src/ZF/Constructible/Relative.thy
author haftmann
Fri Jun 17 16:12:49 2005 +0200 (2005-06-17)
changeset 16417 9bc16273c2d4
parent 13702 c7cf8fa66534
child 21233 5a5c8ea5f66a
permissions -rw-r--r--
migrated theory headers to new format
     1 (*  Title:      ZF/Constructible/Relative.thy
     2     ID:         $Id$
     3     Author:     Lawrence C Paulson, Cambridge University Computer Laboratory
     4 *)
     5 
     6 header {*Relativization and Absoluteness*}
     7 
     8 theory Relative imports Main begin
     9 
    10 subsection{* Relativized versions of standard set-theoretic concepts *}
    11 
    12 constdefs
    13   empty :: "[i=>o,i] => o"
    14     "empty(M,z) == \<forall>x[M]. x \<notin> z"
    15 
    16   subset :: "[i=>o,i,i] => o"
    17     "subset(M,A,B) == \<forall>x[M]. x\<in>A --> x \<in> B"
    18 
    19   upair :: "[i=>o,i,i,i] => o"
    20     "upair(M,a,b,z) == a \<in> z & b \<in> z & (\<forall>x[M]. x\<in>z --> x = a | x = b)"
    21 
    22   pair :: "[i=>o,i,i,i] => o"
    23     "pair(M,a,b,z) == \<exists>x[M]. upair(M,a,a,x) &
    24                           (\<exists>y[M]. upair(M,a,b,y) & upair(M,x,y,z))"
    25 
    26 
    27   union :: "[i=>o,i,i,i] => o"
    28     "union(M,a,b,z) == \<forall>x[M]. x \<in> z <-> x \<in> a | x \<in> b"
    29 
    30   is_cons :: "[i=>o,i,i,i] => o"
    31     "is_cons(M,a,b,z) == \<exists>x[M]. upair(M,a,a,x) & union(M,x,b,z)"
    32 
    33   successor :: "[i=>o,i,i] => o"
    34     "successor(M,a,z) == is_cons(M,a,a,z)"
    35 
    36   number1 :: "[i=>o,i] => o"
    37     "number1(M,a) == \<exists>x[M]. empty(M,x) & successor(M,x,a)"
    38 
    39   number2 :: "[i=>o,i] => o"
    40     "number2(M,a) == \<exists>x[M]. number1(M,x) & successor(M,x,a)"
    41 
    42   number3 :: "[i=>o,i] => o"
    43     "number3(M,a) == \<exists>x[M]. number2(M,x) & successor(M,x,a)"
    44 
    45   powerset :: "[i=>o,i,i] => o"
    46     "powerset(M,A,z) == \<forall>x[M]. x \<in> z <-> subset(M,x,A)"
    47 
    48   is_Collect :: "[i=>o,i,i=>o,i] => o"
    49     "is_Collect(M,A,P,z) == \<forall>x[M]. x \<in> z <-> x \<in> A & P(x)"
    50 
    51   is_Replace :: "[i=>o,i,[i,i]=>o,i] => o"
    52     "is_Replace(M,A,P,z) == \<forall>u[M]. u \<in> z <-> (\<exists>x[M]. x\<in>A & P(x,u))"
    53 
    54   inter :: "[i=>o,i,i,i] => o"
    55     "inter(M,a,b,z) == \<forall>x[M]. x \<in> z <-> x \<in> a & x \<in> b"
    56 
    57   setdiff :: "[i=>o,i,i,i] => o"
    58     "setdiff(M,a,b,z) == \<forall>x[M]. x \<in> z <-> x \<in> a & x \<notin> b"
    59 
    60   big_union :: "[i=>o,i,i] => o"
    61     "big_union(M,A,z) == \<forall>x[M]. x \<in> z <-> (\<exists>y[M]. y\<in>A & x \<in> y)"
    62 
    63   big_inter :: "[i=>o,i,i] => o"
    64     "big_inter(M,A,z) ==
    65              (A=0 --> z=0) &
    66 	     (A\<noteq>0 --> (\<forall>x[M]. x \<in> z <-> (\<forall>y[M]. y\<in>A --> x \<in> y)))"
    67 
    68   cartprod :: "[i=>o,i,i,i] => o"
    69     "cartprod(M,A,B,z) ==
    70 	\<forall>u[M]. u \<in> z <-> (\<exists>x[M]. x\<in>A & (\<exists>y[M]. y\<in>B & pair(M,x,y,u)))"
    71 
    72   is_sum :: "[i=>o,i,i,i] => o"
    73     "is_sum(M,A,B,Z) ==
    74        \<exists>A0[M]. \<exists>n1[M]. \<exists>s1[M]. \<exists>B1[M].
    75        number1(M,n1) & cartprod(M,n1,A,A0) & upair(M,n1,n1,s1) &
    76        cartprod(M,s1,B,B1) & union(M,A0,B1,Z)"
    77 
    78   is_Inl :: "[i=>o,i,i] => o"
    79     "is_Inl(M,a,z) == \<exists>zero[M]. empty(M,zero) & pair(M,zero,a,z)"
    80 
    81   is_Inr :: "[i=>o,i,i] => o"
    82     "is_Inr(M,a,z) == \<exists>n1[M]. number1(M,n1) & pair(M,n1,a,z)"
    83 
    84   is_converse :: "[i=>o,i,i] => o"
    85     "is_converse(M,r,z) ==
    86 	\<forall>x[M]. x \<in> z <->
    87              (\<exists>w[M]. w\<in>r & (\<exists>u[M]. \<exists>v[M]. pair(M,u,v,w) & pair(M,v,u,x)))"
    88 
    89   pre_image :: "[i=>o,i,i,i] => o"
    90     "pre_image(M,r,A,z) ==
    91 	\<forall>x[M]. x \<in> z <-> (\<exists>w[M]. w\<in>r & (\<exists>y[M]. y\<in>A & pair(M,x,y,w)))"
    92 
    93   is_domain :: "[i=>o,i,i] => o"
    94     "is_domain(M,r,z) ==
    95 	\<forall>x[M]. x \<in> z <-> (\<exists>w[M]. w\<in>r & (\<exists>y[M]. pair(M,x,y,w)))"
    96 
    97   image :: "[i=>o,i,i,i] => o"
    98     "image(M,r,A,z) ==
    99         \<forall>y[M]. y \<in> z <-> (\<exists>w[M]. w\<in>r & (\<exists>x[M]. x\<in>A & pair(M,x,y,w)))"
   100 
   101   is_range :: "[i=>o,i,i] => o"
   102     --{*the cleaner
   103       @{term "\<exists>r'[M]. is_converse(M,r,r') & is_domain(M,r',z)"}
   104       unfortunately needs an instance of separation in order to prove
   105         @{term "M(converse(r))"}.*}
   106     "is_range(M,r,z) ==
   107 	\<forall>y[M]. y \<in> z <-> (\<exists>w[M]. w\<in>r & (\<exists>x[M]. pair(M,x,y,w)))"
   108 
   109   is_field :: "[i=>o,i,i] => o"
   110     "is_field(M,r,z) ==
   111 	\<exists>dr[M]. \<exists>rr[M]. is_domain(M,r,dr) & is_range(M,r,rr) &
   112                         union(M,dr,rr,z)"
   113 
   114   is_relation :: "[i=>o,i] => o"
   115     "is_relation(M,r) ==
   116         (\<forall>z[M]. z\<in>r --> (\<exists>x[M]. \<exists>y[M]. pair(M,x,y,z)))"
   117 
   118   is_function :: "[i=>o,i] => o"
   119     "is_function(M,r) ==
   120 	\<forall>x[M]. \<forall>y[M]. \<forall>y'[M]. \<forall>p[M]. \<forall>p'[M].
   121            pair(M,x,y,p) --> pair(M,x,y',p') --> p\<in>r --> p'\<in>r --> y=y'"
   122 
   123   fun_apply :: "[i=>o,i,i,i] => o"
   124     "fun_apply(M,f,x,y) ==
   125         (\<exists>xs[M]. \<exists>fxs[M].
   126          upair(M,x,x,xs) & image(M,f,xs,fxs) & big_union(M,fxs,y))"
   127 
   128   typed_function :: "[i=>o,i,i,i] => o"
   129     "typed_function(M,A,B,r) ==
   130         is_function(M,r) & is_relation(M,r) & is_domain(M,r,A) &
   131         (\<forall>u[M]. u\<in>r --> (\<forall>x[M]. \<forall>y[M]. pair(M,x,y,u) --> y\<in>B))"
   132 
   133   is_funspace :: "[i=>o,i,i,i] => o"
   134     "is_funspace(M,A,B,F) ==
   135         \<forall>f[M]. f \<in> F <-> typed_function(M,A,B,f)"
   136 
   137   composition :: "[i=>o,i,i,i] => o"
   138     "composition(M,r,s,t) ==
   139         \<forall>p[M]. p \<in> t <->
   140                (\<exists>x[M]. \<exists>y[M]. \<exists>z[M]. \<exists>xy[M]. \<exists>yz[M].
   141                 pair(M,x,z,p) & pair(M,x,y,xy) & pair(M,y,z,yz) &
   142                 xy \<in> s & yz \<in> r)"
   143 
   144   injection :: "[i=>o,i,i,i] => o"
   145     "injection(M,A,B,f) ==
   146 	typed_function(M,A,B,f) &
   147         (\<forall>x[M]. \<forall>x'[M]. \<forall>y[M]. \<forall>p[M]. \<forall>p'[M].
