial cases, A->B cannot be expected to belong to @{term M}.*}
  1321 lemma (in M_basic) is_funspace_abs [simp]:
  1322      "[|M(A); M(B); M(F); M(A->B)|] ==> is_funspace(M,A,B,F) <-> F = A->B";
  1323 apply (simp add: is_funspace_def)
  1324 apply (rule iffI)
  1325  prefer 2 apply blast 
  1326 apply (rule M_equalityI)
  1327   apply simp_all
  1328 done
  1329 
  1330 lemma (in M_basic) succ_fun_eq2:
  1331      "[|M(B); M(n->B)|] ==>
  1332       succ(n) -> B = 
  1333       \<Union>{z. p \<in> (n->B)*B, \<exists>f[M]. \<exists>b[M]. p = <f,b> & z = {cons(<n,b>, f)}}"
  1334 apply (simp add: succ_fun_eq)
  1335 apply (blast dest: transM)  
  1336 done
  1337 
  1338 lemma (in M_basic) funspace_succ:
  1339      "[|M(n); M(B); M(n->B) |] ==> M(succ(n) -> B)"
  1340 apply (insert funspace_succ_replacement [of n], simp) 
  1341 apply (force simp add: succ_fun_eq2 univalent_def) 
  1342 done
  1343 
  1344 text{*@{term M} contains all finite function spaces.  Needed to prove the
  1345 absoluteness of transitive closure.*}
  1346 lemma (in M_basic) finite_funspace_closed [intro,simp]:
  1347      "[|n\<in>nat; M(B)|] ==> M(n->B)"
  1348 apply (induct_tac n, simp)
  1349 apply (simp add: funspace_succ nat_into_M) 
  1350 done
  1351 
  1352 
  1353 subsection{*Relativization and Absoluteness for Boolean Operators*}
  1354 
  1355 constdefs
  1356   is_bool_of_o :: "[i=>o, o, i] => o"
  1357    "is_bool_of_o(M,P,z) == (P & number1(M,z)) | (~P & empty(M,z))"
  1358 
  1359   is_not :: "[i=>o, i, i] => o"
  1360    "is_not(M,a,z) == (number1(M,a)  & empty(M,z)) | 
  1361                      (~number1(M,a) & number1(M,z))"
  1362 
  1363   is_and :: "[i=>o, i, i, i] => o"
  1364    "is_and(M,a,b,z) == (number1(M,a)  & z=b) | 
  1365                        (~number1(M,a) & empty(M,z))"
  1366 
  1367   is_or :: "[i=>o, i, i, i] => o"
  1368    "is_or(M,a,b,z) == (number1(M,a)  & number1(M,z)) | 
  1369                       (~number1(M,a) & z=b)"
  1370 
  1371 lemma (in M_trivial) bool_of_o_abs [simp]: 
  1372      "M(z) ==> is_bool_of_o(M,P,z) <-> z = bool_of_o(P)" 
  1373 by (simp add: is_bool_of_o_def bool_of_o_def) 
  1374 
  1375 
  1376 lemma (in M_trivial) not_abs [simp]: 
  1377      "[| M(a); M(z)|] ==> is_not(M,a,z) <-> z = not(a)"
  1378 by (simp add: Bool.not_def cond_def is_not_def) 
  1379 
  1380 lemma (in M_trivial) and_abs [simp]: 
  1381      "[| M(a); M(b); M(z)|] ==> is_and(M,a,b,z) <-> z = a and b"
  1382 by (simp add: Bool.and_def cond_def is_and_def) 
  1383 
  1384 lemma (in M_trivial) or_abs [simp]: 
  1385      "[| M(a); M(b); M(z)|] ==> is_or(M,a,b,z) <-> z = a or b"
  1386 by (simp add: Bool.or_def cond_def is_or_def)
  1387 
  1388 
  1389 lemma (in M_trivial) bool_of_o_closed [intro,simp]:
  1390      "M(bool_of_o(P))"
  1391 by (simp add: bool_of_o_def) 
  1392 
  1393 lemma (in M_trivial) and_closed [intro,simp]:
  1394      "[| M(p); M(q) |] ==> M(p and q)"
  1395 by (simp add: and_def cond_def) 
  1396 
  1397 lemma (in M_trivial) or_closed [intro,simp]:
  1398      "[| M(p); M(q) |] ==> M(p or q)"
  1399 by (simp add: or_def cond_def) 
  1400 
  1401 lemma (in M_trivial) not_closed [intro,simp]:
  1402      "M(p) ==> M(not(p))"
  1403 by (simp add: Bool.not_def cond_def) 
  1404 
  1405 
  1406 subsection{*Relativization and Absoluteness for List Operators*}
  1407 
  1408 constdefs
  1409 
