(*  Title:      HOL/Set.thy

    Author:     Tobias Nipkow, Lawrence C Paulson and Markus Wenzel

*)

header {* Set theory for higher-order logic *}

theory Set

imports Lattices

begin

text {* A set in HOL is simply a predicate. *}

subsection {* Basic syntax *}

global

types 'a set = "'a => bool"

consts

  Collect       :: "('a => bool) => 'a set"              -- "comprehension"

  "op :"        :: "'a => 'a set => bool"                -- "membership"

  insert        :: "'a => 'a set => 'a set"

  Ball          :: "'a set => ('a => bool) => bool"      -- "bounded universal quantifiers"

  Bex           :: "'a set => ('a => bool) => bool"      -- "bounded existential quantifiers"

  Bex1          :: "'a set => ('a => bool) => bool"      -- "bounded unique existential quantifiers"

  Pow           :: "'a set => 'a set set"                -- "powerset"

  image         :: "('a => 'b) => 'a set => 'b set"      (infixr "`" 90)

local

notation

  "op :"  ("op :") and

  "op :"  ("(_/ : _)" [50, 51] 50)

abbreviation

  "not_mem x A == ~ (x : A)" -- "non-membership"

notation

  not_mem  ("op ~:") and

  not_mem  ("(_/ ~: _)" [50, 51] 50)

notation (xsymbols)

  "op :"  ("op \<in>") and

  "op :"  ("(_/ \<in> _)" [50, 51] 50) and

  not_mem  ("op \<notin>") and

  not_mem  ("(_/ \<notin> _)" [50, 51] 50)

notation (HTML output)

  "op :"  ("op \<in>") and

  "op :"  ("(_/ \<in> _)" [50, 51] 50) and

  not_mem  ("op \<notin>") and

  not_mem  ("(_/ \<notin> _)" [50, 51] 50)

syntax

  "@Coll"       :: "pttrn => bool => 'a set"              ("(1{_./ _})")

translations

  "{x. P}"      == "Collect (%x. P)"

definition empty :: "'a set" ("{}") where

  "empty \<equiv> {x. False}"

definition UNIV :: "'a set" where

  "UNIV \<equiv> {x. True}"

syntax

  "@Finset"     :: "args => 'a set"                       ("{(_)}")

translations

  "{x, xs}"     == "insert x {xs}"

  "{x}"         == "insert x {}"

definition Int :: "'a set \<Rightarrow> 'a set \<Rightarrow> 'a set" (infixl "Int" 70) where

  "A Int B \<equiv> {x. x \<in> A \<and> x \<in> B}"

definition Un :: "'a set \<Rightarrow> 'a set \<Rightarrow> 'a set" (infixl "Un" 65) where

  "A Un B \<equiv> {x. x \<in> A \<or> x \<in> B}"

notation (xsymbols)

  "Int"  (infixl "\<inter>" 70) and

  "Un"  (infixl "\<union>" 65)

notation (HTML output)

  "Int"  (infixl "\<inter>" 70) and

  "Un"  (infixl "\<union>" 65)

syntax

  "_Ball"       :: "pttrn => 'a set => bool => bool"      ("(3ALL _:_./ _)" [0, 0, 10] 10)

  "_Bex"        :: "pttrn => 'a set => bool => bool"      ("(3EX _:_./ _)" [0, 0, 10] 10)

  "_Bex1"       :: "pttrn => 'a set => bool => bool"      ("(3EX! _:_./ _)" [0, 0, 10] 10)

  "_Bleast"     :: "id => 'a set => bool => 'a"           ("(3LEAST _:_./ _)" [0, 0, 10] 10)

syntax (HOL)

  "_Ball"       :: "pttrn => 'a set => bool => bool"      ("(3! _:_./ _)" [0, 0, 10] 10)

  "_Bex"        :: "pttrn => 'a set => bool => bool"      ("(3? _:_./ _)" [0, 0, 10] 10)

  "_Bex1"       :: "pttrn => 'a set => bool => bool"      ("(3?! _:_./ _)" [0, 0, 10] 10)

syntax (xsymbols)

  "_Ball"       :: "pttrn => 'a set => bool => bool"      ("(3\<forall>_\<in>_./ _)" [0, 0, 10] 10)

  "_Bex"        :: "pttrn => 'a set => bool => bool"      ("(3\<exists>_\<in>_./ _)" [0, 0, 10] 10)

  "_Bex1"       :: "pttrn => 'a set => bool => bool"      ("(3\<exists>!_\<in>_./ _)" [0, 0, 10] 10)

  "_Bleast"     :: "id => 'a set => bool => 'a"           ("(3LEAST_\<in>_./ _)" [0, 0, 10] 10)

syntax (HTML output)

  "_Ball"       :: "pttrn => 'a set => bool => bool"      ("(3\<forall>_\<in>_./ _)" [0, 0, 10] 10)

  "_Bex"        :: "pttrn => 'a set => bool => bool"      ("(3\<exists>_\<in>_./ _)" [0, 0, 10] 10)

  "_Bex1"       :: "pttrn => 'a set => bool => bool"      ("(3\<exists>!_\<in>_./ _)" [0, 0, 10] 10)

translations

  "ALL x:A. P"  == "Ball A (%x. P)"

