src/ZF/Constructible/Relative.thy
author wenzelm
Sun Apr 09 20:44:35 2017 +0200 (2017-04-09)
changeset 65449 c82e63b11b8b
parent 61798 27f3c10b0b50
child 67443 3abf6a722518
permissions -rw-r--r--
clarified main ZF.thy / ZFC.thy, and avoid name clash with global HOL/Main.thy;
     1 (*  Title:      ZF/Constructible/Relative.thy
     2     Author:     Lawrence C Paulson, Cambridge University Computer Laboratory
     3 *)
     4 
     5 section \<open>Relativization and Absoluteness\<close>
     6 
     7 theory Relative imports ZF begin
     8 
     9 subsection\<open>Relativized versions of standard set-theoretic concepts\<close>
    10 
    11 definition
    12   empty :: "[i=>o,i] => o" where
    13     "empty(M,z) == \<forall>x[M]. x \<notin> z"
    14 
    15 definition
    16   subset :: "[i=>o,i,i] => o" where
    17     "subset(M,A,B) == \<forall>x[M]. x\<in>A \<longrightarrow> x \<in> B"
    18 
    19 definition
    20   upair :: "[i=>o,i,i,i] => o" where
    21     "upair(M,a,b,z) == a \<in> z & b \<in> z & (\<forall>x[M]. x\<in>z \<longrightarrow> x = a | x = b)"
    22 
    23 definition
    24   pair :: "[i=>o,i,i,i] => o" where
    25     "pair(M,a,b,z) == \<exists>x[M]. upair(M,a,a,x) &
    26                      (\<exists>y[M]. upair(M,a,b,y) & upair(M,x,y,z))"
    27 
    28 
    29 definition
    30   union :: "[i=>o,i,i,i] => o" where
    31     "union(M,a,b,z) == \<forall>x[M]. x \<in> z \<longleftrightarrow> x \<in> a | x \<in> b"
    32 
    33 definition
    34   is_cons :: "[i=>o,i,i,i] => o" where
    35     "is_cons(M,a,b,z) == \<exists>x[M]. upair(M,a,a,x) & union(M,x,b,z)"
    36 
    37 definition
    38   successor :: "[i=>o,i,i] => o" where
    39     "successor(M,a,z) == is_cons(M,a,a,z)"
    40 
    41 definition
    42   number1 :: "[i=>o,i] => o" where
    43     "number1(M,a) == \<exists>x[M]. empty(M,x) & successor(M,x,a)"
    44 
    45 definition
    46   number2 :: "[i=>o,i] => o" where
    47     "number2(M,a) == \<exists>x[M]. number1(M,x) & successor(M,x,a)"
    48 
    49 definition
    50   number3 :: "[i=>o,i] => o" where
    51     "number3(M,a) == \<exists>x[M]. number2(M,x) & successor(M,x,a)"
    52 
    53 definition
    54   powerset :: "[i=>o,i,i] => o" where
    55     "powerset(M,A,z) == \<forall>x[M]. x \<in> z \<longleftrightarrow> subset(M,x,A)"
    56 
    57 definition
    58   is_Collect :: "[i=>o,i,i=>o,i] => o" where
    59     "is_Collect(M,A,P,z) == \<forall>x[M]. x \<in> z \<longleftrightarrow> x \<in> A & P(x)"
    60 
    61 definition
    62   is_Replace :: "[i=>o,i,[i,i]=>o,i] => o" where
    63     "is_Replace(M,A,P,z) == \<forall>u[M]. u \<in> z \<longleftrightarrow> (\<exists>x[M]. x\<in>A & P(x,u))"
    64 
    65 definition
    66   inter :: "[i=>o,i,i,i] => o" where
    67     "inter(M,a,b,z) == \<forall>x[M]. x \<in> z \<longleftrightarrow> x \<in> a & x \<in> b"
    68 
    69 definition
    70   setdiff :: "[i=>o,i,i,i] => o" where
    71     "setdiff(M,a,b,z) == \<forall>x[M]. x \<in> z \<longleftrightarrow> x \<in> a & x \<notin> b"
    72 
    73 definition
    74   big_union :: "[i=>o,i,i] => o" where
    75     "big_union(M,A,z) == \<forall>x[M]. x \<in> z \<longleftrightarrow> (\<exists>y[M]. y\<in>A & x \<in> y)"
    76 
    77 definition
    78   big_inter :: "[i=>o,i,i] => o" where
    79     "big_inter(M,A,z) ==
    80              (A=0 \<longrightarrow> z=0) &
    81              (A\<noteq>0 \<longrightarrow> (\<forall>x[M]. x \<in> z \<longleftrightarrow> (\<forall>y[M]. y\<in>A \<longrightarrow> x \<in> y)))"
    82 
    83 definition
    84   cartprod :: "[i=>o,i,i,i] => o" where
    85     "cartprod(M,A,B,z) ==
    86         \<forall>u[M]. u \<in> z \<longleftrightarrow> (\<exists>x[M]. x\<in>A & (\<exists>y[M]. y\<in>B & pair(M,x,y,u)))"
    87 
    88 definition
    89   is_sum :: "[i=>o,i,i,i] => o" where
    90     "is_sum(M,A,B,Z) ==
    91        \<exists>A0[M]. \<exists>n1[M]. \<exists>s1[M]. \<exists>B1[M].
    92        number1(M,n1) & cartprod(M,n1,A,A0) & upair(M,n1,n1,s1) &
    93        cartprod(M,s1,B,B1) & union(M,A0,B1,Z)"
    94 
    95 definition
    96   is_Inl :: "[i=>o,i,i] => o" where
    97     "is_Inl(M,a,z) == \<exists>zero[M]. empty(M,zero) & pair(M,zero,a,z)"
    98 
    99 definition
   100   is_Inr :: "[i=>o,i,i] => o" where
   101     "is_Inr(M,a,z) == \<exists>n1[M]. number1(M,n1) & pair(M,n1,a,z)"
   102 
   103 definition
   104   is_converse :: "[i=>o,i,i] => o" where
   105     "is_converse(M,r,z) ==
   106         \<forall>x[M]. x \<in> z \<longleftrightarrow>
   107              (\<exists>w[M]. w\<in>r & (\<exists>u[M]. \<exists>v[M]. pair(M,u,v,w) & pair(M,v,u,x)))"
   108 
   109 definition
   110   pre_image :: "[i=>o,i,i,i] => o" where
   111     "pre_image(M,r,A,z) ==
   112         \<forall>x[M]. x \<in> z \<longleftrightarrow> (\<exists>w[M]. w\<in>r & (\<exists>y[M]. y\<in>A & pair(M,x,y,w)))"
   113 
   114 definition
   115   is_domain :: "[i=>o,i,i] => o" where
   116     "is_domain(M,r,z) ==
   117         \<forall>x[M]. x \<in> z \<longleftrightarrow> (\<exists>w[M]. w\<in>r & (\<exists>y[M]. pair(M,x,y,w)))"
   118 
   119 definition
   120   image :: "[i=>o,i,i,i] => o" where
   121     "image(M,r,A,z) ==
   122         \<forall>y[M]. y \<in> z \<longleftrightarrow> (\<exists>w[M]. w\<in>r & (\<exists>x[M]. x\<in>A & pair(M,x,y,w)))"
   123 
   124 definition
   125   is_range :: "[i=>o,i,i] => o" where
   126     \<comment>\<open>the cleaner
   127       @{term "\<exists>r'[M]. is_converse(M,r,r') & is_domain(M,r',z)"}
   128       unfortunately needs an instance of separation in order to prove
   129         @{term "M(converse(r))"}.\<close>
   130     "is_range(M,r,z) ==
   131         \<forall>y[M]. y \<in> z \<longleftrightarrow> (\<exists>w[M]. w\<in>r & (\<exists>x[M]. pair(M,x,y,w)))"
   132 
   133 definition
   134   is_field :: "[i=>o,i,i] => o" where
   135     "is_field(M,r,z) ==
   136         \<exists>dr[M]. \<exists>rr[M]. is_domain(M,r,dr) & is_range(M,r,rr) &
   137                         union(M,dr,rr,z)"
   138 
   139 definition
   140   is_relation :: "[i=>o,i] => o" where
   141     "is_relation(M,r) ==
   142         (\<forall>z[M]. z\<in>r \<longrightarrow> (\<exists>x[M]. \<exists>y[M]. pair(M,x,y,z)))"
   143 
   144 definition
   145   is_function :: "[i=>o,i] => o" where
   146     "is_function(M,r) ==
   147         \<forall>x[M]. \<forall>y[M]. \<forall>y'[M]. \<forall>p[M]. \<forall>p'[M].
   148            pair(M,x,y,p) \<longrightarrow> pair(M,x,y',p') \<longrightarrow> p\<in>r \<longrightarrow> p'\<in>r \<longrightarrow> y=y'"
   149 
   150 definition
   151   fun_apply :: "[i=>o,i,i,i] => o" where
   152     "fun_apply(M,f,x,y) ==
   153         (\<exists>xs[M]. \<exists>fxs[M].
   154          upair(M,x,x,xs) & image(M,f,xs,fxs) & big_union(M,fxs,y))"
   155 
   156 definition
   157   typed_function :: "[i=>o,i,i,i] => o" where
   158     "typed_function(M,A,B,r) ==
   159         is_function(M,r) & is_relation(M,r) & is_domain(M,r,A) &
   160         (\<forall>u[M]. u\<in>r \<longrightarrow> (\<forall>x[M]. \<forall>y[M]. pair(M,x,y,u) \<longrightarrow> y\<in>B))"
   161 
   162 definition
   163   is_funspace :: "[i=>o,i,i,i] => o" where
   164     "is_funspace(M,A,B,F) ==
   165         \<forall>f[M]. f \<in> F \<longleftrightarrow> typed_function(M,A,B,f)"
   166 
   167 definition
   168   composition :: "[i=>o,i,i,i] => o" where
   169     "composition(M,r,s,t) ==
   170         \<forall>p[M]. p \<in> t \<longleftrightarrow>
   171                (\<exists>x[M]. \<exists>y[M]. \<exists>z[M]. \<exists>xy[M]. \<exists>yz[M].
   172                 pair(M,x,z,p) & pair(M,x,y,xy) & pair(M,y,z,yz) &
   173                 xy \<in> s & yz \<in> r)"
   174 
   175 definition
   176   injection :: "[i=>o,i,i,i] => o" where
   177     "injection(M,A,B,f) ==
   178         typed_function(M,A,B,f) &
   179         (\<forall>x[M]. \<forall>x'[M]. \<forall>y[M]. \<forall>p[M]. \<forall>p'[M].