   148           pair(M,x,y,p) --> pair(M,x',y,p') --> p\<in>f --> p'\<in>f --> x=x')"
   149 
   150   surjection :: "[i=>o,i,i,i] => o"
   151     "surjection(M,A,B,f) ==
   152         typed_function(M,A,B,f) &
   153         (\<forall>y[M]. y\<in>B --> (\<exists>x[M]. x\<in>A & fun_apply(M,f,x,y)))"
   154 
   155   bijection :: "[i=>o,i,i,i] => o"
   156     "bijection(M,A,B,f) == injection(M,A,B,f) & surjection(M,A,B,f)"
   157 
   158   restriction :: "[i=>o,i,i,i] => o"
   159     "restriction(M,r,A,z) ==
   160 	\<forall>x[M]. x \<in> z <-> (x \<in> r & (\<exists>u[M]. u\<in>A & (\<exists>v[M]. pair(M,u,v,x))))"
   161 
   162   transitive_set :: "[i=>o,i] => o"
   163     "transitive_set(M,a) == \<forall>x[M]. x\<in>a --> subset(M,x,a)"
   164 
   165   ordinal :: "[i=>o,i] => o"
   166      --{*an ordinal is a transitive set of transitive sets*}
   167     "ordinal(M,a) == transitive_set(M,a) & (\<forall>x[M]. x\<in>a --> transitive_set(M,x))"
   168 
   169   limit_ordinal :: "[i=>o,i] => o"
   170     --{*a limit ordinal is a non-empty, successor-closed ordinal*}
   171     "limit_ordinal(M,a) ==
   172 	ordinal(M,a) & ~ empty(M,a) &
   173         (\<forall>x[M]. x\<in>a --> (\<exists>y[M]. y\<in>a & successor(M,x,y)))"
   174 
   175   successor_ordinal :: "[i=>o,i] => o"
   176     --{*a successor ordinal is any ordinal that is neither empty nor limit*}
   177     "successor_ordinal(M,a) ==
   178 	ordinal(M,a) & ~ empty(M,a) & ~ limit_ordinal(M,a)"
   179 
   180   finite_ordinal :: "[i=>o,i] => o"
   181     --{*an ordinal is finite if neither it nor any of its elements are limit*}
   182     "finite_ordinal(M,a) ==
   183 	ordinal(M,a) & ~ limit_ordinal(M,a) &
   184         (\<forall>x[M]. x\<in>a --> ~ limit_ordinal(M,x))"
   185 
   186   omega :: "[i=>o,i] => o"
   187     --{*omega is a limit ordinal none of whose elements are limit*}
   188     "omega(M,a) == limit_ordinal(M,a) & (\<forall>x[M]. x\<in>a --> ~ limit_ordinal(M,x))"
   189 
   190   is_quasinat :: "[i=>o,i] => o"
   191     "is_quasinat(M,z) == empty(M,z) | (\<exists>m[M]. successor(M,m,z))"
   192 
   193   is_nat_case :: "[i=>o, i, [i,i]=>o, i, i] => o"
   194     "is_nat_case(M, a, is_b, k, z) ==
   195        (empty(M,k) --> z=a) &
   196        (\<forall>m[M]. successor(M,m,k) --> is_b(m,z)) &
   197        (is_quasinat(M,k) | empty(M,z))"
   198 
   199   relation1 :: "[i=>o, [i,i]=>o, i=>i] => o"
   200     "relation1(M,is_f,f) == \<forall>x[M]. \<forall>y[M]. is_f(x,y) <-> y = f(x)"
   201 
   202   Relation1 :: "[i=>o, i, [i,i]=>o, i=>i] => o"
   203     --{*as above, but typed*}
   204     "Relation1(M,A,is_f,f) ==
   205         \<forall>x[M]. \<forall>y[M]. x\<in>A --> is_f(x,y) <-> y = f(x)"
   206 
   207   relation2 :: "[i=>o, [i,i,i]=>o, [i,i]=>i] => o"
   208     "relation2(M,is_f,f) == \<forall>x[M]. \<forall>y[M]. \<forall>z[M]. is_f(x,y,z) <-> z = f(x,y)"
   209 
   210   Relation2 :: "[i=>o, i, i, [i,i,i]=>o, [i,i]=>i] => o"
   211     "Relation2(M,A,B,is_f,f) ==
   212         \<forall>x[M]. \<forall>y[M]. \<forall>z[M]. x\<in>A --> y\<in>B --> is_f(x,y,z) <-> z = f(x,y)"
   213 
   214   relation3 :: "[i=>o, [i,i,i,i]=>o, [i,i,i]=>i] => o"
   215     "relation3(M,is_f,f) ==
   216        \<forall>x[M]. \<forall>y[M]. \<forall>z[M]. \<forall>u[M]. is_f(x,y,z,u) <-> u = f(x,y,z)"
   217 
   218   Relation3 :: "[i=>o, i, i, i, [i,i,i,i]=>o, [i,i,i]=>i] => o"
   219     "Relation3(M,A,B,C,is_f,f) ==
   220        \<forall>x[M]. \<forall>y[M]. \<forall>z[M]. \<forall>u[M].
   221          x\<in>A --> y\<in>B --> z\<in>C --> is_f(x,y,z,u) <-> u = f(x,y,z)"
   222 
   223   relation4 :: "[i=>o, [i,i,i,i,i]=>o, [i,i,i,i]=>i] => o"
   224     "relation4(M,is_f,f) ==
   225        \<forall>u[M]. \<forall>x[M]. \<forall>y[M]. \<forall>z[M]. \<forall>a[M]. is_f(u,x,y,z,a) <-> a = f(u,x,y,z)"
   226 
   227 
   228 text{*Useful when absoluteness reasoning has replaced the predicates by terms*}
   229 lemma triv_Relation1:
   230      "Relation1(M, A, \<lambda>x y. y = f(x), f)"
   231 by (simp add: Relation1_def)
   232 
   233 lemma triv_Relation2:
   234      "Relation2(M, A, B, \<lambda>x y a. a = f(x,y), f)"
   235 by (simp add: Relation2_def)
   236 
   237 
   238 subsection {*The relativized ZF axioms*}
   239 constdefs
   240 
   241   extensionality :: "(i=>o) => o"
   242     "extensionality(M) ==
   243 	\<forall>x[M]. \<forall>y[M]. (\<forall>z[M]. z \<in> x <-> z \<in> y) --> x=y"
   244 
   245   separation :: "[i=>o, i=>o] => o"
   246     --{*The formula @{text P} should only involve parameters
   247         belonging to @{text M} and all its quantifiers must be relativized
   248         to @{text M}.  We do not have separation as a scheme; every instance
   249         that we need must be assumed (and later proved) separately.*}
   250     "separation(M,P) ==
   251 	\<forall>z[M]. \<exists>y[M]. \<forall>x[M]. x \<in> y <-> x \<in> z & P(x)"
   252 
   253   upair_ax :: "(i=>o) => o"
   254     "upair_ax(M) == \<forall>x[M]. \<forall>y[M]. \<exists>z[M]. upair(M,x,y,z)"
   255 
   256   Union_ax :: "(i=>o) => o"
   257     "Union_ax(M) == \<forall>x[M]. \<exists>z[M]. big_union(M,x,z)"
   258 
   259   power_ax :: "(i=>o) => o"
   260     "power_ax(M) == \<forall>x[M]. \<exists>z[M]. powerset(M,x,z)"
   261 
   262   univalent :: "[i=>o, i, [i,i]=>o] => o"
   263     "univalent(M,A,P) ==
   264 	\<forall>x[M]. x\<in>A --> (\<forall>y[M]. \<forall>z[M]. P(x,y) & P(x,z) --> y=z)"
   265 
   266   replacement :: "[i=>o, [i,i]=>o] => o"
   267     "replacement(M,P) ==
   268       \<forall>A[M]. univalent(M,A,P) -->
   269       (\<exists>Y[M]. \<forall>b[M]. (\<exists>x[M]. x\<in>A & P(x,b)) --> b \<in> Y)"
   270 
   271   strong_replacement :: "[i=>o, [i,i]=>o] => o"
   272     "strong_replacement(M,P) ==
   273       \<forall>A[M]. univalent(M,A,P) -->
   274       (\<exists>Y[M]. \<forall>b[M]. b \<in> Y <-> (\<exists>x[M]. x\<in>A & P(x,b)))"
   275 
   276   foundation_ax :: "(i=>o) => o"
   277     "foundation_ax(M) ==
   278 	\<forall>x[M]. (\<exists>y[M]. y\<in>x) --> (\<exists>y[M]. y\<in>x & ~(\<exists>z[M]. z\<in>x & z \<in> y))"
   279 
   280 
   281 subsection{*A trivial consistency proof for $V_\omega$ *}
   282 
   283 text{*We prove that $V_\omega$
   284       (or @{text univ} in Isabelle) satisfies some ZF axioms.