  "EX x:A. P"   == "Bex A (%x. P)"

  "EX! x:A. P"  == "Bex1 A (%x. P)"

  "LEAST x:A. P" => "LEAST x. x:A & P"

definition INTER :: "'a set \<Rightarrow> ('a \<Rightarrow> 'b set) \<Rightarrow> 'b set" where

  "INTER A B \<equiv> {y. \<forall>x\<in>A. y \<in> B x}"

definition UNION :: "'a set \<Rightarrow> ('a \<Rightarrow> 'b set) \<Rightarrow> 'b set" where

  "UNION A B \<equiv> {y. \<exists>x\<in>A. y \<in> B x}"

definition Inter :: "'a set set \<Rightarrow> 'a set" where

  "Inter S \<equiv> INTER S (\<lambda>x. x)"

definition Union :: "'a set set \<Rightarrow> 'a set" where

  "Union S \<equiv> UNION S (\<lambda>x. x)"

notation (xsymbols)

  Inter  ("\<Inter>_" [90] 90) and

  Union  ("\<Union>_" [90] 90)

subsection {* Additional concrete syntax *}

syntax

  "@SetCompr"   :: "'a => idts => bool => 'a set"         ("(1{_ |/_./ _})")

  "@Collect"    :: "idt => 'a set => bool => 'a set"      ("(1{_ :/ _./ _})")

  "@INTER1"     :: "pttrns => 'b set => 'b set"           ("(3INT _./ _)" [0, 10] 10)

  "@UNION1"     :: "pttrns => 'b set => 'b set"           ("(3UN _./ _)" [0, 10] 10)

  "@INTER"      :: "pttrn => 'a set => 'b set => 'b set"  ("(3INT _:_./ _)" [0, 10] 10)

  "@UNION"      :: "pttrn => 'a set => 'b set => 'b set"  ("(3UN _:_./ _)" [0, 10] 10)

syntax (xsymbols)

  "@Collect"    :: "idt => 'a set => bool => 'a set"      ("(1{_ \<in>/ _./ _})")

  "@INTER1"     :: "pttrns => 'b set => 'b set"           ("(3\<Inter>_./ _)" [0, 10] 10)

  "@UNION1"     :: "pttrns => 'b set => 'b set"           ("(3\<Union>_./ _)" [0, 10] 10)

  "@INTER"      :: "pttrn => 'a set => 'b set => 'b set"  ("(3\<Inter>_\<in>_./ _)" [0, 10] 10)

  "@UNION"      :: "pttrn => 'a set => 'b set => 'b set"  ("(3\<Union>_\<in>_./ _)" [0, 10] 10)

syntax (latex output)

  "@INTER1"     :: "pttrns => 'b set => 'b set"           ("(3\<Inter>(00\<^bsub>_\<^esub>)/ _)" [0, 10] 10)

  "@UNION1"     :: "pttrns => 'b set => 'b set"           ("(3\<Union>(00\<^bsub>_\<^esub>)/ _)" [0, 10] 10)

  "@INTER"      :: "pttrn => 'a set => 'b set => 'b set"  ("(3\<Inter>(00\<^bsub>_\<in>_\<^esub>)/ _)" [0, 10] 10)

  "@UNION"      :: "pttrn => 'a set => 'b set => 'b set"  ("(3\<Union>(00\<^bsub>_\<in>_\<^esub>)/ _)" [0, 10] 10)

translations

  "{x:A. P}"    => "{x. x:A & P}"

  "INT x y. B"  == "INT x. INT y. B"

  "INT x. B"    == "CONST INTER CONST UNIV (%x. B)"

  "INT x. B"    == "INT x:CONST UNIV. B"

  "INT x:A. B"  == "CONST INTER A (%x. B)"

  "UN x y. B"   == "UN x. UN y. B"

  "UN x. B"     == "CONST UNION CONST UNIV (%x. B)"

  "UN x. B"     == "UN x:CONST UNIV. B"

  "UN x:A. B"   == "CONST UNION A (%x. B)"

text {*

  Note the difference between ordinary xsymbol syntax of indexed

  unions and intersections (e.g.\ @{text"\<Union>a\<^isub>1\<in>A\<^isub>1. B"})

  and their \LaTeX\ rendition: @{term"\<Union>a\<^isub>1\<in>A\<^isub>1. B"}. The

  former does not make the index expression a subscript of the

  union/intersection symbol because this leads to problems with nested

  subscripts in Proof General.

*}

abbreviation

  subset :: "'a set \<Rightarrow> 'a set \<Rightarrow> bool" where

  "subset \<equiv> less"

abbreviation

  subset_eq :: "'a set \<Rightarrow> 'a set \<Rightarrow> bool" where

  "subset_eq \<equiv> less_eq"

notation (output)

  subset  ("op <") and

  subset  ("(_/ < _)" [50, 51] 50) and

  subset_eq  ("op <=") and

  subset_eq  ("(_/ <= _)" [50, 51] 50)

notation (xsymbols)

  subset  ("op \<subset>") and

  subset  ("(_/ \<subset> _)" [50, 51] 50) and

  subset_eq  ("op \<subseteq>") and

  subset_eq  ("(_/ \<subseteq> _)" [50, 51] 50)