   180           pair(M,x,y,p) \<longrightarrow> pair(M,x',y,p') \<longrightarrow> p\<in>f \<longrightarrow> p'\<in>f \<longrightarrow> x=x')"
   181 
   182 definition
   183   surjection :: "[i=>o,i,i,i] => o" where
   184     "surjection(M,A,B,f) ==
   185         typed_function(M,A,B,f) &
   186         (\<forall>y[M]. y\<in>B \<longrightarrow> (\<exists>x[M]. x\<in>A & fun_apply(M,f,x,y)))"
   187 
   188 definition
   189   bijection :: "[i=>o,i,i,i] => o" where
   190     "bijection(M,A,B,f) == injection(M,A,B,f) & surjection(M,A,B,f)"
   191 
   192 definition
   193   restriction :: "[i=>o,i,i,i] => o" where
   194     "restriction(M,r,A,z) ==
   195         \<forall>x[M]. x \<in> z \<longleftrightarrow> (x \<in> r & (\<exists>u[M]. u\<in>A & (\<exists>v[M]. pair(M,u,v,x))))"
   196 
   197 definition
   198   transitive_set :: "[i=>o,i] => o" where
   199     "transitive_set(M,a) == \<forall>x[M]. x\<in>a \<longrightarrow> subset(M,x,a)"
   200 
   201 definition
   202   ordinal :: "[i=>o,i] => o" where
   203      \<comment>\<open>an ordinal is a transitive set of transitive sets\<close>
   204     "ordinal(M,a) == transitive_set(M,a) & (\<forall>x[M]. x\<in>a \<longrightarrow> transitive_set(M,x))"
   205 
   206 definition
   207   limit_ordinal :: "[i=>o,i] => o" where
   208     \<comment>\<open>a limit ordinal is a non-empty, successor-closed ordinal\<close>
   209     "limit_ordinal(M,a) ==
   210         ordinal(M,a) & ~ empty(M,a) &
   211         (\<forall>x[M]. x\<in>a \<longrightarrow> (\<exists>y[M]. y\<in>a & successor(M,x,y)))"
   212 
   213 definition
   214   successor_ordinal :: "[i=>o,i] => o" where
   215     \<comment>\<open>a successor ordinal is any ordinal that is neither empty nor limit\<close>
   216     "successor_ordinal(M,a) ==
   217         ordinal(M,a) & ~ empty(M,a) & ~ limit_ordinal(M,a)"
   218 
   219 definition
   220   finite_ordinal :: "[i=>o,i] => o" where
   221     \<comment>\<open>an ordinal is finite if neither it nor any of its elements are limit\<close>
   222     "finite_ordinal(M,a) ==
   223         ordinal(M,a) & ~ limit_ordinal(M,a) &
   224         (\<forall>x[M]. x\<in>a \<longrightarrow> ~ limit_ordinal(M,x))"
   225 
   226 definition
   227   omega :: "[i=>o,i] => o" where
   228     \<comment>\<open>omega is a limit ordinal none of whose elements are limit\<close>
   229     "omega(M,a) == limit_ordinal(M,a) & (\<forall>x[M]. x\<in>a \<longrightarrow> ~ limit_ordinal(M,x))"
   230 
   231 definition
   232   is_quasinat :: "[i=>o,i] => o" where
   233     "is_quasinat(M,z) == empty(M,z) | (\<exists>m[M]. successor(M,m,z))"
   234 
   235 definition
   236   is_nat_case :: "[i=>o, i, [i,i]=>o, i, i] => o" where
   237     "is_nat_case(M, a, is_b, k, z) ==
   238        (empty(M,k) \<longrightarrow> z=a) &
   239        (\<forall>m[M]. successor(M,m,k) \<longrightarrow> is_b(m,z)) &
   240        (is_quasinat(M,k) | empty(M,z))"
   241 
   242 definition
   243   relation1 :: "[i=>o, [i,i]=>o, i=>i] => o" where
   244     "relation1(M,is_f,f) == \<forall>x[M]. \<forall>y[M]. is_f(x,y) \<longleftrightarrow> y = f(x)"
   245 
   246 definition
   247   Relation1 :: "[i=>o, i, [i,i]=>o, i=>i] => o" where
   248     \<comment>\<open>as above, but typed\<close>
   249     "Relation1(M,A,is_f,f) ==
   250         \<forall>x[M]. \<forall>y[M]. x\<in>A \<longrightarrow> is_f(x,y) \<longleftrightarrow> y = f(x)"
   251 
   252 definition
   253   relation2 :: "[i=>o, [i,i,i]=>o, [i,i]=>i] => o" where
   254     "relation2(M,is_f,f) == \<forall>x[M]. \<forall>y[M]. \<forall>z[M]. is_f(x,y,z) \<longleftrightarrow> z = f(x,y)"
   255 
   256 definition
   257   Relation2 :: "[i=>o, i, i, [i,i,i]=>o, [i,i]=>i] => o" where
   258     "Relation2(M,A,B,is_f,f) ==
   259         \<forall>x[M]. \<forall>y[M]. \<forall>z[M]. x\<in>A \<longrightarrow> y\<in>B \<longrightarrow> is_f(x,y,z) \<longleftrightarrow> z = f(x,y)"
   260 
   261 definition
   262   relation3 :: "[i=>o, [i,i,i,i]=>o, [i,i,i]=>i] => o" where
   263     "relation3(M,is_f,f) ==
   264        \<forall>x[M]. \<forall>y[M]. \<forall>z[M]. \<forall>u[M]. is_f(x,y,z,u) \<longleftrightarrow> u = f(x,y,z)"
   265 
   266 definition
   267   Relation3 :: "[i=>o, i, i, i, [i,i,i,i]=>o, [i,i,i]=>i] => o" where
   268     "Relation3(M,A,B,C,is_f,f) ==
   269        \<forall>x[M]. \<forall>y[M]. \<forall>z[M]. \<forall>u[M].
   270          x\<in>A \<longrightarrow> y\<in>B \<longrightarrow> z\<in>C \<longrightarrow> is_f(x,y,z,u) \<longleftrightarrow> u = f(x,y,z)"
   271 
   272 definition
   273   relation4 :: "[i=>o, [i,i,i,i,i]=>o, [i,i,i,i]=>i] => o" where
   274     "relation4(M,is_f,f) ==
   275        \<forall>u[M]. \<forall>x[M]. \<forall>y[M]. \<forall>z[M]. \<forall>a[M]. is_f(u,x,y,z,a) \<longleftrightarrow> a = f(u,x,y,z)"
   276 
   277 
   278 text\<open>Useful when absoluteness reasoning has replaced the predicates by terms\<close>
   279 lemma triv_Relation1:
   280      "Relation1(M, A, \<lambda>x y. y = f(x), f)"
   281 by (simp add: Relation1_def)
   282 
   283 lemma triv_Relation2:
   284      "Relation2(M, A, B, \<lambda>x y a. a = f(x,y), f)"
   285 by (simp add: Relation2_def)
   286 
   287 
   288 subsection \<open>The relativized ZF axioms\<close>
   289 
   290 definition
   291   extensionality :: "(i=>o) => o" where
   292     "extensionality(M) ==
   293         \<forall>x[M]. \<forall>y[M]. (\<forall>z[M]. z \<in> x \<longleftrightarrow> z \<in> y) \<longrightarrow> x=y"
   294 
   295 definition
   296   separation :: "[i=>o, i=>o] => o" where
   297     \<comment>\<open>The formula \<open>P\<close> should only involve parameters
   298         belonging to \<open>M\<close> and all its quantifiers must be relativized
   299         to \<open>M\<close>.  We do not have separation as a scheme; every instance
   300         that we need must be assumed (and later proved) separately.\<close>
   301     "separation(M,P) ==
   302         \<forall>z[M]. \<exists>y[M]. \<forall>x[M]. x \<in> y \<longleftrightarrow> x \<in> z & P(x)"
   303 
   304 definition
   305   upair_ax :: "(i=>o) => o" where
   306     "upair_ax(M) == \<forall>x[M]. \<forall>y[M]. \<exists>z[M]. upair(M,x,y,z)"
   307 
   308 definition
   309   Union_ax :: "(i=>o) => o" where
   310     "Union_ax(M) == \<forall>x[M]. \<exists>z[M]. big_union(M,x,z)"
   311 
   312 definition
   313   power_ax :: "(i=>o) => o" where
   314     "power_ax(M) == \<forall>x[M]. \<exists>z[M]. powerset(M,x,z)"
   315 
   316 definition
   317   univalent :: "[i=>o, i, [i,i]=>o] => o" where
   318     "univalent(M,A,P) ==
   319         \<forall>x[M]. x\<in>A \<longrightarrow> (\<forall>y[M]. \<forall>z[M]. P(x,y) & P(x,z) \<longrightarrow> y=z)"
   320 
   321 definition
   322   replacement :: "[i=>o, [i,i]=>o] => o" where
   323     "replacement(M,P) ==
   324       \<forall>A[M]. univalent(M,A,P) \<longrightarrow>
   325       (\<exists>Y[M]. \<forall>b[M]. (\<exists>x[M]. x\<in>A & P(x,b)) \<longrightarrow> b \<in> Y)"
   326 
   327 definition
   328   strong_replacement :: "[i=>o, [i,i]=>o] => o" where
   329     "strong_replacement(M,P) ==
   330       \<forall>A[M]. univalent(M,A,P) \<longrightarrow>
   331       (\<exists>Y[M]. \<forall>b[M]. b \<in> Y \<longleftrightarrow> (\<exists>x[M]. x\<in>A & P(x,b)))"
   332 
   333 definition
   334   foundation_ax :: "(i=>o) => o" where
   335     "foundation_ax(M) ==
   336         \<forall>x[M]. (\<exists>y[M]. y\<in>x) \<longrightarrow> (\<exists>y[M]. y\<in>x & ~(\<exists>z[M]. z\<in>x & z \<in> y))"
   337 
   338 
   339 subsection\<open>A trivial consistency proof for $V_\omega$\<close>
   340 
   341 text\<open>We prove that $V_\omega$
   342       (or \<open>univ\<close> in Isabelle) satisfies some ZF axioms.