   285      Kunen, Theorem IV 3.13, page 123.*}
   286 
   287 lemma univ0_downwards_mem: "[| y \<in> x; x \<in> univ(0) |] ==> y \<in> univ(0)"
   288 apply (insert Transset_univ [OF Transset_0])
   289 apply (simp add: Transset_def, blast)
   290 done
   291 
   292 lemma univ0_Ball_abs [simp]:
   293      "A \<in> univ(0) ==> (\<forall>x\<in>A. x \<in> univ(0) --> P(x)) <-> (\<forall>x\<in>A. P(x))"
   294 by (blast intro: univ0_downwards_mem)
   295 
   296 lemma univ0_Bex_abs [simp]:
   297      "A \<in> univ(0) ==> (\<exists>x\<in>A. x \<in> univ(0) & P(x)) <-> (\<exists>x\<in>A. P(x))"
   298 by (blast intro: univ0_downwards_mem)
   299 
   300 text{*Congruence rule for separation: can assume the variable is in @{text M}*}
   301 lemma separation_cong [cong]:
   302      "(!!x. M(x) ==> P(x) <-> P'(x))
   303       ==> separation(M, %x. P(x)) <-> separation(M, %x. P'(x))"
   304 by (simp add: separation_def)
   305 
   306 lemma univalent_cong [cong]:
   307      "[| A=A'; !!x y. [| x\<in>A; M(x); M(y) |] ==> P(x,y) <-> P'(x,y) |]
   308       ==> univalent(M, A, %x y. P(x,y)) <-> univalent(M, A', %x y. P'(x,y))"
   309 by (simp add: univalent_def)
   310 
   311 lemma univalent_triv [intro,simp]:
   312      "univalent(M, A, \<lambda>x y. y = f(x))"
   313 by (simp add: univalent_def)
   314 
   315 lemma univalent_conjI2 [intro,simp]:
   316      "univalent(M,A,Q) ==> univalent(M, A, \<lambda>x y. P(x,y) & Q(x,y))"
   317 by (simp add: univalent_def, blast)
   318 
   319 text{*Congruence rule for replacement*}
   320 lemma strong_replacement_cong [cong]:
   321      "[| !!x y. [| M(x); M(y) |] ==> P(x,y) <-> P'(x,y) |]
   322       ==> strong_replacement(M, %x y. P(x,y)) <->
   323           strong_replacement(M, %x y. P'(x,y))"
   324 by (simp add: strong_replacement_def)
   325 
   326 text{*The extensionality axiom*}
   327 lemma "extensionality(\<lambda>x. x \<in> univ(0))"
   328 apply (simp add: extensionality_def)
   329 apply (blast intro: univ0_downwards_mem)
   330 done
   331 
   332 text{*The separation axiom requires some lemmas*}
   333 lemma Collect_in_Vfrom:
   334      "[| X \<in> Vfrom(A,j);  Transset(A) |] ==> Collect(X,P) \<in> Vfrom(A, succ(j))"
   335 apply (drule Transset_Vfrom)
   336 apply (rule subset_mem_Vfrom)
   337 apply (unfold Transset_def, blast)
   338 done
   339 
   340 lemma Collect_in_VLimit:
   341      "[| X \<in> Vfrom(A,i);  Limit(i);  Transset(A) |]
   342       ==> Collect(X,P) \<in> Vfrom(A,i)"
   343 apply (rule Limit_VfromE, assumption+)
   344 apply (blast intro: Limit_has_succ VfromI Collect_in_Vfrom)
   345 done
   346 
   347 lemma Collect_in_univ:
   348      "[| X \<in> univ(A);  Transset(A) |] ==> Collect(X,P) \<in> univ(A)"
   349 by (simp add: univ_def Collect_in_VLimit Limit_nat)
   350 
   351 lemma "separation(\<lambda>x. x \<in> univ(0), P)"
   352 apply (simp add: separation_def, clarify)
   353 apply (rule_tac x = "Collect(z,P)" in bexI)
   354 apply (blast intro: Collect_in_univ Transset_0)+
   355 done
   356 
   357 text{*Unordered pairing axiom*}
   358 lemma "upair_ax(\<lambda>x. x \<in> univ(0))"
   359 apply (simp add: upair_ax_def upair_def)
   360 apply (blast intro: doubleton_in_univ)
   361 done
   362 
   363 text{*Union axiom*}
   364 lemma "Union_ax(\<lambda>x. x \<in> univ(0))"
   365 apply (simp add: Union_ax_def big_union_def, clarify)
   366 apply (rule_tac x="\<Union>x" in bexI)
   367  apply (blast intro: univ0_downwards_mem)
   368 apply (blast intro: Union_in_univ Transset_0)
   369 done
   370 
   371 text{*Powerset axiom*}
   372 
   373 lemma Pow_in_univ:
   374      "[| X \<in> univ(A);  Transset(A) |] ==> Pow(X) \<in> univ(A)"
   375 apply (simp add: univ_def Pow_in_VLimit Limit_nat)
   376 done
   377 
   378 lemma "power_ax(\<lambda>x. x \<in> univ(0))"
   379 apply (simp add: power_ax_def powerset_def subset_def, clarify)
   380 apply (rule_tac x="Pow(x)" in bexI)
   381  apply (blast intro: univ0_downwards_mem)
   382 apply (blast intro: Pow_in_univ Transset_0)
   383 done
   384 
   385 text{*Foundation axiom*}
   386 lemma "foundation_ax(\<lambda>x. x \<in> univ(0))"
   387 apply (simp add: foundation_ax_def, clarify)
   388 apply (cut_tac A=x in foundation)
   389 apply (blast intro: univ0_downwards_mem)
   390 done
   391 
   392 lemma "replacement(\<lambda>x. x \<in> univ(0), P)"
   393 apply (simp add: replacement_def, clarify)
   394 oops
   395 text{*no idea: maybe prove by induction on the rank of A?*}
   396 
   397 text{*Still missing: Replacement, Choice*}
   398 
   399 subsection{*Lemmas Needed to Reduce Some Set Constructions to Instances
   400       of Separation*}
   401 
   402 lemma image_iff_Collect: "r `` A = {y \<in> Union(Union(r)). \<exists>p\<in>r. \<exists>x\<in>A. p=<x,y>}"
   403 apply (rule equalityI, auto)
   404 apply (simp add: Pair_def, blast)
   405 done
   406 
   407 lemma vimage_iff_Collect:
   408      "r -`` A = {x \<in> Union(Union(r)). \<exists>p\<in>r. \<exists>y\<in>A. p=<x,y>}"
   409 apply (rule equalityI, auto)
   410 apply (simp add: Pair_def, blast)
   411 done
   412 
   413 text{*These two lemmas lets us prove @{text domain_closed} and
   414       @{text range_closed} without new instances of separation*}
   415 
   416 lemma domain_eq_vimage: "domain(r) = r -`` Union(Union(r))"
   417 apply (rule equalityI, auto)
   418 apply (rule vimageI, assumption)
   419 apply (simp add: Pair_def, blast)
   420 done
   421 
   422 lemma range_eq_image: "range(r) = r `` Union(Union(r))"
   423 apply (rule equalityI, auto)
   424 apply (rule imageI, assumption)
   425 apply (simp add: Pair_def, blast)
   426 done
   427 
   428 lemma replacementD:
   429     "[| replacement(M,P); M(A);  univalent(M,A,P) |]
   430      ==> \<exists>Y[M]. (\<forall>b[M]. ((\<exists>x[M]. x\<in>A & P(x,b)) --> b \<in> Y))"
   431 by (simp add: replacement_def)
   432 
   433 lemma strong_replacementD:
   434     "[| strong_replacement(M,P); M(A);  univalent(M,A,P) |]
   435      ==> \<exists>Y[M]. (\<forall>b[M]. (b \<in> Y <-> (\<exists>x[M]. x\<in>A & P(x,b))))"
   436 by (simp add: strong_replacement_def)
   437 
   438 lemma separationD:
   439     "[| separation(M,P); M(z) |] ==> \<exists>y[M]. \<forall>x[M]. x \<in> y <-> x \<in> z & P(x)"
   440 by (simp add: separation_def)
   441 
   442 
   443 text{*More constants, for order types*}
   444 constdefs
   445 
   446   order_isomorphism :: "[i=>o,i,i,i,i,i] => o"
   447     "order_isomorphism(M,A,r,B,s,f) ==
   448         bijection(M,A,B,f) &
   449         (\<forall>x[M]. x\<in>A --> (\<forall>y[M]. y\<in>A -->
   450           (\<forall>p[M]. \<forall>fx[M]. \<forall>fy[M]. \<forall>q[M].
   451             pair(M,x,y,p) --> fun_apply(M,f,x,fx) --> fun_apply(M,f,y,fy) -->
   452             pair(M,fx,fy,q) --> (p\<in>r <-> q\<in>s))))"
   453 
   454   pred_set :: "[i=>o,i,i,i,i] => o"
   455     "pred_set(M,A,x,r,B) ==
   456 	\<forall>y[M]. y \<in> B <-> (\<exists>p[M]. p\<in>r & y \<in> A & pair(M,y,x,p))"
   457 
   458   membership :: "[i=>o,i,i] => o" --{*membership relation*}
   459     "membership(M,A,r) ==
   460 	\<forall>p[M]. p \<in> r <-> (\<exists>x[M]. x\<in>A & (\<exists>y[M]. y\<in>A & x\<in>y & pair(M,x,y,p)))"
   461 
   462 
   463 subsection{*Introducing a Transitive Class Model*}
   464 
   465 text{*The class M is assumed to be transitive and to satisfy some
   466       relativized ZF axioms*}
   467 locale M_trivial =
   468   fixes M
   469   assumes transM:           "[| y\<in>x; M(x) |] ==> M(y)"
   470       and upair_ax:	    "upair_ax(M)"
   471       and Union_ax:	    "Union_ax(M)"
   472       and power_ax:         "power_ax(M)"
   473       and replacement:      "replacement(M,P)"
   474       and M_nat [iff]:      "M(nat)"           (*i.e. the axiom of infinity*)
   475 
   476 
   477 text{*Automatically discovers the proof using @{text transM}, @{text nat_0I}
   478 and @{text M_nat}.*}
   479 lemma (in M_trivial) nonempty [simp]: "M(0)"
   480 by (blast intro: transM)
   481 
   482 lemma (in M_trivial) rall_abs [simp]:
   483      "M(A) ==> (\<forall>x[M]. x\<in>A --> P(x)) <-> (\<forall>x\<in>A. P(x))"
   484 by (blast intro: transM)
   485 
   486 lemma (in M_trivial) rex_abs [simp]:
   487      "M(A) ==> (\<exists>x[M]. x\<in>A & P(x)) <-> (\<exists>x\<in>A. P(x))"
   488 by (blast intro: transM)
   489 
   490 lemma (in M_trivial) ball_iff_equiv:
   491      "M(A) ==> (\<forall>x[M]. (x\<in>A <-> P(x))) <->
   492                (\<forall>x\<in>A. P(x)) & (\<forall>x. P(x) --> M(x) --> x\<in>A)"
   493 by (blast intro: transM)
   494 
   495 text{*Simplifies proofs of equalities when there's an iff-equality
   496       available for rewriting, universally quantified over M.  