  1410   is_Nil :: "[i=>o, i] => o"
  1411      --{* because @{term "[] \<equiv> Inl(0)"}*}
  1412     "is_Nil(M,xs) == \<exists>zero[M]. empty(M,zero) & is_Inl(M,zero,xs)"
  1413 
  1414   is_Cons :: "[i=>o,i,i,i] => o"
  1415      --{* because @{term "Cons(a, l) \<equiv> Inr(\<langle>a,l\<rangle>)"}*}
  1416     "is_Cons(M,a,l,Z) == \<exists>p[M]. pair(M,a,l,p) & is_Inr(M,p,Z)"
  1417 
  1418 
  1419 lemma (in M_trivial) Nil_in_M [intro,simp]: "M(Nil)"
  1420 by (simp add: Nil_def)
  1421 
  1422 lemma (in M_trivial) Nil_abs [simp]: "M(Z) ==> is_Nil(M,Z) <-> (Z = Nil)"
  1423 by (simp add: is_Nil_def Nil_def)
  1424 
  1425 lemma (in M_trivial) Cons_in_M_iff [iff]: "M(Cons(a,l)) <-> M(a) & M(l)"
  1426 by (simp add: Cons_def) 
  1427 
  1428 lemma (in M_trivial) Cons_abs [simp]:
  1429      "[|M(a); M(l); M(Z)|] ==> is_Cons(M,a,l,Z) <-> (Z = Cons(a,l))"
  1430 by (simp add: is_Cons_def Cons_def)
  1431 
  1432 
  1433 constdefs
  1434 
  1435   quasilist :: "i => o"
  1436     "quasilist(xs) == xs=Nil | (\<exists>x l. xs = Cons(x,l))"
  1437 
  1438   is_quasilist :: "[i=>o,i] => o"
  1439     "is_quasilist(M,z) == is_Nil(M,z) | (\<exists>x[M]. \<exists>l[M]. is_Cons(M,x,l,z))"
  1440 
  1441   list_case' :: "[i, [i,i]=>i, i] => i"
  1442     --{*A version of @{term list_case} that's always defined.*}
  1443     "list_case'(a,b,xs) == 
  1444        if quasilist(xs) then list_case(a,b,xs) else 0"  
  1445 
  1446   is_list_case :: "[i=>o, i, [i,i,i]=>o, i, i] => o"
  1447     --{*Returns 0 for non-lists*}
  1448     "is_list_case(M, a, is_b, xs, z) == 
  1449        (is_Nil(M,xs) --> z=a) &
  1450        (\<forall>x[M]. \<forall>l[M]. is_Cons(M,x,l,xs) --> is_b(x,l,z)) &
  1451        (is_quasilist(M,xs) | empty(M,z))"
  1452 
  1453   hd' :: "i => i"
  1454     --{*A version of @{term hd} that's always defined.*}
  1455     "hd'(xs) == if quasilist(xs) then hd(xs) else 0"  
  1456 
  1457   tl' :: "i => i"
  1458     --{*A version of @{term tl} that's always defined.*}
  1459     "tl'(xs) == if quasilist(xs) then tl(xs) else 0"  
  1460 
  1461   is_hd :: "[i=>o,i,i] => o"
  1462      --{* @{term "hd([]) = 0"} no constraints if not a list.
  1463           Avoiding implication prevents the simplifier's looping.*}
  1464     "is_hd(M,xs,H) == 
  1465        (is_Nil(M,xs) --> empty(M,H)) &
  1466        (\<forall>x[M]. \<forall>l[M]. ~ is_Cons(M,x,l,xs) | H=x) &
  1467        (is_quasilist(M,xs) | empty(M,H))"
  1468 
  1469   is_tl :: "[i=>o,i,i] => o"
  1470      --{* @{term "tl([]) = []"}; see comments about @{term is_hd}*}
  1471     "is_tl(M,xs,T) == 
  1472        (is_Nil(M,xs) --> T=xs) &
  1473        (\<forall>x[M]. \<forall>l[M]. ~ is_Cons(M,x,l,xs) | T=l) &
  1474        (is_quasilist(M,xs) | empty(M,T))"
  1475 
  1476 subsubsection{*@{term quasilist}: For Case-Splitting with @{term list_case'}*}
  1477 
  1478 lemma [iff]: "quasilist(Nil)"
  1479 by (simp add: quasilist_def)
  1480 
  1481 lemma [iff]: "quasilist(Cons(x,l))"
  1482 by (simp add: quasilist_def)
  1483 
  1484 lemma list_imp_quasilist: "l \<in> list(A) ==> quasilist(l)"
  1485 by (erule list.cases, simp_all)
  1486 
  1487 subsubsection{*@{term list_case'}, the Modified Version of @{term list_case}*}
  1488 
  1489 lemma list_case'_Nil [simp]: "list_case'(a,b,Nil) = a"
  1490 by (simp add: list_case'_def quasilist_def)
  1491 