notation (HTML output)

  subset  ("op \<subset>") and

  subset  ("(_/ \<subset> _)" [50, 51] 50) and

  subset_eq  ("op \<subseteq>") and

  subset_eq  ("(_/ \<subseteq> _)" [50, 51] 50)

abbreviation (input)

  supset :: "'a set \<Rightarrow> 'a set \<Rightarrow> bool" where

  "supset \<equiv> greater"

abbreviation (input)

  supset_eq :: "'a set \<Rightarrow> 'a set \<Rightarrow> bool" where

  "supset_eq \<equiv> greater_eq"

notation (xsymbols)

  supset  ("op \<supset>") and

  supset  ("(_/ \<supset> _)" [50, 51] 50) and

  supset_eq  ("op \<supseteq>") and

  supset_eq  ("(_/ \<supseteq> _)" [50, 51] 50)

abbreviation

  range :: "('a => 'b) => 'b set" where -- "of function"

  "range f == f ` UNIV"

subsubsection "Bounded quantifiers"

syntax (output)

  "_setlessAll" :: "[idt, 'a, bool] => bool"  ("(3ALL _<_./ _)"  [0, 0, 10] 10)

  "_setlessEx"  :: "[idt, 'a, bool] => bool"  ("(3EX _<_./ _)"  [0, 0, 10] 10)

  "_setleAll"   :: "[idt, 'a, bool] => bool"  ("(3ALL _<=_./ _)" [0, 0, 10] 10)

  "_setleEx"    :: "[idt, 'a, bool] => bool"  ("(3EX _<=_./ _)" [0, 0, 10] 10)

  "_setleEx1"   :: "[idt, 'a, bool] => bool"  ("(3EX! _<=_./ _)" [0, 0, 10] 10)

syntax (xsymbols)

  "_setlessAll" :: "[idt, 'a, bool] => bool"   ("(3\<forall>_\<subset>_./ _)"  [0, 0, 10] 10)

  "_setlessEx"  :: "[idt, 'a, bool] => bool"   ("(3\<exists>_\<subset>_./ _)"  [0, 0, 10] 10)

  "_setleAll"   :: "[idt, 'a, bool] => bool"   ("(3\<forall>_\<subseteq>_./ _)" [0, 0, 10] 10)

  "_setleEx"    :: "[idt, 'a, bool] => bool"   ("(3\<exists>_\<subseteq>_./ _)" [0, 0, 10] 10)

  "_setleEx1"   :: "[idt, 'a, bool] => bool"   ("(3\<exists>!_\<subseteq>_./ _)" [0, 0, 10] 10)

syntax (HOL output)

  "_setlessAll" :: "[idt, 'a, bool] => bool"   ("(3! _<_./ _)"  [0, 0, 10] 10)

  "_setlessEx"  :: "[idt, 'a, bool] => bool"   ("(3? _<_./ _)"  [0, 0, 10] 10)

  "_setleAll"   :: "[idt, 'a, bool] => bool"   ("(3! _<=_./ _)" [0, 0, 10] 10)

  "_setleEx"    :: "[idt, 'a, bool] => bool"   ("(3? _<=_./ _)" [0, 0, 10] 10)

  "_setleEx1"   :: "[idt, 'a, bool] => bool"   ("(3?! _<=_./ _)" [0, 0, 10] 10)

syntax (HTML output)

  "_setlessAll" :: "[idt, 'a, bool] => bool"   ("(3\<forall>_\<subset>_./ _)"  [0, 0, 10] 10)

  "_setlessEx"  :: "[idt, 'a, bool] => bool"   ("(3\<exists>_\<subset>_./ _)"  [0, 0, 10] 10)

  "_setleAll"   :: "[idt, 'a, bool] => bool"   ("(3\<forall>_\<subseteq>_./ _)" [0, 0, 10] 10)

  "_setleEx"    :: "[idt, 'a, bool] => bool"   ("(3\<exists>_\<subseteq>_./ _)" [0, 0, 10] 10)

  "_setleEx1"   :: "[idt, 'a, bool] => bool"   ("(3\<exists>!_\<subseteq>_./ _)" [0, 0, 10] 10)

translations

 "\<forall>A\<subset>B. P"   =>  "ALL A. A \<subset> B --> P"

 "\<exists>A\<subset>B. P"   =>  "EX A. A \<subset> B & P"

 "\<forall>A\<subseteq>B. P"   =>  "ALL A. A \<subseteq> B --> P"

 "\<exists>A\<subseteq>B. P"   =>  "EX A. A \<subseteq> B & P"