   343      Kunen, Theorem IV 3.13, page 123.\<close>
   344 
   345 lemma univ0_downwards_mem: "[| y \<in> x; x \<in> univ(0) |] ==> y \<in> univ(0)"
   346 apply (insert Transset_univ [OF Transset_0])
   347 apply (simp add: Transset_def, blast)
   348 done
   349 
   350 lemma univ0_Ball_abs [simp]:
   351      "A \<in> univ(0) ==> (\<forall>x\<in>A. x \<in> univ(0) \<longrightarrow> P(x)) \<longleftrightarrow> (\<forall>x\<in>A. P(x))"
   352 by (blast intro: univ0_downwards_mem)
   353 
   354 lemma univ0_Bex_abs [simp]:
   355      "A \<in> univ(0) ==> (\<exists>x\<in>A. x \<in> univ(0) & P(x)) \<longleftrightarrow> (\<exists>x\<in>A. P(x))"
   356 by (blast intro: univ0_downwards_mem)
   357 
   358 text\<open>Congruence rule for separation: can assume the variable is in \<open>M\<close>\<close>
   359 lemma separation_cong [cong]:
   360      "(!!x. M(x) ==> P(x) \<longleftrightarrow> P'(x))
   361       ==> separation(M, %x. P(x)) \<longleftrightarrow> separation(M, %x. P'(x))"
   362 by (simp add: separation_def)
   363 
   364 lemma univalent_cong [cong]:
   365      "[| A=A'; !!x y. [| x\<in>A; M(x); M(y) |] ==> P(x,y) \<longleftrightarrow> P'(x,y) |]
   366       ==> univalent(M, A, %x y. P(x,y)) \<longleftrightarrow> univalent(M, A', %x y. P'(x,y))"
   367 by (simp add: univalent_def)
   368 
   369 lemma univalent_triv [intro,simp]:
   370      "univalent(M, A, \<lambda>x y. y = f(x))"
   371 by (simp add: univalent_def)
   372 
   373 lemma univalent_conjI2 [intro,simp]:
   374      "univalent(M,A,Q) ==> univalent(M, A, \<lambda>x y. P(x,y) & Q(x,y))"
   375 by (simp add: univalent_def, blast)
   376 
   377 text\<open>Congruence rule for replacement\<close>
   378 lemma strong_replacement_cong [cong]:
   379      "[| !!x y. [| M(x); M(y) |] ==> P(x,y) \<longleftrightarrow> P'(x,y) |]
   380       ==> strong_replacement(M, %x y. P(x,y)) \<longleftrightarrow>
   381           strong_replacement(M, %x y. P'(x,y))"
   382 by (simp add: strong_replacement_def)
   383 
   384 text\<open>The extensionality axiom\<close>
   385 lemma "extensionality(\<lambda>x. x \<in> univ(0))"
   386 apply (simp add: extensionality_def)
   387 apply (blast intro: univ0_downwards_mem)
   388 done
   389 
   390 text\<open>The separation axiom requires some lemmas\<close>
   391 lemma Collect_in_Vfrom:
   392      "[| X \<in> Vfrom(A,j);  Transset(A) |] ==> Collect(X,P) \<in> Vfrom(A, succ(j))"
   393 apply (drule Transset_Vfrom)
   394 apply (rule subset_mem_Vfrom)
   395 apply (unfold Transset_def, blast)
   396 done
   397 
   398 lemma Collect_in_VLimit:
   399      "[| X \<in> Vfrom(A,i);  Limit(i);  Transset(A) |]
   400       ==> Collect(X,P) \<in> Vfrom(A,i)"
   401 apply (rule Limit_VfromE, assumption+)
   402 apply (blast intro: Limit_has_succ VfromI Collect_in_Vfrom)
   403 done
   404 
   405 lemma Collect_in_univ:
   406      "[| X \<in> univ(A);  Transset(A) |] ==> Collect(X,P) \<in> univ(A)"
   407 by (simp add: univ_def Collect_in_VLimit Limit_nat)
   408 
   409 lemma "separation(\<lambda>x. x \<in> univ(0), P)"
   410 apply (simp add: separation_def, clarify)
   411 apply (rule_tac x = "Collect(z,P)" in bexI)
   412 apply (blast intro: Collect_in_univ Transset_0)+
   413 done
   414 
   415 text\<open>Unordered pairing axiom\<close>
   416 lemma "upair_ax(\<lambda>x. x \<in> univ(0))"
   417 apply (simp add: upair_ax_def upair_def)
   418 apply (blast intro: doubleton_in_univ)
   419 done
   420 
   421 text\<open>Union axiom\<close>
   422 lemma "Union_ax(\<lambda>x. x \<in> univ(0))"
   423 apply (simp add: Union_ax_def big_union_def, clarify)
   424 apply (rule_tac x="\<Union>x" in bexI)
   425  apply (blast intro: univ0_downwards_mem)
   426 apply (blast intro: Union_in_univ Transset_0)
   427 done
   428 
   429 text\<open>Powerset axiom\<close>
   430 
   431 lemma Pow_in_univ:
   432      "[| X \<in> univ(A);  Transset(A) |] ==> Pow(X) \<in> univ(A)"
   433 apply (simp add: univ_def Pow_in_VLimit Limit_nat)
   434 done
   435 
   436 lemma "power_ax(\<lambda>x. x \<in> univ(0))"
   437 apply (simp add: power_ax_def powerset_def subset_def, clarify)
   438 apply (rule_tac x="Pow(x)" in bexI)
   439  apply (blast intro: univ0_downwards_mem)
   440 apply (blast intro: Pow_in_univ Transset_0)
   441 done
   442 
   443 text\<open>Foundation axiom\<close>
   444 lemma "foundation_ax(\<lambda>x. x \<in> univ(0))"
   445 apply (simp add: foundation_ax_def, clarify)
   446 apply (cut_tac A=x in foundation)
   447 apply (blast intro: univ0_downwards_mem)
   448 done
   449 
   450 lemma "replacement(\<lambda>x. x \<in> univ(0), P)"
   451 apply (simp add: replacement_def, clarify)
   452 oops
   453 text\<open>no idea: maybe prove by induction on the rank of A?\<close>
   454 
   455 text\<open>Still missing: Replacement, Choice\<close>
   456 
   457 subsection\<open>Lemmas Needed to Reduce Some Set Constructions to Instances
   458       of Separation\<close>
   459 
   460 lemma image_iff_Collect: "r `` A = {y \<in> \<Union>(\<Union>(r)). \<exists>p\<in>r. \<exists>x\<in>A. p=<x,y>}"
   461 apply (rule equalityI, auto)
   462 apply (simp add: Pair_def, blast)
   463 done
   464 
   465 lemma vimage_iff_Collect:
   466      "r -`` A = {x \<in> \<Union>(\<Union>(r)). \<exists>p\<in>r. \<exists>y\<in>A. p=<x,y>}"
   467 apply (rule equalityI, auto)
   468 apply (simp add: Pair_def, blast)
   469 done
   470 
   471 text\<open>These two lemmas lets us prove \<open>domain_closed\<close> and
   472       \<open>range_closed\<close> without new instances of separation\<close>
   473 
   474 lemma domain_eq_vimage: "domain(r) = r -`` Union(Union(r))"
   475 apply (rule equalityI, auto)
   476 apply (rule vimageI, assumption)
   477 apply (simp add: Pair_def, blast)
   478 done
   479 
   480 lemma range_eq_image: "range(r) = r `` Union(Union(r))"
   481 apply (rule equalityI, auto)
   482 apply (rule imageI, assumption)
   483 apply (simp add: Pair_def, blast)
   484 done
   485 
   486 lemma replacementD:
   487     "[| replacement(M,P); M(A);  univalent(M,A,P) |]
   488      ==> \<exists>Y[M]. (\<forall>b[M]. ((\<exists>x[M]. x\<in>A & P(x,b)) \<longrightarrow> b \<in> Y))"
   489 by (simp add: replacement_def)
   490 
   491 lemma strong_replacementD:
   492     "[| strong_replacement(M,P); M(A);  univalent(M,A,P) |]
   493      ==> \<exists>Y[M]. (\<forall>b[M]. (b \<in> Y \<longleftrightarrow> (\<exists>x[M]. x\<in>A & P(x,b))))"
   494 by (simp add: strong_replacement_def)
   495 
   496 lemma separationD:
   497     "[| separation(M,P); M(z) |] ==> \<exists>y[M]. \<forall>x[M]. x \<in> y \<longleftrightarrow> x \<in> z & P(x)"
   498 by (simp add: separation_def)
   499 
   500 
   501 text\<open>More constants, for order types\<close>
   502 
   503 definition
   504   order_isomorphism :: "[i=>o,i,i,i,i,i] => o" where
   505     "order_isomorphism(M,A,r,B,s,f) ==
   506         bijection(M,A,B,f) &
   507         (\<forall>x[M]. x\<in>A \<longrightarrow> (\<forall>y[M]. y\<in>A \<longrightarrow>
   508           (\<forall>p[M]. \<forall>fx[M]. \<forall>fy[M]. \<forall>q[M].
   509             pair(M,x,y,p) \<longrightarrow> fun_apply(M,f,x,fx) \<longrightarrow> fun_apply(M,f,y,fy) \<longrightarrow>
   510             pair(M,fx,fy,q) \<longrightarrow> (p\<in>r \<longleftrightarrow> q\<in>s))))"
   511 
   512 definition
   513   pred_set :: "[i=>o,i,i,i,i] => o" where
   514     "pred_set(M,A,x,r,B) ==
   515         \<forall>y[M]. y \<in> B \<longleftrightarrow> (\<exists>p[M]. p\<in>r & y \<in> A & pair(M,y,x,p))"
   516 
   517 definition
   518   membership :: "[i=>o,i,i] => o" where \<comment>\<open>membership relation\<close>
   519     "membership(M,A,r) ==
   520         \<forall>p[M]. p \<in> r \<longleftrightarrow> (\<exists>x[M]. x\<in>A & (\<exists>y[M]. y\<in>A & x\<in>y & pair(M,x,y,p)))"
   521 
   522 
   523 subsection\<open>Introducing a Transitive Class Model\<close>
   524 
   525 text\<open>The class M is assumed to be transitive and to satisfy some
   526       relativized ZF axioms\<close>
   527 locale M_trivial =
   528   fixes M
   529   assumes transM:           "[| y\<in>x; M(x) |] ==> M(y)"
   530       and upair_ax:         "upair_ax(M)"
   531       and Union_ax:         "Union_ax(M)"
   532       and power_ax:         "power_ax(M)"
   533       and replacement:      "replacement(M,P)"
   534       and M_nat [iff]:      "M(nat)"           (*i.e. the axiom of infinity*)
   535 
   536 
   537 text\<open>Automatically discovers the proof using \<open>transM\<close>, \<open>nat_0I\<close>
   538 and \<open>M_nat\<close>.\<close>
   539 lemma (in M_trivial) nonempty [simp]: "M(0)"
   540 by (blast intro: transM)
   541 
   542 lemma (in M_trivial) rall_abs [simp]:
   543      "M(A) ==> (\<forall>x[M]. x\<in>A \<longrightarrow> P(x)) \<longleftrightarrow> (\<forall>x\<in>A. P(x))"
   544 by (blast intro: transM)
   545 
   546 lemma (in M_trivial) rex_abs [simp]:
   547      "M(A) ==> (\<exists>x[M]. x\<in>A & P(x)) \<longleftrightarrow> (\<exists>x\<in>A. P(x))"
   548 by (blast intro: transM)
   549 
   550 lemma (in M_trivial) ball_iff_equiv:
   551      "M(A) ==> (\<forall>x[M]. (x\<in>A \<longleftrightarrow> P(x))) \<longleftrightarrow>
   552                (\<forall>x\<in>A. P(x)) & (\<forall>x. P(x) \<longrightarrow> M(x) \<longrightarrow> x\<in>A)"
   553 by (blast intro: transM)
   554 
   555 text\<open>Simplifies proofs of equalities when there's an iff-equality
   556       available for rewriting, universally quantified over M.