   497       But it's not the only way to prove such equalities: its
   498       premises @{term "M(A)"} and  @{term "M(B)"} can be too strong.*}
   499 lemma (in M_trivial) M_equalityI:
   500      "[| !!x. M(x) ==> x\<in>A <-> x\<in>B; M(A); M(B) |] ==> A=B"
   501 by (blast intro!: equalityI dest: transM)
   502 
   503 
   504 subsubsection{*Trivial Absoluteness Proofs: Empty Set, Pairs, etc.*}
   505 
   506 lemma (in M_trivial) empty_abs [simp]:
   507      "M(z) ==> empty(M,z) <-> z=0"
   508 apply (simp add: empty_def)
   509 apply (blast intro: transM)
   510 done
   511 
   512 lemma (in M_trivial) subset_abs [simp]:
   513      "M(A) ==> subset(M,A,B) <-> A \<subseteq> B"
   514 apply (simp add: subset_def)
   515 apply (blast intro: transM)
   516 done
   517 
   518 lemma (in M_trivial) upair_abs [simp]:
   519      "M(z) ==> upair(M,a,b,z) <-> z={a,b}"
   520 apply (simp add: upair_def)
   521 apply (blast intro: transM)
   522 done
   523 
   524 lemma (in M_trivial) upair_in_M_iff [iff]:
   525      "M({a,b}) <-> M(a) & M(b)"
   526 apply (insert upair_ax, simp add: upair_ax_def)
   527 apply (blast intro: transM)
   528 done
   529 
   530 lemma (in M_trivial) singleton_in_M_iff [iff]:
   531      "M({a}) <-> M(a)"
   532 by (insert upair_in_M_iff [of a a], simp)
   533 
   534 lemma (in M_trivial) pair_abs [simp]:
   535      "M(z) ==> pair(M,a,b,z) <-> z=<a,b>"
   536 apply (simp add: pair_def ZF.Pair_def)
   537 apply (blast intro: transM)
   538 done
   539 
   540 lemma (in M_trivial) pair_in_M_iff [iff]:
   541      "M(<a,b>) <-> M(a) & M(b)"
   542 by (simp add: ZF.Pair_def)
   543 
   544 lemma (in M_trivial) pair_components_in_M:
   545      "[| <x,y> \<in> A; M(A) |] ==> M(x) & M(y)"
   546 apply (simp add: Pair_def)
   547 apply (blast dest: transM)
   548 done
   549 
   550 lemma (in M_trivial) cartprod_abs [simp]:
   551      "[| M(A); M(B); M(z) |] ==> cartprod(M,A,B,z) <-> z = A*B"
   552 apply (simp add: cartprod_def)
   553 apply (rule iffI)
   554  apply (blast intro!: equalityI intro: transM dest!: rspec)
   555 apply (blast dest: transM)
   556 done
   557 
   558 subsubsection{*Absoluteness for Unions and Intersections*}
   559 
   560 lemma (in M_trivial) union_abs [simp]:
   561      "[| M(a); M(b); M(z) |] ==> union(M,a,b,z) <-> z = a Un b"
   562 apply (simp add: union_def)
   563 apply (blast intro: transM)
   564 done
   565 
   566 lemma (in M_trivial) inter_abs [simp]:
   567      "[| M(a); M(b); M(z) |] ==> inter(M,a,b,z) <-> z = a Int b"
   568 apply (simp add: inter_def)
   569 apply (blast intro: transM)
   570 done
   571 
   572 lemma (in M_trivial) setdiff_abs [simp]:
   573      "[| M(a); M(b); M(z) |] ==> setdiff(M,a,b,z) <-> z = a-b"
   574 apply (simp add: setdiff_def)
   575 apply (blast intro: transM)
   576 done
   577 
   578 lemma (in M_trivial) Union_abs [simp]:
   579      "[| M(A); M(z) |] ==> big_union(M,A,z) <-> z = Union(A)"
   580 apply (simp add: big_union_def)
   581 apply (blast intro!: equalityI dest: transM)
   582 done
   583 
   584 lemma (in M_trivial) Union_closed [intro,simp]:
   585      "M(A) ==> M(Union(A))"
   586 by (insert Union_ax, simp add: Union_ax_def)
   587 
   588 lemma (in M_trivial) Un_closed [intro,simp]:
   589      "[| M(A); M(B) |] ==> M(A Un B)"
   590 by (simp only: Un_eq_Union, blast)
   591 
   592 lemma (in M_trivial) cons_closed [intro,simp]:
   593      "[| M(a); M(A) |] ==> M(cons(a,A))"
   594 by (subst cons_eq [symmetric], blast)
   595 
   596 lemma (in M_trivial) cons_abs [simp]:
   597      "[| M(b); M(z) |] ==> is_cons(M,a,b,z) <-> z = cons(a,b)"
   598 by (simp add: is_cons_def, blast intro: transM)
   599 
   600 lemma (in M_trivial) successor_abs [simp]:
   601      "[| M(a); M(z) |] ==> successor(M,a,z) <-> z = succ(a)"
   602 by (simp add: successor_def, blast)
   603 
   604 lemma (in M_trivial) succ_in_M_iff [iff]:
   605      "M(succ(a)) <-> M(a)"
   606 apply (simp add: succ_def)
   607 apply (blast intro: transM)
   608 done
   609 
   610 subsubsection{*Absoluteness for Separation and Replacement*}
   611 
   612 lemma (in M_trivial) separation_closed [intro,simp]:
   613      "[| separation(M,P); M(A) |] ==> M(Collect(A,P))"
   614 apply (insert separation, simp add: separation_def)
   615 apply (drule rspec, assumption, clarify)
   616 apply (subgoal_tac "y = Collect(A,P)", blast)
   617 apply (blast dest: transM)
   618 done
   619 
   620 lemma separation_iff:
   621      "separation(M,P) <-> (\<forall>z[M]. \<exists>y[M]. is_Collect(M,z,P,y))"
   622 by (simp add: separation_def is_Collect_def)
   623 
   624 lemma (in M_trivial) Collect_abs [simp]:
   625      "[| M(A); M(z) |] ==> is_Collect(M,A,P,z) <-> z = Collect(A,P)"
   626 apply (simp add: is_Collect_def)
   627 apply (blast intro!: equalityI dest: transM)
   628 done
   629 
   630 text{*Probably the premise and conclusion are equivalent*}
   631 lemma (in M_trivial) strong_replacementI [rule_format]:
   632     "[| \<forall>B[M]. separation(M, %u. \<exists>x[M]. x\<in>B & P(x,u)) |]
   633      ==> strong_replacement(M,P)"
   634 apply (simp add: strong_replacement_def, clarify)
   635 apply (frule replacementD [OF replacement], assumption, clarify)
   636 apply (drule_tac x=A in rspec, clarify)
   637 apply (drule_tac z=Y in separationD, assumption, clarify)
   638 apply (rule_tac x=y in rexI, force, assumption)
   639 done
   640 
   641 subsubsection{*The Operator @{term is_Replace}*}
   642 
   643 
   644 lemma is_Replace_cong [cong]:
   645      "[| A=A';
   646          !!x y. [| M(x); M(y) |] ==> P(x,y) <-> P'(x,y);
   647          z=z' |]
   648       ==> is_Replace(M, A, %x y. P(x,y), z) <->
   649           is_Replace(M, A', %x y. P'(x,y), z')"
   650 by (simp add: is_Replace_def)
   651 
   652 lemma (in M_trivial) univalent_Replace_iff:
   653      "[| M(A); univalent(M,A,P);
   654          !!x y. [| x\<in>A; P(x,y) |] ==> M(y) |]
   655       ==> u \<in> Replace(A,P) <-> (\<exists>x. x\<in>A & P(x,u))"
   656 apply (simp add: Replace_iff univalent_def)
   657 apply (blast dest: transM)
   658 done
   659 
   660 (*The last premise expresses that P takes M to M*)
   661 lemma (in M_trivial) strong_replacement_closed [intro,simp]:
   662      "[| strong_replacement(M,P); M(A); univalent(M,A,P);
   663          !!x y. [| x\<in>A; P(x,y) |] ==> M(y) |] ==> M(Replace(A,P))"
   664 apply (simp add: strong_replacement_def)
   665 apply (drule_tac x=A in rspec, safe)
   666 apply (subgoal_tac "Replace(A,P) = Y")
   667  apply simp
   668 apply (rule equality_iffI)
   669 apply (simp add: univalent_Replace_iff)
   670 apply (blast dest: transM)
   671 done
   672 
   673 lemma (in M_trivial) Replace_abs:
   674      "[| M(A); M(z); univalent(M,A,P); 
   675          !!x y. [| x\<in>A; P(x,y) |] ==> M(y)  |]
   676       ==> is_Replace(M,A,P,z) <-> z = Replace(A,P)"
   677 apply (simp add: is_Replace_def)
   678 apply (rule iffI)
   679  apply (rule equality_iffI)
   680  apply (simp_all add: univalent_Replace_iff) 
   681  apply (blast dest: transM)+
   682 done
   683 
   684 
   685 (*The first premise can't simply be assumed as a schema.
   686   It is essential to take care when asserting instances of Replacement.
   687   Let K be a nonconstructible subset of nat and define
   688   f(x) = x if x:K and f(x)=0 otherwise.  Then RepFun(nat,f) = cons(0,K), a
   689   nonconstructible set.  So we cannot assume that M(X) implies M(RepFun(X,f))
   690   even for f : M -> M.
   691 *)
   692 lemma (in M_trivial) RepFun_closed:
   693      "[| strong_replacement(M, \<lambda>x y. y = f(x)); M(A); \<forall>x\<in>A. M(f(x)) |]
   694       ==> M(RepFun(A,f))"
   695 apply (simp add: RepFun_def)
   696 apply (rule strong_replacement_closed)
   697 apply (auto dest: transM  simp add: univalent_def)
   698 done
   699 
   700 lemma Replace_conj_eq: "{y . x \<in> A, x\<in>A & y=f(x)} = {y . x\<in>A, y=f(x)}"
   701 by simp
   702 
   703 text{*Better than @{text RepFun_closed} when having the formula @{term "x\<in>A"}
   704       makes relativization easier.*}
   705 lemma (in M_trivial) RepFun_closed2:
   706      "[| strong_replacement(M, \<lambda>x y. x\<in>A & y = f(x)); M(A); \<forall>x\<in>A. M(f(x)) |]
   707       ==> M(RepFun(A, %x. f(x)))"
   708 apply (simp add: RepFun_def)
   709 apply (frule strong_replacement_closed, assumption)
   710 apply (auto dest: transM  simp add: Replace_conj_eq univalent_def)
   711 done
   712 
   713 subsubsection {*Absoluteness for @{term Lambda}*}
   714 
   715 constdefs
   716  is_lambda :: "[i=>o, i, [i,i]=>o, i] => o"
   717     "is_lambda(M, A, is_b, z) ==
   718        \<forall>p[M]. p \<in> z <->
   719         (\<exists>u[M]. \<exists>v[M]. u\<in>A & pair(M,u,v,p) & is_b(u,v))"
   720 
   721 lemma (in M_trivial) lam_closed:
   722      "[| strong_replacement(M, \<lambda>x y. y = <x,b(x)>); M(A); \<forall>x\<in>A. M(b(x)) |]
   723       ==> M(\<lambda>x\<in>A. b(x))"
   724 by (simp add: lam_def, blast intro: RepFun_closed dest: transM)
   725 
   726 text{*Better than @{text lam_closed}: has the formula @{term "x\<in>A"}*}
   727 lemma (in M_trivial) lam_closed2:
   728   "[|strong_replacement(M, \<lambda>x y. x\<in>A & y = \<langle>x, b(x)\<rangle>);
   729      M(A); \<forall>m[M]. m\<in>A --> M(b(m))|] ==> M(Lambda(A,b))"
   730 apply (simp add: lam_def)
   731 apply (blast intro: RepFun_closed2 dest: transM)
   732 done
   733 
   734 lemma (in M_trivial) lambda_abs2:
   735      "[| Relation1(M,A,is_b,b); M(A); \<forall>m[M]. m\<in>A --> M(b(m)); M(z) |]
   736       ==> is_lambda(M,A,is_b,z) <-> z = Lambda(A,b)"
   737 apply (simp add: Relation1_def is_lambda_def)
   738 apply (rule iffI)
   739  prefer 2 apply (simp add: lam_def)
   740 apply (rule equality_iffI)
   741 apply (simp add: lam_def) 
   742 apply (rule iffI) 
   743  apply (blast dest: transM) 
   744 apply (auto simp add: transM [of _ A]) 
   745 done
   746 
   747 lemma is_lambda_cong [cong]:
   748      "[| A=A';  z=z';
   749          !!x y. [| x\<in>A; M(x); M(y) |] ==> is_b(x,y) <-> is_b'(x,y) |]
   750       ==> is_lambda(M, A, %x y. is_b(x,y), z) <->
   751           is_lambda(M, A', %x y. is_b'(x,y), z')"
   752 by (simp add: is_lambda_def)
   753 
   754 lemma (in M_trivial) image_abs [simp]:
   755      "[| M(r); M(A); M(z) |] ==> image(M,r,A,z) <-> z = r``A"
   756 apply (simp add: image_def)
   757 apply (rule iffI)
   758  apply (blast intro!: equalityI dest: transM, blast)
   759 done
   760 
   761 text{*What about @{text Pow_abs}?  Powerset is NOT absolute!