 "\<exists>!A\<subseteq>B. P"  =>  "EX! A. A \<subseteq> B & P"

print_translation {*

let

  val Type (set_type, _) = @{typ "'a set"};

  val All_binder = Syntax.binder_name @{const_syntax "All"};

  val Ex_binder = Syntax.binder_name @{const_syntax "Ex"};

  val impl = @{const_syntax "op -->"};

  val conj = @{const_syntax "op &"};

  val sbset = @{const_syntax "subset"};

  val sbset_eq = @{const_syntax "subset_eq"};

  val trans =

   [((All_binder, impl, sbset), "_setlessAll"),

    ((All_binder, impl, sbset_eq), "_setleAll"),

    ((Ex_binder, conj, sbset), "_setlessEx"),

    ((Ex_binder, conj, sbset_eq), "_setleEx")];

  fun mk v v' c n P =

    if v = v' andalso not (Term.exists_subterm (fn Free (x, _) => x = v | _ => false) n)

    then Syntax.const c $ Syntax.mark_bound v' $ n $ P else raise Match;

  fun tr' q = (q,

    fn [Const ("_bound", _) $ Free (v, Type (T, _)), Const (c, _) $ (Const (d, _) $ (Const ("_bound", _) $ Free (v', _)) $ n) $ P] =>

         if T = (set_type) then case AList.lookup (op =) trans (q, c, d)

          of NONE => raise Match

           | SOME l => mk v v' l n P

         else raise Match

     | _ => raise Match);

in

  [tr' All_binder, tr' Ex_binder]

end

*}

text {*

  \medskip Translate between @{text "{e | x1...xn. P}"} and @{text

  "{u. EX x1..xn. u = e & P}"}; @{text "{y. EX x1..xn. y = e & P}"} is

  only translated if @{text "[0..n] subset bvs(e)"}.

*}

parse_translation {*

  let

    val ex_tr = snd (mk_binder_tr ("EX ", "Ex"));

    fun nvars (Const ("_idts", _) $ _ $ idts) = nvars idts + 1

      | nvars _ = 1;

    fun setcompr_tr [e, idts, b] =

      let

        val eq = Syntax.const "op =" $ Bound (nvars idts) $ e;

        val P = Syntax.const "op &" $ eq $ b;

        val exP = ex_tr [idts, P];

      in Syntax.const "Collect" $ Term.absdummy (dummyT, exP) end;

  in [("@SetCompr", setcompr_tr)] end;

*}

(* To avoid eta-contraction of body: *)

print_translation {*

let

  fun btr' syn [A, Abs abs] =

    let val (x, t) = atomic_abs_tr' abs

    in Syntax.const syn $ x $ A $ t end

in

[(@{const_syntax Ball}, btr' "_Ball"), (@{const_syntax Bex}, btr' "_Bex"),

 (@{const_syntax UNION}, btr' "@UNION"),(@{const_syntax INTER}, btr' "@INTER")]

end

*}

print_translation {*

let

  val ex_tr' = snd (mk_binder_tr' ("Ex", "DUMMY"));

  fun setcompr_tr' [Abs (abs as (_, _, P))] =

    let

      fun check (Const ("Ex", _) $ Abs (_, _, P), n) = check (P, n + 1)

        | check (Const ("op &", _) $ (Const ("op =", _) $ Bound m $ e) $ P, n) =

            n > 0 andalso m = n andalso not (loose_bvar1 (P, n)) andalso

            ((0 upto (n - 1)) subset add_loose_bnos (e, 0, []))

        | check _ = false

        fun tr' (_ $ abs) =

          let val _ $ idts $ (_ $ (_ $ _ $ e) $ Q) = ex_tr' [abs]

          in Syntax.const "@SetCompr" $ e $ idts $ Q end;

    in if check (P, 0) then tr' P

       else let val (x as _ $ Free(xN,_), t) = atomic_abs_tr' abs

                val M = Syntax.const "@Coll" $ x $ t

            in case t of

                 Const("op &",_)

                   $ (Const("op :",_) $ (Const("_bound",_) $ Free(yN,_)) $ A)

                   $ P =>

                   if xN=yN then Syntax.const "@Collect" $ x $ A $ P else M

               | _ => M

            end

    end;

  in [("Collect", setcompr_tr')] end;

*}

subsection {* Rules and definitions *}

text {* Isomorphisms between predicates and sets. *}

defs

  mem_def [code]: "x : S == S x"

  Collect_def [code]: "Collect P == P"

defs

  Ball_def:     "Ball A P       == ALL x. x:A --> P(x)"

  Bex_def:      "Bex A P        == EX x. x:A & P(x)"

  Bex1_def:     "Bex1 A P       == EX! x. x:A & P(x)"

instantiation "fun" :: (type, minus) minus

begin

definition

  fun_diff_def: "A - B = (%x. A x - B x)"

instance ..

end

instantiation bool :: minus

begin

definition

  bool_diff_def: "A - B = (A & ~ B)"

instance ..

end

instantiation "fun" :: (type, uminus) uminus

begin

definition

  fun_Compl_def: "- A = (%x. - A x)"

instance ..

end

instantiation bool :: uminus

begin

definition

  bool_Compl_def: "- A = (~ A)"

instance ..