   557       But it's not the only way to prove such equalities: its
   558       premises @{term "M(A)"} and  @{term "M(B)"} can be too strong.\<close>
   559 lemma (in M_trivial) M_equalityI:
   560      "[| !!x. M(x) ==> x\<in>A \<longleftrightarrow> x\<in>B; M(A); M(B) |] ==> A=B"
   561 by (blast intro!: equalityI dest: transM)
   562 
   563 
   564 subsubsection\<open>Trivial Absoluteness Proofs: Empty Set, Pairs, etc.\<close>
   565 
   566 lemma (in M_trivial) empty_abs [simp]:
   567      "M(z) ==> empty(M,z) \<longleftrightarrow> z=0"
   568 apply (simp add: empty_def)
   569 apply (blast intro: transM)
   570 done
   571 
   572 lemma (in M_trivial) subset_abs [simp]:
   573      "M(A) ==> subset(M,A,B) \<longleftrightarrow> A \<subseteq> B"
   574 apply (simp add: subset_def)
   575 apply (blast intro: transM)
   576 done
   577 
   578 lemma (in M_trivial) upair_abs [simp]:
   579      "M(z) ==> upair(M,a,b,z) \<longleftrightarrow> z={a,b}"
   580 apply (simp add: upair_def)
   581 apply (blast intro: transM)
   582 done
   583 
   584 lemma (in M_trivial) upair_in_M_iff [iff]:
   585      "M({a,b}) \<longleftrightarrow> M(a) & M(b)"
   586 apply (insert upair_ax, simp add: upair_ax_def)
   587 apply (blast intro: transM)
   588 done
   589 
   590 lemma (in M_trivial) singleton_in_M_iff [iff]:
   591      "M({a}) \<longleftrightarrow> M(a)"
   592 by (insert upair_in_M_iff [of a a], simp)
   593 
   594 lemma (in M_trivial) pair_abs [simp]:
   595      "M(z) ==> pair(M,a,b,z) \<longleftrightarrow> z=<a,b>"
   596 apply (simp add: pair_def Pair_def)
   597 apply (blast intro: transM)
   598 done
   599 
   600 lemma (in M_trivial) pair_in_M_iff [iff]:
   601      "M(<a,b>) \<longleftrightarrow> M(a) & M(b)"
   602 by (simp add: Pair_def)
   603 
   604 lemma (in M_trivial) pair_components_in_M:
   605      "[| <x,y> \<in> A; M(A) |] ==> M(x) & M(y)"
   606 apply (simp add: Pair_def)
   607 apply (blast dest: transM)
   608 done
   609 
   610 lemma (in M_trivial) cartprod_abs [simp]:
   611      "[| M(A); M(B); M(z) |] ==> cartprod(M,A,B,z) \<longleftrightarrow> z = A*B"
   612 apply (simp add: cartprod_def)
   613 apply (rule iffI)
   614  apply (blast intro!: equalityI intro: transM dest!: rspec)
   615 apply (blast dest: transM)
   616 done
   617 
   618 subsubsection\<open>Absoluteness for Unions and Intersections\<close>
   619 
   620 lemma (in M_trivial) union_abs [simp]:
   621      "[| M(a); M(b); M(z) |] ==> union(M,a,b,z) \<longleftrightarrow> z = a \<union> b"
   622 apply (simp add: union_def)
   623 apply (blast intro: transM)
   624 done
   625 
   626 lemma (in M_trivial) inter_abs [simp]:
   627      "[| M(a); M(b); M(z) |] ==> inter(M,a,b,z) \<longleftrightarrow> z = a \<inter> b"
   628 apply (simp add: inter_def)
   629 apply (blast intro: transM)
   630 done
   631 
   632 lemma (in M_trivial) setdiff_abs [simp]:
   633      "[| M(a); M(b); M(z) |] ==> setdiff(M,a,b,z) \<longleftrightarrow> z = a-b"
   634 apply (simp add: setdiff_def)
   635 apply (blast intro: transM)
   636 done
   637 
   638 lemma (in M_trivial) Union_abs [simp]:
   639      "[| M(A); M(z) |] ==> big_union(M,A,z) \<longleftrightarrow> z = \<Union>(A)"
   640 apply (simp add: big_union_def)
   641 apply (blast intro!: equalityI dest: transM)
   642 done
   643 
   644 lemma (in M_trivial) Union_closed [intro,simp]:
   645      "M(A) ==> M(\<Union>(A))"
   646 by (insert Union_ax, simp add: Union_ax_def)
   647 
   648 lemma (in M_trivial) Un_closed [intro,simp]:
   649      "[| M(A); M(B) |] ==> M(A \<union> B)"
   650 by (simp only: Un_eq_Union, blast)
   651 
   652 lemma (in M_trivial) cons_closed [intro,simp]:
   653      "[| M(a); M(A) |] ==> M(cons(a,A))"
   654 by (subst cons_eq [symmetric], blast)
   655 
   656 lemma (in M_trivial) cons_abs [simp]:
   657      "[| M(b); M(z) |] ==> is_cons(M,a,b,z) \<longleftrightarrow> z = cons(a,b)"
   658 by (simp add: is_cons_def, blast intro: transM)
   659 
   660 lemma (in M_trivial) successor_abs [simp]:
   661      "[| M(a); M(z) |] ==> successor(M,a,z) \<longleftrightarrow> z = succ(a)"
   662 by (simp add: successor_def, blast)
   663 
   664 lemma (in M_trivial) succ_in_M_iff [iff]:
   665      "M(succ(a)) \<longleftrightarrow> M(a)"
   666 apply (simp add: succ_def)
   667 apply (blast intro: transM)
   668 done
   669 
   670 subsubsection\<open>Absoluteness for Separation and Replacement\<close>
   671 
   672 lemma (in M_trivial) separation_closed [intro,simp]:
   673      "[| separation(M,P); M(A) |] ==> M(Collect(A,P))"
   674 apply (insert separation, simp add: separation_def)
   675 apply (drule rspec, assumption, clarify)
   676 apply (subgoal_tac "y = Collect(A,P)", blast)
   677 apply (blast dest: transM)
   678 done
   679 
   680 lemma separation_iff:
   681      "separation(M,P) \<longleftrightarrow> (\<forall>z[M]. \<exists>y[M]. is_Collect(M,z,P,y))"
   682 by (simp add: separation_def is_Collect_def)
   683 
   684 lemma (in M_trivial) Collect_abs [simp]:
   685      "[| M(A); M(z) |] ==> is_Collect(M,A,P,z) \<longleftrightarrow> z = Collect(A,P)"
   686 apply (simp add: is_Collect_def)
   687 apply (blast intro!: equalityI dest: transM)
   688 done
   689 
   690 text\<open>Probably the premise and conclusion are equivalent\<close>
   691 lemma (in M_trivial) strong_replacementI [rule_format]:
   692     "[| \<forall>B[M]. separation(M, %u. \<exists>x[M]. x\<in>B & P(x,u)) |]
   693      ==> strong_replacement(M,P)"
   694 apply (simp add: strong_replacement_def, clarify)
   695 apply (frule replacementD [OF replacement], assumption, clarify)
   696 apply (drule_tac x=A in rspec, clarify)
   697 apply (drule_tac z=Y in separationD, assumption, clarify)
   698 apply (rule_tac x=y in rexI, force, assumption)
   699 done
   700 
   701 subsubsection\<open>The Operator @{term is_Replace}\<close>
   702 
   703 
   704 lemma is_Replace_cong [cong]:
   705      "[| A=A';
   706          !!x y. [| M(x); M(y) |] ==> P(x,y) \<longleftrightarrow> P'(x,y);
   707          z=z' |]
   708       ==> is_Replace(M, A, %x y. P(x,y), z) \<longleftrightarrow>
   709           is_Replace(M, A', %x y. P'(x,y), z')"
   710 by (simp add: is_Replace_def)
   711 
   712 lemma (in M_trivial) univalent_Replace_iff:
   713      "[| M(A); univalent(M,A,P);
   714          !!x y. [| x\<in>A; P(x,y) |] ==> M(y) |]
   715       ==> u \<in> Replace(A,P) \<longleftrightarrow> (\<exists>x. x\<in>A & P(x,u))"
   716 apply (simp add: Replace_iff univalent_def)
   717 apply (blast dest: transM)
   718 done
   719 
   720 (*The last premise expresses that P takes M to M*)
   721 lemma (in M_trivial) strong_replacement_closed [intro,simp]:
   722      "[| strong_replacement(M,P); M(A); univalent(M,A,P);
   723          !!x y. [| x\<in>A; P(x,y) |] ==> M(y) |] ==> M(Replace(A,P))"
   724 apply (simp add: strong_replacement_def)
   725 apply (drule_tac x=A in rspec, safe)
   726 apply (subgoal_tac "Replace(A,P) = Y")
   727  apply simp
   728 apply (rule equality_iffI)
   729 apply (simp add: univalent_Replace_iff)
   730 apply (blast dest: transM)
   731 done
   732 
   733 lemma (in M_trivial) Replace_abs:
   734      "[| M(A); M(z); univalent(M,A,P);
   735          !!x y. [| x\<in>A; P(x,y) |] ==> M(y)  |]
   736       ==> is_Replace(M,A,P,z) \<longleftrightarrow> z = Replace(A,P)"
   737 apply (simp add: is_Replace_def)
   738 apply (rule iffI)
   739  apply (rule equality_iffI)
   740  apply (simp_all add: univalent_Replace_iff)
   741  apply (blast dest: transM)+
   742 done
   743 
   744 
   745 (*The first premise can't simply be assumed as a schema.
   746   It is essential to take care when asserting instances of Replacement.
   747   Let K be a nonconstructible subset of nat and define
   748   f(x) = x if x \<in> K and f(x)=0 otherwise.  Then RepFun(nat,f) = cons(0,K), a
   749   nonconstructible set.  So we cannot assume that M(X) implies M(RepFun(X,f))
   750   even for f \<in> M -> M.
   751 *)
   752 lemma (in M_trivial) RepFun_closed:
   753      "[| strong_replacement(M, \<lambda>x y. y = f(x)); M(A); \<forall>x\<in>A. M(f(x)) |]
   754       ==> M(RepFun(A,f))"
   755 apply (simp add: RepFun_def)
   756 done
   757 
   758 lemma Replace_conj_eq: "{y . x \<in> A, x\<in>A & y=f(x)} = {y . x\<in>A, y=f(x)}"
   759 by simp
   760 
   761 text\<open>Better than \<open>RepFun_closed\<close> when having the formula @{term "x\<in>A"}
   762       makes relativization easier.\<close>
   763 lemma (in M_trivial) RepFun_closed2:
   764      "[| strong_replacement(M, \<lambda>x y. x\<in>A & y = f(x)); M(A); \<forall>x\<in>A. M(f(x)) |]
   765       ==> M(RepFun(A, %x. f(x)))"
   766 apply (simp add: RepFun_def)
   767 apply (frule strong_replacement_closed, assumption)
   768 apply (auto dest: transM  simp add: Replace_conj_eq univalent_def)
   769 done
   770 
   771 subsubsection \<open>Absoluteness for @{term Lambda}\<close>
   772 
   773 definition
   774  is_lambda :: "[i=>o, i, [i,i]=>o, i] => o" where
   775     "is_lambda(M, A, is_b, z) ==
   776        \<forall>p[M]. p \<in> z \<longleftrightarrow>
   777         (\<exists>u[M]. \<exists>v[M]. u\<in>A & pair(M,u,v,p) & is_b(u,v))"
   778 
   779 lemma (in M_trivial) lam_closed:
   780      "[| strong_replacement(M, \<lambda>x y. y = <x,b(x)>); M(A); \<forall>x\<in>A. M(b(x)) |]
   781       ==> M(\<lambda>x\<in>A. b(x))"
   782 by (simp add: lam_def, blast intro: RepFun_closed dest: transM)
   783 
   784 text\<open>Better than \<open>lam_closed\<close>: has the formula @{term "x\<in>A"}\<close>
   785 lemma (in M_trivial) lam_closed2:
   786   "[|strong_replacement(M, \<lambda>x y. x\<in>A & y = \<langle>x, b(x)\<rangle>);
   787      M(A); \<forall>m[M]. m\<in>A \<longrightarrow> M(b(m))|] ==> M(Lambda(A,b))"
   788 apply (simp add: lam_def)
   789 apply (blast intro: RepFun_closed2 dest: transM)
   790 done
   791 
   792 lemma (in M_trivial) lambda_abs2:
   793      "[| Relation1(M,A,is_b,b); M(A); \<forall>m[M]. m\<in>A \<longrightarrow> M(b(m)); M(z) |]
   794       ==> is_lambda(M,A,is_b,z) \<longleftrightarrow> z = Lambda(A,b)"
   795 apply (simp add: Relation1_def is_lambda_def)
   796 apply (rule iffI)
   797  prefer 2 apply (simp add: lam_def)
   798 apply (rule equality_iffI)
   799 apply (simp add: lam_def)
   800 apply (rule iffI)
   801  apply (blast dest: transM)
   802 apply (auto simp add: transM [of _ A])
   803 done
   804 
   805 lemma is_lambda_cong [cong]:
   806      "[| A=A';  z=z';
   807          !!x y. [| x\<in>A; M(x); M(y) |] ==> is_b(x,y) \<longleftrightarrow> is_b'(x,y) |]
   808       ==> is_lambda(M, A, %x y. is_b(x,y), z) \<longleftrightarrow>
   809           is_lambda(M, A', %x y. is_b'(x,y), z')"
   810 by (simp add: is_lambda_def)
   811 
   812 lemma (in M_trivial) image_abs [simp]:
   813      "[| M(r); M(A); M(z) |] ==> image(M,r,A,z) \<longleftrightarrow> z = r``A"
   814 apply (simp add: image_def)
   815 apply (rule iffI)
   816  apply (blast intro!: equalityI dest: transM, blast)
   817 done
   818 
   819 text\<open>What about \<open>Pow_abs\<close>?  Powerset is NOT absolute!