  1492 lemma list_case'_Cons [simp]: "list_case'(a,b,Cons(x,l)) = b(x,l)"
  1493 by (simp add: list_case'_def quasilist_def)
  1494 
  1495 lemma non_list_case: "~ quasilist(x) ==> list_case'(a,b,x) = 0" 
  1496 by (simp add: quasilist_def list_case'_def) 
  1497 
  1498 lemma list_case'_eq_list_case [simp]:
  1499      "xs \<in> list(A) ==>list_case'(a,b,xs) = list_case(a,b,xs)"
  1500 by (erule list.cases, simp_all)
  1501 
  1502 lemma (in M_basic) list_case'_closed [intro,simp]:
  1503   "[|M(k); M(a); \<forall>x[M]. \<forall>y[M]. M(b(x,y))|] ==> M(list_case'(a,b,k))"
  1504 apply (case_tac "quasilist(k)") 
  1505  apply (simp add: quasilist_def, force) 
  1506 apply (simp add: non_list_case) 
  1507 done
  1508 
  1509 lemma (in M_trivial) quasilist_abs [simp]: 
  1510      "M(z) ==> is_quasilist(M,z) <-> quasilist(z)"
  1511 by (auto simp add: is_quasilist_def quasilist_def)
  1512 
  1513 lemma (in M_trivial) list_case_abs [simp]: 
  1514      "[| relativize2(M,is_b,b); M(k); M(z) |] 
  1515       ==> is_list_case(M,a,is_b,k,z) <-> z = list_case'(a,b,k)"
  1516 apply (case_tac "quasilist(k)") 
  1517  prefer 2 
  1518  apply (simp add: is_list_case_def non_list_case) 
  1519  apply (force simp add: quasilist_def) 
  1520 apply (simp add: quasilist_def is_list_case_def)
  1521 apply (elim disjE exE) 
  1522  apply (simp_all add: relativize2_def) 
  1523 done
  1524 
  1525 
  1526 subsubsection{*The Modified Operators @{term hd'} and @{term tl'}*}
  1527 
  1528 lemma (in M_trivial) is_hd_Nil: "is_hd(M,[],Z) <-> empty(M,Z)"
  1529 by (simp add: is_hd_def)
  1530 
  1531 lemma (in M_trivial) is_hd_Cons:
  1532      "[|M(a); M(l)|] ==> is_hd(M,Cons(a,l),Z) <-> Z = a"
  1533 by (force simp add: is_hd_def) 
  1534 
  1535 lemma (in M_trivial) hd_abs [simp]:
  1536      "[|M(x); M(y)|] ==> is_hd(M,x,y) <-> y = hd'(x)"
  1537 apply (simp add: hd'_def)
  1538 apply (intro impI conjI)
  1539  prefer 2 apply (force simp add: is_hd_def) 
  1540 apply (simp add: quasilist_def is_hd_def)
  1541 apply (elim disjE exE, auto)
  1542 done 
  1543 
  1544 lemma (in M_trivial) is_tl_Nil: "is_tl(M,[],Z) <-> Z = []"
  1545 by (simp add: is_tl_def)
  1546 
  1547 lemma (in M_trivial) is_tl_Cons:
  1548      "[|M(a); M(l)|] ==> is_tl(M,Cons(a,l),Z) <-> Z = l"
  1549 by (force simp add: is_tl_def) 
  1550 
  1551 lemma (in M_trivial) tl_abs [simp]:
  1552      "[|M(x); M(y)|] ==> is_tl(M,x,y) <-> y = tl'(x)"
  1553 apply (simp add: tl'_def)
  1554 apply (intro impI conjI)
  1555  prefer 2 apply (force simp add: is_tl_def) 
  1556 apply (simp add: quasilist_def is_tl_def)
  1557 apply (elim disjE exE, auto)
  1558 done 
  1559 
  1560 lemma (in M_trivial) relativize1_tl: "relativize1(M, is_tl(M), tl')"  
  1561 by (simp add: relativize1_def)
  1562 
  1563 lemma hd'_Nil: "hd'([]) = 0"
  1564 by (simp add: hd'_def)
  1565 
  1566 lemma hd'_Cons: "hd'(Cons(a,l)) = a"
  1567 by (simp add: hd'_def)
  1568 
  1569 lemma tl'_Nil: "tl'([]) = []"
  1570 by (simp add: tl'_def)
  1571 
  1572 lemma tl'_Cons: "tl'(Cons(a,l)) = l"
  1573 by (simp add: tl'_def)
  1574 
  1575 lemma iterates_tl_Nil: "n \<in> nat ==> tl'^n ([]) = []"
  1576 apply (induct_tac n) 
  1577 apply (simp_all add: tl'_Nil) 
  1578 done
  1579 
  1580 lemma (in M_basic) tl'_closed: "M(x) ==> M(tl'(x))"
  1581 apply (simp add: tl'_def)
  1582 apply (force simp add: quasilist_def)
  1583 done
  1584 
  1585 
  1586 end