end

defs

  Pow_def:      "Pow A          == {B. B <= A}"

  insert_def:   "insert a B     == {x. x=a} Un B"

  image_def:    "f`A            == {y. EX x:A. y = f(x)}"

subsection {* Lemmas and proof tool setup *}

subsubsection {* Relating predicates and sets *}

lemma mem_Collect_eq [iff]: "(a : {x. P(x)}) = P(a)"

  by (simp add: Collect_def mem_def)

lemma Collect_mem_eq [simp]: "{x. x:A} = A"

  by (simp add: Collect_def mem_def)

lemma CollectI: "P(a) ==> a : {x. P(x)}"

  by simp

lemma CollectD: "a : {x. P(x)} ==> P(a)"

  by simp

lemma Collect_cong: "(!!x. P x = Q x) ==> {x. P(x)} = {x. Q(x)}"

  by simp

lemmas CollectE = CollectD [elim_format]

subsubsection {* Bounded quantifiers *}

lemma ballI [intro!]: "(!!x. x:A ==> P x) ==> ALL x:A. P x"

  by (simp add: Ball_def)

lemmas strip = impI allI ballI

lemma bspec [dest?]: "ALL x:A. P x ==> x:A ==> P x"

  by (simp add: Ball_def)

lemma ballE [elim]: "ALL x:A. P x ==> (P x ==> Q) ==> (x ~: A ==> Q) ==> Q"

  by (unfold Ball_def) blast

ML {* bind_thm ("rev_ballE", permute_prems 1 1 @{thm ballE}) *}

text {*

  \medskip This tactic takes assumptions @{prop "ALL x:A. P x"} and

  @{prop "a:A"}; creates assumption @{prop "P a"}.

*}

ML {*

  fun ball_tac i = etac @{thm ballE} i THEN contr_tac (i + 1)

*}

text {*

  Gives better instantiation for bound:

*}

declaration {* fn _ =>

  Classical.map_cs (fn cs => cs addbefore ("bspec", datac @{thm bspec} 1))

*}

lemma bexI [intro]: "P x ==> x:A ==> EX x:A. P x"

  -- {* Normally the best argument order: @{prop "P x"} constrains the

    choice of @{prop "x:A"}. *}

  by (unfold Bex_def) blast

lemma rev_bexI [intro?]: "x:A ==> P x ==> EX x:A. P x"

  -- {* The best argument order when there is only one @{prop "x:A"}. *}

  by (unfold Bex_def) blast

lemma bexCI: "(ALL x:A. ~P x ==> P a) ==> a:A ==> EX x:A. P x"

  by (unfold Bex_def) blast

lemma bexE [elim!]: "EX x:A. P x ==> (!!x. x:A ==> P x ==> Q) ==> Q"

  by (unfold Bex_def) blast

lemma ball_triv [simp]: "(ALL x:A. P) = ((EX x. x:A) --> P)"

  -- {* Trival rewrite rule. *}

  by (simp add: Ball_def)

lemma bex_triv [simp]: "(EX x:A. P) = ((EX x. x:A) & P)"

  -- {* Dual form for existentials. *}

  by (simp add: Bex_def)

lemma bex_triv_one_point1 [simp]: "(EX x:A. x = a) = (a:A)"

  by blast

lemma bex_triv_one_point2 [simp]: "(EX x:A. a = x) = (a:A)"

  by blast

lemma bex_one_point1 [simp]: "(EX x:A. x = a & P x) = (a:A & P a)"

  by blast

lemma bex_one_point2 [simp]: "(EX x:A. a = x & P x) = (a:A & P a)"

  by blast

lemma ball_one_point1 [simp]: "(ALL x:A. x = a --> P x) = (a:A --> P a)"

  by blast

lemma ball_one_point2 [simp]: "(ALL x:A. a = x --> P x) = (a:A --> P a)"

  by blast

ML {*

  local

    val unfold_bex_tac = unfold_tac @{thms "Bex_def"};

    fun prove_bex_tac ss = unfold_bex_tac ss THEN Quantifier1.prove_one_point_ex_tac;

    val rearrange_bex = Quantifier1.rearrange_bex prove_bex_tac;

    val unfold_ball_tac = unfold_tac @{thms "Ball_def"};

    fun prove_ball_tac ss = unfold_ball_tac ss THEN Quantifier1.prove_one_point_all_tac;

    val rearrange_ball = Quantifier1.rearrange_ball prove_ball_tac;

  in

    val defBEX_regroup = Simplifier.simproc (the_context ())

      "defined BEX" ["EX x:A. P x & Q x"] rearrange_bex;

    val defBALL_regroup = Simplifier.simproc (the_context ())

      "defined BALL" ["ALL x:A. P x --> Q x"] rearrange_ball;

  end;

  Addsimprocs [defBALL_regroup, defBEX_regroup];

*}

subsubsection {* Congruence rules *}

lemma ball_cong:

  "A = B ==> (!!x. x:B ==> P x = Q x) ==>

    (ALL x:A. P x) = (ALL x:B. Q x)"

  by (simp add: Ball_def)

lemma strong_ball_cong [cong]:

  "A = B ==> (!!x. x:B =simp=> P x = Q x) ==>

    (ALL x:A. P x) = (ALL x:B. Q x)"

  by (simp add: simp_implies_def Ball_def)

lemma bex_cong:

  "A = B ==> (!!x. x:B ==> P x = Q x) ==>

    (EX x:A. P x) = (EX x:B. Q x)"

  by (simp add: Bex_def cong: conj_cong)

lemma strong_bex_cong [cong]:

  "A = B ==> (!!x. x:B =simp=> P x = Q x) ==>

    (EX x:A. P x) = (EX x:B. Q x)"

  by (simp add: simp_implies_def Bex_def cong: conj_cong)

subsubsection {* Subsets *}

lemma subsetI [atp,intro!]: "(!!x. x:A ==> x:B) ==> A \<subseteq> B"

  by (auto simp add: mem_def intro: predicate1I)

text {*

  \medskip Map the type @{text "'a set => anything"} to just @{typ

  'a}; for overloading constants whose first argument has type @{typ

  "'a set"}.