   762       This result is one direction of absoluteness.*}
   763 
   764 lemma (in M_trivial) powerset_Pow:
   765      "powerset(M, x, Pow(x))"
   766 by (simp add: powerset_def)
   767 
   768 text{*But we can't prove that the powerset in @{text M} includes the
   769       real powerset.*}
   770 lemma (in M_trivial) powerset_imp_subset_Pow:
   771      "[| powerset(M,x,y); M(y) |] ==> y <= Pow(x)"
   772 apply (simp add: powerset_def)
   773 apply (blast dest: transM)
   774 done
   775 
   776 subsubsection{*Absoluteness for the Natural Numbers*}
   777 
   778 lemma (in M_trivial) nat_into_M [intro]:
   779      "n \<in> nat ==> M(n)"
   780 by (induct n rule: nat_induct, simp_all)
   781 
   782 lemma (in M_trivial) nat_case_closed [intro,simp]:
   783   "[|M(k); M(a); \<forall>m[M]. M(b(m))|] ==> M(nat_case(a,b,k))"
   784 apply (case_tac "k=0", simp)
   785 apply (case_tac "\<exists>m. k = succ(m)", force)
   786 apply (simp add: nat_case_def)
   787 done
   788 
   789 lemma (in M_trivial) quasinat_abs [simp]:
   790      "M(z) ==> is_quasinat(M,z) <-> quasinat(z)"
   791 by (auto simp add: is_quasinat_def quasinat_def)
   792 
   793 lemma (in M_trivial) nat_case_abs [simp]:
   794      "[| relation1(M,is_b,b); M(k); M(z) |]
   795       ==> is_nat_case(M,a,is_b,k,z) <-> z = nat_case(a,b,k)"
   796 apply (case_tac "quasinat(k)")
   797  prefer 2
   798  apply (simp add: is_nat_case_def non_nat_case)
   799  apply (force simp add: quasinat_def)
   800 apply (simp add: quasinat_def is_nat_case_def)
   801 apply (elim disjE exE)
   802  apply (simp_all add: relation1_def)
   803 done
   804 
   805 (*NOT for the simplifier.  The assumption M(z') is apparently necessary, but
   806   causes the error "Failed congruence proof!"  It may be better to replace
   807   is_nat_case by nat_case before attempting congruence reasoning.*)
   808 lemma is_nat_case_cong:
   809      "[| a = a'; k = k';  z = z';  M(z');
   810        !!x y. [| M(x); M(y) |] ==> is_b(x,y) <-> is_b'(x,y) |]
   811       ==> is_nat_case(M, a, is_b, k, z) <-> is_nat_case(M, a', is_b', k', z')"
   812 by (simp add: is_nat_case_def)
   813 
   814 
   815 subsection{*Absoluteness for Ordinals*}
   816 text{*These results constitute Theorem IV 5.1 of Kunen (page 126).*}
   817 
   818 lemma (in M_trivial) lt_closed:
   819      "[| j<i; M(i) |] ==> M(j)"
   820 by (blast dest: ltD intro: transM)
   821 
   822 lemma (in M_trivial) transitive_set_abs [simp]:
   823      "M(a) ==> transitive_set(M,a) <-> Transset(a)"
   824 by (simp add: transitive_set_def Transset_def)
   825 
   826 lemma (in M_trivial) ordinal_abs [simp]:
   827      "M(a) ==> ordinal(M,a) <-> Ord(a)"
   828 by (simp add: ordinal_def Ord_def)
   829 
   830 lemma (in M_trivial) limit_ordinal_abs [simp]:
   831      "M(a) ==> limit_ordinal(M,a) <-> Limit(a)"
   832 apply (unfold Limit_def limit_ordinal_def)
   833 apply (simp add: Ord_0_lt_iff)
   834 apply (simp add: lt_def, blast)
   835 done
   836 
   837 lemma (in M_trivial) successor_ordinal_abs [simp]:
   838      "M(a) ==> successor_ordinal(M,a) <-> Ord(a) & (\<exists>b[M]. a = succ(b))"
   839 apply (simp add: successor_ordinal_def, safe)
   840 apply (drule Ord_cases_disj, auto)
   841 done
   842 
   843 lemma finite_Ord_is_nat:
   844       "[| Ord(a); ~ Limit(a); \<forall>x\<in>a. ~ Limit(x) |] ==> a \<in> nat"
   845 by (induct a rule: trans_induct3, simp_all)
   846 
   847 lemma (in M_trivial) finite_ordinal_abs [simp]:
   848      "M(a) ==> finite_ordinal(M,a) <-> a \<in> nat"
   849 apply (simp add: finite_ordinal_def)
   850 apply (blast intro: finite_Ord_is_nat intro: nat_into_Ord
   851              dest: Ord_trans naturals_not_limit)
   852 done
   853 
   854 lemma Limit_non_Limit_implies_nat:
   855      "[| Limit(a); \<forall>x\<in>a. ~ Limit(x) |] ==> a = nat"
   856 apply (rule le_anti_sym)
   857 apply (rule all_lt_imp_le, blast, blast intro: Limit_is_Ord)
   858  apply (simp add: lt_def)
   859  apply (blast intro: Ord_in_Ord Ord_trans finite_Ord_is_nat)
   860 apply (erule nat_le_Limit)
   861 done
   862 
   863 lemma (in M_trivial) omega_abs [simp]:
   864      "M(a) ==> omega(M,a) <-> a = nat"
   865 apply (simp add: omega_def)
   866 apply (blast intro: Limit_non_Limit_implies_nat dest: naturals_not_limit)
   867 done
   868 
   869 lemma (in M_trivial) number1_abs [simp]:
   870      "M(a) ==> number1(M,a) <-> a = 1"
   871 by (simp add: number1_def)
   872 
   873 lemma (in M_trivial) number2_abs [simp]:
   874      "M(a) ==> number2(M,a) <-> a = succ(1)"
   875 by (simp add: number2_def)
   876 
   877 lemma (in M_trivial) number3_abs [simp]:
   878      "M(a) ==> number3(M,a) <-> a = succ(succ(1))"
   879 by (simp add: number3_def)
   880 
   881 text{*Kunen continued to 20...*}
   882 
   883 (*Could not get this to work.  The \<lambda>x\<in>nat is essential because everything
   884   but the recursion variable must stay unchanged.  But then the recursion
   885   equations only hold for x\<in>nat (or in some other set) and not for the
   886   whole of the class M.
   887   consts
   888     natnumber_aux :: "[i=>o,i] => i"
   889 
   890   primrec
   891       "natnumber_aux(M,0) = (\<lambda>x\<in>nat. if empty(M,x) then 1 else 0)"
   892       "natnumber_aux(M,succ(n)) =
   893 	   (\<lambda>x\<in>nat. if (\<exists>y[M]. natnumber_aux(M,n)`y=1 & successor(M,y,x))
   894 		     then 1 else 0)"
   895 
   896   constdefs
   897     natnumber :: "[i=>o,i,i] => o"
   898       "natnumber(M,n,x) == natnumber_aux(M,n)`x = 1"
   899 
   900   lemma (in M_trivial) [simp]:
   901        "natnumber(M,0,x) == x=0"
   902 *)
   903 
   904 subsection{*Some instances of separation and strong replacement*}
   905 
   906 locale M_basic = M_trivial +
   907 assumes Inter_separation:
   908      "M(A) ==> separation(M, \<lambda>x. \<forall>y[M]. y\<in>A --> x\<in>y)"
   909   and Diff_separation:
   910      "M(B) ==> separation(M, \<lambda>x. x \<notin> B)"
   911   and cartprod_separation:
   912      "[| M(A); M(B) |]
   913       ==> separation(M, \<lambda>z. \<exists>x[M]. x\<in>A & (\<exists>y[M]. y\<in>B & pair(M,x,y,z)))"
   914   and image_separation:
   915      "[| M(A); M(r) |]
   916       ==> separation(M, \<lambda>y. \<exists>p[M]. p\<in>r & (\<exists>x[M]. x\<in>A & pair(M,x,y,p)))"
   917   and converse_separation:
   918      "M(r) ==> separation(M,
   919          \<lambda>z. \<exists>p[M]. p\<in>r & (\<exists>x[M]. \<exists>y[M]. pair(M,x,y,p) & pair(M,y,x,z)))"
   920   and restrict_separation:
   921      "M(A) ==> separation(M, \<lambda>z. \<exists>x[M]. x\<in>A & (\<exists>y[M]. pair(M,x,y,z)))"
   922   and comp_separation:
   923      "[| M(r); M(s) |]
   924       ==> separation(M, \<lambda>xz. \<exists>x[M]. \<exists>y[M]. \<exists>z[M]. \<exists>xy[M]. \<exists>yz[M].
   925 		  pair(M,x,z,xz) & pair(M,x,y,xy) & pair(M,y,z,yz) &
   926                   xy\<in>s & yz\<in>r)"
   927   and pred_separation:
   928      "[| M(r); M(x) |] ==> separation(M, \<lambda>y. \<exists>p[M]. p\<in>r & pair(M,y,x,p))"
   929   and Memrel_separation:
   930      "separation(M, \<lambda>z. \<exists>x[M]. \<exists>y[M]. pair(M,x,y,z) & x \<in> y)"
   931   and funspace_succ_replacement:
   932      "M(n) ==>
   933       strong_replacement(M, \<lambda>p z. \<exists>f[M]. \<exists>b[M]. \<exists>nb[M]. \<exists>cnbf[M].
   934                 pair(M,f,b,p) & pair(M,n,b,nb) & is_cons(M,nb,f,cnbf) &
   935                 upair(M,cnbf,cnbf,z))"
   936   and is_recfun_separation:
   937      --{*for well-founded recursion: used to prove @{text is_recfun_equal}*}
   938      "[| M(r); M(f); M(g); M(a); M(b) |]
   939      ==> separation(M,
   940             \<lambda>x. \<exists>xa[M]. \<exists>xb[M].