   820       This result is one direction of absoluteness.\<close>
   821 
   822 lemma (in M_trivial) powerset_Pow:
   823      "powerset(M, x, Pow(x))"
   824 by (simp add: powerset_def)
   825 
   826 text\<open>But we can't prove that the powerset in \<open>M\<close> includes the
   827       real powerset.\<close>
   828 lemma (in M_trivial) powerset_imp_subset_Pow:
   829      "[| powerset(M,x,y); M(y) |] ==> y \<subseteq> Pow(x)"
   830 apply (simp add: powerset_def)
   831 apply (blast dest: transM)
   832 done
   833 
   834 subsubsection\<open>Absoluteness for the Natural Numbers\<close>
   835 
   836 lemma (in M_trivial) nat_into_M [intro]:
   837      "n \<in> nat ==> M(n)"
   838 by (induct n rule: nat_induct, simp_all)
   839 
   840 lemma (in M_trivial) nat_case_closed [intro,simp]:
   841   "[|M(k); M(a); \<forall>m[M]. M(b(m))|] ==> M(nat_case(a,b,k))"
   842 apply (case_tac "k=0", simp)
   843 apply (case_tac "\<exists>m. k = succ(m)", force)
   844 apply (simp add: nat_case_def)
   845 done
   846 
   847 lemma (in M_trivial) quasinat_abs [simp]:
   848      "M(z) ==> is_quasinat(M,z) \<longleftrightarrow> quasinat(z)"
   849 by (auto simp add: is_quasinat_def quasinat_def)
   850 
   851 lemma (in M_trivial) nat_case_abs [simp]:
   852      "[| relation1(M,is_b,b); M(k); M(z) |]
   853       ==> is_nat_case(M,a,is_b,k,z) \<longleftrightarrow> z = nat_case(a,b,k)"
   854 apply (case_tac "quasinat(k)")
   855  prefer 2
   856  apply (simp add: is_nat_case_def non_nat_case)
   857  apply (force simp add: quasinat_def)
   858 apply (simp add: quasinat_def is_nat_case_def)
   859 apply (elim disjE exE)
   860  apply (simp_all add: relation1_def)
   861 done
   862 
   863 (*NOT for the simplifier.  The assumption M(z') is apparently necessary, but
   864   causes the error "Failed congruence proof!"  It may be better to replace
   865   is_nat_case by nat_case before attempting congruence reasoning.*)
   866 lemma is_nat_case_cong:
   867      "[| a = a'; k = k';  z = z';  M(z');
   868        !!x y. [| M(x); M(y) |] ==> is_b(x,y) \<longleftrightarrow> is_b'(x,y) |]
   869       ==> is_nat_case(M, a, is_b, k, z) \<longleftrightarrow> is_nat_case(M, a', is_b', k', z')"
   870 by (simp add: is_nat_case_def)
   871 
   872 
   873 subsection\<open>Absoluteness for Ordinals\<close>
   874 text\<open>These results constitute Theorem IV 5.1 of Kunen (page 126).\<close>
   875 
   876 lemma (in M_trivial) lt_closed:
   877      "[| j<i; M(i) |] ==> M(j)"
   878 by (blast dest: ltD intro: transM)
   879 
   880 lemma (in M_trivial) transitive_set_abs [simp]:
   881      "M(a) ==> transitive_set(M,a) \<longleftrightarrow> Transset(a)"
   882 by (simp add: transitive_set_def Transset_def)
   883 
   884 lemma (in M_trivial) ordinal_abs [simp]:
   885      "M(a) ==> ordinal(M,a) \<longleftrightarrow> Ord(a)"
   886 by (simp add: ordinal_def Ord_def)
   887 
   888 lemma (in M_trivial) limit_ordinal_abs [simp]:
   889      "M(a) ==> limit_ordinal(M,a) \<longleftrightarrow> Limit(a)"
   890 apply (unfold Limit_def limit_ordinal_def)
   891 apply (simp add: Ord_0_lt_iff)
   892 apply (simp add: lt_def, blast)
   893 done
   894 
   895 lemma (in M_trivial) successor_ordinal_abs [simp]:
   896      "M(a) ==> successor_ordinal(M,a) \<longleftrightarrow> Ord(a) & (\<exists>b[M]. a = succ(b))"
   897 apply (simp add: successor_ordinal_def, safe)
   898 apply (drule Ord_cases_disj, auto)
   899 done
   900 
   901 lemma finite_Ord_is_nat:
   902       "[| Ord(a); ~ Limit(a); \<forall>x\<in>a. ~ Limit(x) |] ==> a \<in> nat"
   903 by (induct a rule: trans_induct3, simp_all)
   904 
   905 lemma (in M_trivial) finite_ordinal_abs [simp]:
   906      "M(a) ==> finite_ordinal(M,a) \<longleftrightarrow> a \<in> nat"
   907 apply (simp add: finite_ordinal_def)
   908 apply (blast intro: finite_Ord_is_nat intro: nat_into_Ord
   909              dest: Ord_trans naturals_not_limit)
   910 done
   911 
   912 lemma Limit_non_Limit_implies_nat:
   913      "[| Limit(a); \<forall>x\<in>a. ~ Limit(x) |] ==> a = nat"
   914 apply (rule le_anti_sym)
   915 apply (rule all_lt_imp_le, blast, blast intro: Limit_is_Ord)
   916  apply (simp add: lt_def)
   917  apply (blast intro: Ord_in_Ord Ord_trans finite_Ord_is_nat)
   918 apply (erule nat_le_Limit)
   919 done
   920 
   921 lemma (in M_trivial) omega_abs [simp]:
   922      "M(a) ==> omega(M,a) \<longleftrightarrow> a = nat"
   923 apply (simp add: omega_def)
   924 apply (blast intro: Limit_non_Limit_implies_nat dest: naturals_not_limit)
   925 done
   926 
   927 lemma (in M_trivial) number1_abs [simp]:
   928      "M(a) ==> number1(M,a) \<longleftrightarrow> a = 1"
   929 by (simp add: number1_def)
   930 
   931 lemma (in M_trivial) number2_abs [simp]:
   932      "M(a) ==> number2(M,a) \<longleftrightarrow> a = succ(1)"
   933 by (simp add: number2_def)
   934 
   935 lemma (in M_trivial) number3_abs [simp]:
   936      "M(a) ==> number3(M,a) \<longleftrightarrow> a = succ(succ(1))"
   937 by (simp add: number3_def)
   938 
   939 text\<open>Kunen continued to 20...\<close>
   940 
   941 (*Could not get this to work.  The \<lambda>x\<in>nat is essential because everything
   942   but the recursion variable must stay unchanged.  But then the recursion
   943   equations only hold for x\<in>nat (or in some other set) and not for the
   944   whole of the class M.
   945   consts
   946     natnumber_aux :: "[i=>o,i] => i"
   947 
   948   primrec
   949       "natnumber_aux(M,0) = (\<lambda>x\<in>nat. if empty(M,x) then 1 else 0)"
   950       "natnumber_aux(M,succ(n)) =
   951            (\<lambda>x\<in>nat. if (\<exists>y[M]. natnumber_aux(M,n)`y=1 & successor(M,y,x))
   952                      then 1 else 0)"
   953 
   954   definition
   955     natnumber :: "[i=>o,i,i] => o"
   956       "natnumber(M,n,x) == natnumber_aux(M,n)`x = 1"
   957 
   958   lemma (in M_trivial) [simp]:
   959        "natnumber(M,0,x) == x=0"
   960 *)
   961 
   962 subsection\<open>Some instances of separation and strong replacement\<close>
   963 
   964 locale M_basic = M_trivial +
   965 assumes Inter_separation:
   966      "M(A) ==> separation(M, \<lambda>x. \<forall>y[M]. y\<in>A \<longrightarrow> x\<in>y)"
   967   and Diff_separation:
   968      "M(B) ==> separation(M, \<lambda>x. x \<notin> B)"
   969   and cartprod_separation:
   970      "[| M(A); M(B) |]
   971       ==> separation(M, \<lambda>z. \<exists>x[M]. x\<in>A & (\<exists>y[M]. y\<in>B & pair(M,x,y,z)))"
   972   and image_separation:
   973      "[| M(A); M(r) |]
   974       ==> separation(M, \<lambda>y. \<exists>p[M]. p\<in>r & (\<exists>x[M]. x\<in>A & pair(M,x,y,p)))"
   975   and converse_separation:
   976      "M(r) ==> separation(M,
   977          \<lambda>z. \<exists>p[M]. p\<in>r & (\<exists>x[M]. \<exists>y[M]. pair(M,x,y,p) & pair(M,y,x,z)))"
   978   and restrict_separation:
   979      "M(A) ==> separation(M, \<lambda>z. \<exists>x[M]. x\<in>A & (\<exists>y[M]. pair(M,x,y,z)))"
   980   and comp_separation:
   981      "[| M(r); M(s) |]
   982       ==> separation(M, \<lambda>xz. \<exists>x[M]. \<exists>y[M]. \<exists>z[M]. \<exists>xy[M]. \<exists>yz[M].
   983                   pair(M,x,z,xz) & pair(M,x,y,xy) & pair(M,y,z,yz) &
   984                   xy\<in>s & yz\<in>r)"
   985   and pred_separation:
   986      "[| M(r); M(x) |] ==> separation(M, \<lambda>y. \<exists>p[M]. p\<in>r & pair(M,y,x,p))"
   987   and Memrel_separation:
   988      "separation(M, \<lambda>z. \<exists>x[M]. \<exists>y[M]. pair(M,x,y,z) & x \<in> y)"
   989   and funspace_succ_replacement:
   990      "M(n) ==>
   991       strong_replacement(M, \<lambda>p z. \<exists>f[M]. \<exists>b[M]. \<exists>nb[M]. \<exists>cnbf[M].