*}

lemma subsetD [elim]: "A \<subseteq> B ==> c \<in> A ==> c \<in> B"

  -- {* Rule in Modus Ponens style. *}

  by (unfold mem_def) blast

declare subsetD [intro?] -- FIXME

lemma rev_subsetD: "c \<in> A ==> A \<subseteq> B ==> c \<in> B"

  -- {* The same, with reversed premises for use with @{text erule} --

      cf @{text rev_mp}. *}

  by (rule subsetD)

declare rev_subsetD [intro?] -- FIXME

text {*

  \medskip Converts @{prop "A \<subseteq> B"} to @{prop "x \<in> A ==> x \<in> B"}.

*}

ML {*

  fun impOfSubs th = th RSN (2, @{thm rev_subsetD})

*}

lemma subsetCE [elim]: "A \<subseteq>  B ==> (c \<notin> A ==> P) ==> (c \<in> B ==> P) ==> P"

  -- {* Classical elimination rule. *}

  by (unfold mem_def) blast

lemma subset_eq: "A \<le> B = (\<forall>x\<in>A. x \<in> B)" by blast

text {*

  \medskip Takes assumptions @{prop "A \<subseteq> B"}; @{prop "c \<in> A"} and

  creates the assumption @{prop "c \<in> B"}.

*}

ML {*

  fun set_mp_tac i = etac @{thm subsetCE} i THEN mp_tac i

*}

lemma contra_subsetD: "A \<subseteq> B ==> c \<notin> B ==> c \<notin> A"

  by blast

lemma subset_refl [simp,atp]: "A \<subseteq> A"

  by fast

lemma subset_trans: "A \<subseteq> B ==> B \<subseteq> C ==> A \<subseteq> C"

  by blast

subsubsection {* Equality *}

lemma set_ext: assumes prem: "(!!x. (x:A) = (x:B))" shows "A = B"

  apply (rule prem [THEN ext, THEN arg_cong, THEN box_equals])

   apply (rule Collect_mem_eq)

  apply (rule Collect_mem_eq)

  done

(* Due to Brian Huffman *)

lemma expand_set_eq: "(A = B) = (ALL x. (x:A) = (x:B))"

by(auto intro:set_ext)

lemma subset_antisym [intro!]: "A \<subseteq> B ==> B \<subseteq> A ==> A = B"

  -- {* Anti-symmetry of the subset relation. *}

  by (iprover intro: set_ext subsetD)

lemmas equalityI [intro!] = subset_antisym

text {*

  \medskip Equality rules from ZF set theory -- are they appropriate

  here?

*}

lemma equalityD1: "A = B ==> A \<subseteq> B"

  by (simp add: subset_refl)

lemma equalityD2: "A = B ==> B \<subseteq> A"

  by (simp add: subset_refl)

text {*

  \medskip Be careful when adding this to the claset as @{text

  subset_empty} is in the simpset: @{prop "A = {}"} goes to @{prop "{}

  \<subseteq> A"} and @{prop "A \<subseteq> {}"} and then back to @{prop "A = {}"}!

*}

lemma equalityE: "A = B ==> (A \<subseteq> B ==> B \<subseteq> A ==> P) ==> P"

  by (simp add: subset_refl)

lemma equalityCE [elim]:

    "A = B ==> (c \<in> A ==> c \<in> B ==> P) ==> (c \<notin> A ==> c \<notin> B ==> P) ==> P"

  by blast

lemma eqset_imp_iff: "A = B ==> (x : A) = (x : B)"

  by simp

lemma eqelem_imp_iff: "x = y ==> (x : A) = (y : A)"

  by simp

subsubsection {* The universal set -- UNIV *}

lemma UNIV_I [simp]: "x : UNIV"

  by (simp add: UNIV_def)

declare UNIV_I [intro]  -- {* unsafe makes it less likely to cause problems *}

lemma UNIV_witness [intro?]: "EX x. x : UNIV"

  by simp

lemma subset_UNIV [simp]: "A \<subseteq> UNIV"

  by (rule subsetI) (rule UNIV_I)

text {*

  \medskip Eta-contracting these two rules (to remove @{text P})

  causes them to be ignored because of their interaction with

  congruence rules.

*}

lemma ball_UNIV [simp]: "Ball UNIV P = All P"

  by (simp add: Ball_def)

lemma bex_UNIV [simp]: "Bex UNIV P = Ex P"

  by (simp add: Bex_def)

lemma UNIV_eq_I: "(\<And>x. x \<in> A) \<Longrightarrow> UNIV = A"

  by auto

subsubsection {* The empty set *}

lemma empty_iff [simp]: "(c : {}) = False"

  by (simp add: empty_def)

lemma emptyE [elim!]: "a : {} ==> P"

  by simp

lemma empty_subsetI [iff]: "{} \<subseteq> A"

    -- {* One effect is to delete the ASSUMPTION @{prop "{} <= A"} *}

  by blast

lemma equals0I: "(!!y. y \<in> A ==> False) ==> A = {}"

  by blast

lemma equals0D: "A = {} ==> a \<notin> A"