   941                 pair(M,x,a,xa) & xa \<in> r & pair(M,x,b,xb) & xb \<in> r &
   942                 (\<exists>fx[M]. \<exists>gx[M]. fun_apply(M,f,x,fx) & fun_apply(M,g,x,gx) &
   943                                    fx \<noteq> gx))"
   944 
   945 lemma (in M_basic) cartprod_iff_lemma:
   946      "[| M(C);  \<forall>u[M]. u \<in> C <-> (\<exists>x\<in>A. \<exists>y\<in>B. u = {{x}, {x,y}});
   947          powerset(M, A \<union> B, p1); powerset(M, p1, p2);  M(p2) |]
   948        ==> C = {u \<in> p2 . \<exists>x\<in>A. \<exists>y\<in>B. u = {{x}, {x,y}}}"
   949 apply (simp add: powerset_def)
   950 apply (rule equalityI, clarify, simp)
   951  apply (frule transM, assumption)
   952  apply (frule transM, assumption, simp (no_asm_simp))
   953  apply blast
   954 apply clarify
   955 apply (frule transM, assumption, force)
   956 done
   957 
   958 lemma (in M_basic) cartprod_iff:
   959      "[| M(A); M(B); M(C) |]
   960       ==> cartprod(M,A,B,C) <->
   961           (\<exists>p1[M]. \<exists>p2[M]. powerset(M,A Un B,p1) & powerset(M,p1,p2) &
   962                    C = {z \<in> p2. \<exists>x\<in>A. \<exists>y\<in>B. z = <x,y>})"
   963 apply (simp add: Pair_def cartprod_def, safe)
   964 defer 1
   965   apply (simp add: powerset_def)
   966  apply blast
   967 txt{*Final, difficult case: the left-to-right direction of the theorem.*}
   968 apply (insert power_ax, simp add: power_ax_def)
   969 apply (frule_tac x="A Un B" and P="\<lambda>x. rex(M,?Q(x))" in rspec)
   970 apply (blast, clarify)
   971 apply (drule_tac x=z and P="\<lambda>x. rex(M,?Q(x))" in rspec)
   972 apply assumption
   973 apply (blast intro: cartprod_iff_lemma)
   974 done
   975 
   976 lemma (in M_basic) cartprod_closed_lemma:
   977      "[| M(A); M(B) |] ==> \<exists>C[M]. cartprod(M,A,B,C)"
   978 apply (simp del: cartprod_abs add: cartprod_iff)
   979 apply (insert power_ax, simp add: power_ax_def)
   980 apply (frule_tac x="A Un B" and P="\<lambda>x. rex(M,?Q(x))" in rspec)
   981 apply (blast, clarify)
   982 apply (drule_tac x=z and P="\<lambda>x. rex(M,?Q(x))" in rspec, auto)
   983 apply (intro rexI conjI, simp+)
   984 apply (insert cartprod_separation [of A B], simp)
   985 done
   986 
   987 text{*All the lemmas above are necessary because Powerset is not absolute.
   988       I should have used Replacement instead!*}
   989 lemma (in M_basic) cartprod_closed [intro,simp]:
   990      "[| M(A); M(B) |] ==> M(A*B)"
   991 by (frule cartprod_closed_lemma, assumption, force)
   992 
   993 lemma (in M_basic) sum_closed [intro,simp]:
   994      "[| M(A); M(B) |] ==> M(A+B)"
   995 by (simp add: sum_def)
   996 
   997 lemma (in M_basic) sum_abs [simp]:
   998      "[| M(A); M(B); M(Z) |] ==> is_sum(M,A,B,Z) <-> (Z = A+B)"
   999 by (simp add: is_sum_def sum_def singleton_0 nat_into_M)
  1000 
  1001 lemma (in M_trivial) Inl_in_M_iff [iff]:
  1002      "M(Inl(a)) <-> M(a)"
  1003 by (simp add: Inl_def)
  1004 
  1005 lemma (in M_trivial) Inl_abs [simp]:
  1006      "M(Z) ==> is_Inl(M,a,Z) <-> (Z = Inl(a))"
  1007 by (simp add: is_Inl_def Inl_def)
  1008 
  1009 lemma (in M_trivial) Inr_in_M_iff [iff]:
  1010      "M(Inr(a)) <-> M(a)"
  1011 by (simp add: Inr_def)
  1012 
  1013 lemma (in M_trivial) Inr_abs [simp]:
  1014      "M(Z) ==> is_Inr(M,a,Z) <-> (Z = Inr(a))"
  1015 by (simp add: is_Inr_def Inr_def)
  1016 
  1017 
  1018 subsubsection {*converse of a relation*}
  1019 
  1020 lemma (in M_basic) M_converse_iff:
  1021      "M(r) ==>
  1022       converse(r) =
  1023       {z \<in> Union(Union(r)) * Union(Union(r)).
  1024        \<exists>p\<in>r. \<exists>x[M]. \<exists>y[M]. p = \<langle>x,y\<rangle> & z = \<langle>y,x\<rangle>}"
  1025 apply (rule equalityI)
  1026  prefer 2 apply (blast dest: transM, clarify, simp)
  1027 apply (simp add: Pair_def)
  1028 apply (blast dest: transM)
  1029 done
  1030 
  1031 lemma (in M_basic) converse_closed [intro,simp]:
  1032      "M(r) ==> M(converse(r))"
  1033 apply (simp add: M_converse_iff)
  1034 apply (insert converse_separation [of r], simp)
  1035 done
  1036 
  1037 lemma (in M_basic) converse_abs [simp]:
  1038      "[| M(r); M(z) |] ==> is_converse(M,r,z) <-> z = converse(r)"
  1039 apply (simp add: is_converse_def)
  1040 apply (rule iffI)
  1041  prefer 2 apply blast
  1042 apply (rule M_equalityI)
  1043   apply simp
  1044   apply (blast dest: transM)+
  1045 done
  1046 
  1047 
  1048 subsubsection {*image, preimage, domain, range*}
  1049 
  1050 lemma (in M_basic) image_closed [intro,simp]:
  1051      "[| M(A); M(r) |] ==> M(r``A)"
  1052 apply (simp add: image_iff_Collect)
  1053 apply (insert image_separation [of A r], simp)
  1054 done
  1055 
  1056 lemma (in M_basic) vimage_abs [simp]:
  1057      "[| M(r); M(A); M(z) |] ==> pre_image(M,r,A,z) <-> z = r-``A"
  1058 apply (simp add: pre_image_def)
  1059 apply (rule iffI)
  1060  apply (blast intro!: equalityI dest: transM, blast)
  1061 done
  1062 
  1063 lemma (in M_basic) vimage_closed [intro,simp]:
  1064      "[| M(A); M(r) |] ==> M(r-``A)"
  1065 by (simp add: vimage_def)
  1066 
  1067 
  1068 subsubsection{*Domain, range and field*}
  1069 
  1070 lemma (in M_basic) domain_abs [simp]:
  1071      "[| M(r); M(z) |] ==> is_domain(M,r,z) <-> z = domain(r)"
  1072 apply (simp add: is_domain_def)
  1073 apply (blast intro!: equalityI dest: transM)
  1074 done
  1075 
  1076 lemma (in M_basic) domain_closed [intro,simp]:
  1077      "M(r) ==> M(domain(r))"
  1078 apply (simp add: domain_eq_vimage)
  1079 done
  1080 
  1081 lemma (in M_basic) range_abs [simp]:
  1082      "[| M(r); M(z) |] ==> is_range(M,r,z) <-> z = range(r)"
  1083 apply (simp add: is_range_def)
  1084 apply (blast intro!: equalityI dest: transM)
  1085 done
  1086 
  1087 lemma (in M_basic) range_closed [intro,simp]:
  1088      "M(r) ==> M(range(r))"
  1089 apply (simp add: range_eq_image)
  1090 done
  1091 
  1092 lemma (in M_basic) field_abs [simp]:
  1093      "[| M(r); M(z) |] ==> is_field(M,r,z) <-> z = field(r)"
  1094 by (simp add: domain_closed range_closed is_field_def field_def)
  1095 
  1096 lemma (in M_basic) field_closed [intro,simp]:
  1097      "M(r) ==> M(field(r))"
  1098 by (simp add: domain_closed range_closed Un_closed field_def)
  1099 
  1100 
  1101 subsubsection{*Relations, functions and application*}
  1102 
  1103 lemma (in M_basic) relation_abs [simp]:
  1104      "M(r) ==> is_relation(M,r) <-> relation(r)"
  1105 apply (simp add: is_relation_def relation_def)
  1106 apply (blast dest!: bspec dest: pair_components_in_M)+
  1107 done
  1108 
  1109 lemma (in M_basic) function_abs [simp]:
  1110      "M(r) ==> is_function(M,r) <-> function(r)"
  1111 apply (simp add: is_function_def function_def, safe)
  1112    apply (frule transM, assumption)
  1113   apply (blast dest: pair_components_in_M)+
  1114 done
  1115 
  1116 lemma (in M_basic) apply_closed [intro,simp]:
  1117      "[|M(f); M(a)|] ==> M(f`a)"
  1118 by (simp add: apply_def)
  1119 
  1120 lemma (in M_basic) apply_abs [simp]:
  1121      "[| M(f); M(x); M(y) |] ==> fun_apply(M,f,x,y) <-> f`x = y"
  1122 apply (simp add: fun_apply_def apply_def, blast)
  1123 done
  1124 
  1125 lemma (in M_basic) typed_function_abs [simp]:
  1126      "[| M(A); M(f) |] ==> typed_function(M,A,B,f) <-> f \<in> A -> B"
  1127 apply (auto simp add: typed_function_def relation_def Pi_iff)
  1128 apply (blast dest: pair_components_in_M)+
  1129 done
  1130 
  1131 lemma (in M_basic) injection_abs [simp]:
  1132      "[| M(A); M(f) |] ==> injection(M,A,B,f) <-> f \<in> inj(A,B)"
  1133 apply (simp add: injection_def apply_iff inj_def apply_closed)
  1134 apply (blast dest: transM [of _ A])
  1135 done
  1136 
  1137 lemma (in M_basic) surjection_abs [simp]:
  1138      "[| M(A); M(B); M(f) |] ==> surjection(M,A,B,f) <-> f \<in> surj(A,B)"
  1139 by (simp add: surjection_def surj_def)
  1140 
  1141 lemma (in M_basic) bijection_abs [simp]:
  1142      "[| M(A); M(B); M(f) |] ==> bijection(M,A,B,f) <-> f \<in> bij(A,B)"
  1143 by (simp add: bijection_def bij_def)
  1144 
  1145 
  1146 subsubsection{*Composition of relations*}
  1147 
  1148 lemma (in M_basic) M_comp_iff:
  1149      "[| M(r); M(s) |]
  1150       ==> r O s =
  1151           {xz \<in> domain(s) * range(r).