   992                 pair(M,f,b,p) & pair(M,n,b,nb) & is_cons(M,nb,f,cnbf) &
   993                 upair(M,cnbf,cnbf,z))"
   994   and is_recfun_separation:
   995      \<comment>\<open>for well-founded recursion: used to prove \<open>is_recfun_equal\<close>\<close>
   996      "[| M(r); M(f); M(g); M(a); M(b) |]
   997      ==> separation(M,
   998             \<lambda>x. \<exists>xa[M]. \<exists>xb[M].
   999                 pair(M,x,a,xa) & xa \<in> r & pair(M,x,b,xb) & xb \<in> r &
  1000                 (\<exists>fx[M]. \<exists>gx[M]. fun_apply(M,f,x,fx) & fun_apply(M,g,x,gx) &
  1001                                    fx \<noteq> gx))"
  1002 
  1003 lemma (in M_basic) cartprod_iff_lemma:
  1004      "[| M(C);  \<forall>u[M]. u \<in> C \<longleftrightarrow> (\<exists>x\<in>A. \<exists>y\<in>B. u = {{x}, {x,y}});
  1005          powerset(M, A \<union> B, p1); powerset(M, p1, p2);  M(p2) |]
  1006        ==> C = {u \<in> p2 . \<exists>x\<in>A. \<exists>y\<in>B. u = {{x}, {x,y}}}"
  1007 apply (simp add: powerset_def)
  1008 apply (rule equalityI, clarify, simp)
  1009  apply (frule transM, assumption)
  1010  apply (frule transM, assumption, simp (no_asm_simp))
  1011  apply blast
  1012 apply clarify
  1013 apply (frule transM, assumption, force)
  1014 done
  1015 
  1016 lemma (in M_basic) cartprod_iff:
  1017      "[| M(A); M(B); M(C) |]
  1018       ==> cartprod(M,A,B,C) \<longleftrightarrow>
  1019           (\<exists>p1[M]. \<exists>p2[M]. powerset(M,A \<union> B,p1) & powerset(M,p1,p2) &
  1020                    C = {z \<in> p2. \<exists>x\<in>A. \<exists>y\<in>B. z = <x,y>})"
  1021 apply (simp add: Pair_def cartprod_def, safe)
  1022 defer 1
  1023   apply (simp add: powerset_def)
  1024  apply blast
  1025 txt\<open>Final, difficult case: the left-to-right direction of the theorem.\<close>
  1026 apply (insert power_ax, simp add: power_ax_def)
  1027 apply (frule_tac x="A \<union> B" and P="\<lambda>x. rex(M,Q(x))" for Q in rspec)
  1028 apply (blast, clarify)
  1029 apply (drule_tac x=z and P="\<lambda>x. rex(M,Q(x))" for Q in rspec)
  1030 apply assumption
  1031 apply (blast intro: cartprod_iff_lemma)
  1032 done
  1033 
  1034 lemma (in M_basic) cartprod_closed_lemma:
  1035      "[| M(A); M(B) |] ==> \<exists>C[M]. cartprod(M,A,B,C)"
  1036 apply (simp del: cartprod_abs add: cartprod_iff)
  1037 apply (insert power_ax, simp add: power_ax_def)
  1038 apply (frule_tac x="A \<union> B" and P="\<lambda>x. rex(M,Q(x))" for Q in rspec)
  1039 apply (blast, clarify)
  1040 apply (drule_tac x=z and P="\<lambda>x. rex(M,Q(x))" for Q in rspec, auto)
  1041 apply (intro rexI conjI, simp+)
  1042 apply (insert cartprod_separation [of A B], simp)
  1043 done
  1044 
  1045 text\<open>All the lemmas above are necessary because Powerset is not absolute.
  1046       I should have used Replacement instead!\<close>
  1047 lemma (in M_basic) cartprod_closed [intro,simp]:
  1048      "[| M(A); M(B) |] ==> M(A*B)"
  1049 by (frule cartprod_closed_lemma, assumption, force)
  1050 
  1051 lemma (in M_basic) sum_closed [intro,simp]:
  1052      "[| M(A); M(B) |] ==> M(A+B)"
  1053 by (simp add: sum_def)
  1054 
  1055 lemma (in M_basic) sum_abs [simp]:
  1056      "[| M(A); M(B); M(Z) |] ==> is_sum(M,A,B,Z) \<longleftrightarrow> (Z = A+B)"
  1057 by (simp add: is_sum_def sum_def singleton_0 nat_into_M)
  1058 
  1059 lemma (in M_trivial) Inl_in_M_iff [iff]:
  1060      "M(Inl(a)) \<longleftrightarrow> M(a)"
  1061 by (simp add: Inl_def)
  1062 
  1063 lemma (in M_trivial) Inl_abs [simp]:
  1064      "M(Z) ==> is_Inl(M,a,Z) \<longleftrightarrow> (Z = Inl(a))"
  1065 by (simp add: is_Inl_def Inl_def)
  1066 
  1067 lemma (in M_trivial) Inr_in_M_iff [iff]:
  1068      "M(Inr(a)) \<longleftrightarrow> M(a)"
  1069 by (simp add: Inr_def)
  1070 
  1071 lemma (in M_trivial) Inr_abs [simp]:
  1072      "M(Z) ==> is_Inr(M,a,Z) \<longleftrightarrow> (Z = Inr(a))"
  1073 by (simp add: is_Inr_def Inr_def)
  1074 
  1075 
  1076 subsubsection \<open>converse of a relation\<close>
  1077 
  1078 lemma (in M_basic) M_converse_iff:
  1079      "M(r) ==>
  1080       converse(r) =
  1081       {z \<in> \<Union>(\<Union>(r)) * \<Union>(\<Union>(r)).
  1082        \<exists>p\<in>r. \<exists>x[M]. \<exists>y[M]. p = \<langle>x,y\<rangle> & z = \<langle>y,x\<rangle>}"
  1083 apply (rule equalityI)
  1084  prefer 2 apply (blast dest: transM, clarify, simp)
  1085 apply (simp add: Pair_def)
  1086 apply (blast dest: transM)
  1087 done
  1088 
  1089 lemma (in M_basic) converse_closed [intro,simp]:
  1090      "M(r) ==> M(converse(r))"
  1091 apply (simp add: M_converse_iff)
  1092 apply (insert converse_separation [of r], simp)
  1093 done
  1094 
  1095 lemma (in M_basic) converse_abs [simp]:
  1096      "[| M(r); M(z) |] ==> is_converse(M,r,z) \<longleftrightarrow> z = converse(r)"
  1097 apply (simp add: is_converse_def)
  1098 apply (rule iffI)
  1099  prefer 2 apply blast
  1100 apply (rule M_equalityI)
  1101   apply simp
  1102   apply (blast dest: transM)+
  1103 done
  1104 
  1105 
  1106 subsubsection \<open>image, preimage, domain, range\<close>
  1107 
  1108 lemma (in M_basic) image_closed [intro,simp]:
  1109      "[| M(A); M(r) |] ==> M(r``A)"
  1110 apply (simp add: image_iff_Collect)
  1111 apply (insert image_separation [of A r], simp)
  1112 done
  1113 
  1114 lemma (in M_basic) vimage_abs [simp]:
  1115      "[| M(r); M(A); M(z) |] ==> pre_image(M,r,A,z) \<longleftrightarrow> z = r-``A"
  1116 apply (simp add: pre_image_def)
  1117 apply (rule iffI)
  1118  apply (blast intro!: equalityI dest: transM, blast)
  1119 done
  1120 
  1121 lemma (in M_basic) vimage_closed [intro,simp]:
  1122      "[| M(A); M(r) |] ==> M(r-``A)"
  1123 by (simp add: vimage_def)
  1124 
  1125 
  1126 subsubsection\<open>Domain, range and field\<close>
  1127 
  1128 lemma (in M_basic) domain_abs [simp]:
  1129      "[| M(r); M(z) |] ==> is_domain(M,r,z) \<longleftrightarrow> z = domain(r)"
  1130 apply (simp add: is_domain_def)
  1131 apply (blast intro!: equalityI dest: transM)
  1132 done
  1133 
  1134 lemma (in M_basic) domain_closed [intro,simp]:
  1135      "M(r) ==> M(domain(r))"
  1136 apply (simp add: domain_eq_vimage)
  1137 done
  1138 
  1139 lemma (in M_basic) range_abs [simp]:
  1140      "[| M(r); M(z) |] ==> is_range(M,r,z) \<longleftrightarrow> z = range(r)"
  1141 apply (simp add: is_range_def)
  1142 apply (blast intro!: equalityI dest: transM)
  1143 done
  1144 
  1145 lemma (in M_basic) range_closed [intro,simp]:
  1146      "M(r) ==> M(range(r))"
  1147 apply (simp add: range_eq_image)
  1148 done
  1149 
  1150 lemma (in M_basic) field_abs [simp]:
  1151      "[| M(r); M(z) |] ==> is_field(M,r,z) \<longleftrightarrow> z = field(r)"
  1152 by (simp add: domain_closed range_closed is_field_def field_def)
  1153 
  1154 lemma (in M_basic) field_closed [intro,simp]:
  1155      "M(r) ==> M(field(r))"
  1156 by (simp add: domain_closed range_closed Un_closed field_def)
  1157 
  1158 
  1159 subsubsection\<open>Relations, functions and application\<close>
  1160 
  1161 lemma (in M_basic) relation_abs [simp]:
  1162      "M(r) ==> is_relation(M,r) \<longleftrightarrow> relation(r)"
  1163 apply (simp add: is_relation_def relation_def)
  1164 apply (blast dest!: bspec dest: pair_components_in_M)+
  1165 done
  1166 
  1167 lemma (in M_basic) function_abs [simp]:
  1168      "M(r) ==> is_function(M,r) \<longleftrightarrow> function(r)"
  1169 apply (simp add: is_function_def function_def, safe)
  1170    apply (frule transM, assumption)
  1171   apply (blast dest: pair_components_in_M)+
  1172 done
  1173 
  1174 lemma (in M_basic) apply_closed [intro,simp]:
  1175      "[|M(f); M(a)|] ==> M(f`a)"
  1176 by (simp add: apply_def)
  1177 
  1178 lemma (in M_basic) apply_abs [simp]:
  1179      "[| M(f); M(x); M(y) |] ==> fun_apply(M,f,x,y) \<longleftrightarrow> f`x = y"
  1180 apply (simp add: fun_apply_def apply_def, blast)
  1181 done
  1182 
  1183 lemma (in M_basic) typed_function_abs [simp]:
  1184      "[| M(A); M(f) |] ==> typed_function(M,A,B,f) \<longleftrightarrow> f \<in> A -> B"
  1185 apply (auto simp add: typed_function_def relation_def Pi_iff)
  1186 apply (blast dest: pair_components_in_M)+
  1187 done
  1188 
  1189 lemma (in M_basic) injection_abs [simp]:
  1190      "[| M(A); M(f) |] ==> injection(M,A,B,f) \<longleftrightarrow> f \<in> inj(A,B)"
  1191 apply (simp add: injection_def apply_iff inj_def apply_closed)
  1192 apply (blast dest: transM [of _ A])
  1193 done
  1194 
  1195 lemma (in M_basic) surjection_abs [simp]:
  1196      "[| M(A); M(B); M(f) |] ==> surjection(M,A,B,f) \<longleftrightarrow> f \<in> surj(A,B)"
  1197 by (simp add: surjection_def surj_def)
  1198 
  1199 lemma (in M_basic) bijection_abs [simp]:
  1200      "[| M(A); M(B); M(f) |] ==> bijection(M,A,B,f) \<longleftrightarrow> f \<in> bij(A,B)"
  1201 by (simp add: bijection_def bij_def)
  1202 
  1203 
  1204 subsubsection\<open>Composition of relations\<close>
  1205 
  1206 lemma (in M_basic) M_comp_iff:
  1207      "[| M(r); M(s) |]
  1208       ==> r O s =
  1209           {xz \<in> domain(s) * range(r).