    -- {* Use for reasoning about disjointness: @{prop "A Int B = {}"} *}

  by blast

lemma ball_empty [simp]: "Ball {} P = True"

  by (simp add: Ball_def)

lemma bex_empty [simp]: "Bex {} P = False"

  by (simp add: Bex_def)

lemma UNIV_not_empty [iff]: "UNIV ~= {}"

  by (blast elim: equalityE)

subsubsection {* The Powerset operator -- Pow *}

lemma Pow_iff [iff]: "(A \<in> Pow B) = (A \<subseteq> B)"

  by (simp add: Pow_def)

lemma PowI: "A \<subseteq> B ==> A \<in> Pow B"

  by (simp add: Pow_def)

lemma PowD: "A \<in> Pow B ==> A \<subseteq> B"

  by (simp add: Pow_def)

lemma Pow_bottom: "{} \<in> Pow B"

  by simp

lemma Pow_top: "A \<in> Pow A"

  by (simp add: subset_refl)

subsubsection {* Set complement *}

lemma Compl_iff [simp]: "(c \<in> -A) = (c \<notin> A)"

  by (simp add: mem_def fun_Compl_def bool_Compl_def)

lemma ComplI [intro!]: "(c \<in> A ==> False) ==> c \<in> -A"

  by (unfold mem_def fun_Compl_def bool_Compl_def) blast

text {*

  \medskip This form, with negated conclusion, works well with the

  Classical prover.  Negated assumptions behave like formulae on the

  right side of the notional turnstile ... *}

lemma ComplD [dest!]: "c : -A ==> c~:A"

  by (simp add: mem_def fun_Compl_def bool_Compl_def)

lemmas ComplE = ComplD [elim_format]

lemma Compl_eq: "- A = {x. ~ x : A}" by blast

subsubsection {* Binary union -- Un *}

lemma Un_iff [simp]: "(c : A Un B) = (c:A | c:B)"

  by (unfold Un_def) blast

lemma UnI1 [elim?]: "c:A ==> c : A Un B"

  by simp

lemma UnI2 [elim?]: "c:B ==> c : A Un B"

  by simp

text {*

  \medskip Classical introduction rule: no commitment to @{prop A} vs

  @{prop B}.

*}

lemma UnCI [intro!]: "(c~:B ==> c:A) ==> c : A Un B"

  by auto

lemma UnE [elim!]: "c : A Un B ==> (c:A ==> P) ==> (c:B ==> P) ==> P"

  by (unfold Un_def) blast

subsubsection {* Binary intersection -- Int *}

lemma Int_iff [simp]: "(c : A Int B) = (c:A & c:B)"

  by (unfold Int_def) blast

lemma IntI [intro!]: "c:A ==> c:B ==> c : A Int B"

  by simp

lemma IntD1: "c : A Int B ==> c:A"

  by simp

lemma IntD2: "c : A Int B ==> c:B"

  by simp

lemma IntE [elim!]: "c : A Int B ==> (c:A ==> c:B ==> P) ==> P"

  by simp

subsubsection {* Set difference *}

lemma Diff_iff [simp]: "(c : A - B) = (c:A & c~:B)"

  by (simp add: mem_def fun_diff_def bool_diff_def)

lemma DiffI [intro!]: "c : A ==> c ~: B ==> c : A - B"

  by simp

lemma DiffD1: "c : A - B ==> c : A"

  by simp

lemma DiffD2: "c : A - B ==> c : B ==> P"

  by simp

lemma DiffE [elim!]: "c : A - B ==> (c:A ==> c~:B ==> P) ==> P"

  by simp

lemma set_diff_eq: "A - B = {x. x : A & ~ x : B}" by blast

lemma Compl_eq_Diff_UNIV: "-A = (UNIV - A)"

by blast

subsubsection {* Augmenting a set -- insert *}

lemma insert_iff [simp]: "(a : insert b A) = (a = b | a:A)"

  by (unfold insert_def) blast

lemma insertI1: "a : insert a B"

  by simp

lemma insertI2: "a : B ==> a : insert b B"

  by simp

lemma insertE [elim!]: "a : insert b A ==> (a = b ==> P) ==> (a:A ==> P) ==> P"

  by (unfold insert_def) blast

lemma insertCI [intro!]: "(a~:B ==> a = b) ==> a: insert b B"

  -- {* Classical introduction rule. *}

  by auto

lemma subset_insert_iff: "(A \<subseteq> insert x B) = (if x:A then A - {x} \<subseteq> B else A \<subseteq> B)"

  by auto

lemma set_insert:

  assumes "x \<in> A"

  obtains B where "A = insert x B" and "x \<notin> B"

proof

  from assms show "A = insert x (A - {x})" by blast

next

  show "x \<notin> A - {x}" by blast

qed

lemma insert_ident: "x ~: A ==> x ~: B ==> (insert x A = insert x B) = (A = B)"

by auto

subsubsection {* Singletons, using insert *}

lemma singletonI [intro!,noatp]: "a : {a}"