  1152             \<exists>x[M]. \<exists>y[M]. \<exists>z[M]. xz = \<langle>x,z\<rangle> & \<langle>x,y\<rangle> \<in> s & \<langle>y,z\<rangle> \<in> r}"
  1153 apply (simp add: comp_def)
  1154 apply (rule equalityI)
  1155  apply clarify
  1156  apply simp
  1157  apply  (blast dest:  transM)+
  1158 done
  1159 
  1160 lemma (in M_basic) comp_closed [intro,simp]:
  1161      "[| M(r); M(s) |] ==> M(r O s)"
  1162 apply (simp add: M_comp_iff)
  1163 apply (insert comp_separation [of r s], simp)
  1164 done
  1165 
  1166 lemma (in M_basic) composition_abs [simp]:
  1167      "[| M(r); M(s); M(t) |] ==> composition(M,r,s,t) <-> t = r O s"
  1168 apply safe
  1169  txt{*Proving @{term "composition(M, r, s, r O s)"}*}
  1170  prefer 2
  1171  apply (simp add: composition_def comp_def)
  1172  apply (blast dest: transM)
  1173 txt{*Opposite implication*}
  1174 apply (rule M_equalityI)
  1175   apply (simp add: composition_def comp_def)
  1176   apply (blast del: allE dest: transM)+
  1177 done
  1178 
  1179 text{*no longer needed*}
  1180 lemma (in M_basic) restriction_is_function:
  1181      "[| restriction(M,f,A,z); function(f); M(f); M(A); M(z) |]
  1182       ==> function(z)"
  1183 apply (simp add: restriction_def ball_iff_equiv)
  1184 apply (unfold function_def, blast)
  1185 done
  1186 
  1187 lemma (in M_basic) restriction_abs [simp]:
  1188      "[| M(f); M(A); M(z) |]
  1189       ==> restriction(M,f,A,z) <-> z = restrict(f,A)"
  1190 apply (simp add: ball_iff_equiv restriction_def restrict_def)
  1191 apply (blast intro!: equalityI dest: transM)
  1192 done
  1193 
  1194 
  1195 lemma (in M_basic) M_restrict_iff:
  1196      "M(r) ==> restrict(r,A) = {z \<in> r . \<exists>x\<in>A. \<exists>y[M]. z = \<langle>x, y\<rangle>}"
  1197 by (simp add: restrict_def, blast dest: transM)
  1198 
  1199 lemma (in M_basic) restrict_closed [intro,simp]:
  1200      "[| M(A); M(r) |] ==> M(restrict(r,A))"
  1201 apply (simp add: M_restrict_iff)
  1202 apply (insert restrict_separation [of A], simp)
  1203 done
  1204 
  1205 lemma (in M_basic) Inter_abs [simp]:
  1206      "[| M(A); M(z) |] ==> big_inter(M,A,z) <-> z = Inter(A)"
  1207 apply (simp add: big_inter_def Inter_def)
  1208 apply (blast intro!: equalityI dest: transM)
  1209 done
  1210 
  1211 lemma (in M_basic) Inter_closed [intro,simp]:
  1212      "M(A) ==> M(Inter(A))"
  1213 by (insert Inter_separation, simp add: Inter_def)
  1214 
  1215 lemma (in M_basic) Int_closed [intro,simp]:
  1216      "[| M(A); M(B) |] ==> M(A Int B)"
  1217 apply (subgoal_tac "M({A,B})")
  1218 apply (frule Inter_closed, force+)
  1219 done
  1220 
  1221 lemma (in M_basic) Diff_closed [intro,simp]:
  1222      "[|M(A); M(B)|] ==> M(A-B)"
  1223 by (insert Diff_separation, simp add: Diff_def)
  1224 
  1225 subsubsection{*Some Facts About Separation Axioms*}
  1226 
  1227 lemma (in M_basic) separation_conj:
  1228      "[|separation(M,P); separation(M,Q)|] ==> separation(M, \<lambda>z. P(z) & Q(z))"
  1229 by (simp del: separation_closed
  1230          add: separation_iff Collect_Int_Collect_eq [symmetric])
  1231 
  1232 (*???equalities*)
  1233 lemma Collect_Un_Collect_eq:
  1234      "Collect(A,P) Un Collect(A,Q) = Collect(A, %x. P(x) | Q(x))"
  1235 by blast
  1236 
  1237 lemma Diff_Collect_eq:
  1238      "A - Collect(A,P) = Collect(A, %x. ~ P(x))"
  1239 by blast
  1240 
  1241 lemma (in M_trivial) Collect_rall_eq:
  1242      "M(Y) ==> Collect(A, %x. \<forall>y[M]. y\<in>Y --> P(x,y)) =
  1243                (if Y=0 then A else (\<Inter>y \<in> Y. {x \<in> A. P(x,y)}))"
  1244 apply simp
  1245 apply (blast intro!: equalityI dest: transM)
  1246 done
  1247 
  1248 lemma (in M_basic) separation_disj:
  1249      "[|separation(M,P); separation(M,Q)|] ==> separation(M, \<lambda>z. P(z) | Q(z))"
  1250 by (simp del: separation_closed
  1251          add: separation_iff Collect_Un_Collect_eq [symmetric])
  1252 
  1253 lemma (in M_basic) separation_neg:
  1254      "separation(M,P) ==> separation(M, \<lambda>z. ~P(z))"
  1255 by (simp del: separation_closed
  1256          add: separation_iff Diff_Collect_eq [symmetric])
  1257 
  1258 lemma (in M_basic) separation_imp:
  1259      "[|separation(M,P); separation(M,Q)|]
  1260       ==> separation(M, \<lambda>z. P(z) --> Q(z))"
  1261 by (simp add: separation_neg separation_disj not_disj_iff_imp [symmetric])
  1262 
  1263 text{*This result is a hint of how little can be done without the Reflection
  1264   Theorem.  The quantifier has to be bounded by a set.  We also need another
  1265   instance of Separation!*}
  1266 lemma (in M_basic) separation_rall:
  1267      "[|M(Y); \<forall>y[M]. separation(M, \<lambda>x. P(x,y));
  1268         \<forall>z[M]. strong_replacement(M, \<lambda>x y. y = {u \<in> z . P(u,x)})|]
  1269       ==> separation(M, \<lambda>x. \<forall>y[M]. y\<in>Y --> P(x,y))"
  1270 apply (simp del: separation_closed rall_abs
  1271          add: separation_iff Collect_rall_eq)
  1272 apply (blast intro!: Inter_closed RepFun_closed dest: transM)
  1273 done
  1274 
  1275 
  1276 subsubsection{*Functions and function space*}
  1277 
  1278 text{*The assumption @{term "M(A->B)"} is unusual, but essential: in
  1279 all but trivial cases, A->B cannot be expected to belong to @{term M}.*}
  1280 lemma (in M_basic) is_funspace_abs [simp]:
  1281      "[|M(A); M(B); M(F); M(A->B)|] ==> is_funspace(M,A,B,F) <-> F = A->B";
  1282 apply (simp add: is_funspace_def)
  1283 apply (rule iffI)
  1284  prefer 2 apply blast
  1285 apply (rule M_equalityI)
  1286   apply simp_all
  1287 done
  1288 
  1289 lemma (in M_basic) succ_fun_eq2:
  1290      "[|M(B); M(n->B)|] ==>
  1291       succ(n) -> B =
  1292       \<Union>{z. p \<in> (n->B)*B, \<exists>f[M]. \<exists>b[M]. p = <f,b> & z = {cons(<n,b>, f)}}"
  1293 apply (simp add: succ_fun_eq)
  1294 apply (blast dest: transM)
  1295 done
  1296 
  1297 lemma (in M_basic) funspace_succ:
  1298      "[|M(n); M(B); M(n->B) |] ==> M(succ(n) -> B)"
  1299 apply (insert funspace_succ_replacement [of n], simp)
  1300 apply (force simp add: succ_fun_eq2 univalent_def)
  1301 done
  1302 
  1303 text{*@{term M} contains all finite function spaces.  Needed to prove the
  1304 absoluteness of transitive closure.  See the definition of
  1305 @{text rtrancl_alt} in in @{text WF_absolute.thy}.*}
  1306 lemma (in M_basic) finite_funspace_closed [intro,simp]:
  1307      "[|n\<in>nat; M(B)|] ==> M(n->B)"
  1308 apply (induct_tac n, simp)
  1309 apply (simp add: funspace_succ nat_into_M)
  1310 done
  1311 
  1312 
  1313 subsection{*Relativization and Absoluteness for Boolean Operators*}
  1314 
  1315 constdefs
  1316   is_bool_of_o :: "[i=>o, o, i] => o"
  1317    "is_bool_of_o(M,P,z) == (P & number1(M,z)) | (~P & empty(M,z))"
  1318 
  1319   is_not :: "[i=>o, i, i] => o"
  1320    "is_not(M,a,z) == (number1(M,a)  & empty(M,z)) |
  1321                      (~number1(M,a) & number1(M,z))"
  1322 
  1323   is_and :: "[i=>o, i, i, i] => o"
  1324    "is_and(M,a,b,z) == (number1(M,a)  & z=b) |
  1325                        (~number1(M,a) & empty(M,z))"
  1326 
  1327   is_or :: "[i=>o, i, i, i] => o"
  1328    "is_or(M,a,b,z) == (number1(M,a)  & number1(M,z)) |
  1329                       (~number1(M,a) & z=b)"
  1330 
  1331 lemma (in M_trivial) bool_of_o_abs [simp]:
  1332      "M(z) ==> is_bool_of_o(M,P,z) <-> z = bool_of_o(P)"
  1333 by (simp add: is_bool_of_o_def bool_of_o_def)
  1334 
  1335 
  1336 lemma (in M_trivial) not_abs [simp]:
  1337      "[| M(a); M(z)|] ==> is_not(M,a,z) <-> z = not(a)"
  1338 by (simp add: Bool.not_def cond_def is_not_def)
  1339 
  1340 lemma (in M_trivial) and_abs [simp]:
  1341      "[| M(a); M(b); M(z)|] ==> is_and(M,a,b,z) <-> z = a and b"
  1342 by (simp add: Bool.and_def cond_def is_and_def)
  1343 
  1344 lemma (in M_trivial) or_abs [simp]:
  1345      "[| M(a); M(b); M(z)|] ==> is_or(M,a,b,z) <-> z = a or b"
  1346 by (simp add: Bool.or_def cond_def is_or_def)
  1347 
  1348 
  1349 lemma (in M_trivial) bool_of_o_closed [intro,simp]:
  1350      "M(bool_of_o(P))"
  1351 by (simp add: bool_of_o_def)
  1352 
  1353 lemma (in M_trivial) and_closed [intro,simp]:
  1354      "[| M(p); M(q) |] ==> M(p and q)"
  1355 by (simp add: and_def cond_def)
  1356 
  1357 lemma (in M_trivial) or_closed [intro,simp]:
  1358      "[| M(p); M(q) |] ==> M(p or q)"
  1359 by (simp add: or_def cond_def)
  1360 
  1361 lemma (in M_trivial) not_closed [intro,simp]:
  1362      "M(p) ==> M(not(p))"
  1363 by (simp add: Bool.not_def cond_def)
  1364 
  1365 
  1366 subsection{*Relativization and Absoluteness for List Operators*}
  1367 
  1368 constdefs
  1369 
  1370   is_Nil :: "[i=>o, i] => o"
  1371      --{* because @{term "[] \<equiv> Inl(0)"}*}
  1372     "is_Nil(M,xs) == \<exists>zero[M]. empty(M,zero) & is_Inl(M,zero,xs)"
  1373 
  1374   is_Cons :: "[i=>o,i,i,i] => o"
  1375      --{* because @{term "Cons(a, l) \<equiv> Inr(\<langle>a,l\<rangle>)"}*}
  1376     "is_Cons(M,a,l,Z) == \<exists>p[M]. pair(M,a,l,p) & is_Inr(M,p,Z)"
  1377 
  1378 
  1379 lemma (in M_trivial) Nil_in_M [intro,simp]: "M(Nil)"
  1380 by (simp add: Nil_def)
  1381 
  1382 lemma (in M_trivial) Nil_abs [simp]: "M(Z) ==> is_Nil(M,Z) <-> (Z = Nil)"
  1383 by (simp add: is_Nil_def Nil_def)
  1384 
  1385 lemma (in M_trivial) Cons_in_M_iff [iff]: "M(Cons(a,l)) <-> M(a) & M(l)"
  1386 by (simp add: Cons_def)
  1387 
  1388 lemma (in M_trivial) Cons_abs [simp]:
  1389      "[|M(a); M(l); M(Z)|] ==> is_Cons(M,a,l,Z) <-> (Z = Cons(a,l))"
  1390 by (simp add: is_Cons_def Cons_def)
  1391 
  1392 
  1393 constdefs
  1394 
  1395   quasilist :: "i => o"
  1396     "quasilist(xs) == xs=Nil | (\<exists>x l. xs = Cons(x,l))"
  1397 
  1398   is_quasilist :: "[i=>o,i] => o"
  1399     "is_quasilist(M,z) == is_Nil(M,z) | (\<exists>x[M]. \<exists>l[M]. is_Cons(M,x,l,z))"
  1400 
  1401   list_case' :: "[i, [i,i]=>i, i] => i"
  1402     --{*A version of @{term list_case} that's always defined.*}
  1403     "list_case'(a,b,xs) ==
  1404        if quasilist(xs) then list_case(a,b,xs) else 0"
  1405 
  1406   is_list_case :: "[i=>o, i, [i,i,i]=>o, i, i] => o"
  1407     --{*Returns 0 for non-lists*}
  1408     "is_list_case(M, a, is_b, xs, z) ==
  1409        (is_Nil(M,xs) --> z=a) &
  1410        (\<forall>x[M]. \<forall>l[M]. is_Cons(M,x,l,xs) --> is_b(x,l,z)) &
  1411        (is_quasilist(M,xs) | empty(M,z))"
  1412 
  1413   hd' :: "i => i"
  1414     --{*A version of @{term hd} that's always defined.*}
  1415     "hd'(xs) == if quasilist(xs) then hd(xs) else 0"
  1416 
  1417   tl' :: "i => i"
  1418     --{*A version of @{term tl} that's always defined.*}
  1419     "tl'(xs) == if quasilist(xs) then tl(xs) else 0"
  1420 
  1421   is_hd :: "[i=>o,i,i] => o"
  1422      --{* @{term "hd([]) = 0"} no constraints if not a list.
  1423           Avoiding implication prevents the simplifier's looping.*}
  1424     "is_hd(M,xs,H) ==
  1425        (is_Nil(M,xs) --> empty(M,H)) &
  1426        (\<forall>x[M]. \<forall>l[M]. ~ is_Cons(M,x,l,xs) | H=x) &
  1427        (is_quasilist(M,xs) | empty(M,H))"
  1428 
  1429   is_tl :: "[i=>o,i,i] => o"
  1430      --{* @{term "tl([]) = []"}; see comments about @{term is_hd}*}
  1431     "is_tl(M,xs,T) ==
  1432        (is_Nil(M,xs) --> T=xs) &
  1433        (\<forall>x[M]. \<forall>l[M]. ~ is_Cons(M,x,l,xs) | T=l) &
  1434        (is_quasilist(M,xs) | empty(M,T))"
  1435 
  1436 subsubsection{*@{term quasilist}: For Case-Splitting with @{term list_case'}*}
  1437 
  1438 lemma [iff]: "quasilist(Nil)"
  1439 by (simp add: quasilist_def)
  1440 
  1441 lemma [iff]: "quasilist(Cons(x,l))"
  1442 by (simp add: quasilist_def)
  1443 
  1444 lemma list_imp_quasilist: "l \<in> list(A) ==> quasilist(l)"
  1445 by (erule list.cases, simp_all)
  1446 
  1447 subsubsection{*@{term list_case'}, the Modified Version of @{term list_case}*}
  1448 
  1449 lemma list_case'_Nil [simp]: "list_case'(a,b,Nil) = a"
  1450 by (simp add: list_case'_def quasilist_def)
  1451 
  1452 lemma list_case'_Cons [simp]: "list_case'(a,b,Cons(x,l)) = b(x,l)"
  1453 by (simp add: list_case'_def quasilist_def)
  1454 
  1455 lemma non_list_case: "~ quasilist(x) ==> list_case'(a,b,x) = 0"
  1456 by (simp add: quasilist_def list_case'_def)
  1457 
  1458 lemma list_case'_eq_list_case [simp]:
  1459      "xs \<in> list(A) ==>list_case'(a,b,xs) = list_case(a,b,xs)"
  1460 by (erule list.cases, simp_all)
  1461 
  1462 lemma (in M_basic) list_case'_closed [intro,simp]:
  1463   "[|M(k); M(a); \<forall>x[M]. \<forall>y[M]. M(b(x,y))|] ==> M(list_case'(a,b,k))"
  1464 apply (case_tac "quasilist(k)")
  1465  apply (simp add: quasilist_def, force)
  1466 apply (simp add: non_list_case)
  1467 done
  1468 
  1469 lemma (in M_trivial) quasilist_abs [simp]:
  1470      "M(z) ==> is_quasilist(M,z) <-> quasilist(z)"
  1471 by (auto simp add: is_quasilist_def quasilist_def)
  1472 
  1473 lemma (in M_trivial) list_case_abs [simp]:
  1474      "[| relation2(M,is_b,b); M(k); M(z) |]
  1475       ==> is_list_case(M,a,is_b,k,z) <-> z = list_case'(a,b,k)"
  1476 apply (case_tac "quasilist(k)")
  1477  prefer 2
  1478  apply (simp add: is_list_case_def non_list_case)
  1479  apply (force simp add: quasilist_def)
  1480 apply (simp add: quasilist_def is_list_case_def)
  1481 apply (elim disjE exE)
  1482  apply (simp_all add: relation2_def)
  1483 done
  1484 
  1485 
  1486 subsubsection{*The Modified Operators @{term hd'} and @{term tl'}*}
  1487 
  1488 lemma (in M_trivial) is_hd_Nil: "is_hd(M,[],Z) <-> empty(M,Z)"
  1489 by (simp add: is_hd_def)
  1490 
  1491 lemma (in M_trivial) is_hd_Cons:
  1492      "[|M(a); M(l)|] ==> is_hd(M,Cons(a,l),Z) <-> Z = a"
  1493 by (force simp add: is_hd_def)
  1494 
  1495 lemma (in M_trivial) hd_abs [simp]:
  1496      "[|M(x); M(y)|] ==> is_hd(M,x,y) <-> y = hd'(x)"
  1497 apply (simp add: hd'_def)
  1498 apply (intro impI conjI)
  1499  prefer 2 apply (force simp add: is_hd_def)
  1500 apply (simp add: quasilist_def is_hd_def)
  1501 apply (elim disjE exE, auto)
  1502 done
  1503 
  1504 lemma (in M_trivial) is_tl_Nil: "is_tl(M,[],Z) <-> Z = []"
  1505 by (simp add: is_tl_def)
  1506 
  1507 lemma (in M_trivial) is_tl_Cons:
  1508      "[|M(a); M(l)|] ==> is_tl(M,Cons(a,l),Z) <-> Z = l"
  1509 by (force simp add: is_tl_def)
  1510 
  1511 lemma (in M_trivial) tl_abs [simp]:
  1512      "[|M(x); M(y)|] ==> is_tl(M,x,y) <-> y = tl'(x)"
  1513 apply (simp add: tl'_def)
  1514 apply (intro impI conjI)
  1515  prefer 2 apply (force simp add: is_tl_def)
  1516 apply (simp add: quasilist_def is_tl_def)
  1517 apply (elim disjE exE, auto)
  1518 done
  1519 
  1520 lemma (in M_trivial) relation1_tl: "relation1(M, is_tl(M), tl')"
  1521 by (simp add: relation1_def)
  1522 
  1523 lemma hd'_Nil: "hd'([]) = 0"
  1524 by (simp add: hd'_def)
  1525 
  1526 lemma hd'_Cons: "hd'(Cons(a,l)) = a"
  1527 by (simp add: hd'_def)
  1528 
  1529 lemma tl'_Nil: "tl'([]) = []"
  1530 by (simp add: tl'_def)
  1531 
  1532 lemma tl'_Cons: "tl'(Cons(a,l)) = l"
  1533 by (simp add: tl'_def)
  1534 
  1535 lemma iterates_tl_Nil: "n \<in> nat ==> tl'^n ([]) = []"
  1536 apply (induct_tac n)
  1537 apply (simp_all add: tl'_Nil)
  1538 done
  1539 
  1540 lemma (in M_basic) tl'_closed: "M(x) ==> M(tl'(x))"
  1541 apply (simp add: tl'_def)
  1542 apply (force simp add: quasilist_def)
  1543 done
  1544 
  1545 
  1546 end