  1210             \<exists>x[M]. \<exists>y[M]. \<exists>z[M]. xz = \<langle>x,z\<rangle> & \<langle>x,y\<rangle> \<in> s & \<langle>y,z\<rangle> \<in> r}"
  1211 apply (simp add: comp_def)
  1212 apply (rule equalityI)
  1213  apply clarify
  1214  apply simp
  1215  apply  (blast dest:  transM)+
  1216 done
  1217 
  1218 lemma (in M_basic) comp_closed [intro,simp]:
  1219      "[| M(r); M(s) |] ==> M(r O s)"
  1220 apply (simp add: M_comp_iff)
  1221 apply (insert comp_separation [of r s], simp)
  1222 done
  1223 
  1224 lemma (in M_basic) composition_abs [simp]:
  1225      "[| M(r); M(s); M(t) |] ==> composition(M,r,s,t) \<longleftrightarrow> t = r O s"
  1226 apply safe
  1227  txt\<open>Proving @{term "composition(M, r, s, r O s)"}\<close>
  1228  prefer 2
  1229  apply (simp add: composition_def comp_def)
  1230  apply (blast dest: transM)
  1231 txt\<open>Opposite implication\<close>
  1232 apply (rule M_equalityI)
  1233   apply (simp add: composition_def comp_def)
  1234   apply (blast del: allE dest: transM)+
  1235 done
  1236 
  1237 text\<open>no longer needed\<close>
  1238 lemma (in M_basic) restriction_is_function:
  1239      "[| restriction(M,f,A,z); function(f); M(f); M(A); M(z) |]
  1240       ==> function(z)"
  1241 apply (simp add: restriction_def ball_iff_equiv)
  1242 apply (unfold function_def, blast)
  1243 done
  1244 
  1245 lemma (in M_basic) restriction_abs [simp]:
  1246      "[| M(f); M(A); M(z) |]
  1247       ==> restriction(M,f,A,z) \<longleftrightarrow> z = restrict(f,A)"
  1248 apply (simp add: ball_iff_equiv restriction_def restrict_def)
  1249 apply (blast intro!: equalityI dest: transM)
  1250 done
  1251 
  1252 
  1253 lemma (in M_basic) M_restrict_iff:
  1254      "M(r) ==> restrict(r,A) = {z \<in> r . \<exists>x\<in>A. \<exists>y[M]. z = \<langle>x, y\<rangle>}"
  1255 by (simp add: restrict_def, blast dest: transM)
  1256 
  1257 lemma (in M_basic) restrict_closed [intro,simp]:
  1258      "[| M(A); M(r) |] ==> M(restrict(r,A))"
  1259 apply (simp add: M_restrict_iff)
  1260 apply (insert restrict_separation [of A], simp)
  1261 done
  1262 
  1263 lemma (in M_basic) Inter_abs [simp]:
  1264      "[| M(A); M(z) |] ==> big_inter(M,A,z) \<longleftrightarrow> z = \<Inter>(A)"
  1265 apply (simp add: big_inter_def Inter_def)
  1266 apply (blast intro!: equalityI dest: transM)
  1267 done
  1268 
  1269 lemma (in M_basic) Inter_closed [intro,simp]:
  1270      "M(A) ==> M(\<Inter>(A))"
  1271 by (insert Inter_separation, simp add: Inter_def)
  1272 
  1273 lemma (in M_basic) Int_closed [intro,simp]:
  1274      "[| M(A); M(B) |] ==> M(A \<inter> B)"
  1275 apply (subgoal_tac "M({A,B})")
  1276 apply (frule Inter_closed, force+)
  1277 done
  1278 
  1279 lemma (in M_basic) Diff_closed [intro,simp]:
  1280      "[|M(A); M(B)|] ==> M(A-B)"
  1281 by (insert Diff_separation, simp add: Diff_def)
  1282 
  1283 subsubsection\<open>Some Facts About Separation Axioms\<close>
  1284 
  1285 lemma (in M_basic) separation_conj:
  1286      "[|separation(M,P); separation(M,Q)|] ==> separation(M, \<lambda>z. P(z) & Q(z))"
  1287 by (simp del: separation_closed
  1288          add: separation_iff Collect_Int_Collect_eq [symmetric])
  1289 
  1290 (*???equalities*)
  1291 lemma Collect_Un_Collect_eq:
  1292      "Collect(A,P) \<union> Collect(A,Q) = Collect(A, %x. P(x) | Q(x))"
  1293 by blast
  1294 
  1295 lemma Diff_Collect_eq:
  1296      "A - Collect(A,P) = Collect(A, %x. ~ P(x))"
  1297 by blast
  1298 
  1299 lemma (in M_trivial) Collect_rall_eq:
  1300      "M(Y) ==> Collect(A, %x. \<forall>y[M]. y\<in>Y \<longrightarrow> P(x,y)) =
  1301                (if Y=0 then A else (\<Inter>y \<in> Y. {x \<in> A. P(x,y)}))"
  1302 apply simp
  1303 apply (blast intro!: equalityI dest: transM)
  1304 done
  1305 
  1306 lemma (in M_basic) separation_disj:
  1307      "[|separation(M,P); separation(M,Q)|] ==> separation(M, \<lambda>z. P(z) | Q(z))"
  1308 by (simp del: separation_closed
  1309          add: separation_iff Collect_Un_Collect_eq [symmetric])
  1310 
  1311 lemma (in M_basic) separation_neg:
  1312      "separation(M,P) ==> separation(M, \<lambda>z. ~P(z))"
  1313 by (simp del: separation_closed
  1314          add: separation_iff Diff_Collect_eq [symmetric])
  1315 
  1316 lemma (in M_basic) separation_imp:
  1317      "[|separation(M,P); separation(M,Q)|]
  1318       ==> separation(M, \<lambda>z. P(z) \<longrightarrow> Q(z))"
  1319 by (simp add: separation_neg separation_disj not_disj_iff_imp [symmetric])
  1320 
  1321 text\<open>This result is a hint of how little can be done without the Reflection
  1322   Theorem.  The quantifier has to be bounded by a set.  We also need another
  1323   instance of Separation!\<close>
  1324 lemma (in M_basic) separation_rall:
  1325      "[|M(Y); \<forall>y[M]. separation(M, \<lambda>x. P(x,y));
  1326         \<forall>z[M]. strong_replacement(M, \<lambda>x y. y = {u \<in> z . P(u,x)})|]
  1327       ==> separation(M, \<lambda>x. \<forall>y[M]. y\<in>Y \<longrightarrow> P(x,y))"
  1328 apply (simp del: separation_closed rall_abs
  1329          add: separation_iff Collect_rall_eq)
  1330 apply (blast intro!: Inter_closed RepFun_closed dest: transM)
  1331 done
  1332 
  1333 
  1334 subsubsection\<open>Functions and function space\<close>
  1335 
  1336 text\<open>The assumption @{term "M(A->B)"} is unusual, but essential: in
  1337 all but trivial cases, A->B cannot be expected to belong to @{term M}.\<close>
  1338 lemma (in M_basic) is_funspace_abs [simp]:
  1339      "[|M(A); M(B); M(F); M(A->B)|] ==> is_funspace(M,A,B,F) \<longleftrightarrow> F = A->B"
  1340 apply (simp add: is_funspace_def)
  1341 apply (rule iffI)
  1342  prefer 2 apply blast
  1343 apply (rule M_equalityI)
  1344   apply simp_all
  1345 done
  1346 
  1347 lemma (in M_basic) succ_fun_eq2:
  1348      "[|M(B); M(n->B)|] ==>
  1349       succ(n) -> B =
  1350       \<Union>{z. p \<in> (n->B)*B, \<exists>f[M]. \<exists>b[M]. p = <f,b> & z = {cons(<n,b>, f)}}"
  1351 apply (simp add: succ_fun_eq)
  1352 apply (blast dest: transM)
  1353 done
  1354 
  1355 lemma (in M_basic) funspace_succ:
  1356      "[|M(n); M(B); M(n->B) |] ==> M(succ(n) -> B)"
  1357 apply (insert funspace_succ_replacement [of n], simp)
  1358 apply (force simp add: succ_fun_eq2 univalent_def)
  1359 done
  1360 
  1361 text\<open>@{term M} contains all finite function spaces.  Needed to prove the
  1362 absoluteness of transitive closure.  See the definition of
  1363 \<open>rtrancl_alt\<close> in in \<open>WF_absolute.thy\<close>.\<close>
  1364 lemma (in M_basic) finite_funspace_closed [intro,simp]:
  1365      "[|n\<in>nat; M(B)|] ==> M(n->B)"
  1366 apply (induct_tac n, simp)
  1367 apply (simp add: funspace_succ nat_into_M)
  1368 done
  1369 
  1370 
  1371 subsection\<open>Relativization and Absoluteness for Boolean Operators\<close>
  1372 
  1373 definition
  1374   is_bool_of_o :: "[i=>o, o, i] => o" where
  1375    "is_bool_of_o(M,P,z) == (P & number1(M,z)) | (~P & empty(M,z))"
  1376 
  1377 definition
  1378   is_not :: "[i=>o, i, i] => o" where
  1379    "is_not(M,a,z) == (number1(M,a)  & empty(M,z)) |
  1380                      (~number1(M,a) & number1(M,z))"
  1381 
  1382 definition
  1383   is_and :: "[i=>o, i, i, i] => o" where
  1384    "is_and(M,a,b,z) == (number1(M,a)  & z=b) |
  1385                        (~number1(M,a) & empty(M,z))"
  1386 
  1387 definition
  1388   is_or :: "[i=>o, i, i, i] => o" where
  1389    "is_or(M,a,b,z) == (number1(M,a)  & number1(M,z)) |
  1390                       (~number1(M,a) & z=b)"
  1391 
  1392 lemma (in M_trivial) bool_of_o_abs [simp]:
  1393      "M(z) ==> is_bool_of_o(M,P,z) \<longleftrightarrow> z = bool_of_o(P)"
  1394 by (simp add: is_bool_of_o_def bool_of_o_def)
  1395 
  1396 
  1397 lemma (in M_trivial) not_abs [simp]:
  1398      "[| M(a); M(z)|] ==> is_not(M,a,z) \<longleftrightarrow> z = not(a)"
  1399 by (simp add: Bool.not_def cond_def is_not_def)
  1400 
  1401 lemma (in M_trivial) and_abs [simp]:
  1402      "[| M(a); M(b); M(z)|] ==> is_and(M,a,b,z) \<longleftrightarrow> z = a and b"
  1403 by (simp add: Bool.and_def cond_def is_and_def)
  1404 
  1405 lemma (in M_trivial) or_abs [simp]:
  1406      "[| M(a); M(b); M(z)|] ==> is_or(M,a,b,z) \<longleftrightarrow> z = a or b"
  1407 by (simp add: Bool.or_def cond_def is_or_def)
  1408 
  1409 
  1410 lemma (in M_trivial) bool_of_o_closed [intro,simp]:
  1411      "M(bool_of_o(P))"
  1412 by (simp add: bool_of_o_def)
  1413 
  1414 lemma (in M_trivial) and_closed [intro,simp]:
  1415      "[| M(p); M(q) |] ==> M(p and q)"
  1416 by (simp add: and_def cond_def)
  1417 
  1418 lemma (in M_trivial) or_closed [intro,simp]:
  1419      "[| M(p); M(q) |] ==> M(p or q)"
  1420 by (simp add: or_def cond_def)
  1421 
  1422 lemma (in M_trivial) not_closed [intro,simp]:
  1423      "M(p) ==> M(not(p))"
  1424 by (simp add: Bool.not_def cond_def)
  1425 
  1426 
  1427 subsection\<open>Relativization and Absoluteness for List Operators\<close>
  1428 
  1429 definition
  1430   is_Nil :: "[i=>o, i] => o" where
  1431      \<comment>\<open>because @{prop "[] \<equiv> Inl(0)"}\<close>
  1432     "is_Nil(M,xs) == \<exists>zero[M]. empty(M,zero) & is_Inl(M,zero,xs)"
  1433 
  1434 definition
  1435   is_Cons :: "[i=>o,i,i,i] => o" where
  1436      \<comment>\<open>because @{prop "Cons(a, l) \<equiv> Inr(\<langle>a,l\<rangle>)"}\<close>
  1437     "is_Cons(M,a,l,Z) == \<exists>p[M]. pair(M,a,l,p) & is_Inr(M,p,Z)"
  1438 
  1439 
  1440 lemma (in M_trivial) Nil_in_M [intro,simp]: "M(Nil)"
  1441 by (simp add: Nil_def)
  1442 
  1443 lemma (in M_trivial) Nil_abs [simp]: "M(Z) ==> is_Nil(M,Z) \<longleftrightarrow> (Z = Nil)"
  1444 by (simp add: is_Nil_def Nil_def)
  1445 
  1446 lemma (in M_trivial) Cons_in_M_iff [iff]: "M(Cons(a,l)) \<longleftrightarrow> M(a) & M(l)"
  1447 by (simp add: Cons_def)
  1448 
  1449 lemma (in M_trivial) Cons_abs [simp]:
  1450      "[|M(a); M(l); M(Z)|] ==> is_Cons(M,a,l,Z) \<longleftrightarrow> (Z = Cons(a,l))"
  1451 by (simp add: is_Cons_def Cons_def)
  1452 
  1453 
  1454 definition
  1455   quasilist :: "i => o" where
  1456     "quasilist(xs) == xs=Nil | (\<exists>x l. xs = Cons(x,l))"
  1457 
  1458 definition
  1459   is_quasilist :: "[i=>o,i] => o" where
  1460     "is_quasilist(M,z) == is_Nil(M,z) | (\<exists>x[M]. \<exists>l[M]. is_Cons(M,x,l,z))"
  1461 
  1462 definition
  1463   list_case' :: "[i, [i,i]=>i, i] => i" where
  1464     \<comment>\<open>A version of @{term list_case} that's always defined.\<close>
  1465     "list_case'(a,b,xs) ==
  1466        if quasilist(xs) then list_case(a,b,xs) else 0"
  1467 
  1468 definition
  1469   is_list_case :: "[i=>o, i, [i,i,i]=>o, i, i] => o" where
  1470     \<comment>\<open>Returns 0 for non-lists\<close>
  1471     "is_list_case(M, a, is_b, xs, z) ==
  1472        (is_Nil(M,xs) \<longrightarrow> z=a) &
  1473        (\<forall>x[M]. \<forall>l[M]. is_Cons(M,x,l,xs) \<longrightarrow> is_b(x,l,z)) &
  1474        (is_quasilist(M,xs) | empty(M,z))"
  1475 
  1476 definition
  1477   hd' :: "i => i" where
  1478     \<comment>\<open>A version of @{term hd} that's always defined.\<close>
  1479     "hd'(xs) == if quasilist(xs) then hd(xs) else 0"
  1480 
  1481 definition
  1482   tl' :: "i => i" where
  1483     \<comment>\<open>A version of @{term tl} that's always defined.\<close>
  1484     "tl'(xs) == if quasilist(xs) then tl(xs) else 0"
  1485 
  1486 definition
  1487   is_hd :: "[i=>o,i,i] => o" where
  1488      \<comment>\<open>@{term "hd([]) = 0"} no constraints if not a list.
  1489           Avoiding implication prevents the simplifier's looping.\<close>
  1490     "is_hd(M,xs,H) ==
  1491        (is_Nil(M,xs) \<longrightarrow> empty(M,H)) &
  1492        (\<forall>x[M]. \<forall>l[M]. ~ is_Cons(M,x,l,xs) | H=x) &
  1493        (is_quasilist(M,xs) | empty(M,H))"
  1494 
  1495 definition
  1496   is_tl :: "[i=>o,i,i] => o" where
  1497      \<comment>\<open>@{term "tl([]) = []"}; see comments about @{term is_hd}\<close>
  1498     "is_tl(M,xs,T) ==
  1499        (is_Nil(M,xs) \<longrightarrow> T=xs) &
  1500        (\<forall>x[M]. \<forall>l[M]. ~ is_Cons(M,x,l,xs) | T=l) &
  1501        (is_quasilist(M,xs) | empty(M,T))"
  1502 
  1503 subsubsection\<open>@{term quasilist}: For Case-Splitting with @{term list_case'}\<close>
  1504 
  1505 lemma [iff]: "quasilist(Nil)"
  1506 by (simp add: quasilist_def)
  1507 
  1508 lemma [iff]: "quasilist(Cons(x,l))"
  1509 by (simp add: quasilist_def)
  1510 
  1511 lemma list_imp_quasilist: "l \<in> list(A) ==> quasilist(l)"
  1512 by (erule list.cases, simp_all)
  1513 
  1514 subsubsection\<open>@{term list_case'}, the Modified Version of @{term list_case}\<close>
  1515 
  1516 lemma list_case'_Nil [simp]: "list_case'(a,b,Nil) = a"
  1517 by (simp add: list_case'_def quasilist_def)
  1518 
  1519 lemma list_case'_Cons [simp]: "list_case'(a,b,Cons(x,l)) = b(x,l)"
  1520 by (simp add: list_case'_def quasilist_def)
  1521 
  1522 lemma non_list_case: "~ quasilist(x) ==> list_case'(a,b,x) = 0"
  1523 by (simp add: quasilist_def list_case'_def)
  1524 
  1525 lemma list_case'_eq_list_case [simp]:
  1526      "xs \<in> list(A) ==>list_case'(a,b,xs) = list_case(a,b,xs)"
  1527 by (erule list.cases, simp_all)
  1528 
  1529 lemma (in M_basic) list_case'_closed [intro,simp]:
  1530   "[|M(k); M(a); \<forall>x[M]. \<forall>y[M]. M(b(x,y))|] ==> M(list_case'(a,b,k))"
  1531 apply (case_tac "quasilist(k)")
  1532  apply (simp add: quasilist_def, force)
  1533 apply (simp add: non_list_case)
  1534 done
  1535 
  1536 lemma (in M_trivial) quasilist_abs [simp]:
  1537      "M(z) ==> is_quasilist(M,z) \<longleftrightarrow> quasilist(z)"
  1538 by (auto simp add: is_quasilist_def quasilist_def)
  1539 
  1540 lemma (in M_trivial) list_case_abs [simp]:
  1541      "[| relation2(M,is_b,b); M(k); M(z) |]
  1542       ==> is_list_case(M,a,is_b,k,z) \<longleftrightarrow> z = list_case'(a,b,k)"
  1543 apply (case_tac "quasilist(k)")
  1544  prefer 2
  1545  apply (simp add: is_list_case_def non_list_case)
  1546  apply (force simp add: quasilist_def)
  1547 apply (simp add: quasilist_def is_list_case_def)
  1548 apply (elim disjE exE)
  1549  apply (simp_all add: relation2_def)
  1550 done
  1551 
  1552 
  1553 subsubsection\<open>The Modified Operators @{term hd'} and @{term tl'}\<close>
  1554 
  1555 lemma (in M_trivial) is_hd_Nil: "is_hd(M,[],Z) \<longleftrightarrow> empty(M,Z)"
  1556 by (simp add: is_hd_def)
  1557 
  1558 lemma (in M_trivial) is_hd_Cons:
  1559      "[|M(a); M(l)|] ==> is_hd(M,Cons(a,l),Z) \<longleftrightarrow> Z = a"
  1560 by (force simp add: is_hd_def)
  1561 
  1562 lemma (in M_trivial) hd_abs [simp]:
  1563      "[|M(x); M(y)|] ==> is_hd(M,x,y) \<longleftrightarrow> y = hd'(x)"
  1564 apply (simp add: hd'_def)
  1565 apply (intro impI conjI)
  1566  prefer 2 apply (force simp add: is_hd_def)
  1567 apply (simp add: quasilist_def is_hd_def)
  1568 apply (elim disjE exE, auto)
  1569 done
  1570 
  1571 lemma (in M_trivial) is_tl_Nil: "is_tl(M,[],Z) \<longleftrightarrow> Z = []"
  1572 by (simp add: is_tl_def)
  1573 
  1574 lemma (in M_trivial) is_tl_Cons:
  1575      "[|M(a); M(l)|] ==> is_tl(M,Cons(a,l),Z) \<longleftrightarrow> Z = l"
  1576 by (force simp add: is_tl_def)
  1577 
  1578 lemma (in M_trivial) tl_abs [simp]:
  1579      "[|M(x); M(y)|] ==> is_tl(M,x,y) \<longleftrightarrow> y = tl'(x)"
  1580 apply (simp add: tl'_def)
  1581 apply (intro impI conjI)
  1582  prefer 2 apply (force simp add: is_tl_def)
  1583 apply (simp add: quasilist_def is_tl_def)
  1584 apply (elim disjE exE, auto)
  1585 done
  1586 
  1587 lemma (in M_trivial) relation1_tl: "relation1(M, is_tl(M), tl')"
  1588 by (simp add: relation1_def)
  1589 
  1590 lemma hd'_Nil: "hd'([]) = 0"
  1591 by (simp add: hd'_def)
  1592 
  1593 lemma hd'_Cons: "hd'(Cons(a,l)) = a"
  1594 by (simp add: hd'_def)
  1595 
  1596 lemma tl'_Nil: "tl'([]) = []"
  1597 by (simp add: tl'_def)
  1598 
  1599 lemma tl'_Cons: "tl'(Cons(a,l)) = l"
  1600 by (simp add: tl'_def)
  1601 
  1602 lemma iterates_tl_Nil: "n \<in> nat ==> tl'^n ([]) = []"
  1603 apply (induct_tac n)
  1604 apply (simp_all add: tl'_Nil)
  1605 done
  1606 
  1607 lemma (in M_basic) tl'_closed: "M(x) ==> M(tl'(x))"
  1608 apply (simp add: tl'_def)
  1609 apply (force simp add: quasilist_def)
  1610 done
  1611 
  1612 
  1613 end