    -- {* Redundant? But unlike @{text insertCI}, it proves the subgoal immediately! *}

  by (rule insertI1)

lemma singletonD [dest!,noatp]: "b : {a} ==> b = a"

  by blast

lemmas singletonE = singletonD [elim_format]

lemma singleton_iff: "(b : {a}) = (b = a)"

  by blast

lemma singleton_inject [dest!]: "{a} = {b} ==> a = b"

  by blast

lemma singleton_insert_inj_eq [iff,noatp]:

     "({b} = insert a A) = (a = b & A \<subseteq> {b})"

  by blast

lemma singleton_insert_inj_eq' [iff,noatp]:

     "(insert a A = {b}) = (a = b & A \<subseteq> {b})"

  by blast

lemma subset_singletonD: "A \<subseteq> {x} ==> A = {} | A = {x}"

  by fast

lemma singleton_conv [simp]: "{x. x = a} = {a}"

  by blast

lemma singleton_conv2 [simp]: "{x. a = x} = {a}"

  by blast

lemma diff_single_insert: "A - {x} \<subseteq> B ==> x \<in> A ==> A \<subseteq> insert x B"

  by blast

lemma doubleton_eq_iff: "({a,b} = {c,d}) = (a=c & b=d | a=d & b=c)"

  by (blast elim: equalityE)

subsubsection {* Unions of families *}

text {*

  @{term [source] "UN x:A. B x"} is @{term "Union (B`A)"}.

*}

declare UNION_def [noatp]

lemma UN_iff [simp]: "(b: (UN x:A. B x)) = (EX x:A. b: B x)"

  by (unfold UNION_def) blast

lemma UN_I [intro]: "a:A ==> b: B a ==> b: (UN x:A. B x)"

  -- {* The order of the premises presupposes that @{term A} is rigid;

    @{term b} may be flexible. *}

  by auto

lemma UN_E [elim!]: "b : (UN x:A. B x) ==> (!!x. x:A ==> b: B x ==> R) ==> R"

  by (unfold UNION_def) blast

lemma UN_cong [cong]:

    "A = B ==> (!!x. x:B ==> C x = D x) ==> (UN x:A. C x) = (UN x:B. D x)"

  by (simp add: UNION_def)

lemma strong_UN_cong:

    "A = B ==> (!!x. x:B =simp=> C x = D x) ==> (UN x:A. C x) = (UN x:B. D x)"

  by (simp add: UNION_def simp_implies_def)

subsubsection {* Intersections of families *}

text {* @{term [source] "INT x:A. B x"} is @{term "Inter (B`A)"}. *}

lemma INT_iff [simp]: "(b: (INT x:A. B x)) = (ALL x:A. b: B x)"

  by (unfold INTER_def) blast

lemma INT_I [intro!]: "(!!x. x:A ==> b: B x) ==> b : (INT x:A. B x)"

  by (unfold INTER_def) blast

lemma INT_D [elim]: "b : (INT x:A. B x) ==> a:A ==> b: B a"

  by auto

lemma INT_E [elim]: "b : (INT x:A. B x) ==> (b: B a ==> R) ==> (a~:A ==> R) ==> R"

  -- {* "Classical" elimination -- by the Excluded Middle on @{prop "a:A"}. *}

  by (unfold INTER_def) blast

lemma INT_cong [cong]:

    "A = B ==> (!!x. x:B ==> C x = D x) ==> (INT x:A. C x) = (INT x:B. D x)"

  by (simp add: INTER_def)

subsubsection {* Union *}

lemma Union_iff [simp,noatp]: "(A : Union C) = (EX X:C. A:X)"

  by (unfold Union_def) blast

lemma UnionI [intro]: "X:C ==> A:X ==> A : Union C"

  -- {* The order of the premises presupposes that @{term C} is rigid;

    @{term A} may be flexible. *}

  by auto

lemma UnionE [elim!]: "A : Union C ==> (!!X. A:X ==> X:C ==> R) ==> R"

  by (unfold Union_def) blast

subsubsection {* Inter *}

lemma Inter_iff [simp,noatp]: "(A : Inter C) = (ALL X:C. A:X)"

  by (unfold Inter_def) blast

lemma InterI [intro!]: "(!!X. X:C ==> A:X) ==> A : Inter C"

  by (simp add: Inter_def)

text {*

  \medskip A ``destruct'' rule -- every @{term X} in @{term C}

  contains @{term A} as an element, but @{prop "A:X"} can hold when

  @{prop "X:C"} does not!  This rule is analogous to @{text spec}.

*}

lemma InterD [elim]: "A : Inter C ==> X:C ==> A:X"

  by auto

lemma InterE [elim]: "A : Inter C ==> (X~:C ==> R) ==> (A:X ==> R) ==> R"

  -- {* ``Classical'' elimination rule -- does not require proving

    @{prop "X:C"}. *}

  by (unfold Inter_def) blast

text {*

  \medskip Image of a set under a function.  Frequently @{term b} does

  not have the syntactic form of @{term "f x"}.

*}

declare image_def [noatp]

lemma image_eqI [simp, intro]: "b = f x ==> x:A ==> b : f`A"

  by (unfold image_def) blast

lemma imageI: "x : A ==> f x : f ` A"

  by (rule image_eqI) (rule refl)

lemma rev_image_eqI: "x:A ==> b = f x ==> b : f`A"

  -- {* This version's more effective when we already have the